![](/screenshots/b6e06721-ecfc-4e4b-8ded-6807e0780385.png)
login.microsoftonline.com
Open in
urlscan Pro
20.190.159.68
Public Scan
Effective URL: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%...
Submission Tags: @ecarlesi possiblethreat Search All
Submission: On March 31 via api from IT — Scanned from IT
Summary
TLS certificate: Issued by DigiCert SHA2 Secure Server CA on March 7th 2024. Valid for: a year.
This is the only time login.microsoftonline.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 | 198.54.120.229 198.54.120.229 | 22612 (NAMECHEAP...) (NAMECHEAP-NET) | |
2 6 | 52.98.152.178 52.98.152.178 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
28 | 23.15.178.82 23.15.178.82 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 | 13.107.246.45 13.107.246.45 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
3 | 20.190.159.68 20.190.159.68 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 | 51.11.192.49 51.11.192.49 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 | 13.107.213.63 13.107.213.63 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
11 | 152.199.23.37 152.199.23.37 | 15133 (EDGECAST) (EDGECAST) | |
1 | 20.190.160.17 20.190.160.17 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
53 | 10 |
ASN22612 (NAMECHEAP-NET, US)
PTR: premium59-4.web-hosting.com
forenqqry65.sbs |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
outlook.office.com | |
outlook.office365.com |
ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-15-178-82.deploy.static.akamaitechnologies.com
res.cdn.office.net |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
login.microsoftonline.com |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
eu-office.events.data.microsoft.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
28 |
office.net
res.cdn.office.net — Cisco Umbrella Rank: 157 |
1 MB |
11 |
msftauth.net
aadcdn.msftauth.net — Cisco Umbrella Rank: 956 |
286 KB |
5 |
office.com
2 redirects
outlook.office.com — Cisco Umbrella Rank: 59 |
21 KB |
3 |
microsoftonline.com
login.microsoftonline.com — Cisco Umbrella Rank: 10 |
28 KB |
2 |
microsoft.com
csp.microsoft.com — Cisco Umbrella Rank: 503 Failed eu-office.events.data.microsoft.com — Cisco Umbrella Rank: 867 |
808 B |
1 |
office365.com
outlook.office365.com — Cisco Umbrella Rank: 40 |
|
1 |
live.com
login.live.com — Cisco Umbrella Rank: 81 |
|
1 |
msauth.net
aadcdn.msauth.net — Cisco Umbrella Rank: 931 |
49 KB |
1 |
forenqqry65.sbs
forenqqry65.sbs |
371 B |
53 | 9 |
Domain | Requested by | |
---|---|---|
28 | res.cdn.office.net |
outlook.office.com
res.cdn.office.net |
11 | aadcdn.msftauth.net |
login.microsoftonline.com
aadcdn.msftauth.net |
5 | outlook.office.com |
2 redirects
forenqqry65.sbs
res.cdn.office.net |
3 | login.microsoftonline.com |
res.cdn.office.net
aadcdn.msauth.net |
1 | outlook.office365.com |
aadcdn.msftauth.net
|
1 | login.live.com |
login.microsoftonline.com
|
1 | aadcdn.msauth.net |
login.microsoftonline.com
|
1 | eu-office.events.data.microsoft.com |
res.cdn.office.net
|
1 | csp.microsoft.com |
res.cdn.office.net
|
1 | forenqqry65.sbs | |
53 | 10 |
This site contains links to these domains. Also see Links.
