login.microsoftonline.us.office.rp1.abangaritest.govshn.net Open in urlscan Pro
52.222.91.178  Malicious Activity! Public Scan

3 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request authorize Show response login.microsoftonline.us.office.rp1.abangaritest.govshn.net/organizations/oauth2/v2.0/	192 KB 50 KB	525ms 224ms	Document text/html	52.222.91.178 AMAZON EXPANSION
General Check archive.org Show headers Download Go to Full URL https://login.microsoftonline.us.office.rp1.abangaritest.govshn.net/organizations/oauth2/v2.0/authorize?response_type=id_token&scope=openid%20profile&client_id=5e3ce6c0-2b1f-4285-8d4b-75ee78787346&redirect_uri=https://gov.teams.microsoft.us.office.rp1.abangaritest.govshn.net/go&state=eyJpZCI6IjAwMTY4OWQzLWFhNTgtNDRhNi1hZmVhLTA5ODY5YjJmOTY1OSIsInRzIjoxNjQyOTAwNjMyLCJtZXRob2QiOiJyZWRpcmVjdEludGVyYWN0aW9uIn0=&nonce=b1748f17-4eb1-4c58-ba32-5270365b1cbd&client_info=1&x-client-SKU=MSAL.JS&x-client-Ver=1.3.4&client-request-id=a2770175-d1d8-4180-8c7e-b45d56b84e91&response_mode=fragment&sso_reload=true Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.222.91.178 Boardman, United States, ASN8987 (AMAZON EXPANSION, IE), Reverse DNS ec2-52-222-91-178.us-gov-west-1.compute.amazonaws.com Software nginx / Resource Hash a3eb7fe6af3154c27ebe7c5e7651123268996ac520afee9024829d1af379bd1f Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Accept-Language en-US,en;q=0.9 Response headers Server nginx Date Wed, 26 Jan 2022 01:22:02 GMT Content-Type text/html; charset=utf-8 Content-Length 48978 Connection keep-alive Cache-Control no-store, no-cache Content-Encoding gzip Expires -1 Link <https://aadcdn.msftauth.net>; rel=preconnect; crossorigin <https://aadcdn.msftauth.net>; rel=dns-prefetch <https://aadcdn.msauth.net>; rel=dns-prefetch P3P CP="DSP CUR OTPi IND OTRi ONL FIN" Pragma no-cache Referrer-Policy strict-origin-when-cross-origin Strict-Transport-Security max-age=31536000; includeSubDomains Vary Accept-Encoding X-Content-Type-Options nosniff X-DNS-Prefetch-Control on X-Frame-Options DENY x-ms-clitelem 1,0,0,, x-ms-ests-server 2.1.12261.22 - UST1 ProdSlices x-ms-request-id 9c04fe5e-8aa0-4444-9b40-090f9d9a1900 X-Robots-Tag none X-SkyHigh-Version BuildNumber=4, BuildDate=2021-10-20 16:58
GET H/1.1	200 OK	Me.htm login.live.com/	0 0	115ms 24ms	Other text/html	20.190.152.19 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://login.live.com/Me.htm?v=3 Requested by Host: login.microsoftonline.us.office.rp1.abangaritest.govshn.net URL: https://login.microsoftonline.us.office.rp1.abangaritest.govshn.net/organizations/oauth2/v2.0/authorize?response_type=id_token&scope=openid%20profile&client_id=5e3ce6c0-2b1f-4285-8d4b-75ee78787346&redirect_uri=https://gov.teams.microsoft.us.office.rp1.abangaritest.govshn.net/go&state=eyJpZCI6IjAwMTY4OWQzLWFhNTgtNDRhNi1hZmVhLTA5ODY5YjJmOTY1OSIsInRzIjoxNjQyOTAwNjMyLCJtZXRob2QiOiJyZWRpcmVjdEludGVyYWN0aW9uIn0=&nonce=b1748f17-4eb1-4c58-ba32-5270365b1cbd&client_info=1&x-client-SKU=MSAL.JS&x-client-Ver=1.3.4&client-request-id=a2770175-d1d8-4180-8c7e-b45d56b84e91&response_mode=fragment&sso_reload=true Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 20.190.152.19 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash Request headers Accept-Language en-US,en;q=0.9 Referer https://login.microsoftonline.us.office.rp1.abangaritest.govshn.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers
