login-microsoftonline.onlinemailservices.email Open in urlscan Pro
185.189.149.142  Malicious Activity! Public Scan

Submitted URL: http://login-microsoftonline.onlinemailservices.email/
Effective URL: https://login-microsoftonline.onlinemailservices.email/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3...
Submission: On May 27 via manual from AT — Scanned from DE

Summary

This website contacted 2 IPs in 1 countries across 1 domains to perform 18 HTTP transactions. The main IP is 185.189.149.142, located in Switzerland and belongs to AS-SOFTPLUS, CH. The main domain is login-microsoftonline.onlinemailservices.email.
TLS certificate: Issued by R3 on May 27th 2022. Valid for: 3 months.
This is the only time login-microsoftonline.onlinemailservices.email was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
3 20 185.189.149.142 51395 (AS-SOFTPLUS)
18 2
Domain Requested by
11 aadcdn-msftauth-7e6ac4aa.onlinemailservices.email login-microsoftonline.onlinemailservices.email
aadcdn-msftauth-7e6ac4aa.onlinemailservices.email
6 login-microsoftonline.onlinemailservices.email 2 redirects login-microsoftonline.onlinemailservices.email
2 login-live.onlinemailservices.email login-microsoftonline.onlinemailservices.email
aadcdn-msftauth-7e6ac4aa.onlinemailservices.email
1 www-office.onlinemailservices.email 1 redirects
18 4
Subject Issuer Validity Valid
onlinemailservices.email
R3
2022-05-27 -
2022-08-25
3 months crt.sh

This page contains 2 frames:

Primary Page: https://login-microsoftonline.onlinemailservices.email/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww-office.onlinemailservices.email%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww-office.onlinemailservices.email%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637892884903445095.ZTk5OGQ3NmUtMjMyYy00YmQ3LTk2NGMtZmMwYjBlYWRlNjU1YTE0OTUyOWEtYjlmZC00NTg0LWJlZmItN2Q4YjlhODM0YmQ3&ui_locales=de-DE&mkt=de-DE&state=s3Pk1rT07VC1kotUWfqXmYp6FAo9p967eKcG7smumEdWLek4YfHPbSD-LXtncYVEcYjVngrGxSiN5FBMaIg3NWuKZuy87J8NBO7qZ6W-pxzy5cYVzHf_Bj72jh8Boao3ZvJe9EZRE8r09-wh07p40lNCvC2Ejs8v20llvA7B1sXuVjfIphJrY8a9KygzASbRUWjD_lytp4IVoGULVInIvFodNtG2y_vlXtEnrhOboeXSKzKSb5Px2s7RYxmolnI3ar-Jz310gB7JF5kMm-okiQ&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0&sso_reload=true
Frame ID: E25DD2DB1F551530F8FDDEF9D3BAF37D
Requests: 16 HTTP requests in this frame

Frame: https://login-live.onlinemailservices.email/Me.htm?v=3
Frame ID: 49D58F9A2E2DDE77B30A9D50B86456B0
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

Bei Ihrem Konto anmelden

Page URL History Show full URLs

  1. http://login-microsoftonline.onlinemailservices.email/ HTTP 301
    https://login-microsoftonline.onlinemailservices.email/ Page URL
  2. https://login-microsoftonline.onlinemailservices.email/ HTTP 302
    https://www-office.onlinemailservices.email/login HTTP 302
    https://login-microsoftonline.onlinemailservices.email/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&... Page URL
  3. https://login-microsoftonline.onlinemailservices.email/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&... Page URL

