Submitted URL: https://outlook.office365.us/Encryption/retrieve.ashx?recipientemailaddress=contracts%40thorlabs.com&senderemailaddress=Josep...
Effective URL: https://outlook.office365.us/Encryption/authenticationpage.aspx?st=Microsoft&ru=https%3a%2f%2foutlook.office365.us%2fEncrypti...
Submission: On July 07 via manual from US — Scanned from US

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 3 HTTP transactions. The main IP is 2001:489a:2200:41e::2, located in San Antonio, United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is outlook.office365.us. The Cisco Umbrella rank of the primary domain is 12256.
TLS certificate: Issued by DigiCert Cloud Services CA-1 on May 6th 2023. Valid for: a year.
This is the only time outlook.office365.us was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 4 2001:489a:220... 8070 (MICROSOFT...)
1 152.199.4.33 15133 (EDGECAST)
3 2
Apex Domain
Subdomains
Transfer
4 office365.us
outlook.office365.us — Cisco Umbrella Rank: 12256
6 KB
1 aspnetcdn.com
ajax.aspnetcdn.com — Cisco Umbrella Rank: 2263
43 KB
3 2
Domain Requested by
4 outlook.office365.us 2 redirects outlook.office365.us
1 ajax.aspnetcdn.com outlook.office365.us
3 2

This site contains links to these domains. Also see Links.

Domain
go.microsoft.com
privacy.microsoft.com
Subject Issuer Validity Valid
office365.us
DigiCert Cloud Services CA-1
2023-05-06 -
2024-05-05
a year crt.sh
*.vo.msecnd.net
DigiCert SHA2 Secure Server CA
2023-05-05 -
2024-04-28
a year crt.sh

This page contains 1 frames:

Primary Page: https://outlook.office365.us/Encryption/authenticationpage.aspx?st=Microsoft&ru=https%3a%2f%2foutlook.office365.us%2fEncryption%2fdefault.aspx%3fitemID%3dE4E_M_8c2733d5-e718-4df7-b707-27dac1a40cd2&e4e_sdata=XQyFxkxmaOc2XNzFg7q67vva6ZDYzDQ%2bvXss0pbbXOsTuNZyOrb2LzTnxsy12tA2tZObbOm%2ftBBHnDcRouqIYsUxGWHAFG85If4WZCp6mCW%2fnIrPYiSPSImGDwdGP2UOgSZD9Nuf6PzWLWwFhUjhWAWuqjlPO0XNNE0Lx%2bXaazrzlKd02ciMAixwbSxTJO%2bFpQi%2buCWjhrjmzXDlPU%2baTtwECAyRaqfMsx4pS5H6JB2BdBQ0GBvw6neJ8pFmuY9lQTUcyjJQOXz8GMoUteC1w%2foprLCQIadBJcWQY8Y5%2b2ncC2U1UN4n3%2fB8sFZgnG5LVHKTlM2OQMjHJFQFpq%2b5Cg%3d%3d
Frame ID: 0FCE1C100D7F2393244B9E85677B29DA
Requests: 3 HTTP requests in this frame

Screenshot

Page Title

Encrypted Message Authentication

Page URL History Show full URLs

  1. https://outlook.office365.us/Encryption/retrieve.ashx?recipientemailaddress=contracts%40thorlabs.com&send... HTTP 302
    https://outlook.office365.us/Encryption/default.aspx?itemID=E4E_M_8c2733d5-e718-4df7-b707-27dac1a40cd2 HTTP 302
    https://outlook.office365.us/Encryption/authenticationpage.aspx?st=Microsoft&ru=https%3a%2f%2foutlook.off... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.aspx?(?:$|\?)