GET H/1.1	200 OK	ConvergedLogin_PCore_a6PeIgafSneuouox-qU5OA2.js Show response aadcdn.msftauth.net.office.rp1.abangaritest.govshn.net/shared/1.0/content/js/	459 KB 127 KB	376ms 134ms	Script application/x-javascript	15.200.226.212 AMAZON EXPANSION
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net.office.rp1.abangaritest.govshn.net/shared/1.0/content/js/ConvergedLogin_PCore_a6PeIgafSneuouox-qU5OA2.js Requested by Host: login.microsoftonline.us.office.rp1.abangaritest.govshn.net URL: https://login.microsoftonline.us.office.rp1.abangaritest.govshn.net/organizations/oauth2/v2.0/authorize?response_type=id_token&scope=openid%20profile&client_id=5e3ce6c0-2b1f-4285-8d4b-75ee78787346&redirect_uri=https://gov.teams.microsoft.us.office.rp1.abangaritest.govshn.net/go&state=eyJpZCI6IjAwMTY4OWQzLWFhNTgtNDRhNi1hZmVhLTA5ODY5YjJmOTY1OSIsInRzIjoxNjQyOTAwNjMyLCJtZXRob2QiOiJyZWRpcmVjdEludGVyYWN0aW9uIn0=&nonce=b1748f17-4eb1-4c58-ba32-5270365b1cbd&client_info=1&x-client-SKU=MSAL.JS&x-client-Ver=1.3.4&client-request-id=a2770175-d1d8-4180-8c7e-b45d56b84e91&response_mode=fragment&sso_reload=true Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 15.200.226.212 Boardman, United States, ASN8987 (AMAZON EXPANSION, IE), Reverse DNS ec2-15-200-226-212.us-gov-west-1.compute.amazonaws.com Software nginx / Resource Hash 341cf2104d8ab582b1fbede9700b11ea157a57fd78828cd7574a4b7e5de2e3cd Request headers Referer https://login.microsoftonline.us.office.rp1.abangaritest.govshn.net/ Origin https://login.microsoftonline.us.office.rp1.abangaritest.govshn.net Accept-Language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers x-ms-blob-type BlockBlob Date Wed, 26 Jan 2022 01:22:03 GMT Content-Encoding gzip Content-MD5 e+GEpArZIh9idGnWSOj0zg== Age 4160446 X-Cache HIT Connection keep-alive Content-Length 128688 x-ms-lease-status unlocked Last-Modified Thu, 04 Nov 2021 21:02:14 GMT Server nginx Etag 0x8D99FD6608B3F3E Vary Accept-Encoding Content-Type application/x-javascript Access-Control-Allow-Origin * x-ms-request-id 2bbd319f-001e-000d-1e7c-ecec0b000000 Access-Control-Expose-Headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Cache-Control public, max-age=31536000 x-ms-version 2009-09-19 X-SkyHigh-Version BuildNumber=4, BuildDate=2021-10-20 16:58 Accept-Ranges bytes X-Robots-Tag none
GET H/1.1	200 OK	oneDs_472fa3a12b65cf387ccd.js Show response aadcdn.msftauth.net.office.rp1.abangaritest.govshn.net/shared/1.0/content/js/	78 KB 26 KB	334ms 99ms	Script application/x-javascript	15.200.226.212 AMAZON EXPANSION
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net.office.rp1.abangaritest.govshn.net/shared/1.0/content/js/oneDs_472fa3a12b65cf387ccd.js Requested by Host: aadcdn.msftauth.net.office.rp1.abangaritest.govshn.net URL: https://aadcdn.msftauth.net.office.rp1.abangaritest.govshn.net/shared/1.0/content/js/ConvergedLogin_PCore_a6PeIgafSneuouox-qU5OA2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 15.200.226.212 Boardman, United States, ASN8987 (AMAZON EXPANSION, IE), Reverse DNS ec2-15-200-226-212.us-gov-west-1.compute.amazonaws.com Software nginx / Resource Hash 235b558b77ab36f63c1439a68ac2410aaf8f42f7b9c93c0bfdc9af662abab8b6 Request headers Accept-Language en-US,en;q=0.9 Referer https://login.microsoftonline.us.office.rp1.abangaritest.govshn.