myaccount.microstfonline.com Open in urlscan Pro
137.135.72.110  Malicious Activity! Public Scan

Submitted URL: https://portal.login.msclickemail.com/?mfa=THlubi5VcmJhbkBpaHNtYXJraXQuY29t
Effective URL: https://myaccount.microstfonline.com/changePasswd/?mfa=THlubi5VcmJhbkBpaHNtYXJraXQuY29t&redirect=https://login.microsoftonline.com/co...
Submission: On April 25 via manual from AP

Summary

This website contacted 3 IPs in 1 countries across 4 domains to perform 16 HTTP transactions. The main IP is 137.135.72.110, located in Washington, United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US. The main domain is myaccount.microstfonline.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on April 25th 2019. Valid for: 3 months.
This is the only time myaccount.microstfonline.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: OneDrive (Online) Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
3 4 137.135.72.110 8075 (MICROSOFT...)
14 2620:1ec:bdf::10 8068 (MICROSOFT...)
1 2603:1026:6:2... 8075 (MICROSOFT...)
16 3
Domain Requested by
14 aadcdn.msauth.net myaccount.microstfonline.com
aadcdn.msauth.net
3 myaccount.microstfonline.com 2 redirects
1 outlook.office365.com aadcdn.msauth.net
1 portal.login.msclickemail.com 1 redirects
16 4

This site contains links to these domains. Also see Links.

Domain
www.microsoft.com
privacy.microsoft.com
Subject Issuer Validity Valid
myaccount.microstfonline.com
Sectigo RSA Domain Validation Secure Server CA
2019-04-25 -
2019-08-03
3 months crt.sh
aadcdn.msauth.net
Microsoft IT TLS CA 4
2018-11-07 -
2020-11-07
2 years crt.sh
outlook.com
DigiCert Cloud Services CA-1
2018-10-03 -
2020-10-03
2 years crt.sh

This page contains 2 frames:

Primary Page: https://myaccount.microstfonline.com/changePasswd/?mfa=THlubi5VcmJhbkBpaHNtYXJraXQuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
Frame ID: 0A09B7EBF66CFF6848CAAB39467D7D7F
Requests: 15 HTTP requests in this frame

Frame: https://outlook.office365.com/owa/prefetch.aspx
Frame ID: 303A641B2514048344B53BCEF27A3A98
Requests: 1 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://portal.login.msclickemail.com/?mfa=THlubi5VcmJhbkBpaHNtYXJraXQuY29t HTTP 302
    https://myaccount.microstfonline.com/?mfa=THlubi5VcmJhbkBpaHNtYXJraXQuY29t HTTP 302
    https://myaccount.microstfonline.com/changePasswd?mfa=THlubi5VcmJhbkBpaHNtYXJraXQuY29t&redirect=https://login.mic... HTTP 301
    https://myaccount.microstfonline.com/changePasswd/?mfa=THlubi5VcmJhbkBpaHNtYXJraXQuY29t&redirect=https://login.mi... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /IIS(?:\/([\d.]+))?/i

Overall confidence: 100%
Detected patterns
  • headers server /IIS(?:\/([\d.]+))?/i

