login.microsoftonline.com Open in urlscan Pro
40.126.32.69  Public Scan

3 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

1. https://hype-external.alight.com/prweb/PRHTTPService/MKT/RH/POREv2?Px=%7Bpr%7DnH2nLCVDNlgPNFAh9Iahu92ToJJwTjU2irA3pVG3b%2Fx9kvckSTsgSrbrK2GKxYd3PoGXQIUZX5YW%0A06M4KWYDdsfaD%2BKWmmq1%2BbnCbWjYG821jG60yB4d1rBWDm%2FpJrbbI%2Betw1NBDr91N2gekysydk3F%0AUXEIqBSBVU49dmo1XZ7bO3QZXXvwsXxA5cIPpBEwA4LPxIZ%2B6qgGsLXOhqvQyLLwxJ4jtTGYzg19%0A0QscIAQp6%2FjKW34bJyfRrTPeB7RaDiEAC29kUPty21jpYlAROWNu96CdnwQK8QE1mxxfRGJSNYhP%0Agzp1RpKid7XWBASO4GWI6j6wp1D8tXlqtH1PZSSVUW%2B4gQx7p1J5nuOyh%2FgznOUn06FjGDhjyL2a%0AdJPJ1ePkB%2FYX1sJv%2BWxYf2F4m9vv9nAas8tKvs%2BuYDLPhH%2FQ%2FvcUSEvoEwpfvCRyMtjGzQ0WU56s%0AdSSVP0wxeIRCya8wB3NV%2BdFVjd4bsd%2F1hMerd8HBf6poeSCNriSo3%2BRHJ96vR5K0%2B3FUt1J0SS%2Fb%0AwWhTy%2BHA%2BIUe3Q1CPfa3%2FjzKrqa0RLyh%2FT4joI3IQuzRk9EUk70EFU2Ps2tHwnkh9enrjZW9FVMB%0ALzIfCJTuP2FdDmKIl%2B82PdTfFu689AV%2B5sY%2BXrpY%2BzOXI4A1nmY8cWmwXo%2BvvCJtmVR41PZhYLsP%0A70SqDNd2olBDjsu4BOBR Page URL
2. https://saml.alight.com/sp/startSSO.ping?PartnerIdpId=https://sts.windows.net/771c9c47-7f24-44dc-958e-34f8713a8394/&TargetResource=https://sso.alight.com/portal%3FpageCd%3DL_SwordProgram Page URL
3. https://login.microsoftonline.com/771c9c47-7f24-44dc-958e-34f8713a8394/saml2 Page URL
4. https://login.microsoftonline.com/771c9c47-7f24-44dc-958e-34f8713a8394/saml2?sso_reload=true Page URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

13 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200	POREv2 Show response hype-external.alight.com/prweb/PRHTTPService/MKT/RH/	391 B 1 KB	485ms 249ms	Document text/html	204.152.239.42 ALIGHT-SOLUTIONS-LLC
General Check archive.org Show headers Download Go to Full URL https://hype-external.alight.com/prweb/PRHTTPService/MKT/RH/POREv2?Px=%7Bpr%7DnH2nLCVDNlgPNFAh9Iahu92ToJJwTjU2irA3pVG3b%2Fx9kvckSTsgSrbrK2GKxYd3PoGXQIUZX5YW%0A06M4KWYDdsfaD%2BKWmmq1%2BbnCbWjYG821jG60yB4d1rBWDm%2FpJrbbI%2Betw1NBDr91N2gekysydk3F%0AUXEIqBSBVU49dmo1XZ7bO3QZXXvwsXxA5cIPpBEwA4LPxIZ%2B6qgGsLXOhqvQyLLwxJ4jtTGYzg19%0A0QscIAQp6%2FjKW34bJyfRrTPeB7RaDiEAC29kUPty21jpYlAROWNu96CdnwQK8QE1mxxfRGJSNYhP%0Agzp1RpKid7XWBASO4GWI6j6wp1D8tXlqtH1PZSSVUW%2B4gQx7p1J5nuOyh%2FgznOUn06FjGDhjyL2a%0AdJPJ1ePkB%2FYX1sJv%2BWxYf2F4m9vv9nAas8tKvs%2BuYDLPhH%2FQ%2FvcUSEvoEwpfvCRyMtjGzQ0WU56s%0AdSSVP0wxeIRCya8wB3NV%2BdFVjd4bsd%2F1hMerd8HBf6poeSCNriSo3%2BRHJ96vR5K0%2B3FUt1J0SS%2Fb%0AwWhTy%2BHA%2BIUe3Q1CPfa3%2FjzKrqa0RLyh%2FT4joI3IQuzRk9EUk70EFU2Ps2tHwnkh9enrjZW9FVMB%0ALzIfCJTuP2FdDmKIl%2B82PdTfFu689AV%2B5sY%2BXrpY%2BzOXI4A1nmY8cWmwXo%2BvvCJtmVR41PZhYLsP%0A70SqDNd2olBDjsu4BOBR Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 204.152.239.42 Riverside, United States, ASN13716 (ALIGHT-SOLUTIONS-LLC, US), Reverse DNS Software Apache / Resource Hash 67464e8eb69180939f3e540b69d027db8de2f85f2b07c209309078159a4d0140 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Cache-Control no-cache Connection Keep-Alive Content-Length 391 Content-Type text/html;charset=UTF-8 Date Mon, 20 Feb 2023 02:29:11 GMT Expires 0 Keep-Alive timeout=5, max=1000 Pragma no-cache Server Apache
GET H/1.1	200 OK	startSSO.ping Show response saml.alight.com/sp/	1 KB 2 KB	393ms 126ms	Document text/html	204.152.235.123 ALIGHT-SOLUTIONS-LLC
