office.offic0.online Open in urlscan Pro
172.67.166.217 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://url.us.m.mimecastprotect.com/s/Xqh9CG62WJHzVp9oCKji8L?domain=office.offic0.online
Effective URL:
https://office.offic0.online/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3...
Submission: On May 30 via api (May 30th 2024, 8:22:21 pm UTC) from US — Scanned from US

Summary HTTP 18 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 3 IPs in 1 countries across 3 domains to perform 18 HTTP transactions. The main IP is 172.67.166.217, located in United States and belongs to CLOUDFLARENET, US. The main domain is office.offic0.online.
TLS certificate: Issued by E1 on April 30th 2024. Valid for: 3 months.

This is the only time office.offic0.online was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
2 2	205.139.111.117 205.139.111.117	30031 (MIMECAST-) (MIMECAST-)
3 7	172.67.166.217 172.67.166.217	13335 (CLOUDFLAR...) (CLOUDFLARENET)
13	2620:1ec:bdf::40 2620:1ec:bdf::40	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
18	3

2 205.139.111.117 (United States) 2 redirects

ASN30031 (MIMECAST-, US)
PTR: us-api.mimecast.com

url.us.m.mimecastprotect.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 172.67.166.217 (United States) 3 redirects

ASN13335 (CLOUDFLARENET, US)

office.offic0.online	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
react.offic0.online	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ywnjb.offic0.online	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

13 2620:1ec:bdf::40 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

aadcdn.msauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	msauth.net aadcdn.msauth.net — Cisco Umbrella Rank: 892	329 KB
7	offic0.online 3 redirects office.offic0.online react.offic0.online ywnjb.offic0.online	31 KB
2	mimecastprotect.com 2 redirects url.us.m.mimecastprotect.com — Cisco Umbrella Rank: 11045	4 KB
18	3

	Domain	Requested by
13	aadcdn.msauth.net	office.offic0.online aadcdn.msauth.net
4	office.offic0.online	2 redirects aadcdn.msauth.net
2	ywnjb.offic0.online	office.offic0.online aadcdn.msauth.net
2	url.us.m.mimecastprotect.com	2 redirects
1	react.offic0.online	1 redirects
18	5

This site contains links to these domains. Also see Links.

Domain
ywnjb.offic0.online
www.microsoft.com
privacy.microsoft.com

Subject Issuer	Validity	Valid
offic0.online E1	`2024-04-30` - `2024-07-29`	3 months	crt.sh
aadcdn.msauth.net DigiCert SHA2 Secure Server CA	`2024-04-30` - `2025-04-30`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://office.offic0.online/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638526973362872514.NmExYTZkYzYtNDkyYi00MjUxLThhN2MtMGQ4YjM2MjVjNmZjMGNmNjlkOWMtZWM3NS00MmU3LTkyMWMtNTMxYTg5MzdjOGQ3&ui_locales=en-US&mkt=en-US&client-request-id=5c70147a-b3a4-4000-8dee-77fb92dcb540&state=0fdaUNyapjKyufKKAhfhSIoWAKuxDxTAy3gwDAZ9NJRuRp29SKLsYvWujxqauUQS6lX7R--mCGs9lB7Ov7uiv-DJwMgpa4OIEvvek8IFqmpXpBEIBRNur5Ylbt2a4lSUPiR8XZwTnldmP-oQpXzxpQMxVyJmJIlzndcHcr2o5rmxlACR0trnUZEMiOJhQk_TUg8I4ZbcLZh_5CnM4eJzsOJfk1CSddR5EcMnSoidbcT4USTqwZWb5JVLYc_ighwbPbNW0RilP5fxsSv_2mVo7Q&x-client-SKU=ID_NET8_0&x-client-ver=7.3.1.0&sso_reload=true
Frame ID: 6FB56533A71B4FBF81ED97EBB317B264
Requests: 17 HTTP requests in this frame

Frame: https://ywnjb.offic0.online/Me.htm?v=3
Frame ID: 3C38CF87BDD86E6A0BBBAF1E075184C3
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in to your account

Page URL History Show full URLs

https://url.us.m.mimecastprotect.com/s/Xqh9CG62WJHzVp9oCKji8L?domain=office.offic0.online HTTP 307
https://url.us.m.mimecastprotect.com/r/znsBYLmQ1_LF9FMmY_q1wtGxIEdtPO9fcmgTC-8DvaVftues10SqBo6K00sqNrlBkMuwxZklN8... HTTP 307
https://office.offic0.online/TiTwvYXp HTTP 302
https://office.offic0.online/ HTTP 302
https://react.offic0.online/login HTTP 302
https://office.offic0.online/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&... Page URL
https://office.offic0.online/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&... Page URL

