urlscan.io logo urlscan.io
SecurityTrails logo

mqscrp.retailconstructionadvisor.com Open in urlscan Pro
172.67.177.82  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://mailing.birdeye.com/ls/click?upn=u001.aakefH-2Bl0f3i6bWqZ94RwLy-2ByEVUcqDwS2pwLBSyZTk-3D0k49_O7bc24Ttbwixq2NySqPEoeQ...
Effective URL: https://mqscrp.retailconstructionadvisor.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%...
Submission: On April 04 via manual from AU — Scanned from AU
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 24 HTTP transactions. The main IP is 172.67.177.82, located in United States and belongs to CLOUDFLARENET, US. The main domain is mqscrp.retailconstructionadvisor.com.
TLS certificate: Issued by GTS CA 1P5 on April 2nd 2024. Valid for: 3 months.
This is the only time mqscrp.retailconstructionadvisor.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 1 50.18.123.174 16509 (AMAZON-02)
1 1 67.199.248.11 396982 (GOOGLE-CL...)
2 19 172.67.177.82 13335 (CLOUDFLAR...)
7 23.55.242.177 20940 (AKAMAI-ASN1)
24 3
1    50.18.123.174 (San Jose, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-50-18-123-174.us-west-1.compute.amazonaws.com
mailing.birdeye.com
1    67.199.248.11 (United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: bit.ly
bit.ly
19    172.67.177.82 (United States)

ASN13335 (CLOUDFLARENET, US)
meheff.retailconstructionadvisor.com
mejeff.retailconstructionadvisor.com
mqscrp.retailconstructionadvisor.com
ktejre.retailconstructionadvisor.com
krvetbr.retailconstructionadvisor.com
jrhte.retailconstructionadvisor.com
7    23.55.242.177 (Sydney, Australia)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-55-242-177.deploy.static.akamaitechnologies.com
r4.res.office365.com
Domain Requested by
11 jrhte.retailconstructionadvisor.com mqscrp.retailconstructionadvisor.com
jrhte.retailconstructionadvisor.com
7 r4.res.office365.com mejeff.retailconstructionadvisor.com
3 mqscrp.retailconstructionadvisor.com ktejre.retailconstructionadvisor.com
2 mejeff.retailconstructionadvisor.com 1 redirects jrhte.retailconstructionadvisor.com
1 krvetbr.retailconstructionadvisor.com mqscrp.retailconstructionadvisor.com
1 ktejre.retailconstructionadvisor.com mqscrp.retailconstructionadvisor.com
1 meheff.retailconstructionadvisor.com 1 redirects
1 bit.ly 1 redirects
1 mailing.birdeye.com 1 redirects
24 9

This site contains links to these domains. Also see Links.

Domain
mejeff.retailconstructionadvisor.com
www.microsoft.com
privacy.microsoft.com
Subject Issuer Validity Valid
retailconstructionadvisor.com
GTS CA 1P5		 2024-04-02 -
2024-07-01		 3 months crt.sh
*.res.outlook.com
DigiCert SHA2 Secure Server CA		 2024-02-20 -
2025-02-20		 a year crt.sh

This page contains 2 frames:

Primary Page: https://mqscrp.retailconstructionadvisor.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=2b808b64-3a5a-61b1-3f83-e2ae962fcfb6&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638478064755779439.82429ef4-6557-4afb-9114-5158e554bb94&state=DYs7DoAwDMVSEMcJ_fDSJMdppXZl5PpksAdLTkR0BkeQSoi0Pwa10qEiqo7Hb2tovja4R2KMPdlrBUsVWyKY05HivfL7jfwD&sso_reload=true
Frame ID: 0E72F6A4AB06413302A33B982C45CE17
Requests: 16 HTTP requests in this frame

Frame: https://mejeff.retailconstructionadvisor.com/owa/prefetch.aspx
Frame ID: 3691118412E8375555C78205BEC184F6
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

.

Page URL History Show full URLs

  1. https://mailing.birdeye.com/ls/click?upn=u001.aakefH-2Bl0f3i6bWqZ94RwLy-2ByEVUcqDwS2pwLBSyZTk-3D0k49_O7b... HTTP 302
    https://bit.ly/43OUoy3 HTTP 301
    https://meheff.retailconstructionadvisor.com/o365 HTTP 302
    https://mejeff.retailconstructionadvisor.com/owa/ HTTP 302
    https://mqscrp.retailconstructionadvisor.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redir... Page URL
  2. https://mqscrp.retailconstructionadvisor.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redir... Page URL

