Submitted URL: http://www-jstor-org.plymouth.idm.oclc.org/
Effective URL: https://login.microsoftonline.com/5437e7eb-83fb-4d1a-bfd3-bb247e061bf1/saml2?SAMLRequest=jVLLbtswEPwVgneJEiVZNmE5cGMENZA2RqTk0EtBS...
Submission: On January 22 via api from US — Scanned from NL

Summary

This website contacted 5 IPs in 3 countries across 4 domains to perform 5 HTTP transactions. The main IP is 2603:1026:3000:148::7, located in Amsterdam, Netherlands and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is login.microsoftonline.com. The Cisco Umbrella rank of the primary domain is 11.
TLS certificate: Issued by DigiCert SHA2 Secure Server CA on November 23rd 2023. Valid for: a year.
This is the only time login.microsoftonline.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
2 3 154.59.124.101 4373 (OCLC-AS)
4 5 5.101.151.140 42831 (UKSERVERS...)
1 2603:1026:300... 8075 (MICROSOFT...)
1 2606:2800:233... 15133 (EDGECAST)
5 5
Apex Domain
Subdomains
Transfer
5 plymouth.ac.uk
shibboleth.plymouth.ac.uk
5 KB
3 oclc.org
www-jstor-org.plymouth.idm.oclc.org
plymouth.idm.oclc.org
2 KB
1 msftauth.net
aadcdn.msftauth.net — Cisco Umbrella Rank: 943
48 KB
1 microsoftonline.com
login.microsoftonline.com — Cisco Umbrella Rank: 11
10 KB
5 4
Domain Requested by
5 shibboleth.plymouth.ac.uk 4 redirects
2 plymouth.idm.oclc.org 1 redirects
1 aadcdn.msftauth.net login.microsoftonline.com
1 login.microsoftonline.com aadcdn.msftauth.net
1 www-jstor-org.plymouth.idm.oclc.org 1 redirects
5 5

This site contains no links.

Subject Issuer Validity Valid
shibboleth.plymouth.ac.uk
Sectigo RSA Domain Validation Secure Server CA
2023-06-26 -
2024-07-25
a year crt.sh
stamp2.login.microsoftonline.com
DigiCert SHA2 Secure Server CA
2023-11-23 -
2024-11-23
a year crt.sh
aadcdn.msftauth.net
DigiCert SHA2 Secure Server CA
2023-12-01 -
2024-12-01
a year crt.sh

This page contains 1 frames:

Frame: https://login.microsoftonline.com/5437e7eb-83fb-4d1a-bfd3-bb247e061bf1/saml2?SAMLRequest=jVLLbtswEPwVgneJEiVZNmE5cGMENZA2RqTk0EtBSsuYCEWqJJU2fx%2FFjzwuQc87O7Mzs8uLf71GT%2BC8sqbCaZxgBKa1nTIPFb5rrqI5vlgtPe81Hdh6DHtzC39G8AFNi8az46TCozPMcq88M7wHz0LL6vWPa0bjhA3OBttajdHae3Bhkrq0xo89uBrck2rh7va6wvsQBs8I8XslhNUQ9vGgn3s7ica8jcdHorqBTGRSaSCHW8irBiW7m7ohdX2D0Wa6TBkeDm7OhNo%2BKBP3qnXWWxms0cpA3NqeFHlWQgkimmdSRHmX8kjILouEoHkJySwVMiUHixhtNxX%2BTYtCzksKs7Tji0IuUpFJueCzLs9mZZ4VE8z7EbbGB25ChWlC8yhJI0qbNGEpZfk8XpTFL4x2p1C%2BKXMM%2B6sExRHk2fem2UWvdjG6P5c2AfCpInZQdx%2B7%2BZqYnwvBq%2F%2BL%2F326JB8l337k56Sx3eysVu0zWmtt%2F1464AEqHNwImKxOe5%2B%2FafUC&RelayState=e1s2&sso_reload=true
Frame ID: BBE984E3BF7DD4FD91715256B92E13DF
Requests: 5 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. http://www-jstor-org.plymouth.idm.oclc.org/ HTTP 302
    http://plymouth.idm.oclc.org/ HTTP 302
    http://plymouth.idm.oclc.org/login Page URL
  2. https://shibboleth.plymouth.ac.uk/idp/profile/SAML2/POST/SSO HTTP 302
    https://shibboleth.plymouth.ac.uk/idp/profile/SAML2/POST/SSO?execution=e1s1 Page URL
  3. https://shibboleth.plymouth.ac.uk/idp/profile/SAML2/POST/SSO?execution=e1s1 HTTP 302
    https://shibboleth.plymouth.ac.uk/idp/profile/SAML2/POST/SSO?execution=e1s2 HTTP 302
    https://shibboleth.plymouth.ac.uk/idp/profile/Authn/SAML2/POST/SSO/start?conversation=e1s2 HTTP 302
    https://login.microsoftonline.com/5437e7eb-83fb-4d1a-bfd3-bb247e061bf1/saml2?SAMLRequest=jVLLbtswEPwVgneJEiVZN... Page URL

