rthfsocprq.trafficsdoctor.org Open in urlscan Pro
188.114.96.3 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://email.app.bamboohr.com/c/eJyMkE3LGjEAhH9Nctsln7u-hxysVohUS1tF8SL5bCKbZNmNwv77YttjD70NzDDwPKak9MzRqBpLvkcrLOWOcGYaTJFtMH...
Effective URL:
https://rthfsocprq.trafficsdoctor.org/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3...
Submission: On May 16 via manual (May 16th 2024, 10:51:28 pm UTC) from PH — Scanned from DE

Summary HTTP 31 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 3 IPs in 2 countries across 2 domains to perform 31 HTTP transactions. The main IP is 188.114.96.3, located in Amsterdam, Netherlands and belongs to CLOUDFLARENET, US. The main domain is rthfsocprq.trafficsdoctor.org.
TLS certificate: Issued by E1 on May 12th 2024. Valid for: 3 months.

This is the only time rthfsocprq.trafficsdoctor.org was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2606:4700::68... 2606:4700::6811:f670	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3 20	188.114.96.3 188.114.96.3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	188.114.97.3 188.114.97.3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
31	3

1 2606:4700::6811:f670 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

email.app.bamboohr.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

20 188.114.96.3 (Amsterdam, Netherlands) 3 redirects

ASN13335 (CLOUDFLARENET, US)

rthfsmeheff.trafficsdoctor.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
rthfsocprq.trafficsdoctor.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
rthfshefbew.trafficsdoctor.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
rthfshrvetbr.trafficsdoctor.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
rthfsdjrhte.trafficsdoctor.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 188.114.97.3 (Amsterdam, Netherlands)

ASN13335 (CLOUDFLARENET, US)

rthfsdjrhte.trafficsdoctor.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
24	trafficsdoctor.org 3 redirects rthfsmeheff.trafficsdoctor.org rthfsocprq.trafficsdoctor.org rthfshefbew.trafficsdoctor.org rthfsdjrhte.trafficsdoctor.org Failed rthfshrvetbr.trafficsdoctor.org	345 KB
1	bamboohr.com 1 redirects email.app.bamboohr.com — Cisco Umbrella Rank: 108018	370 B
31	2

	Domain	Requested by
13	rthfsdjrhte.trafficsdoctor.org	rthfsocprq.trafficsdoctor.org rthfsdjrhte.trafficsdoctor.org
7	rthfsocprq.trafficsdoctor.org	1 redirects rthfsocprq.trafficsdoctor.org rthfsdjrhte.trafficsdoctor.org
2	rthfshrvetbr.trafficsdoctor.org	rthfsocprq.trafficsdoctor.org rthfsdjrhte.trafficsdoctor.org
1	rthfshefbew.trafficsdoctor.org	1 redirects
1	rthfsmeheff.trafficsdoctor.org	1 redirects
1	email.app.bamboohr.com	1 redirects
31	6

This site contains links to these domains. Also see Links.

Domain
rthfshrvetbr.trafficsdoctor.org
www.microsoft.com
privacy.microsoft.com

Subject Issuer	Validity	Valid
trafficsdoctor.org E1	`2024-05-12` - `2024-08-10`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://rthfsocprq.trafficsdoctor.org/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638514966834378742.MDBjYTFmMzItZDVmMC00MmNhLWFhOTYtNmM1NDM4MmFlM2Y0MDM1YjU1NjYtNjMwNy00YWMwLTg4YmItMjIxNjU3MTZmZTNj&ui_locales=de-DE&mkt=de-DE&client-request-id=cae916fc-0aa6-47ac-b232-1040fad8c8ea&state=jjrnl31dBLbT42FPgwbv-u4-wuU6OfNjpHU9VIeFVKYlOjoSnvjnjyLXeJjm8fl_iI7e_6Bx_xbUNk9sLGn2E8KAeg1J8dyVN1p8CdIn3BcP1xUZdpnSRPCPp3GbKpiocldVQP-sZKgNfaP2y0MFyC_c5BsphS2FDuIns7kk2KUN2XKwfN04-3A097rrckNZy33L9OfpQa6Gf3_s0DvtT3Dxjn39K7kX7pbam6belL3t8Y6m6DTNkYPKMgAR31VynHA8yMlo_jJZTNQ19fGsoQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true
Frame ID: 6F2A9DEE9019728F2145A7672262E203
Requests: 30 HTTP requests in this frame

Frame: https://rthfshrvetbr.trafficsdoctor.org/Me.htm?v=3
Frame ID: 29B3E207FE965760555883FA3B2961A4
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Bei Ihrem Konto anmelden

Page URL History Show full URLs

https://email.app.bamboohr.com/c/eJyMkE3LGjEAhH9Nctsln7u-hxysVohUS1tF8SL5bCKbZNmNwv77YttjD70NzDDwPKak9MzRqB... HTTP 302
https://rthfsmeheff.trafficsdoctor.org/NIvNycjX HTTP 302
https://rthfsocprq.trafficsdoctor.org/ HTTP 302
https://rthfshefbew.trafficsdoctor.org/login HTTP 302
https://rthfsocprq.trafficsdoctor.org/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&... Page URL
https://rthfsocprq.trafficsdoctor.org/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&... Page URL

Page Statistics

31
Requests

68 %
HTTPS

33 %
IPv6

2
Domains

6
Subdomains

3
IPs

2
Countries

342 kB
Transfer

1188 kB
Size

19
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://rthfshrvetbr.trafficsdoctor.org/oauth20_authorize.srf?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&scope=openid+profile+https%3a%2f%2frthfshefbew.trafficsdoctor.org%2fv2%2fOfficeHome.All&redirect_uri=https%3a%2f%2frthfshefbew.trafficsdoctor.org%2flandingv2&response_type=code+id_token&state=jjrnl31dBLbT42FPgwbv-u4-wuU6OfNjpHU9VIeFVKYlOjoSnvjnjyLXeJjm8fl_iI7e_6Bx_xbUNk9sLGn2E8KAeg1J8dyVN1p8CdIn3BcP1xUZdpnSRPCPp3GbKpiocldVQP-sZKgNfaP2y0MFyC_c5BsphS2FDuIns7kk2KUN2XKwfN04-3A097rrckNZy33L9OfpQa6Gf3_s0DvtT3Dxjn39K7kX7pbam6belL3t8Y6m6DTNkYPKMgAR31VynHA8yMlo_jJZTNQ19fGsoQ&response_mode=form_post&nonce=638514966834378742.MDBjYTFmMzItZDVmMC00MmNhLWFhOTYtNmM1NDM4MmFlM2Y0MDM1YjU1NjYtNjMwNy00YWMwLTg4YmItMjIxNjU3MTZmZTNj&x-client-SKU=ID_NET6_0&x-client-Ver=7.3.1.0&uaid=cae916fc0aa647acb2321040fad8c8ea&msproxy=1&issuer=mso&tenant=common&ui_locales=de-DE&signup=1&lw=1&fl=easi2&epct=PAQABDgEAAADnfolhJpSnRYB1SVj-Hgd8dg6WDj1x9Q1_--yR-iHRAMc48913vgI6m3y2ngx1X4KIFj43hS78fjpQH66mKr1HvGg-uzcYtzVBrTCQwdFqWea1_txdcfSJtZ9338nqCOGf8v4LtviEOTAsafjskTZcraacoOqNnkLlQLDqI_MjtQNA5JO_9usHl7JOjvWjS0mCau4tWTUVw9qaZXTdyO1HOl8HREkO6YHxr2RL_mMPUyAA&jshs=0
Title: Erstellen Sie jetzt eins!

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/de-DE/servicesagreement/
Title: Nutzungsbedingungen

Search URL Search Domain Scan URL

URL: https://privacy.microsoft.com/de-DE/privacystatement
Title: Datenschutz und Cookies

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/de-de/corporate/rechtliche-hinweise/impressum.aspx
Title: Haftungsausschluss

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://email.app.bamboohr.com/c/eJyMkE3LGjEAhH9Nctsln7u-hxysVohUS1tF8SL5bCKbZNmNwv77YttjD70NzDDwPKak9MzRqBpLvkcrLOWOcGYaTJFtMHa--XCON9oZ4lZMGeooNCWNKi_vvYn2TjrMewTNc64lCbfs0e3Cg87f97eN7ORDksPpTA8bOct0fOnrp6Dz8I-OB305x69RLnIro_8G6BbQLbTCsB46gXvMV5hy3sMgbI-VZsoSxO2KdhixjvXEEu4_PNI9hfG_UABDahxbrZIuJUytKQkOItQ6zoCuAdkBsptq8HNywXnf1kl5H81si6llasv0E5DdUb6Oi3lc4SSSihkwpIeSbVJx-H1Yxfr04_75sJZfYHVZ5fo29zf9kfcrAAD__wZRe-k HTTP 302
https://rthfsmeheff.trafficsdoctor.org/NIvNycjX HTTP 302
https://rthfsocprq.trafficsdoctor.org/ HTTP 302
https://rthfshefbew.trafficsdoctor.org/login HTTP 302
https://rthfsocprq.trafficsdoctor.org/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638514966834378742.MDBjYTFmMzItZDVmMC00MmNhLWFhOTYtNmM1NDM4MmFlM2Y0MDM1YjU1NjYtNjMwNy00YWMwLTg4YmItMjIxNjU3MTZmZTNj&ui_locales=de-DE&mkt=de-DE&client-request-id=cae916fc-0aa6-47ac-b232-1040fad8c8ea&state=jjrnl31dBLbT42FPgwbv-u4-wuU6OfNjpHU9VIeFVKYlOjoSnvjnjyLXeJjm8fl_iI7e_6Bx_xbUNk9sLGn2E8KAeg1J8dyVN1p8CdIn3BcP1xUZdpnSRPCPp3GbKpiocldVQP-sZKgNfaP2y0MFyC_c5BsphS2FDuIns7kk2KUN2XKwfN04-3A097rrckNZy33L9OfpQa6Gf3_s0DvtT3Dxjn39K7kX7pbam6belL3t8Y6m6DTNkYPKMgAR31VynHA8yMlo_jJZTNQ19fGsoQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0 Page URL
https://rthfsocprq.trafficsdoctor.org/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638514966834378742.MDBjYTFmMzItZDVmMC00MmNhLWFhOTYtNmM1NDM4MmFlM2Y0MDM1YjU1NjYtNjMwNy00YWMwLTg4YmItMjIxNjU3MTZmZTNj&ui_locales=de-DE&mkt=de-DE&client-request-id=cae916fc-0aa6-47ac-b232-1040fad8c8ea&state=jjrnl31dBLbT42FPgwbv-u4-wuU6OfNjpHU9VIeFVKYlOjoSnvjnjyLXeJjm8fl_iI7e_6Bx_xbUNk9sLGn2E8KAeg1J8dyVN1p8CdIn3BcP1xUZdpnSRPCPp3GbKpiocldVQP-sZKgNfaP2y0MFyC_c5BsphS2FDuIns7kk2KUN2XKwfN04-3A097rrckNZy33L9OfpQa6Gf3_s0DvtT3Dxjn39K7kX7pbam6belL3t8Y6m6DTNkYPKMgAR31VynHA8yMlo_jJZTNQ19fGsoQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://email.app.bamboohr.com/c/eJyMkE3LGjEAhH9Nctsln7u-hxysVohUS1tF8SL5bCKbZNmNwv77YttjD70NzDDwPKak9MzRqBpLvkcrLOWOcGYaTJFtMHa--XCON9oZ4lZMGeooNCWNKi_vvYn2TjrMewTNc64lCbfs0e3Cg87f97eN7ORDksPpTA8bOct0fOnrp6Dz8I-OB305x69RLnIro_8G6BbQLbTCsB46gXvMV5hy3sMgbI-VZsoSxO2KdhixjvXEEu4_PNI9hfG_UABDahxbrZIuJUytKQkOItQ6zoCuAdkBsptq8HNywXnf1kl5H81si6llasv0E5DdUb6Oi3lc4SSSihkwpIeSbVJx-H1Yxfr04_75sJZfYHVZ5fo29zf9kfcrAAD__wZRe-k HTTP 302
https://rthfsmeheff.trafficsdoctor.org/NIvNycjX HTTP 302
https://rthfsocprq.trafficsdoctor.org/ HTTP 302
https://rthfshefbew.trafficsdoctor.org/login HTTP 302
https://rthfsocprq.trafficsdoctor.org/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638514966834378742.MDBjYTFmMzItZDVmMC00MmNhLWFhOTYtNmM1NDM4MmFlM2Y0MDM1YjU1NjYtNjMwNy00YWMwLTg4YmItMjIxNjU3MTZmZTNj&ui_locales=de-DE&mkt=de-DE&client-request-id=cae916fc-0aa6-47ac-b232-1040fad8c8ea&state=jjrnl31dBLbT42FPgwbv-u4-wuU6OfNjpHU9VIeFVKYlOjoSnvjnjyLXeJjm8fl_iI7e_6Bx_xbUNk9sLGn2E8KAeg1J8dyVN1p8CdIn3BcP1xUZdpnSRPCPp3GbKpiocldVQP-sZKgNfaP2y0MFyC_c5BsphS2FDuIns7kk2KUN2XKwfN04-3A097rrckNZy33L9OfpQa6Gf3_s0DvtT3Dxjn39K7kX7pbam6belL3t8Y6m6DTNkYPKMgAR31VynHA8yMlo_jJZTNQ19fGsoQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0

