office376-app-zcvwh.ondigitalocean.app Open in urlscan Pro
2606:4700::6810:f44e Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://sgxsd.proferemnce.click/?kec=86dHJpc3Rhbi5mbGludEBsYXphcmQuY29t
Effective URL:
https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/include/check.php?w=fed
Submission: On October 17 via api (October 17th 2022, 9:56:27 am UTC) from US — Scanned from GB

Summary HTTP 20 Redirects Behaviour Indicators

Summary

This website contacted 4 IPs in 2 countries across 3 domains to perform 20 HTTP transactions. The main IP is 2606:4700::6810:f44e, located in United States and belongs to CLOUDFLARENET, US. The main domain is office376-app-zcvwh.ondigitalocean.app.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on April 7th 2022. Valid for: a year.

This is the only time office376-app-zcvwh.ondigitalocean.app was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1	18.135.16.240 18.135.16.240	16509 (AMAZON-02) (AMAZON-02)
1 17	2606:4700::68... 2606:4700::6810:f44e	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3	63.84.138.45 63.84.138.45	701 (UUNET) (UUNET)
20	4

1 18.135.16.240 (London, United Kingdom)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-135-16-240.eu-west-2.compute.amazonaws.com

sgxsd.proferemnce.click	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

17 2606:4700::6810:f44e (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

office376-app-zcvwh.ondigitalocean.app	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 63.84.138.45 (Lehighton, United States)

ASN701 (UUNET, US)

sts5.lazard.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
17	ondigitalocean.app 1 redirects office376-app-zcvwh.ondigitalocean.app	50 KB
3	lazard.com sts5.lazard.com	142 KB
1	proferemnce.click sgxsd.proferemnce.click	573 B
20	3

	Domain	Requested by
17	office376-app-zcvwh.ondigitalocean.app	1 redirects office376-app-zcvwh.ondigitalocean.app
3	sts5.lazard.com	office376-app-zcvwh.ondigitalocean.app
1	sgxsd.proferemnce.click
20	3

This site contains no links.

Subject Issuer	Validity	Valid
*.proferemnce.click R3	`2022-10-08` - `2023-01-06`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-04-07` - `2023-04-07`	a year	crt.sh
sts5.lazard.com DigiCert TLS RSA SHA256 2020 CA1	`2022-03-21` - `2023-03-21`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/include/check.php?w=fed
Frame ID: B921589101FFCB26D7CF49D1DF2851C4
Requests: 21 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign In

Page URL History Show full URLs

https://sgxsd.proferemnce.click/?kec=86dHJpc3Rhbi5mbGludEBsYXphcmQuY29t Page URL
https://office376-app-zcvwh.ondigitalocean.app/ Page URL
https://office376-app-zcvwh.ondigitalocean.app/7oyXD03QNw.php HTTP 302
https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/?client_id=0000001143-0000-0nmq-td00-000000... Page URL
https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/include/check.php?w=fed Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

\.php(?:$|\?)

Page Statistics

20
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

192 kB
Transfer

255 kB
Size

3
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://sgxsd.proferemnce.click/?kec=86dHJpc3Rhbi5mbGludEBsYXphcmQuY29t Page URL
https://office376-app-zcvwh.ondigitalocean.app/ Page URL
https://office376-app-zcvwh.ondigitalocean.app/7oyXD03QNw.php HTTP 302
https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/?client_id=0000001143-0000-0nmq-td00-000000000&y=53dHJpc3Rhbi5mbGludEBsYXphcmQuY29t&redirect_uri=https%3a%2f%2foutlook.office.com%2fowa%2f&resource=client_id&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&client-request-id=45f4d5f9-4657-4816-9528-af3f59994174&protectedtoken=true Page URL
https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/include/check.php?w=fed Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 3

https://office376-app-zcvwh.ondigitalocean.app/7oyXD03QNw.php HTTP 302
https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/?client_id=0000001143-0000-0nmq-td00-000000000&y=53dHJpc3Rhbi5mbGludEBsYXphcmQuY29t&redirect_uri=https%3a%2f%2foutlook.office.com%2fowa%2f&resource=client_id&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&client-request-id=45f4d5f9-4657-4816-9528-af3f59994174&protectedtoken=true

20 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK /
sgxsd.proferemnce.click/ 365 B
573 B 242ms
111ms Document
text/html 18.135.16.240
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://sgxsd.proferemnce.click/?kec=86dHJpc3Rhbi5mbGludEBsYXphcmQuY29t
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 18.135.16.240 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-18-135-16-240.eu-west-2.compute.amazonaws.com
Software: Apache /
Resource Hash