Page Statistics

18
Requests

94 %
HTTPS

0 %
IPv6

1
Domains

4
Subdomains

2
IPs

1
Countries

389 kB
Transfer

1227 kB
Size

9
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://login-microsoftonline.onlinemailservices.email/ HTTP 301
    https://login-microsoftonline.onlinemailservices.email/ Page URL
  2. https://login-microsoftonline.onlinemailservices.email/ HTTP 302
    https://www-office.onlinemailservices.email/login HTTP 302
    https://login-microsoftonline.onlinemailservices.email/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww-office.onlinemailservices.email%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww-office.onlinemailservices.email%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637892884903445095.ZTk5OGQ3NmUtMjMyYy00YmQ3LTk2NGMtZmMwYjBlYWRlNjU1YTE0OTUyOWEtYjlmZC00NTg0LWJlZmItN2Q4YjlhODM0YmQ3&ui_locales=de-DE&mkt=de-DE&state=s3Pk1rT07VC1kotUWfqXmYp6FAo9p967eKcG7smumEdWLek4YfHPbSD-LXtncYVEcYjVngrGxSiN5FBMaIg3NWuKZuy87J8NBO7qZ6W-pxzy5cYVzHf_Bj72jh8Boao3ZvJe9EZRE8r09-wh07p40lNCvC2Ejs8v20llvA7B1sXuVjfIphJrY8a9KygzASbRUWjD_lytp4IVoGULVInIvFodNtG2y_vlXtEnrhOboeXSKzKSb5Px2s7RYxmolnI3ar-Jz310gB7JF5kMm-okiQ&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0 Page URL
  3. https://login-microsoftonline.onlinemailservices.email/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww-office.onlinemailservices.email%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww-office.onlinemailservices.email%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637892884903445095.ZTk5OGQ3NmUtMjMyYy00YmQ3LTk2NGMtZmMwYjBlYWRlNjU1YTE0OTUyOWEtYjlmZC00NTg0LWJlZmItN2Q4YjlhODM0YmQ3&ui_locales=de-DE&mkt=de-DE&state=s3Pk1rT07VC1kotUWfqXmYp6FAo9p967eKcG7smumEdWLek4YfHPbSD-LXtncYVEcYjVngrGxSiN5FBMaIg3NWuKZuy87J8NBO7qZ6W-pxzy5cYVzHf_Bj72jh8Boao3ZvJe9EZRE8r09-wh07p40lNCvC2Ejs8v20llvA7B1sXuVjfIphJrY8a9KygzASbRUWjD_lytp4IVoGULVInIvFodNtG2y_vlXtEnrhOboeXSKzKSb5Px2s7RYxmolnI3ar-Jz310gB7JF5kMm-okiQ&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0&sso_reload=true Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://login-microsoftonline.onlinemailservices.email/ HTTP 301
  • https://login-microsoftonline.onlinemailservices.email/
Request Chain 1
  • https://login-microsoftonline.onlinemailservices.email/ HTTP 302
  • https://www-office.onlinemailservices.email/login HTTP 302
  • https://login-microsoftonline.onlinemailservices.email/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww-office.onlinemailservices.email%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww-office.onlinemailservices.email%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637892884903445095.ZTk5OGQ3NmUtMjMyYy00YmQ3LTk2NGMtZmMwYjBlYWRlNjU1YTE0OTUyOWEtYjlmZC00NTg0LWJlZmItN2Q4YjlhODM0YmQ3&ui_locales=de-DE&mkt=de-DE&state=s3Pk1rT07VC1kotUWfqXmYp6FAo9p967eKcG7smumEdWLek4YfHPbSD-LXtncYVEcYjVngrGxSiN5FBMaIg3NWuKZuy87J8NBO7qZ6W-pxzy5cYVzHf_Bj72jh8Boao3ZvJe9EZRE8r09-wh07p40lNCvC2Ejs8v20llvA7B1sXuVjfIphJrY8a9KygzASbRUWjD_lytp4IVoGULVInIvFodNtG2y_vlXtEnrhOboeXSKzKSb5Px2s7RYxmolnI3ar-Jz310gB7JF5kMm-okiQ&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0

18 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
/
login-microsoftonline.onlinemailservices.email/
Redirect Chain
  • http://login-microsoftonline.onlinemailservices.email/
  • https://login-microsoftonline.onlinemailservices.email/
72 KB
25 KB
Document
General
Full URL
https://login-microsoftonline.onlinemailservices.email/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.189.149.142 , Switzerland, ASN51395 (AS-SOFTPLUS, CH),
Reverse DNS
macestart.com
Software
nginx/1.21.6 /
Resource Hash
2c0cd347e7ec499e9274b56efcdca69dc07b64e53722c789bab97da89667ea1f

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-headers
*
access-control-allow-origin
*
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Fri, 27 May 2022 22:48:09 GMT
server
nginx/1.21.6
vary
Accept-Encoding

Redirect headers

Connection
keep-alive
Content-Length
169
Content-Type
text/html
Date
Fri, 27 May 2022 22:48:09 GMT
Location
https://login-microsoftonline.onlinemailservices.email/
Server
nginx/1.21.6
authorize
login-microsoftonline.onlinemailservices.email/common/oauth2/v2.0/
Redirect Chain
  • https://login-microsoftonline.onlinemailservices.email/
  • https://www-office.onlinemailservices.email/login
  • https://login-microsoftonline.onlinemailservices.email/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww-office.onlinemailservices.email%2Fl...
291 KB
85 KB
Document
General
Full URL
https://login-microsoftonline.onlinemailservices.email/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww-office.onlinemailservices.email%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww-office.onlinemailservices.email%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637892884903445095.ZTk5OGQ3NmUtMjMyYy00YmQ3LTk2NGMtZmMwYjBlYWRlNjU1YTE0OTUyOWEtYjlmZC00NTg0LWJlZmItN2Q4YjlhODM0YmQ3&ui_locales=de-DE&mkt=de-DE&state=s3Pk1rT07VC1kotUWfqXmYp6FAo9p967eKcG7smumEdWLek4YfHPbSD-LXtncYVEcYjVngrGxSiN5FBMaIg3NWuKZuy87J8NBO7qZ6W-pxzy5cYVzHf_Bj72jh8Boao3ZvJe9EZRE8r09-wh07p40lNCvC2Ejs8v20llvA7B1sXuVjfIphJrY8a9KygzASbRUWjD_lytp4IVoGULVInIvFodNtG2y_vlXtEnrhOboeXSKzKSb5Px2s7RYxmolnI3ar-Jz310gB7JF5kMm-okiQ&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0
Requested by
Host: login-microsoftonline.onlinemailservices.email
URL: https://login-microsoftonline.onlinemailservices.email/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.189.149.142 , Switzerland, ASN51395 (AS-SOFTPLUS, CH),
Reverse DNS
macestart.com
Software
nginx/1.21.6 /
Resource Hash
5cfde8e8595058b7a784030000ee5b3b1aa8f5a34156838ddda37ff96e5b0ce0