31 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H3	200	authorize Show response rthfsocprq.trafficsdoctor.org/common/oauth2/v2.0/ Redirect Chain https://email.app.bamboohr.com/c/eJyMkE3LGjEAhH9Nctsln7u-hxysVohUS1tF8SL5bCKbZNmNwv77YttjD70NzDDwPKak9MzRqBpLvkcrLOWOcGYaTJFtMHa--XCON9oZ4lZMGeooNCWNKi_vvYn2TjrMewTNc64lCbfs0e3Cg87f97eN7ORDksPpTA8b... https://rthfsmeheff.trafficsdoctor.org/NIvNycjX https://rthfsocprq.trafficsdoctor.org/ https://rthfshefbew.trafficsdoctor.org/login https://rthfsocprq.trafficsdoctor.org/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token...	21 KB 10 KB	263ms 263ms	Document text/html	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://rthfsocprq.trafficsdoctor.org/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638514966834378742.MDBjYTFmMzItZDVmMC00MmNhLWFhOTYtNmM1NDM4MmFlM2Y0MDM1YjU1NjYtNjMwNy00YWMwLTg4YmItMjIxNjU3MTZmZTNj&ui_locales=de-DE&mkt=de-DE&client-request-id=cae916fc-0aa6-47ac-b232-1040fad8c8ea&state=jjrnl31dBLbT42FPgwbv-u4-wuU6OfNjpHU9VIeFVKYlOjoSnvjnjyLXeJjm8fl_iI7e_6Bx_xbUNk9sLGn2E8KAeg1J8dyVN1p8CdIn3BcP1xUZdpnSRPCPp3GbKpiocldVQP-sZKgNfaP2y0MFyC_c5BsphS2FDuIns7kk2KUN2XKwfN04-3A097rrckNZy33L9OfpQa6Gf3_s0DvtT3Dxjn39K7kX7pbam6belL3t8Y6m6DTNkYPKMgAR31VynHA8yMlo_jJZTNQ19fGsoQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0 Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `245f9142bda9ad96c504683dcdd8be8b01188122dc1662a21deba9797c1f31f4` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers alt-svc h3=":443"; ma=86400 cache-control no-store, no-cache cf-cache-status DYNAMIC cf-ray 884eeea09cd79214-FRA content-encoding br content-type text/html; charset=utf-8 date Thu, 16 May 2024 22:51:23 GMT expires -1 nel {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} p3p CP="DSP CUR OTPi IND OTRi ONL FIN" pragma no-cache referrer-policy strict-origin-when-cross-origin report-to {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+frc"}]} server cloudflare vary Accept-Encoding x-ms-clitelem 1,50168,0,, x-ms-ests-server 2.1.18077.3 - NEULR1 ProdSlices x-ms-request-id 84918fc3-7a9b-40b5-824e-0407a0635000 x-ms-srs 1.P Redirect headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 884eee9dcbcc9214-FRA content-type text/html; charset=utf-8 date Thu, 16 May 2024 22:51:23 GMT location https://rthfsocprq.trafficsdoctor.org/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638514966834378742.MDBjYTFmMzItZDVmMC00MmNhLWFhOTYtNmM1NDM4MmFlM2Y0MDM1YjU1NjYtNjMwNy00YWMwLTg4YmItMjIxNjU3MTZmZTNj&ui_locales=de-DE&mkt=de-DE&client-request-id=cae916fc-0aa6-47ac-b232-1040fad8c8ea&state=jjrnl31dBLbT42FPgwbv-u4-wuU6OfNjpHU9VIeFVKYlOjoSnvjnjyLXeJjm8fl_iI7e_6Bx_xbUNk9sLGn2E8KAeg1J8dyVN1p8CdIn3BcP1xUZdpnSRPCPp3GbKpiocldVQP-sZKgNfaP2y0MFyC_c5BsphS2FDuIns7kk2KUN2XKwfN04-3A097rrckNZy33L9OfpQa6Gf3_s0DvtT3Dxjn39K7kX7pbam6belL3t8Y6m6DTNkYPKMgAR31VynHA8yMlo_jJZTNQ19fGsoQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} referrer-policy strict-origin-when-cross-origin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bEuvnLAZVGrOf3ZBef0cb0FTqwob%2Fr13UUnJQwYMT3qKwQzy28hAVHUWSf56mvM1uIb59emcw8zAkxYzDG2CBxSR4o%2FEMQQxE8rHqec2N0k6CCpoieOT6tfHPETPVhIqg9wcz2b1LEpI59G06Wdv8Cw%3D"}],"group":"cf-nel","max_age":604800} request-context appId= server cloudflare vary Accept-Encoding x-cache CONFIG_NOCACHE x-msedge-ref Ref A: DBCDEEE19F0B465C9222330DF68759D7 Ref B: HEL01EDGE1309 Ref C: 2024-05-16T22:51:23Z x-ua-compatible IE=edge,chrome=1
GET		BssoInterrupt_Core_RY3pVDLvjU_KKLtTKxjDFA2.js rthfsdjrhte.trafficsdoctor.org/shared/1.0/content/js/	0 0

GET H3	200	BssoInterrupt_Core_RY3pVDLvjU_KKLtTKxjDFA2.js Show response rthfsdjrhte.trafficsdoctor.org/shared/1.0/content/js/	138 KB 50 KB	37ms 22ms	Script application/x-javascript	188.114.97.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://rthfsdjrhte.trafficsdoctor.org/shared/1.0/content/js/BssoInterrupt_Core_RY3pVDLvjU_KKLtTKxjDFA2.js Requested by Host: rthfsocprq.trafficsdoctor.org URL: https://rthfsocprq.trafficsdoctor.org/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638514966834378742.MDBjYTFmMzItZDVmMC00MmNhLWFhOTYtNmM1NDM4MmFlM2Y0MDM1YjU1NjYtNjMwNy00YWMwLTg4YmItMjIxNjU3MTZmZTNj&ui_locales=de-DE&mkt=de-DE&client-request-id=cae916fc-0aa6-47ac-b232-1040fad8c8ea&state=jjrnl31dBLbT42FPgwbv-u4-wuU6OfNjpHU9VIeFVKYlOjoSnvjnjyLXeJjm8fl_iI7e_6Bx_xbUNk9sLGn2E8KAeg1J8dyVN1p8CdIn3BcP1xUZdpnSRPCPp3GbKpiocldVQP-sZKgNfaP2y0MFyC_c5BsphS2FDuIns7kk2KUN2XKwfN04-3A097rrckNZy33L9OfpQa6Gf3_s0DvtT3Dxjn39K7kX7pbam6belL3t8Y6m6DTNkYPKMgAR31VynHA8yMlo_jJZTNQ19fGsoQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0 Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `4638fd8935d19192119469391e3befbb88f620ccd8eeeef2045cd5bdd3bba414` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://rthfsocprq.trafficsdoctor.org/ Origin https://rthfsocprq.trafficsdoctor.org Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 16 May 2024 22:51:23 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 52087 x-cache TCP_HIT x-fd-int-roxy-purgeid 4554691 alt-svc h3=":443"; ma=86400 x-ms-lease-status unlocked last-modified Mon, 29 Apr 2024 17:13:55 GMT server cloudflare x-azure-ref 20240516T082315Z-1654dd6c8cbmqbd8g120kce8e800000001ug000000008qeu report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=77W9obR5cXfKm98VkbAzh%2BSpSjbynbZOt27D6YhM5J5OU4esURIFYrj8ArExyDUPxgJnd9fCCXkVfx44gH3MEVJviAQlmtrQKTNXovR5PtJxWwSm%2F1LrDwa63e89tMLQQp4Sk%2B%2BPJ9TTapwiuM9tHIY%3D"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript access-control-allow-origin * x-ms-request-id 49c3108b-a01e-0004-45c2-a64996000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 vary Accept-Encoding cf-ray 884eeea29b311c05-FRA
GET		watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js rthfsdjrhte.trafficsdoctor.org/ests/2.1/content/cdnbundles/	0 0

GET		watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js rthfsdjrhte.trafficsdoctor.org/ests/2.1/content/cdnbundles/	0 0

GET		watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js rthfsdjrhte.trafficsdoctor.org/ests/2.1/content/cdnbundles/	0 0