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers x-ms-blob-type BlockBlob Date Wed, 26 Jan 2022 01:22:03 GMT Content-Encoding gzip Content-MD5 xAmVJ4UrtXATagLD0tDXoQ== Age 8069344 X-Cache HIT Connection keep-alive Content-Length 26117 x-ms-lease-status unlocked Last-Modified Thu, 21 Oct 2021 01:02:25 GMT Server nginx Etag 0x8D9942E72241B02 Vary Accept-Encoding Content-Type application/x-javascript Access-Control-Allow-Origin * x-ms-request-id 69741d16-201e-003e-2aef-c8de12000000 Access-Control-Expose-Headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Cache-Control public, max-age=31536000 x-ms-version 2009-09-19 X-SkyHigh-Version BuildNumber=4, BuildDate=2021-10-20 16:58 Accept-Ranges bytes X-Robots-Tag none
GET H/1.1	200 OK	converged.v2.login.min_kfhrfyfy-sm2tmkm5ficcw2.css aadcdn.msftauth.net.office.rp1.abangaritest.govshn.net/ests/2.1/content/cdnbundles/	0 20 KB	343ms 93ms	Other text/css	15.200.226.212 AMAZON EXPANSION
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net.office.rp1.abangaritest.govshn.net/ests/2.1/content/cdnbundles/converged.v2.login.min_kfhrfyfy-sm2tmkm5ficcw2.css Requested by Host: login.microsoftonline.us.office.rp1.abangaritest.govshn.net URL: https://login.microsoftonline.us.office.rp1.abangaritest.govshn.net/organizations/oauth2/v2.0/authorize?response_type=id_token&scope=openid%20profile&client_id=5e3ce6c0-2b1f-4285-8d4b-75ee78787346&redirect_uri=https://gov.teams.microsoft.us.office.rp1.abangaritest.govshn.net/go&state=eyJpZCI6IjAwMTY4OWQzLWFhNTgtNDRhNi1hZmVhLTA5ODY5YjJmOTY1OSIsInRzIjoxNjQyOTAwNjMyLCJtZXRob2QiOiJyZWRpcmVjdEludGVyYWN0aW9uIn0=&nonce=b1748f17-4eb1-4c58-ba32-5270365b1cbd&client_info=1&x-client-SKU=MSAL.JS&x-client-Ver=1.3.4&client-request-id=a2770175-d1d8-4180-8c7e-b45d56b84e91&response_mode=fragment&sso_reload=true Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 15.200.226.212 Boardman, United States, ASN8987 (AMAZON EXPANSION, IE), Reverse DNS ec2-15-200-226-212.us-gov-west-1.compute.amazonaws.com Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language en-US,en;q=0.9 Referer https://login.microsoftonline.us.office.rp1.abangaritest.govshn.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers x-ms-blob-type BlockBlob Date Wed, 26 Jan 2022 01:22:03 GMT Content-Encoding gzip Content-MD5 0O2H9juGYL0zkzcYWr0NIg== Age 9884652 X-Cache HIT Connection keep-alive Content-Length 19877 x-ms-lease-status unlocked Last-Modified Tue, 28 Sep 2021 21:42:58 GMT Server nginx Etag 0x8D982C8F03AF4D4 Vary Accept-Encoding Content-Type text/css Access-Control-Allow-Origin * x-ms-request-id 9a234756-201e-005a-1c6c-b8b74d000000 Access-Control-Expose-Headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Cache-Control public, max-age=31536000 x-ms-version 2009-09-19 X-SkyHigh-Version BuildNumber=4, BuildDate=2021-10-20 16:58 Accept-Ranges bytes X-Robots-Tag none
GET H/1.1	200 OK	ux.converged.login.strings-en.min_o71-iz4tb7logt_eqer98w2.js aadcdn.msftauth.net.office.rp1.abangaritest.govshn.net/ests/2.1/content/cdnbundles/	0 13 KB	362ms 93ms	Other application/x-javascript	15.200.226.212 AMAZON EXPANSION
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net.office.rp1.abangaritest.govshn.