Domain |
---|
outlook.office.com |
www.microsoft.com |
privacy.microsoft.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
forenqqry65.sbs Sectigo RSA Domain Validation Secure Server CA |
2024-03-30 - 2025-03-30 |
a year | crt.sh |
outlook.com DigiCert Cloud Services CA-1 |
2024-01-22 - 2025-01-21 |
a year | crt.sh |
*.res.outlook.com DigiCert SHA2 Secure Server CA |
2024-02-20 - 2025-02-20 |
a year | crt.sh |
csp.microsoft.com GeoTrust Global TLS RSA4096 SHA256 2022 CA1 |
2024-03-27 - 2024-09-27 |
6 months | crt.sh |
stamp2.login.microsoftonline.com DigiCert SHA2 Secure Server CA |
2024-03-07 - 2025-03-07 |
a year | crt.sh |
*.events.data.microsoft.com Microsoft Azure RSA TLS Issuing CA 04 |
2023-12-31 - 2024-12-25 |
a year | crt.sh |
aadcdn.msauth.net DigiCert SHA2 Secure Server CA |
2024-01-29 - 2025-01-29 |
a year | crt.sh |
aadcdn.msftauth.net DigiCert SHA2 Secure Server CA |
2023-12-01 - 2024-12-01 |
a year | crt.sh |
login.live.com DigiCert SHA2 Secure Server CA |
2024-02-13 - 2025-02-13 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=44e25fb2-3062-e140-f6dd-f69c9214b65f&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638474490755562479.4ee8c861-834f-4771-8c54-82f3370312af&state=DYuxDoIwFACL_osbUtrXvnYgDhrDgAuaaNjaUhKIBFMajH9vh7vcchkhZJ_YJTKaRFByBQigKQohJAPUR_BeOSXLXHEYckBM5QTkig2cI-UlM0OW3kuxfE1xWqOJvioPwfdj8C4-lsrULXX1TTY_vfWvdrVMh2bWcze_p-4uJsvoZp_Xjz2rPw&sso_reload=true
Frame ID: E40C83A9071F088FD876880E91D5994C
Requests: 52 HTTP requests in this frame
Frame:
https://outlook.office365.com/owa/prefetch.aspx
Frame ID: 6CB940F175EDD20F49E766DB907DF5E7
Requests: 1 HTTP requests in this frame
Screenshot
![](/screenshots/b6e06721-ecfc-4e4b-8ded-6807e0780385.png)
Page Title
Accedi a OutlookPage URL History Show full URLs
- https://forenqqry65.sbs/custom/ Page URL
- https://outlook.office.com/mail/ Page URL
-
https://outlook.office.com/mail/?authRedirect=true&state=0
HTTP 302
https://outlook.office.com/owa/?state=1&redirectTo=aHR0cHM6Ly9vdXRsb29rLm9mZmljZS5jb20vbWFpbC8 HTTP 302
https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redir... Page URL
- https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redir... Page URL
Page Statistics
4 Outgoing links
These are links going to different origins than the main page.
Title: fare clic qui per crearne uno.
Search URL Search Domain Scan URL
Title: Condizioni per l'utilizzo
Search URL Search Domain Scan URL
Title: Privacy e cookie
Search URL Search Domain Scan URL
Title: AccessibilitÃ
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://forenqqry65.sbs/custom/ Page URL
- https://outlook.office.com/mail/ Page URL
-
https://outlook.office.com/mail/?authRedirect=true&state=0
HTTP 302
https://outlook.office.com/owa/?state=1&redirectTo=aHR0cHM6Ly9vdXRsb29rLm9mZmljZS5jb20vbWFpbC8 HTTP 302
https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=44e25fb2-3062-e140-f6dd-f69c9214b65f&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638474490755562479.4ee8c861-834f-4771-8c54-82f3370312af&state=DYuxDoIwFACL_osbUtrXvnYgDhrDgAuaaNjaUhKIBFMajH9vh7vcchkhZJ_YJTKaRFByBQigKQohJAPUR_BeOSXLXHEYckBM5QTkig2cI-UlM0OW3kuxfE1xWqOJvioPwfdj8C4-lsrULXX1TTY_vfWvdrVMh2bWcze_p-4uJsvoZp_Xjz2rPw Page URL
- https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=44e25fb2-3062-e140-f6dd-f69c9214b65f&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638474490755562479.4ee8c861-834f-4771-8c54-82f3370312af&state=DYuxDoIwFACL_osbUtrXvnYgDhrDgAuaaNjaUhKIBFMajH9vh7vcchkhZJ_YJTKaRFByBQigKQohJAPUR_BeOSXLXHEYckBM5QTkig2cI-UlM0OW3kuxfE1xWqOJvioPwfdj8C4-lsrULXX1TTY_vfWvdrVMh2bWcze_p-4uJsvoZp_Xjz2rPw&sso_reload=true Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 34- https://outlook.office.com/mail/?authRedirect=true&state=0 HTTP 302