POST H3	200	watson rthfsocprq.trafficsdoctor.org/common/handlers/	265 B 934 B	235ms 235ms	XHR application/json	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://rthfsocprq.trafficsdoctor.org/common/handlers/watson Requested by Host: rthfsocprq.trafficsdoctor.org URL: https://rthfsocprq.trafficsdoctor.org/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638514966834378742.MDBjYTFmMzItZDVmMC00MmNhLWFhOTYtNmM1NDM4MmFlM2Y0MDM1YjU1NjYtNjMwNy00YWMwLTg4YmItMjIxNjU3MTZmZTNj&ui_locales=de-DE&mkt=de-DE&client-request-id=cae916fc-0aa6-47ac-b232-1040fad8c8ea&state=jjrnl31dBLbT42FPgwbv-u4-wuU6OfNjpHU9VIeFVKYlOjoSnvjnjyLXeJjm8fl_iI7e_6Bx_xbUNk9sLGn2E8KAeg1J8dyVN1p8CdIn3BcP1xUZdpnSRPCPp3GbKpiocldVQP-sZKgNfaP2y0MFyC_c5BsphS2FDuIns7kk2KUN2XKwfN04-3A097rrckNZy33L9OfpQa6Gf3_s0DvtT3Dxjn39K7kX7pbam6belL3t8Y6m6DTNkYPKMgAR31VynHA8yMlo_jJZTNQ19fGsoQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0 Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 client-request-id cae916fc-0aa6-47ac-b232-1040fad8c8ea canary PAQABDgEAAADnfolhJpSnRYB1SVj-Hgd8pxgg-AJLhvOxl_rcbe2VLQo-IFCBfZODw4yud_tInPES_nGI2y3RGj8QWQ4nAPWZo9N6TdyrhLHHcbx2h6n4kDMsf8__5UdxGuRY8-6TeiFF-C0EmjX155SqHbKBletVoGHmwy2iYi79J9sxe3JCSm_GR1H4sDCVP9zS4lf3zKh7731wqg1-fll3A6KM-7iopksVlnhVC3gICuv8LI6TYiAA Content-Type application/json; charset=UTF-8 hpgid 6 Accept application/json Referer https://rthfsocprq.trafficsdoctor.org/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638514966834378742.MDBjYTFmMzItZDVmMC00MmNhLWFhOTYtNmM1NDM4MmFlM2Y0MDM1YjU1NjYtNjMwNy00YWMwLTg4YmItMjIxNjU3MTZmZTNj&ui_locales=de-DE&mkt=de-DE&client-request-id=cae916fc-0aa6-47ac-b232-1040fad8c8ea&state=jjrnl31dBLbT42FPgwbv-u4-wuU6OfNjpHU9VIeFVKYlOjoSnvjnjyLXeJjm8fl_iI7e_6Bx_xbUNk9sLGn2E8KAeg1J8dyVN1p8CdIn3BcP1xUZdpnSRPCPp3GbKpiocldVQP-sZKgNfaP2y0MFyC_c5BsphS2FDuIns7kk2KUN2XKwfN04-3A097rrckNZy33L9OfpQa6Gf3_s0DvtT3Dxjn39K7kX7pbam6belL3t8Y6m6DTNkYPKMgAR31VynHA8yMlo_jJZTNQ19fGsoQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0 hpgact 1800 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 22:51:24 GMT content-encoding br cf-cache-status DYNAMIC nel {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} client-request-id cae916fc-0aa6-47ac-b232-1040fad8c8ea p3p CP="DSP CUR OTPi IND OTRi ONL FIN" alt-svc h3=":443"; ma=86400 pragma no-cache referrer-policy strict-origin-when-cross-origin x-ms-srs 1.P server cloudflare report-to {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+frc"}]} content-type application/json; charset=utf-8 x-ms-request-id 201e0de7-edc4-42e9-b7a1-3efdc6f7ec00 cache-control no-store, no-cache cf-ray 884eeea5df4f9214-FRA x-ms-ests-server 2.1.18077.3 - WEULR1 ProdSlices expires -1
POST H3	200	reportbssotelemetry rthfsocprq.trafficsdoctor.org/common/instrumentation/	265 B 897 B	292ms 291ms	Ping application/json	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://rthfsocprq.trafficsdoctor.org/common/instrumentation/reportbssotelemetry?hpgid=6&hpgact=1800&client-request-id=cae916fc-0aa6-47ac-b232-1040fad8c8ea&hpgrequestid=84918fc3-7a9b-40b5-824e-0407a0635000 Requested by Host: rthfsdjrhte.trafficsdoctor.org URL: https://rthfsdjrhte.trafficsdoctor.org/shared/1.0/content/js/BssoInterrupt_Core_RY3pVDLvjU_KKLtTKxjDFA2.js Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" sec-ch-ua-platform "Win32" Referer https://rthfsocprq.trafficsdoctor.org/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638514966834378742.MDBjYTFmMzItZDVmMC00MmNhLWFhOTYtNmM1NDM4MmFlM2Y0MDM1YjU1NjYtNjMwNy00YWMwLTg4YmItMjIxNjU3MTZmZTNj&ui_locales=de-DE&mkt=de-DE&client-request-id=cae916fc-0aa6-47ac-b232-1040fad8c8ea&state=jjrnl31dBLbT42FPgwbv-u4-wuU6OfNjpHU9VIeFVKYlOjoSnvjnjyLXeJjm8fl_iI7e_6Bx_xbUNk9sLGn2E8KAeg1J8dyVN1p8CdIn3BcP1xUZdpnSRPCPp3GbKpiocldVQP-sZKgNfaP2y0MFyC_c5BsphS2FDuIns7kk2KUN2XKwfN04-3A097rrckNZy33L9OfpQa6Gf3_s0DvtT3Dxjn39K7kX7pbam6belL3t8Y6m6DTNkYPKMgAR31VynHA8yMlo_jJZTNQ19fGsoQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0 Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers date Thu, 16 May 2024 22:51:24 GMT content-encoding br cf-cache-status DYNAMIC nel {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} p3p CP="DSP CUR OTPi IND OTRi ONL FIN" alt-svc h3=":443"; ma=86400 pragma no-cache referrer-policy strict-origin-when-cross-origin x-ms-srs 1.P server cloudflare report-to {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+frc"}]} content-type application/json; charset=utf-8 x-ms-request-id 157dce7a-0536-4fb2-9d00-61484ec45500 cache-control no-store, no-cache cf-ray 884eeea5ef5e9214-FRA x-ms-ests-server 2.1.18077.3 - NEULR1 ProdSlices expires -1
GET H3	200	Primary Request authorize Show response rthfsocprq.trafficsdoctor.org/common/oauth2/v2.0/	45 KB 17 KB	504ms 504ms	Document text/html	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://rthfsocprq.trafficsdoctor.org/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638514966834378742.MDBjYTFmMzItZDVmMC00MmNhLWFhOTYtNmM1NDM4MmFlM2Y0MDM1YjU1NjYtNjMwNy00YWMwLTg4YmItMjIxNjU3MTZmZTNj&ui_locales=de-DE&mkt=de-DE&client-request-id=cae916fc-0aa6-47ac-b232-1040fad8c8ea&state=jjrnl31dBLbT42FPgwbv-u4-wuU6OfNjpHU9VIeFVKYlOjoSnvjnjyLXeJjm8fl_iI7e_6Bx_xbUNk9sLGn2E8KAeg1J8dyVN1p8CdIn3BcP1xUZdpnSRPCPp3GbKpiocldVQP-sZKgNfaP2y0MFyC_c5BsphS2FDuIns7kk2KUN2XKwfN04-3A097rrckNZy33L9OfpQa6Gf3_s0DvtT3Dxjn39K7kX7pbam6belL3t8Y6m6DTNkYPKMgAR31VynHA8yMlo_jJZTNQ19fGsoQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true Requested by Host: rthfsdjrhte.trafficsdoctor.org URL: https://rthfsdjrhte.trafficsdoctor.org/shared/1.0/content/js/BssoInterrupt_Core_RY3pVDLvjU_KKLtTKxjDFA2.js Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `6e86239d63bb800c75bd2ee4ca9720b7e54112807265f32b859ef1325cf7e531` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer https://rthfsocprq.trafficsdoctor.org/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638514966834378742.MDBjYTFmMzItZDVmMC00MmNhLWFhOTYtNmM1NDM4MmFlM2Y0MDM1YjU1NjYtNjMwNy00YWMwLTg4YmItMjIxNjU3MTZmZTNj&ui_locales=de-DE&mkt=de-DE&client-request-id=cae916fc-0aa6-47ac-b232-1040fad8c8ea&state=jjrnl31dBLbT42FPgwbv-u4-wuU6OfNjpHU9VIeFVKYlOjoSnvjnjyLXeJjm8fl_iI7e_6Bx_xbUNk9sLGn2E8KAeg1J8dyVN1p8CdIn3BcP1xUZdpnSRPCPp3GbKpiocldVQP-sZKgNfaP2y0MFyC_c5BsphS2FDuIns7kk2KUN2XKwfN04-3A097rrckNZy33L9OfpQa6Gf3_s0DvtT3Dxjn39K7kX7pbam6belL3t8Y6m6DTNkYPKMgAR31VynHA8yMlo_jJZTNQ19fGsoQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers alt-svc h3=":443"; ma=86400 cache-control no-store, no-cache cf-cache-status DYNAMIC cf-ray 884eeea5ef689214-FRA content-encoding br content-type text/html; charset=utf-8 date Thu, 16 May 2024 22:51:24 GMT expires -1 link <https://aadcdn.msftauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msftauth.net>; rel=dns-prefetch,<https://aadcdn.msauth.net>; rel=dns-prefetch nel {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} p3p CP="DSP CUR OTPi IND OTRi ONL FIN" pragma no-cache referrer-policy strict-origin-when-cross-origin report-to {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+SEC"}]} server cloudflare vary Accept-Encoding x-dns-prefetch-control on x-ms-clitelem 1,0,0,, x-ms-ests-server 2.1.18077.3 - NEULR1 ProdSlices x-ms-request-id 076365ca-7bca-4ac3-81e3-d305ff215000 x-ms-srs 1.P
GET H3	404	favicon.ico rthfsocprq.trafficsdoctor.org/	0 536 B	370ms 370ms	Other text/plain	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://rthfsocprq.trafficsdoctor.org/favicon.ico Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://rthfsocprq.trafficsdoctor.org/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638514966834378742.MDBjYTFmMzItZDVmMC00MmNhLWFhOTYtNmM1NDM4MmFlM2Y0MDM1YjU1NjYtNjMwNy00YWMwLTg4YmItMjIxNjU3MTZmZTNj&ui_locales=de-DE&mkt=de-DE&client-request-id=cae916fc-0aa6-47ac-b232-1040fad8c8ea&state=jjrnl31dBLbT42FPgwbv-u4-wuU6OfNjpHU9VIeFVKYlOjoSnvjnjyLXeJjm8fl_iI7e_6Bx_xbUNk9sLGn2E8KAeg1J8dyVN1p8CdIn3BcP1xUZdpnSRPCPp3GbKpiocldVQP-sZKgNfaP2y0MFyC_c5BsphS2FDuIns7kk2KUN2XKwfN04-3A097rrckNZy33L9OfpQa6Gf3_s0DvtT3Dxjn39K7kX7pbam6belL3t8Y6m6DTNkYPKMgAR31VynHA8yMlo_jJZTNQ19fGsoQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0 Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 22:51:24 GMT referrer-policy strict-origin-when-cross-origin x-ms-srs 1.P nel {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} server cloudflare cf-cache-status BYPASS vary Accept-Encoding report-to {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+frc"}]} p3p CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id 1912b6b8-3462-4558-adf9-a044e7507500 cache-control private cf-ray 884eeea5ef659214-FRA alt-svc h3=":443"; ma=86400 x-ms-ests-server 2.1.18077.3 - SEC ProdSlices
GET H3	200	Me.htm rthfshrvetbr.trafficsdoctor.org/	0 0	333ms 321ms	Other text/html	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://rthfshrvetbr.trafficsdoctor.org/Me.htm?v=3 Requested by Host: rthfsocprq.trafficsdoctor.org URL: https://rthfsocprq.trafficsdoctor.org/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638514966834378742.MDBjYTFmMzItZDVmMC00MmNhLWFhOTYtNmM1NDM4MmFlM2Y0MDM1YjU1NjYtNjMwNy00YWMwLTg4YmItMjIxNjU3MTZmZTNj&ui_locales=de-DE&mkt=de-DE&client-request-id=cae916fc-0aa6-47ac-b232-1040fad8c8ea&state=jjrnl31dBLbT42FPgwbv-u4-wuU6OfNjpHU9VIeFVKYlOjoSnvjnjyLXeJjm8fl_iI7e_6Bx_xbUNk9sLGn2E8KAeg1J8dyVN1p8CdIn3BcP1xUZdpnSRPCPp3GbKpiocldVQP-sZKgNfaP2y0MFyC_c5BsphS2FDuIns7kk2KUN2XKwfN04-3A097rrckNZy33L9OfpQa6Gf3_s0DvtT3Dxjn39K7kX7pbam6belL3t8Y6m6DTNkYPKMgAR31VynHA8yMlo_jJZTNQ19fGsoQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://rthfsocprq.trafficsdoctor.org/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers
GET		converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css rthfsdjrhte.trafficsdoctor.org/ests/2.1/content/cdnbundles/	0 0