Page Statistics

18
Requests

94 %
HTTPS

33 %
IPv6

3
Domains

5
Subdomains

3
IPs

1
Countries

357 kB
Transfer

1179 kB
Size

18
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://ywnjb.offic0.online/oauth20_authorize.srf?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&scope=openid+profile+https%3a%2f%2freact.offic0.online%2fv2%2fOfficeHome.All&redirect_uri=https%3a%2f%2freact.offic0.online%2flandingv2&response_type=code+id_token&state=0fdaUNyapjKyufKKAhfhSIoWAKuxDxTAy3gwDAZ9NJRuRp29SKLsYvWujxqauUQS6lX7R--mCGs9lB7Ov7uiv-DJwMgpa4OIEvvek8IFqmpXpBEIBRNur5Ylbt2a4lSUPiR8XZwTnldmP-oQpXzxpQMxVyJmJIlzndcHcr2o5rmxlACR0trnUZEMiOJhQk_TUg8I4ZbcLZh_5CnM4eJzsOJfk1CSddR5EcMnSoidbcT4USTqwZWb5JVLYc_ighwbPbNW0RilP5fxsSv_2mVo7Q&response_mode=form_post&nonce=638526973362872514.NmExYTZkYzYtNDkyYi00MjUxLThhN2MtMGQ4YjM2MjVjNmZjMGNmNjlkOWMtZWM3NS00MmU3LTkyMWMtNTMxYTg5MzdjOGQ3&x-client-SKU=ID_NET8_0&x-client-Ver=7.3.1.0&uaid=5c70147ab3a440008dee77fb92dcb540&msproxy=1&issuer=mso&tenant=common&ui_locales=en-US&signup=1&lw=1&fl=easi2&epct=PAQABDgEAAADnfolhJpSnRYB1SVj-Hgd8PwyCgw7zQLmRH4DGFCEX_veqaCl1-jKgZFQaJRDr5YJJjgiDnWdXDu422V8gE-TANi0ZTHUJNqZDjsLaiMmsuGGuuUypiomQBCz9yZvougHvbHvnNyPSYAkDohKmtW0aSJVO64PJO5wj7f5kFqCM8NOEYmRkQFrSb2ngsTe2ogyZQWxTsE0l2Wb37B1GOXFeDlMUObbYE3mWpnxB3RLkBiAA&jshs=0
Title: Create one!

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-US/servicesagreement/
Title: Terms of use

Search URL Search Domain Scan URL

URL: https://privacy.microsoft.com/en-US/privacystatement
Title: Privacy & cookies