Page Statistics

24
Requests

100 %
HTTPS

0 %
IPv6

4
Domains

9
Subdomains

3
IPs

2
Countries

1034 kB
Transfer

3986 kB
Size

19
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://mailing.birdeye.com/ls/click?upn=u001.aakefH-2Bl0f3i6bWqZ94RwLy-2ByEVUcqDwS2pwLBSyZTk-3D0k49_O7bc24Ttbwixq2NySqPEoeQyzLm-2BX5SXLKoAltqrIHbZqKgZxpHKf0GPVYt7TuzJVK6YgycUb0V5djK2-2BdhnxD0dd-2B-2FsnqSIWoOY-2Be5IGKGQOsZDc2xhcoUWjTXEVf3ZTEi4uTuBxX0udmEdDmZn2O-2Fm-2BnEusrM6QOfEyJ6P9r44ejLcuGSWtJvtPOHDZhtkrgQ-2BPxbjJ6zdUmOT7fVmG1MKAx-2BPMIfgoI6Xdp0ovGD1l1sE2sDvosyuGBb3Bui1dEUP92kVIPPcCGSWHpootV3vcLkQ6axUV2Z6gzRHm-2F09ojMj0M8z8lssGasRFpRkOdqWb106FX17hIkfJvILwZvy3MkRlG6csxFsBye0lFuZotsa172E2WKc65JEH7Qc2hwJkYzd9XweBoN64wOpnE6dI-2B6B2nW53XP1KUJ-2Bi24cUbWlgVabiAg6b782eJwD-2BJ392FI4cm9QlF4DJnF7VIJ72JgoUuHYB9Ly-2BxErE6TG7bJ8CV8bbE3rpZnxUwFA-2BK015JzM8k-2BxwmaPFXJN0vjQHOUKdokD94Gi4lIXfJpCjKkfwRCu0-2BUW-2FbJtW4PO1wahYB-2BhUFiZKNnyRfRrhvjB7FyPh0gt5FO4dkxhGnM-3D HTTP 302
    https://bit.ly/43OUoy3 HTTP 301
    https://meheff.retailconstructionadvisor.com/o365 HTTP 302
    https://mejeff.retailconstructionadvisor.com/owa/ HTTP 302
    https://mqscrp.retailconstructionadvisor.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=2b808b64-3a5a-61b1-3f83-e2ae962fcfb6&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638478064755779439.82429ef4-6557-4afb-9114-5158e554bb94&state=DYs7DoAwDMVSEMcJ_fDSJMdppXZl5PpksAdLTkR0BkeQSoi0Pwa10qEiqo7Hb2tovja4R2KMPdlrBUsVWyKY05HivfL7jfwD Page URL
  2. https://mqscrp.retailconstructionadvisor.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=2b808b64-3a5a-61b1-3f83-e2ae962fcfb6&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638478064755779439.82429ef4-6557-4afb-9114-5158e554bb94&state=DYs7DoAwDMVSEMcJ_fDSJMdppXZl5PpksAdLTkR0BkeQSoi0Pwa10qEiqo7Hb2tovja4R2KMPdlrBUsVWyKY05HivfL7jfwD&sso_reload=true Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://mailing.birdeye.com/ls/click?upn=u001.aakefH-2Bl0f3i6bWqZ94RwLy-2ByEVUcqDwS2pwLBSyZTk-3D0k49_O7bc24Ttbwixq2NySqPEoeQyzLm-2BX5SXLKoAltqrIHbZqKgZxpHKf0GPVYt7TuzJVK6YgycUb0V5djK2-2BdhnxD0dd-2B-2FsnqSIWoOY-2Be5IGKGQOsZDc2xhcoUWjTXEVf3ZTEi4uTuBxX0udmEdDmZn2O-2Fm-2BnEusrM6QOfEyJ6P9r44ejLcuGSWtJvtPOHDZhtkrgQ-2BPxbjJ6zdUmOT7fVmG1MKAx-2BPMIfgoI6Xdp0ovGD1l1sE2sDvosyuGBb3Bui1dEUP92kVIPPcCGSWHpootV3vcLkQ6axUV2Z6gzRHm-2F09ojMj0M8z8lssGasRFpRkOdqWb106FX17hIkfJvILwZvy3MkRlG6csxFsBye0lFuZotsa172E2WKc65JEH7Qc2hwJkYzd9XweBoN64wOpnE6dI-2B6B2nW53XP1KUJ-2Bi24cUbWlgVabiAg6b782eJwD-2BJ392FI4cm9QlF4DJnF7VIJ72JgoUuHYB9Ly-2BxErE6TG7bJ8CV8bbE3rpZnxUwFA-2BK015JzM8k-2BxwmaPFXJN0vjQHOUKdokD94Gi4lIXfJpCjKkfwRCu0-2BUW-2FbJtW4PO1wahYB-2BhUFiZKNnyRfRrhvjB7FyPh0gt5FO4dkxhGnM-3D HTTP 302
  • https://bit.ly/43OUoy3 HTTP 301
  • https://meheff.retailconstructionadvisor.com/o365 HTTP 302
  • https://mejeff.retailconstructionadvisor.com/owa/ HTTP 302
  • https://mqscrp.retailconstructionadvisor.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=2b808b64-3a5a-61b1-3f83-e2ae962fcfb6&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638478064755779439.82429ef4-6557-4afb-9114-5158e554bb94&state=DYs7DoAwDMVSEMcJ_fDSJMdppXZl5PpksAdLTkR0BkeQSoi0Pwa10qEiqo7Hb2tovja4R2KMPdlrBUsVWyKY05HivfL7jfwD

24 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
authorize
mqscrp.retailconstructionadvisor.com/common/oauth2/
Redirect Chain
  • https://mailing.birdeye.com/ls/click?upn=u001.aakefH-2Bl0f3i6bWqZ94RwLy-2ByEVUcqDwS2pwLBSyZTk-3D0k49_O7bc24Ttbwixq2NySqPEoeQyzLm-2BX5SXLKoAltqrIHbZqKgZxpHKf0GPVYt7TuzJVK6YgycUb0V5djK2-2BdhnxD0dd-2B...
  • https://bit.ly/43OUoy3
  • https://meheff.retailconstructionadvisor.com/o365
  • https://mejeff.retailconstructionadvisor.com/owa/
  • https://mqscrp.retailconstructionadvisor.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-...
21 KB
10 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://mqscrp.retailconstructionadvisor.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=2b808b64-3a5a-61b1-3f83-e2ae962fcfb6&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638478064755779439.82429ef4-6557-4afb-9114-5158e554bb94&state=DYs7DoAwDMVSEMcJ_fDSJMdppXZl5PpksAdLTkR0BkeQSoi0Pwa10qEiqo7Hb2tovja4R2KMPdlrBUsVWyKY05HivfL7jfwD
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.177.82 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1c11151e4bb85de513e2e04f9f80333ea7ea378e3da8c31e20edcf80c5391ebe

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language
en-AU,en;q=0.9
sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
no-store, no-cache
cf-cache-status
DYNAMIC
cf-ray
86ef01ad2c10a82f-SYD
content-encoding
br
content-type
text/html; charset=utf-8
date
Thu, 04 Apr 2024 05:47:57 GMT
expires
-1
nel
{"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
p3p
CP="DSP CUR OTPi IND OTRi ONL FIN"
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
report-to
{"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+dub2"}]}
server
cloudflare
vary
Accept-Encoding
x-ms-ests-server
2.1.17615.13 - SEC ProdSlices
x-ms-request-id
e303573a-c3c5-4321-a18e-7ddd673a9500
x-ms-srs
1.P

Redirect headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
86ef01a3f926a82f-SYD
content-type
text/html; charset=utf-8
date
Thu, 04 Apr 2024 05:47:56 GMT
location
https://mqscrp.retailconstructionadvisor.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=2b808b64-3a5a-61b1-3f83-e2ae962fcfb6&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638478064755779439.82429ef4-6557-4afb-9114-5158e554bb94&state=DYs7DoAwDMVSEMcJ_fDSJMdppXZl5PpksAdLTkR0BkeQSoi0Pwa10qEiqo7Hb2tovja4R2KMPdlrBUsVWyKY05HivfL7jfwD
nel
{"report_to":"NelOfficeUpload1","max_age":7200,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01}
p3p
CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
report-to
{"group":"NelOfficeUpload1","max_age":7200,"endpoints":[{"url":"https://exo.nel.measure.office.net/api/report?TenantId=&FrontEnd=Cafe&DestinationEndpoint=AMS&RemoteIP=2602:fa08:20::"}],"include_subdomains":true}
request-id
2b808b64-3a5a-61b1-3f83-e2ae962fcfb6
server
cloudflare
x-backend-begin
2024-04-04T05:47:55.577
x-backend-end
2024-04-04T05:47:55.577
x-backendhttpstatus
302 302
x-beserver
DB7PR05MB5542
x-besku
WCS5
x-calculatedbetarget
DB7PR05MB5542.eurprd05.prod.outlook.com
x-calculatedfetarget
DUZP191CU001.internal.outlook.com
x-diaginfo
DB7PR05MB5542
x-feefzinfo
AMS
x-feproxyinfo
AM4PR05CA0031.EURPRD05.PROD.OUTLOOK.COM
x-feserver
DUZP191CA0010 AM4PR05CA0031
x-firsthopcafeefz
AMS
x-iids
0
x-owa-diagnosticsinfo
1;0;0
x-proxy-backendserverstatus
302
x-proxy-routingcorrectness
1
x-rum-notupdatequerieddbcopy
1
x-rum-notupdatequeriedpath
1
x-rum-validated
1
x-ua-compatible
IE=EmulateIE7
BssoInterrupt_Core_HC7t4HZ_o96i0-T341lIwg2.js
ktejre.retailconstructionadvisor.com/shared/1.0/content/js/ 		138 KB
50 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ktejre.retailconstructionadvisor.com/shared/1.0/content/js/BssoInterrupt_Core_HC7t4HZ_o96i0-T341lIwg2.js
Requested by
Host: mqscrp.retailconstructionadvisor.com
URL: https://mqscrp.retailconstructionadvisor.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=2b808b64-3a5a-61b1-3f83-e2ae962fcfb6&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638478064755779439.82429ef4-6557-4afb-9114-5158e554bb94&state=DYs7DoAwDMVSEMcJ_fDSJMdppXZl5PpksAdLTkR0BkeQSoi0Pwa10qEiqo7Hb2tovja4R2KMPdlrBUsVWyKY05HivfL7jfwD
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.177.82 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f3ef1594a12e18d5d80c69caef319427ff1e4bb60b64e433eaa9fe46de5acb3d

