urlscan.io logo urlscan.io
SecurityTrails logo

outlook.office365.us Open in urlscan Pro
2001:489a:2200:14f::2  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://outlook.office365.us/Encryption/retrieve.ashx?recipientemailaddress=Matthew.Robles%40dps.texas.gov&senderemailaddress...
Effective URL: https://outlook.office365.us/Encryption/authenticationpage.aspx?st=OTP&ru=https%3a%2f%2foutlook.office365.us%2fEncryption%2fd...
Submission: On October 25 via manual from US — Scanned from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 3 HTTP transactions. The main IP is 2001:489a:2200:14f::2, located in San Antonio, United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is outlook.office365.us. The Cisco Umbrella rank of the primary domain is 14031.
TLS certificate: Issued by DigiCert Cloud Services CA-1 on August 4th 2022. Valid for: a year.
This is the only time outlook.office365.us was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 4 2001:489a:220... 8070 (MICROSOFT...)
1 152.199.4.33 15133 (EDGECAST)
3 2
Apex Domain
Subdomains		 Transfer
4 office365.us
outlook.office365.us — Cisco Umbrella Rank: 14031
8 KB
1 aspnetcdn.com
ajax.aspnetcdn.com — Cisco Umbrella Rank: 809
43 KB
3 2
Domain Requested by
4 outlook.office365.us 2 redirects outlook.office365.us
1 ajax.aspnetcdn.com outlook.office365.us
3 2

This site contains links to these domains. Also see Links.

Domain
go.microsoft.com
privacy.microsoft.com
Subject Issuer Validity Valid
office365.us
DigiCert Cloud Services CA-1		 2022-08-04 -
2023-08-03		 a year crt.sh
*.vo.msecnd.net
DigiCert SHA2 Secure Server CA		 2022-07-11 -
2023-07-11		 a year crt.sh

This page contains 1 frames:

Primary Page: https://outlook.office365.us/Encryption/authenticationpage.aspx?st=OTP&ru=https%3a%2f%2foutlook.office365.us%2fEncryption%2fdefault.aspx%3fitemID%3dE4E_M_04729c33-e61c-43fc-a943-efdecf55b2d7
Frame ID: D42DA9D7CF416B108142B62AA9D7C4F6
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Encrypted Message Authentication

Page URL History Show full URLs

  1. https://outlook.office365.us/Encryption/retrieve.ashx?recipientemailaddress=Matthew.Robles%40dps.texas.go... HTTP 302
    https://outlook.office365.us/Encryption/default.aspx?itemID=E4E_M_04729c33-e61c-43fc-a943-efdecf55b2d7 HTTP 302
    https://outlook.office365.us/Encryption/authenticationpage.aspx?st=OTP&ru=https%3a%2f%2foutlook.office365... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • \.aspx?(?:$|\?)
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