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Date: Mon, 17 Oct 2022 09:56:16 GMT
Keep-Alive: timeout=5, max=100
Server: Apache
Transfer-Encoding: chunked

POST
H2 200 /
office376-app-zcvwh.ondigitalocean.app/ 4 KB
3 KB 545ms
446ms Document
text/html 2606:4700::6810:f44e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://office376-app-zcvwh.ondigitalocean.app/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:f44e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://sgxsd.proferemnce.click
Referer: https://sgxsd.proferemnce.click/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

cache-control: private
cf-cache-status: DYNAMIC
cf-ray: 75b829d3deb5d174-LHR
content-encoding: br
content-type: text/html; charset=UTF-8
date: Mon, 17 Oct 2022 09:56:17 GMT
server: cloudflare
x-do-app-origin: 2da64a62-d1b9-4065-96ac-97e7324734e1
x-do-orig-status: 200

GET
DATA 200
OK truncated
/ 3 KB
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash

Request headers

accept-language: en-GB,en;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2

200

/ Show response
office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/
Redirect Chain

https://office376-app-zcvwh.ondigitalocean.app/7oyXD03QNw.php
https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/?client_id=0000001143-0000-0nmq-td00-000000000&y=53dHJpc3Rhbi5mbGludEBsYXphcmQuY29t&redirect_uri=https%3a%2f%2foutloo...

15 KB
4 KB

468ms
467ms

Document
text/html

2606:4700::6810:f44e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/?client_id=0000001143-0000-0nmq-td00-000000000&y=53dHJpc3Rhbi5mbGludEBsYXphcmQuY29t&redirect_uri=https%3a%2f%2foutlook.office.com%2fowa%2f&resource=client_id&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&client-request-id=45f4d5f9-4657-4816-9528-af3f59994174&protectedtoken=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:f44e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 891751e4ac386787fcc6357fbe8dfc8dd99812fe82aea47309b6ca9a9a376b15

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://office376-app-zcvwh.ondigitalocean.app
Referer: https://office376-app-zcvwh.ondigitalocean.app/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

cache-control: private
cf-cache-status: MISS
cf-ray: 75b829f07dc5d174-LHR
content-encoding: br
content-type: text/html; charset=UTF-8
date: Mon, 17 Oct 2022 09:56:21 GMT
last-modified: Mon, 17 Oct 2022 09:56:21 GMT
server: cloudflare
vary: Accept-Encoding
x-do-app-origin: 2da64a62-d1b9-4065-96ac-97e7324734e1
x-do-orig-status: 200

Redirect headers

cache-control: private
cf-cache-status: DYNAMIC
cf-ray: 75b829d6dc54d174-LHR
content-type: text/html; charset=UTF-8
date: Mon, 17 Oct 2022 09:56:21 GMT
location: 86ea9444fb696c35ed4ad80187934fbc/?client_id=0000001143-0000-0nmq-td00-000000000&y=53dHJpc3Rhbi5mbGludEBsYXphcmQuY29t&redirect_uri=https%3a%2f%2foutlook.office.com%2fowa%2f&resource=client_id&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&client-request-id=45f4d5f9-4657-4816-9528-af3f59994174&protectedtoken=true
server: cloudflare
x-do-app-origin: 2da64a62-d1b9-4065-96ac-97e7324734e1
x-do-orig-status: 302

GET
H2 200 css.css
office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/include/src/ 24 KB
4 KB 506ms
504ms Stylesheet
text/css 2606:4700::6810:f44e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/include/src/css.css
Requested by: Host: office376-app-zcvwh.ondigitalocean.app
URL: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/?client_id=0000001143-0000-0nmq-td00-000000000&y=53dHJpc3Rhbi5mbGludEBsYXphcmQuY29t&redirect_uri=https%3a%2f%2foutlook.office.com%2fowa%2f&resource=client_id&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&client-request-id=45f4d5f9-4657-4816-9528-af3f59994174&protectedtoken=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:f44e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 13853a83c9d5320662be27925e44f7e48e284fb30747d31e0f6ce996470b64a5