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

3
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

47 kB
Transfer

105 kB
Size

15
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://outlook.office365.us/Encryption/retrieve.ashx?recipientemailaddress=contracts%40thorlabs.com&senderemailaddress=Joseph.Dugan%40ga-asi.com&senderorganization=AwGFAAAAAoEAAAADAQAAAJn64aPBfEVBrkxf3X%2fw9mlPVT1nZW5lcmFsYXRvbWljcy5vbm1pY3Jvc29mdC5jb20sT1U9TWljcm9zb2Z0IEV4Y2hhbmdlIEhvc3RlZCBPcmdhbml6YXRpb25zLERDPU5BTVAxMTBBMDAzLERDPVBST0QsREM9T1VUTE9PSyxEQz1DT03A4XipT8LiTI0Z9xcG5ArWQ049Q29uZmlndXJhdGlvbixDTj1nZW5lcmFsYXRvbWljcy5vbm1pY3Jvc29mdC5jb20sQ049Q29uZmlndXJhdGlvblVuaXRzLERDPU5BTVAxMTBBMDAzLERDPVBST0QsREM9T1VUTE9PSyxEQz1DT00B&messageid=%3cPH1P110MB15874A7418E7C7F7263CA5B4B92CA%40PH1P110MB1587.NAMP110.PROD.OUTLOOK.COM%3e&cfmRecipient=SystemMailbox%7bD0E409A0-AF9B-4720-92FE-AAC869B0D201%7d%40generalatomics.onmicrosoft.com&consumerEncryption=false&senderorgid=05e53887-e4b3-4595-87f7-3ae79f0e723e&urldecoded=1&e4e_sdata=jLHlvSXIEJf6Rzc15GdkBs7oKFNC%2ftIeDeWjjfkYlbu0zhTl%2bJuRzhsoxriDiWaq5XcYSvkMCABgUthxRf9oQuRDg1ukAEyfFrwhWI7CmWILbb0atf6oRwix5q6aXMM0hUw3Y8hFfu4b9NnUgp%2fQ06yJAbvKJKAOWmHigvW9F0Cz8dnBGfFwvQ%2bEDMYvM4rOFweHU4%2bb%2bzD1X75Xof2PxvZjkuNTlml1BeKqdnbU0m1fEaCBe7jpkyFYUkwfJyv8rVwXyGUvS5g2ykqJHA0fpXDsaxYgMzjhNB64COOgOveCJdTs0T7EXpVIGP9h5HbrNePzN8uRKUzsQkBOejvxwQ%3d%3d HTTP 302
    https://outlook.office365.us/Encryption/default.aspx?itemID=E4E_M_8c2733d5-e718-4df7-b707-27dac1a40cd2 HTTP 302
    https://outlook.office365.us/Encryption/authenticationpage.aspx?st=Microsoft&ru=https%3a%2f%2foutlook.office365.us%2fEncryption%2fdefault.aspx%3fitemID%3dE4E_M_8c2733d5-e718-4df7-b707-27dac1a40cd2&e4e_sdata=XQyFxkxmaOc2XNzFg7q67vva6ZDYzDQ%2bvXss0pbbXOsTuNZyOrb2LzTnxsy12tA2tZObbOm%2ftBBHnDcRouqIYsUxGWHAFG85If4WZCp6mCW%2fnIrPYiSPSImGDwdGP2UOgSZD9Nuf6PzWLWwFhUjhWAWuqjlPO0XNNE0Lx%2bXaazrzlKd02ciMAixwbSxTJO%2bFpQi%2buCWjhrjmzXDlPU%2baTtwECAyRaqfMsx4pS5H6JB2BdBQ0GBvw6neJ8pFmuY9lQTUcyjJQOXz8GMoUteC1w%2foprLCQIadBJcWQY8Y5%2b2ncC2U1UN4n3%2fB8sFZgnG5LVHKTlM2OQMjHJFQFpq%2b5Cg%3d%3d Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request authenticationpage.aspx
outlook.office365.us/Encryption/
Redirect Chain
  • https://outlook.office365.us/Encryption/retrieve.ashx?recipientemailaddress=contracts%40thorlabs.com&senderemailaddress=Joseph.Dugan%40ga-asi.com&senderorganization=AwGFAAAAAoEAAAADAQAAAJn64aPBfEVB...
  • https://outlook.office365.us/Encryption/default.aspx?itemID=E4E_M_8c2733d5-e718-4df7-b707-27dac1a40cd2
  • https://outlook.office365.us/Encryption/authenticationpage.aspx?st=Microsoft&ru=https%3a%2f%2foutlook.office365.us%2fEncryption%2fdefault.aspx%3fitemID%3dE4E_M_8c2733d5-e718-4df7-b707-27dac1a40cd2&...
7 KB
3 KB
Document
General
Full URL
https://outlook.office365.us/Encryption/authenticationpage.aspx?st=Microsoft&ru=https%3a%2f%2foutlook.office365.us%2fEncryption%2fdefault.aspx%3fitemID%3dE4E_M_8c2733d5-e718-4df7-b707-27dac1a40cd2&e4e_sdata=XQyFxkxmaOc2XNzFg7q67vva6ZDYzDQ%2bvXss0pbbXOsTuNZyOrb2LzTnxsy12tA2tZObbOm%2ftBBHnDcRouqIYsUxGWHAFG85If4WZCp6mCW%2fnIrPYiSPSImGDwdGP2UOgSZD9Nuf6PzWLWwFhUjhWAWuqjlPO0XNNE0Lx%2bXaazrzlKd02ciMAixwbSxTJO%2bFpQi%2buCWjhrjmzXDlPU%2baTtwECAyRaqfMsx4pS5H6JB2BdBQ0GBvw6neJ8pFmuY9lQTUcyjJQOXz8GMoUteC1w%2foprLCQIadBJcWQY8Y5%2b2ncC2U1UN4n3%2fB8sFZgnG5LVHKTlM2OQMjHJFQFpq%2b5Cg%3d%3d
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:489a:2200:41e::2 San Antonio, United States, ASN8070 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
0300c7e2a76e9fade98869a466118e49de9e3cdd6e77cf796cc91a27e0c8a67b