3
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

2
Subdomains

2
IPs

1
Countries

48 kB
Transfer

105 kB
Size

15
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://outlook.office365.us/Encryption/retrieve.ashx?recipientemailaddress=Matthew.Robles%40dps.texas.gov&senderemailaddress=jstafford%40fbi.gov&senderorganization=AwF9AAAAAnkAAAADAQAAAByGXVwaKIhOrR%2f5HEpQpRpPVT1kb2pmYmkub25taWNyb3NvZnQuY29tLE9VPU1pY3Jvc29mdCBFeGNoYW5nZSBIb3N0ZWQgT3JnYW5pemF0aW9ucyxEQz1OQU1QMTEwQTAwMSxEQz1QUk9ELERDPU9VVExPT0ssREM9Q09N%2blbvNXXeIk6fr5Io%2b1MzUUNOPUNvbmZpZ3VyYXRpb24sQ049ZG9qZmJpLm9ubWljcm9zb2Z0LmNvbSxDTj1Db25maWd1cmF0aW9uVW5pdHMsREM9TkFNUDExMEEwMDEsREM9UFJPRCxEQz1PVVRMT09LLERDPUNPTQE%3d&messageid=%3cPH1P110MB1236FB481297EE28B0E5B244B2319%40PH1P110MB1236.NAMP110.PROD.OUTLOOK.COM%3e&cfmRecipient=SystemMailbox%7bD0E409A0-AF9B-4720-92FE-AAC869B0D201%7d%40dojfbi.onmicrosoft.com&consumerEncryption=false&senderorgid=022914a9-b95f-4b7b-bace-551ce1a04071&urldecoded=1&e4e_sdata=aLK6UYd5POS7RUm9bpMbj%2bhC7Oe5FH1BcFiApvwyOedB2b1ipr3%2buof2m09UdPV1gPk3kqzXo6aAtLLPWezKBxWBtP8hrAsrKEcu4lv5Hmti62748uvhChmwEZqGu5J3poMAmT3S3mKFnCRvoDazsnVBjctbDuritMK8c0p2jtzxF%2f%2fU7bIR2H3C%2fm8GFZvgG1Zew%2fFqEKorzG5KUF2gjepneYj4lbKtp3zWhHbeyX%2f%2fgH%2fOCW6hv%2bVjxs0b8uIMcXv1ineG7dip%2fa0TQIgp%2fJ%2f%2ft857%2bBe%2blzG%2bfzp6%2bL1WwlwI7jIyxl7abSuShrvpZICJgrbtIDhtF0XZTQZRog%3d%3d HTTP 302
    https://outlook.office365.us/Encryption/default.aspx?itemID=E4E_M_04729c33-e61c-43fc-a943-efdecf55b2d7 HTTP 302
    https://outlook.office365.us/Encryption/authenticationpage.aspx?st=OTP&ru=https%3a%2f%2foutlook.office365.us%2fEncryption%2fdefault.aspx%3fitemID%3dE4E_M_04729c33-e61c-43fc-a943-efdecf55b2d7 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

3 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request authenticationpage.aspx
outlook.office365.us/Encryption/
Redirect Chain
  • https://outlook.office365.us/Encryption/retrieve.ashx?recipientemailaddress=Matthew.Robles%40dps.texas.gov&senderemailaddress=jstafford%40fbi.gov&senderorganization=AwF9AAAAAnkAAAADAQAAAByGXVwaKIhO...
  • https://outlook.office365.us/Encryption/default.aspx?itemID=E4E_M_04729c33-e61c-43fc-a943-efdecf55b2d7
  • https://outlook.office365.us/Encryption/authenticationpage.aspx?st=OTP&ru=https%3a%2f%2foutlook.office365.us%2fEncryption%2fdefault.aspx%3fitemID%3dE4E_M_04729c33-e61c-43fc-a943-efdecf55b2d7
7 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://outlook.office365.us/Encryption/authenticationpage.aspx?st=OTP&ru=https%3a%2f%2foutlook.office365.us%2fEncryption%2fdefault.aspx%3fitemID%3dE4E_M_04729c33-e61c-43fc-a943-efdecf55b2d7
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:489a:2200:14f::2 San Antonio, United States, ASN8070 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
de74333daa32c5cdc621e2f35cb94c0428ca3004c6e8e993c160b11772bf1a73

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36
accept-language
en-US,en;q=0.9

Response headers

Cache-Control
no-cache
Content-Encoding
gzip
Content-Length
2575
Content-Type
text/html; charset=utf-8
Date
Tue, 25 Oct 2022 15:38:37 GMT
Expires
-1
Pragma
no-cache
Server
Microsoft-IIS/10.0
Vary
Accept-Encoding
X-AspNet-Version
4.0.30319
X-BEServer
BN0P110MB1385
X-BackEndHttpStatus
200
X-CalculatedBETarget
BN0P110MB1385.NAMP110.PROD.OUTLOOK.COM
X-DiagInfo
BN0P110MB1385
X-FEEFZInfo
SAT
X-FEProxyInfo
SA1P110CA0024.NAMP110.PROD.OUTLOOK.COM
X-FEServer
SA1P110CA0024
X-FirstHopCafeEFZ
SAT
X-Powered-By
ASP.NET
X-Proxy-BackendServerStatus
200
X-Proxy-RoutingCorrectness
1
X-RUM-Validated
1
request-id
89257300-b093-b6b0-8c2b-b63c14a2847b