Page Statistics

5
Requests

60 %
HTTPS

50 %
IPv6

4
Domains

5
Subdomains

5
IPs

3
Countries

63 kB
Transfer

160 kB
Size

6
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://www-jstor-org.plymouth.idm.oclc.org/ HTTP 302
    http://plymouth.idm.oclc.org/ HTTP 302
    http://plymouth.idm.oclc.org/login Page URL
  2. https://shibboleth.plymouth.ac.uk/idp/profile/SAML2/POST/SSO HTTP 302
    https://shibboleth.plymouth.ac.uk/idp/profile/SAML2/POST/SSO?execution=e1s1 Page URL
  3. https://shibboleth.plymouth.ac.uk/idp/profile/SAML2/POST/SSO?execution=e1s1 HTTP 302
    https://shibboleth.plymouth.ac.uk/idp/profile/SAML2/POST/SSO?execution=e1s2 HTTP 302
    https://shibboleth.plymouth.ac.uk/idp/profile/Authn/SAML2/POST/SSO/start?conversation=e1s2 HTTP 302
    https://login.microsoftonline.com/5437e7eb-83fb-4d1a-bfd3-bb247e061bf1/saml2?SAMLRequest=jVLLbtswEPwVgneJEiVZNmE5cGMENZA2RqTk0EtBSsuYCEWqJJU2fx%2FFjzwuQc87O7Mzs8uLf71GT%2BC8sqbCaZxgBKa1nTIPFb5rrqI5vlgtPe81Hdh6DHtzC39G8AFNi8az46TCozPMcq88M7wHz0LL6vWPa0bjhA3OBttajdHae3Bhkrq0xo89uBrck2rh7va6wvsQBs8I8XslhNUQ9vGgn3s7ica8jcdHorqBTGRSaSCHW8irBiW7m7ohdX2D0Wa6TBkeDm7OhNo%2BKBP3qnXWWxms0cpA3NqeFHlWQgkimmdSRHmX8kjILouEoHkJySwVMiUHixhtNxX%2BTYtCzksKs7Tji0IuUpFJueCzLs9mZZ4VE8z7EbbGB25ChWlC8yhJI0qbNGEpZfk8XpTFL4x2p1C%2BKXMM%2B6sExRHk2fem2UWvdjG6P5c2AfCpInZQdx%2B7%2BZqYnwvBq%2F%2BL%2F326JB8l337k56Sx3eysVu0zWmtt%2F1464AEqHNwImKxOe5%2B%2FafUC&RelayState=e1s2 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • http://www-jstor-org.plymouth.idm.oclc.org/ HTTP 302
  • http://plymouth.idm.oclc.org/ HTTP 302
  • http://plymouth.idm.oclc.org/login
Request Chain 1
  • https://shibboleth.plymouth.ac.uk/idp/profile/SAML2/POST/SSO HTTP 302
  • https://shibboleth.plymouth.ac.uk/idp/profile/SAML2/POST/SSO?execution=e1s1

5 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
login
plymouth.idm.oclc.org/
Redirect Chain
  • http://www-jstor-org.plymouth.idm.oclc.org/
  • http://plymouth.idm.oclc.org/
  • http://plymouth.idm.oclc.org/login
1 KB
1 KB
Document
General
Full URL
http://plymouth.idm.oclc.org/login
Protocol
HTTP/1.1
Server
154.59.124.101 Amsterdam, Netherlands, ASN4373 (OCLC-AS, US),
Reverse DNS
Software
EZproxy /
Resource Hash
fe14dad36e348fb31f53f19f946eae19f4ee33eb39bfe155b00a199978e36339

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

Connection
close
Content-Encoding
gzip
Content-Type
text/html
Date
Mon, 22 Jan 2024 10:12:47 GMT
Server
EZproxy