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/?client_id=0000001143-0000-0nmq-td00-000000000&y=53dHJpc3Rhbi5mbGludEBsYXphcmQuY29t&redirect_uri=https%3a%2f%2foutlook.office.com%2fowa%2f&resource=client_id&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&client-request-id=45f4d5f9-4657-4816-9528-af3f59994174&protectedtoken=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Mon, 17 Oct 2022 09:56:22 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 17 Oct 2022 09:56:21 GMT
server: cloudflare
x-do-app-origin: 2da64a62-d1b9-4065-96ac-97e7324734e1
x-do-orig-status: 200
etag: W/"5e65-5eb37fcd4c57b"
vary: Accept-Encoding
content-type: text/css
cache-control: private
cf-ray: 75b829f37bd4d174-LHR

GET
H2 200 mp.js Show response
office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/include/src/ 5 KB
1 KB 297ms
296ms Script
application/javascript 2606:4700::6810:f44e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/include/src/mp.js
Requested by: Host: office376-app-zcvwh.ondigitalocean.app
URL: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/?client_id=0000001143-0000-0nmq-td00-000000000&y=53dHJpc3Rhbi5mbGludEBsYXphcmQuY29t&redirect_uri=https%3a%2f%2foutlook.office.com%2fowa%2f&resource=client_id&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&client-request-id=45f4d5f9-4657-4816-9528-af3f59994174&protectedtoken=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:f44e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1e0a81574e631c7e3f75db9478970fcbd6d81f8275bbed664498c12eec3023ba

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/?client_id=0000001143-0000-0nmq-td00-000000000&y=53dHJpc3Rhbi5mbGludEBsYXphcmQuY29t&redirect_uri=https%3a%2f%2foutlook.office.com%2fowa%2f&resource=client_id&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&client-request-id=45f4d5f9-4657-4816-9528-af3f59994174&protectedtoken=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Mon, 17 Oct 2022 09:56:21 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 17 Oct 2022 09:56:21 GMT
server: cloudflare
x-do-app-origin: 2da64a62-d1b9-4065-96ac-97e7324734e1
x-do-orig-status: 200
etag: W/"1509-5eb37fcd4e0db"
vary: Accept-Encoding
content-type: application/javascript
cache-control: private
cf-ray: 75b829f37bd7d174-LHR

GET
H2 200 45_sgsjshsdggdjxdghvcvcj.png
office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/include/src/ 5 KB
5 KB 323ms
321ms Image
image/png 2606:4700::6810:f44e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/include/src/45_sgsjshsdggdjxdghvcvcj.png
Requested by: Host: office376-app-zcvwh.ondigitalocean.app
URL: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/?client_id=0000001143-0000-0nmq-td00-000000000&y=53dHJpc3Rhbi5mbGludEBsYXphcmQuY29t&redirect_uri=https%3a%2f%2foutlook.office.com%2fowa%2f&resource=client_id&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&client-request-id=45f4d5f9-4657-4816-9528-af3f59994174&protectedtoken=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:f44e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: e4e1e65871749d18aea150643c07e0aab2057da057c6c57ec1c3c43580e1c898

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/?client_id=0000001143-0000-0nmq-td00-000000000&y=53dHJpc3Rhbi5mbGludEBsYXphcmQuY29t&redirect_uri=https%3a%2f%2foutlook.office.com%2fowa%2f&resource=client_id&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&client-request-id=45f4d5f9-4657-4816-9528-af3f59994174&protectedtoken=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Mon, 17 Oct 2022 09:56:22 GMT
cf-cache-status: MISS
last-modified: Mon, 17 Oct 2022 09:56:21 GMT
server: cloudflare
x-do-app-origin: 2da64a62-d1b9-4065-96ac-97e7324734e1
x-do-orig-status: 200
etag: "1413-5eb37fcd49f9d"
vary: Accept-Encoding
content-type: image/png
cache-control: private
accept-ranges: bytes
cf-ray: 75b829f6aa28d174-LHR
content-length: 5139