Overall confidence: 100%
Detected patterns
  • env /^ko$/i

Overall confidence: 100%
Detected patterns
  • env /^webpackJsonp$/i

Page Statistics

16
Requests

100 %
HTTPS

67 %
IPv6

4
Domains

4
Subdomains

3
IPs

1
Countries

496 kB
Transfer

1003 kB
Size

6
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://portal.login.msclickemail.com/?mfa=THlubi5VcmJhbkBpaHNtYXJraXQuY29t HTTP 302
    https://myaccount.microstfonline.com/?mfa=THlubi5VcmJhbkBpaHNtYXJraXQuY29t HTTP 302
    https://myaccount.microstfonline.com/changePasswd?mfa=THlubi5VcmJhbkBpaHNtYXJraXQuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri= HTTP 301
    https://myaccount.microstfonline.com/changePasswd/?mfa=THlubi5VcmJhbkBpaHNtYXJraXQuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
myaccount.microstfonline.com/changePasswd/
Redirect Chain
  • https://portal.login.msclickemail.com/?mfa=THlubi5VcmJhbkBpaHNtYXJraXQuY29t
  • https://myaccount.microstfonline.com/?mfa=THlubi5VcmJhbkBpaHNtYXJraXQuY29t
  • https://myaccount.microstfonline.com/changePasswd?mfa=THlubi5VcmJhbkBpaHNtYXJraXQuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000...
  • https://myaccount.microstfonline.com/changePasswd/?mfa=THlubi5VcmJhbkBpaHNtYXJraXQuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-00000000...
29 KB
29 KB
Document
General
Full URL
https://myaccount.microstfonline.com/changePasswd/?mfa=THlubi5VcmJhbkBpaHNtYXJraXQuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
137.135.72.110 Washington, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / PHP/7.2.14
Resource Hash
47e8c3ef00903419ef8f3b695d613d4764ce1bddb8e3f79c4e7ddd81d33df7e6

Request headers

:method
GET
:authority
myaccount.microstfonline.com
:scheme
https
:path
/changePasswd/?mfa=THlubi5VcmJhbkBpaHNtYXJraXQuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
accept-encoding
gzip, deflate, br
cookie
PHPSESSID=cn6ghe7nkd3p46ehs0p9g6j80g
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

status
200
cache-control
no-store, no-cache, must-revalidate
pragma
no-cache
content-type
text/html;charset=utf-8
expires
Thu, 19 Nov 1981 08:52:00 GMT
server
Microsoft-IIS/10.0
x-powered-by
PHP/7.2.14
date
Thu, 25 Apr 2019 23:29:57 GMT
content-length
29995

Redirect headers

status
301
content-type
text/html; charset=UTF-8
location
https://myaccount.microstfonline.com/changePasswd/?mfa=THlubi5VcmJhbkBpaHNtYXJraXQuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
server
Microsoft-IIS/10.0
date
Thu, 25 Apr 2019 23:29:57 GMT
content-length
346
converged.v2.login.min_tbsima5-c7pluzuyz0ftda2.css
aadcdn.msauth.net/ests/2.1/content/cdnbundles/
99 KB
19 KB
Stylesheet
General
Full URL
https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_tbsima5-c7pluzuyz0ftda2.css
Requested by
Host: myaccount.microstfonline.com
URL: https://myaccount.microstfonline.com/changePasswd/?mfa=THlubi5VcmJhbkBpaHNtYXJraXQuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:bdf::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
10c50b88ebf99fdf813a4cce86ba218a6e2ea3d266146520529f1e1bddc5ebd3

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://myaccount.microstfonline.com/changePasswd/?mfa=THlubi5VcmJhbkBpaHNtYXJraXQuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
Origin
https://myaccount.microstfonline.com

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 25 Apr 2019 23:30:02 GMT
content-encoding
gzip
x-azure-ref-originshield
0M1K+XAAAAAATEf5ous61S7l+XwMCvhZbQU1TRURHRTA0MDkAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-md5
lq2911TWkRoV0O0xE9QtAg==
status
200
content-length
18705
x-ms-lease-status
unlocked
last-modified
Thu, 28 Mar 2019 22:16:11 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
0x8D6B3CAFC5DC39D
x-azure-ref
0+kLCXAAAAADsTNrCpQBYTZkg5YEqy2LOVklFRURHRTAyMTIAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
73abf0a1-701e-0064-79ff-f6d959000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
convergedlogin_pcore.min_du3a8nubtxbbr0ut5mtmbq2.js
aadcdn.msauth.net/ests/2.1/content/cdnbundles/
548 KB
143 KB
Script
General
Full URL
https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/convergedlogin_pcore.min_du3a8nubtxbbr0ut5mtmbq2.js
Requested by
Host: myaccount.microstfonline.com
URL: https://myaccount.microstfonline.com/changePasswd/?mfa=THlubi5VcmJhbkBpaHNtYXJraXQuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:bdf::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
374d28c33fd449b3cfcc7c7118d40757a9bb40ee5a28ee281a328939aed9ce01