GET		ConvergedLogin_PCore_9i90DmN8HbFiIvCSmsAz-Q2.js rthfsdjrhte.trafficsdoctor.org/shared/1.0/content/js/	0 0

GET		ux.converged.login.strings-de.min_pg3qvekbtzilyo4uvuckhw2.js rthfsdjrhte.trafficsdoctor.org/ests/2.1/content/cdnbundles/	0 0

GET H3	200	ConvergedLogin_PCore_9i90DmN8HbFiIvCSmsAz-Q2.js Show response rthfsdjrhte.trafficsdoctor.org/shared/1.0/content/js/	434 KB 115 KB	38ms 38ms	Script application/x-javascript	188.114.97.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://rthfsdjrhte.trafficsdoctor.org/shared/1.0/content/js/ConvergedLogin_PCore_9i90DmN8HbFiIvCSmsAz-Q2.js Requested by Host: rthfsocprq.trafficsdoctor.org URL: https://rthfsocprq.trafficsdoctor.org/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638514966834378742.MDBjYTFmMzItZDVmMC00MmNhLWFhOTYtNmM1NDM4MmFlM2Y0MDM1YjU1NjYtNjMwNy00YWMwLTg4YmItMjIxNjU3MTZmZTNj&ui_locales=de-DE&mkt=de-DE&client-request-id=cae916fc-0aa6-47ac-b232-1040fad8c8ea&state=jjrnl31dBLbT42FPgwbv-u4-wuU6OfNjpHU9VIeFVKYlOjoSnvjnjyLXeJjm8fl_iI7e_6Bx_xbUNk9sLGn2E8KAeg1J8dyVN1p8CdIn3BcP1xUZdpnSRPCPp3GbKpiocldVQP-sZKgNfaP2y0MFyC_c5BsphS2FDuIns7kk2KUN2XKwfN04-3A097rrckNZy33L9OfpQa6Gf3_s0DvtT3Dxjn39K7kX7pbam6belL3t8Y6m6DTNkYPKMgAR31VynHA8yMlo_jJZTNQ19fGsoQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `49b5577253df30d270fa49037d7f669b5e7450317d13dba2c66af1c8b58ddd68` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://rthfsocprq.trafficsdoctor.org/ Origin https://rthfsocprq.trafficsdoctor.org Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 16 May 2024 22:51:25 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 46487 x-cache TCP_HIT x-fd-int-roxy-purgeid 4554691 alt-svc h3=":443"; ma=86400 x-ms-lease-status unlocked last-modified Mon, 29 Apr 2024 17:13:57 GMT server cloudflare x-azure-ref 20240516T095638Z-1654dd6c8cb5mbj7qqhdrm932c00000000cg00000000d89a report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pXa9CJhYYEtYSWwgJNZWu9GCvzfmJqo8fS%2F%2BPSH49OQbFA5eSnk%2FxzOL%2FWoZHvzOcYQ%2BpMpQ7dcB5G5WOEQ%2B7AzBpMBG70u%2F2FjevoPBD0KmeztOkNv%2FNnznEGPOu2M5Kc%2BVqxZlAeAA47Q5vzJ2GLc%3D"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript access-control-allow-origin * x-ms-request-id 883480dc-f01e-0025-3348-a6f3a7000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 vary Accept-Encoding cf-ray 884eeeac09f91c05-FRA
GET		watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js rthfsdjrhte.trafficsdoctor.org/ests/2.1/content/cdnbundles/	0 0

GET H3	200	converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css rthfsdjrhte.trafficsdoctor.org/ests/2.1/content/cdnbundles/	110 KB 20 KB	29ms 29ms	Stylesheet text/css	188.114.97.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://rthfsdjrhte.trafficsdoctor.org/ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css Requested by Host: rthfsocprq.trafficsdoctor.org URL: https://rthfsocprq.trafficsdoctor.org/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638514966834378742.MDBjYTFmMzItZDVmMC00MmNhLWFhOTYtNmM1NDM4MmFlM2Y0MDM1YjU1NjYtNjMwNy00YWMwLTg4YmItMjIxNjU3MTZmZTNj&ui_locales=de-DE&mkt=de-DE&client-request-id=cae916fc-0aa6-47ac-b232-1040fad8c8ea&state=jjrnl31dBLbT42FPgwbv-u4-wuU6OfNjpHU9VIeFVKYlOjoSnvjnjyLXeJjm8fl_iI7e_6Bx_xbUNk9sLGn2E8KAeg1J8dyVN1p8CdIn3BcP1xUZdpnSRPCPp3GbKpiocldVQP-sZKgNfaP2y0MFyC_c5BsphS2FDuIns7kk2KUN2XKwfN04-3A097rrckNZy33L9OfpQa6Gf3_s0DvtT3Dxjn39K7kX7pbam6belL3t8Y6m6DTNkYPKMgAR31VynHA8yMlo_jJZTNQ19fGsoQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `4b01a0a34ce8ed4bc8a8713be0442d49da6a756236b7b4424622ca3dee820f41` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://rthfsocprq.trafficsdoctor.org/ Origin https://rthfsocprq.trafficsdoctor.org Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 16 May 2024 22:51:25 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 0 x-cache TCP_HIT x-fd-int-roxy-purgeid 4554691 alt-svc h3=":443"; ma=86400 x-ms-lease-status unlocked last-modified Wed, 27 Dec 2023 18:18:12 GMT server cloudflare x-azure-ref 20240516T225125Z-1654dd6c8cb5mbj7qqhdrm932c000000017g000000004hh5 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=GVz1mJN8ReSBLyK6KIxpQ2Fsx7kBh4KWQSUpTz2rpQtf58kDk1qjwSE9qRiXVhgrl4agy39g4hLmshLvaUavU0mRuCHr6KWI4JK77gsMDIp2%2B%2BsGWC7gaOt%2F5oj17fD6Z1CbnFZvtrUiMtSS%2FFTYC6U%3D"}],"group":"cf-nel","max_age":604800} content-type text/css access-control-allow-origin * x-ms-request-id 0616c50c-b01e-0059-72c7-a5f5be000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 vary Accept-Encoding cf-ray 884eeeac09fa1c05-FRA
GET H3	200	ux.converged.login.strings-de.min_pg3qvekbtzilyo4uvuckhw2.js Show response rthfsdjrhte.trafficsdoctor.org/ests/2.1/content/cdnbundles/	60 KB 18 KB	31ms 31ms	Script application/x-javascript	188.114.97.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://rthfsdjrhte.trafficsdoctor.org/ests/2.1/content/cdnbundles/ux.converged.login.strings-de.min_pg3qvekbtzilyo4uvuckhw2.js Requested by Host: rthfsocprq.trafficsdoctor.org URL: https://rthfsocprq.trafficsdoctor.org/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638514966834378742.MDBjYTFmMzItZDVmMC00MmNhLWFhOTYtNmM1NDM4MmFlM2Y0MDM1YjU1NjYtNjMwNy00YWMwLTg4YmItMjIxNjU3MTZmZTNj&ui_locales=de-DE&mkt=de-DE&client-request-id=cae916fc-0aa6-47ac-b232-1040fad8c8ea&state=jjrnl31dBLbT42FPgwbv-u4-wuU6OfNjpHU9VIeFVKYlOjoSnvjnjyLXeJjm8fl_iI7e_6Bx_xbUNk9sLGn2E8KAeg1J8dyVN1p8CdIn3BcP1xUZdpnSRPCPp3GbKpiocldVQP-sZKgNfaP2y0MFyC_c5BsphS2FDuIns7kk2KUN2XKwfN04-3A097rrckNZy33L9OfpQa6Gf3_s0DvtT3Dxjn39K7kX7pbam6belL3t8Y6m6DTNkYPKMgAR31VynHA8yMlo_jJZTNQ19fGsoQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.97.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `1f74044ddfaf154497974982234d52d8066ca432fdfea221fce31d55a68f0d6c` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://rthfsocprq.trafficsdoctor.org/ Origin https://rthfsocprq.trafficsdoctor.org Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 16 May 2024 22:51:25 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 0 x-cache TCP_HIT x-cache-info L1_T2 x-fd-int-roxy-purgeid 4554691 alt-svc h3=":443"; ma=86400 x-ms-lease-status unlocked last-modified Wed, 24 Apr 2024 05:49:08 GMT server cloudflare x-azure-ref 20240516T225125Z-17c898fb97f29hkdmpfvmrzst0000000023000000000bss3 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yOEbCG9tF%2Fvd8IakSsHEKOTswysXtIXaJqzSf6SroDNQhG8kCGTuLfFN1PJ2pnL7%2BS7hPPUdBzdbAwSAj2SDbUmtu7Qg6yfRCMVEk0wBpA6zS%2FKEFpZo3S5Ev6dnGSrwDuLdivYh7z6kg11M8PSsNhE%3D"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript access-control-allow-origin * x-ms-request-id 95d15315-e01e-0010-8093-a755bc000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 vary Accept-Encoding cf-ray 884eeeac0a021c05-FRA
GET		watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js rthfsdjrhte.trafficsdoctor.org/ests/2.1/content/cdnbundles/	0 0

GET		watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js rthfsdjrhte.trafficsdoctor.org/ests/2.1/content/cdnbundles/	0 0