GET
H2 200 microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/include/src/ 4 KB
1 KB 301ms
300ms Image
image/svg+xml 2606:4700::6810:f44e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/include/src/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
Requested by: Host: office376-app-zcvwh.ondigitalocean.app
URL: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/?client_id=0000001143-0000-0nmq-td00-000000000&y=53dHJpc3Rhbi5mbGludEBsYXphcmQuY29t&redirect_uri=https%3a%2f%2foutlook.office.com%2fowa%2f&resource=client_id&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&client-request-id=45f4d5f9-4657-4816-9528-af3f59994174&protectedtoken=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:f44e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/?client_id=0000001143-0000-0nmq-td00-000000000&y=53dHJpc3Rhbi5mbGludEBsYXphcmQuY29t&redirect_uri=https%3a%2f%2foutlook.office.com%2fowa%2f&resource=client_id&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&client-request-id=45f4d5f9-4657-4816-9528-af3f59994174&protectedtoken=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Mon, 17 Oct 2022 09:56:22 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 17 Oct 2022 09:56:21 GMT
server: cloudflare
x-do-app-origin: 2da64a62-d1b9-4065-96ac-97e7324734e1
x-do-orig-status: 200
etag: W/"e43-5eb37fcd4dd3e"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: private
cf-ray: 75b829f6aa2bd174-LHR

GET
H2 200 arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/include/src/ 513 B
356 B 143ms
142ms Image
image/svg+xml 2606:4700::6810:f44e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/include/src/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
Requested by: Host: office376-app-zcvwh.ondigitalocean.app
URL: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/?client_id=0000001143-0000-0nmq-td00-000000000&y=53dHJpc3Rhbi5mbGludEBsYXphcmQuY29t&redirect_uri=https%3a%2f%2foutlook.office.com%2fowa%2f&resource=client_id&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&client-request-id=45f4d5f9-4657-4816-9528-af3f59994174&protectedtoken=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:f44e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/?client_id=0000001143-0000-0nmq-td00-000000000&y=53dHJpc3Rhbi5mbGludEBsYXphcmQuY29t&redirect_uri=https%3a%2f%2foutlook.office.com%2fowa%2f&resource=client_id&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&client-request-id=45f4d5f9-4657-4816-9528-af3f59994174&protectedtoken=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Mon, 17 Oct 2022 09:56:22 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 17 Oct 2022 09:56:21 GMT
server: cloudflare
x-do-app-origin: 2da64a62-d1b9-4065-96ac-97e7324734e1
x-do-orig-status: 200
etag: W/"201-5eb37fcd4c0ef"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: private
cf-ray: 75b829f6aa2ed174-LHR

GET
H2 200 ellipsis_white_5ac590ee72bfe06a7cecfd75b588ad73.svg
office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/include/src/ 915 B
328 B 309ms
308ms Image
image/svg+xml 2606:4700::6810:f44e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/include/src/ellipsis_white_5ac590ee72bfe06a7cecfd75b588ad73.svg
Requested by: Host: office376-app-zcvwh.ondigitalocean.app
URL: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/?client_id=0000001143-0000-0nmq-td00-000000000&y=53dHJpc3Rhbi5mbGludEBsYXphcmQuY29t&redirect_uri=https%3a%2f%2foutlook.office.com%2fowa%2f&resource=client_id&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&client-request-id=45f4d5f9-4657-4816-9528-af3f59994174&protectedtoken=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:f44e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/?client_id=0000001143-0000-0nmq-td00-000000000&y=53dHJpc3Rhbi5mbGludEBsYXphcmQuY29t&redirect_uri=https%3a%2f%2foutlook.office.com%2fowa%2f&resource=client_id&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&client-request-id=45f4d5f9-4657-4816-9528-af3f59994174&protectedtoken=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Mon, 17 Oct 2022 09:56:22 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 17 Oct 2022 09:56:21 GMT
server: cloudflare
x-do-app-origin: 2da64a62-d1b9-4065-96ac-97e7324734e1
x-do-orig-status: 200
etag: W/"393-5eb37fcd4cccc"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: private
cf-ray: 75b829f6aa2fd174-LHR

GET
H2 200 ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c.svg
office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/include/src/ 915 B
328 B 324ms
324ms Image
image/svg+xml 2606:4700::6810:f44e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/include/src/ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c.svg
Requested by: Host: office376-app-zcvwh.ondigitalocean.app
URL: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/?client_id=0000001143-0000-0nmq-td00-000000000&y=53dHJpc3Rhbi5mbGludEBsYXphcmQuY29t&redirect_uri=https%3a%2f%2foutlook.office.com%2fowa%2f&resource=client_id&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&client-request-id=45f4d5f9-4657-4816-9528-af3f59994174&protectedtoken=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:f44e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 16c3f6531d0fa5b4d16e82abf066233b2a9f284c068c663699313c09f5e8d6e6