Request headers

Referer
https://login-microsoftonline.onlinemailservices.email/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-headers
*
access-control-allow-origin
*
cache-control
no-store, no-cache
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Fri, 27 May 2022 22:48:10 GMT
nel
{"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
p3p
CP="DSP CUR OTPi IND OTRi ONL FIN"
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
report-to
{"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity-nel-measure-office-7e6ac4aa.onlinemailservices.email/api/report?catId=GW+estsfd+dub2"}]}
server
nginx/1.21.6
vary
Accept-Encoding Accept-Encoding
x-ms-clitelem
1,50168,0,,
x-ms-ests-server
2.1.12794.7 - WEULR2 ProdSlices
x-ms-request-id
bdaf11a9-5d2a-4690-9dfa-62bf51cd0800

Redirect headers

access-control-allow-headers
*
access-control-allow-origin
*
content-type
text/html; charset=utf-8
date
Fri, 27 May 2022 22:48:10 GMT
location
https://login-microsoftonline.onlinemailservices.email/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww-office.onlinemailservices.email%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww-office.onlinemailservices.email%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637892884903445095.ZTk5OGQ3NmUtMjMyYy00YmQ3LTk2NGMtZmMwYjBlYWRlNjU1YTE0OTUyOWEtYjlmZC00NTg0LWJlZmItN2Q4YjlhODM0YmQ3&ui_locales=de-DE&mkt=de-DE&state=s3Pk1rT07VC1kotUWfqXmYp6FAo9p967eKcG7smumEdWLek4YfHPbSD-LXtncYVEcYjVngrGxSiN5FBMaIg3NWuKZuy87J8NBO7qZ6W-pxzy5cYVzHf_Bj72jh8Boao3ZvJe9EZRE8r09-wh07p40lNCvC2Ejs8v20llvA7B1sXuVjfIphJrY8a9KygzASbRUWjD_lytp4IVoGULVInIvFodNtG2y_vlXtEnrhOboeXSKzKSb5Px2s7RYxmolnI3ar-Jz310gB7JF5kMm-okiQ&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0
referrer-policy
strict-origin-when-cross-origin
request-context
appId=
server
nginx/1.21.6
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
x-msedge-ref
Ref A: E5C35683CF624F29AB04DF9149072C3A Ref B: VIEEDGE4320 Ref C: 2022-05-27T22:48:10Z
x-ua-compatible
IE=edge,chrome=1
reportbssotelemetry
login-microsoftonline.onlinemailservices.email/common/instrumentation/
264 B
846 B
Ping
General
Full URL
https://login-microsoftonline.onlinemailservices.email/common/instrumentation/reportbssotelemetry?hpgid=6&hpgact=1800&client-request-id=6c14a61f-117b-40f9-9d23-dbbe7f7561cf&hpgrequestid=bdaf11a9-5d2a-4690-9dfa-62bf51cd0800
Requested by
Host: login-microsoftonline.onlinemailservices.email
URL: https://login-microsoftonline.onlinemailservices.email/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww-office.onlinemailservices.email%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww-office.onlinemailservices.email%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637892884903445095.ZTk5OGQ3NmUtMjMyYy00YmQ3LTk2NGMtZmMwYjBlYWRlNjU1YTE0OTUyOWEtYjlmZC00NTg0LWJlZmItN2Q4YjlhODM0YmQ3&ui_locales=de-DE&mkt=de-DE&state=s3Pk1rT07VC1kotUWfqXmYp6FAo9p967eKcG7smumEdWLek4YfHPbSD-LXtncYVEcYjVngrGxSiN5FBMaIg3NWuKZuy87J8NBO7qZ6W-pxzy5cYVzHf_Bj72jh8Boao3ZvJe9EZRE8r09-wh07p40lNCvC2Ejs8v20llvA7B1sXuVjfIphJrY8a9KygzASbRUWjD_lytp4IVoGULVInIvFodNtG2y_vlXtEnrhOboeXSKzKSb5Px2s7RYxmolnI3ar-Jz310gB7JF5kMm-okiQ&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.189.149.142 , Switzerland, ASN51395 (AS-SOFTPLUS, CH),
Reverse DNS
macestart.com
Software
nginx/1.21.6 /
Resource Hash