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_o71-iz4tb7logt_eqer98w2.js Requested by Host: login.microsoftonline.us.office.rp1.abangaritest.govshn.net URL: https://login.microsoftonline.us.office.rp1.abangaritest.govshn.net/organizations/oauth2/v2.0/authorize?response_type=id_token&scope=openid%20profile&client_id=5e3ce6c0-2b1f-4285-8d4b-75ee78787346&redirect_uri=https://gov.teams.microsoft.us.office.rp1.abangaritest.govshn.net/go&state=eyJpZCI6IjAwMTY4OWQzLWFhNTgtNDRhNi1hZmVhLTA5ODY5YjJmOTY1OSIsInRzIjoxNjQyOTAwNjMyLCJtZXRob2QiOiJyZWRpcmVjdEludGVyYWN0aW9uIn0=&nonce=b1748f17-4eb1-4c58-ba32-5270365b1cbd&client_info=1&x-client-SKU=MSAL.JS&x-client-Ver=1.3.4&client-request-id=a2770175-d1d8-4180-8c7e-b45d56b84e91&response_mode=fragment&sso_reload=true Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 15.200.226.212 Boardman, United States, ASN8987 (AMAZON EXPANSION, IE), Reverse DNS ec2-15-200-226-212.us-gov-west-1.compute.amazonaws.com Software nginx / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept-Language en-US,en;q=0.9 Referer https://login.microsoftonline.us.office.rp1.abangaritest.govshn.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers x-ms-blob-type BlockBlob Date Wed, 26 Jan 2022 01:22:03 GMT Content-Encoding gzip Content-MD5 TYaL+AGTXfxbZBdZyg21Og== Age 8069690 X-Cache HIT Connection keep-alive Content-Length 12552 x-ms-lease-status unlocked Last-Modified Tue, 19 Oct 2021 04:06:56 GMT Server nginx Etag 0x8D992B5E40D12D5 Vary Accept-Encoding Content-Type application/x-javascript Access-Control-Allow-Origin * x-ms-request-id f6061721-601e-003c-33ee-c8d37f000000 Access-Control-Expose-Headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Cache-Control public, max-age=31536000 x-ms-version 2009-09-19 X-SkyHigh-Version BuildNumber=4, BuildDate=2021-10-20 16:58 Accept-Ranges bytes X-Robots-Tag none
GET H/1.1	200 OK	2_bc3d32a696895f78c19df6c717586a5d.svg aadcdn.msftauth.net.office.rp1.abangaritest.govshn.net/shared/1.0/content/images/backgrounds/	2 KB 1 KB	327ms 86ms	Image image/svg+xml	15.200.226.212 AMAZON EXPANSION
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msftauth.net.office.rp1.abangaritest.govshn.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 15.200.226.212 Boardman, United States, ASN8987 (AMAZON EXPANSION, IE), Reverse DNS ec2-15-200-226-212.us-gov-west-1.compute.amazonaws.com Software nginx / Resource Hash 0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68 Request headers Accept-Language en-US,en;q=0.9 Referer https://login.microsoftonline.us.office.rp1.abangaritest.govshn.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers x-ms-blob-type BlockBlob Date Wed, 26 Jan 2022 01:22:03 GMT Content-Encoding gzip Content-MD5 DhdidjYrlCeaRJJRG/y9mA== Age 20620380 X-Cache HIT Connection keep-alive Content-Length 673 x-ms-lease-status unlocked Last-Modified Wed, 12 Feb 2020 22:01:50 GMT Server nginx Etag 0x8D7B007297AE131 Vary Accept-Encoding Content-Type image/svg+xml Access-Control-Allow-Origin * x-ms-request-id 700718a4-701e-009b-10c8-564da7000000 Access-Control-Expose-Headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Cache-Control public, max-age=31536000 x-ms-version 2009-09-19 X-SkyHigh-Version BuildNumber=4, BuildDate=2021-10-20 16:58 Accept-Ranges bytes X-Robots-Tag none
GET H/1.1	200 OK	microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg aadcdn.msftauth.net.office.rp1.abangaritest.govshn.net/shared/1.0/content/images/	4 KB 2 KB	297ms 87ms	Image image/svg+xml	15.200.226.212 AMAZON EXPANSION
