office.vefyofic65.com Open in urlscan Pro
2606:4700:3032::6815:4e24 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://qrco.de/bfRZJN/01/00000002134384
Effective URL:
https://office.vefyofic65.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3...
Submission: On October 01 via manual (October 1st 2024, 8:23:47 pm UTC) from US — Scanned from DE

Summary HTTP 17 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 3 domains to perform 17 HTTP transactions. The main IP is 2606:4700:3032::6815:4e24, located in United States and belongs to CLOUDFLARENET, US. The main domain is office.vefyofic65.com.
TLS certificate: Issued by WE1 on September 30th 2024. Valid for: 3 months.

This is the only time office.vefyofic65.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 1	18.173.187.101 18.173.187.101	16509 (AMAZON-02) (AMAZON-02)
3 8	2606:4700:303... 2606:4700:3032::6815:4e24	13335 (CLOUDFLAR...) (CLOUDFLARENET)
12	2620:1ec:bdf::64 2620:1ec:bdf::64	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
17	2

1 18.173.187.101 (United States) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: server-18-173-187-101.muc50.r.cloudfront.net

qrco.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2606:4700:3032::6815:4e24 (United States) 3 redirects

ASN13335 (CLOUDFLARENET, US)

office.vefyofic65.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
react.vefyofic65.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ywnjb.vefyofic65.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2620:1ec:bdf::64 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

aadcdn.msauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	msauth.net aadcdn.msauth.net — Cisco Umbrella Rank: 1016	342 KB
8	vefyofic65.com 3 redirects office.vefyofic65.com react.vefyofic65.com ywnjb.vefyofic65.com	24 KB
1	qrco.de 1 redirects qrco.de — Cisco Umbrella Rank: 83827	351 B
17	3

	Domain	Requested by
12	aadcdn.msauth.net	office.vefyofic65.com aadcdn.msauth.net
4	office.vefyofic65.com	2 redirects
3	ywnjb.vefyofic65.com	office.vefyofic65.com aadcdn.msauth.net
1	react.vefyofic65.com	1 redirects
1	qrco.de	1 redirects
17	5

This site contains links to these domains. Also see Links.

Domain
ywnjb.vefyofic65.com
www.microsoft.com
privacy.microsoft.com

Subject Issuer	Validity	Valid
vefyofic65.com WE1	`2024-09-30` - `2024-12-29`	3 months	crt.sh
aadcdn.msauth.net DigiCert SHA2 Secure Server CA	`2024-07-30` - `2025-07-30`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://office.vefyofic65.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638634110214868964.OGMyMDVmZTItNzZkNS00ZjMyLTkzMzEtODZhMzg0ZWFmOTI3NDIyMzk1NzUtMGFlZS00NGM1LWI1NDktYzZhMjk3YmM2MWRh&ui_locales=de-DE&mkt=de-DE&client-request-id=c3e3b833-649e-4d6a-8b51-1f856f7ddec4&state=aZaqaGZu2kF4pUPl-YQZH6iMrACfz9pLm252M14Lwm2l8Vdmzg3Zt7LbrPM_o6CMiOc5fwlLwI3Z5_4rYlTnxCKhSl5QJ7OI5m5U4WcqkGTeJaWoOSlN3UWVThfOfAgMWjwctrAHSrZwQRJRN0dfSEQuh0c17y_zWr9VMivPGi7t84WupH2I0D3777lFpNc9pPpMSRpy4Ex4p1T365_71Ah9vussM_ra4f-cf_dlL3fSKakbgW3-dBKk0JCfR3kwOeheHQlbPMSrYQZZpZxuOg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0
Frame ID: D673CD719018B417563A8AFB3A3956B4
Requests: 15 HTTP requests in this frame

Frame: https://ywnjb.vefyofic65.com/Me.htm?v=3
Frame ID: BE78E6A6FD4F0FE3CF19F044B48ADE67
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Bei Ihrem Konto anmelden

Page URL History Show full URLs

https://qrco.de/bfRZJN/01/00000002134384 HTTP 308
https://office.vefyofic65.com/FdfpCHKC HTTP 302
https://office.vefyofic65.com/ HTTP 302
https://react.vefyofic65.com/login HTTP 302
https://office.vefyofic65.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&... Page URL