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://mqscrp.retailconstructionadvisor.com/
accept-language
en-AU,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 04 Apr 2024 05:47:59 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-md5
RiOUyizqnv15B1QMum/0dg==
age
22293
x-cache
HIT
alt-svc
h3=":443"; ma=86400
x-ms-lease-status
unlocked
last-modified
Sat, 02 Mar 2024 00:12:03 GMT
server
cloudflare
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NNdjI95NUoiusLvrJPiTPC0CZvkJxCbOQOLihP97b9XyaxE4csIlDLssVOr4zxbopsZtHeNLerWKy2kPCXyMBRhwOyERApLkO6pRJMNn%2FMh76ymJ6xdJ0tOQDPv3N7PpN1za2pem%2FfX1Sal9iD4zz42Vji%2FMAJ0%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
255ee369-f01e-00b0-7da4-7d2c62000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
cf-ray
86ef01becf54a82f-SYD
Primary Request authorize
mqscrp.retailconstructionadvisor.com/common/oauth2/ 		39 KB
16 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://mqscrp.retailconstructionadvisor.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=2b808b64-3a5a-61b1-3f83-e2ae962fcfb6&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638478064755779439.82429ef4-6557-4afb-9114-5158e554bb94&state=DYs7DoAwDMVSEMcJ_fDSJMdppXZl5PpksAdLTkR0BkeQSoi0Pwa10qEiqo7Hb2tovja4R2KMPdlrBUsVWyKY05HivfL7jfwD&sso_reload=true
Requested by
Host: ktejre.retailconstructionadvisor.com
URL: https://ktejre.retailconstructionadvisor.com/shared/1.0/content/js/BssoInterrupt_Core_HC7t4HZ_o96i0-T341lIwg2.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.177.82 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2537bd1f7a6738fba17e11fec33e51e988314310ed8771a801fa9b0e7d849d33

Request headers

Referer
https://mqscrp.retailconstructionadvisor.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=2b808b64-3a5a-61b1-3f83-e2ae962fcfb6&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638478064755779439.82429ef4-6557-4afb-9114-5158e554bb94&state=DYs7DoAwDMVSEMcJ_fDSJMdppXZl5PpksAdLTkR0BkeQSoi0Pwa10qEiqo7Hb2tovja4R2KMPdlrBUsVWyKY05HivfL7jfwD
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language
en-AU,en;q=0.9
sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
no-store, no-cache
cf-cache-status
DYNAMIC
cf-ray
86ef01bf1fbaa82f-SYD
content-encoding
br
content-type
text/html; charset=utf-8
date
Thu, 04 Apr 2024 05:48:00 GMT
expires
-1
link
<https://aadcdn.msauth.net>; rel=preconnect; crossorigin <https://aadcdn.msauth.net>; rel=dns-prefetch <https://aadcdn.msftauth.net>; rel=dns-prefetch
nel
{"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
p3p
CP="DSP CUR OTPi IND OTRi ONL FIN"
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
report-to
{"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+dub2"}]}
server
cloudflare
vary
Accept-Encoding
x-dns-prefetch-control
on
x-ms-ests-server
2.1.17750.6 - NEULR1 ProdSlices
x-ms-request-id
76034608-4f3b-43d7-be2c-4d15dad70300
x-ms-srs
1.P
favicon.ico
mqscrp.retailconstructionadvisor.com/ 		0
537 B 		Other
General
Check archive.org
Download Go to
Full URL
https://mqscrp.retailconstructionadvisor.com/favicon.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.177.82 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://mqscrp.retailconstructionadvisor.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=2b808b64-3a5a-61b1-3f83-e2ae962fcfb6&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638478064755779439.82429ef4-6557-4afb-9114-5158e554bb94&state=DYs7DoAwDMVSEMcJ_fDSJMdppXZl5PpksAdLTkR0BkeQSoi0Pwa10qEiqo7Hb2tovja4R2KMPdlrBUsVWyKY05HivfL7jfwD
accept-language
en-AU,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 04 Apr 2024 05:48:00 GMT
referrer-policy
strict-origin-when-cross-origin
x-ms-srs
1.P
nel
{"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
server
cloudflare
cf-cache-status
BYPASS
vary
Accept-Encoding
report-to
{"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+dub2"}]}
p3p
CP="DSP CUR OTPi IND OTRi ONL FIN"
x-ms-request-id
f2fe581c-80c4-4116-a63b-399ec3520400
cache-control
private
cf-ray
86ef01bf1fb5a82f-SYD
alt-svc
h3=":443"; ma=86400
x-ms-ests-server
2.1.17750.6 - SEC ProdSlices
Me.htm
krvetbr.retailconstructionadvisor.com/ 		0
0 		Other
General
Check archive.org
Download Go to
Full URL
https://krvetbr.retailconstructionadvisor.com/Me.htm?v=3
Requested by
Host: mqscrp.retailconstructionadvisor.com
URL: https://mqscrp.retailconstructionadvisor.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=2b808b64-3a5a-61b1-3f83-e2ae962fcfb6&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638478064755779439.82429ef4-6557-4afb-9114-5158e554bb94&state=DYs7DoAwDMVSEMcJ_fDSJMdppXZl5PpksAdLTkR0BkeQSoi0Pwa10qEiqo7Hb2tovja4R2KMPdlrBUsVWyKY05HivfL7jfwD&sso_reload=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.177.82 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://mqscrp.retailconstructionadvisor.com/
accept-language
en-AU,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers
converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css
jrhte.retailconstructionadvisor.com/ests/2.1/content/cdnbundles/ 		110 KB
20 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://jrhte.retailconstructionadvisor.com/ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css
Requested by
Host: mqscrp.retailconstructionadvisor.com
URL: https://mqscrp.retailconstructionadvisor.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=2b808b64-3a5a-61b1-3f83-e2ae962fcfb6&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638478064755779439.82429ef4-6557-4afb-9114-5158e554bb94&state=DYs7DoAwDMVSEMcJ_fDSJMdppXZl5PpksAdLTkR0BkeQSoi0Pwa10qEiqo7Hb2tovja4R2KMPdlrBUsVWyKY05HivfL7jfwD&sso_reload=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.177.82 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4b01a0a34ce8ed4bc8a8713be0442d49da6a756236b7b4424622ca3dee820f41