Redirect headers

Cache-Control
no-store, no-cache, must-revalidate post-check=0, pre-check=0
Connection
close
Date
Mon, 22 Jan 2024 10:12:47 GMT
Expires
Mon, 02 Aug 1999 00:00:00 GMT
Last-Modified
Mon, 22 Jan 2024 10:12:47 GMT
Location
http://plymouth.idm.oclc.org/login
Pragma
no-cache
Server
EZproxy
SSO
shibboleth.plymouth.ac.uk/idp/profile/SAML2/POST/
Redirect Chain
  • https://shibboleth.plymouth.ac.uk/idp/profile/SAML2/POST/SSO
  • https://shibboleth.plymouth.ac.uk/idp/profile/SAML2/POST/SSO?execution=e1s1
3 KB
3 KB
Document
General
Full URL
https://shibboleth.plymouth.ac.uk/idp/profile/SAML2/POST/SSO?execution=e1s1
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
5.101.151.140 London, United Kingdom, ASN42831 (UKSERVERS-AS UK Dedicated Servers, Hosting and Co-Location, GB),
Reverse DNS
no.rdns.ukservers.com
Software
/
Resource Hash
4ceacbe07542a579459a5a9f61c1449e9441200a47e8383452adf0ddfd97a09b
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'none';
Strict-Transport-Security max-age=31536000; includeSubDomains max-age=0
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN DENY
X-Xss-Protection 1

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
http://plymouth.idm.oclc.org
Referer
http://plymouth.idm.oclc.org/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

cache-control
no-store
connection
close
content-length
2706
content-security-policy
frame-ancestors 'none';
content-type
text/html;charset=utf-8
strict-transport-security
max-age=31536000; includeSubDomains max-age=0
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN DENY
x-xss-protection
1

Redirect headers

cache-control
no-store
connection
close
content-security-policy
frame-ancestors 'none';
expires
location
https://shibboleth.plymouth.ac.uk/idp/profile/SAML2/POST/SSO?execution=e1s1
strict-transport-security
max-age=31536000; includeSubDomains max-age=0
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN DENY
x-xss-protection
1
Primary Request saml2
login.microsoftonline.com/5437e7eb-83fb-4d1a-bfd3-bb247e061bf1/
Redirect Chain
  • https://shibboleth.plymouth.ac.uk/idp/profile/SAML2/POST/SSO?execution=e1s1
  • https://shibboleth.plymouth.ac.uk/idp/profile/SAML2/POST/SSO?execution=e1s2
  • https://shibboleth.plymouth.ac.uk/idp/profile/Authn/SAML2/POST/SSO/start?conversation=e1s2
  • https://login.microsoftonline.com/5437e7eb-83fb-4d1a-bfd3-bb247e061bf1/saml2?SAMLRequest=jVLLbtswEPwVgneJEiVZNmE5cGMENZA2RqTk0EtBSsuYCEWqJJU2fx%2FFjzwuQc87O7Mzs8uLf71GT%2BC8sqbCaZxgBKa1nTIPFb5rrqI5...
20 KB
10 KB
Document
General
Full URL
https://login.microsoftonline.com/5437e7eb-83fb-4d1a-bfd3-bb247e061bf1/saml2?SAMLRequest=jVLLbtswEPwVgneJEiVZNmE5cGMENZA2RqTk0EtBSsuYCEWqJJU2fx%2FFjzwuQc87O7Mzs8uLf71GT%2BC8sqbCaZxgBKa1nTIPFb5rrqI5vlgtPe81Hdh6DHtzC39G8AFNi8az46TCozPMcq88M7wHz0LL6vWPa0bjhA3OBttajdHae3Bhkrq0xo89uBrck2rh7va6wvsQBs8I8XslhNUQ9vGgn3s7ica8jcdHorqBTGRSaSCHW8irBiW7m7ohdX2D0Wa6TBkeDm7OhNo%2BKBP3qnXWWxms0cpA3NqeFHlWQgkimmdSRHmX8kjILouEoHkJySwVMiUHixhtNxX%2BTYtCzksKs7Tji0IuUpFJueCzLs9mZZ4VE8z7EbbGB25ChWlC8yhJI0qbNGEpZfk8XpTFL4x2p1C%2BKXMM%2B6sExRHk2fem2UWvdjG6P5c2AfCpInZQdx%2B7%2BZqYnwvBq%2F%2BL%2F326JB8l337k56Sx3eysVu0zWmtt%2F1464AEqHNwImKxOe5%2B%2FafUC&RelayState=e1s2
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2603:1026:3000:148::7 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
7fadb2a4015a256f494cac06aaa6deef8709ba64a634beca8db9501e121c7cd9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://shibboleth.plymouth.ac.uk
Referer
https://shibboleth.plymouth.ac.uk/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36
accept-language
nl-NL,nl;q=0.9