General Check archive.org Show headers Download Go to Full URL https://saml.alight.com/sp/startSSO.ping?PartnerIdpId=https://sts.windows.net/771c9c47-7f24-44dc-958e-34f8713a8394/&TargetResource=https://sso.alight.com/portal%3FpageCd%3DL_SwordProgram Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 204.152.235.123 Riverside, United States, ASN13716 (ALIGHT-SOLUTIONS-LLC, US), Reverse DNS Software / Resource Hash e387acc577beb7a8e260086596c712e35c7975ab06264beb2b45df10d356d163 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubdomains; Request headers Referer https://hype-external.alight.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Cache-Control no-cache, no-store Connection Keep-Alive Content-Length 1350 Content-Type text/html;charset=utf-8 Date Mon, 20 Feb 2023 02:29:12 GMT Expires Thu, 01 Jan 1970 00:00:00 GMT Keep-Alive timeout=5, max=1000 Pragma no-cache Strict-Transport-Security max-age=31536000; includeSubdomains;
POST H/1.1	200 OK	saml2 Show response login.microsoftonline.com/771c9c47-7f24-44dc-958e-34f8713a8394/	152 KB 55 KB	678ms 631ms	Document text/html	40.126.32.69 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://login.microsoftonline.com/771c9c47-7f24-44dc-958e-34f8713a8394/saml2 Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 40.126.32.69 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 92a9a91faa82b2f7727e4c8b1293402ce5cb7fec6a855341ec9e4e9408ef907f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Content-Type application/x-www-form-urlencoded Origin https://saml.alight.com Referer https://saml.alight.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Cache-Control no-store, no-cache Content-Encoding gzip Content-Length 55261 Content-Type text/html; charset=utf-8 Date Mon, 20 Feb 2023 02:29:12 GMT Expires -1 P3P CP="DSP CUR OTPi IND OTRi ONL FIN" Pragma no-cache Referrer-Policy strict-origin-when-cross-origin Strict-Transport-Security max-age=31536000; includeSubDomains Vary Accept-Encoding X-Content-Type-Options nosniff X-XSS-Protection 0 nel {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} report-to {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+ams1"}]} x-ms-ests-server 2.1.14601.11 - NCUS ProdSlices x-ms-request-id abaaa0c6-60a4-488f-9869-1abc24111800
POST H/1.1	200 OK	Primary Request saml2 Show response login.microsoftonline.com/771c9c47-7f24-44dc-958e-34f8713a8394/	199 KB 52 KB	648ms 648ms	Document text/html	40.126.32.69 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://login.microsoftonline.com/771c9c47-7f24-44dc-958e-34f8713a8394/saml2?sso_reload=true Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 40.126.32.69 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 97a2cafa017013813f8cb14d2cc5923d98fcb0a13c088477d609673a2c24a93d Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Content-Type application/x-www-form-urlencoded Origin https://login.microsoftonline.com Referer https://login.microsoftonline.com/771c9c47-7f24-44dc-958e-34f8713a8394/saml2 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Cache-Control no-store, no-cache Content-Encoding gzip Content-Length 51097 Content-Type text/html; charset=utf-8 Date Mon, 20 Feb 2023 02:29:12 GMT Expires -1 Link <https://aadcdn.msauth.net>; rel=preconnect; crossorigin <https://aadcdn.msauth.net>; rel=dns-prefetch <https://aadcdn.msftauth.net>; rel=dns-prefetch P3P CP="DSP CUR OTPi IND OTRi ONL FIN" Pragma no-cache Referrer-Policy strict-origin-when-cross-origin Strict-Transport-Security max-age=31536000; includeSubDomains Vary Accept-Encoding X-Content-Type-Options nosniff X-DNS-Prefetch-Control on X-Frame-Options DENY X-XSS-Protection 0 nel {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} report-to {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+ams1"}]} x-ms-ests-server 2.1.14601.11 - SCUS ProdSlices x-ms-request-id 955b6f76-3bca-43ca-ae2d-031e5b7a1a00