POST H3	200	watson Show response rthfsocprq.trafficsdoctor.org/common/handlers/	265 B 951 B	247ms 247ms	XHR application/json	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://rthfsocprq.trafficsdoctor.org/common/handlers/watson Requested by Host: rthfsocprq.trafficsdoctor.org URL: https://rthfsocprq.trafficsdoctor.org/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638514966834378742.MDBjYTFmMzItZDVmMC00MmNhLWFhOTYtNmM1NDM4MmFlM2Y0MDM1YjU1NjYtNjMwNy00YWMwLTg4YmItMjIxNjU3MTZmZTNj&ui_locales=de-DE&mkt=de-DE&client-request-id=cae916fc-0aa6-47ac-b232-1040fad8c8ea&state=jjrnl31dBLbT42FPgwbv-u4-wuU6OfNjpHU9VIeFVKYlOjoSnvjnjyLXeJjm8fl_iI7e_6Bx_xbUNk9sLGn2E8KAeg1J8dyVN1p8CdIn3BcP1xUZdpnSRPCPp3GbKpiocldVQP-sZKgNfaP2y0MFyC_c5BsphS2FDuIns7kk2KUN2XKwfN04-3A097rrckNZy33L9OfpQa6Gf3_s0DvtT3Dxjn39K7kX7pbam6belL3t8Y6m6DTNkYPKMgAR31VynHA8yMlo_jJZTNQ19fGsoQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `e18658374541f996aae7a8a47e0f90d5bb63f7ebe0a20d775d1d258544c2b49e` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 client-request-id cae916fc-0aa6-47ac-b232-1040fad8c8ea canary PAQABDgEAAADnfolhJpSnRYB1SVj-Hgd8t8Mi7f0SYBHgnztwet_PW5ByzCo_DEh8RkyVdBN9tYefCwjWsM-SbA9xrAqdkFTfVIS6XGpu4a2qR_d_ZkplVZcysfW7wjLhQj2UgEIKrwic7gqH45Fsy1-RLmdnOW_URZNs0sconr-YSO0u672kjEAAPEMv7_aate18sDADegg5J_srLhLn_zFQYLkeJA5JFo7MJAxfHLhLmmw8Cw2GECAA Content-Type application/json; charset=UTF-8 hpgid 1104 Accept application/json Referer https://rthfsocprq.trafficsdoctor.org/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638514966834378742.MDBjYTFmMzItZDVmMC00MmNhLWFhOTYtNmM1NDM4MmFlM2Y0MDM1YjU1NjYtNjMwNy00YWMwLTg4YmItMjIxNjU3MTZmZTNj&ui_locales=de-DE&mkt=de-DE&client-request-id=cae916fc-0aa6-47ac-b232-1040fad8c8ea&state=jjrnl31dBLbT42FPgwbv-u4-wuU6OfNjpHU9VIeFVKYlOjoSnvjnjyLXeJjm8fl_iI7e_6Bx_xbUNk9sLGn2E8KAeg1J8dyVN1p8CdIn3BcP1xUZdpnSRPCPp3GbKpiocldVQP-sZKgNfaP2y0MFyC_c5BsphS2FDuIns7kk2KUN2XKwfN04-3A097rrckNZy33L9OfpQa6Gf3_s0DvtT3Dxjn39K7kX7pbam6belL3t8Y6m6DTNkYPKMgAR31VynHA8yMlo_jJZTNQ19fGsoQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true hpgact 1800 sec-ch-ua-platform "Win32" Response headers date Thu, 16 May 2024 22:51:26 GMT content-encoding br cf-cache-status DYNAMIC nel {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} client-request-id cae916fc-0aa6-47ac-b232-1040fad8c8ea p3p CP="DSP CUR OTPi IND OTRi ONL FIN" alt-svc h3=":443"; ma=86400 pragma no-cache referrer-policy strict-origin-when-cross-origin x-ms-srs 1.P server cloudflare report-to {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+SEC"}]} content-type application/json; charset=utf-8 x-ms-request-id ab2b1526-42e6-4f82-a1a7-0977d1556d00 cache-control no-store, no-cache cf-ray 884eeeaf5bb79214-FRA x-ms-ests-server 2.1.18077.3 - FRC ProdSlices expires -1
GET H3	200	convergedlogin_pcustomizationloader_8e14dcf0e3ff5580d170.js Show response rthfsdjrhte.trafficsdoctor.org/shared/1.0/content/js/asyncchunk/	219 KB 51 KB	555ms 555ms	Script application/x-javascript	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://rthfsdjrhte.trafficsdoctor.org/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_8e14dcf0e3ff5580d170.js Requested by Host: rthfsdjrhte.trafficsdoctor.org URL: https://rthfsdjrhte.trafficsdoctor.org/shared/1.0/content/js/ConvergedLogin_PCore_9i90DmN8HbFiIvCSmsAz-Q2.js Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `474ce0790ceb18a100cebaf1ac0915a51389fcae0830c3b44bfa1e365d40b2b4` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://rthfsocprq.trafficsdoctor.org/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 16 May 2024 22:51:26 GMT content-encoding br cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-cache TCP_HIT x-fd-int-roxy-purgeid 4554691 alt-svc h3=":443"; ma=86400 x-ms-lease-status unlocked last-modified Thu, 28 Mar 2024 21:22:21 GMT server cloudflare x-azure-ref 20240516T225126Z-17c898fb97f29hkdmpfvmrzst0000000023000000000bssc report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BlJGUO5tKRwJTyHkJmBVEBBQw4%2FA8bU3I7%2FUMrz8ObZMvuxirmqzKX51KNHOatGw99nQ7vapl5zwzTXSM7R8pfFvadliu%2Bfgs2I%2BKGoqlCN8l9UoipONigXD64QnKIvKOKH5h302vpbvN8WuCjdntc4%3D"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript access-control-allow-origin * x-ms-request-id 47e49116-801e-0006-6eaa-a61f92000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 vary Accept-Encoding cf-ray 884eeeaf6bc19214-FRA
GET H3	200	favicon_a_eupayfgghqiai7k9sol6lg2.ico rthfsdjrhte.trafficsdoctor.org/shared/1.0/content/images/	17 KB 1 KB	16ms 16ms	Other image/x-icon	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://rthfsdjrhte.trafficsdoctor.org/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://rthfsocprq.trafficsdoctor.org/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 16 May 2024 22:51:26 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 46475 x-cache TCP_HIT x-fd-int-roxy-purgeid 4554691 alt-svc h3=":443"; ma=86400 x-ms-lease-status unlocked last-modified Sun, 18 Oct 2020 03:02:03 GMT server cloudflare x-azure-ref 20240516T095651Z-17c898fb97fvwvql5hb82x52mc00000001g000000000qm2k report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Bhw%2BpDMeG1QHk7WmHPdWBrR7DEWRLx8aXr7tL2%2Fld6hI63Hdo2z6wlLylHRiuMX8qrebQY6bPyHIpEAEiZxHjcmmDixKauAp%2BJwtmUyZ%2BY4IlL9lw29h8I4EPfepKDMgFhG3vlq9KMMYyj3c1F8YbAg%3D"}],"group":"cf-nel","max_age":604800} content-type image/x-icon access-control-allow-origin * x-ms-request-id 86567cbd-701e-0079-03c3-a6648d000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 vary Accept-Encoding cf-ray 884eeeaf7bcd9214-FRA
GET H3	200	convergedlogin_pfetchsessionsprogress_7c1aa7609345f99e4914.js Show response rthfsdjrhte.trafficsdoctor.org/shared/1.0/content/js/asyncchunk/	15 KB 6 KB	19ms 19ms	Script application/x-javascript	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://rthfsdjrhte.trafficsdoctor.org/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_7c1aa7609345f99e4914.js Requested by Host: rthfsdjrhte.trafficsdoctor.org URL: https://rthfsdjrhte.trafficsdoctor.org/shared/1.0/content/js/ConvergedLogin_PCore_9i90DmN8HbFiIvCSmsAz-Q2.js Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `35afb11dab6edcbc989a25fe5cf19f5d8289499232b7ec775f318d8b8a5bbf78` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://rthfsocprq.trafficsdoctor.org/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 16 May 2024 22:51:26 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 26685 x-cache TCP_HIT x-fd-int-roxy-purgeid 4554691 alt-svc h3=":443"; ma=86400 x-ms-lease-status unlocked last-modified Thu, 28 Mar 2024 21:22:21 GMT server cloudflare x-azure-ref 20240516T152641Z-1654dd6c8cb7wmvfg4ztn70v0800000003ug000000001qcm report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=C32DlykrdZomEAPoQIy3jzWwVbzSGOmQ3U5FEuHrZJUXeGfvwLyODNh%2FBkKlg2koXlUqDAtoV39zo3zDrIoIMbNzKXAsbsKL%2Bu%2Fm%2FkPtxreNtw5DJ7RlO%2B8Md3WhL2bKwddAu8gIhQbKSQpUSwKkL0c%3D"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript access-control-allow-origin * x-ms-request-id 235b2ae4-601e-0070-73e2-a5179e000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 vary Accept-Encoding cf-ray 884eeeb2fd119214-FRA
GET H3	200	marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif rthfsdjrhte.trafficsdoctor.org/shared/1.0/content/images/	3 KB 3 KB	20ms 20ms	Image image/gif	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://rthfsdjrhte.trafficsdoctor.org/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `a46201581a7c7c667fd42787cd1e9adf2f6bf809efb7596e61a03e8dba9ada13` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://rthfsocprq.trafficsdoctor.org/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 16 May 2024 22:51:26 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 26685 x-cache TCP_HIT x-fd-int-roxy-purgeid 4554691 alt-svc h3=":443"; ma=86400 x-ms-lease-status unlocked last-modified Wed, 24 May 2023 10:11:47 GMT server cloudflare etag 0x8DB5C3F48EC4154 x-azure-ref 20240516T152641Z-17c898fb97fwjnb8c81kcqzkvs00000000gg00000000kyg9 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DJ28wlHzU%2B8tXiM%2F0RV55MVYU5pCeFLgJhWpc3xNsLu7HkoBiY6Ky4AHthKQVjkI1gqg5xk7kY%2BeKSHCtMOrvcK0Ou1pSAsJ02zsBXxe9VJeh%2FJtXgpK90pVUeN1gZ%2FboD%2BRWcy8XXfQYOYPzstfe3M%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif access-control-allow-origin * x-ms-request-id 85df3eb2-e01e-003c-101d-a73096000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 vary Accept-Encoding cf-ray 884eeeb30d179214-FRA
GET H3	200	marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif rthfsdjrhte.trafficsdoctor.org/shared/1.0/content/images/	4 KB 4 KB	18ms 18ms	Image image/gif	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://rthfsdjrhte.trafficsdoctor.org/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `8737d721808655f37b333f08a90185699e7e8b9bdaaa15cdb63c8448b426f95d` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://rthfsocprq.trafficsdoctor.org/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 16 May 2024 22:51:26 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 26685 x-cache TCP_HIT x-fd-int-roxy-purgeid 4554691 alt-svc h3=":443"; ma=86400 x-ms-lease-status unlocked last-modified Wed, 24 May 2023 10:11:48 GMT server cloudflare etag 0x8DB5C3F4904824B x-azure-ref 20240516T152641Z-17c898fb97fwjnb8c81kcqzkvs00000000gg00000000kyga report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BoIm6YLd%2BLpXzsO0pHveYo%2BCdeXqugSQO6XuptR0TUdpeqz7xhTme9tfvFAuufZeQ228KlPwlctLZ3qV9%2FhMyHHiXRhsORdxq%2BjOLb4DI6lJKNAZ7rdRBIHQCynVv1rrKoVEQ6FqF2UfuuHppJ1YYpw%3D"}],"group":"cf-nel","max_age":604800} content-type image/gif access-control-allow-origin * x-ms-request-id ccef7333-401e-005e-743b-a724b0000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 vary Accept-Encoding cf-ray 884eeeb30d189214-FRA
GET H3	200	2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg rthfsdjrhte.trafficsdoctor.org/shared/1.0/content/images/backgrounds/	2 KB 1 KB	18ms 17ms	Image image/svg+xml	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://rthfsdjrhte.trafficsdoctor.org/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://rthfsocprq.trafficsdoctor.org/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 16 May 2024 22:51:26 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 26685 x-cache TCP_HIT x-fd-int-roxy-purgeid 4554691 alt-svc h3=":443"; ma=86400 x-ms-lease-status unlocked last-modified Wed, 24 May 2023 10:11:46 GMT server cloudflare x-azure-ref 20240516T152641Z-17c898fb97fwjnb8c81kcqzkvs00000000gg00000000kygk report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RLYcSiWmFFiNQdVGgSrXBKlUqAleEZ18vXXmWr%2BKUCb%2BH9mefB9SJpK4S5Fky8lhTN7uhk2o1FjLeM5MrjxXjedxZor%2FSPqiMN0lRhLn1FK9gqGeyeoE1cUVNQZ8OXq%2BEMNGTFKCVTQsKkaavQiVW%2Bc%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml access-control-allow-origin * x-ms-request-id baf7803d-301e-0015-670f-a7d2b6000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 vary Accept-Encoding cf-ray 884eeeb33d3c9214-FRA
GET H3	200	microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg rthfsdjrhte.trafficsdoctor.org/shared/1.0/content/images/	4 KB 2 KB	16ms 15ms	Image image/svg+xml	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://rthfsdjrhte.trafficsdoctor.org/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://rthfsocprq.trafficsdoctor.org/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 16 May 2024 22:51:26 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 26685 x-cache TCP_HIT x-fd-int-roxy-purgeid 4554691 alt-svc h3=":443"; ma=86400 x-ms-lease-status unlocked last-modified Wed, 24 May 2023 10:11:48 GMT server cloudflare x-azure-ref 20240516T152641Z-1654dd6c8cb7wmvfg4ztn70v0800000003ug000000001qcs report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BiUZUy%2BHUZM0KzdNTtlo81wGMSBE0u3k%2B6iifF2MBTGGKxyDQnqlzlaj90j%2B4oYisqwkWcbu9VsiUAX5cOGNM8a6lCauuPPBfMYtB0655Qg7FRpB3JqSXgOst9%2FWi6LpInxlvFT2do1Lz%2B9YpBfqxak%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml access-control-allow-origin * x-ms-request-id 0b1f9313-101e-002b-2eb1-a551ba000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 vary Accept-Encoding cf-ray 884eeeb33d3d9214-FRA
GET H3	200	Me.htm Show response rthfshrvetbr.trafficsdoctor.org/ Frame 29B3	2 KB 2 KB	288ms 287ms	Document text/html	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://rthfshrvetbr.trafficsdoctor.org/Me.htm?v=3 Requested by Host: rthfsdjrhte.trafficsdoctor.org URL: https://rthfsdjrhte.trafficsdoctor.org/shared/1.0/content/js/ConvergedLogin_PCore_9i90DmN8HbFiIvCSmsAz-Q2.js Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `b2395b217b15b703afff5fd46b546935bfaf89e040902744912131b273856c32` Request headers Accept-Language de-DE,de;q=0.9;q=0.9 Referer https://rthfsocprq.trafficsdoctor.org/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers alt-svc h3=":443"; ma=86400 cache-control max-age=315360000 cf-cache-status DYNAMIC cf-ray 884eeeb35d5b9214-FRA content-encoding br content-type text/html; charset=utf-8 date Thu, 16 May 2024 22:51:26 GMT expires Sun, 14 May 2034 22:51:26 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} p3p CP="DSP CUR OTPi IND OTRi ONL FIN" ppserver PPV: 30 H: BL02EPF0001D797 V: 0 referrer-policy strict-origin-when-cross-origin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T5FKZXZ8GRuJMiCyDGvNmjPUmooaJwBn8RQWKM1xvPqbJ651I%2FeYRIIF9fpkzs5qUeu%2BH9%2FGYrph2fkPqInWp4hTWuPnMvH6R39BssNHjVluhzEgrB0FABima%2BsXyYJu4phh3sMfPLZEKxXwr4axhfiA"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding x-ms-request-id 986bbb7f-530f-4f35-8910-54e909ed12ad x-ms-route-info C514_BL2
GET H3	200	convergedlogin_pstringcustomizationhelper_ea3e62a2bdfb2b2ee8c8.js Show response rthfsdjrhte.trafficsdoctor.org/shared/1.0/content/js/asyncchunk/	111 KB 36 KB	22ms 22ms	Script application/x-javascript	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://rthfsdjrhte.trafficsdoctor.org/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_ea3e62a2bdfb2b2ee8c8.js Requested by Host: rthfsdjrhte.trafficsdoctor.org URL: https://rthfsdjrhte.trafficsdoctor.org/shared/1.0/content/js/ConvergedLogin_PCore_9i90DmN8HbFiIvCSmsAz-Q2.js Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `4be11c075187615adaf493d54cb7b05556e76806aed2b3b082d72952d0025be5` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://rthfsocprq.trafficsdoctor.org/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 16 May 2024 22:51:26 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 26684 x-cache TCP_HIT x-fd-int-roxy-purgeid 4554691 alt-svc h3=":443"; ma=86400 x-ms-lease-status unlocked last-modified Thu, 28 Mar 2024 21:22:22 GMT server cloudflare x-azure-ref 20240516T152642Z-17c898fb97fwjnb8c81kcqzkvs00000000gg00000000kyha report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Zztt2sPEIYyYtR%2Fq5G9z0RWSLjAvogiMHqeKKTYg%2BRT%2F6eewfGhvd2ZBeet64q%2FW0uOMesa8iTyvjakpTs7qBMNuUZ6zAmLGyFStc%2Bv4Cnq%2Bkhsjjmp%2B1ufR5i%2B4OV2t01RMKc%2FK0sIYKQHa3nPBjH0%3D"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript access-control-allow-origin * x-ms-request-id 42c80901-101e-0007-0161-a73490000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 vary Accept-Encoding cf-ray 884eeeb53e549214-FRA
GET H3	200	signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg rthfsdjrhte.trafficsdoctor.org/shared/1.0/content/images/	2 KB 1 KB	19ms 19ms	Image image/svg+xml	188.114.96.3 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://rthfsdjrhte.trafficsdoctor.org/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg Protocol H3 Security QUIC, , AES_128_GCM Server 188.114.96.3 Amsterdam, Netherlands, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://rthfsocprq.trafficsdoctor.org/ Accept-Language de-DE,de;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 16 May 2024 22:51:26 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 26684 x-cache TCP_HIT x-fd-int-roxy-purgeid 4554691 alt-svc h3=":443"; ma=86400 x-ms-lease-status unlocked last-modified Wed, 24 May 2023 10:11:49 GMT server cloudflare x-azure-ref 20240516T152642Z-1654dd6c8cb7wmvfg4ztn70v0800000003ug000000001qd4 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hl67kHTQHW8gxCCG12RCJs8ONeiuGT%2FN5KA0AcLOoXLI4WF8HKBdsyTgmCYQP6j6fzndifyQK8eUgh%2F4QgCQmWKj1tvPa%2BWCIM3m2Yo0UcFBVHrA%2FyXNIDcctf53KJS30wSfLoo2XbDrCMoY91RZ63Y%3D"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml access-control-allow-origin * x-ms-request-id fc3503c1-601e-004c-7c71-9fc296000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 vary Accept-Encoding cf-ray 884eeeb54e589214-FRA

