login.microsoftonline.com
Open in
urlscan Pro
40.126.32.136
Public Scan
Effective URL: https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%...
Submission: On April 27 via api from IE — Scanned from DE
Summary
TLS certificate: Issued by DigiCert SHA2 Secure Server CA on February 24th 2023. Valid for: a year.
This is the only time login.microsoftonline.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
2 2 | 2603:1046:c04... 2603:1046:c04:1015::2 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
2 | 40.126.32.136 40.126.32.136 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 | 2603:1026:300... 2603:1026:3000:148::12 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
4 | 3 |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
4e8fbc59e6e75808b55ec9c317ecdb0e.fp.measure.office.com |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
login.microsoftonline.com |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
login.live.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
2 |
microsoftonline.com
login.microsoftonline.com — Cisco Umbrella Rank: 30 |
108 KB |
2 |
office.com
2 redirects
4e8fbc59e6e75808b55ec9c317ecdb0e.fp.measure.office.com |
3 KB |
1 |
live.com
login.live.com — Cisco Umbrella Rank: 61 |
|
0 |
msauth.net
Failed
aadcdn.msauth.net Failed |
|
4 | 4 |
Domain | Requested by | |
---|---|---|
2 | login.microsoftonline.com |
login.microsoftonline.com
|
2 | 4e8fbc59e6e75808b55ec9c317ecdb0e.fp.measure.office.com | 2 redirects |
1 | login.live.com |
login.microsoftonline.com
|
0 | aadcdn.msauth.net Failed |
login.microsoftonline.com
|
4 | 4 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
stamp2.login.microsoftonline.com DigiCert SHA2 Secure Server CA |
2023-02-24 - 2024-02-24 |
a year | crt.sh |
login.live.com DigiCert SHA2 Secure Server CA |
2023-04-02 - 2024-04-02 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f4e8fbc59e6e75808b55ec9c317ecdb0e.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=66bd0c8f-70db-0b8e-078b-09e8f1879f01&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638181649849039926.aebc17d9-24be-4c97-b41a-bd0beff5af53&state=DctLFoAgCEBRrNNySFFSWQ74mTZs-zG4b_YCAJzucCF5oNXSqVNl6SypiOR667JBbQpmtoU8pKExKdpMtvZ-dD8l-HvF99P4Aw&sso_reload=true
Frame ID: FA39229418ED7F0354EB881AE99A0C5A
Requests: 4 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://4e8fbc59e6e75808b55ec9c317ecdb0e.fp.measure.office.com/
HTTP 302
https://4e8fbc59e6e75808b55ec9c317ecdb0e.fp.measure.office.com/owa/ HTTP 302
https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redir... Page URL
- https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redir... Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://4e8fbc59e6e75808b55ec9c317ecdb0e.fp.measure.office.com/
HTTP 302
https://4e8fbc59e6e75808b55ec9c317ecdb0e.fp.measure.office.com/owa/ HTTP 302
https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f4e8fbc59e6e75808b55ec9c317ecdb0e.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=66bd0c8f-70db-0b8e-078b-09e8f1879f01&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638181649849039926.aebc17d9-24be-4c97-b41a-bd0beff5af53&state=DctLFoAgCEBRrNNySFFSWQ74mTZs-zG4b_YCAJzucCF5oNXSqVNl6SypiOR667JBbQpmtoU8pKExKdpMtvZ-dD8l-HvF99P4Aw Page URL
- https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f4e8fbc59e6e75808b55ec9c317ecdb0e.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=66bd0c8f-70db-0b8e-078b-09e8f1879f01&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638181649849039926.aebc17d9-24be-4c97-b41a-bd0beff5af53&state=DctLFoAgCEBRrNNySFFSWQ74mTZs-zG4b_YCAJzucCF5oNXSqVNl6SypiOR667JBbQpmtoU8pKExKdpMtvZ-dD8l-HvF99P4Aw&sso_reload=true Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 0- https://4e8fbc59e6e75808b55ec9c317ecdb0e.fp.measure.office.com/ HTTP 302
- https://4e8fbc59e6e75808b55ec9c317ecdb0e.fp.measure.office.com/owa/ HTTP 302
- https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2f4e8fbc59e6e75808b55ec9c317ecdb0e.fp.measure.office.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=66bd0c8f-70db-0b8e-078b-09e8f1879f01&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638181649849039926.aebc17d9-24be-4c97-b41a-bd0beff5af53&state=DctLFoAgCEBRrNNySFFSWQ74mTZs-zG4b_YCAJzucCF5oNXSqVNl6SypiOR667JBbQpmtoU8pKExKdpMtvZ-dD8l-HvF99P4Aw
4 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H/1.1 |
authorize
login.microsoftonline.com/common/oauth2/ Redirect Chain
|
153 KB 55 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Primary Request
authorize
login.microsoftonline.com/common/oauth2/ |
205 KB 53 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET |
ConvergedLogin_PCore_fDEeyPmTrJZRJANKd5wNrA2.js
aadcdn.msauth.net/shared/1.0/content/js/ |
0 0 |
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H/1.1 |
Me.htm
login.live.com/ |
0 0 |
Other
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers |
Failed requests
These URLs were requested, but there was no response received. You will also see them in the list above.
