Submitted URL: https://substrate.office.com/sts/%22,%22aud%22:%22https://outlookimageproxy.azurewebsites.net%22,%22ssec%22:%22C5zQeOIal8AlLl...
Effective URL: https://substrate.office.com/sts/%22,%22aud%22:%22https://outlookimageproxy.azurewebsites.net%22,%22ssec%22:%22C5zQeOIal8AlLl...
Submission: On May 17 via manual from SG — Scanned from SG

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 2 HTTP transactions. The main IP is 2603:1046:c01:2460::2, located in Singapore, Singapore and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is substrate.office.com. The Cisco Umbrella rank of the primary domain is 56.
TLS certificate: Issued by DigiCert Cloud Services CA-1 on January 22nd 2024. Valid for: a year.
This is the only time substrate.office.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 3 2603:1046:c01... 8075 (MICROSOFT...)
2 1
Apex Domain
Subdomains
Transfer
3 office.com
substrate.office.com — Cisco Umbrella Rank: 56
9 KB
2 1
Domain Requested by
3 substrate.office.com 1 redirects
2 1

This site contains no links.

Subject Issuer Validity Valid
outlook.com
DigiCert Cloud Services CA-1
2024-01-22 -
2025-01-21
a year crt.sh

This page contains 1 frames:

Primary Page: https://substrate.office.com/sts/%22,%22aud%22:%22https://outlookimageproxy.azurewebsites.net%22,%22ssec%22:%22C5zQeOIal8AlLlt2%22%7D%EF%BF%BDXF%EF%BF%BD%EF%BF%BDy%EF%BF%BD%3Ch%22%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%0E%EF%BF%BD%EF%BF%BD%C9%B352%22%D2%9D*%22%EF%BF%BD%EF%BF%BD~G%EF%BF%BD%EF%BF%BD;%EF%BF%BD%EF%BF%BD%151%EF%BF%BD+jF%EF%BF%BD%EF%BF%BD%EF%BF%BD&cf%EF%BF%BDuAf%EF%BF%BD%EF%BF%BD%06%EF%BF%BD%16%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%1E%1D(k8vt%EF%BF%BD%EF%BF%BDw%EF%BF%BDk%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BDzI3%EF%BF%BD%D3%B5%EF%BF%BDT%EF%BF%BD~%EF%BF%BD3%EF%BF%BD%19%16%EF%BF%BDH8%EF%BF%BD%25%C5%A58%EF%BF%BD@%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD1%5E%EF%BF%BD%EF%BF%BDO%EF%BF%BD%EF%BF%BD%3E%EF%BF%BD%EF%BF%BD%EF%BF%BD%19%EF%BF%BD%1F)W%EF%BF%BDl%EF%BF%BD(%EF%BF%BD%3EH%7B%EF%BF%BD_%EF%BF%BD4%EF%BF%BD%25g%EF%BF%BD3%0F%EF%BF%BD%EF%BF%BD%22%EF%BF%BD%EF%BF%BD%17%EF%BF%BD%EF%BF%BD%EF%BF%BD;
Frame ID: C7C4097381F739565421A33C09241C29
Requests: 2 HTTP requests in this frame

Screenshot

Page Title

Bad Request

Page Statistics

2
Requests

50 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

9 kB
Transfer

8 kB
Size

2
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://substrate.office.com/favicon.ico HTTP 302
  • https://substrate.office.com/owa/favicon.ico

2 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request outlookimageproxy.azurewebsites.net%22,%22ssec%22:%22C5zQeOIal8AlLlt2%22%7D%EF%BF%BDXF%EF%BF%BD%EF%BF%BDy%EF%BF%BD%3Ch%22%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%0E%EF%BF%BD%EF%BF%BD%C9%B352%22%D2%9D*%...
substrate.office.com/sts/%22,%22aud%22:%22https://
324 B
424 B
Document
General
Full URL
https://substrate.office.com/sts/%22,%22aud%22:%22https://outlookimageproxy.azurewebsites.net%22,%22ssec%22:%22C5zQeOIal8AlLlt2%22%7D%EF%BF%BDXF%EF%BF%BD%EF%BF%BDy%EF%BF%BD%3Ch%22%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%0E%EF%BF%BD%EF%BF%BD%C9%B352%22%D2%9D*%22%EF%BF%BD%EF%BF%BD~G%EF%BF%BD%EF%BF%BD;%EF%BF%BD%EF%BF%BD%151%EF%BF%BD+jF%EF%BF%BD%EF%BF%BD%EF%BF%BD&cf%EF%BF%BDuAf%EF%BF%BD%EF%BF%BD%06%EF%BF%BD%16%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%1E%1D(k8vt%EF%BF%BD%EF%BF%BDw%EF%BF%BDk%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BDzI3%EF%BF%BD%D3%B5%EF%BF%BDT%EF%BF%BD~%EF%BF%BD3%EF%BF%BD%19%16%EF%BF%BDH8%EF%BF%BD%25%C5%A58%EF%BF%BD@%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD1%5E%EF%BF%BD%EF%BF%BDO%EF%BF%BD%EF%BF%BD%3E%EF%BF%BD%EF%BF%BD%EF%BF%BD%19%EF%BF%BD%1F)W%EF%BF%BDl%EF%BF%BD(%EF%BF%BD%3EH%7B%EF%BF%BD_%EF%BF%BD4%EF%BF%BD%25g%EF%BF%BD3%0F%EF%BF%BD%EF%BF%BD%22%EF%BF%BD%EF%BF%BD%17%EF%BF%BD%EF%BF%BD%EF%BF%BD;
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2603:1046:c01:2460::2 Singapore, Singapore, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-HTTPAPI/2.0 /
Resource Hash
14c08afc15e276b96c48de6598e86fcc933f3b105a2a18667d395d82c1ea97d5