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://myaccount.microstfonline.com/changePasswd/?mfa=THlubi5VcmJhbkBpaHNtYXJraXQuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
Origin
https://myaccount.microstfonline.com

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 25 Apr 2019 23:30:02 GMT
content-encoding
gzip
x-azure-ref-originshield
0bmK+XAAAAAAChb69PoIyRLAXbPfPUswaQU1TRURHRTA0MDcAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-md5
v9JXLX6IN8bD9tEOiWiIaw==
status
200
content-length
146178
x-ms-lease-status
unlocked
last-modified
Sat, 20 Apr 2019 00:33:19 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
0x8D6C527C94296E7
x-azure-ref
0+kLCXAAAAAC/5Jjfcad2TrKxLEuEHWHWVklFRURHRTAyMTIAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
8f3b6048-b01e-0010-623a-f98751000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
convergedloginpaginatedstrings-en.min_kxotwlssckntce4-jjxrfw2.js
aadcdn.msauth.net/ests/2.1/content/cdnbundles/
31 KB
11 KB
Script
General
Full URL
https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/convergedloginpaginatedstrings-en.min_kxotwlssckntce4-jjxrfw2.js
Requested by
Host: myaccount.microstfonline.com
URL: https://myaccount.microstfonline.com/changePasswd/?mfa=THlubi5VcmJhbkBpaHNtYXJraXQuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:bdf::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
4c0aa35957f5768970ce5569fa59434854a3ad180a9bba1aecc81bc0e0addacc

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://myaccount.microstfonline.com/changePasswd/?mfa=THlubi5VcmJhbkBpaHNtYXJraXQuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
Origin
https://myaccount.microstfonline.com

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 25 Apr 2019 23:30:02 GMT
content-encoding
gzip
x-azure-ref-originshield
0Hvi9XAAAAAAIo8Z498KgTLVY3BxLIPTUQU1TRURHRTA0MTEAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-md5
2KfbKwF8su50DeB6Mr5RxQ==
status
200
content-length
10106
x-ms-lease-status
unlocked
last-modified
Thu, 04 Apr 2019 21:21:57 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
0x8D6B94391491758
x-azure-ref
0+kLCXAAAAAAeQjYSkVUkQJfFVvOMMq1BVklFRURHRTAyMTIAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
e3e2e8af-601e-0029-24f1-f6d553000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
Cookie set prefetch.aspx
outlook.office365.com/owa/ Frame 303A
0
0
Document
General
Full URL
https://outlook.office365.com/owa/prefetch.aspx
Requested by
Host: aadcdn.msauth.net
URL: https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/convergedlogin_pcore.min_du3a8nubtxbbr0ut5mtmbq2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2603:1026:6:2d::2 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Host
outlook.office365.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Referer
https://myaccount.microstfonline.com/changePasswd/?mfa=THlubi5VcmJhbkBpaHNtYXJraXQuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://myaccount.microstfonline.com/changePasswd/?mfa=THlubi5VcmJhbkBpaHNtYXJraXQuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=

Response headers

Cache-Control
private, no-store
Content-Length
1241
Content-Type
text/html; charset=utf-8
Content-Encoding
gzip
Vary
Accept-Encoding
Server
Microsoft-IIS/10.0
request-id
e72d7834-d233-439e-9965-583f9f987110
X-CalculatedFETarget
AM4PR0701CU001.internal.outlook.com
X-BackEndHttpStatus
200 200
Set-Cookie
ClientId=3C3A879191C8406BB829C632983B0206; expires=Sat, 25-Apr-2020 23:30:02 GMT; path=/; secure ClientId=3C3A879191C8406BB829C632983B0206; expires=Sat, 25-Apr-2020 23:30:02 GMT; path=/; secure OIDC=1; expires=Fri, 25-Oct-2019 23:30:02 GMT; path=/; secure; HttpOnly OWAPF=v:16.3012.3.2690869&l:mouse; path=/
X-FEProxyInfo
AM4PR0701CA0009.EURPRD07.PROD.OUTLOOK.COM
X-CalculatedBETarget
AM0PR07MB6050.eurprd07.prod.outlook.com
X-RUM-Validated
1
X-Content-Type-Options
nosniff
X-BeSku
WCS5
X-OWA-Version
15.20.1835.13
X-OWA-DiagnosticsInfo
2;0;0
X-BackEnd-Begin
2019-04-25T23:30:02.537
X-BackEnd-End
2019-04-25T23:30:02.540
X-DiagInfo
AM0PR07MB6050
X-BEServer
AM0PR07MB6050
X-UA-Compatible
IE=EmulateIE7
Strict-Transport-Security
max-age=31536000; includeSubDomains max-age=31536000; includeSubDomains
X-FEServer
AM4PR0701CA0009 DB6PR07CA0003
Date
Thu, 25 Apr 2019 23:30:02 GMT
microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
aadcdn.msauth.net/ests/2.1/content/images/
4 KB
2 KB
Image
General
Full URL
https://aadcdn.msauth.net/ests/2.1/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:bdf::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