- Domain
- aadcdn.msauth.net
- URL
- https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_fDEeyPmTrJZRJANKd5wNrA2.js
Verdicts & Comments Add Verdict or Comment
11 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
boolean| credentialless object| $Config object| $Debug object| $Do function| $Loader object| $WebWatson function| GetString function| GetErrorString function| GetUrl object| $B object| ServerData13 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
4e8fbc59e6e75808b55ec9c317ecdb0e.fp.measure.office.com/ | Name: ClientId Value: FE4D4FB1138C4480B6C61067043A9254 |
|
4e8fbc59e6e75808b55ec9c317ecdb0e.fp.measure.office.com/ | Name: OIDC Value: 1 |
|
4e8fbc59e6e75808b55ec9c317ecdb0e.fp.measure.office.com/ | Name: OpenIdConnect.nonce.v3.OAnhrDfZ2zZnyuKG2vhIRLKd-EL-4eKTA8vpUWv-Gbo Value: 638181649849039926.aebc17d9-24be-4c97-b41a-bd0beff5af53 |
|
4e8fbc59e6e75808b55ec9c317ecdb0e.fp.measure.office.com/ | Name: X-OWA-RedirectHistory Value: ArLym14BNrxsTdRG2wg |
|
login.microsoftonline.com/ | Name: x-ms-gateway-slice Value: estsfd |
|
login.microsoftonline.com/ | Name: stsservicecookie Value: estsfd |
|
.login.microsoftonline.com/ | Name: AADSSO Value: NA|NoExtension |
|
login.microsoftonline.com/ | Name: SSOCOOKIEPULLED Value: 1 |
|
login.microsoftonline.com/ | Name: buid Value: 0.AQUAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABAAEAAAD--DLA3VO7QrddgJg7WevrGHieW9ckyhvK-3BS9zYRdigziroqOeNDploRnX2IIulSGSeUD4r0jBqeCFVSUnrs_vAQsV3AU-r3MMQqsO9HAiSkjb1Vgylgx9VRSWBcmrkgAA |
|
.login.microsoftonline.com/ | Name: esctx Value: PAQABAAEAAAD--DLA3VO7QrddgJg7WevrpvvGNQsHJr7Vy2akxUVsWty9galQA2gxZz7JBQo826gR_wnGkPVDekUQNMN2h_heJYD-wiciG1zKaCtHD7zvyUZ7_OVKQijSzhG77u7RG0NWJeNrceAKu4ElU7C_cBv2Z_NGK_T8lugNPmjWvsnRnfO2lb3rxAzAKFJczfqZfkAYksjbuW1D1kE-iVUZIJ3l-mSZGAM83wm2XsI5eo9hfrYeSclhNcBd4WL3AKMnzBUgAA |
|
login.microsoftonline.com/ | Name: fpc Value: AhPU2k7N5eVKp9Ckt8i2bQ6erOTJAQAAAPjq29sOAAAA |
|
.login.live.com/ | Name: uaid Value: 5feb88a533c8485281284ca94472405d |
|
.login.live.com/ | Name: MSPRequ Value: id=N<=1682568185&co=1 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000; includeSubDomains |
X-Content-Type-Options | nosniff |
X-Xss-Protection | 0 |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
4e8fbc59e6e75808b55ec9c317ecdb0e.fp.measure.office.com
aadcdn.msauth.net
login.live.com
login.microsoftonline.com
aadcdn.msauth.net
2603:1026:3000:148::12
2603:1046:c04:1015::2
40.126.32.136
84edddcc5edb00b29f5bdd1f60e0980b4b5d7c35bb20fba339a9ebeaffba6eef
e7f09ac64b3748160767f390575ff6e71ea1e83c1e5a74212c59c623b50190fd