GET H2	200	ConvergedLogin_PCore_107jr3BDJx7vcmkFlFtgbQ2.js Show response aadcdn.msauth.net/shared/1.0/content/js/	394 KB 111 KB	196ms 11ms	Script application/x-javascript	2620:1ec:4f:1::44 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_107jr3BDJx7vcmkFlFtgbQ2.js Requested by Host: login.microsoftonline.com URL: https://login.microsoftonline.com/771c9c47-7f24-44dc-958e-34f8713a8394/saml2?sso_reload=true Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:4f:1::44 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 7882199766af67996985bc27a2da42c974810bb9e4f04e093d5ecb64bf64182e Request headers Referer https://login.microsoftonline.com/ Origin https://login.microsoftonline.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 20 Feb 2023 02:29:13 GMT content-encoding gzip x-cache TCP_HIT content-length 112962 x-ms-lease-status unlocked last-modified Tue, 10 Jan 2023 18:52:31 GMT etag 0x8DAF33BD42063FA x-azure-ref 20230220T022913Z-pwb8bf9bpt5n9636xufvnn8syn00000002w0000000007s20 content-type application/x-javascript access-control-allow-origin * x-ms-request-id 9d4ae960-c01e-0067-4304-3fa45f000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H/1.1	200 OK	Me.htm login.live.com/	0 0	192ms 100ms	Other text/html	40.126.31.70 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://login.live.com/Me.htm?v=3 Requested by Host: login.microsoftonline.com URL: https://login.microsoftonline.com/771c9c47-7f24-44dc-958e-34f8713a8394/saml2?sso_reload=true Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 40.126.31.70 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://login.microsoftonline.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers
GET H2	200	convergedlogin_pcustomizationloader_f226dd7c4f08045ad544.js Show response aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/	107 KB 32 KB	38ms 18ms	Script application/x-javascript	2620:1ec:4f:1::44 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_f226dd7c4f08045ad544.js Requested by Host: aadcdn.msauth.net URL: https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_107jr3BDJx7vcmkFlFtgbQ2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:4f:1::44 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash b22fc156c87081fbd745b1742898bbba5755a779d86ada9489c08196cd4d55c8 Request headers accept-language de-DE,de;q=0.9 Referer https://login.microsoftonline.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 20 Feb 2023 02:29:13 GMT content-encoding gzip x-azure-ref-originshield 0IinwYwAAAACww+67wI8zTYODLLXn3RR1RlJBMjMxMDUwNDE3MDI3ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== content-md5 YVvRQn8alC3N3tI6cG7wJQ== x-cache TCP_HIT content-length 32196 x-ms-lease-status unlocked last-modified Tue, 10 Jan 2023 18:52:09 GMT server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 etag 0x8DAF33BC6F7B414 x-azure-ref 0+dryYwAAAADC0qsF39coQZGDK74SpjbfRlJBMzFFREdFMDMyMgAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY= content-type application/x-javascript access-control-allow-origin * x-ms-request-id 4893f274-201e-002d-5f62-3b795b000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19