Request headers

Referer
https://login-microsoftonline.onlinemailservices.email/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww-office.onlinemailservices.email%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww-office.onlinemailservices.email%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637892884903445095.ZTk5OGQ3NmUtMjMyYy00YmQ3LTk2NGMtZmMwYjBlYWRlNjU1YTE0OTUyOWEtYjlmZC00NTg0LWJlZmItN2Q4YjlhODM0YmQ3&ui_locales=de-DE&mkt=de-DE&state=s3Pk1rT07VC1kotUWfqXmYp6FAo9p967eKcG7smumEdWLek4YfHPbSD-LXtncYVEcYjVngrGxSiN5FBMaIg3NWuKZuy87J8NBO7qZ6W-pxzy5cYVzHf_Bj72jh8Boao3ZvJe9EZRE8r09-wh07p40lNCvC2Ejs8v20llvA7B1sXuVjfIphJrY8a9KygzASbRUWjD_lytp4IVoGULVInIvFodNtG2y_vlXtEnrhOboeXSKzKSb5Px2s7RYxmolnI3ar-Jz310gB7JF5kMm-okiQ&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Fri, 27 May 2022 22:48:11 GMT
content-encoding
gzip
referrer-policy
strict-origin-when-cross-origin
nel
{"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
server
nginx/1.21.6
vary
Accept-Encoding
report-to
{"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity-nel-measure-office-7e6ac4aa.onlinemailservices.email/api/report?catId=GW+estsfd+dub2"}]}
p3p
CP="DSP CUR OTPi IND OTRi ONL FIN"
access-control-allow-origin
*
x-ms-request-id
2666cf7c-4d34-43c4-93d3-a463ef2a0600
cache-control
no-store, no-cache
content-type
application/json; charset=utf-8
access-control-allow-headers
*
x-ms-ests-server
2.1.12794.7 - WEULR2 ProdSlices
Primary Request authorize
login-microsoftonline.onlinemailservices.email/common/oauth2/v2.0/
344 KB
82 KB
Document
General
Full URL
https://login-microsoftonline.onlinemailservices.email/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww-office.onlinemailservices.email%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww-office.onlinemailservices.email%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637892884903445095.ZTk5OGQ3NmUtMjMyYy00YmQ3LTk2NGMtZmMwYjBlYWRlNjU1YTE0OTUyOWEtYjlmZC00NTg0LWJlZmItN2Q4YjlhODM0YmQ3&ui_locales=de-DE&mkt=de-DE&state=s3Pk1rT07VC1kotUWfqXmYp6FAo9p967eKcG7smumEdWLek4YfHPbSD-LXtncYVEcYjVngrGxSiN5FBMaIg3NWuKZuy87J8NBO7qZ6W-pxzy5cYVzHf_Bj72jh8Boao3ZvJe9EZRE8r09-wh07p40lNCvC2Ejs8v20llvA7B1sXuVjfIphJrY8a9KygzASbRUWjD_lytp4IVoGULVInIvFodNtG2y_vlXtEnrhOboeXSKzKSb5Px2s7RYxmolnI3ar-Jz310gB7JF5kMm-okiQ&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0&sso_reload=true
Requested by
Host: login-microsoftonline.onlinemailservices.email
URL: https://login-microsoftonline.onlinemailservices.email/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww-office.onlinemailservices.email%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww-office.onlinemailservices.email%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637892884903445095.ZTk5OGQ3NmUtMjMyYy00YmQ3LTk2NGMtZmMwYjBlYWRlNjU1YTE0OTUyOWEtYjlmZC00NTg0LWJlZmItN2Q4YjlhODM0YmQ3&ui_locales=de-DE&mkt=de-DE&state=s3Pk1rT07VC1kotUWfqXmYp6FAo9p967eKcG7smumEdWLek4YfHPbSD-LXtncYVEcYjVngrGxSiN5FBMaIg3NWuKZuy87J8NBO7qZ6W-pxzy5cYVzHf_Bj72jh8Boao3ZvJe9EZRE8r09-wh07p40lNCvC2Ejs8v20llvA7B1sXuVjfIphJrY8a9KygzASbRUWjD_lytp4IVoGULVInIvFodNtG2y_vlXtEnrhOboeXSKzKSb5Px2s7RYxmolnI3ar-Jz310gB7JF5kMm-okiQ&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.189.149.142 , Switzerland, ASN51395 (AS-SOFTPLUS, CH),
Reverse DNS
macestart.com
Software
nginx/1.21.6 /
Resource Hash
6a685f793c0105f2cd8981c13892f97ec6209a648deede365d8d6282859b9b34

Request headers

Referer
https://login-microsoftonline.onlinemailservices.email/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww-office.onlinemailservices.email%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww-office.onlinemailservices.email%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637892884903445095.ZTk5OGQ3NmUtMjMyYy00YmQ3LTk2NGMtZmMwYjBlYWRlNjU1YTE0OTUyOWEtYjlmZC00NTg0LWJlZmItN2Q4YjlhODM0YmQ3&ui_locales=de-DE&mkt=de-DE&state=s3Pk1rT07VC1kotUWfqXmYp6FAo9p967eKcG7smumEdWLek4YfHPbSD-LXtncYVEcYjVngrGxSiN5FBMaIg3NWuKZuy87J8NBO7qZ6W-pxzy5cYVzHf_Bj72jh8Boao3ZvJe9EZRE8r09-wh07p40lNCvC2Ejs8v20llvA7B1sXuVjfIphJrY8a9KygzASbRUWjD_lytp4IVoGULVInIvFodNtG2y_vlXtEnrhOboeXSKzKSb5Px2s7RYxmolnI3ar-Jz310gB7JF5kMm-okiQ&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-headers
*
access-control-allow-origin
*
cache-control
no-store, no-cache
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Fri, 27 May 2022 22:48:11 GMT
nel
{"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
p3p
CP="DSP CUR OTPi IND OTRi ONL FIN"
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
report-to
{"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity-nel-measure-office-7e6ac4aa.onlinemailservices.email/api/report?catId=GW+estsfd+dub2"}]}
server
nginx/1.21.6
vary
Accept-Encoding Accept-Encoding
x-ms-clitelem
1,0,0,,
x-ms-ests-server
2.1.12821.9 - WEULR2 ProdSlices
x-ms-request-id
dec4c334-34c5-436e-a2d8-a1ed9dff1b00
Me.htm
login-live.onlinemailservices.email/
0
0
Other
General
Full URL
https://login-live.onlinemailservices.email/Me.htm?v=3
Requested by
Host: login-microsoftonline.onlinemailservices.email
URL: https://login-microsoftonline.onlinemailservices.email/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww-office.onlinemailservices.email%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww-office.onlinemailservices.email%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637892884903445095.ZTk5OGQ3NmUtMjMyYy00YmQ3LTk2NGMtZmMwYjBlYWRlNjU1YTE0OTUyOWEtYjlmZC00NTg0LWJlZmItN2Q4YjlhODM0YmQ3&ui_locales=de-DE&mkt=de-DE&state=s3Pk1rT07VC1kotUWfqXmYp6FAo9p967eKcG7smumEdWLek4YfHPbSD-LXtncYVEcYjVngrGxSiN5FBMaIg3NWuKZuy87J8NBO7qZ6W-pxzy5cYVzHf_Bj72jh8Boao3ZvJe9EZRE8r09-wh07p40lNCvC2Ejs8v20llvA7B1sXuVjfIphJrY8a9KygzASbRUWjD_lytp4IVoGULVInIvFodNtG2y_vlXtEnrhOboeXSKzKSb5Px2s7RYxmolnI3ar-Jz310gB7JF5kMm-okiQ&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0&sso_reload=true
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.189.149.142 , Switzerland, ASN51395 (AS-SOFTPLUS, CH),
Reverse DNS
macestart.com
Software
/
Resource Hash

