login-microsoftonline.nlmeks.com Open in urlscan Pro
185.102.170.161 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://login-microsoftonline.nlmeks.com/
Effective URL:
https://login-microsoftonline.nlmeks.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3...
Submission: On July 11 via manual (July 11th 2022, 9:31:49 pm UTC) from US — Scanned from DE

Summary HTTP 16 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 16 HTTP transactions. The main IP is 185.102.170.161, located in Ashburn, United States and belongs to AS-SERVERION Serverion B.V., NL. The main domain is login-microsoftonline.nlmeks.com.
TLS certificate: Issued by R3 on July 11th 2022. Valid for: 3 months.

This is the only time login-microsoftonline.nlmeks.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address		AS Autonomous System
3 19	185.102.170.161 185.102.170.161		213035 (AS-SERVER...) (AS-SERVERION Serverion B.V.)
16	1

19 185.102.170.161 (Ashburn, United States) 3 redirects

ASN213035 (AS-SERVERION Serverion B.V., NL)

login-microsoftonline.nlmeks.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
wwwoffice.nlmeks.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
aadcdn-msauth-b0a9af9c.nlmeks.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
login.nlmeks.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
19	nlmeks.com 3 redirects login-microsoftonline.nlmeks.com wwwoffice.nlmeks.com aadcdn-msauth-b0a9af9c.nlmeks.com login.nlmeks.com	396 KB
16	1

	Domain	Requested by
11	aadcdn-msauth-b0a9af9c.nlmeks.com	login-microsoftonline.nlmeks.com aadcdn-msauth-b0a9af9c.nlmeks.com
5	login-microsoftonline.nlmeks.com	2 redirects login-microsoftonline.nlmeks.com
2	login.nlmeks.com	login-microsoftonline.nlmeks.com aadcdn-msauth-b0a9af9c.nlmeks.com
1	wwwoffice.nlmeks.com	1 redirects
16	4

This site contains links to these domains. Also see Links.

Domain
www-microsoft.nlmeks.com
privacy-microsoft-b0a9af9c.nlmeks.com

Subject Issuer	Validity	Valid
nlmeks.com R3	`2022-07-11` - `2022-10-09`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://login-microsoftonline.nlmeks.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwwwoffice.nlmeks.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwwwoffice.nlmeks.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637931719062853065.NDIwYzA0NjYtYzQyNC00OWZlLWI3N2ItZjZlMDdmYTc4NTljN2VkOGI2Y2QtYjhmNy00NzQ1LTk3MjItOGNiMmMwNzgzMGRi&ui_locales=de-DE&mkt=de-DE&state=EiJysNLdHjqmZygy8P6H39M6A6sy_JQhbhqsPpabCTAOZK8MbBy9OAeg9Jni5BWKaSx3FE7KA03YRWkZmF14cnGk9XMclGuG0vnYsZXF7kBxKWTbRDgH6Aj8nVslVzMNiIJgi6cRwthfnEje0-_x4Mb7i2WwBkNsYCwPm40x-8e5YharyFLtY8caEfJTcjlJRucrJvLClfs4Idok-aV9UiqF86hr9RW8wFtMS_aN8s9PWImB0SONpSnRytQ1brpGRfJHZbLrBc4EUx7_T45gRA&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0&sso_reload=true
Frame ID: 6187B114AC5CCC0503E1F8E23C3FDFC0
Requests: 15 HTTP requests in this frame

Frame: https://login.nlmeks.com/Me.htm?v=3
Frame ID: 16C22F832867940B717832B6F2D083B0
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Bei Ihrem Konto anmelden

Page URL History Show full URLs

http://login-microsoftonline.nlmeks.com/ HTTP 301
https://login-microsoftonline.nlmeks.com/ Page URL
https://login-microsoftonline.nlmeks.com/ HTTP 302
https://wwwoffice.nlmeks.com/login HTTP 302
https://login-microsoftonline.nlmeks.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&... Page URL
https://login-microsoftonline.nlmeks.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&... Page URL

Page Statistics

16
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

4
Subdomains

1
IPs

1
Countries

394 kB
Transfer

1230 kB
Size

9
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://www-microsoft.nlmeks.com/de-DE/servicesagreement/
Title: Nutzungsbedingungen

Search URL Search Domain Scan URL

URL: https://privacy-microsoft-b0a9af9c.nlmeks.com/de-DE/privacystatement
Title: Datenschutz & Cookies

Search URL Search Domain Scan URL

URL: https://www-microsoft.nlmeks.com/de-de/corporate/rechtliche-hinweise/impressum.aspx
Title: Haftungsausschluss