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msftauth.net.office.rp1.abangaritest.govshn.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 15.200.226.212 Boardman, United States, ASN8987 (AMAZON EXPANSION, IE), Reverse DNS ec2-15-200-226-212.us-gov-west-1.compute.amazonaws.com Software nginx / Resource Hash 04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a Request headers Accept-Language en-US,en;q=0.9 Referer https://login.microsoftonline.us.office.rp1.abangaritest.govshn.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers x-ms-blob-type BlockBlob Date Wed, 26 Jan 2022 01:22:03 GMT Content-Encoding gzip Content-MD5 nzaLxFgP7ZB3dfMcaybWzw== Age 18749861 X-Cache HIT Connection keep-alive Content-Length 1435 x-ms-lease-status unlocked Last-Modified Thu, 16 Jan 2020 00:32:52 GMT Server nginx Etag 0x8D79A1B9F5E121A Vary Accept-Encoding Content-Type image/svg+xml Access-Control-Allow-Origin * x-ms-request-id 06675533-501e-0003-23cb-672de5000000 Access-Control-Expose-Headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Cache-Control public, max-age=31536000 x-ms-version 2009-09-19 X-SkyHigh-Version BuildNumber=4, BuildDate=2021-10-20 16:58 Accept-Ranges bytes X-Robots-Tag none
POST H/1.1	200 OK	reportpageload Show response login.microsoftonline.us.office.rp1.abangaritest.govshn.net/common/instrumentation/	264 B 2 KB	166ms 166ms	XHR application/json	52.222.91.178 AMAZON EXPANSION
General Check archive.org Show headers Download Go to Full URL https://login.microsoftonline.us.office.rp1.abangaritest.govshn.net/common/instrumentation/reportpageload?mkt=en-US Requested by Host: aadcdn.msftauth.net.office.rp1.abangaritest.govshn.net URL: https://aadcdn.msftauth.net.office.rp1.abangaritest.govshn.net/shared/1.0/content/js/ConvergedLogin_PCore_a6PeIgafSneuouox-qU5OA2.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 52.222.91.178 Boardman, United States, ASN8987 (AMAZON EXPANSION, IE), Reverse DNS ec2-52-222-91-178.us-gov-west-1.compute.amazonaws.com Software nginx / Resource Hash cd08195051cff92ac1d3faafbb5d8f79b79f77981624518ec284cbb09b4d5142 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers hpgrequestid 9c04fe5e-8aa0-4444-9b40-090f9d9a1900 Accept-Language en-US,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 client-request-id a2770175-d1d8-4180-8c7e-b45d56b84e91 canary AQABAAAAAgBXxJ9NxOLiQKGXj-vdb8Bdk2fgDtS93v2_V4PljrIhnfNebcyOGGeeOpVVjfh5Lj6pOZMrTtg-pHhi01qA8pIW4e51ro3qToK5nvXG_dF5g6VsFfA3-3vvtOKoOfOwYIKcy7HvzFXRt7WzIG1xKfSaJMxuROmSgvYcHtYPH0Mh-wy56rQt7-nHbHWdMbkJ3FQi_qvYfZVJFE4ZXC8RY__bUhobV0ONF82tc5DkUt75oCAA Content-type application/json; charset=UTF-8 hpgid 1104 Accept application/json Referer https://login.microsoftonline.us.office.rp1.abangaritest.govshn.net/organizations/oauth2/v2.0/authorize?response_type=id_token&scope=openid%20profile&client_id=5e3ce6c0-2b1f-4285-8d4b-75ee78787346&redirect_uri=https://gov.teams.microsoft.us.office.rp1.abangaritest.govshn.net/go&state=eyJpZCI6IjAwMTY4OWQzLWFhNTgtNDRhNi1hZmVhLTA5ODY5YjJmOTY1OSIsInRzIjoxNjQyOTAwNjMyLCJtZXRob2QiOiJyZWRpcmVjdEludGVyYWN0aW9uIn0=&nonce=b1748f17-4eb1-4c58-ba32-5270365b1cbd&client_info=1&x-client-SKU=MSAL.JS&x-client-Ver=1.3.4&client-request-id=a2770175-d1d8-4180-8c7e-b45d56b84e91&response_mode=fragment&sso_reload=true hpgact 1800 Response headers Date Wed, 26 Jan 2022 01:22:03 GMT X-Content-Type-Options nosniff client-request-id a2770175-d1d8-4180-8c7e-b45d56b84e91 P3P CP="DSP CUR OTPi IND OTRi ONL FIN" Connection keep-alive Content-Length 264 Pragma no-cache Referrer-Policy strict-origin-when-cross-origin Server nginx Strict-Transport-Security max-age=31536000; includeSubDomains Access-Control-Allow-Methods POST, OPTIONS Content-Type application/json; charset=utf-8 Access-Control-Allow-Origin https://autologon.microsoft.us.office.rp1.abangaritest.govshn.net/ x-ms-request-id 13bccfaa-7034-42c2-bbbc-d5669f730e00 Cache-Control no-store, no-cache Access-Control-Allow-Credentials true X-SkyHigh-Version BuildNumber=4, BuildDate=2021-10-20 16:58 X-Robots-Tag none x-ms-ests-server 2.1.12261.22 - UST1 ProdSlices Expires -1