Referer
https://myaccount.microstfonline.com/changePasswd/?mfa=THlubi5VcmJhbkBpaHNtYXJraXQuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 25 Apr 2019 23:30:02 GMT
content-encoding
gzip
x-azure-ref-originshield
0xyu+XAAAAACeazk1Uo81TpDShYBgoGK2QU1TRURHRTA1MDgAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-md5
nzaLxFgP7ZB3dfMcaybWzw==
status
200
content-length
1435
x-ms-lease-status
unlocked
last-modified
Fri, 02 Nov 2018 20:25:31 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
0x8D64101560D5E58
x-azure-ref
0+kLCXAAAAACtr8m+zVuaQ7jjpc/hS/Z/VklFRURHRTAyMTgAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
7ff7636d-e01e-000d-5805-f7e868000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=604800
x-ms-version
2009-09-19
ellipsis_white_5ac590ee72bfe06a7cecfd75b588ad73.svg
aadcdn.msauth.net/ests/2.1/content/images/
915 B
558 B
Image
General
Full URL
https://aadcdn.msauth.net/ests/2.1/content/images/ellipsis_white_5ac590ee72bfe06a7cecfd75b588ad73.svg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:bdf::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea

Request headers

Referer
https://myaccount.microstfonline.com/changePasswd/?mfa=THlubi5VcmJhbkBpaHNtYXJraXQuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 25 Apr 2019 23:30:02 GMT
content-encoding
gzip
x-azure-ref-originshield
0CGO+XAAAAABbuJ4gPwTkTKkdDaq/GA2JQU1TRURHRTA0MTQAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-md5
HMwsHhNXdtrfirQDkzcqMA==
status
200
content-length
263
x-ms-lease-status
unlocked
last-modified
Fri, 02 Nov 2018 20:25:24 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
0x8D64101521A1ED5
x-azure-ref
0+kLCXAAAAAB8toaRC4QSS78iK4rLDMZmVklFRURHRTAyMTgAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
ec5add20-201e-002d-074c-f9795b000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=604800
x-ms-version
2009-09-19
ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c.svg
aadcdn.msauth.net/ests/2.1/content/images/
915 B
561 B
Image
General
Full URL
https://aadcdn.msauth.net/ests/2.1/content/images/ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c.svg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:bdf::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
16c3f6531d0fa5b4d16e82abf066233b2a9f284c068c663699313c09f5e8d6e6