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/?client_id=0000001143-0000-0nmq-td00-000000000&y=53dHJpc3Rhbi5mbGludEBsYXphcmQuY29t&redirect_uri=https%3a%2f%2foutlook.office.com%2fowa%2f&resource=client_id&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&client-request-id=45f4d5f9-4657-4816-9528-af3f59994174&protectedtoken=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Mon, 17 Oct 2022 09:56:22 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 17 Oct 2022 09:56:21 GMT
server: cloudflare
x-do-app-origin: 2da64a62-d1b9-4065-96ac-97e7324734e1
x-do-orig-status: 200
etag: W/"393-5eb37fcd4c913"
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: private
cf-ray: 75b829f6aa32d174-LHR

GET
H2 200 sc_login.js Show response
office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/include/src/ 12 KB
4 KB 330ms
330ms Script
application/javascript 2606:4700::6810:f44e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/include/src/sc_login.js
Requested by: Host: office376-app-zcvwh.ondigitalocean.app
URL: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/?client_id=0000001143-0000-0nmq-td00-000000000&y=53dHJpc3Rhbi5mbGludEBsYXphcmQuY29t&redirect_uri=https%3a%2f%2foutlook.office.com%2fowa%2f&resource=client_id&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&client-request-id=45f4d5f9-4657-4816-9528-af3f59994174&protectedtoken=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:f44e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a0e74e60af1071828d901d37ea36097222f2d0f2bc80336a807ac1f005fd9d9e

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/?client_id=0000001143-0000-0nmq-td00-000000000&y=53dHJpc3Rhbi5mbGludEBsYXphcmQuY29t&redirect_uri=https%3a%2f%2foutlook.office.com%2fowa%2f&resource=client_id&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&client-request-id=45f4d5f9-4657-4816-9528-af3f59994174&protectedtoken=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Mon, 17 Oct 2022 09:56:22 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 17 Oct 2022 09:56:21 GMT
server: cloudflare
x-do-app-origin: 2da64a62-d1b9-4065-96ac-97e7324734e1
x-do-orig-status: 200
etag: W/"3171-5eb37fcd4e507"
vary: Accept-Encoding
content-type: application/javascript
cache-control: private
cf-ray: 75b829f55f6ad174-LHR

GET
H2 200 0-small_138bcee624fa04ef9b75e86211a9fe0d.jpg
office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/include/src/ 3 KB
3 KB 281ms
280ms Image
image/jpeg 2606:4700::6810:f44e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/include/src/0-small_138bcee624fa04ef9b75e86211a9fe0d.jpg
Requested by: Host: office376-app-zcvwh.ondigitalocean.app
URL: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/?client_id=0000001143-0000-0nmq-td00-000000000&y=53dHJpc3Rhbi5mbGludEBsYXphcmQuY29t&redirect_uri=https%3a%2f%2foutlook.office.com%2fowa%2f&resource=client_id&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&client-request-id=45f4d5f9-4657-4816-9528-af3f59994174&protectedtoken=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:f44e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f89e908280791803bbf1f33b596ff4a2179b355a8e15ad02ebaa2b1da11127ea

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/?client_id=0000001143-0000-0nmq-td00-000000000&y=53dHJpc3Rhbi5mbGludEBsYXphcmQuY29t&redirect_uri=https%3a%2f%2foutlook.office.com%2fowa%2f&resource=client_id&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&client-request-id=45f4d5f9-4657-4816-9528-af3f59994174&protectedtoken=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Mon, 17 Oct 2022 09:56:22 GMT
cf-cache-status: MISS
last-modified: Mon, 17 Oct 2022 09:56:21 GMT
server: cloudflare
x-do-app-origin: 2da64a62-d1b9-4065-96ac-97e7324734e1
x-do-orig-status: 200
etag: "bbe-5eb37fcd49bfa"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: private
accept-ranges: bytes
cf-ray: 75b829f6aa3cd174-LHR
content-length: 3006

GET
H2 200 Mic_BG.jpg
office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/include/src/ 17 KB
17 KB 365ms
364ms Image
image/jpeg 2606:4700::6810:f44e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/include/src/Mic_BG.jpg
Requested by: Host: office376-app-zcvwh.ondigitalocean.app
URL: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/?client_id=0000001143-0000-0nmq-td00-000000000&y=53dHJpc3Rhbi5mbGludEBsYXphcmQuY29t&redirect_uri=https%3a%2f%2foutlook.office.com%2fowa%2f&resource=client_id&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&client-request-id=45f4d5f9-4657-4816-9528-af3f59994174&protectedtoken=true
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:f44e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d8f5ab3e00202fd3b45be1acd95d677b137064001e171bc79b06826d98f1e1d3