Request headers

Accept-Language
zh-SG,zh;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua
"Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile
?0
sec-ch-ua-platform
"Win32"

Response headers

content-length
324
content-type
text/html; charset=us-ascii
date
Fri, 17 May 2024 10:21:41 GMT
server
Microsoft-HTTPAPI/2.0
favicon.ico
substrate.office.com/owa/
Redirect Chain
  • https://substrate.office.com/favicon.ico
  • https://substrate.office.com/owa/favicon.ico
8 KB
9 KB
Other
General
Full URL
https://substrate.office.com/owa/favicon.ico
Protocol
H2
Server
2603:1046:c01:2460::2 Singapore, Singapore, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
e35d94b76894d6eca96ff5b1a12d94dfe73485ef3c52cb5b4395be8ffac1cb45
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Accept-Language
zh-SG,zh;q=0.9;q=0.9
Referer
https://substrate.office.com/sts/%22,%22aud%22:%22https://outlookimageproxy.azurewebsites.net%22,%22ssec%22:%22C5zQeOIal8AlLlt2%22%7D%EF%BF%BDXF%EF%BF%BD%EF%BF%BDy%EF%BF%BD%3Ch%22%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%0E%EF%BF%BD%EF%BF%BD%C9%B352%22%D2%9D*%22%EF%BF%BD%EF%BF%BD~G%EF%BF%BD%EF%BF%BD;%EF%BF%BD%EF%BF%BD%151%EF%BF%BD+jF%EF%BF%BD%EF%BF%BD%EF%BF%BD&cf%EF%BF%BDuAf%EF%BF%BD%EF%BF%BD%06%EF%BF%BD%16%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%1E%1D(k8vt%EF%BF%BD%EF%BF%BDw%EF%BF%BDk%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BDzI3%EF%BF%BD%D3%B5%EF%BF%BDT%EF%BF%BD~%EF%BF%BD3%EF%BF%BD%19%16%EF%BF%BDH8%EF%BF%BD%25%C5%A58%EF%BF%BD@%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD1%5E%EF%BF%BD%EF%BF%BDO%EF%BF%BD%EF%BF%BD%3E%EF%BF%BD%EF%BF%BD%EF%BF%BD%19%EF%BF%BD%1F)W%EF%BF%BDl%EF%BF%BD(%EF%BF%BD%3EH%7B%EF%BF%BD_%EF%BF%BD4%EF%BF%BD%25g%EF%BF%BD3%0F%EF%BF%BD%EF%BF%BD%22%EF%BF%BD%EF%BF%BD%17%EF%BF%BD%EF%BF%BD%EF%BF%BD;
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

x-beserver
KL1P153MB0961
strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Fri, 17 May 2024 10:21:41 GMT
x-backendhttpstatus
200, 200
x-content-type-options
nosniff
x-backend-end
2024-05-17T10:21:42.388
nel
{"report_to":"NelOfficeUpload1","max_age":7200,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01}
x-proxy-backendserverstatus
200
x-rum-notupdatequerieddbcopy
1
x-calculatedfetarget
KL1PR01CU003.internal.outlook.com
x-feserver
KL1PR01CA0068, SI2P153CA0001
x-feproxyinfo
SI2P153CA0001.APCP153.PROD.OUTLOOK.COM
x-rum-validated
1
request-id
ddd4a0fe-ff61-8203-c72b-0353ee578115
alt-svc
h3=":443";ma=2592000,h3-29=":443";ma=2592000
content-length
7886
x-backend-begin
2024-05-17T10:21:42.388
x-ua-compatible
IE=EmulateIE7
last-modified
Wed, 15 May 2024 11:21:14 GMT
server
Microsoft-IIS/10.0
x-calculatedbetarget
KL1P153MB0961.APCP153.PROD.OUTLOOK.COM
etag
"0711bffb9a6da1:0"
x-rum-notupdatequeriedpath
1
content-type
image/x-icon
report-to
{"group":"NelOfficeUpload1","max_age":7200,"endpoints":[{"url":"https://exo.nel.measure.office.net/api/report?TenantId=&FrontEnd=Cafe&DestinationEndpoint=SIN&RemoteIP=2001:df1:800::&Environment="}],"include_subdomains":true}
cache-control
public,max-age=2592000
x-firsthopcafeefz
SIN
x-diaginfo
KL1P153MB0961
x-proxy-routingcorrectness
1
accept-ranges
bytes
x-feefzinfo
SIN