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

cache-control
no-cache
content-encoding
gzip
content-length
2572
content-type
text/html; charset=utf-8
date
Fri, 07 Jul 2023 13:18:11 GMT
expires
-1
pragma
no-cache
request-id
e86b35ee-c332-90a1-5efb-7e5ad864be9c
server
Microsoft-IIS/10.0
vary
Accept-Encoding
x-aspnet-version
4.0.30319
x-backendhttpstatus
200
x-beserver
SA1P110MB1405
x-calculatedbetarget
SA1P110MB1405.NAMP110.PROD.OUTLOOK.COM
x-diaginfo
SA1P110MB1405
x-feefzinfo
SAT
x-feproxyinfo
SN5P110CA0048.NAMP110.PROD.OUTLOOK.COM
x-feserver
SN5P110CA0048
x-firsthopcafeefz
SAT
x-powered-by
ASP.NET
x-proxy-backendserverstatus
200
x-proxy-routingcorrectness
1
x-rum-notupdatequerieddbcopy
1
x-rum-notupdatequeriedpath
1
x-rum-validated
1

Redirect headers

content-length
674
content-type
text/html; charset=utf-8
date
Fri, 07 Jul 2023 13:18:10 GMT
location
/Encryption/authenticationpage.aspx?st=Microsoft&ru=https%3a%2f%2foutlook.office365.us%2fEncryption%2fdefault.aspx%3fitemID%3dE4E_M_8c2733d5-e718-4df7-b707-27dac1a40cd2&e4e_sdata=XQyFxkxmaOc2XNzFg7q67vva6ZDYzDQ%2bvXss0pbbXOsTuNZyOrb2LzTnxsy12tA2tZObbOm%2ftBBHnDcRouqIYsUxGWHAFG85If4WZCp6mCW%2fnIrPYiSPSImGDwdGP2UOgSZD9Nuf6PzWLWwFhUjhWAWuqjlPO0XNNE0Lx%2bXaazrzlKd02ciMAixwbSxTJO%2bFpQi%2buCWjhrjmzXDlPU%2baTtwECAyRaqfMsx4pS5H6JB2BdBQ0GBvw6neJ8pFmuY9lQTUcyjJQOXz8GMoUteC1w%2foprLCQIadBJcWQY8Y5%2b2ncC2U1UN4n3%2fB8sFZgnG5LVHKTlM2OQMjHJFQFpq%2b5Cg%3d%3d
request-id
7afa2e1e-ed50-8227-c860-0baea8f782b0
server
Microsoft-IIS/10.0
x-backendhttpstatus
302
x-beserver
SA1P110MB1405
x-calculatedbetarget
SA1P110MB1405.NAMP110.PROD.OUTLOOK.COM
x-diaginfo
SA1P110MB1405
x-feefzinfo
SAT
x-feproxyinfo
SN5P110CA0048.NAMP110.PROD.OUTLOOK.COM
x-feserver
SN5P110CA0048
x-firsthopcafeefz
SAT
x-powered-by
ASP.NET
x-proxy-backendserverstatus
302
x-proxy-routingcorrectness
1
x-rum-notupdatequerieddbcopy
1
x-rum-notupdatequeriedpath
1
x-rum-validated
1
jquery-1.12.4.min.js
ajax.aspnetcdn.com/ajax/jQuery/
95 KB
43 KB
Script
General
Full URL
https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.12.4.min.js
Requested by
Host: outlook.office365.us
URL: https://outlook.office365.us/Encryption/authenticationpage.aspx?st=Microsoft&ru=https%3a%2f%2foutlook.office365.us%2fEncryption%2fdefault.aspx%3fitemID%3dE4E_M_8c2733d5-e718-4df7-b707-27dac1a40cd2&e4e_sdata=XQyFxkxmaOc2XNzFg7q67vva6ZDYzDQ%2bvXss0pbbXOsTuNZyOrb2LzTnxsy12tA2tZObbOm%2ftBBHnDcRouqIYsUxGWHAFG85If4WZCp6mCW%2fnIrPYiSPSImGDwdGP2UOgSZD9Nuf6PzWLWwFhUjhWAWuqjlPO0XNNE0Lx%2bXaazrzlKd02ciMAixwbSxTJO%2bFpQi%2buCWjhrjmzXDlPU%2baTtwECAyRaqfMsx4pS5H6JB2BdBQ0GBvw6neJ8pFmuY9lQTUcyjJQOXz8GMoUteC1w%2foprLCQIadBJcWQY8Y5%2b2ncC2U1UN4n3%2fB8sFZgnG5LVHKTlM2OQMjHJFQFpq%2b5Cg%3d%3d
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.4.33 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (nya/7911) /
Resource Hash