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://mqscrp.retailconstructionadvisor.com/
accept-language
en-AU,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 04 Apr 2024 05:48:00 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
22291
x-cache
TCP_HIT
x-fd-int-roxy-purgeid
4554691
alt-svc
h3=":443"; ma=86400
x-ms-lease-status
unlocked
last-modified
Wed, 27 Dec 2023 18:18:12 GMT
server
cloudflare
x-azure-ref
20240403T233629Z-nkpv23qxkd4f93nsuwr9e3htxg0000000ad000000000w4pe
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PjNSLnFrw3EO9%2F%2FJkZLaxdqRyYmIuZ2LV1qdLMg%2FGzFZWJJJdzV4OBYk3cSwhcVy1wgBex968jGus8T9C5TWzfD7OHhiQKZ%2B%2FPEDXVa0gqQN3e7N4vQ569mdaoALMwdWzEzQz4EJ%2BvbozsJNvhV4U4ov08J93g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
43d55263-401e-000a-66ae-80eb8b000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
vary
Accept-Encoding
cf-ray
86ef01c8de396a6f-SYD
ConvergedLogin_PCore_xtPRDEy3EhlAdpju-Ah7qw2.js
jrhte.retailconstructionadvisor.com/shared/1.0/content/js/ 		434 KB
114 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://jrhte.retailconstructionadvisor.com/shared/1.0/content/js/ConvergedLogin_PCore_xtPRDEy3EhlAdpju-Ah7qw2.js
Requested by
Host: mqscrp.retailconstructionadvisor.com
URL: https://mqscrp.retailconstructionadvisor.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=2b808b64-3a5a-61b1-3f83-e2ae962fcfb6&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638478064755779439.82429ef4-6557-4afb-9114-5158e554bb94&state=DYs7DoAwDMVSEMcJ_fDSJMdppXZl5PpksAdLTkR0BkeQSoi0Pwa10qEiqo7Hb2tovja4R2KMPdlrBUsVWyKY05HivfL7jfwD&sso_reload=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.177.82 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2442d75ea0aee91158db7ad41e46527fe94a961c1f0f62d7f503f526adb029b7

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://mqscrp.retailconstructionadvisor.com/
accept-language
en-AU,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 04 Apr 2024 05:48:00 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
22280
x-cache
TCP_HIT
x-fd-int-roxy-purgeid
4554691
alt-svc
h3=":443"; ma=86400
x-ms-lease-status
unlocked
last-modified
Sat, 16 Mar 2024 03:21:38 GMT
server
cloudflare
x-azure-ref
20240403T233640Z-hy383wrnht49b283k01gn804780000000nz0000000002se2
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kTgxnirENxxmm5dyTNerachQOsTs3rci89h28cSNrx2fAIylnAE6NyYONVpzMb1wPheUmZnlxlScH%2FpQEe%2BED1M7R%2FWR%2FVoJY9GlUA1hrYWFTgDIo35FRRo9ojXlLF%2Bm93%2BZOEWYmxrSu3hBi316MYl0P3EaCA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
d6fcb2ad-d01e-005f-572a-820fb2000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
vary
Accept-Encoding
cf-ray
86ef01c8de3b6a6f-SYD
ux.converged.login.strings-en.min_pxjdzrjcwtmbr-ntjn_f8q2.js
jrhte.retailconstructionadvisor.com/ests/2.1/content/cdnbundles/ 		54 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://jrhte.retailconstructionadvisor.com/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_pxjdzrjcwtmbr-ntjn_f8q2.js
Requested by
Host: mqscrp.retailconstructionadvisor.com
URL: https://mqscrp.retailconstructionadvisor.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=2b808b64-3a5a-61b1-3f83-e2ae962fcfb6&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638478064755779439.82429ef4-6557-4afb-9114-5158e554bb94&state=DYs7DoAwDMVSEMcJ_fDSJMdppXZl5PpksAdLTkR0BkeQSoi0Pwa10qEiqo7Hb2tovja4R2KMPdlrBUsVWyKY05HivfL7jfwD&sso_reload=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.177.82 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
33cea1c907e3d621eafe2bd781df9eee3a2a96e7ce8375b01e103d0533db8c09

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://mqscrp.retailconstructionadvisor.com/
accept-language
en-AU,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 04 Apr 2024 05:48:00 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
22280
x-cache
TCP_HIT
x-fd-int-roxy-purgeid
4554691
alt-svc
h3=":443"; ma=86400
x-ms-lease-status
unlocked
last-modified
Fri, 15 Mar 2024 21:03:36 GMT
server
cloudflare
x-azure-ref
20240403T233640Z-g257vtdq2t3pxbsu7qcf1vbvps0000000p6g000000001kxd
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HDsn2jlG1iuzGEGwVa66YjfqRXK0Mfvk6oLYcgqFhD1Xn0V7BgAaAPpL8Oz%2BVGBXFHTT8vDkTnCOA%2BFdP5KXbDmxfpE6W%2BO1zM1wWalKZyQhfiaFHhLKImyO7eoD7b2tJlOgBDEXMaBI8UEY%2FhmfsAJVQW5%2FOQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
bee36289-101e-0017-602a-8284b2000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
vary
Accept-Encoding
cf-ray
86ef01c8de3c6a6f-SYD
convergedlogin_pcustomizationloader_7f0a8c2a247460fad87f.js
jrhte.retailconstructionadvisor.com/shared/1.0/content/js/asyncchunk/ 		219 KB
51 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://jrhte.retailconstructionadvisor.com/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_7f0a8c2a247460fad87f.js
Requested by
Host: jrhte.retailconstructionadvisor.com
URL: https://jrhte.retailconstructionadvisor.com/shared/1.0/content/js/ConvergedLogin_PCore_xtPRDEy3EhlAdpju-Ah7qw2.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.67.177.82 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
df2e852c347ecf82f70a0c8a4b91713fbb0914d58f2cbab01316bfe646abee7c