GET H2	200	converged.v2.login.min_8owwt4u-33ps0wawi7tmow2.css aadcdn.msauth.net/ests/2.1/content/cdnbundles/	0 20 KB	13ms 11ms	Other text/css	2620:1ec:4f:1::44 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_8owwt4u-33ps0wawi7tmow2.css Requested by Host: login.microsoftonline.com URL: https://login.microsoftonline.com/771c9c47-7f24-44dc-958e-34f8713a8394/saml2?sso_reload=true Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:4f:1::44 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://login.microsoftonline.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 20 Feb 2023 02:29:13 GMT content-encoding gzip x-azure-ref-originshield 02Q/wYwAAAADErrQIY19xTqO1OHV/Sc6ARlJBMjMxMDUwNDE4MDQ5ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== content-md5 9K2/nGCj75WAmmAI9nZNCA== x-cache TCP_HIT content-length 19970 x-ms-lease-status unlocked last-modified Thu, 04 Aug 2022 19:37:00 GMT server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 etag 0x8DA7650B37ACC3D x-azure-ref 0+dryYwAAAADZn0jO9udLQqbjrq/yX1YKRlJBMzFFREdFMDMyMgAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY= content-type text/css access-control-allow-origin * x-ms-request-id 885b679c-701e-0098-0b35-3b8815000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19
GET H2	200	ux.converged.login.strings-de.min_egm72xgxis3arkcshl_vsg2.js aadcdn.msauth.net/ests/2.1/content/cdnbundles/	0 15 KB	19ms 18ms	Other application/x-javascript	2620:1ec:4f:1::44 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-de.min_egm72xgxis3arkcshl_vsg2.js Requested by Host: login.microsoftonline.com URL: https://login.microsoftonline.com/771c9c47-7f24-44dc-958e-34f8713a8394/saml2?sso_reload=true Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:4f:1::44 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://login.microsoftonline.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 20 Feb 2023 02:29:13 GMT content-encoding gzip x-azure-ref-originshield 0H+vvYwAAAABewiChHwJ2Qb+OLEq06UzZRlJBMjMxMDUwNDE3MDI1ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== content-md5 k7fVZXvzmEOgfmeeNd3Kyw== x-cache TCP_HIT content-length 15207 x-ms-lease-status unlocked last-modified Sat, 17 Dec 2022 08:38:03 GMT server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 etag 0x8DAE00A0321E74C x-azure-ref 0+dryYwAAAAAa9/qs0fBVRYv9NnGDDWNSRlJBMzFFREdFMDMyMgAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY= content-type application/x-javascript access-control-allow-origin * x-ms-request-id 17d5eae7-501e-0076-1b98-413f7f000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19
GET H2	200	illustration aadcdn.msauthimages.net/dbd5a2dd-v-8rcyyuzxfgvnd301orkhj-lwfft4r6cqehfismhma/logintenantbranding/0/	57 KB 57 KB	191ms 9ms	Image image/*	152.199.23.72 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauthimages.net/dbd5a2dd-v-8rcyyuzxfgvnd301orkhj-lwfft4r6cqehfismhma/logintenantbranding/0/illustration?ts=637027522486896217 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.23.72 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/4CC1) / Resource Hash 4a0fe34684996028ce83cc6f9f07052e565386b89e5313d6db254ad274f61368 Request headers accept-language de-DE,de;q=0.9 Referer https://login.microsoftonline.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers x-ms-lease-status unlocked x-ms-blob-type BlockBlob date Mon, 20 Feb 2023 02:29:14 GMT last-modified Fri, 30 Aug 2019 08:57:29 GMT server ECAcc (frc/4CC1) content-md5 fTtfS4xAcrQkRlfYL8MS9w== age 3916 etag 0x8D72D2816B9189B x-cache HIT content-type image/* x-ms-request-id a44de8ed-001e-0084-26ca-44d671000000 cache-control public, max-age=86400 x-ms-version 2009-09-19 accept-ranges bytes content-length 58351