- https://outlook.office.com/owa/?state=1&redirectTo=aHR0cHM6Ly9vdXRsb29rLm9mZmljZS5jb20vbWFpbC8 HTTP 302
- https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=44e25fb2-3062-e140-f6dd-f69c9214b65f&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638474490755562479.4ee8c861-834f-4771-8c54-82f3370312af&state=DYuxDoIwFACL_osbUtrXvnYgDhrDgAuaaNjaUhKIBFMajH9vh7vcchkhZJ_YJTKaRFByBQigKQohJAPUR_BeOSXLXHEYckBM5QTkig2cI-UlM0OW3kuxfE1xWqOJvioPwfdj8C4-lsrULXX1TTY_vfWvdrVMh2bWcze_p-4uJsvoZp_Xjz2rPw
53 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
/
forenqqry65.sbs/custom/ |
75 B 371 B |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
outlook.office.com/mail/ |
13 KB 9 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
owa.mail.runtime.382fa557.js
res.cdn.office.net/owamail/hashed-v1/scripts/ |
496 KB 283 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
owa.mailindex.bfaf3d44.js
res.cdn.office.net/owamail/hashed-v1/scripts/ |
265 KB 87 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
owa.484176.m.23bd8f14.js
res.cdn.office.net/owamail/hashed-v1/scripts/ |
2 MB 515 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
owa.AppBoot.m.e879baad.css
res.cdn.office.net/owamail/hashed-v1/scripts/ |
15 KB 4 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
owa.AppBoot.m.5a0c159b.js
res.cdn.office.net/owamail/hashed-v1/scripts/ |
665 KB 187 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
owa.542398.m.a04a2706.js
res.cdn.office.net/owamail/hashed-v1/scripts/ |
9 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
owa.566286.m.062cd011.js
res.cdn.office.net/owamail/hashed-v1/scripts/ |
673 B 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
owa.792146.m.ad26554a.js
res.cdn.office.net/owamail/hashed-v1/scripts/ |
29 KB 9 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
owa.501998.m.0b95ddfd.js
res.cdn.office.net/owamail/hashed-v1/scripts/ |
12 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
owa.307897.m.e4c39640.js
res.cdn.office.net/owamail/hashed-v1/scripts/ |
10 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
owa.407663.m.6b784653.js
res.cdn.office.net/owamail/hashed-v1/scripts/ |
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
owa.896847.m.01a57e03.js
res.cdn.office.net/owamail/hashed-v1/scripts/ |
26 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
owa.741001.m.70f891fb.js
res.cdn.office.net/owamail/hashed-v1/scripts/ |
8 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
owa.209952.m.b9a756c8.js
res.cdn.office.net/owamail/hashed-v1/scripts/ |
10 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
owa.6014.m.36a6ba65.js
res.cdn.office.net/owamail/hashed-v1/scripts/ |
13 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
owa.112988.m.3a4b3c95.js
res.cdn.office.net/owamail/hashed-v1/scripts/ |
21 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
owa.344475.m.93bd512f.js
res.cdn.office.net/owamail/hashed-v1/scripts/ |
11 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
owa.981965.m.db2af890.js
res.cdn.office.net/owamail/hashed-v1/scripts/ |
18 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
owa.588883.m.52970779.js
res.cdn.office.net/owamail/hashed-v1/scripts/ |
5 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
owa.613508.m.95bc5090.js