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://mqscrp.retailconstructionadvisor.com/
accept-language
en-AU,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 04 Apr 2024 05:48:00 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
22289
x-cache
TCP_HIT
x-fd-int-roxy-purgeid
4554691
alt-svc
h3=":443"; ma=86400
x-ms-lease-status
unlocked
last-modified
Thu, 15 Feb 2024 19:13:15 GMT
server
cloudflare
x-azure-ref
20240403T233631Z-qee8tyvaw90mt79dxbpa2q0w6w0000000geg000000004aw3
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=CKRkQzItyB79tLHJh6mGvJpCBiQ%2BQTU%2BlcF02Me1oFIajNUw2giiuJsafa%2FjH%2BUWP%2Bpw3390n80fbQ02gE4Q%2B%2BdGAMafGyILRn8Nk12bWSSQnqBh7vYpErgaGxAnQ6PziG6pAEV%2FULRquSWjhrKouEA8CgPzCg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
31311cf1-601e-0024-2c5c-7cd8a5000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
vary
Accept-Encoding
cf-ray
86ef01c94ea16a6f-SYD
prefetch.aspx
mejeff.retailconstructionadvisor.com/owa/ Frame 3691 		3 KB
2 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://mejeff.retailconstructionadvisor.com/owa/prefetch.aspx
Requested by
Host: jrhte.retailconstructionadvisor.com
URL: https://jrhte.retailconstructionadvisor.com/shared/1.0/content/js/ConvergedLogin_PCore_xtPRDEy3EhlAdpju-Ah7qw2.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.177.82 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4bf693e314b77c74e8bf76ee60d067f08abbef5d92c66d350a8300568991d70e

Request headers

Referer
https://mqscrp.retailconstructionadvisor.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
accept-language
en-AU,en;q=0.9
sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

alt-svc
h3=":443"; ma=86400
cache-control
private, no-store
cf-cache-status
DYNAMIC
cf-ray
86ef01c96ae6a82f-SYD
content-encoding
br
content-type
text/html; charset=utf-8
date
Thu, 04 Apr 2024 05:48:02 GMT
nel
{"report_to":"NelOfficeUpload1","max_age":7200,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01}
report-to
{"group":"NelOfficeUpload1","max_age":7200,"endpoints":[{"url":"https://exo.nel.measure.office.net/api/report?TenantId=&FrontEnd=Cafe&DestinationEndpoint=AMS&RemoteIP=2602:fa08:20::"}],"include_subdomains":true}
request-id
82ea7884-7815-9225-fc9f-c35e522787a3
server
cloudflare
vary
Accept-Encoding
x-backend-begin
2024-04-04T05:48:01.921
x-backend-end
2024-04-04T05:48:01.921
x-backendhttpstatus
200 200
x-beserver
AS2PR05MB10442
x-besku
WCS7
x-calculatedbetarget
AS2PR05MB10442.eurprd05.prod.outlook.com
x-calculatedfetarget
AM6P195CU002.internal.outlook.com
x-diaginfo
AS2PR05MB10442
x-feefzinfo
AMS
x-feproxyinfo
AM4PR05CA0031.EURPRD05.PROD.OUTLOOK.COM
x-feserver
AM6P195CA0054 AM4PR05CA0031
x-firsthopcafeefz
AMS
x-iids
0
x-owa-diagnosticsinfo
1;0;0
x-owa-version
15.20.7409.46
x-proxy-backendserverstatus
200
x-proxy-routingcorrectness
1
x-rum-notupdatequerieddbcopy
1
x-rum-notupdatequeriedpath
1
x-rum-validated
1
x-ua-compatible
IE=EmulateIE7
49-small_2055002f2daae2ed8f69f03944c0e5d9.jpg
jrhte.retailconstructionadvisor.com/shared/1.0/content/images/appbackgrounds/ 		987 B
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://jrhte.retailconstructionadvisor.com/shared/1.0/content/images/appbackgrounds/49-small_2055002f2daae2ed8f69f03944c0e5d9.jpg
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.177.82 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8b34a475187302935336bf43a2bf2a4e0adb9a1e87953ea51f6fcf0ef52a4a1d

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://mqscrp.retailconstructionadvisor.com/
accept-language
en-AU,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 04 Apr 2024 05:48:00 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
22284
x-cache
TCP_HIT
x-fd-int-roxy-purgeid
4554691
alt-svc
h3=":443"; ma=86400
x-ms-lease-status
unlocked
last-modified
Wed, 24 May 2023 10:11:42 GMT
server
cloudflare
etag
0x8DB5C3F457E15E1
x-azure-ref
20240403T233636Z-hy383wrnht49b283k01gn804780000000nz0000000002sbr
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nm0EMR0ODU%2F8%2FSzA8cm4C1nMdoewoHrfyEhgyNLpYixqJxQnrCfBG5kNtDXfZco8ueOgMIf7pyEswAN8dIRr1zhFXKVaThWQ%2F93UkyjFoE2FUqseLBnihx3AH%2BBjFaq9jBAU0rTw8sdhRUW%2B7XG%2BQK%2B5kGYjCQ%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
access-control-allow-origin
*
x-ms-request-id
11e5bfb2-f01e-0009-5e19-7d968d000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
vary
Accept-Encoding
cf-ray
86ef01c9ae40a88f-SYD
49_6ffe0a92d779c878835b40171ffc2e13.jpg
jrhte.retailconstructionadvisor.com/shared/1.0/content/images/appbackgrounds/ 		17 KB
18 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://jrhte.retailconstructionadvisor.com/shared/1.0/content/images/appbackgrounds/49_6ffe0a92d779c878835b40171ffc2e13.jpg
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.177.82 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d8f5ab3e00202fd3b45be1acd95d677b137064001e171bc79b06826d98f1e1d3

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://mqscrp.retailconstructionadvisor.com/
accept-language
en-AU,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 04 Apr 2024 05:48:00 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
22284
x-cache
TCP_HIT
x-fd-int-roxy-purgeid
4554691
alt-svc
h3=":443"; ma=86400
x-ms-lease-status
unlocked
last-modified
Wed, 24 May 2023 10:11:42 GMT
server
cloudflare
etag
0x8DB5C3F4584F323
x-azure-ref
20240403T233636Z-g257vtdq2t3pxbsu7qcf1vbvps0000000p6g000000001kuu
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ozAJYRWyR4rN9iq%2F%2BRjvGnEUp5Z%2FymAD%2BY%2BrrlygNSwlWG86XbihjCIbDvBJPwXO5SIGtebQYSm675CsvF8CC%2Fyy29egOr5Z%2BnivSvG1XuNoT0CV4b9Qq6alU5yYsNNHg3mIT3ClFH9bTmwadSZvZcaBqKL4XA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
access-control-allow-origin
*
x-ms-request-id
81c14d0f-601e-0018-7c8a-800dad000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
vary
Accept-Encoding
cf-ray
86ef01c9be41a88f-SYD
53_7a3c80bf9694448bac31a9589d2e9e92.png
jrhte.retailconstructionadvisor.com/shared/1.0/content/images/applogos/ 		5 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://jrhte.retailconstructionadvisor.com/shared/1.0/content/images/applogos/53_7a3c80bf9694448bac31a9589d2e9e92.png
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.177.82 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e4e1e65871749d18aea150643c07e0aab2057da057c6c57ec1c3c43580e1c898