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://outlook.office365.us/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Fri, 07 Jul 2023 13:18:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
20261242
x-cache
HIT
content-length
43298
x-xss-protection
1; mode=block
last-modified
Mon, 31 Oct 2016 23:10:52 GMT
server
ECAcc (nya/7911)
etag
"851dbc6cc33d21:0"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public,max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
authentication.css
outlook.office365.us/Encryption/
3 KB
1 KB
Stylesheet
General
Full URL
https://outlook.office365.us/Encryption/authentication.css
Requested by
Host: outlook.office365.us
URL: https://outlook.office365.us/Encryption/authenticationpage.aspx?st=Microsoft&ru=https%3a%2f%2foutlook.office365.us%2fEncryption%2fdefault.aspx%3fitemID%3dE4E_M_8c2733d5-e718-4df7-b707-27dac1a40cd2&e4e_sdata=XQyFxkxmaOc2XNzFg7q67vva6ZDYzDQ%2bvXss0pbbXOsTuNZyOrb2LzTnxsy12tA2tZObbOm%2ftBBHnDcRouqIYsUxGWHAFG85If4WZCp6mCW%2fnIrPYiSPSImGDwdGP2UOgSZD9Nuf6PzWLWwFhUjhWAWuqjlPO0XNNE0Lx%2bXaazrzlKd02ciMAixwbSxTJO%2bFpQi%2buCWjhrjmzXDlPU%2baTtwECAyRaqfMsx4pS5H6JB2BdBQ0GBvw6neJ8pFmuY9lQTUcyjJQOXz8GMoUteC1w%2foprLCQIadBJcWQY8Y5%2b2ncC2U1UN4n3%2fB8sFZgnG5LVHKTlM2OQMjHJFQFpq%2b5Cg%3d%3d
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:489a:2200:41e::2 San Antonio, United States, ASN8070 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
08a857eeec64d9c6b3ece76762eed837929e0e6f8a29d1315a04d38c3053b4b6

Request headers

accept-language
en-US,en;q=0.9
Referer
https://outlook.office365.us/Encryption/authenticationpage.aspx?st=Microsoft&ru=https%3a%2f%2foutlook.office365.us%2fEncryption%2fdefault.aspx%3fitemID%3dE4E_M_8c2733d5-e718-4df7-b707-27dac1a40cd2&e4e_sdata=XQyFxkxmaOc2XNzFg7q67vva6ZDYzDQ%2bvXss0pbbXOsTuNZyOrb2LzTnxsy12tA2tZObbOm%2ftBBHnDcRouqIYsUxGWHAFG85If4WZCp6mCW%2fnIrPYiSPSImGDwdGP2UOgSZD9Nuf6PzWLWwFhUjhWAWuqjlPO0XNNE0Lx%2bXaazrzlKd02ciMAixwbSxTJO%2bFpQi%2buCWjhrjmzXDlPU%2baTtwECAyRaqfMsx4pS5H6JB2BdBQ0GBvw6neJ8pFmuY9lQTUcyjJQOXz8GMoUteC1w%2foprLCQIadBJcWQY8Y5%2b2ncC2U1UN4n3%2fB8sFZgnG5LVHKTlM2OQMjHJFQFpq%2b5Cg%3d%3d
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-beserver
SA1P110MB1405
date
Fri, 07 Jul 2023 13:18:11 GMT
content-encoding
gzip
x-backendhttpstatus
200
x-proxy-backendserverstatus
200
x-rum-notupdatequerieddbcopy
1
x-powered-by
ASP.NET
x-feserver
SN5P110CA0048
x-feproxyinfo
SN5P110CA0048.NAMP110.PROD.OUTLOOK.COM
x-rum-validated
1
request-id
03a80c6c-719c-d337-7b58-47704e75de6b
content-length
1265
last-modified
Fri, 26 May 2023 11:06:36 GMT
server
Microsoft-IIS/10.0
x-calculatedbetarget
SA1P110MB1405.NAMP110.PROD.OUTLOOK.COM
etag
"062223c28fd91:0"
vary
Accept-Encoding
x-rum-notupdatequeriedpath
1
content-type
text/css
cache-control
public,max-age=2592000
x-firsthopcafeefz
SAT
x-diaginfo
SA1P110MB1405
x-proxy-routingcorrectness
1
accept-ranges
bytes
x-feefzinfo
SAT