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://login-microsoftonline.onlinemailservices.email/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

ConvergedLogin_PCore_Ab4Yaj5a0D_cjcCwxd3oDw2.js
aadcdn-msftauth-7e6ac4aa.onlinemailservices.email/shared/1.0/content/js/
379 KB
108 KB
Script
General
Full URL
https://aadcdn-msftauth-7e6ac4aa.onlinemailservices.email/shared/1.0/content/js/ConvergedLogin_PCore_Ab4Yaj5a0D_cjcCwxd3oDw2.js
Requested by
Host: login-microsoftonline.onlinemailservices.email
URL: https://login-microsoftonline.onlinemailservices.email/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww-office.onlinemailservices.email%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww-office.onlinemailservices.email%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637892884903445095.ZTk5OGQ3NmUtMjMyYy00YmQ3LTk2NGMtZmMwYjBlYWRlNjU1YTE0OTUyOWEtYjlmZC00NTg0LWJlZmItN2Q4YjlhODM0YmQ3&ui_locales=de-DE&mkt=de-DE&state=s3Pk1rT07VC1kotUWfqXmYp6FAo9p967eKcG7smumEdWLek4YfHPbSD-LXtncYVEcYjVngrGxSiN5FBMaIg3NWuKZuy87J8NBO7qZ6W-pxzy5cYVzHf_Bj72jh8Boao3ZvJe9EZRE8r09-wh07p40lNCvC2Ejs8v20llvA7B1sXuVjfIphJrY8a9KygzASbRUWjD_lytp4IVoGULVInIvFodNtG2y_vlXtEnrhOboeXSKzKSb5Px2s7RYxmolnI3ar-Jz310gB7JF5kMm-okiQ&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0&sso_reload=true
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.189.149.142 , Switzerland, ASN51395 (AS-SOFTPLUS, CH),
Reverse DNS
macestart.com
Software
nginx/1.21.6 /
Resource Hash
037758b0f935c8e9062b3c5a6e9ce51ed2b84e366585aa77a3641fb6597a222e