res.cdn.office.net/owamail/hashed-v1/scripts/ |
9 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
owa.79959.m.737c1fd9.js
res.cdn.office.net/owamail/hashed-v1/scripts/ |
18 KB 8 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
owa.933145.m.d717923d.js
res.cdn.office.net/owamail/hashed-v1/scripts/ |
13 KB 5 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
owa.917329.m.44479c42.js
res.cdn.office.net/owamail/hashed-v1/scripts/ |
9 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
owa.734935.m.b511b174.js
res.cdn.office.net/owamail/hashed-v1/scripts/ |
9 KB 4 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
owa.MailBoot.m.0d184825.css
res.cdn.office.net/owamail/hashed-v1/scripts/ |
93 KB 16 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
owa.MailBoot.m.e3f64afa.js
res.cdn.office.net/owamail/hashed-v1/scripts/ |
1 MB 345 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
microsoft.svg
res.cdn.office.net/assets/framework/ |
3 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST |
OutlookWeb-Mail-PROD
csp.microsoft.com/report/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
startupdata.ashx
outlook.office.com/owa/ |
0 1 KB |
Fetch
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
boot-analytics-ping.js
res.cdn.office.net/owamail/20240315003.19/resources/ |
34 B 878 B |
Fetch
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
OutlookWeb-Mail-PROD
csp.microsoft.com/report/ |
2 B 224 B |
Other
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET BLOB |
9047c727-3b75-49ea-ad14-52d3e560c633
https://outlook.office.com/ |
647 B 0 |
Other
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
authorize
login.microsoftonline.com/common/oauth2/ Redirect Chain
|
20 KB 10 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
/
eu-office.events.data.microsoft.com/OneCollector/1.0/ |
0 584 B |
Ping
text/plain |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
favicon.ico
outlook.office.com/mail/ |
8 KB 8 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
BssoInterrupt_Core_3b4rnVNi70Sso4_c42_ImQ2.js
aadcdn.msauth.net/shared/1.0/content/js/ |
138 KB 49 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
reportbssotelemetry
login.microsoftonline.com/common/instrumentation/ |
265 B 1 KB |
Ping
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
authorize
login.microsoftonline.com/common/oauth2/ |
38 KB 17 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ |
110 KB 20 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ConvergedLogin_PCore_QMJbZSc_Phofl-lfd63BLw2.js
aadcdn.msftauth.net/shared/1.0/content/js/ |
433 KB 118 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ux.converged.login.strings-it.min_xvxwiankgjkmygba5lwbfq2.js
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ |
58 KB 17 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Me.htm
login.live.com/ |
0 0 |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
convergedlogin_pcustomizationloader_7f0a8c2a247460fad87f.js
aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/ |
219 KB 54 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
prefetch.aspx
outlook.office365.com/owa/ Frame 6CB9 |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
49-small_2055002f2daae2ed8f69f03944c0e5d9.jpg
aadcdn.msftauth.net/shared/1.0/content/images/appbackgrounds/ |
987 B 1 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
49_6ffe0a92d779c878835b40171ffc2e13.jpg
aadcdn.msftauth.net/shared/1.0/content/images/appbackgrounds/ |