Page Statistics

17
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

5
Subdomains

2
IPs

1
Countries

363 kB
Transfer

1215 kB
Size

15
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://ywnjb.vefyofic65.com/oauth20_authorize.srf?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&scope=openid+profile+https%3a%2f%2freact.vefyofic65.com%2fv2%2fOfficeHome.All&redirect_uri=https%3a%2f%2freact.vefyofic65.com%2flandingv2&response_type=code+id_token&state=aZaqaGZu2kF4pUPl-YQZH6iMrACfz9pLm252M14Lwm2l8Vdmzg3Zt7LbrPM_o6CMiOc5fwlLwI3Z5_4rYlTnxCKhSl5QJ7OI5m5U4WcqkGTeJaWoOSlN3UWVThfOfAgMWjwctrAHSrZwQRJRN0dfSEQuh0c17y_zWr9VMivPGi7t84WupH2I0D3777lFpNc9pPpMSRpy4Ex4p1T365_71Ah9vussM_ra4f-cf_dlL3fSKakbgW3-dBKk0JCfR3kwOeheHQlbPMSrYQZZpZxuOg&response_mode=form_post&nonce=638634110214868964.OGMyMDVmZTItNzZkNS00ZjMyLTkzMzEtODZhMzg0ZWFmOTI3NDIyMzk1NzUtMGFlZS00NGM1LWI1NDktYzZhMjk3YmM2MWRh&x-client-SKU=ID_NET8_0&x-client-Ver=7.5.1.0&uaid=c3e3b833649e4d6a8b511f856f7ddec4&msproxy=1&issuer=mso&tenant=common&ui_locales=de-DE&signup=1&lw=1&fl=easi2&epct=PAQABDgEAAADW6jl31mB3T7ugrWTT8pFehHz5gddeRIdyLM-vapiMFQGXfaT8HTpz_ITc-mdKpS0A6WCu_ixXSLKs8plpJR_KeKLgmGUrbjMGa9JPCWO6_kp2VsUNAGE7GuP5gUwmRz1gv96Qz73Dah5bbVy5CkFIFvDe2PbKz6mokZ8fKK_jjErAl5j6D6lD6DW19TNwetX__m_YmrrebVHe729gkgTO8w-J87Sbm-v427oIA4V62CAA&jshs=0
Title: Erstellen Sie jetzt eins!

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/de-DE/servicesagreement/
Title: Nutzungsbedingungen

Search URL Search Domain Scan URL

URL: https://privacy.microsoft.com/de-DE/privacystatement
Title: Datenschutz und Cookies

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/de-de/corporate/rechtliche-hinweise/impressum.aspx
Title: Haftungsausschluss

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://qrco.de/bfRZJN/01/00000002134384 HTTP 308
https://office.vefyofic65.com/FdfpCHKC HTTP 302
https://office.vefyofic65.com/ HTTP 302
https://react.vefyofic65.com/login HTTP 302
https://office.vefyofic65.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638634110214868964.OGMyMDVmZTItNzZkNS00ZjMyLTkzMzEtODZhMzg0ZWFmOTI3NDIyMzk1NzUtMGFlZS00NGM1LWI1NDktYzZhMjk3YmM2MWRh&ui_locales=de-DE&mkt=de-DE&client-request-id=c3e3b833-649e-4d6a-8b51-1f856f7ddec4&state=aZaqaGZu2kF4pUPl-YQZH6iMrACfz9pLm252M14Lwm2l8Vdmzg3Zt7LbrPM_o6CMiOc5fwlLwI3Z5_4rYlTnxCKhSl5QJ7OI5m5U4WcqkGTeJaWoOSlN3UWVThfOfAgMWjwctrAHSrZwQRJRN0dfSEQuh0c17y_zWr9VMivPGi7t84WupH2I0D3777lFpNc9pPpMSRpy4Ex4p1T365_71Ah9vussM_ra4f-cf_dlL3fSKakbgW3-dBKk0JCfR3kwOeheHQlbPMSrYQZZpZxuOg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