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/?client_id=0000001143-0000-0nmq-td00-000000000&y=53dHJpc3Rhbi5mbGludEBsYXphcmQuY29t&redirect_uri=https%3a%2f%2foutlook.office.com%2fowa%2f&resource=client_id&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&client-request-id=45f4d5f9-4657-4816-9528-af3f59994174&protectedtoken=true
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Mon, 17 Oct 2022 09:56:22 GMT
cf-cache-status: MISS
last-modified: Mon, 17 Oct 2022 09:56:21 GMT
server: cloudflare
x-do-app-origin: 2da64a62-d1b9-4065-96ac-97e7324734e1
x-do-orig-status: 200
etag: "442d-5eb37fcd4af75"
vary: Accept-Encoding
content-type: image/jpeg
cache-control: private
accept-ranges: bytes
cf-ray: 75b829f6aa3fd174-LHR
content-length: 17453

POST
H2 200 check.php Show response
office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/include/ 14 B
200 B 1118ms
1117ms XHR
text/html 2606:4700::6810:f44e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/include/check.php
Requested by: Host: office376-app-zcvwh.ondigitalocean.app
URL: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/include/src/sc_login.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:f44e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 2acc4617bab6897cc0aa5583b01b20bbbbe746cddd6d29134bbe64db9cef8e2d

Request headers

Referer: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/?client_id=0000001143-0000-0nmq-td00-000000000&y=53dHJpc3Rhbi5mbGludEBsYXphcmQuY29t&redirect_uri=https%3a%2f%2foutlook.office.com%2fowa%2f&resource=client_id&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&client-request-id=45f4d5f9-4657-4816-9528-af3f59994174&protectedtoken=true
accept-language: en-GB,en;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
Content-type: application/x-www-form-urlencoded

Response headers

pragma: no-cache
date: Mon, 17 Oct 2022 09:56:23 GMT
content-encoding: br
cf-cache-status: DYNAMIC
server: cloudflare
x-do-app-origin: 2da64a62-d1b9-4065-96ac-97e7324734e1
x-do-orig-status: 200
content-type: text/html; charset=UTF-8
cache-control: no-store, no-cache, must-revalidate
cf-ray: 75b829f90f4fd174-LHR
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H2 200 Primary Request check.php Show response
office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/include/ 13 KB
3 KB 140ms
139ms Document
text/html 2606:4700::6810:f44e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/include/check.php?w=fed
Requested by: Host: office376-app-zcvwh.ondigitalocean.app
URL: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/include/src/sc_login.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:f44e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b070355415387ef33eed0fdf6f4b85756283ce70c1a96f6bbb40e3ba5c2e2588

Request headers

Referer: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/?client_id=0000001143-0000-0nmq-td00-000000000&y=53dHJpc3Rhbi5mbGludEBsYXphcmQuY29t&redirect_uri=https%3a%2f%2foutlook.office.com%2fowa%2f&resource=client_id&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=0&client-request-id=45f4d5f9-4657-4816-9528-af3f59994174&protectedtoken=true
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language: en-GB,en;q=0.9

Response headers

cache-control: no-store, no-cache, must-revalidate
cf-cache-status: MISS
cf-ray: 75b82a032c20d174-LHR
content-encoding: br
content-type: text/html; charset=UTF-8
date: Mon, 17 Oct 2022 09:56:24 GMT
expires: Thu, 19 Nov 1981 08:52:00 GMT
last-modified: Mon, 17 Oct 2022 09:56:24 GMT
pragma: no-cache
server: cloudflare
vary: Accept-Encoding
x-do-app-origin: 2da64a62-d1b9-4065-96ac-97e7324734e1
x-do-orig-status: 200

GET
H/1.1 200
OK style.css
sts5.lazard.com/adfs/portal/css/ 23 KB
24 KB 715ms
290ms Stylesheet
text/css 63.84.138.45
UUNET

General

Check archive.org

Show headers Download Go to

Full URL

https://sts5.lazard.com/adfs/portal/css/style.css?id=2250E25ECB44325890BA14A695D9F63616088A85AFC0480064D0533E77BD954D

Requested by

Host: office376-app-zcvwh.ondigitalocean.app
URL: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/include/check.php?w=fed