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://login-microsoftonline.nlmeks.com/ HTTP 301
https://login-microsoftonline.nlmeks.com/ Page URL
https://login-microsoftonline.nlmeks.com/ HTTP 302
https://wwwoffice.nlmeks.com/login HTTP 302
https://login-microsoftonline.nlmeks.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwwwoffice.nlmeks.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwwwoffice.nlmeks.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637931719062853065.NDIwYzA0NjYtYzQyNC00OWZlLWI3N2ItZjZlMDdmYTc4NTljN2VkOGI2Y2QtYjhmNy00NzQ1LTk3MjItOGNiMmMwNzgzMGRi&ui_locales=de-DE&mkt=de-DE&state=EiJysNLdHjqmZygy8P6H39M6A6sy_JQhbhqsPpabCTAOZK8MbBy9OAeg9Jni5BWKaSx3FE7KA03YRWkZmF14cnGk9XMclGuG0vnYsZXF7kBxKWTbRDgH6Aj8nVslVzMNiIJgi6cRwthfnEje0-_x4Mb7i2WwBkNsYCwPm40x-8e5YharyFLtY8caEfJTcjlJRucrJvLClfs4Idok-aV9UiqF86hr9RW8wFtMS_aN8s9PWImB0SONpSnRytQ1brpGRfJHZbLrBc4EUx7_T45gRA&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0 Page URL
https://login-microsoftonline.nlmeks.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwwwoffice.nlmeks.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwwwoffice.nlmeks.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637931719062853065.NDIwYzA0NjYtYzQyNC00OWZlLWI3N2ItZjZlMDdmYTc4NTljN2VkOGI2Y2QtYjhmNy00NzQ1LTk3MjItOGNiMmMwNzgzMGRi&ui_locales=de-DE&mkt=de-DE&state=EiJysNLdHjqmZygy8P6H39M6A6sy_JQhbhqsPpabCTAOZK8MbBy9OAeg9Jni5BWKaSx3FE7KA03YRWkZmF14cnGk9XMclGuG0vnYsZXF7kBxKWTbRDgH6Aj8nVslVzMNiIJgi6cRwthfnEje0-_x4Mb7i2WwBkNsYCwPm40x-8e5YharyFLtY8caEfJTcjlJRucrJvLClfs4Idok-aV9UiqF86hr9RW8wFtMS_aN8s9PWImB0SONpSnRytQ1brpGRfJHZbLrBc4EUx7_T45gRA&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0&sso_reload=true Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://login-microsoftonline.nlmeks.com/ HTTP 301
https://login-microsoftonline.nlmeks.com/

Request Chain 1

https://login-microsoftonline.nlmeks.com/ HTTP 302
https://wwwoffice.nlmeks.com/login HTTP 302
https://login-microsoftonline.nlmeks.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwwwoffice.nlmeks.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwwwoffice.nlmeks.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637931719062853065.NDIwYzA0NjYtYzQyNC00OWZlLWI3N2ItZjZlMDdmYTc4NTljN2VkOGI2Y2QtYjhmNy00NzQ1LTk3MjItOGNiMmMwNzgzMGRi&ui_locales=de-DE&mkt=de-DE&state=EiJysNLdHjqmZygy8P6H39M6A6sy_JQhbhqsPpabCTAOZK8MbBy9OAeg9Jni5BWKaSx3FE7KA03YRWkZmF14cnGk9XMclGuG0vnYsZXF7kBxKWTbRDgH6Aj8nVslVzMNiIJgi6cRwthfnEje0-_x4Mb7i2WwBkNsYCwPm40x-8e5YharyFLtY8caEfJTcjlJRucrJvLClfs4Idok-aV9UiqF86hr9RW8wFtMS_aN8s9PWImB0SONpSnRytQ1brpGRfJHZbLrBc4EUx7_T45gRA&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0