17 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H3	200	Primary Request authorize Show response office.vefyofic65.com/common/oauth2/v2.0/ Redirect Chain https://qrco.de/bfRZJN/01/00000002134384 https://office.vefyofic65.com/FdfpCHKC https://office.vefyofic65.com/ https://react.vefyofic65.com/login https://office.vefyofic65.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=o...	45 KB 17 KB	607ms 607ms	Document text/html	2606:4700:3032::6815:4e24 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://office.vefyofic65.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638634110214868964.OGMyMDVmZTItNzZkNS00ZjMyLTkzMzEtODZhMzg0ZWFmOTI3NDIyMzk1NzUtMGFlZS00NGM1LWI1NDktYzZhMjk3YmM2MWRh&ui_locales=de-DE&mkt=de-DE&client-request-id=c3e3b833-649e-4d6a-8b51-1f856f7ddec4&state=aZaqaGZu2kF4pUPl-YQZH6iMrACfz9pLm252M14Lwm2l8Vdmzg3Zt7LbrPM_o6CMiOc5fwlLwI3Z5_4rYlTnxCKhSl5QJ7OI5m5U4WcqkGTeJaWoOSlN3UWVThfOfAgMWjwctrAHSrZwQRJRN0dfSEQuh0c17y_zWr9VMivPGi7t84WupH2I0D3777lFpNc9pPpMSRpy4Ex4p1T365_71Ah9vussM_ra4f-cf_dlL3fSKakbgW3-dBKk0JCfR3kwOeheHQlbPMSrYQZZpZxuOg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3032::6815:4e24 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `0e29d2dd543004c71ec49850d657e5adcc7a06084e0f23de60ec57ce8f2d80e5` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers cache-control no-store, no-cache cf-cache-status DYNAMIC cf-ray 8cbf2c05bd403a8a-FRA content-encoding br content-type text/html; charset=utf-8 date Tue, 01 Oct 2024 20:23:42 GMT expires -1 link <https://aadcdn.msauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msauth.net>; rel=dns-prefetch,<https://aadcdn.msftauth.net>; rel=dns-prefetch nel {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} p3p CP="DSP CUR OTPi IND OTRi ONL FIN" pragma no-cache referrer-policy strict-origin-when-cross-origin report-to {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+bno"}]} server cloudflare speculation-rules "/cdn-cgi/speculation" vary Accept-Encoding x-dns-prefetch-control on x-ms-clitelem 1,0,0,, x-ms-ests-server 2.1.19005.9 - EUS ProdSlices x-ms-request-id 030ccc8e-2509-485a-a005-e0e1983c2800 x-ms-srs 1.P Redirect headers cf-cache-status DYNAMIC cf-ray 8cbf2bffce333a8a-FRA content-type text/html; charset=utf-8 date Tue, 01 Oct 2024 20:23:41 GMT location https://office.vefyofic65.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638634110214868964.OGMyMDVmZTItNzZkNS00ZjMyLTkzMzEtODZhMzg0ZWFmOTI3NDIyMzk1NzUtMGFlZS00NGM1LWI1NDktYzZhMjk3YmM2MWRh&ui_locales=de-DE&mkt=de-DE&client-request-id=c3e3b833-649e-4d6a-8b51-1f856f7ddec4&state=aZaqaGZu2kF4pUPl-YQZH6iMrACfz9pLm252M14Lwm2l8Vdmzg3Zt7LbrPM_o6CMiOc5fwlLwI3Z5_4rYlTnxCKhSl5QJ7OI5m5U4WcqkGTeJaWoOSlN3UWVThfOfAgMWjwctrAHSrZwQRJRN0dfSEQuh0c17y_zWr9VMivPGi7t84WupH2I0D3777lFpNc9pPpMSRpy4Ex4p1T365_71Ah9vussM_ra4f-cf_dlL3fSKakbgW3-dBKk0JCfR3kwOeheHQlbPMSrYQZZpZxuOg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} referrer-policy strict-origin-when-cross-origin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kPIFcqhS%2BenMg2Dy%2F6XFzqx%2FV37NGyfSKRYf18pyTqkHGsBi5a%2B02tHyeps4PVHfYsTTCiI5Rt4Rt4Y5%2Bvb9K7FZ6GquFnXf6%2Bw0pymbOXStN377m6ELT7Xw%2BTX2naaUf%2FnI6b%2FprzVyRHXZ4H9t2wbGoA%3D%3D"}],"group":"cf-nel","max_age":604800} request-context appId= server cloudflare speculation-rules "/cdn-cgi/speculation" vary Accept-Encoding x-cache CONFIG_NOCACHE x-msedge-ref Ref A: 743B90F6F17C482095054BA43FB16F8D Ref B: DFW311000106049 Ref C: 2024-10-01T20:23:41Z x-ua-compatible IE=edge,chrome=1
GET H3	200	speculation office.vefyofic65.com/cdn-cgi/	128 B 556 B	38ms 38ms	Other application/speculationrules+json	2606:4700:3032::6815:4e24 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://office.vefyofic65.com/cdn-cgi/speculation Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3032::6815:4e24 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://office.vefyofic65.com Referer https://office.vefyofic65.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638634110214868964.OGMyMDVmZTItNzZkNS00ZjMyLTkzMzEtODZhMzg0ZWFmOTI3NDIyMzk1NzUtMGFlZS00NGM1LWI1NDktYzZhMjk3YmM2MWRh&ui_locales=de-DE&mkt=de-DE&client-request-id=c3e3b833-649e-4d6a-8b51-1f856f7ddec4&state=aZaqaGZu2kF4pUPl-YQZH6iMrACfz9pLm252M14Lwm2l8Vdmzg3Zt7LbrPM_o6CMiOc5fwlLwI3Z5_4rYlTnxCKhSl5QJ7OI5m5U4WcqkGTeJaWoOSlN3UWVThfOfAgMWjwctrAHSrZwQRJRN0dfSEQuh0c17y_zWr9VMivPGi7t84WupH2I0D3777lFpNc9pPpMSRpy4Ex4p1T365_71Ah9vussM_ra4f-cf_dlL3fSKakbgW3-dBKk0JCfR3kwOeheHQlbPMSrYQZZpZxuOg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 Response headers nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=IYkQ6osOvi1uO4BSOuf2EmeBZfdznFfYpH7hKq4DTRFWZlCYXt6Eei8qVMLehNO37oT9OY4nEuAse26AbYofdHuurbWkjCHgUz0A1HbQNYr4AE3JnrevsgnZREBMkpMpNaszyqvi7HimqQWUCmrQ3tMimpU%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8cbf2c09daf03a8a-FRA access-control-allow-origin https://office.vefyofic65.com content-length 128 date Tue, 01 Oct 2024 20:23:42 GMT content-type application/speculationrules+json vary Origin, Accept-Encoding server cloudflare