17 KB 17 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
53_7a3c80bf9694448bac31a9589d2e9e92.png
aadcdn.msftauth.net/shared/1.0/content/images/applogos/ |
5 KB 5 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg
aadcdn.msftauth.net/shared/1.0/content/images/ |
4 KB 2 KB |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
convergedlogin_pstringcustomizationhelper_eb638da25d4055fbbb57.js
aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/ |
111 KB 35 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
favicon_a_eupayfgghqiai7k9sol6lg2.ico
aadcdn.msftauth.net/shared/1.0/content/images/ |
17 KB 17 KB |
Other
image/x-icon |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg
aadcdn.msftauth.net/shared/1.0/content/images/ |
2 KB 772 B |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- csp.microsoft.com
- URL
- https://csp.microsoft.com/report/OutlookWeb-Mail-PROD
Verdicts & Comments Add Verdict or Comment
22 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| onpagereveal object| $Config object| $Debug object| $Do function| $Loader object| $WebWatson function| GetString function| GetErrorString function| GetUrl object| $B object| ServerData object| webpackJsonp object| ko object| PROOF object| StringRepository object| Telemetry object| telemetry_webpackJsonp boolean| __ConvergedLogin_PCore boolean| __ boolean| __convergedlogin_pcustomizationloader_7f0a8c2a247460fad87f boolean| __convergedlogin_pstringcustomizationhelper_eb638da25d4055fbbb5721 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
forenqqry65.sbs/ | Name: PHPSESSID Value: gfpiohmhjqm5o4hptkc9885qao |
|
outlook.office.com/ | Name: ClientId Value: 827948442617437AB47C669FECD4D39F |
|
outlook.office.com/ | Name: OIDC Value: 1 |
|
outlook.office.com/ | Name: OpenIdConnect.nonce.v3.QPWMNX-bEMCLtE1iRmvf10G_m67tRiR-yGYnIWCd42o Value: 638474490755562479.4ee8c861-834f-4771-8c54-82f3370312af |
|
outlook.office.com/ | Name: X-OWA-RedirectHistory Value: ArLym14B7zuioypR3Ag |
|
.microsoft.com/ | Name: MC1 Value: GUID=049a75a2ddd14204a41c5713666c310c&HASH=049a&LV=202403&V=4&LU=1711852275653 |
|
.microsoft.com/ | Name: MS0 Value: 2229fe75f5684e6190068def1ced7099 |
|
.login.microsoftonline.com/ | Name: esctx-7iXDV6eXmQk Value: AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8nq21k4cLdhd1En5sM3MdTLaIbwk7racbi7OxMDQeSZDzpIx2-FRzcQqnsOG8GSmCVpZnHSFeZw3nDrH8PfJ2ddxATnY5zCN-tsA2fRWoZ6uN7Dl8I6InCgPZOS06W5Ce0XJh3sFBhJsfHvGV1X5zRiAA |
|
login.microsoftonline.com/ | Name: x-ms-gateway-slice Value: estsfd |
|
login.microsoftonline.com/ | Name: stsservicecookie Value: estsfd |
|
.login.microsoftonline.com/ | Name: AADSSO Value: NA|NoExtension |
|
login.microsoftonline.com/ | Name: SSOCOOKIEPULLED Value: 1 |
|
login.microsoftonline.com/ | Name: buid Value: 0.AXMAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8A_5CYLo4p8NRgf4jJW9TlYQPCoEeONZWSGiq5GHTUdKVT6S_Htnf4P0QgLSOIGWl3Vdrr_LJ90wr4osijM6c9vBivWeU3zAzPI5y-PhOwR8gAA |
|
.login.microsoftonline.com/ | Name: esctx Value: PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8XALMMmEhYbWMHyRVSS1-RcyvRYL_3nI1ypr0V-q4UQe39xAwzVuYgR3nFD4wGrJ5F983r_rlOtQgtE_mhjjB2oQ8i5L_W4ei-rEDoWlxhhyQSZvWYxBj5BoVKDW_AEiCNsMS6JbZY2uDdHJJMPUcXDzID06fQJp_dDrX-wvw1x4gAA |
|
.login.microsoftonline.com/ | Name: esctx-lZ40kSHkPng Value: AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8UCOdfbxxqIsi-V_yr8cu4n-PL8ZiJ7bsGRoBkX6UWh8Eh7Al6MFcb0EbANE44KCIoIhj0BwZHAwmSBHvGimgYsNPXjIMGHV5tN3hqhJ2_XAUfP0ihrMfn68w0q9drWmbiO8nJe7uefdzxBqc33LkZSAA |
|