16 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	/ Show response login-microsoftonline.nlmeks.com/ Redirect Chain http://login-microsoftonline.nlmeks.com/ https://login-microsoftonline.nlmeks.com/	72 KB 25 KB	173ms 110ms	Document text/html	185.102.170.161 AS-SERVERION Serv...
General Check archive.org Show headers Download Go to Full URL https://login-microsoftonline.nlmeks.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.102.170.161 Ashburn, United States, ASN213035 (AS-SERVERION Serverion B.V., NL), Reverse DNS Software nginx/1.21.6 / Resource Hash `224c1e2f8859440f070a66624b09c4092a51d246876411e9ce59a9f482bdd2ad` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-headers * access-control-allow-origin * content-encoding gzip content-type text/html; charset=utf-8 date Mon, 11 Jul 2022 21:31:45 GMT server nginx/1.21.6 vary Accept-Encoding Redirect headers Connection keep-alive Content-Length 169 Content-Type text/html Date Mon, 11 Jul 2022 21:31:45 GMT Location https://login-microsoftonline.nlmeks.com/ Server nginx/1.21.6
GET H2	200	authorize login-microsoftonline.nlmeks.com/common/oauth2/v2.0/ Redirect Chain https://login-microsoftonline.nlmeks.com/ https://wwwoffice.nlmeks.com/login https://login-microsoftonline.nlmeks.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwwwoffice.nlmeks.com%2Flandingv2&response_type=code%2...	291 KB 85 KB	706ms 706ms	Document text/html	185.102.170.161 AS-SERVERION Serv...
General Check archive.org Show headers Download Go to Full URL https://login-microsoftonline.nlmeks.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwwwoffice.nlmeks.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwwwoffice.nlmeks.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637931719062853065.NDIwYzA0NjYtYzQyNC00OWZlLWI3N2ItZjZlMDdmYTc4NTljN2VkOGI2Y2QtYjhmNy00NzQ1LTk3MjItOGNiMmMwNzgzMGRi&ui_locales=de-DE&mkt=de-DE&state=EiJysNLdHjqmZygy8P6H39M6A6sy_JQhbhqsPpabCTAOZK8MbBy9OAeg9Jni5BWKaSx3FE7KA03YRWkZmF14cnGk9XMclGuG0vnYsZXF7kBxKWTbRDgH6Aj8nVslVzMNiIJgi6cRwthfnEje0-_x4Mb7i2WwBkNsYCwPm40x-8e5YharyFLtY8caEfJTcjlJRucrJvLClfs4Idok-aV9UiqF86hr9RW8wFtMS_aN8s9PWImB0SONpSnRytQ1brpGRfJHZbLrBc4EUx7_T45gRA&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0 Requested by Host: login-microsoftonline.nlmeks.com URL: https://login-microsoftonline.nlmeks.com/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.102.170.161 Ashburn, United States, ASN213035 (AS-SERVERION Serverion B.V., NL), Reverse DNS Software nginx/1.21.6 / Resource Hash Request headers Referer https://login-microsoftonline.nlmeks.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-headers * access-control-allow-origin * cache-control no-store, no-cache content-encoding gzip content-type text/html; charset=utf-8 date Mon, 11 Jul 2022 21:31:47 GMT nel {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} p3p CP="DSP CUR OTPi IND OTRi ONL FIN" pragma no-cache referrer-policy strict-origin-when-cross-origin report-to {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity-nel-measure-office-b0a9af9c.nlmeks.com/api/report?catId=GW+estsfd+dub2"}]} server nginx/1.21.6 vary Accept-Encoding Accept-Encoding x-ms-clitelem 1,50168,0,, x-ms-ests-server 2.1.13156.10 - NEULR2 ProdSlices x-ms-request-id c66f26d7-ba6e-4bb0-a8d6-66c1af24b900 Redirect headers access-control-allow-headers * access-control-allow-origin * content-type text/html; charset=utf-8 date Mon, 11 Jul 2022 21:31:46 GMT location https://login-microsoftonline.nlmeks.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwwwoffice.nlmeks.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwwwoffice.nlmeks.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637931719062853065.NDIwYzA0NjYtYzQyNC00OWZlLWI3N2ItZjZlMDdmYTc4NTljN2VkOGI2Y2QtYjhmNy00NzQ1LTk3MjItOGNiMmMwNzgzMGRi&ui_locales=de-DE&mkt=de-DE&state=EiJysNLdHjqmZygy8P6H39M6A6sy_JQhbhqsPpabCTAOZK8MbBy9OAeg9Jni5BWKaSx3FE7KA03YRWkZmF14cnGk9XMclGuG0vnYsZXF7kBxKWTbRDgH6Aj8nVslVzMNiIJgi6cRwthfnEje0-_x4Mb7i2WwBkNsYCwPm40x-8e5YharyFLtY8caEfJTcjlJRucrJvLClfs4Idok-aV9UiqF86hr9RW8wFtMS_aN8s9PWImB0SONpSnRytQ1brpGRfJHZbLrBc4EUx7_T45gRA&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0 referrer-policy strict-origin-when-cross-origin request-context appId= server nginx/1.21.6 vary Accept-Encoding x-cache CONFIG_NOCACHE x-msedge-ref Ref A: 289C7B41DADC4C0EAD364C123C93CE6D Ref B: AMS04EDGE2607 Ref C: 2022-07-11T21:31:46Z x-ua-compatible IE=edge,chrome=1
GET H2	200	Primary Request authorize Show response login-microsoftonline.nlmeks.com/common/oauth2/v2.0/	343 KB 82 KB	693ms 693ms	Document text/html	185.102.170.161 AS-SERVERION Serv...
General Check archive.org Show headers Download Go to Full URL https://login-microsoftonline.nlmeks.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwwwoffice.nlmeks.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwwwoffice.nlmeks.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637931719062853065.NDIwYzA0NjYtYzQyNC00OWZlLWI3N2ItZjZlMDdmYTc4NTljN2VkOGI2Y2QtYjhmNy00NzQ1LTk3MjItOGNiMmMwNzgzMGRi&ui_locales=de-DE&mkt=de-DE&state=EiJysNLdHjqmZygy8P6H39M6A6sy_JQhbhqsPpabCTAOZK8MbBy9OAeg9Jni5BWKaSx3FE7KA03YRWkZmF14cnGk9XMclGuG0vnYsZXF7kBxKWTbRDgH6Aj8nVslVzMNiIJgi6cRwthfnEje0-_x4Mb7i2WwBkNsYCwPm40x-8e5YharyFLtY8caEfJTcjlJRucrJvLClfs4Idok-aV9UiqF86hr9RW8wFtMS_aN8s9PWImB0SONpSnRytQ1brpGRfJHZbLrBc4EUx7_T45gRA&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0&sso_reload=true Requested by Host: login-microsoftonline.nlmeks.com URL: https://login-microsoftonline.nlmeks.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwwwoffice.nlmeks.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwwwoffice.nlmeks.