Request headers

Referer
https://myaccount.microstfonline.com/changePasswd/?mfa=THlubi5VcmJhbkBpaHNtYXJraXQuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 25 Apr 2019 23:30:02 GMT
content-encoding
gzip
x-azure-ref-originshield
0z02+XAAAAADZRVD9DMGURrClkklz7d8jQU1TRURHRTA1MDgAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-md5
/a3y/mpA+HRaVAiPACrsog==
status
200
content-length
263
x-ms-lease-status
unlocked
last-modified
Fri, 02 Nov 2018 20:25:23 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
0x8D641015168A4FB
x-azure-ref
0+kLCXAAAAAAMYdpfeBNqRK5PctdLUo7qVklFRURHRTAyMTgAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
936a846b-a01e-0019-5d49-f9f442000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=604800
x-ms-version
2009-09-19
33-small_138bcee624fa04ef9b75e86211a9fe0d.jpg
aadcdn.msauth.net/ests/2.1/content/images/appbackgrounds/
3 KB
3 KB
Image
General
Full URL
https://aadcdn.msauth.net/ests/2.1/content/images/appbackgrounds/33-small_138bcee624fa04ef9b75e86211a9fe0d.jpg
Requested by
Host: aadcdn.msauth.net
URL: https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/convergedlogin_pcore.min_du3a8nubtxbbr0ut5mtmbq2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:bdf::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
f89e908280791803bbf1f33b596ff4a2179b355a8e15ad02ebaa2b1da11127ea

Request headers

Referer
https://myaccount.microstfonline.com/changePasswd/?mfa=THlubi5VcmJhbkBpaHNtYXJraXQuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 25 Apr 2019 23:30:02 GMT
x-azure-ref-originshield
0sS2+XAAAAACXFPwRZz1sSqFjM2lXKIQVQU1TRURHRTA2MjAAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-md5
E4vO5iT6BO+bdehiEan+DQ==
status
200
content-length
3006
x-ms-lease-status
unlocked
last-modified
Wed, 13 Mar 2019 20:50:28 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
0x8D6A7F58641DEFF
x-azure-ref
0+kLCXAAAAABSUXgTKCzNTKbGpiuN0qbMVklFRURHRTAyMTgAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-type
image/jpeg
access-control-allow-origin
*
x-ms-request-id
c7d4baea-701e-0048-79dc-f6bc73000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
33_a5dbd4393ff6a725c7e62b61df7e72f0.jpg
aadcdn.msauth.net/ests/2.1/content/images/appbackgrounds/
277 KB
277 KB
Image
General
Full URL
https://aadcdn.msauth.net/ests/2.1/content/images/appbackgrounds/33_a5dbd4393ff6a725c7e62b61df7e72f0.jpg
Requested by
Host: aadcdn.msauth.net
URL: https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/convergedlogin_pcore.min_du3a8nubtxbbr0ut5mtmbq2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:bdf::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb

Request headers

Referer
https://myaccount.microstfonline.com/changePasswd/?mfa=THlubi5VcmJhbkBpaHNtYXJraXQuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 25 Apr 2019 23:30:02 GMT
x-azure-ref-originshield
07w6+XAAAAACHMM+Ece81QqG4mhI+gu97QU1TRURHRTA2MDYAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-md5
pdvUOT/2pyXH5ith335y8A==
status
200
content-length
283351
x-ms-lease-status
unlocked
last-modified
Wed, 13 Mar 2019 20:50:28 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
0x8D6A7F5866686F7
x-azure-ref
0+kLCXAAAAAAemjg6Db4tRoNm6vMekADCVklFRURHRTAyMTgAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-type
image/jpeg
access-control-allow-origin
*
x-ms-request-id
e6a11559-e01e-0065-6dff-f6f25b000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
37_533e293f0c8947ada653b47c00e394e2.png
aadcdn.msauth.net/ests/2.1/content/images/applogos/
2 KB
2 KB
Image
General
Full URL
https://aadcdn.msauth.net/ests/2.1/content/images/applogos/37_533e293f0c8947ada653b47c00e394e2.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:bdf::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
b5d587f6c48a9b22bbe97150249e0c0655ac1780bd273431480a22f8a5bfef6c