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: rthfsdjrhte.trafficsdoctor.org
URL: https://rthfsdjrhte.trafficsdoctor.org/shared/1.0/content/js/BssoInterrupt_Core_RY3pVDLvjU_KKLtTKxjDFA2.js

Domain: rthfsdjrhte.trafficsdoctor.org
URL: https://rthfsdjrhte.trafficsdoctor.org/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js

Domain: rthfsdjrhte.trafficsdoctor.org
URL: https://rthfsdjrhte.trafficsdoctor.org/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js

Domain: rthfsdjrhte.trafficsdoctor.org
URL: https://rthfsdjrhte.trafficsdoctor.org/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js

Domain: rthfsdjrhte.trafficsdoctor.org
URL: https://rthfsdjrhte.trafficsdoctor.org/ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css

Domain: rthfsdjrhte.trafficsdoctor.org
URL: https://rthfsdjrhte.trafficsdoctor.org/shared/1.0/content/js/ConvergedLogin_PCore_9i90DmN8HbFiIvCSmsAz-Q2.js

Domain: rthfsdjrhte.trafficsdoctor.org
URL: https://rthfsdjrhte.trafficsdoctor.org/ests/2.1/content/cdnbundles/ux.converged.login.strings-de.min_pg3qvekbtzilyo4uvuckhw2.js

Domain: rthfsdjrhte.trafficsdoctor.org
URL: https://rthfsdjrhte.trafficsdoctor.org/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js

Domain: rthfsdjrhte.trafficsdoctor.org
URL: https://rthfsdjrhte.trafficsdoctor.org/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js

Domain: rthfsdjrhte.trafficsdoctor.org
URL: https://rthfsdjrhte.trafficsdoctor.org/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

