![](/screenshots/a115dd99-fa33-445b-819d-e66cc3636467.png)
login.microsoftonline.com
Open in
urlscan Pro
2603:1026:3000:148::12
Public Scan
Effective URL: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?response_type=code&client_id=8ce481bb-db67-45cb-8d1b-7a2d216b5208&r...
Submission: On April 25 via api from US — Scanned from DE
Summary
TLS certificate: Issued by DigiCert SHA2 Secure Server CA on April 4th 2024. Valid for: a year.
This is the only time login.microsoftonline.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
5 9 | 107.154.38.60 107.154.38.60 | 19551 (INCAPSULA) (INCAPSULA) | |
1 1 | 2606:4700::68... 2606:4700::6811:feb6 | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
2 | 2603:1026:300... 2603:1026:3000:148::12 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 | 2606:2800:233... 2606:2800:233:78b9:f44e:2c1f:31aa:d9ef | () () | |
8 | 4 |
ASN19551 (INCAPSULA, US)
PTR: 107.154.38.60.ip.incapdns.net
hassan.workflowcloud-test.com | |
auth.nintexcloudtest.com |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
login.microsoftonline.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
7 |
workflowcloud-test.com
3 redirects
hassan.workflowcloud-test.com |
25 KB |
2 |
microsoftonline.com
login.microsoftonline.com — Cisco Umbrella Rank: 10 |
10 KB |
2 |
nintexcloudtest.com
2 redirects
auth.nintexcloudtest.com |
3 KB |
1 |
msftauth.net
aadcdn.msftauth.net |
49 KB |
1 |
auth0.com
1 redirects
ntxtest.auth0.com |
1 KB |
8 | 5 |
Domain | Requested by | |
---|---|---|
7 | hassan.workflowcloud-test.com |
3 redirects
hassan.workflowcloud-test.com
|
2 | login.microsoftonline.com |
aadcdn.msftauth.net
|
2 | auth.nintexcloudtest.com | 2 redirects |
1 | aadcdn.msftauth.net |
login.microsoftonline.com
|
1 | ntxtest.auth0.com | 1 redirects |
8 | 5 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
*.workflowcloud-test.com DigiCert Global G2 TLS RSA SHA256 2020 CA1 |
2023-10-15 - 2024-11-14 |
a year | crt.sh |
stamp2.login.microsoftonline.com DigiCert SHA2 Secure Server CA |
2024-04-04 - 2025-04-04 |
a year | crt.sh |
aadcdn.msftauth.net DigiCert SHA2 Secure Server CA |
2023-12-01 - 2024-12-01 |
a year | crt.sh |
This page contains 1 frames:
Frame:
https://login.microsoftonline.com/common/oauth2/v2.0/authorize?response_type=code&client_id=8ce481bb-db67-45cb-8d1b-7a2d216b5208&redirect_uri=https%3A%2F%2Fntxtest.auth0.com%2Flogin%2Fcallback&nonce=ZzfTtGEgaSWoQENvm%2BdA&scope=openid%20profile%20email%20https%3A%2F%2Fgraph.microsoft.com%2FUser.Read&state=z6VKVh4JPhJJ5btkYwmfDhWQgXzxbjll&sso_reload=true
Frame ID: A008088ADCF4316C52C20E0653816736
Requests: 8 HTTP requests in this frame
Screenshot
![](/screenshots/a115dd99-fa33-445b-819d-e66cc3636467.png)
Page URL History Show full URLs
-
https://hassan.workflowcloud-test.com/
HTTP 302
https://hassan.workflowcloud-test.com/dashboard HTTP 302
https://hassan.workflowcloud-test.com/startlogon Page URL
-
https://hassan.workflowcloud-test.com/logon
HTTP 302
https://auth.nintexcloudtest.com/connect/authorize?resource=urn%3Anc%3Aaus&resource=urn%3Anc&response_type=co... HTTP 302