GET H3	200	Me.htm ywnjb.vefyofic65.com/	0 0	608ms 593ms	Other text/html	2606:4700:3032::6815:4e24 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ywnjb.vefyofic65.com/Me.htm?v=3 Requested by Host: office.vefyofic65.com URL: https://office.vefyofic65.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638634110214868964.OGMyMDVmZTItNzZkNS00ZjMyLTkzMzEtODZhMzg0ZWFmOTI3NDIyMzk1NzUtMGFlZS00NGM1LWI1NDktYzZhMjk3YmM2MWRh&ui_locales=de-DE&mkt=de-DE&client-request-id=c3e3b833-649e-4d6a-8b51-1f856f7ddec4&state=aZaqaGZu2kF4pUPl-YQZH6iMrACfz9pLm252M14Lwm2l8Vdmzg3Zt7LbrPM_o6CMiOc5fwlLwI3Z5_4rYlTnxCKhSl5QJ7OI5m5U4WcqkGTeJaWoOSlN3UWVThfOfAgMWjwctrAHSrZwQRJRN0dfSEQuh0c17y_zWr9VMivPGi7t84WupH2I0D3777lFpNc9pPpMSRpy4Ex4p1T365_71Ah9vussM_ra4f-cf_dlL3fSKakbgW3-dBKk0JCfR3kwOeheHQlbPMSrYQZZpZxuOg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3032::6815:4e24 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://office.vefyofic65.com/ Response headers
GET H2	200	converged.v2.login.min_qzvqnltrxpy99ajspyxbgq2.css aadcdn.msauth.net/ests/2.1/content/cdnbundles/	111 KB 20 KB	165ms 66ms	Stylesheet text/css	2620:1ec:bdf::64 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_qzvqnltrxpy99ajspyxbgq2.css Requested by Host: office.vefyofic65.com URL: https://office.vefyofic65.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638634110214868964.OGMyMDVmZTItNzZkNS00ZjMyLTkzMzEtODZhMzg0ZWFmOTI3NDIyMzk1NzUtMGFlZS00NGM1LWI1NDktYzZhMjk3YmM2MWRh&ui_locales=de-DE&mkt=de-DE&client-request-id=c3e3b833-649e-4d6a-8b51-1f856f7ddec4&state=aZaqaGZu2kF4pUPl-YQZH6iMrACfz9pLm252M14Lwm2l8Vdmzg3Zt7LbrPM_o6CMiOc5fwlLwI3Z5_4rYlTnxCKhSl5QJ7OI5m5U4WcqkGTeJaWoOSlN3UWVThfOfAgMWjwctrAHSrZwQRJRN0dfSEQuh0c17y_zWr9VMivPGi7t84WupH2I0D3777lFpNc9pPpMSRpy4Ex4p1T365_71Ah9vussM_ra4f-cf_dlL3fSKakbgW3-dBKk0JCfR3kwOeheHQlbPMSrYQZZpZxuOg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:bdf::64 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash `1f8ceb44fe7cfcf7e71dbd5122210335ca3821d697a851d2900b95af7d92d69d` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://office.vefyofic65.com Referer https://office.vefyofic65.com/ Response headers access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip x-ms-version 2009-09-19 etag 0x8DC9BA9D4131BFD x-ms-lease-status unlocked x-fd-int-roxy-purgeid 0 x-cache TCP_HIT date Tue, 01 Oct 2024 20:23:42 GMT content-type text/css last-modified Wed, 03 Jul 2024 21:48:08 GMT cache-control public, max-age=31536000 x-ms-request-id d1b1275d-601e-0041-6ff2-0da41f000000 accept-ranges bytes access-control-allow-origin * content-length 20414 x-azure-ref 20241001T202342Z-176d4fdd79c5lw2m85440x50vg0000000hpg000000005krm x-ms-blob-type BlockBlob
GET H2	200	ConvergedLogin_PCore_ELtAAt2Ya8ISGuc0PJcBKA2.js Show response aadcdn.msauth.net/shared/1.0/content/js/	439 KB 120 KB	164ms 65ms	Script application/x-javascript	2620:1ec:bdf::64 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_ELtAAt2Ya8ISGuc0PJcBKA2.js Requested by Host: office.vefyofic65.com URL: https://office.vefyofic65.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638634110214868964.OGMyMDVmZTItNzZkNS00ZjMyLTkzMzEtODZhMzg0ZWFmOTI3NDIyMzk1NzUtMGFlZS00NGM1LWI1NDktYzZhMjk3YmM2MWRh&ui_locales=de-DE&mkt=de-DE&client-request-id=c3e3b833-649e-4d6a-8b51-1f856f7ddec4&state=aZaqaGZu2kF4pUPl-YQZH6iMrACfz9pLm252M14Lwm2l8Vdmzg3Zt7LbrPM_o6CMiOc5fwlLwI3Z5_4rYlTnxCKhSl5QJ7OI5m5U4WcqkGTeJaWoOSlN3UWVThfOfAgMWjwctrAHSrZwQRJRN0dfSEQuh0c17y_zWr9VMivPGi7t84WupH2I0D3777lFpNc9pPpMSRpy4Ex4p1T365_71Ah9vussM_ra4f-cf_dlL3fSKakbgW3-dBKk0JCfR3kwOeheHQlbPMSrYQZZpZxuOg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:bdf::64 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash `7dc87d100ffda0b44300291491bbe7ac8a6eae94937ccec0494d5f154c07c3a0` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://office.vefyofic65.com Referer https://office.vefyofic65.com/ Response headers access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip x-ms-version 2009-09-19 etag 0x8DCCC8188A08D46 x-ms-lease-status unlocked x-fd-int-roxy-purgeid 4554691 x-cache TCP_HIT date Tue, 01 Oct 2024 20:23:42 GMT content-type application/x-javascript last-modified Wed, 04 Sep 2024 01:33:09 GMT cache-control public, max-age=31536000 x-ms-request-id c9596554-a01e-0018-5cf5-0d6b8e000000 accept-ranges bytes access-control-allow-origin * content-length 122193 x-azure-ref 20241001T202342Z-176d4fdd79c5lw2m85440x50vg0000000hpg000000005krn x-ms-blob-type BlockBlob