21 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

19 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.bamboohr.com/	1969-12-31 23:59:59	Name: _cfuvid Value: 3x_swAXE5Avy9NZ3R5FbdhQXBVqwzj.3Ffxxfz5OX_0-1715899882351-0.0.1.1-604800000
.trafficsdoctor.org/	1970-01-20 20:38:23	Name: pHlS Value: 010c1071c16beb31949b03bbf30f9173cf432d01487930ebcdb93466ded9bac3
rthfsocprq.trafficsdoctor.org/	1969-12-31 23:59:59	Name: x-ms-gateway-slice Value: estsfd
rthfsocprq.trafficsdoctor.org/	1969-12-31 23:59:59	Name: stsservicecookie Value: estsfd
rthfshefbew.trafficsdoctor.org/	1970-01-20 20:38:48	Name: OH.DCAffinity Value: OH-sec
rthfshefbew.trafficsdoctor.org/	1970-01-21 05:23:55	Name: OH.FLID Value: fadf8793-16fd-41ce-a8a9-85943cbf2fba
rthfshefbew.trafficsdoctor.org/	1970-01-20 20:38:20	Name: .AspNetCore.OpenIdConnect.Nonce.gLPluF0Kd8GLk8Krxu49vUIZOWG82RaDD5G1stYpuiOR9GFtBI3d9ovbOpn3yjzWFcAunQMhn0Pr6j5r1Usmisj7HyeNYvAzTVVt_Hl0bWJqksyAPem_cDSyHqr-xDJ0Ia8slwDE_RI3GM-0wPJcJ3yzMg96MhqvjN-MFyEY2X0t3SVo9tGOmXSvNxG-rv02JyuMvobGsclMPgInlHXKJCU1PHX_RyByf8vrLE7Yok81SJEBNmaKYp-l49GgeRQR Value: N
rthfshefbew.trafficsdoctor.org/	1970-01-20 20:38:20	Name: .AspNetCore.Correlation.0v4GgR-4IK9wF9hB2EB9c8fSrBF5QGVLLHxkTdO7m-o Value: N
.trafficsdoctor.org/	1970-01-21 05:59:55	Name: MUID Value: 013677D6F983691D34C16357F8736824
.rthfsocprq.trafficsdoctor.org/	1969-12-31 23:59:59	Name: esctx-EPrC4EAzFbY Value: AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8IBTYZDfTGbMTD1oJ1rUTq_bRb7Hy_8E1xKEKV-Z45fMEx9yi7JxWEnNsl-CmU79G7XXGw5qFZEiJ4B7H1w0DCCAAQQ1LPCaleGxZwUOgF_qR1uDMbffSS8Yy_6908YyOnVN4gv5M0oOnC3HROMqv6iAA
.rthfsocprq.trafficsdoctor.org/	1969-12-31 23:59:59	Name: AADSSO Value: NA\|NoExtension
rthfsocprq.trafficsdoctor.org/	1970-01-20 20:38:19	Name: SSOCOOKIEPULLED Value: 1
rthfsocprq.trafficsdoctor.org/	1970-01-20 21:21:31	Name: buid Value: 0.AS8AMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8YL5-9I-CtwrT4JZIQZ5auZlzDtEK-mCCtZykhtseci_lOwQsrIlJmlnw1keX2DD6Ak9Yb4smViaddZ7XbOPYbvrJRWm_zDOE20A27HTrmW8gAA
.rthfsocprq.trafficsdoctor.org/	1969-12-31 23:59:59	Name: esctx Value: PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd85D7FcCAIZZC89vlP76ks6cqPnbpHzqqx5FBJ6jDj6SqTtswphBZSs9U4xNRwXeDX5XsAzScxPHuiDPRGj-85EPoW-DLBECbjWBLMro0c-IalYDGYlivqUwtPia5rjB4YtLck9vww4U5CmEPblvTAhdigqLV3a0E93f5E8yONGC8gAA
.rthfsocprq.trafficsdoctor.org/	1969-12-31 23:59:59	Name: esctx-dR8Y7vfL1n4 Value: AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8m2vgTIvTEV3JEceIsHLObiVIHHR8oTAl08IGSIKnj6-Q2VUykWmfZLtD-A7ucTmCJEvYuLYqYkf9AFUIBRFR8XvfXPjwG2hrwBU4g8aSmPy2Db2M1Y0MrndBpFB-4BcHhpC73nga8p1fkEJbvuEnyiAA
rthfsocprq.trafficsdoctor.org/	1970-01-20 21:21:31	Name: fpc Value: AkSoLVhyolxNofxryyvdhO-8Ae7AAQAAAOyE2N0OAAAA
.rthfsocprq.trafficsdoctor.org/	1970-01-21 05:59:55	Name: brcap Value: 0
.rthfshrvetbr.trafficsdoctor.org/	1969-12-31 23:59:59	Name: uaid Value: e283e1f6ea6947bbb8d96938ba2e381a
.rthfshrvetbr.trafficsdoctor.org/	1969-12-31 23:59:59	Name: MSPRequ Value: id=N&lt=1715899886&co=2