GET H2	200	bannerlogo aadcdn.msauthimages.net/dbd5a2dd-v-8rcyyuzxfgvnd301orkhj-lwfft4r6cqehfismhma/logintenantbranding/0/	5 KB 5 KB	189ms 7ms	Image image/*	152.199.23.72 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauthimages.net/dbd5a2dd-v-8rcyyuzxfgvnd301orkhj-lwfft4r6cqehfismhma/logintenantbranding/0/bannerlogo?ts=637027522510224792 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.23.72 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/4D04) / Resource Hash 1b28fa37690c44485d747decdc67e570b324eb6c0762939aaf682d123042bd50 Request headers accept-language de-DE,de;q=0.9 Referer https://login.microsoftonline.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers x-ms-lease-status unlocked x-ms-blob-type BlockBlob date Mon, 20 Feb 2023 02:29:14 GMT last-modified Fri, 30 Aug 2019 08:57:31 GMT server ECAcc (frc/4D04) content-md5 Do4k8aiOPb5+2oGU3kWBOQ== age 3916 etag 0x8D72D2817EAA453 x-cache HIT content-type image/* x-ms-request-id 1f50128a-901e-0046-75ca-445ecf000000 cache-control public, max-age=86400 x-ms-version 2009-09-19 accept-ranges bytes content-length 4757
GET H2	200	convergedlogin_pstringcustomizationhelper_881cfed13e4de9243d02.js Show response aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/	111 KB 35 KB	10ms 9ms	Script application/x-javascript	2620:1ec:4f:1::44 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_881cfed13e4de9243d02.js Requested by Host: aadcdn.msauth.net URL: https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_107jr3BDJx7vcmkFlFtgbQ2.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:4f:1::44 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash fab4e269d8c1f352519f80252bf81bb4aa64d33556d9f812bfdb93464c5ca234 Request headers accept-language de-DE,de;q=0.9 Referer https://login.microsoftonline.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 20 Feb 2023 02:29:13 GMT content-encoding gzip x-azure-ref-originshield 0xUnwYwAAAADOwnbQeuXrSoMaxVQnr7jxRlJBMjMxMDUwNDE4MDQ1ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== content-md5 0mK+NcE8D9/LFiugof4bnQ== x-cache TCP_HIT content-length 35791 x-ms-lease-status unlocked last-modified Tue, 10 Jan 2023 18:52:10 GMT server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 etag 0x8DAF33BC7C616F4 x-azure-ref 0+tryYwAAAAAGLPZ7kPGsSKTqv6kI2/1ZRlJBMzFFREdFMDMyMgAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY= content-type application/x-javascript access-control-allow-origin * x-ms-request-id 1a9a77e8-a01e-008d-6d30-3bbf3d000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19
GET H2	200	signin-options_4e48046ce74f4b89d45037c90576bfac.svg aadcdn.msauth.net/shared/1.0/content/images/	2 KB 968 B	9ms 9ms	Image image/svg+xml	2620:1ec:4f:1::44 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:4f:1::44 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 / Resource Hash 8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93 Request headers accept-language de-DE,de;q=0.9 Referer https://login.microsoftonline.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 20 Feb 2023 02:29:13 GMT content-encoding gzip x-azure-ref-originshield 0gOrvYwAAAAADilNMGoG5SZxDH+umj7o1RlJBMjMxMDUwNDE4MDM5ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== content-md5 R2FAVxfpONfnQAuxVxXbHg== x-cache TCP_HIT content-length 621 x-ms-lease-status unlocked last-modified Tue, 10 Nov 2020 03:41:24 GMT server Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 etag 0x8D8852A7FA6B761 x-azure-ref 0+tryYwAAAADqO+XAkqEoQ7kK59HekjhQRlJBMzFFREdFMDMyMgAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY= content-type image/svg+xml access-control-allow-origin * x-ms-request-id 