Request headers

Referer
https://login-microsoftonline.onlinemailservices.email/
Origin
https://login-microsoftonline.onlinemailservices.email
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
date
Fri, 27 May 2022 22:48:12 GMT
content-encoding
gzip
last-modified
Fri, 06 May 2022 21:52:08 GMT
server
nginx/1.21.6
age
1644087
vary
Accept-Encoding, Accept-Encoding
x-cache
HIT
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
1acd2104-501e-0067-1127-6344ba000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
converged.v2.login.min_ziytf8dzt9eg1s6-ohhleg2.css
aadcdn-msftauth-7e6ac4aa.onlinemailservices.email/ests/2.1/content/cdnbundles/
0
20 KB
Other
General
Full URL
https://aadcdn-msftauth-7e6ac4aa.onlinemailservices.email/ests/2.1/content/cdnbundles/converged.v2.login.min_ziytf8dzt9eg1s6-ohhleg2.css
Requested by
Host: login-microsoftonline.onlinemailservices.email
URL: https://login-microsoftonline.onlinemailservices.email/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww-office.onlinemailservices.email%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww-office.onlinemailservices.email%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637892884903445095.ZTk5OGQ3NmUtMjMyYy00YmQ3LTk2NGMtZmMwYjBlYWRlNjU1YTE0OTUyOWEtYjlmZC00NTg0LWJlZmItN2Q4YjlhODM0YmQ3&ui_locales=de-DE&mkt=de-DE&state=s3Pk1rT07VC1kotUWfqXmYp6FAo9p967eKcG7smumEdWLek4YfHPbSD-LXtncYVEcYjVngrGxSiN5FBMaIg3NWuKZuy87J8NBO7qZ6W-pxzy5cYVzHf_Bj72jh8Boao3ZvJe9EZRE8r09-wh07p40lNCvC2Ejs8v20llvA7B1sXuVjfIphJrY8a9KygzASbRUWjD_lytp4IVoGULVInIvFodNtG2y_vlXtEnrhOboeXSKzKSb5Px2s7RYxmolnI3ar-Jz310gB7JF5kMm-okiQ&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0&sso_reload=true
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.189.149.142 , Switzerland, ASN51395 (AS-SOFTPLUS, CH),
Reverse DNS
macestart.com
Software
nginx/1.21.6 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://login-microsoftonline.onlinemailservices.email/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
date
Fri, 27 May 2022 22:48:12 GMT
content-encoding
gzip
last-modified
Mon, 18 Apr 2022 21:17:58 GMT
server
nginx/1.21.6
age
3303606
vary
Accept-Encoding, Accept-Encoding
x-cache
HIT
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
e26fcc02-601e-001b-6810-54b5e2000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
ux.converged.login.strings-de.min_dleyhmk9dgvufebxr4oyiq2.js
aadcdn-msftauth-7e6ac4aa.onlinemailservices.email/ests/2.1/content/cdnbundles/
0
15 KB
Other
General
Full URL
https://aadcdn-msftauth-7e6ac4aa.onlinemailservices.email/ests/2.1/content/cdnbundles/ux.converged.login.strings-de.min_dleyhmk9dgvufebxr4oyiq2.js
Requested by
Host: login-microsoftonline.onlinemailservices.email
URL: https://login-microsoftonline.onlinemailservices.email/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww-office.onlinemailservices.email%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww-office.onlinemailservices.email%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637892884903445095.ZTk5OGQ3NmUtMjMyYy00YmQ3LTk2NGMtZmMwYjBlYWRlNjU1YTE0OTUyOWEtYjlmZC00NTg0LWJlZmItN2Q4YjlhODM0YmQ3&ui_locales=de-DE&mkt=de-DE&state=s3Pk1rT07VC1kotUWfqXmYp6FAo9p967eKcG7smumEdWLek4YfHPbSD-LXtncYVEcYjVngrGxSiN5FBMaIg3NWuKZuy87J8NBO7qZ6W-pxzy5cYVzHf_Bj72jh8Boao3ZvJe9EZRE8r09-wh07p40lNCvC2Ejs8v20llvA7B1sXuVjfIphJrY8a9KygzASbRUWjD_lytp4IVoGULVInIvFodNtG2y_vlXtEnrhOboeXSKzKSb5Px2s7RYxmolnI3ar-Jz310gB7JF5kMm-okiQ&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0&sso_reload=true
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.189.149.142 , Switzerland, ASN51395 (AS-SOFTPLUS, CH),
Reverse DNS
macestart.com
Software
nginx/1.21.6 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://login-microsoftonline.onlinemailservices.email/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
date
Fri, 27 May 2022 22:48:12 GMT
content-encoding
gzip
last-modified
Tue, 03 May 2022 21:20:06 GMT
server
nginx/1.21.6
age
792203
vary
Accept-Encoding, Accept-Encoding
x-cache
HIT
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
9743d26f-001e-006f-23e7-6a6395000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
convergedlogin_pfetchsessionsprogress_5ae001837875e6d5d706.js
aadcdn-msftauth-7e6ac4aa.onlinemailservices.email/shared/1.0/content/js/asyncchunk/
15 KB
6 KB
Script
General
Full URL
https://aadcdn-msftauth-7e6ac4aa.onlinemailservices.email/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_5ae001837875e6d5d706.js
Requested by
Host: aadcdn-msftauth-7e6ac4aa.onlinemailservices.email
URL: https://aadcdn-msftauth-7e6ac4aa.onlinemailservices.email/shared/1.0/content/js/ConvergedLogin_PCore_Ab4Yaj5a0D_cjcCwxd3oDw2.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.189.149.142 , Switzerland, ASN51395 (AS-SOFTPLUS, CH),
Reverse DNS
macestart.com
Software
nginx/1.21.6 /
Resource Hash
42f05dd3cc62b4e335cf734e9a067a005f7998306230aab2d763dd4ecceac164

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://login-microsoftonline.onlinemailservices.email/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
date
Fri, 27 May 2022 22:48:12 GMT
content-encoding
gzip
last-modified
Tue, 26 Apr 2022 23:42:16 GMT
server
nginx/1.21.6
age
2476713
vary
Accept-Encoding, Accept-Encoding
x-cache
HIT
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
c0f8fae1-e01e-003f-7b95-5b201f000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
marching_ants_white_166de53471265253ab3a456defe6da23.gif
aadcdn-msftauth-7e6ac4aa.onlinemailservices.email/shared/1.0/content/images/
3 KB
3 KB
Image
General
Full URL
https://aadcdn-msftauth-7e6ac4aa.onlinemailservices.email/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.189.149.142 , Switzerland, ASN51395 (AS-SOFTPLUS, CH),
Reverse DNS
macestart.com
Software
nginx/1.21.6 /
Resource Hash
a46201581a7c7c667fd42787cd1e9adf2f6bf809efb7596e61a03e8dba9ada13