Redirect headers

Content-Length
283
Content-Type
text/html; charset=utf-8
Date
Tue, 25 Oct 2022 15:38:37 GMT
Location
/Encryption/authenticationpage.aspx?st=OTP&ru=https%3a%2f%2foutlook.office365.us%2fEncryption%2fdefault.aspx%3fitemID%3dE4E_M_04729c33-e61c-43fc-a943-efdecf55b2d7
Server
Microsoft-IIS/10.0
X-BEServer
BN0P110MB1385
X-BackEndHttpStatus
302
X-CalculatedBETarget
BN0P110MB1385.NAMP110.PROD.OUTLOOK.COM
X-DiagInfo
BN0P110MB1385
X-FEEFZInfo
SAT
X-FEProxyInfo
SA1P110CA0024.NAMP110.PROD.OUTLOOK.COM
X-FEServer
SA1P110CA0024
X-FirstHopCafeEFZ
SAT
X-Powered-By
ASP.NET
X-Proxy-BackendServerStatus
302
X-Proxy-RoutingCorrectness
1
X-RUM-Validated
1
request-id
4510f96f-0759-d642-36a9-7480183d4649
jquery-1.12.4.min.js
ajax.aspnetcdn.com/ajax/jQuery/ 		95 KB
43 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.12.4.min.js
Requested by
Host: outlook.office365.us
URL: https://outlook.office365.us/Encryption/authenticationpage.aspx?st=OTP&ru=https%3a%2f%2foutlook.office365.us%2fEncryption%2fdefault.aspx%3fitemID%3dE4E_M_04729c33-e61c-43fc-a943-efdecf55b2d7
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.4.33 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (nya/7911) /
Resource Hash
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-US,en;q=0.9
Referer
https://outlook.office365.us/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

date
Tue, 25 Oct 2022 15:38:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
29773671
x-cache
HIT
content-length
43298
x-xss-protection
1; mode=block
last-modified
Mon, 31 Oct 2016 23:10:52 GMT
server
ECAcc (nya/7911)
etag
"851dbc6cc33d21:0"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public,max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
authentication.css
outlook.office365.us/Encryption/ 		3 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://outlook.office365.us/Encryption/authentication.css
Requested by
Host: outlook.office365.us
URL: https://outlook.office365.us/Encryption/authenticationpage.aspx?st=OTP&ru=https%3a%2f%2foutlook.office365.us%2fEncryption%2fdefault.aspx%3fitemID%3dE4E_M_04729c33-e61c-43fc-a943-efdecf55b2d7
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2001:489a:2200:14f::2 San Antonio, United States, ASN8070 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
08a857eeec64d9c6b3ece76762eed837929e0e6f8a29d1315a04d38c3053b4b6

Request headers

accept-language
en-US,en;q=0.9
Referer
https://outlook.office365.us/Encryption/authenticationpage.aspx?st=OTP&ru=https%3a%2f%2foutlook.office365.us%2fEncryption%2fdefault.aspx%3fitemID%3dE4E_M_04729c33-e61c-43fc-a943-efdecf55b2d7
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.119 Safari/537.36