808c6e1a-101e-0062-4007-432355000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| oncontentvisibilityautostatechange object| $Config object| $Debug object| $Do function| $Loader object| $WebWatson function| GetString function| GetErrorString function| GetUrl object| $B object| ServerData object| webpackJsonp object| ko object| PROOF object| StringRepository object| Telemetry object| telemetry_webpackJsonp boolean| __ConvergedLogin_PCore boolean| __ boolean| __convergedlogin_pcustomizationloader_f226dd7c4f08045ad544 boolean| __convergedlogin_pstringcustomizationhelper_881cfed13e4de9243d02

15 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			hype-external.alight.com/prweb	1969-12-31 23:59:59	Name: JSESSIONID Value: 19C84DE0A795157A386B6224E1B4FE12
			hype-external.alight.com/	1970-01-20 09:57:44	Name: AWSALB Value: 8RGp8poVMkAvPQ5wZbml+DDWtvavisvAgqHSv8DcgVQhF7nfEWQJ7y0SKCs3n2wU9l9kAbX7WVQP2BPmHqUV5C5zsrco0na46jhGdK8xjbnP8pM0mlkeCXKZ/zDP
			hype-external.alight.com/	1970-01-20 09:57:44	Name: AWSALBCORS Value: 8RGp8poVMkAvPQ5wZbml+DDWtvavisvAgqHSv8DcgVQhF7nfEWQJ7y0SKCs3n2wU9l9kAbX7WVQP2BPmHqUV5C5zsrco0na46jhGdK8xjbnP8pM0mlkeCXKZ/zDP
			hype-external.alight.com/	1970-01-20 18:32:55	Name: MKTID Value: C-%7Bpr%7DKX3XgOFl3Vl1spHxNOUaOb8HOnL%2BhNASv2gGunMqqGs%3D
			saml.alight.com/	1969-12-31 23:59:59	Name: PF Value: 9KZXlPEdTY2RmMzvlTzfsE
			login.microsoftonline.com/	1969-12-31 23:59:59	Name: x-ms-gateway-slice Value: estsfd
			login.microsoftonline.com/	1969-12-31 23:59:59	Name: stsservicecookie Value: estsfd
			.login.microsoftonline.com/	1969-12-31 23:59:59	Name: AADSSO Value: NA|NoExtension
			login.microsoftonline.com/	1970-01-20 09:47:40	Name: SSOCOOKIEPULLED Value: 1
			login.microsoftonline.com/	1970-01-20 10:30:52	Name: buid Value: 0.AQQAR5wcdyR_3ESVjjT4cTqDlILelz1bvbZLiPtm-utpvC0EAAA.AQABAAEAAAD--DLA3VO7QrddgJg7Wevr8zJwesSG4WpF2VJZZ9VlqEGAtgcaAMk_YIuKuRL0nwC6aqM1Tug41QmLKm-qk3NwjNbNphvjimJHLOtgzKaha_7fcuRJobBvYO63Y1uChqsgAA
			login.microsoftonline.com/	1970-01-20 10:30:52	Name: fpc Value: Ajn4dDCFNPJOg62h4PSjnQpv7pVTAQAAAPnRhNsOAAAA
			.login.microsoftonline.com/	1969-12-31 23:59:59	Name: esctx Value: PAQABAAEAAAD--DLA3VO7QrddgJg7WevrM_gP0XcsUn_GMEvHxNVQDT4Zmpe1K-gffdWd3-8a_fx06oMeg4rqpIzD5YpfN7FJiFnqZQYGYmfxGXBx0TCCEpnkZevYVTF9TFV1EgRELHVkg4ZZfShb3z7IvSGMOuFfQl9ceyq-HRpLTa2hO4vAezAXj4TxNqJ_mZOGrAuD0k4gAA
			.login.live.com/	1969-12-31 23:59:59	Name: uaid Value: 00c16e8835794ee6b007534af07e5a15
			.login.live.com/	1969-12-31 23:59:59	Name: MSPRequ Value: id=N&lt=1676860153&co=1
			.login.microsoftonline.com/	1970-01-20 19:09:16	Name: brcap Value: 0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msauth.net
aadcdn.msauthimages.net
hype-external.alight.com
login.live.com
login.microsoftonline.com
saml.alight.com
152.199.23.72
204.152.235.123
204.152.239.42
2620:1ec:4f:1::44
40.126.31.70
40.126.32.69
1b28fa37690c44485d747decdc67e570b324eb6c0762939aaf682d123042bd50
4a0fe34684996028ce83cc6f9f07052e565386b89e5313d6db254ad274f61368
67464e8eb69180939f3e540b69d027db8de2f85f2b07c209309078159a4d0140
7882199766af67996985bc27a2da42c974810bb9e4f04e093d5ecb64bf64182e
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93
92a9a91faa82b2f7727e4c8b1293402ce5cb7fec6a855341ec9e4e9408ef907f
97a2cafa017013813f8cb14d2cc5923d98fcb0a13c088477d609673a2c24a93d
b22fc156c87081fbd745b1742898bbba5755a779d86ada9489c08196cd4d55c8
e387acc577beb7a8e260086596c712e35c7975ab06264beb2b45df10d356d163
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
fab4e269d8c1f352519f80252bf81bb4aa64d33556d9f812bfdb93464c5ca234