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Fri, 17 May 2024 10:21:41 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
x-feserver
SI2P153CA0001
content-type
text/html; charset=utf-8
location
/owa/favicon.ico
x-feproxyinfo
SI2P153CA0001.APCP153.PROD.OUTLOOK.COM
request-id
4e393389-ac47-55fe-e844-93c34eeb5888
ms-cv
iTM5Tkes/lXoRJPDTutYiA.0
x-feefzinfo
SIN
content-length
133

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Domain/Path Name / Value
substrate.office.com/ Name: ClientId
Value: 1E4A3AE4E6ED4D3AA3A75852AC491A14
substrate.office.com/ Name: OIDC
Value: 1

1 Console Messages

Source Level URL
Text
network error URL: https://substrate.office.com/sts/%22,%22aud%22:%22https://outlookimageproxy.azurewebsites.net%22,%22ssec%22:%22C5zQeOIal8AlLlt2%22%7D%EF%BF%BDXF%EF%BF%BD%EF%BF%BDy%EF%BF%BD%3Ch%22%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%0E%EF%BF%BD%EF%BF%BD%C9%B352%22%D2%9D*%22%EF%BF%BD%EF%BF%BD~G%EF%BF%BD%EF%BF%BD;%EF%BF%BD%EF%BF%BD%151%EF%BF%BD+jF%EF%BF%BD%EF%BF%BD%EF%BF%BD&cf%EF%BF%BDuAf%EF%BF%BD%EF%BF%BD%06%EF%BF%BD%16%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD%1E%1D(k8vt%EF%BF%BD%EF%BF%BDw%EF%BF%BDk%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BDzI3%EF%BF%BD%D3%B5%EF%BF%BDT%EF%BF%BD~%EF%BF%BD3%EF%BF%BD%19%16%EF%BF%BDH8%EF%BF%BD%25%C5%A58%EF%BF%BD@%EF%BF%BD%EF%BF%BD%EF%BF%BD%EF%BF%BD1%5E%EF%BF%BD%EF%BF%BDO%EF%BF%BD%EF%BF%BD%3E%EF%BF%BD%EF%BF%BD%EF%BF%BD%19%EF%BF%BD%1F)W%EF%BF%BDl%EF%BF%BD(%EF%BF%BD%3EH%7B%EF%BF%BD_%EF%BF%BD4%EF%BF%BD%25g%EF%BF%BD3%0F%EF%BF%BD%EF%BF%BD%22%EF%BF%BD%EF%BF%BD%17%EF%BF%BD%EF%BF%BD%EF%BF%BD;#%1A%0E%EF%BF%BDaG%EF%BF%BD%7D2%EF%BF%BDK%EF%BF%BD%EF%BF%BD%01%EF%BF%BD%EF%BF%BDq%EF%BF%BD%EF%BF%BD!%EF%BF%BD%EF%BF%BD%D4%91'r%1C%07%EF%BF%BDt%19:%EF%BF%BDb%EF%BF%BD%EF%BF%BDT%EF%BF%BDF%EF%BF%BDJ%D1%BE%1DP%EF%BF%BD%20%3C%EF%BF%BDD9%EF%BF%BD%EF%BF%BD%EF%BF%BDD%EF%BF%BD#%EF%BF%BDi%EF%BF%BD%E7%97%94C%EF%BF%BDya7%EF%BF%BD%07L%EF%BF%BD'%EF%BF%BD%EF%BF%BD%25%18M%EF%BF%BD%EF%BF%BD%EF%BF%BD%D2%A0%EF%BF%BD%EF%BF%BD*A_%EF%BF%BD%04%EF%BF%BD%EF%BF%BD%3C4U%14%EF%BF%BDy%EF%BF%BD#
Message:
Failed to load resource: the server responded with a status of 400 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

substrate.office.com
2603:1046:c01:2460::2
14c08afc15e276b96c48de6598e86fcc933f3b105a2a18667d395d82c1ea97d5
e35d94b76894d6eca96ff5b1a12d94dfe73485ef3c52cb5b4395be8ffac1cb45