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

63.84.138.45 Lehighton, United States, ASN701 (UUNET, US),

Reverse DNS

Software

Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0 /

Resource Hash

2250e25ecb44325890ba14a695d9f63616088a85afc0480064d0533e77bd954d

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:;;; frame-src api-fb448f9f.duosecurity.com
Strict-Transport-Security	max-age = 31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://office376-app-zcvwh.ondigitalocean.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Strict-Transport-Security: max-age = 31536000
Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:;;; frame-src api-fb448f9f.duosecurity.com
X-Content-Type-Options: nosniff
Date: Mon, 17 Oct 2022 09:56:24 GMT
Server: Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0
ETag: 2250E25ECB44325890BA14A695D9F63616088A85AFC0480064D0533E77BD954D
Content-Type: text/css
Content-Length: 23679
X-XSS-Protection: 1; mode=block
Expires: Wed, 16 Nov 2022 10:56:24 GMT

GET
H2 200 mp.js Show response
office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/include/src/ 5 KB
1 KB 140ms
140ms Script
application/javascript 2606:4700::6810:f44e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/include/src/mp.js
Requested by: Host: office376-app-zcvwh.ondigitalocean.app
URL: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/include/check.php?w=fed
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:f44e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 1e0a81574e631c7e3f75db9478970fcbd6d81f8275bbed664498c12eec3023ba

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/include/check.php?w=fed
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Mon, 17 Oct 2022 09:56:24 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 17 Oct 2022 09:56:21 GMT
server: cloudflare
x-do-app-origin: 2da64a62-d1b9-4065-96ac-97e7324734e1
x-do-orig-status: 200
etag: W/"1509-5eb37fcd4e0db"
vary: Accept-Encoding
content-type: application/javascript
cache-control: private
cf-ray: 75b82a04bf57d174-LHR

GET
H/1.1 200
OK logo.jpg
sts5.lazard.com/adfs/portal/logo/ 3 KB
4 KB 566ms
157ms Image
image/jpeg 63.84.138.45
UUNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sts5.lazard.com/adfs/portal/logo/logo.jpg?id=053751ABB16D1831BC75CD7F01F2371CF75A88D82037BBB129D17D16DA9648BB

Requested by

Host: office376-app-zcvwh.ondigitalocean.app
URL: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/include/check.php?w=fed

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

63.84.138.45 Lehighton, United States, ASN701 (UUNET, US),

Reverse DNS

Software

Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0 /

Resource Hash

053751abb16d1831bc75cd7f01f2371cf75a88d82037bbb129d17d16da9648bb

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:;;; frame-src api-fb448f9f.duosecurity.com
Strict-Transport-Security	max-age = 31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://office376-app-zcvwh.ondigitalocean.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Strict-Transport-Security: max-age = 31536000
Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:;;; frame-src api-fb448f9f.duosecurity.com
X-Content-Type-Options: nosniff
Date: Mon, 17 Oct 2022 09:56:25 GMT
Server: Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0
ETag: 053751ABB16D1831BC75CD7F01F2371CF75A88D82037BBB129D17D16DA9648BB
Content-Type: image/jpeg
Content-Length: 3170
X-XSS-Protection: 1; mode=block
Expires: Wed, 16 Nov 2022 10:56:25 GMT

GET
H2 200 fed.js Show response
office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/include/src/ 2 KB
807 B 133ms
133ms Script
application/javascript 2606:4700::6810:f44e
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/include/src/fed.js
Requested by: Host: office376-app-zcvwh.ondigitalocean.app
URL: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/include/check.php?w=fed
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:f44e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bd39d15217c5e9045c331715ba57b5279128ea5fafc319c9c2881b89bfeb2edf

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/include/check.php?w=fed
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date: Mon, 17 Oct 2022 09:56:24 GMT
content-encoding: br
cf-cache-status: MISS
last-modified: Mon, 17 Oct 2022 09:56:21 GMT
server: cloudflare
x-do-app-origin: 2da64a62-d1b9-4065-96ac-97e7324734e1
x-do-orig-status: 200
etag: W/"871-5eb37fcd4d53a"
vary: Accept-Encoding
content-type: application/javascript
cache-control: private
cf-ray: 75b82a05a907d174-LHR

GET
H/1.1 200
OK illustration.png
sts5.lazard.com/adfs/portal/illustration/ 114 KB
114 KB 158ms
158ms Image
image/png 63.84.138.45
UUNET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://sts5.lazard.com/adfs/portal/illustration/illustration.png?id=183128A3C941EDE3D9199FA37D6AA90E0A7DFE101B37D10B4FEDA0CF35E11AFD