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://mqscrp.retailconstructionadvisor.com/
accept-language
en-AU,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 04 Apr 2024 05:48:00 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
22284
x-cache
TCP_HIT
x-fd-int-roxy-purgeid
4554691
alt-svc
h3=":443"; ma=86400
x-ms-lease-status
unlocked
last-modified
Wed, 24 May 2023 10:11:45 GMT
server
cloudflare
etag
0x8DB5C3F475BAFC0
x-azure-ref
20240403T233636Z-hy383wrnht49b283k01gn804780000000nz0000000002sbt
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uVt0geIlTRPTtj9pkngq9zLX44xySVariJOl3o7Y5X7vDqAbnCb4MtI5bFSDfzi4ex9IQNxufHWzx6YlRfDmrTKmMYWVf2lxV5J49BLJGhd6daDvDdjyvp2Gara9%2Bpoi4dnZqe7Emy5mhqSK11dOCvoCJdAVXg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/png
access-control-allow-origin
*
x-ms-request-id
85bfe7ad-d01e-0037-587b-801581000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
vary
Accept-Encoding
cf-ray
86ef01c9be42a88f-SYD
microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg
jrhte.retailconstructionadvisor.com/shared/1.0/content/images/ 		4 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://jrhte.retailconstructionadvisor.com/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.177.82 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://mqscrp.retailconstructionadvisor.com/
accept-language
en-AU,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 04 Apr 2024 05:48:00 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
22284
x-cache
TCP_HIT
x-fd-int-roxy-purgeid
4554691
alt-svc
h3=":443"; ma=86400
x-ms-lease-status
unlocked
last-modified
Wed, 24 May 2023 10:11:48 GMT
server
cloudflare
x-azure-ref
20240403T233636Z-g257vtdq2t3pxbsu7qcf1vbvps0000000p6g000000001kut
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=31EXC5mq%2BZd2XDzuTBggtf3o8Ik4MOYVpbUK%2FXXf%2Fg8LyT6N5xTmzga3fk6EVyH0tjEBi%2FRhwsZl%2B%2F0aR9bfOndVxU%2BUCPJWS99jImkNxvxrEi3XeG15MaoS4OTJHleOgA6uVmqGxny4zJtqdnA5ZsmftxN3Eg%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
bcecc4aa-701e-0045-7be8-81b185000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
vary
Accept-Encoding
cf-ray
86ef01c9be44a88f-SYD
convergedlogin_pstringcustomizationhelper_eb638da25d4055fbbb57.js
jrhte.retailconstructionadvisor.com/shared/1.0/content/js/asyncchunk/ 		111 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://jrhte.retailconstructionadvisor.com/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_eb638da25d4055fbbb57.js
Requested by
Host: jrhte.retailconstructionadvisor.com
URL: https://jrhte.retailconstructionadvisor.com/shared/1.0/content/js/ConvergedLogin_PCore_xtPRDEy3EhlAdpju-Ah7qw2.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.177.82 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7530b843a86f3155ce07cda787a40da87052664b09c22f3d4db5e9238664dbe0

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://mqscrp.retailconstructionadvisor.com/
accept-language
en-AU,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 04 Apr 2024 05:48:00 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
22285
x-cache
TCP_HIT
x-fd-int-roxy-purgeid
4554691
alt-svc
h3=":443"; ma=86400
x-ms-lease-status
unlocked
last-modified
Thu, 15 Feb 2024 19:13:16 GMT
server
cloudflare
x-azure-ref
20240403T233634Z-hy383wrnht49b283k01gn804780000000nz0000000002sb4
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Tx04QbLDf6HREBDRSTTxL07WgwnR9eReG%2B7MB0hddeG3I0vDQDBSdp4DbwZnZTF5Xpel4i6pWTUSaLkF9Eah9yqOs6f%2FcM8vX6dx2DMwz4QCoCz7AaGKvIpEVlOoRBRtv%2BXXfsc%2F6Plht%2FkTdswxi5j9jvrybw%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
e22b8224-301e-006d-5b13-7b78a7000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
vary
Accept-Encoding
cf-ray
86ef01c9be4ea88f-SYD
favicon_a_eupayfgghqiai7k9sol6lg2.ico
jrhte.retailconstructionadvisor.com/shared/1.0/content/images/ 		17 KB
1 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://jrhte.retailconstructionadvisor.com/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.177.82 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://mqscrp.retailconstructionadvisor.com/
accept-language
en-AU,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 04 Apr 2024 05:48:00 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
22277
x-cache
TCP_HIT
x-fd-int-roxy-purgeid
4554691
alt-svc
h3=":443"; ma=86400
x-ms-lease-status
unlocked
last-modified
Sun, 18 Oct 2020 03:02:03 GMT
server
cloudflare
x-azure-ref
20240403T233643Z-g257vtdq2t3pxbsu7qcf1vbvps0000000p6g000000001kzy
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XppTZyh6o7tD%2Fpdcfn3GZgVAaXxPkWSU6vrz8MsyMW8GRXo5pZ%2BBxyJmfkhgwvSMNeRSqXexmrgOKF1TT7i%2B2sAEFlATkO6ksg4R5%2FaiiAvyVRAKBxDuWe5aanYLB6DTypfwdZf0P0xbdVRZa7TLafxTvOwk8g%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/x-icon
access-control-allow-origin
*
x-ms-request-id
91843f9d-e01e-002c-76ea-7a80b4000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
vary
Accept-Encoding
cf-ray
86ef01c9de75a88f-SYD
signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg
jrhte.retailconstructionadvisor.com/shared/1.0/content/images/ 		2 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://jrhte.retailconstructionadvisor.com/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.67.177.82 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://mqscrp.retailconstructionadvisor.com/
accept-language
en-AU,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 04 Apr 2024 05:48:01 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age
22284
x-cache
TCP_HIT
x-fd-int-roxy-purgeid
4554691
alt-svc
h3=":443"; ma=86400
x-ms-lease-status
unlocked
last-modified
Wed, 24 May 2023 10:11:49 GMT
server
cloudflare
x-azure-ref
20240403T233637Z-g257vtdq2t3pxbsu7qcf1vbvps0000000p6g000000001kv9
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4ry1yUIZDDClcuU78MhA4LvEZeH4oPOidQhGMsag4G2rOQJLBPkgFOPBDZ12Ybb9j3mot9soRaz%2Fp5fAc0uDt06r4k2BhdlaGSX%2BfZsvf7aQHieYHvfsAFwGgCEkJ0Qggl3dxbREdgfkl94NhP%2FRE2SJ08JwWA%3D%3D"}],"group":"cf-nel","max_age":604800}
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
7af5ab78-601e-0070-5219-7b179e000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
vary
Accept-Encoding
cf-ray
86ef01cb8ffea88f-SYD
truncated
/ Frame 3691 		341 B
0 		Script
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
90682803943448f3acffc81014c87fdd71f30d8cf97335fcea451fac1e568221