login.microsoftonline.com/ | Name: fpc Value: AjKiJWP-FspPlMe09qrmzkGerOTJAQAAAPPBmt0OAAAA |
|
.login.microsoftonline.com/ | Name: brcap Value: 0 |
|
outlook.office365.com/ | Name: ClientId Value: 64A12F4BD8D643A79F1E12F50DC45276 |
|
outlook.office365.com/ | Name: OIDC Value: 1 |
|
.login.live.com/ | Name: uaid Value: 6044640ae6404752a4b9a6168afd1beb |
|
.login.live.com/ | Name: MSPRequ Value: id=N<=1711852276&co=1 |
35 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
aadcdn.msauth.net
aadcdn.msftauth.net
csp.microsoft.com
eu-office.events.data.microsoft.com
forenqqry65.sbs
login.live.com
login.microsoftonline.com
outlook.office.com
outlook.office365.com
res.cdn.office.net
csp.microsoft.com
13.107.213.63
13.107.246.45
152.199.23.37
198.54.120.229
20.190.159.68
20.190.160.17
23.15.178.82
51.11.192.49
52.98.152.178
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
099f2112125883f69a6c8e51392263c4db10a618f6fcc1db1f6c531d587ec554
0a269651263979c9c5c7706a3d7a105ee26be7cabc915f73570c07d32489d598
0bb5e328c955db5f4c0fc71adab3185033350ab8ceb23dc4b6099b470bd1786d
1233f5c82145e80d674ff74c9ac0c67c27f7c873e440bc4286518d2506efbb14
1a45cba08818584e09d70104418aaf8b6883898b2c004bb4ace9040d3ba8d694
1a593c25442e0b30d379ee4a9c5c8772c70e097c4f92bfefe07baf8c168e79ee
1e5a2397d04981110ad9071a41e25f3c04dda800d80432a7644b0772fc53488a
2194fa4c15707a1ce59ad5502dd9bf50669ca95be2233d6499771d52a321ecac
23d210d0b316c77b085f5ce09e92293d9acdfc2dd792253abd905bfc8f2f5088
2b3eac425fcb9fc4f3ad4232dbe032278728c6cee9168fcbf6b4102e9f924e61
2d59ec9ee4c9edc32654124b3bd427113cb01e12657c6d7a20b4fd39d916a2c3
4763de920723eea396d53b09f4c94db7b103ece31a1177d8c68637b03cde54c9
4b01a0a34ce8ed4bc8a8713be0442d49da6a756236b7b4424622ca3dee820f41
5ae86b8d36d91f14bd9dac9755c7be8572ac8dd763c5244d1c5653dc99728384
663fa176d95020fc81cd5767d28879752ef3a287ab5aab4f65ae29e22364318f
690576521b9f4bf163a2813e0148d22a8c8c7b2126e8b0645114af2e0f56365d
69074bdc22e980887be06579af80f6f3098bd28d9b37f50b503a96f9469b5079
7530b843a86f3155ce07cda787a40da87052664b09c22f3d4db5e9238664dbe0
77c63a5d39e578b3595175eded73f2ccec37228d46e4f81f0d863fc0cf1b41d8
781c8f09a0e08768c3b9b86a05d77e11b41aae70dd1571edc34e614ccd171797
797bda35d13e5130fe5a14e0069c31b46ec1af6ea47f2d300309803bb4d2608c
8b34a475187302935336bf43a2bf2a4e0adb9a1e87953ea51f6fcf0ef52a4a1d
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21
93d7ffac076d72063b590b94472d4ec648dfed204d7343a0ca68bb81a1048a03
9fbf3cdd260e73445ceb5e430c57707cf33bb5a9defbbeec9073358a434544c3
ac38aaf3eeb9cedc4dd58af152a7b80b41ded2704d269759bd74737c3d1acf09
b74809eb28d4a4f584e6d56fc7c1eb0a6d57d62b5ec8bb33acf92d9021a9e058
c09df8a13cc7b80c8420d26cfc9b2e35dd545f1f2423faf575b35267e15c3523
c91fcb75665fc9c0c75010d0ac9d0fcf9923bcd6dad714d9d1ddfb3c1c9b32d8
ce33d84fc4cc083a6b912ab360d0c11c994eabcd050b4e4af2375c54122ea0e4
d8f5ab3e00202fd3b45be1acd95d677b137064001e171bc79b06826d98f1e1d3
df2e852c347ecf82f70a0c8a4b91713fbb0914d58f2cbab01316bfe646abee7c
dfc7f120c3234b7e758e407f55ad852ed3399cad1cfa0948c540e103cd5e2abf
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4e1e65871749d18aea150643c07e0aab2057da057c6c57ec1c3c43580e1c898
e79d180562997c2ad4560f4df39bd8d2772ba7c9f1abee2ea6c18e6abeb3755e
ef01d07a5ab36208f98f3a0c1da87965bb5ba7a27e777e898bc4ba97b0014878
f0515054b167145a4c6d14e33dfbe05a003954e929963fa99da453bb888890c2
f2b28e8206ab1376f76303bab348bc782004a6af506b564f1387fe3e31452433
fa1d97aefa6355e8b8e1d6fb58d3843b9dc2ca132c487fecdc15d01c5f00b762
fe825a96b0617ab14d22a4d0aff7f0fd21d6d6b71864d22f522c6bfbd3bc4e5d