Request headers

Referer
https://myaccount.microstfonline.com/changePasswd/?mfa=THlubi5VcmJhbkBpaHNtYXJraXQuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 25 Apr 2019 23:30:02 GMT
x-azure-ref-originshield
0XiK+XAAAAABgxa3KnhyZQZ8bWRsbmig2QU1TRURHRTA2MjAAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-md5
Uz4pPwyJR62mU7R8AOOU4g==
status
200
content-length
1750
x-ms-lease-status
unlocked
last-modified
Wed, 13 Mar 2019 20:50:51 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
0x8D6A7F594080DCC
x-azure-ref
0+kLCXAAAAACdkej8Yy6VQ7/vrx/D2m00VklFRURHRTAyMTgAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-type
image/png
access-control-allow-origin
*
x-ms-request-id
9fff632d-101e-001a-0846-f98944000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
picker_account_aad_9de70d1c5191d1852a0d5aac28b44a6c.svg
aadcdn.msauth.net/ests/2.1/content/images/
756 B
978 B
Image
General
Full URL
https://aadcdn.msauth.net/ests/2.1/content/images/picker_account_aad_9de70d1c5191d1852a0d5aac28b44a6c.svg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:bdf::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69

Request headers

Referer
https://myaccount.microstfonline.com/changePasswd/?mfa=THlubi5VcmJhbkBpaHNtYXJraXQuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 25 Apr 2019 23:30:02 GMT
content-encoding
gzip
x-azure-ref-originshield
0Vi2+XAAAAAB55v22zTCjR5n05kATxgcMQU1TRURHRTA1MTIAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-md5
Sm6wIsHj8wthIZkm/aQWhA==
status
200
content-length
394
x-ms-lease-status
unlocked
last-modified
Fri, 02 Nov 2018 20:25:36 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
0x8D64101593D933D
x-azure-ref
0+kLCXAAAAACTh8A7dDn/Rp01Sdi0W9mxVklFRURHRTAyMTgAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
ee121fcb-c01e-004b-1401-f7c175000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=604800
x-ms-version
2009-09-19
picker_more_7568a43cf440757c55d2e7f51557ae1f.svg
aadcdn.msauth.net/ests/2.1/content/images/
899 B
555 B
Image
General
Full URL
https://aadcdn.msauth.net/ests/2.1/content/images/picker_more_7568a43cf440757c55d2e7f51557ae1f.svg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:bdf::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
b7fcd37eaafe3f08647ed072d5289eadfff6c660a26cdef31532b3fcfb4a0bb2

Request headers

Referer
https://myaccount.microstfonline.com/changePasswd/?mfa=THlubi5VcmJhbkBpaHNtYXJraXQuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 25 Apr 2019 23:30:02 GMT
content-encoding
gzip
x-azure-ref-originshield
0BDa+XAAAAADRe/2sxlNdSa44DKdWT+S9QU1TRURHRTA2MTMAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-md5
K28EA/F25txr6jQahXym+g==
status
200
content-length
257
x-ms-lease-status
unlocked
last-modified
Fri, 02 Nov 2018 20:25:40 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
0x8D641015B4AAC42
x-azure-ref
0+kLCXAAAAADLQVawGB01RbmsyUHX92wXVklFRURHRTAyMTgAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
3727a856-c01e-000f-7703-f7be6c000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=604800
x-ms-version
2009-09-19
marching_ants_white_166de53471265253ab3a456defe6da23.gif
aadcdn.msauth.net/ests/2.1/content/images/
3 KB
3 KB
Image
General
Full URL
https://aadcdn.msauth.net/ests/2.1/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:bdf::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
a46201581a7c7c667fd42787cd1e9adf2f6bf809efb7596e61a03e8dba9ada13

Request headers

Referer
https://myaccount.microstfonline.com/changePasswd/?mfa=THlubi5VcmJhbkBpaHNtYXJraXQuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 25 Apr 2019 23:30:02 GMT
x-azure-ref-originshield
0fy2+XAAAAACaJUh1VekeQagbWle4mWoMQU1TRURHRTA2MjAAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-md5
Fm3lNHEmUlOrOkVt7+baIw==
status
200
content-length
2672
x-ms-lease-status
unlocked
last-modified
Fri, 02 Nov 2018 20:25:29 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
0x8D6410154F5B6A5
x-azure-ref
0+kLCXAAAAADPS05aM1f9Tafc9EabAtXVVklFRURHRTAyMTgAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-type
image/gif
access-control-allow-origin
*
x-ms-request-id
09cc72ef-e01e-0031-774f-f93d60000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=604800
x-ms-version
2009-09-19
marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif
aadcdn.msauth.net/ests/2.1/content/images/
4 KB
4 KB
Image
General
Full URL
https://aadcdn.msauth.net/ests/2.1/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:bdf::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
8737d721808655f37b333f08a90185699e7e8b9bdaaa15cdb63c8448b426f95d