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637931719062853065.NDIwYzA0NjYtYzQyNC00OWZlLWI3N2ItZjZlMDdmYTc4NTljN2VkOGI2Y2QtYjhmNy00NzQ1LTk3MjItOGNiMmMwNzgzMGRi&ui_locales=de-DE&mkt=de-DE&state=EiJysNLdHjqmZygy8P6H39M6A6sy_JQhbhqsPpabCTAOZK8MbBy9OAeg9Jni5BWKaSx3FE7KA03YRWkZmF14cnGk9XMclGuG0vnYsZXF7kBxKWTbRDgH6Aj8nVslVzMNiIJgi6cRwthfnEje0-_x4Mb7i2WwBkNsYCwPm40x-8e5YharyFLtY8caEfJTcjlJRucrJvLClfs4Idok-aV9UiqF86hr9RW8wFtMS_aN8s9PWImB0SONpSnRytQ1brpGRfJHZbLrBc4EUx7_T45gRA&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.102.170.161 Ashburn, United States, ASN213035 (AS-SERVERION Serverion B.V., NL), Reverse DNS Software nginx/1.21.6 / Resource Hash `4b7a3728464b85e69ab991e57840e89e7f1314d3187b4eac6f67e187d90d5737` Request headers Referer https://login-microsoftonline.nlmeks.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwwwoffice.nlmeks.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwwwoffice.nlmeks.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637931719062853065.NDIwYzA0NjYtYzQyNC00OWZlLWI3N2ItZjZlMDdmYTc4NTljN2VkOGI2Y2QtYjhmNy00NzQ1LTk3MjItOGNiMmMwNzgzMGRi&ui_locales=de-DE&mkt=de-DE&state=EiJysNLdHjqmZygy8P6H39M6A6sy_JQhbhqsPpabCTAOZK8MbBy9OAeg9Jni5BWKaSx3FE7KA03YRWkZmF14cnGk9XMclGuG0vnYsZXF7kBxKWTbRDgH6Aj8nVslVzMNiIJgi6cRwthfnEje0-_x4Mb7i2WwBkNsYCwPm40x-8e5YharyFLtY8caEfJTcjlJRucrJvLClfs4Idok-aV9UiqF86hr9RW8wFtMS_aN8s9PWImB0SONpSnRytQ1brpGRfJHZbLrBc4EUx7_T45gRA&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-headers * access-control-allow-origin * cache-control no-store, no-cache content-encoding gzip content-type text/html; charset=utf-8 date Mon, 11 Jul 2022 21:31:47 GMT nel {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} p3p CP="DSP CUR OTPi IND OTRi ONL FIN" pragma no-cache referrer-policy strict-origin-when-cross-origin report-to {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity-nel-measure-office-b0a9af9c.nlmeks.com/api/report?catId=GW+estsfd+dub2"}]} server nginx/1.21.6 vary Accept-Encoding Accept-Encoding x-ms-clitelem 1,0,0,, x-ms-ests-server 2.1.13156.10 - NEULR2 ProdSlices x-ms-request-id eb3bd21b-ed4b-4708-bca2-f7ae2a240100
GET H2	200	ConvergedLogin_PCore_BdGsyKr09CEVooArpGMldQ2.js Show response aadcdn-msauth-b0a9af9c.nlmeks.com/shared/1.0/content/js/	380 KB 109 KB	637ms 538ms	Script application/x-javascript	185.102.170.161 AS-SERVERION Serv...
General Check archive.org Show headers Download Go to Full URL https://aadcdn-msauth-b0a9af9c.nlmeks.com/shared/1.0/content/js/ConvergedLogin_PCore_BdGsyKr09CEVooArpGMldQ2.js Requested by Host: login-microsoftonline.nlmeks.com URL: https://login-microsoftonline.nlmeks.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwwwoffice.nlmeks.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwwwoffice.nlmeks.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637931719062853065.NDIwYzA0NjYtYzQyNC00OWZlLWI3N2ItZjZlMDdmYTc4NTljN2VkOGI2Y2QtYjhmNy00NzQ1LTk3MjItOGNiMmMwNzgzMGRi&ui_locales=de-DE&mkt=de-DE&state=EiJysNLdHjqmZygy8P6H39M6A6sy_JQhbhqsPpabCTAOZK8MbBy9OAeg9Jni5BWKaSx3FE7KA03YRWkZmF14cnGk9XMclGuG0vnYsZXF7kBxKWTbRDgH6Aj8nVslVzMNiIJgi6cRwthfnEje0-_x4Mb7i2WwBkNsYCwPm40x-8e5YharyFLtY8caEfJTcjlJRucrJvLClfs4Idok-aV9UiqF86hr9RW8wFtMS_aN8s9PWImB0SONpSnRytQ1brpGRfJHZbLrBc4EUx7_T45gRA&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0&sso_reload=true Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.102.170.161 Ashburn, United States, ASN213035 (AS-SERVERION Serverion B.V., NL), Reverse DNS Software nginx/1.21.6 / Resource Hash `df2c40d6032c40476090e9b69c506f72178212104d7f1f415b10c60c0613cc85` Request headers Referer https://login-microsoftonline.nlmeks.com/ Origin https://login-microsoftonline.nlmeks.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 11 Jul 2022 21:31:48 GMT content-encoding gzip vary Accept-Encoding x-azure-ref-originshield 0baXHYgAAAACtbKZBswCsTY7ODN98a1cJTE9OMjFFREdFMDEwNwAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY= x-cache TCP_HIT x-ms-lease-status unlocked last-modified Wed, 15 Jun 2022 19:42:10 GMT server nginx/1.21.6 x-azure-ref 0xJbMYgAAAAAApgVimxeTTpGBYmECgjeATE9OMjEyMDUwNzE2MDI1ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== content-type application/x-javascript access-control-allow-origin * x-ms-request-id 194a1e4f-a01e-008d-580f-91bf3d000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19
GET H2	200	Me.htm login.nlmeks.com/	0 0	440ms 415ms	Other text/html	185.102.170.161 AS-SERVERION Serv...
General Check archive.org Show headers Download Go to Full URL https://login.nlmeks.com/Me.htm?v=3 Requested by Host: login-microsoftonline.nlmeks.com URL: https://login-microsoftonline.nlmeks.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwwwoffice.nlmeks.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwwwoffice.nlmeks.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637931719062853065.NDIwYzA0NjYtYzQyNC00OWZlLWI3N2ItZjZlMDdmYTc4NTljN2VkOGI2Y2QtYjhmNy00NzQ1LTk3MjItOGNiMmMwNzgzMGRi&ui_locales=de-DE&mkt=de-DE&state=EiJysNLdHjqmZygy8P6H39M6A6sy_JQhbhqsPpabCTAOZK8MbBy9OAeg9Jni5BWKaSx3FE7KA03YRWkZmF14cnGk9XMclGuG0vnYsZXF7kBxKWTbRDgH6Aj8nVslVzMNiIJgi6cRwthfnEje0-_x4Mb7i2WwBkNsYCwPm40x-8e5YharyFLtY8caEfJTcjlJRucrJvLClfs4Idok-aV9UiqF86hr9RW8wFtMS_aN8s9PWImB0SONpSnRytQ1brpGRfJHZbLrBc4EUx7_T45gRA&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0&sso_reload=true Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.102.170.161 Ashburn, United States, ASN213035 (AS-SERVERION Serverion B.V., NL), Reverse DNS Software / Resource Hash Request headers accept-language de-DE,de;q=0.9 Referer https://login-microsoftonline.nlmeks.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers
GET H2	200	converged.v2.login.min_9lddfuhsopopkddlczwbda2.css aadcdn-msauth-b0a9af9c.nlmeks.com/ests/2.1/content/cdnbundles/	0 20 KB	246ms 246ms	Other text/css	185.102.170.161 AS-SERVERION Serv...
General Check archive.org Show headers Download Go to Full URL https://aadcdn-msauth-b0a9af9c.nlmeks.com/ests/2.1/content/cdnbundles/converged.v2.login.min_9lddfuhsopopkddlczwbda2.css Requested by Host: login-microsoftonline.nlmeks.com URL: https://login-microsoftonline.nlmeks.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwwwoffice.nlmeks.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwwwoffice.nlmeks.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637931719062853065.NDIwYzA0NjYtYzQyNC00OWZlLWI3N2ItZjZlMDdmYTc4NTljN2VkOGI2Y2QtYjhmNy00NzQ1LTk3MjItOGNiMmMwNzgzMGRi&ui_locales=de-DE&mkt=de-DE&state=EiJysNLdHjqmZygy8P6H39M6A6sy_JQhbhqsPpabCTAOZK8MbBy9OAeg9Jni5BWKaSx3FE7KA03YRWkZmF14cnGk9XMclGuG0vnYsZXF7kBxKWTbRDgH6Aj8nVslVzMNiIJgi6cRwthfnEje0-_x4Mb7i2WwBkNsYCwPm40x-8e5YharyFLtY8caEfJTcjlJRucrJvLClfs4Idok-aV9UiqF86hr9RW8wFtMS_aN8s9PWImB0SONpSnRytQ1brpGRfJHZbLrBc4EUx7_T45gRA&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0&sso_reload=true Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.102.170.161 Ashburn, United States, ASN213035 (AS-SERVERION Serverion B.V., NL), Reverse DNS Software nginx/1.21.6 / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language de-DE,de;q=0.9 Referer https://login-microsoftonline.nlmeks.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 11 Jul 2022 21:31:49 GMT content-encoding gzip vary Accept-Encoding x-azure-ref-originshield 0AYDJYgAAAAD+pQ60o1RlTYq6Zjyxd4JVUEFSMjAxMDMxMDEyMDA5ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== x-cache TCP_HIT x-ms-lease-status unlocked last-modified Fri, 03 Jun 2022 20:17:34 GMT server nginx/1.21.6 x-azure-ref 0xZbMYgAAAADAlBlgAB08RLMaJdofNV/qUEFSMjAxMDgwMzg1MDI5ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== content-type text/css access-control-allow-origin * x-ms-request-id b14e1575-101e-0036-1095-92ec6e000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19
GET H2	200	ux.converged.login.strings-de.min_qabyv2ri8ucdnzwtci_lyq2.js aadcdn-msauth-b0a9af9c.nlmeks.com/ests/2.1/content/cdnbundles/	0 15 KB	466ms 466ms	Other application/x-javascript	185.102.170.161 AS-SERVERION Serv...
General Check archive.org Show headers Download Go to Full URL https://aadcdn-msauth-b0a9af9c.nlmeks.com/ests/2.1/content/cdnbundles/ux.converged.login.strings-de.min_qabyv2ri8ucdnzwtci_lyq2.js Requested by Host: login-microsoftonline.nlmeks.com URL: https://login-microsoftonline.nlmeks.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwwwoffice.nlmeks.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwwwoffice.nlmeks.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637931719062853065.NDIwYzA0NjYtYzQyNC00OWZlLWI3N2ItZjZlMDdmYTc4NTljN2VkOGI2Y2QtYjhmNy00NzQ1LTk3MjItOGNiMmMwNzgzMGRi&ui_locales=de-DE&mkt=de-DE&state=EiJysNLdHjqmZygy8P6H39M6A6sy_JQhbhqsPpabCTAOZK8MbBy9OAeg9Jni5BWKaSx3FE7KA03YRWkZmF14cnGk9XMclGuG0vnYsZXF7kBxKWTbRDgH6Aj8nVslVzMNiIJgi6cRwthfnEje0-_x4Mb7i2WwBkNsYCwPm40x-8e5YharyFLtY8caEfJTcjlJRucrJvLClfs4Idok-aV9UiqF86hr9RW8wFtMS_aN8s9PWImB0SONpSnRytQ1brpGRfJHZbLrBc4EUx7_T45gRA&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0&sso_reload=true Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.102.170.161 Ashburn, United States, ASN213035 (AS-SERVERION Serverion B.V., NL), Reverse DNS Software nginx/1.21.6 / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language de-DE,de;q=0.9 Referer https://login-microsoftonline.nlmeks.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 11 Jul 2022 21:31:49 GMT content-encoding gzip vary Accept-Encoding x-azure-ref-originshield 02NnJYgAAAADXLGo/Kk86SqEMxdg7PTtKUEFSMjAxMDMxMDExMDA5ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== x-cache TCP_HIT x-ms-lease-status unlocked last-modified Thu, 09 Jun 2022 23:27:57 GMT server nginx/1.21.6 x-azure-ref 0xZbMYgAAAABZwBl4JY4TQ5HRGHSLLa3LUEFSMjAxMDgwMzg1MDM1ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== content-type application/x-javascript access-control-allow-origin * x-ms-request-id 9ced6177-001e-0047-618b-92356c000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19
GET H2	200	convergedlogin_pfetchsessionsprogress_c517f0e3ce9f4c448e6f.js Show response aadcdn-msauth-b0a9af9c.nlmeks.com/shared/1.0/content/js/asyncchunk/	15 KB 6 KB	475ms 475ms	Script application/x-javascript	185.102.170.161 AS-SERVERION Serv...
General Check archive.org Show headers Download Go to Full URL https://aadcdn-msauth-b0a9af9c.nlmeks.com/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_c517f0e3ce9f4c448e6f.js Requested by Host: aadcdn-msauth-b0a9af9c.nlmeks.com URL: https://aadcdn-msauth-b0a9af9c.nlmeks.com/shared/1.0/content/js/ConvergedLogin_PCore_BdGsyKr09CEVooArpGMldQ2.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.102.170.161 Ashburn, United States, ASN213035 (AS-SERVERION Serverion B.V., NL), Reverse DNS Software nginx/1.21.6 / Resource Hash `d38c9b217a71fe2b3f7a5eaf534c8c103081733b25caa132383a583830736fb3` Request headers accept-language de-DE,de;q=0.9 Referer https://login-microsoftonline.nlmeks.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 11 Jul 2022 21:31:49 GMT content-encoding gzip vary Accept-Encoding x-azure-ref-originshield 0baXHYgAAAABJV+igSG0wTbO5xXWok5E5TE9OMjFFREdFMTUyMAAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY= x-cache TCP_HIT x-ms-lease-status unlocked last-modified Thu, 26 May 2022 23:21:49 GMT server nginx/1.21.6 x-azure-ref 0xZbMYgAAAADcVwfKRWIdSZnXu+uxR8VfTE9OMjEyMDUwNzE2MDM3ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== content-type application/x-javascript access-control-allow-origin * x-ms-request-id 9d675bd1-101e-0072-5a2a-929377000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19