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://login-microsoftonline.onlinemailservices.email/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
date
Fri, 27 May 2022 22:48:12 GMT
last-modified
Thu, 16 Jan 2020 00:32:52 GMT
server
nginx/1.21.6
age
27631799
etag
0x8D79A1B9F2C6EC8
x-cache
HIT
content-type
image/gif
access-control-allow-origin
*
x-ms-request-id
4ed8ff24-e01e-0094-5bcc-767244000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif
aadcdn-msftauth-7e6ac4aa.onlinemailservices.email/shared/1.0/content/images/
4 KB
4 KB
Image
General
Full URL
https://aadcdn-msftauth-7e6ac4aa.onlinemailservices.email/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.189.149.142 , Switzerland, ASN51395 (AS-SOFTPLUS, CH),
Reverse DNS
macestart.com
Software
nginx/1.21.6 /
Resource Hash
8737d721808655f37b333f08a90185699e7e8b9bdaaa15cdb63c8448b426f95d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://login-microsoftonline.onlinemailservices.email/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
date
Fri, 27 May 2022 22:48:12 GMT
last-modified
Thu, 16 Jan 2020 00:32:52 GMT
server
nginx/1.21.6
age
11396409
etag
0x8D79A1B9F8A840E
x-cache
HIT
content-type
image/gif
access-control-allow-origin
*
x-ms-request-id
36637921-801e-0008-7f75-0af9aa000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
convergedlogin_pcustomizationloader_1adab4c9a8227bd729f8.js
aadcdn-msftauth-7e6ac4aa.onlinemailservices.email/shared/1.0/content/js/asyncchunk/
107 KB
32 KB
Script
General
Full URL
https://aadcdn-msftauth-7e6ac4aa.onlinemailservices.email/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_1adab4c9a8227bd729f8.js
Requested by
Host: aadcdn-msftauth-7e6ac4aa.onlinemailservices.email
URL: https://aadcdn-msftauth-7e6ac4aa.onlinemailservices.email/shared/1.0/content/js/ConvergedLogin_PCore_Ab4Yaj5a0D_cjcCwxd3oDw2.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.189.149.142 , Switzerland, ASN51395 (AS-SOFTPLUS, CH),
Reverse DNS
macestart.com
Software
nginx/1.21.6 /
Resource Hash
9540587fbcbd439db6603b2b014f4ff8584040af358b77994bbd83ec522537db

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://login-microsoftonline.onlinemailservices.email/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
date
Fri, 27 May 2022 22:48:12 GMT
content-encoding
gzip
last-modified
Tue, 03 May 2022 01:12:33 GMT
server
nginx/1.21.6
age
2008570
vary
Accept-Encoding, Accept-Encoding
x-cache
HIT
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
f6531e92-401e-004a-0cd7-5f0865000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
2_bc3d32a696895f78c19df6c717586a5d.svg
aadcdn-msftauth-7e6ac4aa.onlinemailservices.email/shared/1.0/content/images/backgrounds/
2 KB
1 KB
Image
General
Full URL
https://aadcdn-msftauth-7e6ac4aa.onlinemailservices.email/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.189.149.142 , Switzerland, ASN51395 (AS-SOFTPLUS, CH),
Reverse DNS
macestart.com
Software
nginx/1.21.6 /
Resource Hash
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://login-microsoftonline.onlinemailservices.email/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
date
Fri, 27 May 2022 22:48:12 GMT
content-encoding
gzip
last-modified
Wed, 12 Feb 2020 22:01:50 GMT
server
nginx/1.21.6
age
25050184
vary
Accept-Encoding, Accept-Encoding
x-cache
HIT
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
35fe2f35-601e-003a-5447-8e35be000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
aadcdn-msftauth-7e6ac4aa.onlinemailservices.email/shared/1.0/content/images/
4 KB
2 KB
Image
General
Full URL
https://aadcdn-msftauth-7e6ac4aa.onlinemailservices.email/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.189.149.142 , Switzerland, ASN51395 (AS-SOFTPLUS, CH),
Reverse DNS
macestart.com
Software
nginx/1.21.6 /
Resource Hash
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://login-microsoftonline.onlinemailservices.email/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
date
Fri, 27 May 2022 22:48:12 GMT
content-encoding
gzip
last-modified
Thu, 16 Jan 2020 00:32:52 GMT
server
nginx/1.21.6
age
26775673
vary
Accept-Encoding, Accept-Encoding
x-cache
HIT
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
223aaa58-c01e-0068-0195-7e7b59000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
marching_ants_white_166de53471265253ab3a456defe6da23.gif
aadcdn-msftauth-7e6ac4aa.onlinemailservices.email/shared/1.0/content/images/
3 KB
3 KB
Image
General
Full URL
https://aadcdn-msftauth-7e6ac4aa.onlinemailservices.email/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif
Requested by
Host: aadcdn-msftauth-7e6ac4aa.onlinemailservices.email
URL: https://aadcdn-msftauth-7e6ac4aa.onlinemailservices.email/shared/1.0/content/js/ConvergedLogin_PCore_Ab4Yaj5a0D_cjcCwxd3oDw2.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.189.149.142 , Switzerland, ASN51395 (AS-SOFTPLUS, CH),
Reverse DNS
macestart.com
Software
nginx/1.21.6 /
Resource Hash
a46201581a7c7c667fd42787cd1e9adf2f6bf809efb7596e61a03e8dba9ada13