GET H/1.1	200 OK	signin-options_4e48046ce74f4b89d45037c90576bfac.svg aadcdn.msftauth.net.office.rp1.abangaritest.govshn.net/shared/1.0/content/images/	2 KB 1 KB	86ms 85ms	Image image/svg+xml	15.200.226.212 AMAZON EXPANSION
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msftauth.net.office.rp1.abangaritest.govshn.net/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 15.200.226.212 Boardman, United States, ASN8987 (AMAZON EXPANSION, IE), Reverse DNS ec2-15-200-226-212.us-gov-west-1.compute.amazonaws.com Software nginx / Resource Hash 8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93 Request headers Accept-Language en-US,en;q=0.9 Referer https://login.microsoftonline.us.office.rp1.abangaritest.govshn.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers x-ms-blob-type BlockBlob Date Wed, 26 Jan 2022 01:22:03 GMT Content-Encoding gzip Content-MD5 R2FAVxfpONfnQAuxVxXbHg== Age 18635340 X-Cache HIT Connection keep-alive Content-Length 621 x-ms-lease-status unlocked Last-Modified Tue, 10 Nov 2020 03:41:05 GMT Server nginx Etag 0x8D8852A740F01B9 Vary Accept-Encoding Content-Type image/svg+xml Access-Control-Allow-Origin * x-ms-request-id e3d8278b-201e-005a-5bd6-68b74d000000 Access-Control-Expose-Headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Cache-Control public, max-age=31536000 x-ms-version 2009-09-19 X-SkyHigh-Version BuildNumber=4, BuildDate=2021-10-20 16:58 Accept-Ranges bytes X-Robots-Tag none
GET H/1.1	200 OK	converged.v2.login.min_kfhrfyfy-sm2tmkm5ficcw2.css aadcdn.msftauth.net.office.rp1.abangaritest.govshn.net/ests/2.1/content/cdnbundles/	0 0	322ms 94ms	Fetch text/css	15.200.226.212 AMAZON EXPANSION
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net.office.rp1.abangaritest.govshn.net/ests/2.1/content/cdnbundles/converged.v2.login.min_kfhrfyfy-sm2tmkm5ficcw2.css Requested by Host: login.microsoftonline.us.office.rp1.abangaritest.govshn.net URL: https://login.microsoftonline.us.office.rp1.abangaritest.govshn.net/organizations/oauth2/v2.0/authorize?response_type=id_token&scope=openid%20profile&client_id=5e3ce6c0-2b1f-4285-8d4b-75ee78787346&redirect_uri=https://gov.teams.microsoft.us.office.rp1.abangaritest.govshn.net/go&state=eyJpZCI6IjAwMTY4OWQzLWFhNTgtNDRhNi1hZmVhLTA5ODY5YjJmOTY1OSIsInRzIjoxNjQyOTAwNjMyLCJtZXRob2QiOiJyZWRpcmVjdEludGVyYWN0aW9uIn0=&nonce=b1748f17-4eb1-4c58-ba32-5270365b1cbd&client_info=1&x-client-SKU=MSAL.JS&x-client-Ver=1.3.4&client-request-id=a2770175-d1d8-4180-8c7e-b45d56b84e91&response_mode=fragment&sso_reload=true Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 15.200.226.212 Boardman, United States, ASN8987 (AMAZON EXPANSION, IE), Reverse DNS ec2-15-200-226-212.us-gov-west-1.compute.amazonaws.com Software nginx / Resource Hash Request headers Accept-Language en-US,en;q=0.9 Referer https://login.microsoftonline.us.office.rp1.abangaritest.govshn.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36 Response headers x-ms-blob-type BlockBlob Date Wed, 26 Jan 2022 01:22:08 GMT Content-Encoding gzip Content-MD5 0O2H9juGYL0zkzcYWr0NIg== Age 9884657 X-Cache HIT Connection keep-alive Content-Length 19877 x-ms-lease-status unlocked Last-Modified Tue, 28 Sep 2021 21:42:58 GMT Server nginx Etag 0x8D982C8F03AF4D4 Vary Accept-Encoding Content-Type text/css Access-Control-Allow-Origin * x-ms-request-id 9a234756-201e-005a-1c6c-b8b74d000000 Access-Control-Expose-Headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Cache-Control public, max-age=31536000 x-ms-version 2009-09-19 X-SkyHigh-Version BuildNumber=4, BuildDate=2021-10-20 16:58 Accept-Ranges bytes X-Robots-Tag none