Request headers

accept-language
en-AU,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36

Response headers

Content-Type
text/javascript
boot.worldwide.0.mouse.js
r4.res.office365.com/owa/prem/15.20.7409.46/scripts/ Frame 3691 		648 KB
176 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://r4.res.office365.com/owa/prem/15.20.7409.46/scripts/boot.worldwide.0.mouse.js
Requested by
Host: mejeff.retailconstructionadvisor.com
URL: https://mejeff.retailconstructionadvisor.com/owa/prefetch.aspx
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.55.242.177 Sydney, Australia, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-55-242-177.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
d5238dcd5576de5c01381727798f579c4722e1c0b07f544135fbe537d7ccf94f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://mejeff.retailconstructionadvisor.com/
accept-language
en-AU,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 04 Apr 2024 05:48:02 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Sat, 30 Mar 2024 20:06:36 GMT
server
AkamaiNetStorage
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public,max-age=630720000, s-maxage=630720000
accept-ranges
bytes
timing-allow-origin
*
content-length
179692
boot.worldwide.1.mouse.js
r4.res.office365.com/owa/prem/15.20.7409.46/scripts/ Frame 3691 		644 KB
160 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://r4.res.office365.com/owa/prem/15.20.7409.46/scripts/boot.worldwide.1.mouse.js
Requested by
Host: mejeff.retailconstructionadvisor.com
URL: https://mejeff.retailconstructionadvisor.com/owa/prefetch.aspx
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.55.242.177 Sydney, Australia, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-55-242-177.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
5f5adbc771d02801fb69961683d3ee1f50b7e9c8a66dc3f3cc86263a3f995c0d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://mejeff.retailconstructionadvisor.com/
accept-language
en-AU,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 04 Apr 2024 05:48:02 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Sat, 30 Mar 2024 20:06:24 GMT
server
AkamaiNetStorage
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public,max-age=630720000, s-maxage=630720000
accept-ranges
bytes
timing-allow-origin
*
content-length
163064
boot.worldwide.2.mouse.js
r4.res.office365.com/owa/prem/15.20.7409.46/scripts/ Frame 3691 		647 KB
166 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://r4.res.office365.com/owa/prem/15.20.7409.46/scripts/boot.worldwide.2.mouse.js
Requested by
Host: mejeff.retailconstructionadvisor.com
URL: https://mejeff.retailconstructionadvisor.com/owa/prefetch.aspx
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.55.242.177 Sydney, Australia, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-55-242-177.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
58fa5e4a247076c76b9683f01fdf108f54ff88fda4221b2de376eb96d1f2ba2a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://mejeff.retailconstructionadvisor.com/
accept-language
en-AU,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 04 Apr 2024 05:48:02 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Sat, 30 Mar 2024 20:06:37 GMT
server
AkamaiNetStorage
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public,max-age=630720000, s-maxage=630720000
accept-ranges
bytes
timing-allow-origin
*
content-length
169666
boot.worldwide.3.mouse.js
r4.res.office365.com/owa/prem/15.20.7409.46/scripts/ Frame 3691 		645 KB
142 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://r4.res.office365.com/owa/prem/15.20.7409.46/scripts/boot.worldwide.3.mouse.js
Requested by
Host: mejeff.retailconstructionadvisor.com
URL: https://mejeff.retailconstructionadvisor.com/owa/prefetch.aspx
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.55.242.177 Sydney, Australia, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-55-242-177.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
1f90c3543f5b76b8295a8d298dbce301d9c379027c128b47fda21e002638107f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://mejeff.retailconstructionadvisor.com/
accept-language
en-AU,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 04 Apr 2024 05:48:02 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Sat, 30 Mar 2024 20:06:27 GMT
server
AkamaiNetStorage
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
cache-control
public,max-age=630720000, s-maxage=630720000
accept-ranges
bytes
timing-allow-origin
*
content-length
145599
sprite1.mouse.png
r4.res.office365.com/owa/prem/15.20.7409.46/resources/images/0/ Frame 3691 		132 B
327 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://r4.res.office365.com/owa/prem/15.20.7409.46/resources/images/0/sprite1.mouse.png
Requested by
Host: mejeff.retailconstructionadvisor.com
URL: https://mejeff.retailconstructionadvisor.com/owa/prefetch.aspx
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.55.242.177 Sydney, Australia, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-55-242-177.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
3ab09a213eedd51a0eb0e4bc5e6e96c472032dd937420e7e233ea54775c7e024
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://mejeff.retailconstructionadvisor.com/
accept-language
en-AU,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 04 Apr 2024 05:48:02 GMT
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Sat, 30 Mar 2024 20:20:31 GMT
server
AkamaiNetStorage
content-type
image/png
access-control-allow-origin
*
cache-control
public,max-age=630720000, s-maxage=630720000
accept-ranges
bytes
timing-allow-origin
*
content-length
132
sprite1.mouse.css
r4.res.office365.com/owa/prem/15.20.7409.46/resources/images/0/ Frame 3691 		994 B
503 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://r4.res.office365.com/owa/prem/15.20.7409.46/resources/images/0/sprite1.mouse.css
Requested by
Host: mejeff.retailconstructionadvisor.com
URL: https://mejeff.retailconstructionadvisor.com/owa/prefetch.aspx
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.55.242.177 Sydney, Australia, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-55-242-177.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
6d1be7ed96dd494447f348986317faf64728ccf788be551f2a621b31ddc929ac
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://mejeff.retailconstructionadvisor.com/
accept-language
en-AU,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 04 Apr 2024 05:48:02 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Sat, 30 Mar 2024 20:20:30 GMT
server
AkamaiNetStorage
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public,max-age=630720000, s-maxage=630720000
accept-ranges
bytes
timing-allow-origin
*
content-length
288
boot.worldwide.mouse.css
r4.res.office365.com/owa/prem/15.20.7409.46/resources/styles/0/ Frame 3691 		227 KB
43 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://r4.res.office365.com/owa/prem/15.20.7409.46/resources/styles/0/boot.worldwide.mouse.css
Requested by
Host: mejeff.retailconstructionadvisor.com
URL: https://mejeff.retailconstructionadvisor.com/owa/prefetch.aspx
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.55.242.177 Sydney, Australia, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-55-242-177.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
37619b16288166cc76403f0b7df6586349b2d5628de00d5850c815d019b17904
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

sec-ch-ua
"Google Chrome";v="123", "Not:A-Brand";v="8", "Chromium";v="123"
Referer
https://mejeff.retailconstructionadvisor.com/
accept-language
en-AU,en;q=0.9
sec-ch-ua-mobile
?0
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36
sec-ch-ua-platform
"Win32"

Response headers

date
Thu, 04 Apr 2024 05:48:02 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000; includeSubDomains
last-modified
Sat, 30 Mar 2024 20:21:07 GMT
server
AkamaiNetStorage
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public,max-age=630720000, s-maxage=630720000
accept-ranges
bytes
timing-allow-origin
*
content-length
44144

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| $Config object| $Debug object| $Do function| $Loader object| $WebWatson function| GetString function| GetErrorString function| GetUrl object| $B object| ServerData object| webpackJsonp object| ko object| PROOF object| StringRepository object| Telemetry object| telemetry_webpackJsonp boolean| __ConvergedLogin_PCore boolean| __ function| lp boolean| __convergedlogin_pcustomizationloader_7f0a8c2a247460fad87f boolean| __convergedlogin_pstringcustomizationhelper_eb638da25d4055fbbb57