Response headers

X-BEServer
BN0P110MB1385
Date
Tue, 25 Oct 2022 15:38:37 GMT
Content-Encoding
gzip
X-BackEndHttpStatus
200
X-Proxy-BackendServerStatus
200
X-Powered-By
ASP.NET
X-FEServer
SA1P110CA0024
X-FEProxyInfo
SA1P110CA0024.NAMP110.PROD.OUTLOOK.COM
X-RUM-Validated
1
request-id
b197d903-be24-7ff7-18f0-2e8f3987aac0
Content-Length
1265
Last-Modified
Wed, 19 Oct 2022 17:53:32 GMT
Server
Microsoft-IIS/10.0
X-CalculatedBETarget
BN0P110MB1385.NAMP110.PROD.OUTLOOK.COM
ETag
"0b6bcb3e3e3d81:0"
Vary
Accept-Encoding
Content-Type
text/css
Cache-Control
public,max-age=2592000
X-FirstHopCafeEFZ
SAT
X-DiagInfo
BN0P110MB1385
X-Proxy-RoutingCorrectness
1
Accept-Ranges
bytes
X-FEEFZInfo
SAT

Verdicts & Comments Add Verdict or Comment

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation function| $ function| jQuery number| timerInterval function| OtpClicked function| LogOAuthSignIn function| gup function| timedText

15 Cookies

Domain/Path Name / Value
outlook.office365.us/ Name: X-E4E-CorrelationId
Value: ae315b6d-2f40-4e80-972c-abfd1da0128c
outlook.office365.us/ Name: X-OmeVersion
Value: V2
outlook.office365.us/ Name: X-ConsumerEncryption
Value: false
outlook.office365.us/ Name: X-CfmRecipientAddress
Value: SystemMailbox%7bD0E409A0-AF9B-4720-92FE-AAC869B0D201%7d%40dojfbi.onmicrosoft.com
outlook.office365.us/ Name: E4EAnchorMailbox
Value: SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201}@dojfbi.onmicrosoft.com
outlook.office365.us/ Name: X-RecipientEmailAddress
Value: Matthew.Robles@dps.texas.gov
outlook.office365.us/ Name: X-SenderEmailAddress
Value: jstafford@fbi.gov
outlook.office365.us/ Name: X-SenderOrganization
Value: AwF9AAAAAnkAAAADAQAAAByGXVwaKIhOrR/5HEpQpRpPVT1kb2pmYmkub25taWNyb3NvZnQuY29tLE9VPU1pY3Jvc29mdCBFeGNoYW5nZSBIb3N0ZWQgT3JnYW5pemF0aW9ucyxEQz1OQU1QMTEwQTAwMSxEQz1QUk9ELERDPU9VVExPT0ssREM9Q09N+lbvNXXeIk6fr5Io+1MzUUNOPUNvbmZpZ3VyYXRpb24sQ049ZG9qZmJpLm9ubWljcm9zb2Z0LmNvbSxDTj1Db25maWd1cmF0aW9uVW5pdHMsREM9TkFNUDExMEEwMDEsREM9UFJPRCxEQz1PVVRMT09LLERDPUNPTQE=
outlook.office365.us/ Name: X-MessageId
Value: %3cPH1P110MB1236FB481297EE28B0E5B244B2319%40PH1P110MB1236.NAMP110.PROD.OUTLOOK.COM%3e
outlook.office365.us/ Name: X-StoreObjectId
Value:
outlook.office365.us/ Name: X-RecipientPrimarySmtp
Value:
outlook.office365.us/ Name: E4E_M_04729c33-e61c-43fc-a943-efdecf55b2d7
Value: BN0P110MB1385
outlook.office365.us/ Name: X-OTPItemId
Value: E4E_M_04729c33-e61c-43fc-a943-efdecf55b2d7
outlook.office365.us/ Name: X-SenderExternalOrganizationId
Value: 022914a9-b95f-4b7b-bace-551ce1a04071
outlook.office365.us/ Name: X-AnonResource
Value: true

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.aspnetcdn.com
outlook.office365.us
152.199.4.33
2001:489a:2200:14f::2
08a857eeec64d9c6b3ece76762eed837929e0e6f8a29d1315a04d38c3053b4b6
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
de74333daa32c5cdc621e2f35cb94c0428ca3004c6e8e993c160b11772bf1a73