https://auth.nintexcloudtest.com/auth/login?ReturnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fresource%3Durn%253A... HTTP 302
https://ntxtest.auth0.com/authorize?client_id=8kfK5ZP4Wkq0nTu6uv8XKsa7fpdtJ6Jk&redirect_uri=https%3A%2... HTTP 302
https://login.microsoftonline.com/common/oauth2/v2.0/authorize?response_type=code&client_id=8ce481bb-db67-45cb... Page URL
Detected technologies
Detected patterns
- /_Incapsula_Resource
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://hassan.workflowcloud-test.com/
HTTP 302
https://hassan.workflowcloud-test.com/dashboard HTTP 302
https://hassan.workflowcloud-test.com/startlogon Page URL
-
https://hassan.workflowcloud-test.com/logon
HTTP 302
https://auth.nintexcloudtest.com/connect/authorize?resource=urn%3Anc%3Aaus&resource=urn%3Anc&response_type=code&client_id=20ddbf4a0e78441d9f3f943b7b39ae6d&redirect_uri=https%3A%2F%2Fhassan.workflowcloud-test.com%2Foidccallback&scope=openid%20openid%20profile%20email%20organization%3A00000000-0000-0000-0000-000000000001%20tenant%3A54198bad-1372-4c16-b749-38e643d71751%20offline_access&state=aa03GLyYC0OwqZJ5GtHOVGj3 HTTP 302
https://auth.nintexcloudtest.com/auth/login?ReturnUrl=%2Fconnect%2Fauthorize%2Fcallback%3Fresource%3Durn%253Anc%253Aaus%26resource%3Durn%253Anc%26response_type%3Dcode%26client_id%3D20ddbf4a0e78441d9f3f943b7b39ae6d%26redirect_uri%3Dhttps%253A%252F%252Fhassan.workflowcloud-test.com%252Foidccallback%26scope%3Dopenid%2520openid%2520profile%2520email%2520organization%253A00000000-0000-0000-0000-000000000001%2520tenant%253A54198bad-1372-4c16-b749-38e643d71751%2520offline_access%26state%3Daa03GLyYC0OwqZJ5GtHOVGj3 HTTP 302
https://ntxtest.auth0.com/authorize?client_id=8kfK5ZP4Wkq0nTu6uv8XKsa7fpdtJ6Jk&redirect_uri=https%3A%2F%2Fauth.nintexcloudtest.com%2Fsignin-auth0&response_type=code&scope=openid%20email%20tenant_54198bad-1372-4c16-b749-38e643d71751&code_challenge=XqbBLB8aoQFN-91wwVrEaSwyb1oOvlYHI_YU3hY8xlw&code_challenge_method=S256&nonce=638496360435167168.ZWViYmIxMzQtMDdkMi00MTU3LWFmZTYtYmVhYTU2OTBhZTM4NDJiMTEzM2MtYTcxOC00MzIxLWI1NjAtYTc5MjAzNWIyZGU1&connection=azure-ad-multi-tenant-federation&state=CfDJ8Ov9HA8NhvBCnOV4y1PU3BILpkLSJAM8hXYSWViYbLHNUcgtPHrAgdBJg-v7z19sFsn1XuMK2lJSXzUMPjT7X2T3WcwGYz36ELyJH4bNI9znfrASEju3C3azfYV5XVc3rWEvNVhrVAzICMCU_8IhcTo-P4GDdfuY85lRnIfdLREt3MqL9pIVWaGe0heK-NJu2uFoh-tu08xxB65f3vMW_sS4I4ATHfBuIUPppxvp-Lr-9LA1C1jXmz71YprrKYzgmXoKqb99yj56B-8SjIJSKcX9BY3_6oLnIGBTB3IL8-v2faUzkLO3eGSzPDZzD2ZhfHTAMuee1LV-lVxQ-8zg0jAHbURSveMWuCCEzoBvj-FsusBUSAykiCdv713Npqei29D4nsn902HVMwyzwF1angWaS-dJFtKOFsHhiSaR2sE69lUt7-349rIURLR4wEvbE26lsZ2jowwhAR5HIbN8drF4u8LWJLwyFERXtVeJAHU0r-qBxMfE05Fxe30LH57fLmV1eLQzxlaqInO9p0cY4xwP0XKo4P3zzlUpUznT70bn7zowLu6kWZUpfZDaFu_yXLP8AOf1M78ZqW5NLlV8fglwBOwLyY9VFGDOb8w6C7_6msCPyjcXzlCd5qcIq8qwrdW3jj1WX6zkcT_QcA-hwdQdBuytxQxPVfBEyG32Pv2zJEmxzH5MLN9Jj_wmQ7ln4E4IhLm1dxXY3xgAHqA0Ti9SpfsG0jP8rjc5209jr1PANYL8mbtkFRFp2ekgzb9wSFKqkYls7VjL_g4fLeHB7SmQxEAsyvo9rb3BAfQBts-esPJs0PItJ2ppK0SdVxJVE1wdkZErNi5pDhXHFSLzAg7FsEU3ck8kd9gJbjYe0IL4F3_Z3SXTpIhgSixM_r0VhXaJ4oO6OP06klZPR0z7jiitv_-K5noed6CUYrhX_5SIDV9S2Z02IPTkYkzxr06i2wqmVzHoukGl0Z9mfndTYPfWI5ogRSZdnVFgAU94jRS4E5spE0O3KzE5G_e7a3nJ6-yZGAcvYutGv9wGjIzn8OY3MoNz_fCAyCd8D77wlcqaf7aQENSPds4HGQCLPCRstIpeu4u-2MAtEnva4U1-WIqvf31QU0mBHbMl5TKE2lNtA9DjRdQOAZp_r0wpVMoGpCgNkVkx3JeSgQC3BzaSuLE2Eq8_uHZ0Dq3nZ1M3E26x&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 HTTP 302