GET H2	200	marching_ants_white_166de53471265253ab3a456defe6da23.gif aadcdn-msauth-b0a9af9c.nlmeks.com/shared/1.0/content/images/	3 KB 3 KB	206ms 206ms	Image image/gif	185.102.170.161 AS-SERVERION Serv...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn-msauth-b0a9af9c.nlmeks.com/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.102.170.161 Ashburn, United States, ASN213035 (AS-SERVERION Serverion B.V., NL), Reverse DNS Software nginx/1.21.6 / Resource Hash `a46201581a7c7c667fd42787cd1e9adf2f6bf809efb7596e61a03e8dba9ada13` Request headers accept-language de-DE,de;q=0.9 Referer https://login-microsoftonline.nlmeks.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers x-ms-lease-status unlocked x-ms-blob-type BlockBlob date Mon, 11 Jul 2022 21:31:49 GMT last-modified Fri, 17 Jan 2020 19:28:37 GMT server nginx/1.21.6 etag 0x8D79B83739984DD x-azure-ref 0xZbMYgAAAAAa9C785872TIy8l/rGlJ0fUEFSMjAxMDgwMzg0MDExADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== x-cache TCP_HIT content-type image/gif access-control-allow-origin * x-ms-request-id 200c92c4-d01e-003a-0a97-931877000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 x-azure-ref-originshield 0pdPKYgAAAAD50gwJ7pbuRLK7byhQwTEoUEFSMjAxMDMxMDExMDI3ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng==
GET H2	200	marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif aadcdn-msauth-b0a9af9c.nlmeks.com/shared/1.0/content/images/	4 KB 4 KB	454ms 454ms	Image image/gif	185.102.170.161 AS-SERVERION Serv...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn-msauth-b0a9af9c.nlmeks.com/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.102.170.161 Ashburn, United States, ASN213035 (AS-SERVERION Serverion B.V., NL), Reverse DNS Software nginx/1.21.6 / Resource Hash `8737d721808655f37b333f08a90185699e7e8b9bdaaa15cdb63c8448b426f95d` Request headers accept-language de-DE,de;q=0.9 Referer https://login-microsoftonline.nlmeks.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers x-ms-lease-status unlocked x-ms-blob-type BlockBlob date Mon, 11 Jul 2022 21:31:49 GMT last-modified Fri, 17 Jan 2020 19:28:38 GMT server nginx/1.21.6 etag 0x8D79B8373B17F89 x-azure-ref 0xZbMYgAAAAAz7LuHDRLfSKSjvrktGJx6TE9OMjEyMDUwNzE2MDQ5ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== x-cache TCP_HIT content-type image/gif access-control-allow-origin * x-ms-request-id 23efc21c-301e-0070-2524-91c573000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 x-azure-ref-originshield 0MPfHYgAAAAAQSBHlrTlxQrLsKgpFSlIcTE9OMjFFREdFMDIxNgAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
GET H2	200	convergedlogin_pcustomizationloader_87a35ded5475e7847fb4.js Show response aadcdn-msauth-b0a9af9c.nlmeks.com/shared/1.0/content/js/asyncchunk/	107 KB 32 KB	286ms 285ms	Script application/x-javascript	185.102.170.161 AS-SERVERION Serv...
General Check archive.org Show headers Download Go to Full URL https://aadcdn-msauth-b0a9af9c.nlmeks.com/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_87a35ded5475e7847fb4.js Requested by Host: aadcdn-msauth-b0a9af9c.nlmeks.com URL: https://aadcdn-msauth-b0a9af9c.nlmeks.com/shared/1.0/content/js/ConvergedLogin_PCore_BdGsyKr09CEVooArpGMldQ2.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.102.170.161 Ashburn, United States, ASN213035 (AS-SERVERION Serverion B.V., NL), Reverse DNS Software nginx/1.21.6 / Resource Hash `8a347aca9067fa57fb197345311d4fbb34cb5a90899dda44c417db1ddbbbe00f` Request headers accept-language de-DE,de;q=0.9 Referer https://login-microsoftonline.nlmeks.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 11 Jul 2022 21:31:49 GMT content-encoding gzip vary Accept-Encoding x-azure-ref-originshield 0se3LYgAAAACXTWDPq0gGQ6coQ9gp85H4RlJBMjMxMDUwNDE4MDUzADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== x-cache TCP_HIT x-ms-lease-status unlocked last-modified Thu, 26 May 2022 23:21:49 GMT server nginx/1.21.6 x-azure-ref 0xZbMYgAAAABBI9dGPO8/TpuCMMrRNErCRlJBMjMxMDUwNDIwMDM1ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== content-type application/x-javascript access-control-allow-origin * x-ms-request-id e858b28c-401e-0017-48c6-93565f000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19
GET H2	200	2_bc3d32a696895f78c19df6c717586a5d.svg aadcdn-msauth-b0a9af9c.nlmeks.com/shared/1.0/content/images/backgrounds/	2 KB 1 KB	330ms 329ms	Image image/svg+xml	185.102.170.161 AS-SERVERION Serv...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn-msauth-b0a9af9c.nlmeks.com/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.102.170.161 Ashburn, United States, ASN213035 (AS-SERVERION Serverion B.V., NL), Reverse DNS Software nginx/1.21.6 / Resource Hash `0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68` Request headers accept-language de-DE,de;q=0.9 Referer https://login-microsoftonline.nlmeks.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 11 Jul 2022 21:31:49 GMT content-encoding gzip vary Accept-Encoding x-azure-ref-originshield 0mnXKYgAAAABaKrtZV2yIQLMLUn+Rwq4MTE9OMjFFREdFMDIxMAAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY= x-cache TCP_HIT x-ms-lease-status unlocked last-modified Wed, 12 Feb 2020 22:01:30 GMT server nginx/1.21.6 x-azure-ref 0xZbMYgAAAAAj7ah8C9OVT7EPL5zgvHIlTE9OMjEyMDUwNzE4MDM5ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== content-type image/svg+xml access-control-allow-origin * x-ms-request-id 5f63d730-c01e-0023-310d-93db46000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19