GET H2	200	ux.converged.login.strings-de.min_ko72obxvu9yj3q3_akvs9q2.js Show response aadcdn.msauth.net/ests/2.1/content/cdnbundles/	63 KB 18 KB	164ms 65ms	Script application/x-javascript	2620:1ec:bdf::64 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-de.min_ko72obxvu9yj3q3_akvs9q2.js Requested by Host: office.vefyofic65.com URL: https://office.vefyofic65.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638634110214868964.OGMyMDVmZTItNzZkNS00ZjMyLTkzMzEtODZhMzg0ZWFmOTI3NDIyMzk1NzUtMGFlZS00NGM1LWI1NDktYzZhMjk3YmM2MWRh&ui_locales=de-DE&mkt=de-DE&client-request-id=c3e3b833-649e-4d6a-8b51-1f856f7ddec4&state=aZaqaGZu2kF4pUPl-YQZH6iMrACfz9pLm252M14Lwm2l8Vdmzg3Zt7LbrPM_o6CMiOc5fwlLwI3Z5_4rYlTnxCKhSl5QJ7OI5m5U4WcqkGTeJaWoOSlN3UWVThfOfAgMWjwctrAHSrZwQRJRN0dfSEQuh0c17y_zWr9VMivPGi7t84WupH2I0D3777lFpNc9pPpMSRpy4Ex4p1T365_71Ah9vussM_ra4f-cf_dlL3fSKakbgW3-dBKk0JCfR3kwOeheHQlbPMSrYQZZpZxuOg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:bdf::64 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash `b9df4bf16fcb24c8da35cf1a1e891f5a4c8d4bceb89a7cf1ffd5a0f29a6d43ba` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://office.vefyofic65.com Referer https://office.vefyofic65.com/ Response headers access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip x-ms-version 2009-09-19 etag 0x8DCC6D5379BFE3A x-ms-lease-status unlocked x-fd-int-roxy-purgeid 4554691 x-cache TCP_HIT date Tue, 01 Oct 2024 20:23:42 GMT content-type application/x-javascript last-modified Tue, 27 Aug 2024 20:17:04 GMT cache-control public, max-age=31536000 x-ms-request-id 5a991b3b-801e-0049-35f5-0dbe10000000 accept-ranges bytes access-control-allow-origin * content-length 17996 x-azure-ref 20241001T202342Z-176d4fdd79c5lw2m85440x50vg0000000hpg000000005krp x-ms-blob-type BlockBlob
GET H2	200	convergedlogin_pcustomizationloader_117b650bccea354984d8.js Show response aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/	397 KB 114 KB	177ms 76ms	Script application/x-javascript	2620:1ec:bdf::64 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_117b650bccea354984d8.js Requested by Host: aadcdn.msauth.net URL: https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_ELtAAt2Ya8ISGuc0PJcBKA2.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:bdf::64 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash `da4a8df0c326292b5bee9c732b3c962fd67aaf2f99d850f1bf65068d573c5619` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://office.vefyofic65.com/ Response headers access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip x-ms-version 2009-09-19 etag 0x8DCBD5317046A2F x-ms-lease-status unlocked x-fd-int-roxy-purgeid 4554691 x-cache TCP_HIT date Tue, 01 Oct 2024 20:23:42 GMT content-type application/x-javascript last-modified Thu, 15 Aug 2024 17:52:54 GMT cache-control public, max-age=31536000 x-ms-request-id 6f59fddb-f01e-003a-0af5-0dae91000000 accept-ranges bytes access-control-allow-origin * content-length 116365 x-azure-ref 20241001T202342Z-176d4fdd79cl8dfg32x2wc05c80000000k7000000000r7fk x-ms-blob-type BlockBlob
GET H2	200	favicon_a_eupayfgghqiai7k9sol6lg2.ico aadcdn.msauth.net/shared/1.0/content/images/	17 KB 17 KB	163ms 75ms	Other image/x-icon	2620:1ec:bdf::64 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:bdf::64 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash `90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://office.vefyofic65.com/ Response headers access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-version 2009-09-19 x-ms-lease-status unlocked etag 0x8D8731230C851A6 x-fd-int-roxy-purgeid 4554691 x-cache TCP_HIT date Tue, 01 Oct 2024 20:23:42 GMT content-type image/x-icon last-modified Sun, 18 Oct 2020 03:02:03 GMT cache-control public, max-age=31536000 x-ms-request-id b0620fc2-c01e-0043-2bf5-0d52b5000000 accept-ranges bytes access-control-allow-origin * content-length 17174 x-azure-ref 20241001T202342Z-176d4fdd79cl8dfg32x2wc05c80000000k7000000000r7fh x-ms-blob-type BlockBlob