https://login.microsoftonline.com/common/oauth2/v2.0/authorize?response_type=code&client_id=8ce481bb-db67-45cb-8d1b-7a2d216b5208&redirect_uri=https%3A%2F%2Fntxtest.auth0.com%2Flogin%2Fcallback&nonce=ZzfTtGEgaSWoQENvm%2BdA&scope=openid%20profile%20email%20https%3A%2F%2Fgraph.microsoft.com%2FUser.Read&state=z6VKVh4JPhJJ5btkYwmfDhWQgXzxbjll Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://hassan.workflowcloud-test.com/ HTTP 302
- https://hassan.workflowcloud-test.com/dashboard HTTP 302
- https://hassan.workflowcloud-test.com/startlogon
8 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
startlogon
hassan.workflowcloud-test.com/ Redirect Chain
|
10 KB 2 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
_Incapsula_Resource
hassan.workflowcloud-test.com/ |
148 KB 21 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
_Incapsula_Resource
hassan.workflowcloud-test.com/ |
1 B 36 B |
Image
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
Primary Request
authorize
login.microsoftonline.com/common/oauth2/v2.0/ Redirect Chain
|
20 KB 10 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon.ico
hassan.workflowcloud-test.com/ |
672 B 1 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
BssoInterrupt_Core_Ggyc2EJnCaHFrI6xkBPLcg2.js
aadcdn.msftauth.net/shared/1.0/content/js/ |
138 KB 49 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
reportbssotelemetry
login.microsoftonline.com/common/instrumentation/ |
265 B 413 B |
Ping
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
authorize
login.microsoftonline.com/common/oauth2/v2.0/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- login.microsoftonline.com
- URL
- https://login.microsoftonline.com/common/oauth2/v2.0/authorize?response_type=code&client_id=8ce481bb-db67-45cb-8d1b-7a2d216b5208&redirect_uri=https%3A%2F%2Fntxtest.auth0.com%2Flogin%2Fcallback&nonce=ZzfTtGEgaSWoQENvm%2BdA&scope=openid%20profile%20email%20https%3A%2F%2Fgraph.microsoft.com%2FUser.Read&state=z6VKVh4JPhJJ5btkYwmfDhWQgXzxbjll&sso_reload=true
Verdicts & Comments Add Verdict or Comment
10 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| $Config object| $Debug object| $Do function| $Loader object| $WebWatson function| GetString function| GetErrorString function| GetUrl object| $B object| ServerData18 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
auth.nintexcloudtest.com/signin-auth0 | Name: .AspNetCore.OpenIdConnect.Nonce.CfDJ8Ov9HA8NhvBCnOV4y1PU3BIZbmYlf0to2kowVOxINSLfYjKwPj7fgAbmcElvFWixFG4xVlqzfG0hHw7FDL2pyhT1TFUnep3KjiPyxbO_zy_VLUwEwkOe2jFfpPyb_Tte5tSBc7M9MKgOq47vnqxKsQkcoM88EPcJ-hPagmkf7Z98wygPhLbc0MbIK4JvHgFuX-_jj6ncifiVOOLGsIVLGM3hWu_ZFjRMCe0nBCQFzqlj11KinBQeZLXPYRUQaK2x9C-a6KdcANecYgf40F6vyBI Value: N |
|
auth.nintexcloudtest.com/signin-auth0 | Name: .AspNetCore.Correlation.nVPh9emLYIPsqC9K5T0CYN_-AT46nXhaprmLXLSqx2U Value: N |
|
.workflowcloud-test.com/ | Name: nlbi_2351264 Value: J2ytSxR+aRiUHUdxhbu2UQAAAAAyIGDkPNkijlBKIAU8VwQY |
|