GET H2	200	microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg aadcdn-msauth-b0a9af9c.nlmeks.com/shared/1.0/content/images/	4 KB 2 KB	190ms 190ms	Image image/svg+xml	185.102.170.161 AS-SERVERION Serv...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn-msauth-b0a9af9c.nlmeks.com/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.102.170.161 Ashburn, United States, ASN213035 (AS-SERVERION Serverion B.V., NL), Reverse DNS Software nginx/1.21.6 / Resource Hash `04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a` Request headers accept-language de-DE,de;q=0.9 Referer https://login-microsoftonline.nlmeks.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Mon, 11 Jul 2022 21:31:49 GMT content-encoding gzip vary Accept-Encoding x-azure-ref-originshield 0i1bIYgAAAAB54wrHIff/RbNS7fQSykfERlJBMjMxMDUwNDE4MDQ1ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== x-cache TCP_HIT x-ms-lease-status unlocked last-modified Fri, 17 Jan 2020 19:28:38 GMT server nginx/1.21.6 x-azure-ref 0xZbMYgAAAABL0tM6vH/2Sodbrr+5TG3XRlJBMjMxMDUwNDE5MDE3ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== content-type image/svg+xml access-control-allow-origin * x-ms-request-id ff40b9dc-e01e-0021-7fe3-928d42000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19
GET H2	200	marching_ants_white_166de53471265253ab3a456defe6da23.gif aadcdn-msauth-b0a9af9c.nlmeks.com/shared/1.0/content/images/	3 KB 3 KB	332ms 331ms	Image image/gif	185.102.170.161 AS-SERVERION Serv...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn-msauth-b0a9af9c.nlmeks.com/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif Requested by Host: aadcdn-msauth-b0a9af9c.nlmeks.com URL: https://aadcdn-msauth-b0a9af9c.nlmeks.com/shared/1.0/content/js/ConvergedLogin_PCore_BdGsyKr09CEVooArpGMldQ2.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.102.170.161 Ashburn, United States, ASN213035 (AS-SERVERION Serverion B.V., NL), Reverse DNS Software nginx/1.21.6 / Resource Hash `a46201581a7c7c667fd42787cd1e9adf2f6bf809efb7596e61a03e8dba9ada13` Request headers accept-language de-DE,de;q=0.9 Referer https://login-microsoftonline.nlmeks.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers x-ms-lease-status unlocked x-ms-blob-type BlockBlob date Mon, 11 Jul 2022 21:31:49 GMT last-modified Fri, 17 Jan 2020 19:28:37 GMT server nginx/1.21.6 etag 0x8D79B83739984DD x-azure-ref 0xZbMYgAAAADV89V/PvdrSaUyr1eJi/HGTE9OMjEyMDUwNzE4MDA5ADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== x-cache TCP_HIT content-type image/gif access-control-allow-origin * x-ms-request-id 52566466-501e-0032-45d4-934066000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 x-azure-ref-originshield 0GTnKYgAAAADl153R/h6MRJebWGCZSd5KTE9OMjFFREdFMDIxMgAzOWExMmY3ZS04OTlmLTQ2Y2YtYTZkMC0yNGJiYmEyN2Q5NTY=
GET H2	200	marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif aadcdn-msauth-b0a9af9c.nlmeks.com/shared/1.0/content/images/	4 KB 4 KB	240ms 239ms	Image image/gif	185.102.170.161 AS-SERVERION Serv...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn-msauth-b0a9af9c.nlmeks.com/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif Requested by Host: aadcdn-msauth-b0a9af9c.nlmeks.com URL: https://aadcdn-msauth-b0a9af9c.nlmeks.com/shared/1.0/content/js/ConvergedLogin_PCore_BdGsyKr09CEVooArpGMldQ2.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.102.170.161 Ashburn, United States, ASN213035 (AS-SERVERION Serverion B.V., NL), Reverse DNS Software nginx/1.21.6 / Resource Hash `8737d721808655f37b333f08a90185699e7e8b9bdaaa15cdb63c8448b426f95d` Request headers accept-language de-DE,de;q=0.9 Referer https://login-microsoftonline.nlmeks.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 Response headers x-ms-lease-status unlocked x-ms-blob-type BlockBlob date Mon, 11 Jul 2022 21:31:49 GMT last-modified Fri, 17 Jan 2020 19:28:38 GMT server nginx/1.21.6 etag 0x8D79B8373B17F89 x-azure-ref 0xZbMYgAAAACDS/5mN0z7RbNFvde0z5KKUEFSMjAxMDgwMzg0MDUzADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng== x-cache TCP_HIT content-type image/gif access-control-allow-origin * x-ms-request-id e2404795-901e-0002-3390-926177000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 x-azure-ref-originshield 0iZTJYgAAAACC971BOIawRJlPyssuO9YpUEFSMjAxMDMxMDEyMDMzADM5YTEyZjdlLTg5OWYtNDZjZi1hNmQwLTI0YmJiYTI3ZDk1Ng==
GET H2	200	Me.htm Show response login.nlmeks.com/ Frame 16C2	2 KB 1 KB	421ms 421ms	Document text/html	185.102.170.161 AS-SERVERION Serv...
General Check archive.org Show headers Download Go to Full URL https://login.nlmeks.com/Me.htm?v=3 Requested by Host: aadcdn-msauth-b0a9af9c.nlmeks.com URL: https://aadcdn-msauth-b0a9af9c.nlmeks.com/shared/1.0/content/js/ConvergedLogin_PCore_BdGsyKr09CEVooArpGMldQ2.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 185.102.170.161 Ashburn, United States, ASN213035 (AS-SERVERION Serverion B.V., NL), Reverse DNS Software nginx/1.21.6 / Resource Hash `c76ea994f670a158a6dee00d40331fc234e1799b3c01b8ebe38e08804ed5abe4` Request headers Referer https://login-microsoftonline.nlmeks.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.53 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-headers * access-control-allow-origin * cache-control max-age=315360000 content-encoding gzip content-type text/html; charset=utf-8 date Mon, 11 Jul 2022 21:31:49 GMT p3p CP="DSP CUR OTPi IND OTRi ONL FIN" ppserver PPV: 30 H: BL02EPF000066CE V: 0 referrer-policy strict-origin-when-cross-origin server nginx/1.21.6 vary Accept-Encoding Accept-Encoding x-ms-request-id 30daf2ed-42f5-4ff1-a026-1663cf8277e0 x-ms-route-info R3_BL2