19 Cookies

Domain/Path Name / Value
.bit.ly/ Name: _bit
Value: o345LR-cc84652ac8ad7a881e-00R
.retailconstructionadvisor.com/ Name: YUnc
Value: 50dbb05e3425825229a01fd9993e67d30547dd83b14cbb33e44274472900e8e7
mejeff.retailconstructionadvisor.com/ Name: ClientId
Value: 5D763802A2794393AEA391B7D99EAFA2
mejeff.retailconstructionadvisor.com/ Name: OIDC
Value: 1
mejeff.retailconstructionadvisor.com/ Name: OpenIdConnect.nonce.v3.pQWm2eKJe3ts3K7y5JQoThxXwJvMMD3UQ37O22rB0m4
Value: 638478064755779439.82429ef4-6557-4afb-9114-5158e554bb94
mejeff.retailconstructionadvisor.com/ Name: X-OWA-RedirectHistory
Value: ArLym14Bb6elxmpU3Ag
.mqscrp.retailconstructionadvisor.com/ Name: esctx-C6J7QAwCjDs
Value: AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8CSOJETjEs4ghqXd95iipIOsqpcVlM9rQ837WMJYIbkRn6J71zBhvr_qDO1Pl6QbToovLfYr6wFpt7hDu2ZRASzEHmXpknK6Egqfu3Hm2iGhly0wj8t1ujJ-Yjd8Pv55c8NUT6JhI-4Q19mOcR2yMJyAA
mqscrp.retailconstructionadvisor.com/ Name: x-ms-gateway-slice
Value: estsfd
mqscrp.retailconstructionadvisor.com/ Name: stsservicecookie
Value: estsfd
.mqscrp.retailconstructionadvisor.com/ Name: AADSSO
Value: NA|NoExtension
mqscrp.retailconstructionadvisor.com/ Name: SSOCOOKIEPULLED
Value: 1
mqscrp.retailconstructionadvisor.com/ Name: buid
Value: 0.AV8AMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8Y4wkXlwOfvDMbejRV_Z8ka60LqXXPP1sazNbmZCPvRaWYHvOpzCUFz735skzCBgncNweTRWBRULAJy9YzA3sOrm6rU3vuViLYVwJ3zCYkS0gAA
.mqscrp.retailconstructionadvisor.com/ Name: esctx
Value: PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd82j5dP1fNFLMAE2-wYACMy6o7ldSONIW_QpofP2m0RMQANq5-VQBIIBfD7IrUMjLRn1xeyAqplHViysi892FzoHQlEySMqCZVifQYN4urp_JyLLyhPe2W-wRVoHYc5qZhBEgbXnO_GjxMF-IHFg4lg0K1OB-5F5PfUG9jdtWXvYUgAA
.mqscrp.retailconstructionadvisor.com/ Name: esctx-uuRjtzloFQ0
Value: AQABCQEAAADnfolhJpSnRYB1SVj-Hgd891Fn6Lc_yORV1TBlk1nv1Z2toyIoMFj-D_JBvabKtjzecGC_sR2w3yQF1P6JST8ab-_dKsJryvtyL-d2uaq26VuCO-mCXMEihtgZPK78sv210erbJAEmdhkI1TGTqXZ9bTbb0JBKg_EKXPidYZ1-TCAA
mqscrp.retailconstructionadvisor.com/ Name: fpc
Value: AngINZZ8lZRPmMB6eEt6UWyerOTJAQAAAA82oN0OAAAA
.mqscrp.retailconstructionadvisor.com/ Name: brcap
Value: 0
.krvetbr.retailconstructionadvisor.com/ Name: uaid
Value: 76c409f26c9743528764278dd0192ab8
.krvetbr.retailconstructionadvisor.com/ Name: MSPRequ
Value: id=N&lt=1712209681&co=1
mejeff.retailconstructionadvisor.com/ Name: OWAPF
Value: v:15.20.7409.46&l:mouse

2 Console Messages

Source Level URL
Text
network error URL: https://mqscrp.retailconstructionadvisor.com/favicon.ico
Message:
Failed to load resource: the server responded with a status of 404 ()
recommendation verbose URL: https://mqscrp.retailconstructionadvisor.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=2b808b64-3a5a-61b1-3f83-e2ae962fcfb6&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638478064755779439.82429ef4-6557-4afb-9114-5158e554bb94&state=DYs7DoAwDMVSEMcJ_fDSJMdppXZl5PpksAdLTkR0BkeQSoi0Pwa10qEiqo7Hb2tovja4R2KMPdlrBUsVWyKY05HivfL7jfwD&sso_reload=true
Message:
[DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bit.ly
jrhte.retailconstructionadvisor.com
krvetbr.retailconstructionadvisor.com
ktejre.retailconstructionadvisor.com
mailing.birdeye.com
meheff.retailconstructionadvisor.com
mejeff.retailconstructionadvisor.com
mqscrp.retailconstructionadvisor.com
r4.res.office365.com
172.67.177.82
23.55.242.177
50.18.123.174
67.199.248.11
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
1c11151e4bb85de513e2e04f9f80333ea7ea378e3da8c31e20edcf80c5391ebe
1f90c3543f5b76b8295a8d298dbce301d9c379027c128b47fda21e002638107f
2442d75ea0aee91158db7ad41e46527fe94a961c1f0f62d7f503f526adb029b7
2537bd1f7a6738fba17e11fec33e51e988314310ed8771a801fa9b0e7d849d33
33cea1c907e3d621eafe2bd781df9eee3a2a96e7ce8375b01e103d0533db8c09
37619b16288166cc76403f0b7df6586349b2d5628de00d5850c815d019b17904
3ab09a213eedd51a0eb0e4bc5e6e96c472032dd937420e7e233ea54775c7e024
4b01a0a34ce8ed4bc8a8713be0442d49da6a756236b7b4424622ca3dee820f41
4bf693e314b77c74e8bf76ee60d067f08abbef5d92c66d350a8300568991d70e
58fa5e4a247076c76b9683f01fdf108f54ff88fda4221b2de376eb96d1f2ba2a
5f5adbc771d02801fb69961683d3ee1f50b7e9c8a66dc3f3cc86263a3f995c0d
6d1be7ed96dd494447f348986317faf64728ccf788be551f2a621b31ddc929ac
7530b843a86f3155ce07cda787a40da87052664b09c22f3d4db5e9238664dbe0
8b34a475187302935336bf43a2bf2a4e0adb9a1e87953ea51f6fcf0ef52a4a1d
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93
90682803943448f3acffc81014c87fdd71f30d8cf97335fcea451fac1e568221
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21
d5238dcd5576de5c01381727798f579c4722e1c0b07f544135fbe537d7ccf94f
d8f5ab3e00202fd3b45be1acd95d677b137064001e171bc79b06826d98f1e1d3
df2e852c347ecf82f70a0c8a4b91713fbb0914d58f2cbab01316bfe646abee7c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4e1e65871749d18aea150643c07e0aab2057da057c6c57ec1c3c43580e1c898
f3ef1594a12e18d5d80c69caef319427ff1e4bb60b64e433eaa9fe46de5acb3d