Requested by

Host: office376-app-zcvwh.ondigitalocean.app
URL: https://office376-app-zcvwh.ondigitalocean.app/86ea9444fb696c35ed4ad80187934fbc/include/check.php?w=fed

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

63.84.138.45 Lehighton, United States, ASN701 (UUNET, US),

Reverse DNS

Software

Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0 /

Resource Hash

183128a3c941ede3d9199fa37d6aa90e0a7dfe101b37d10b4feda0cf35e11afd

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:;;; frame-src api-fb448f9f.duosecurity.com
Strict-Transport-Security	max-age = 31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: en-GB,en;q=0.9
Referer: https://office376-app-zcvwh.ondigitalocean.app/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

Strict-Transport-Security: max-age = 31536000
Content-Security-Policy: default-src 'self' 'unsafe-inline' 'unsafe-eval'; img-src 'self' data:;;; frame-src api-fb448f9f.duosecurity.com
X-Content-Type-Options: nosniff
Date: Mon, 17 Oct 2022 09:56:24 GMT
Server: Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0
ETag: 183128A3C941EDE3D9199FA37D6AA90E0A7DFE101B37D10B4FEDA0CF35E11AFD
Content-Type: image/png
Content-Length: 116699
X-XSS-Protection: 1; mode=block
Expires: Wed, 16 Nov 2022 10:56:25 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

14 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
office376-app-zcvwh.ondigitalocean.app/	1970-01-20 07:29:52	Name: xlogin Value: dHJpc3Rhbi5mbGludEBsYXphcmQuY29t
office376-app-zcvwh.ondigitalocean.app/	1970-01-20 07:29:52	Name: ip Value: ODIuMTk5LjEzMC40NQ%3D%3D
office376-app-zcvwh.ondigitalocean.app/	1969-12-31 23:59:59	Name: PHPSESSID Value: a31h4n7kd6gsg4ukf7ojgsjld9tflqf6

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

office376-app-zcvwh.ondigitalocean.app
sgxsd.proferemnce.click
sts5.lazard.com
18.135.16.240
2606:4700::6810:f44e
63.84.138.45
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
053751abb16d1831bc75cd7f01f2371cf75a88d82037bbb129d17d16da9648bb
13853a83c9d5320662be27925e44f7e48e284fb30747d31e0f6ce996470b64a5
16c3f6531d0fa5b4d16e82abf066233b2a9f284c068c663699313c09f5e8d6e6
183128a3c941ede3d9199fa37d6aa90e0a7dfe101b37d10b4feda0cf35e11afd
1e0a81574e631c7e3f75db9478970fcbd6d81f8275bbed664498c12eec3023ba
2250e25ecb44325890ba14a695d9f63616088a85afc0480064d0533e77bd954d
2acc4617bab6897cc0aa5583b01b20bbbbe746cddd6d29134bbe64db9cef8e2d
34f9db946e89f031a80dfca7b16b2b686469c9886441261ae70a44da1dfa2d58
6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea
891751e4ac386787fcc6357fbe8dfc8dd99812fe82aea47309b6ca9a9a376b15
a0e74e60af1071828d901d37ea36097222f2d0f2bc80336a807ac1f005fd9d9e
b070355415387ef33eed0fdf6f4b85756283ce70c1a96f6bbb40e3ba5c2e2588
bd39d15217c5e9045c331715ba57b5279128ea5fafc319c9c2881b89bfeb2edf
d8f5ab3e00202fd3b45be1acd95d677b137064001e171bc79b06826d98f1e1d3
e4e1e65871749d18aea150643c07e0aab2057da057c6c57ec1c3c43580e1c898
f89e908280791803bbf1f33b596ff4a2179b355a8e15ad02ebaa2b1da11127ea

office376-app-zcvwh.ondigitalocean.app Open in urlscan Pro 2606:4700::6810:f44e Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

20 Requests

100 %HTTPS

33 %IPv6

3 Domains

3 Subdomains

4 IPs

2 Countries

192 kBTransfer

255 kBSize

3 Cookies

0 Outgoing links

Page URL History

Redirected requests

20 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

14 JavaScript Global Variables

3 Cookies

Indicators

office376-app-zcvwh.ondigitalocean.app Open in urlscan Pro
2606:4700::6810:f44e Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

20
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

3
Subdomains

4
IPs

2
Countries

192 kB
Transfer

255 kB
Size

3
Cookies

20 HTTP transactions
1 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!