Verdicts & Comments Add Verdict or Comment

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| onbeforetoggle object| onscrollend function| $ function| jQuery number| timerInterval function| OtpClicked function| LogOAuthSignIn function| gup function| timedText

15 Cookies

Domain/Path Name / Value
outlook.office365.us/ Name: X-E4E-CorrelationId
Value: 7e51e6ae-8686-4c88-b930-d7907784d085
outlook.office365.us/ Name: X-OmeVersion
Value: V2
outlook.office365.us/ Name: X-ConsumerEncryption
Value: false
outlook.office365.us/ Name: X-CfmRecipientAddress
Value: SystemMailbox%7bD0E409A0-AF9B-4720-92FE-AAC869B0D201%7d%40generalatomics.onmicrosoft.com
outlook.office365.us/ Name: E4EAnchorMailbox
Value: SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201}@generalatomics.onmicrosoft.com
outlook.office365.us/ Name: X-RecipientEmailAddress
Value: contracts@thorlabs.com
outlook.office365.us/ Name: X-SenderEmailAddress
Value: Joseph.Dugan@ga-asi.com
outlook.office365.us/ Name: X-SenderOrganization
Value: AwGFAAAAAoEAAAADAQAAAJn64aPBfEVBrkxf3X/w9mlPVT1nZW5lcmFsYXRvbWljcy5vbm1pY3Jvc29mdC5jb20sT1U9TWljcm9zb2Z0IEV4Y2hhbmdlIEhvc3RlZCBPcmdhbml6YXRpb25zLERDPU5BTVAxMTBBMDAzLERDPVBST0QsREM9T1VUTE9PSyxEQz1DT03A4XipT8LiTI0Z9xcG5ArWQ049Q29uZmlndXJhdGlvbixDTj1nZW5lcmFsYXRvbWljcy5vbm1pY3Jvc29mdC5jb20sQ049Q29uZmlndXJhdGlvblVuaXRzLERDPU5BTVAxMTBBMDAzLERDPVBST0QsREM9T1VUTE9PSyxEQz1DT00B
outlook.office365.us/ Name: X-MessageId
Value: %3cPH1P110MB15874A7418E7C7F7263CA5B4B92CA%40PH1P110MB1587.NAMP110.PROD.OUTLOOK.COM%3e
outlook.office365.us/ Name: X-StoreObjectId
Value:
outlook.office365.us/ Name: X-RecipientPrimarySmtp
Value:
outlook.office365.us/ Name: E4E_M_8c2733d5-e718-4df7-b707-27dac1a40cd2
Value: SA1P110MB1405
outlook.office365.us/ Name: X-OTPItemId
Value: E4E_M_8c2733d5-e718-4df7-b707-27dac1a40cd2
outlook.office365.us/ Name: X-SenderExternalOrganizationId
Value: 05e53887-e4b3-4595-87f7-3ae79f0e723e
outlook.office365.us/ Name: X-AnonResource
Value: true

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.aspnetcdn.com
outlook.office365.us
152.199.4.33
2001:489a:2200:41e::2
0300c7e2a76e9fade98869a466118e49de9e3cdd6e77cf796cc91a27e0c8a67b
08a857eeec64d9c6b3ece76762eed837929e0e6f8a29d1315a04d38c3053b4b6
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404