GET		ux.converged.login.strings-en.min_o71-iz4tb7logt_eqer98w2.js aadcdn.msftauth.net.office.rp1.abangaritest.govshn.net/ests/2.1/content/cdnbundles/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain

aadcdn.msftauth.net.office.rp1.abangaritest.govshn.net

URL

https://aadcdn.msftauth.net.office.rp1.abangaritest.govshn.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_o71-iz4tb7logt_eqer98w2.js

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| $Config object| $Debug object| $Do function| $Loader object| $WebWatson function| GetString function| GetErrorString function| GetUrl object| $B object| ServerData object| webpackJsonp object| ko object| PROOF object| StringRepository boolean| __ConvergedLogin_PCore boolean| __ object| Telemetry object| telemetry_webpackJsonp

9 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			login.microsoftonline.us.office.rp1.abangaritest.govshn.net/	1970-01-20 01:09:12	Name: buid Value: 0.AAAAMe_N-B6jSkuT5F9XHpElWsDmPF4fK4VCjUt17nh4c0YBAAA.AQABAAEAAgBXxJ9NxOLiQKGXj-vdb8BdCpLaU68Lr9DU1KDcsGQ8I9Ds4uNm_ACBsk0L8IaSpJyvjUD0cqlA93RSEw6jOGMqeAiN2sOpM5EI-GgJ5TrcIuPfz4-TNG9MGL0AMCCOIDIgAA
			login.microsoftonline.us.office.rp1.abangaritest.govshn.net/	1970-01-20 01:09:12	Name: fpc Value: ArpOK-wyvD1CnGMbsxIQFQJ81bJ8AQAAADmZgtkOAAAA
			.login.microsoftonline.us.office.rp1.abangaritest.govshn.net/	1969-12-31 23:59:59	Name: esctx Value: AQABAAAAAgBXxJ9NxOLiQKGXj-vdb8BdQ-2kwrtCuXbpBkZ0_5XUADhs_noiIxsMYgxrfVyW1Jf_Fp6KhwE3xk1vWnF_nKb1sNA8UdfvSqC9ecZ3In_d8thnULVW9SxAl49aGs5Eh0yyptPN8CgwhySzXU6O_2snHRGeOlOYUzS_rJlMWQEkkdsgV_ICnJGeSaxFF1f6dMwgAA
			login.microsoftonline.us.office.rp1.abangaritest.govshn.net/	1969-12-31 23:59:59	Name: x-ms-gateway-slice Value: 001
			login.microsoftonline.us.office.rp1.abangaritest.govshn.net/	1969-12-31 23:59:59	Name: stsservicecookie Value: estsusgov
			.login.live.com/	1969-12-31 23:59:59	Name: uaid Value: 423cdc13704c4a84a6b2a5a260131b22
			.login.live.com/	1969-12-31 23:59:59	Name: MSPRequ Value: id=N&lt=1643160122&co=1
			.login.microsoftonline.us.office.rp1.abangaritest.govshn.net/	1970-01-20 09:47:36	Name: brcap Value: 0
			.office.rp1.abangaritest.govshn.net/	1969-12-31 23:59:59	Name: SHN-VH-session Value: 0e1b60df-b4dc-48e2-aca1-bbed0a9d6597|1643161923475

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msftauth.net.office.rp1.abangaritest.govshn.net
login.live.com
login.microsoftonline.us.office.rp1.abangaritest.govshn.net
aadcdn.msftauth.net.office.rp1.abangaritest.govshn.net
15.200.226.212
20.190.152.19
52.222.91.178
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
235b558b77ab36f63c1439a68ac2410aaf8f42f7b9c93c0bfdc9af662abab8b6
341cf2104d8ab582b1fbede9700b11ea157a57fd78828cd7574a4b7e5de2e3cd
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93
a3eb7fe6af3154c27ebe7c5e7651123268996ac520afee9024829d1af379bd1f
cd08195051cff92ac1d3faafbb5d8f79b79f77981624518ec284cbb09b4d5142
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855