Response headers

Cache-Control
no-store, no-cache
Content-Encoding
gzip
Content-Length
8592
Content-Type
text/html; charset=utf-8
Date
Mon, 22 Jan 2024 10:12:48 GMT
Expires
-1
P3P
CP="DSP CUR OTPi IND OTRi ONL FIN"
Pragma
no-cache
Referrer-Policy
strict-origin-when-cross-origin
Strict-Transport-Security
max-age=31536000; includeSubDomains
Vary
Accept-Encoding
X-Content-Type-Options
nosniff
X-XSS-Protection
0
nel
{"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
report-to
{"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+ams2"}]}
x-ms-ests-server
2.1.17122.2 - NEULR1 ProdSlices
x-ms-request-id
95fc7a3b-c8cf-4c42-9b9a-59ab77e52c00

Redirect headers

cache-control
no-cache, no-store
connection
close
location
https://login.microsoftonline.com/5437e7eb-83fb-4d1a-bfd3-bb247e061bf1/saml2?SAMLRequest=jVLLbtswEPwVgneJEiVZNmE5cGMENZA2RqTk0EtBSsuYCEWqJJU2fx%2FFjzwuQc87O7Mzs8uLf71GT%2BC8sqbCaZxgBKa1nTIPFb5rrqI5vlgtPe81Hdh6DHtzC39G8AFNi8az46TCozPMcq88M7wHz0LL6vWPa0bjhA3OBttajdHae3Bhkrq0xo89uBrck2rh7va6wvsQBs8I8XslhNUQ9vGgn3s7ica8jcdHorqBTGRSaSCHW8irBiW7m7ohdX2D0Wa6TBkeDm7OhNo%2BKBP3qnXWWxms0cpA3NqeFHlWQgkimmdSRHmX8kjILouEoHkJySwVMiUHixhtNxX%2BTYtCzksKs7Tji0IuUpFJueCzLs9mZZ4VE8z7EbbGB25ChWlC8yhJI0qbNGEpZfk8XpTFL4x2p1C%2BKXMM%2B6sExRHk2fem2UWvdjG6P5c2AfCpInZQdx%2B7%2BZqYnwvBq%2F%2BL%2F326JB8l337k56Sx3eysVu0zWmtt%2F1464AEqHNwImKxOe5%2B%2FafUC&RelayState=e1s2
pragma
no-cache
strict-transport-security
max-age=31536000; includeSubDomains
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-xss-protection
1
BssoInterrupt_Core_aoxn9LgNNeyAz3OYDcN7uA2.js
aadcdn.msftauth.net/shared/1.0/content/js/
136 KB
48 KB
Script
General
Full URL
https://aadcdn.msftauth.net/shared/1.0/content/js/BssoInterrupt_Core_aoxn9LgNNeyAz3OYDcN7uA2.js
Requested by
Host: login.microsoftonline.com
URL: https://login.microsoftonline.com/5437e7eb-83fb-4d1a-bfd3-bb247e061bf1/saml2?SAMLRequest=jVLLbtswEPwVgneJEiVZNmE5cGMENZA2RqTk0EtBSsuYCEWqJJU2fx%2FFjzwuQc87O7Mzs8uLf71GT%2BC8sqbCaZxgBKa1nTIPFb5rrqI5vlgtPe81Hdh6DHtzC39G8AFNi8az46TCozPMcq88M7wHz0LL6vWPa0bjhA3OBttajdHae3Bhkrq0xo89uBrck2rh7va6wvsQBs8I8XslhNUQ9vGgn3s7ica8jcdHorqBTGRSaSCHW8irBiW7m7ohdX2D0Wa6TBkeDm7OhNo%2BKBP3qnXWWxms0cpA3NqeFHlWQgkimmdSRHmX8kjILouEoHkJySwVMiUHixhtNxX%2BTYtCzksKs7Tji0IuUpFJueCzLs9mZZ4VE8z7EbbGB25ChWlC8yhJI0qbNGEpZfk8XpTFL4x2p1C%2BKXMM%2B6sExRHk2fem2UWvdjG6P5c2AfCpInZQdx%2B7%2BZqYnwvBq%2F%2BL%2F326JB8l337k56Sx3eysVu0zWmtt%2F1464AEqHNwImKxOe5%2B%2FafUC&RelayState=e1s2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:78b9:f44e:2c1f:31aa:d9ef , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (ama/48A5) /
Resource Hash
15e697417242d779ddec5439f81b56bdc61974ffda9a40919be81428f341296e