Request headers

Referer
https://myaccount.microstfonline.com/changePasswd/?mfa=THlubi5VcmJhbkBpaHNtYXJraXQuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 25 Apr 2019 23:30:02 GMT
x-azure-ref-originshield
0bUq+XAAAAACcmFcmSqkVQKBbclJumQi5QU1TRURHRTA0MTIAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-md5
tUCo5RgDcZLjLE/li/Lbqw==
status
200
content-length
3620
x-ms-lease-status
unlocked
last-modified
Fri, 02 Nov 2018 20:25:29 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
0x8D6410154B877AA
x-azure-ref
0+kLCXAAAAAC+ypN/uD1nR478PKmEGQCcVklFRURHRTAyMTgAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-type
image/gif
access-control-allow-origin
*
x-ms-request-id
a5bba7f4-001e-0013-69e7-f6fa57000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=604800
x-ms-version
2009-09-19
picker_account_add_56e73414003cdb676008ff7857343074.svg
aadcdn.msauth.net/ests/2.1/content/images/
222 B
482 B
Image
General
Full URL
https://aadcdn.msauth.net/ests/2.1/content/images/picker_account_add_56e73414003cdb676008ff7857343074.svg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:bdf::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
749f85621d92a5b31b2a377a8c385a36d48a83327dad9a8a8da93cd831b8c9a2

Request headers

Referer
https://myaccount.microstfonline.com/changePasswd/?mfa=THlubi5VcmJhbkBpaHNtYXJraXQuY29t&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Thu, 25 Apr 2019 23:30:02 GMT
content-encoding
gzip
x-azure-ref-originshield
0s2K+XAAAAADzCxOORkySS5FdcOEvcoadQU1TRURHRTA0MTQAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-md5
ykuOnMaTo0vw2Gx/ZceiPg==
status
200
content-length
184
x-ms-lease-status
unlocked
last-modified
Fri, 02 Nov 2018 20:25:37 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
0x8D6410159A239F1
x-azure-ref
0+kLCXAAAAAAOln8topohRL4hZqj7LDJ+VklFRURHRTAyMTgAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
85da3763-d01e-0052-7565-f90244000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=604800
x-ms-version
2009-09-19

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: OneDrive (Online) Microsoft (Consumer)

20 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onselectstart object| onselectionchange function| queueMicrotask object| $Config object| $Debug object| $Do function| $Loader object| $WebWatson function| GetString function| GetErrorString function| GetUrl object| $B object| ServerData function| webpackJsonp object| ko object| PROOF object| StringRepository boolean| __ConvergedLogin_PCore boolean| __ object| mydate

6 Cookies

Domain/Path Name / Value
outlook.office365.com/ Name: OWAPF
Value: v:16.3012.3.2690869&l:mouse
myaccount.microstfonline.com/ Name: PHPSESSID
Value: cn6ghe7nkd3p46ehs0p9g6j80g
outlook.office365.com/ Name: OIDC
Value: 1
myaccount.microstfonline.com/changePasswd Name: CkTst
Value: G1556235002447
outlook.office365.com/ Name: ClientId
Value: 3C3A879191C8406BB829C632983B0206
myaccount.microstfonline.com/ Name: localdate
Value: Thu Apr 25 2019 23:30:02 GMT+0000 (Coordinated Universal Time)

1 Console Messages

Source Level URL
Text
console-api info URL: https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/convergedlogin_pcore.min_du3a8nubtxbbr0ut5mtmbq2.js(Line 23)
Message:
BSSO Telemetry: {"result":"Error","error":"bssoNotSupported","type":"TBAuthTelemetry","data":{"BSSO.info":"not-supported"},"traces":["BrowserSSO Initialized","window.navigator.msLaunchUri is not available for _pullBrowserSsoCookie"]}