.workflowcloud-test.com/ | Name: visid_incap_2351264 Value: IE1M72ZWSFqUa3p6NVAVrsMpKmYAAAAAQUIPAAAAAABJL8cs00yOWmQ+BW7dHsiB |
|
.workflowcloud-test.com/ | Name: incap_ses_1611_2351264 Value: w4hke8yfdkAjVOZB+WtbFsYpKmYAAAAA5QU3K5a9i7TNQ3E8fVPcwA== |
|
hassan.workflowcloud-test.com/ | Name: nwc:sess Value: s%3AaZeByHfQJRgkCLuF7ArwLPS9rcs_gSqh.VZIiGKtvhuazQfzIczFzdIZMrqQzEqaFnx3jg9eaYfA |
|
.nintexcloudtest.com/ | Name: visid_incap_2894744 Value: POMw9vAqRhu6gsTh2MwKo8opKmYAAAAAQUIPAAAAAAA/45ShVJXewKW4IH5wVym7 |
|
.nintexcloudtest.com/ | Name: nlbi_2894744 Value: 0oSuayM3iSA8x0R6mDBQMAAAAAAY45ZaTHHPdLyT62rS07pc |
|
.nintexcloudtest.com/ | Name: incap_ses_1611_2894744 Value: 1zcNZNtd+w5wVOZB+WtbFsspKmYAAAAAYYZ5dXaD3tCoR9RW+LsIig== |
|
ntxtest.auth0.com/ | Name: did Value: s%3Av0%3Aae233340-02ea-11ef-bb03-f14807807bb4.oBVmzkuFwJVy00TfrfIh1fjEOtymm33ms0VeZpsp8Ws |
|
ntxtest.auth0.com/ | Name: auth0 Value: s%3Av1.gadzZXNzaW9ugqZoYW5kbGXEQPHc4eVlV3ciJ9X0l5ufJRYEoMh__4RBKJyxKiED7rjkMF4GpbumcKumR6ULC3ThtalhUabhcHwBwT8z32zv8tumY29va2llg6dleHBpcmVz1__hETAAZi4eS65vcmlnaW5hbE1heEFnZc4PcxQAqHNhbWVTaXRlpG5vbmU.nyDgMZsiZYERRx%2BCnym7nX5N%2B8fLKaAavKXJSOuif5g |
|
ntxtest.auth0.com/ | Name: did_compat Value: s%3Av0%3Aae233340-02ea-11ef-bb03-f14807807bb4.oBVmzkuFwJVy00TfrfIh1fjEOtymm33ms0VeZpsp8Ws |
|
ntxtest.auth0.com/ | Name: auth0_compat Value: s%3Av1.gadzZXNzaW9ugqZoYW5kbGXEQPHc4eVlV3ciJ9X0l5ufJRYEoMh__4RBKJyxKiED7rjkMF4GpbumcKumR6ULC3ThtalhUabhcHwBwT8z32zv8tumY29va2llg6dleHBpcmVz1__hETAAZi4eS65vcmlnaW5hbE1heEFnZc4PcxQAqHNhbWVTaXRlpG5vbmU.nyDgMZsiZYERRx%2BCnym7nX5N%2B8fLKaAavKXJSOuif5g |
|
.login.microsoftonline.com/ | Name: esctx-3n3TG0ufUsM Value: AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8QhtfLjJrRkFe9cf-E3mbt1acdzxv6PIX62w9o-4GeU6QKxxUWqs4QaUuK2dROBxm3Effc71E0ETDrBRv-tzN26C5OuDhmDctms3gZXcGaQua5D-YLv6ARynQ6_fddq8X3vGbbCKWvb2A0ha_FafV6CAA |
|
login.microsoftonline.com/ | Name: fpc Value: AiPTYjl0bsJFiXgDtSQXgTM |
|
.login.microsoftonline.com/ | Name: esctx Value: PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8fDsTFGTFR1XMLoW7mCS2WA9yi_Vb_q3ClU3z4o5avmTd2TY3KhzGFYJlvGufFM7SRHtZP4A3pbxRO_IHIJ3FZbsbTC9_GV9mfDHNGNq1HAGQiON5ikpgKe2aUwpMDTlukt5ecKhrEZ5Av1lglquoDRuG30Udr6DoLXERg-RjfJAgAA |
|
login.microsoftonline.com/ | Name: x-ms-gateway-slice Value: estsfd |
|
login.microsoftonline.com/ | Name: stsservicecookie Value: estsfd |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Content-Security-Policy | frame-ancestors * |
Strict-Transport-Security | max-age=31536000; includeSubDomains |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
aadcdn.msftauth.net
auth.nintexcloudtest.com
hassan.workflowcloud-test.com
login.microsoftonline.com
ntxtest.auth0.com
login.microsoftonline.com
107.154.38.60
2603:1026:3000:148::12
2606:2800:233:78b9:f44e:2c1f:31aa:d9ef
2606:4700::6811:feb6
4b1b49e4ca1cc79af8e168c22e4ba4567e1ce9def25bdb3dce474203a9e41451
82429684290933bc18b18bb68663e356dde635b39d2866f09908a57dbeeabe9c
b9434a231c0e07376a64ea7bd18932cf5cc925a4f55182e9c5517a36aa2d5140
d12f35509e7ebcd8af368faf23c490fda08fa0cb21171ab6b60ae2468242e500
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855