GET H2	200	convergedlogin_pfetchsessionsprogress_d0a803279e7397bef834.js Show response aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/	15 KB 6 KB	37ms 37ms	Script application/x-javascript	2620:1ec:bdf::64 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_d0a803279e7397bef834.js Requested by Host: aadcdn.msauth.net URL: https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_ELtAAt2Ya8ISGuc0PJcBKA2.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:bdf::64 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash `bc6804d058d5bd5b24fc04e479fc8973bef5d3efeafaa9c19c60a009bf0fac0b` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://office.vefyofic65.com/ Response headers access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip x-ms-version 2009-09-19 etag 0x8DCBD531731891C x-ms-lease-status unlocked x-fd-int-roxy-purgeid 4554691 x-cache TCP_HIT date Tue, 01 Oct 2024 20:23:42 GMT content-type application/x-javascript last-modified Thu, 15 Aug 2024 17:52:54 GMT cache-control public, max-age=31536000 x-ms-request-id 8cd2e43e-201e-0006-73f5-0d8756000000 accept-ranges bytes access-control-allow-origin * content-length 5529 x-azure-ref 20241001T202342Z-176d4fdd79cl8dfg32x2wc05c80000000k7000000000r7gm x-ms-blob-type BlockBlob
GET H2	200	marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif aadcdn.msauth.net/shared/1.0/content/images/	3 KB 3 KB	55ms 55ms	Image image/gif	2620:1ec:bdf::64 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:bdf::64 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash `a46201581a7c7c667fd42787cd1e9adf2f6bf809efb7596e61a03e8dba9ada13` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://office.vefyofic65.com/ Response headers access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-version 2009-09-19 x-ms-lease-status unlocked etag 0x8DB5C3F48EC4154 x-fd-int-roxy-purgeid 4554691 x-cache TCP_HIT date Tue, 01 Oct 2024 20:23:42 GMT content-type image/gif last-modified Wed, 24 May 2023 10:11:47 GMT cache-control public, max-age=31536000 x-ms-request-id 6253c521-101e-0022-5df5-0d71f6000000 accept-ranges bytes access-control-allow-origin * content-length 2672 x-azure-ref 20241001T202342Z-176d4fdd79cl8dfg32x2wc05c80000000k7000000000r7gn x-ms-blob-type BlockBlob
GET H2	200	marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif aadcdn.msauth.net/shared/1.0/content/images/	4 KB 4 KB	56ms 56ms	Image image/gif	2620:1ec:bdf::64 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:bdf::64 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash `8737d721808655f37b333f08a90185699e7e8b9bdaaa15cdb63c8448b426f95d` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://office.vefyofic65.com/ Response headers access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-version 2009-09-19 x-ms-lease-status unlocked etag 0x8DB5C3F4904824B x-fd-int-roxy-purgeid 4554691 x-cache TCP_HIT date Tue, 01 Oct 2024 20:23:42 GMT content-type image/gif last-modified Wed, 24 May 2023 10:11:48 GMT cache-control public, max-age=31536000 x-ms-request-id b0924ad4-e01e-0019-80f5-0d3452000000 accept-ranges bytes access-control-allow-origin * content-length 3620 x-azure-ref 20241001T202342Z-176d4fdd79cl8dfg32x2wc05c80000000k7000000000r7gp x-ms-blob-type BlockBlob
GET H2	200	2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg aadcdn.msauth.net/shared/1.0/content/images/backgrounds/	2 KB 1 KB	34ms 33ms	Image image/svg+xml	2620:1ec:bdf::64 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:bdf::64 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash `0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://office.vefyofic65.com/ Response headers access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip x-ms-version 2009-09-19 etag 0x8DB5C3F47E260FD x-ms-lease-status unlocked x-fd-int-roxy-purgeid 4554691 x-cache TCP_HIT date Tue, 01 Oct 2024 20:23:43 GMT content-type image/svg+xml last-modified Wed, 24 May 2023 10:11:46 GMT cache-control public, max-age=31536000 x-ms-request-id b21790b1-e01e-006b-53f5-0d331d000000 accept-ranges bytes access-control-allow-origin * content-length 673 x-azure-ref 20241001T202343Z-176d4fdd79cl8dfg32x2wc05c80000000k7000000000r7h2 x-ms-blob-type BlockBlob
GET H2	200	microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg aadcdn.msauth.net/shared/1.0/content/images/	4 KB 2 KB	34ms 34ms	Image image/svg+xml	2620:1ec:bdf::64 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:bdf::64 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash `04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://office.vefyofic65.com/ Response headers access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip x-ms-version 2009-09-19 etag 0x8DB5C3F4911527F x-ms-lease-status unlocked x-fd-int-roxy-purgeid 4554691 x-cache TCP_HIT date Tue, 01 Oct 2024 20:23:43 GMT content-type image/svg+xml last-modified Wed, 24 May 2023 10:11:48 GMT cache-control public, max-age=31536000 x-ms-request-id e026c7db-801e-0052-62f5-0dc801000000 accept-ranges bytes access-control-allow-origin * content-length 1435 x-azure-ref 20241001T202343Z-176d4fdd79cl8dfg32x2wc05c80000000k7000000000r7h3 x-ms-blob-type BlockBlob
