prod3-passive-dsts.dsts.core.windows.net
Open in
urlscan Pro
104.40.23.190
Public Scan
Submitted URL: https://icm.ad.msft.net/imp/v3/incidents/details/99012477/home
Effective URL: https://prod3-passive-dsts.dsts.core.windows.net/v2/wsfederation?wtrealm=svc%3a%2f%2fsso%40ad.msft.net%2f&wctx=WsFedOwinState%3dXrOdpH5AFO68ugE8g...
Submission: On January 07 via manual from IN
Effective URL: https://prod3-passive-dsts.dsts.core.windows.net/v2/wsfederation?wtrealm=svc%3a%2f%2fsso%40ad.msft.net%2f&wctx=WsFedOwinState%3dXrOdpH5AFO68ugE8g...
Submission: On January 07 via manual from IN
Summary
This website contacted 1 IPs
in 1 countries
across 2 domains to perform 3 HTTP transactions.
The main IP is 104.40.23.190, located in
San Jose, United States and
belongs to MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US.
The main domain is prod3-passive-dsts.dsts.core.windows.net.
TLS certificate: Issued by Microsoft IT TLS CA 2 on October 18th 2018. Valid for: 2 years.
This is the only time prod3-passive-dsts.dsts.core.windows.net was scanned on urlscan.io!
TLS certificate: Issued by Microsoft IT TLS CA 2 on October 18th 2018. Valid for: 2 years.
This is the only time prod3-passive-dsts.dsts.core.windows.net was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 2 2 | 13.106.57.203 13.106.57.203 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation) | |
| 3 | 104.40.23.190 104.40.23.190 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation) | |
| 3 | 1 |
2
13.106.57.203
(Redmond, United States)
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
| icm.ad.msft.net |
3
104.40.23.190
(San Jose, United States)
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
| prod3-passive-dsts.dsts.core.windows.net |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 3 |
windows.net
prod3-passive-dsts.dsts.core.windows.net |
10 KB |
| 2 |
msft.net
2 redirects
icm.ad.msft.net |
963 B |
| 3 | 2 |
| Domain | Requested by | |
|---|---|---|
| 3 | prod3-passive-dsts.dsts.core.windows.net |
prod3-passive-dsts.dsts.core.windows.net
|
| 2 | icm.ad.msft.net | 2 redirects |
| 3 | 2 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| *.dsts.core.windows.net Microsoft IT TLS CA 2 |
2018-10-18 - 2020-10-18 |
2 years | crt.sh |
This page contains 1 frames:
Primary Page:
https://prod3-passive-dsts.dsts.core.windows.net/v2/wsfederation?wtrealm=svc%3a%2f%2fsso%40ad.msft.net%2f&wctx=WsFedOwinState%3dXrOdpH5AFO68ugE8gJQtAlrii4Z7qdEq5aNSQjsnHr5A6cCT8HX_TpFLTkKrl1XxaLEjdshZLfNkmRMaz5f7LiP2bS-hLviW989hpzFpf0spJJ8pezOBzPlORxsa9vbp7o4MiQvgSM5s2FmJvH7zaGKSZKmlaQUqKgisFtlhls6BzK3xg8vCwtik00Z2FF5nWYXcxeF5yW_QNEfBBjZkrk8h6tra8vwbiUiGBC-13kzh6LYa&wa=wsignin1.0
Frame ID: 5E2A1956F73F453D896FA70F931B32AB
Requests: 3 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
-
https://icm.ad.msft.net/imp/v3/incidents/details/99012477/home
HTTP 302
https://icm.ad.msft.net/sso/?ReturnUrl=https%3A%2F%2Ficm.ad.msft.net%2Fimp%2Fv3%2Fincidents%2Fdetail... HTTP 302
https://prod3-passive-dsts.dsts.core.windows.net/v2/wsfederation?wtrealm=svc%3a%2f%2fsso%40ad.msft.net%2f&wctx=WsFedOwinState... Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://icm.ad.msft.net/imp/v3/incidents/details/99012477/home
HTTP 302
https://icm.ad.msft.net/sso/?ReturnUrl=https%3A%2F%2Ficm.ad.msft.net%2Fimp%2Fv3%2Fincidents%2Fdetails%2F99012477%2Fhome HTTP 302
https://prod3-passive-dsts.dsts.core.windows.net/v2/wsfederation?wtrealm=svc%3a%2f%2fsso%40ad.msft.net%2f&wctx=WsFedOwinState%3dXrOdpH5AFO68ugE8gJQtAlrii4Z7qdEq5aNSQjsnHr5A6cCT8HX_TpFLTkKrl1XxaLEjdshZLfNkmRMaz5f7LiP2bS-hLviW989hpzFpf0spJJ8pezOBzPlORxsa9vbp7o4MiQvgSM5s2FmJvH7zaGKSZKmlaQUqKgisFtlhls6BzK3xg8vCwtik00Z2FF5nWYXcxeF5yW_QNEfBBjZkrk8h6tra8vwbiUiGBC-13kzh6LYa&wa=wsignin1.0 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
3 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
wsfederation
prod3-passive-dsts.dsts.core.windows.net/v2/ Redirect Chain
|
21 KB 7 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
acs.css
prod3-passive-dsts.dsts.core.windows.net/Areas/SSOManagement2/Theme/ |
7 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
IdentityProviders.js
prod3-passive-dsts.dsts.core.windows.net/v2/metadata/ |
5 KB 1 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
26 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onselectstart object| onselectionchange function| queueMicrotask function| on_body_load object| identityProviders string| cookieName string| localDstsAuthentication number| cookieExpiration number| cookieExpirationLocalDstsAuth number| maxImageWidth number| maxImageHeight object| provider function| ShowSigninPage function| ShowIdProvidersPage function| ShowDefaultSigninPage function| ShowSigninControls function| CreateIdentityProviderButton function| GetDisplayName function| GetHRDCookieName function| SetCookie function| SAWContinueAnywaysButtonClicked function| IdentityProviderButtonClicked function| CheckBoxClicked function| SetEmailError function| EmailAddressEntered function| ResizeImage0 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
| Header | Value |
|---|---|
| X-Content-Type-Options | nosniff |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
icm.ad.msft.net
prod3-passive-dsts.dsts.core.windows.net
104.40.23.190
13.106.57.203
0d4114b2236127f8e365bca8163e0e4aff1ea8cede0206d5c37a8ce5bfb8e496
1c580d9335d22ebde089d53d228f5293b761dc67025415fe243ccc19083b2141
6cbb8e15a3fa23731e26c8902b4ef08a97cf552ab86c7e83d5b287f7662dca9f