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

30 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

9 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.nlmeks.com/	1970-01-20 13:11:51	Name: __Yxfj Value: YjBhOWFmOWMtZmU3Ni00MzBiLTk4NTItZWUwZWQ0ZmE2OGY1OmY5ODk5MjliLTMzMGMtNGViYi04ODBjLWExMDNlNGI0MzUwMQ==
.nlmeks.com/	1970-02-08 18:14:06	Name: MUID Value: 3D21D9CC867C6CA51FAAC81287FF6D92
wwwoffice.nlmeks.com/	1970-02-08 08:52:31	Name: .AspNetCore.Correlation.OpenIdConnectV2.WypZfzcHp0ehhPKB8jiLFfdtMpIlFHvVY1go9Lsc5UY Value: N
wwwoffice.nlmeks.com/	1970-02-08 08:52:31	Name: .AspNetCore.OpenIdConnect.Nonce.UZVGglNQZ-CaCxn7Mc_PVR3ZJUWpeaDJe7blKgATlrdISn5NA8vu4s4GDlNJMHthGyth399crEiKV6bvrciF7GK-URpsgiu77CMDF0KD1-ZSVn8fSLhrmNtb2_R6J9Xhka1qEOVBI2zopE_GmnlxTEcHO1iWIek8bP7fC6gRGj0X9YTR30o4QtaVEz22WDZ99s57hxwG59vX2kPnA03j002trirvEssrL3Vu1ZAx8j8cFKT_AZQyFgrWiZiT-N0O Value: N
wwwoffice.nlmeks.com/	1970-02-08 08:52:59	Name: OH.DCAffinity Value: OH-weu
wwwoffice.nlmeks.com/	1970-02-08 17:38:06	Name: OH.FLID Value: 74c9147f-2847-4254-8b61-4e9778af9048
.login-microsoftonline.nlmeks.com/	1969-12-31 23:59:59	Name: AADSSO Value: NA\|NoExtension
login-microsoftonline.nlmeks.com/	1970-01-20 04:26:15	Name: SSOCOOKIEPULLED Value: 1
.login-microsoftonline.nlmeks.com/	1970-01-20 13:47:51	Name: brcap Value: 0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn-msauth-b0a9af9c.nlmeks.com
login-microsoftonline.nlmeks.com
login.nlmeks.com
wwwoffice.nlmeks.com
185.102.170.161
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
224c1e2f8859440f070a66624b09c4092a51d246876411e9ce59a9f482bdd2ad
4b7a3728464b85e69ab991e57840e89e7f1314d3187b4eac6f67e187d90d5737
8737d721808655f37b333f08a90185699e7e8b9bdaaa15cdb63c8448b426f95d
8a347aca9067fa57fb197345311d4fbb34cb5a90899dda44c417db1ddbbbe00f
a46201581a7c7c667fd42787cd1e9adf2f6bf809efb7596e61a03e8dba9ada13
c76ea994f670a158a6dee00d40331fc234e1799b3c01b8ebe38e08804ed5abe4
d38c9b217a71fe2b3f7a5eaf534c8c103081733b25caa132383a583830736fb3
df2c40d6032c40476090e9b69c506f72178212104d7f1f415b10c60c0613cc85
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

login-microsoftonline.nlmeks.com Open in urlscan Pro 185.102.170.161 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

16 Requests

100 %HTTPS

0 %IPv6

1 Domains

4 Subdomains

1 IPs

1 Countries

394 kBTransfer

1230 kBSize

9 Cookies

3 Outgoing links

Page URL History

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

30 JavaScript Global Variables

9 Cookies

Indicators

login-microsoftonline.nlmeks.com Open in urlscan Pro
185.102.170.161 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

100 %
HTTPS

0 %
IPv6

1
Domains

4
Subdomains

1
IPs

1
Countries

394 kB
Transfer

1230 kB
Size

9
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!