Request headers

Referer
https://login.microsoftonline.com/
Origin
https://login.microsoftonline.com
accept-language
nl-NL,nl;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.224 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 22 Jan 2024 10:12:51 GMT
content-encoding
gzip
content-md5
wFzpduTSkmnT+dqkuOoEjg==
age
2084188
x-cache
HIT
content-length
49102
x-ms-lease-status
unlocked
last-modified
Fri, 22 Dec 2023 23:52:14 GMT
server
ECAcc (ama/48A5)
etag
0x8DC034905B0FBE6
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
e6733a69-a01e-0005-2c26-3add2c000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
saml2
login.microsoftonline.com/5437e7eb-83fb-4d1a-bfd3-bb247e061bf1/
0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
login.microsoftonline.com
URL
https://login.microsoftonline.com/5437e7eb-83fb-4d1a-bfd3-bb247e061bf1/saml2?SAMLRequest=jVLLbtswEPwVgneJEiVZNmE5cGMENZA2RqTk0EtBSsuYCEWqJJU2fx%2FFjzwuQc87O7Mzs8uLf71GT%2BC8sqbCaZxgBKa1nTIPFb5rrqI5vlgtPe81Hdh6DHtzC39G8AFNi8az46TCozPMcq88M7wHz0LL6vWPa0bjhA3OBttajdHae3Bhkrq0xo89uBrck2rh7va6wvsQBs8I8XslhNUQ9vGgn3s7ica8jcdHorqBTGRSaSCHW8irBiW7m7ohdX2D0Wa6TBkeDm7OhNo%2BKBP3qnXWWxms0cpA3NqeFHlWQgkimmdSRHmX8kjILouEoHkJySwVMiUHixhtNxX%2BTYtCzksKs7Tji0IuUpFJueCzLs9mZZ4VE8z7EbbGB25ChWlC8yhJI0qbNGEpZfk8XpTFL4x2p1C%2BKXMM%2B6sExRHk2fem2UWvdjG6P5c2AfCpInZQdx%2B7%2BZqYnwvBq%2F%2BL%2F326JB8l337k56Sx3eysVu0zWmtt%2F1464AEqHNwImKxOe5%2B%2FafUC&RelayState=e1s2&sso_reload=true

Verdicts & Comments Add Verdict or Comment

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| $Config object| $Debug object| $Do function| $Loader object| $WebWatson function| GetString function| GetErrorString function| GetUrl object| $B object| ServerData

6 Cookies

Domain/Path Name / Value
shibboleth.plymouth.ac.uk/idp Name: JSESSIONID
Value: node0ffycq5fyfk551lf5o3pq407cw18016085.node0
.login.microsoftonline.com/ Name: esctx-igDUvo698
Value: AQABAAEAAAAmoFfGtYxvRrNriQdPKIZ-E5jxm7vDz03rP7pEiWOnprTjybQKtCDTr95WIGYlhJmpbuXEWwVgij7JehaX1uMkba5fScEZ6ajED4zcMm48DzZ9kO7w5IAQwJYRGx5AijXJXLgzcVp3y-5zoLGPjkLhnY83HWMTasDDWGkwTpIoZiAA
login.microsoftonline.com/ Name: fpc
Value: Ao7vtPAi2MFFvzVW-MASBvQ
.login.microsoftonline.com/ Name: esctx
Value: PAQABAAEAAAAmoFfGtYxvRrNriQdPKIZ-dPhZnre0mFxFcYSdUaZNznfv3ahh4eT73sXpgY3VDtD7FxyupTSCcK_EP4hWikC2YfIQTdbNgaaOgmvrf_ScE-k4_PD2Gd4n4yvGgUz6HlFRU-SEjIzmtqmLjXKD4nOl94dk3dExtB2gTguBYdZc_Ro6j3MHkhFmnfGGprdGY4kgAA
login.microsoftonline.com/ Name: x-ms-gateway-slice
Value: estsfd
login.microsoftonline.com/ Name: stsservicecookie
Value: estsfd