GET H3	200	Me.htm Show response ywnjb.vefyofic65.com/ Frame BE78	3 KB 2 KB	559ms 559ms	Document text/html	2606:4700:3032::6815:4e24 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ywnjb.vefyofic65.com/Me.htm?v=3 Requested by Host: aadcdn.msauth.net URL: https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_ELtAAt2Ya8ISGuc0PJcBKA2.js Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3032::6815:4e24 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `cf7ebf9701aa06c9ea9c681e95b1f70ba338f7d7342b4fe459ab07671426ea76` Request headers Referer https://office.vefyofic65.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Response headers cache-control max-age=315360000 cf-cache-status DYNAMIC cf-ray 8cbf2c0e194d3a8a-FRA content-encoding br content-type text/html; charset=utf-8 date Tue, 01 Oct 2024 20:23:43 GMT expires Fri, 29 Sep 2034 20:23:43 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} p3p CP="DSP CUR OTPi IND OTRi ONL FIN" ppserver PPV: 30 H: SN1PEPF0002F9B7 V: 0 referrer-policy strict-origin-when-cross-origin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=pCYe%2BWQDXanXN20nKIWSixJcNbv5zigSR2e3d%2F2LguVxJV55LiCEnJIsEmk3vwlL2WbpXx17q1U%2BvTblJgrmNDb4%2Fv%2FZE8X1CfIPV4u9DCxK7x%2FSPXXXwDC34TBfw0Y3XRo4wKQW1A6PZpTnJLzKLk5F4w%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare speculation-rules "/cdn-cgi/speculation" vary Accept-Encoding x-ms-request-id f8aaf953-e827-4f26-a2c9-49a516fbfd1b x-ms-route-info C545_SN1
GET H3	200	speculation ywnjb.vefyofic65.com/cdn-cgi/ Frame BE78	128 B 562 B	36ms 35ms	Other application/speculationrules+json	2606:4700:3032::6815:4e24 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ywnjb.vefyofic65.com/cdn-cgi/speculation Protocol H3 Security QUIC, , AES_128_GCM Server 2606:4700:3032::6815:4e24 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Origin https://ywnjb.vefyofic65.com Referer https://ywnjb.vefyofic65.com/Me.htm?v=3 Response headers nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2kiNwPBikZ693uYZIZ3hIuyWIKtSX7royhkzSxr6eXJ3QIBktc6DOgLqvmqr1rId9LkIJFv0yP2azQE6AUKewaSke7e%2FzckrarovqWaF4bp1ah5o4so%2BsWXFHCdwhmxOlHSEeiEW4syKWIqJyDP1ggNHxA%3D%3D"}],"group":"cf-nel","max_age":604800} cf-ray 8cbf2c119e193a8a-FRA access-control-allow-origin https://ywnjb.vefyofic65.com content-length 128 date Tue, 01 Oct 2024 20:23:43 GMT content-type application/speculationrules+json vary Origin, Accept-Encoding server cloudflare
GET H2	200	convergedlogin_pstringcustomizationhelper_4285088f1dbaf52a876d.js Show response aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/	111 KB 35 KB	29ms 29ms	Script application/x-javascript	2620:1ec:bdf::64 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_4285088f1dbaf52a876d.js Requested by Host: aadcdn.msauth.net URL: https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_ELtAAt2Ya8ISGuc0PJcBKA2.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:bdf::64 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash `ddd0bb1c19b3d2d045bfcde85d2020bba57854c887a6691b66dba3da1bb3afbe` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://office.vefyofic65.com/ Response headers access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip x-ms-version 2009-09-19 etag 0x8DCBD5317AEB807 x-ms-lease-status unlocked x-fd-int-roxy-purgeid 0 x-cache TCP_HIT date Tue, 01 Oct 2024 20:23:43 GMT content-type application/x-javascript last-modified Thu, 15 Aug 2024 17:52:55 GMT cache-control public, max-age=31536000 x-ms-request-id b0620ef3-c01e-0043-72f5-0d52b5000000 accept-ranges bytes access-control-allow-origin * content-length 35168 x-azure-ref 20241001T202343Z-176d4fdd79cl8dfg32x2wc05c80000000k7000000000r7p7 x-ms-blob-type BlockBlob
GET H2	200	signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg aadcdn.msauth.net/shared/1.0/content/images/	2 KB 1 KB	46ms 46ms	Image image/svg+xml	2620:1ec:bdf::64 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:bdf::64 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash `8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Referer https://office.vefyofic65.com/ Response headers access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip x-ms-version 2009-09-19 etag 0x8DB5C3F49ED96E0 x-ms-lease-status unlocked x-fd-int-roxy-purgeid 4554691 x-cache TCP_HIT date Tue, 01 Oct 2024 20:23:43 GMT content-type image/svg+xml last-modified Wed, 24 May 2023 10:11:49 GMT cache-control public, max-age=31536000 x-ms-request-id d464a90c-b01e-0059-12f5-0d336a000000 accept-ranges bytes access-control-allow-origin * content-length 621 x-azure-ref 20241001T202343Z-176d4fdd79cl8dfg32x2wc05c80000000k7000000000r7pe x-ms-blob-type BlockBlob