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://login-microsoftonline.onlinemailservices.email/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
date
Fri, 27 May 2022 22:48:12 GMT
last-modified
Thu, 16 Jan 2020 00:32:52 GMT
server
nginx/1.21.6
age
27631799
etag
0x8D79A1B9F2C6EC8
x-cache
HIT
content-type
image/gif
access-control-allow-origin
*
x-ms-request-id
4ed8ff24-e01e-0094-5bcc-767244000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
Me.htm
login-live.onlinemailservices.email/ Frame 49D5
3 KB
1 KB
Document
General
Full URL
https://login-live.onlinemailservices.email/Me.htm?v=3
Requested by
Host: aadcdn-msftauth-7e6ac4aa.onlinemailservices.email
URL: https://aadcdn-msftauth-7e6ac4aa.onlinemailservices.email/shared/1.0/content/js/ConvergedLogin_PCore_Ab4Yaj5a0D_cjcCwxd3oDw2.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.189.149.142 , Switzerland, ASN51395 (AS-SOFTPLUS, CH),
Reverse DNS
macestart.com
Software
nginx/1.21.6 /
Resource Hash
e22acba126f852f2106d6c9dd32b96e4a95f5f50b769b63a2ef94c327427a48e

Request headers

Referer
https://login-microsoftonline.onlinemailservices.email/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-headers
*
access-control-allow-origin
*
cache-control
max-age=315360000
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Fri, 27 May 2022 22:48:12 GMT
p3p
CP="DSP CUR OTPi IND OTRi ONL FIN"
ppserver
PPV: 30 H: BL02EPF0000683A V: 0
referrer-policy
strict-origin-when-cross-origin
server
nginx/1.21.6
vary
Accept-Encoding Accept-Encoding
x-ms-request-id
90f71758-bcba-49ef-a638-79909b3feaa2
x-ms-route-info
R3_BL2
signin-options_4e48046ce74f4b89d45037c90576bfac.svg
aadcdn-msftauth-7e6ac4aa.onlinemailservices.email/shared/1.0/content/images/
2 KB
1 KB
Image
General
Full URL
https://aadcdn-msftauth-7e6ac4aa.onlinemailservices.email/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
185.189.149.142 , Switzerland, ASN51395 (AS-SOFTPLUS, CH),
Reverse DNS
macestart.com
Software
nginx/1.21.6 /
Resource Hash
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://login-microsoftonline.onlinemailservices.email/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.61 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
date
Fri, 27 May 2022 22:48:13 GMT
content-encoding
gzip
last-modified
Tue, 10 Nov 2020 03:41:05 GMT
server
nginx/1.21.6
age
4594006
vary
Accept-Encoding, Accept-Encoding
x-cache
HIT
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
4e625f01-401e-0083-6753-48d5a0000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

29 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails object| navigation object| $Config object| $Debug object| $Do function| $Loader object| $WebWatson function| GetString function| GetErrorString function| GetUrl object| $B object| ServerData object| webpackJsonp object| ko object| PROOF object| StringRepository boolean| __ConvergedLogin_PCore boolean| __ function| setImmediate function| clearImmediate object| Telemetry object| telemetry_webpackJsonp boolean| __convergedlogin_pfetchsessionsprogress_5ae001837875e6d5d706 boolean| __convergedlogin_pcustomizationloader_1adab4c9a8227bd729f8

9 Cookies

Domain/Path Name / Value
.onlinemailservices.email/ Name: __kvjC
Value: N2U2YWM0YWEtOTk1OS00MjJhLWE2YjYtMTJkZWQyYTA4MGQwOmYxMjhiNzA3LTQzM2EtNGJhOC1iY2Q4LTY2MGIwZDU5NmYxNg==
.onlinemailservices.email/ Name: MUID
Value: 2C3726E68B9166E7205B37578A48670A
www-office.onlinemailservices.email/ Name: .AspNetCore.Correlation.OpenIdConnectV2.5i46rkuZPgu5Q_un3Y3zp-kYPjh2ZQ7RIXf7QGSxB68
Value: N
www-office.onlinemailservices.email/ Name: .AspNetCore.OpenIdConnect.Nonce.d0a2dJey905aJqEzeqJaUT9z7P701IaKLXERFQwWiJt7LHF2wxLMGaviv-ZCWNg-ud7NpSWoPg_-937dIBE8g6GIgzHBguLFkGikz22yAtTt-7qZ9wuAu472AYuNhpLFPI_CHEKaPTEQmOMPywCD8zIoja0nOWD0kl3466F6lCke5rJCoYwWg5qwtHUPLnkCExDgx-InA5v0inxrYysjZN_Tzoytri5ij_a2dub_hkaCkcAm1tNEVpY_iNn9daI8
Value: N
www-office.onlinemailservices.email/ Name: OH.DCAffinity
Value: OH-weu
www-office.onlinemailservices.email/ Name: OH.FLID
Value: b1c7da3d-6f0c-428d-a0ac-7ffee231f3b3
.login-microsoftonline.onlinemailservices.email/ Name: AADSSO
Value: NA|NoExtension
login-microsoftonline.onlinemailservices.email/ Name: SSOCOOKIEPULLED
Value: 1
.login-microsoftonline.onlinemailservices.email/ Name: brcap
Value: 0