22 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://rthfsocprq.trafficsdoctor.org/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638514966834378742.MDBjYTFmMzItZDVmMC00MmNhLWFhOTYtNmM1NDM4MmFlM2Y0MDM1YjU1NjYtNjMwNy00YWMwLTg4YmItMjIxNjU3MTZmZTNj&ui_locales=de-DE&mkt=de-DE&client-request-id=cae916fc-0aa6-47ac-b232-1040fad8c8ea&state=jjrnl31dBLbT42FPgwbv-u4-wuU6OfNjpHU9VIeFVKYlOjoSnvjnjyLXeJjm8fl_iI7e_6Bx_xbUNk9sLGn2E8KAeg1J8dyVN1p8CdIn3BcP1xUZdpnSRPCPp3GbKpiocldVQP-sZKgNfaP2y0MFyC_c5BsphS2FDuIns7kk2KUN2XKwfN04-3A097rrckNZy33L9OfpQa6Gf3_s0DvtT3Dxjn39K7kX7pbam6belL3t8Y6m6DTNkYPKMgAR31VynHA8yMlo_jJZTNQ19fGsoQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0 Message: Access to script at 'https://rthfsdjrhte.trafficsdoctor.org/shared/1.0/content/js/BssoInterrupt_Core_RY3pVDLvjU_KKLtTKxjDFA2.js' from origin 'https://rthfsocprq.trafficsdoctor.org' has been blocked by CORS policy: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'.
network	error	URL: https://rthfsdjrhte.trafficsdoctor.org/shared/1.0/content/js/BssoInterrupt_Core_RY3pVDLvjU_KKLtTKxjDFA2.js Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://rthfsocprq.trafficsdoctor.org/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638514966834378742.MDBjYTFmMzItZDVmMC00MmNhLWFhOTYtNmM1NDM4MmFlM2Y0MDM1YjU1NjYtNjMwNy00YWMwLTg4YmItMjIxNjU3MTZmZTNj&ui_locales=de-DE&mkt=de-DE&client-request-id=cae916fc-0aa6-47ac-b232-1040fad8c8ea&state=jjrnl31dBLbT42FPgwbv-u4-wuU6OfNjpHU9VIeFVKYlOjoSnvjnjyLXeJjm8fl_iI7e_6Bx_xbUNk9sLGn2E8KAeg1J8dyVN1p8CdIn3BcP1xUZdpnSRPCPp3GbKpiocldVQP-sZKgNfaP2y0MFyC_c5BsphS2FDuIns7kk2KUN2XKwfN04-3A097rrckNZy33L9OfpQa6Gf3_s0DvtT3Dxjn39K7kX7pbam6belL3t8Y6m6DTNkYPKMgAR31VynHA8yMlo_jJZTNQ19fGsoQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0 Message: Access to script at 'https://rthfsdjrhte.trafficsdoctor.org/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js' from origin 'https://rthfsocprq.trafficsdoctor.org' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://rthfsdjrhte.trafficsdoctor.org/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://rthfsocprq.trafficsdoctor.org/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638514966834378742.MDBjYTFmMzItZDVmMC00MmNhLWFhOTYtNmM1NDM4MmFlM2Y0MDM1YjU1NjYtNjMwNy00YWMwLTg4YmItMjIxNjU3MTZmZTNj&ui_locales=de-DE&mkt=de-DE&client-request-id=cae916fc-0aa6-47ac-b232-1040fad8c8ea&state=jjrnl31dBLbT42FPgwbv-u4-wuU6OfNjpHU9VIeFVKYlOjoSnvjnjyLXeJjm8fl_iI7e_6Bx_xbUNk9sLGn2E8KAeg1J8dyVN1p8CdIn3BcP1xUZdpnSRPCPp3GbKpiocldVQP-sZKgNfaP2y0MFyC_c5BsphS2FDuIns7kk2KUN2XKwfN04-3A097rrckNZy33L9OfpQa6Gf3_s0DvtT3Dxjn39K7kX7pbam6belL3t8Y6m6DTNkYPKMgAR31VynHA8yMlo_jJZTNQ19fGsoQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0 Message: Access to script at 'https://rthfsdjrhte.trafficsdoctor.org/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js' from origin 'https://rthfsocprq.trafficsdoctor.org' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://rthfsdjrhte.trafficsdoctor.org/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://rthfsocprq.trafficsdoctor.org/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638514966834378742.MDBjYTFmMzItZDVmMC00MmNhLWFhOTYtNmM1NDM4MmFlM2Y0MDM1YjU1NjYtNjMwNy00YWMwLTg4YmItMjIxNjU3MTZmZTNj&ui_locales=de-DE&mkt=de-DE&client-request-id=cae916fc-0aa6-47ac-b232-1040fad8c8ea&state=jjrnl31dBLbT42FPgwbv-u4-wuU6OfNjpHU9VIeFVKYlOjoSnvjnjyLXeJjm8fl_iI7e_6Bx_xbUNk9sLGn2E8KAeg1J8dyVN1p8CdIn3BcP1xUZdpnSRPCPp3GbKpiocldVQP-sZKgNfaP2y0MFyC_c5BsphS2FDuIns7kk2KUN2XKwfN04-3A097rrckNZy33L9OfpQa6Gf3_s0DvtT3Dxjn39K7kX7pbam6belL3t8Y6m6DTNkYPKMgAR31VynHA8yMlo_jJZTNQ19fGsoQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0 Message: Access to script at 'https://rthfsdjrhte.trafficsdoctor.org/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js' from origin 'https://rthfsocprq.trafficsdoctor.org' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://rthfsdjrhte.trafficsdoctor.org/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js Message: Failed to load resource: net::ERR_FAILED
network	error	URL: https://rthfsocprq.trafficsdoctor.org/favicon.ico Message: Failed to load resource: the server responded with a status of 404 ()
javascript	error	URL: https://rthfsocprq.trafficsdoctor.org/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638514966834378742.MDBjYTFmMzItZDVmMC00MmNhLWFhOTYtNmM1NDM4MmFlM2Y0MDM1YjU1NjYtNjMwNy00YWMwLTg4YmItMjIxNjU3MTZmZTNj&ui_locales=de-DE&mkt=de-DE&client-request-id=cae916fc-0aa6-47ac-b232-1040fad8c8ea&state=jjrnl31dBLbT42FPgwbv-u4-wuU6OfNjpHU9VIeFVKYlOjoSnvjnjyLXeJjm8fl_iI7e_6Bx_xbUNk9sLGn2E8KAeg1J8dyVN1p8CdIn3BcP1xUZdpnSRPCPp3GbKpiocldVQP-sZKgNfaP2y0MFyC_c5BsphS2FDuIns7kk2KUN2XKwfN04-3A097rrckNZy33L9OfpQa6Gf3_s0DvtT3Dxjn39K7kX7pbam6belL3t8Y6m6DTNkYPKMgAR31VynHA8yMlo_jJZTNQ19fGsoQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true Message: Access to script at 'https://rthfsdjrhte.trafficsdoctor.org/shared/1.0/content/js/ConvergedLogin_PCore_9i90DmN8HbFiIvCSmsAz-Q2.js' from origin 'https://rthfsocprq.trafficsdoctor.org' has been blocked by CORS policy: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'.
network	error	URL: https://rthfsdjrhte.trafficsdoctor.org/shared/1.0/content/js/ConvergedLogin_PCore_9i90DmN8HbFiIvCSmsAz-Q2.js Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://rthfsocprq.trafficsdoctor.org/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638514966834378742.MDBjYTFmMzItZDVmMC00MmNhLWFhOTYtNmM1NDM4MmFlM2Y0MDM1YjU1NjYtNjMwNy00YWMwLTg4YmItMjIxNjU3MTZmZTNj&ui_locales=de-DE&mkt=de-DE&client-request-id=cae916fc-0aa6-47ac-b232-1040fad8c8ea&state=jjrnl31dBLbT42FPgwbv-u4-wuU6OfNjpHU9VIeFVKYlOjoSnvjnjyLXeJjm8fl_iI7e_6Bx_xbUNk9sLGn2E8KAeg1J8dyVN1p8CdIn3BcP1xUZdpnSRPCPp3GbKpiocldVQP-sZKgNfaP2y0MFyC_c5BsphS2FDuIns7kk2KUN2XKwfN04-3A097rrckNZy33L9OfpQa6Gf3_s0DvtT3Dxjn39K7kX7pbam6belL3t8Y6m6DTNkYPKMgAR31VynHA8yMlo_jJZTNQ19fGsoQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true Message: Access to CSS stylesheet at 'https://rthfsdjrhte.trafficsdoctor.org/ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css' from origin 'https://rthfsocprq.trafficsdoctor.org' has been blocked by CORS policy: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'.
network	error	URL: https://rthfsdjrhte.trafficsdoctor.org/ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://rthfsocprq.trafficsdoctor.org/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638514966834378742.MDBjYTFmMzItZDVmMC00MmNhLWFhOTYtNmM1NDM4MmFlM2Y0MDM1YjU1NjYtNjMwNy00YWMwLTg4YmItMjIxNjU3MTZmZTNj&ui_locales=de-DE&mkt=de-DE&client-request-id=cae916fc-0aa6-47ac-b232-1040fad8c8ea&state=jjrnl31dBLbT42FPgwbv-u4-wuU6OfNjpHU9VIeFVKYlOjoSnvjnjyLXeJjm8fl_iI7e_6Bx_xbUNk9sLGn2E8KAeg1J8dyVN1p8CdIn3BcP1xUZdpnSRPCPp3GbKpiocldVQP-sZKgNfaP2y0MFyC_c5BsphS2FDuIns7kk2KUN2XKwfN04-3A097rrckNZy33L9OfpQa6Gf3_s0DvtT3Dxjn39K7kX7pbam6belL3t8Y6m6DTNkYPKMgAR31VynHA8yMlo_jJZTNQ19fGsoQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true Message: Access to script at 'https://rthfsdjrhte.trafficsdoctor.org/ests/2.1/content/cdnbundles/ux.converged.login.strings-de.min_pg3qvekbtzilyo4uvuckhw2.js' from origin 'https://rthfsocprq.trafficsdoctor.org' has been blocked by CORS policy: The value of the 'Access-Control-Allow-Origin' header in the response must not be the wildcard '*' when the request's credentials mode is 'include'.
network	error	URL: https://rthfsdjrhte.trafficsdoctor.org/ests/2.1/content/cdnbundles/ux.converged.login.strings-de.min_pg3qvekbtzilyo4uvuckhw2.js Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://rthfsocprq.trafficsdoctor.org/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638514966834378742.MDBjYTFmMzItZDVmMC00MmNhLWFhOTYtNmM1NDM4MmFlM2Y0MDM1YjU1NjYtNjMwNy00YWMwLTg4YmItMjIxNjU3MTZmZTNj&ui_locales=de-DE&mkt=de-DE&client-request-id=cae916fc-0aa6-47ac-b232-1040fad8c8ea&state=jjrnl31dBLbT42FPgwbv-u4-wuU6OfNjpHU9VIeFVKYlOjoSnvjnjyLXeJjm8fl_iI7e_6Bx_xbUNk9sLGn2E8KAeg1J8dyVN1p8CdIn3BcP1xUZdpnSRPCPp3GbKpiocldVQP-sZKgNfaP2y0MFyC_c5BsphS2FDuIns7kk2KUN2XKwfN04-3A097rrckNZy33L9OfpQa6Gf3_s0DvtT3Dxjn39K7kX7pbam6belL3t8Y6m6DTNkYPKMgAR31VynHA8yMlo_jJZTNQ19fGsoQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true Message: Access to script at 'https://rthfsdjrhte.trafficsdoctor.org/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js' from origin 'https://rthfsocprq.trafficsdoctor.org' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://rthfsdjrhte.trafficsdoctor.org/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://rthfsocprq.trafficsdoctor.org/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638514966834378742.MDBjYTFmMzItZDVmMC00MmNhLWFhOTYtNmM1NDM4MmFlM2Y0MDM1YjU1NjYtNjMwNy00YWMwLTg4YmItMjIxNjU3MTZmZTNj&ui_locales=de-DE&mkt=de-DE&client-request-id=cae916fc-0aa6-47ac-b232-1040fad8c8ea&state=jjrnl31dBLbT42FPgwbv-u4-wuU6OfNjpHU9VIeFVKYlOjoSnvjnjyLXeJjm8fl_iI7e_6Bx_xbUNk9sLGn2E8KAeg1J8dyVN1p8CdIn3BcP1xUZdpnSRPCPp3GbKpiocldVQP-sZKgNfaP2y0MFyC_c5BsphS2FDuIns7kk2KUN2XKwfN04-3A097rrckNZy33L9OfpQa6Gf3_s0DvtT3Dxjn39K7kX7pbam6belL3t8Y6m6DTNkYPKMgAR31VynHA8yMlo_jJZTNQ19fGsoQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true Message: Access to script at 'https://rthfsdjrhte.trafficsdoctor.org/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js' from origin 'https://rthfsocprq.trafficsdoctor.org' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://rthfsdjrhte.trafficsdoctor.org/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://rthfsocprq.trafficsdoctor.org/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638514966834378742.MDBjYTFmMzItZDVmMC00MmNhLWFhOTYtNmM1NDM4MmFlM2Y0MDM1YjU1NjYtNjMwNy00YWMwLTg4YmItMjIxNjU3MTZmZTNj&ui_locales=de-DE&mkt=de-DE&client-request-id=cae916fc-0aa6-47ac-b232-1040fad8c8ea&state=jjrnl31dBLbT42FPgwbv-u4-wuU6OfNjpHU9VIeFVKYlOjoSnvjnjyLXeJjm8fl_iI7e_6Bx_xbUNk9sLGn2E8KAeg1J8dyVN1p8CdIn3BcP1xUZdpnSRPCPp3GbKpiocldVQP-sZKgNfaP2y0MFyC_c5BsphS2FDuIns7kk2KUN2XKwfN04-3A097rrckNZy33L9OfpQa6Gf3_s0DvtT3Dxjn39K7kX7pbam6belL3t8Y6m6DTNkYPKMgAR31VynHA8yMlo_jJZTNQ19fGsoQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true Message: Access to script at 'https://rthfsdjrhte.trafficsdoctor.org/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js' from origin 'https://rthfsocprq.trafficsdoctor.org' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://rthfsdjrhte.trafficsdoctor.org/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js Message: Failed to load resource: net::ERR_FAILED
recommendation	verbose	URL: https://rthfsocprq.trafficsdoctor.org/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638514966834378742.MDBjYTFmMzItZDVmMC00MmNhLWFhOTYtNmM1NDM4MmFlM2Y0MDM1YjU1NjYtNjMwNy00YWMwLTg4YmItMjIxNjU3MTZmZTNj&ui_locales=de-DE&mkt=de-DE&client-request-id=cae916fc-0aa6-47ac-b232-1040fad8c8ea&state=jjrnl31dBLbT42FPgwbv-u4-wuU6OfNjpHU9VIeFVKYlOjoSnvjnjyLXeJjm8fl_iI7e_6Bx_xbUNk9sLGn2E8KAeg1J8dyVN1p8CdIn3BcP1xUZdpnSRPCPp3GbKpiocldVQP-sZKgNfaP2y0MFyC_c5BsphS2FDuIns7kk2KUN2XKwfN04-3A097rrckNZy33L9OfpQa6Gf3_s0DvtT3Dxjn39K7kX7pbam6belL3t8Y6m6DTNkYPKMgAR31VynHA8yMlo_jJZTNQ19fGsoQ&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

email.app.bamboohr.com
rthfsdjrhte.trafficsdoctor.org
rthfshefbew.trafficsdoctor.org
rthfshrvetbr.trafficsdoctor.org
rthfsmeheff.trafficsdoctor.org
rthfsocprq.trafficsdoctor.org
rthfsdjrhte.trafficsdoctor.org
188.114.96.3
188.114.97.3
2606:4700::6811:f670
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
1f74044ddfaf154497974982234d52d8066ca432fdfea221fce31d55a68f0d6c
245f9142bda9ad96c504683dcdd8be8b01188122dc1662a21deba9797c1f31f4
35afb11dab6edcbc989a25fe5cf19f5d8289499232b7ec775f318d8b8a5bbf78
4638fd8935d19192119469391e3befbb88f620ccd8eeeef2045cd5bdd3bba414
474ce0790ceb18a100cebaf1ac0915a51389fcae0830c3b44bfa1e365d40b2b4
49b5577253df30d270fa49037d7f669b5e7450317d13dba2c66af1c8b58ddd68
4b01a0a34ce8ed4bc8a8713be0442d49da6a756236b7b4424622ca3dee820f41
4be11c075187615adaf493d54cb7b05556e76806aed2b3b082d72952d0025be5
6e86239d63bb800c75bd2ee4ca9720b7e54112807265f32b859ef1325cf7e531
8737d721808655f37b333f08a90185699e7e8b9bdaaa15cdb63c8448b426f95d
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21
a46201581a7c7c667fd42787cd1e9adf2f6bf809efb7596e61a03e8dba9ada13
b2395b217b15b703afff5fd46b546935bfaf89e040902744912131b273856c32
e18658374541f996aae7a8a47e0f90d5bb63f7ebe0a20d775d1d258544c2b49e
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

rthfsocprq.trafficsdoctor.org Open in urlscan Pro 188.114.96.3 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

31 Requests

68 %HTTPS

33 %IPv6

2 Domains

6 Subdomains

3 IPs

2 Countries

342 kBTransfer

1188 kBSize

19 Cookies

4 Outgoing links

Page URL History

Redirected requests

31 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

21 JavaScript Global Variables

19 Cookies

22 Console Messages

Indicators

rthfsocprq.trafficsdoctor.org Open in urlscan Pro
188.114.96.3 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

31
Requests

68 %
HTTPS

33 %
IPv6

2
Domains

6
Subdomains

3
IPs

2
Countries

342 kB
Transfer

1188 kB
Size

19
Cookies

31 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!