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

15 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.vefyofic65.com/	1970-01-20 23:56:57	Name: 4279-842d Value: 082e264f7cbc8a507f0dff13cac06a5ff55a163e0b80a9d09ab57200e81709a7
office.vefyofic65.com/	1969-12-31 23:59:59	Name: x-ms-gateway-slice Value: estsfd
office.vefyofic65.com/	1969-12-31 23:59:59	Name: stsservicecookie Value: estsfd
react.vefyofic65.com/	1970-01-20 23:57:23	Name: OH.DCAffinity Value: OH-scu
react.vefyofic65.com/	1970-01-21 08:42:30	Name: OH.FLID Value: 8e8296fb-cf87-47e8-b0f6-c0be1851f043
react.vefyofic65.com/	1970-01-20 23:56:55	Name: .AspNetCore.OpenIdConnect.Nonce.hkUv9tDoDBaq7-RcF4gKyyyBpxMmEEUPGekkyxkjya0gxlSPaIDZXZjGkgUcc0KI7URrzFkJBWFdOw-4g6v5yIsVps2oepskmWAgeMqKjCV-Y3GQ8NsD_Tn1lLcTO35pfYptCp9uSziUn8eRVx8at9vq1UaUTH5csK2qClSEbH_9FnpxplaULeCSU6CUIwbcoWYQ2xobM7Srg6AovvLqt7Gs0WVvqYf78uqyOab4IqzQhTxSZNIBkuVxMNg6x5eu Value: N
react.vefyofic65.com/	1970-01-20 23:56:55	Name: .AspNetCore.Correlation.XcFQtmWIqOvEFc0sPpIJIBurzujr2xDVj8qGIw9EKPk Value: N
.vefyofic65.com/	1970-01-21 09:18:30	Name: MUID Value: 25C7743191226F36247A613A90756E16
office.vefyofic65.com/	1970-01-21 00:40:06	Name: buid Value: 0.ARgAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFexTGY5WRbq_yAzgvvyoyrStpJaVEjoCTu5re5sS8AOL4wMqK3nQG1bAmXc7uaUyOnGHQj3LMYVtFXiNoJGVD-rv3l_8iSxWLgd9xxDRnNZyggAA
.office.vefyofic65.com/	1969-12-31 23:59:59	Name: esctx Value: PAQABBwEAAADW6jl31mB3T7ugrWTT8pFe6qv15YT1NxSCiGW_TVU6M1uH1mTDwGIxmDoQHPJqbdVVTHAarz6qxPybhWHlJcHu61nwyenQIuDMHxPqa_JlQArjY_pWRfs-rrLCVmfcG9JCZFzQT-DMPHysa-6lQI3wet91M9ebBpDtH3vQMmyPUQVesg_4lraO0utmma2DZBAgAA
.office.vefyofic65.com/	1969-12-31 23:59:59	Name: esctx-3IsgS0DZ8hQ Value: AQABCQEAAADW6jl31mB3T7ugrWTT8pFe4m8mZRJ8utQHJW-eO0Ix-6oYAQ3uHyP3pqKs7rUh18t8Zw0OAwkk1d1ByiSjBGhPu5aFQ2SWlUpuGn9ctSh8MBLk6Vg8NlTnD4XVoihLoiBdTKcs0GUeNMA85_ATTCzux4RFI9EP49jCGxkXeb7o8iAA
office.vefyofic65.com/	1970-01-21 00:40:06	Name: fpc Value: AmO-Jd0dBj9LsqSMo9kny5y8Ae7AAQAAAE1Rjt4OAAAA
.office.vefyofic65.com/	1970-01-21 09:18:33	Name: brcap Value: 0
.ywnjb.vefyofic65.com/	1969-12-31 23:59:59	Name: uaid Value: 1f90100f92bb4be0b23b16274c9b1dba
.ywnjb.vefyofic65.com/	1969-12-31 23:59:59	Name: MSPRequ Value: id=N&lt=1727814223&co=2

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://office.vefyofic65.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638634110214868964.OGMyMDVmZTItNzZkNS00ZjMyLTkzMzEtODZhMzg0ZWFmOTI3NDIyMzk1NzUtMGFlZS00NGM1LWI1NDktYzZhMjk3YmM2MWRh&ui_locales=de-DE&mkt=de-DE&client-request-id=c3e3b833-649e-4d6a-8b51-1f856f7ddec4&state=aZaqaGZu2kF4pUPl-YQZH6iMrACfz9pLm252M14Lwm2l8Vdmzg3Zt7LbrPM_o6CMiOc5fwlLwI3Z5_4rYlTnxCKhSl5QJ7OI5m5U4WcqkGTeJaWoOSlN3UWVThfOfAgMWjwctrAHSrZwQRJRN0dfSEQuh0c17y_zWr9VMivPGi7t84WupH2I0D3777lFpNc9pPpMSRpy4Ex4p1T365_71Ah9vussM_ra4f-cf_dlL3fSKakbgW3-dBKk0JCfR3kwOeheHQlbPMSrYQZZpZxuOg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msauth.net
office.vefyofic65.com
qrco.de
react.vefyofic65.com
ywnjb.vefyofic65.com
18.173.187.101
2606:4700:3032::6815:4e24
2620:1ec:bdf::64
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0e29d2dd543004c71ec49850d657e5adcc7a06084e0f23de60ec57ce8f2d80e5
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d
1f8ceb44fe7cfcf7e71dbd5122210335ca3821d697a851d2900b95af7d92d69d
7dc87d100ffda0b44300291491bbe7ac8a6eae94937ccec0494d5f154c07c3a0
8737d721808655f37b333f08a90185699e7e8b9bdaaa15cdb63c8448b426f95d
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21
a46201581a7c7c667fd42787cd1e9adf2f6bf809efb7596e61a03e8dba9ada13
b9df4bf16fcb24c8da35cf1a1e891f5a4c8d4bceb89a7cf1ffd5a0f29a6d43ba
bc6804d058d5bd5b24fc04e479fc8973bef5d3efeafaa9c19c60a009bf0fac0b
cf7ebf9701aa06c9ea9c681e95b1f70ba338f7d7342b4fe459ab07671426ea76
da4a8df0c326292b5bee9c732b3c962fd67aaf2f99d850f1bf65068d573c5619
ddd0bb1c19b3d2d045bfcde85d2020bba57854c887a6691b66dba3da1bb3afbe
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

office.vefyofic65.com Open in urlscan Pro 2606:4700:3032::6815:4e24 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

17 Requests

100 %HTTPS

67 %IPv6

3 Domains

5 Subdomains

2 IPs

1 Countries

363 kBTransfer

1215 kBSize

15 Cookies

4 Outgoing links

Page URL History

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

22 JavaScript Global Variables

15 Cookies

1 Console Messages

Indicators

office.vefyofic65.com Open in urlscan Pro
2606:4700:3032::6815:4e24 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

100 %
HTTPS

67 %
IPv6

3
Domains

5
Subdomains

2
IPs

1
Countries

363 kB
Transfer

1215 kB
Size

15
Cookies

17 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!