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://url.us.m.mimecastprotect.com/s/Xqh9CG62WJHzVp9oCKji8L?domain=office.offic0.online HTTP 307
https://url.us.m.mimecastprotect.com/r/znsBYLmQ1_LF9FMmY_q1wtGxIEdtPO9fcmgTC-8DvaVftues10SqBo6K00sqNrlBkMuwxZklN8IjmOnll-y_snMaPHdhKsx69T9LH7rSauLM4EVHyGpLjJJooa3UvYuXPy04GrYwgmYEtMwmGRKfu53xlE7enHme-8AcPUSALHBIMqUi979WN7nJAAuf7YeOfXZ-9PnQeDypGPTwC5-Xsi9N70Z8d0WA91Lndl8iPCoD0Cs8jeE9f5c2BUIynAcsNr8TdC8CV7C1Wvr5T1UPuovL8OEuLBF23jo5-GfVHi6dUpAYLHkefSxq7nLEtzFuBdud56_U-jdkXeC0dEWQjDAQvS38zuup-8WGDlwhekoLhfGp5Cs5NdAVlyxU8gYk3yUf_6ebF8BUBAv22NLeylo4D-UUyS3rBGoa6eEC8GNung15wWnAjHCs8uFMhy79g1vtbQ03crJpiv6nXhfeelxoSayquGhqhpymR8_6m67O7ky2fGY22crDMfUIySUuncB13D-8mxCmNE7PujOfzFmSyC8_pIFXR5NkIWvlk2cZ2JuD2LTT3L5-4F9PxxyQ8RIuaiLyCzBczZCV4tS8BwuhaIx7W8KUgy4f7bdUa3CbdISY50LG4g9xocKXky7ixA_wjpWvgF_GJ84D4gI60Qknb2mlXQDLcNHrHFtkdVR8O8s_Gno7Cj2xqyJsvkscMm40unzF8fPZ5SYw2_5RRc34w9cq5Y3K6idUq7k2bdsJ6nMFGQOTTzZx7RXf6Q5omW9uOPGuPOdfm7F75wxlc5CqGMLVEUizAXlAm2WHf8gL9tg0VqBDL6v2HP2MxGlx8K9HYA467DjSBEY6i4gFVkcwgt284LhDn24qqLj6ad4AuN0Qdfiap9V7jC1VriWcCNdF4aWVo6zl6dEK7Cph80cfJHv01SHDb3RaDBD4OPge6euBI4CFc6RROQPq9aK9r2FLemn57xoUxb7fqgVt8N1-WqHg7-iQBhGIpo9UiKpReTtgMxSYZdYXo64ercDYnpjWX2YMT9YFq3oCSv5Uu99ZRTVxHXElkhRc0SiAL9g3gVRwgDVpGSu16L7n0SZ-HU7yagqIG0zZ6lU5v775LP1ucs3s5vKVqQgaJ3ed9OQw5Vc6DN2IqkeGpcwz3NCNeKb2I-hzUBe0t06LVsPT3eh2hPLqdQNoQfO3Ewy-BDExYBMSoNV2P46js2NIgEmwYw0LJX0o9TUzxp9-vquRHHWuwFFK8XDgAQCGhpbyOVZ_tEQRTM0fzekVrxpPrvI-wd3s4hKJ3oMxGXxdovCAUvkJzMVO2UJndEJMhoZEXkoF6cxb8QKE59oHBZnhKQBUHLEHmrwR10mQcDZxFbUXJ4ymNbHJkJFdjlKOOXXXtZX6g_VJ-bFkBfXLraqb8RMZo-Za1BlW97AHK1IODPdo5ASdUlZtaw07DHhybLRpvXkAt-XkU_HksUg2nchRL3STgDQOJev4UgFTPwQOcn2rD91cr53O-RPAcngvrOj2MqTS8PWfmjUIxei2qgJ6sqrAJg356vtEpvyXhKro8Sz8vHLd3bwv2BU-d9hUztO5RYbVFYXAlsMsQyxEfF8Og6-iUg9bT9_ZeZRqJFC-q8Chh8X-ygMyBIzEk3cevgWGXOaNVrmcOARfgCB8c--ySZSANwtD7VhwyLNpgjQ3KNM3BFrV5sXZFim3iB1hfR0O2OAGOm7L-Fss0YaGDQL_BdQBOiC2CfgFKzHupOkqODoyC18Sfp6HFDydBC5vyncW5PvKOiX0uzZsQCy1L-71zUHs92Li8z3sLp8tkDVbX7ja9R928i28LSmXu4RHRulM31cpuMDOjS1nBckgmRCDOVCfq753drUNBFNpOGizVl9X0-T21yzdpypqFKxe4fB0ndQT4dd9oP0nfTBT8CEB2kO0ovn09psIuV4CCJYzptWEsACk8y_Gv8SjzCJIaPzUe83IcyIGMlShh3bSaUCIeT4WyPV_VJMoJY2ggG2qdjiyreo9SoLfb59O_OlMaPxUwZtZZgARAvcyXMP6VJhBd4bCradd9U1b1gIkPebj31jLITuQXncg9yWYX5-31x3VA5epepsLYta9SlvekhBnWBH23KUBZ_nURNQPjqPnIpKoOWxYlVobYAly638OySMmiQO9Nqt5nKyBOy6ShBR2mrjw_HbosV-kKagXk-ZBonToZ7-9yTHiCth9HVvd65gRlYZFNyaF1D4gRl0yhb5R-YOP-RVdsFjH1tLhxB1rAf4LladihcBz3l-mOQTMaaC_9_unBvAYGJZcel2kGaAdrm4SrYmsbgt0wzfKm8xEQo0EGX4XSacnZ2zEG3T-5jm6x-IH9pF6CQpuruMHziYj4zMw-cWRbzh2wQwsMLRwAtHtJS6wWHbTrCbgpaNF_GMkuL8mnKliMidTYuTSfe_KLwWg-IKhwE0c_GuX3pczHPD4l-6mTqF7xNkvfxuGErBsxOBtVG0CloX5g45iZ-SyyTfn7aVg4bGVuxkA86izEJGsK8SmkTO96E17K_t_PIxRhk9ow56VTM0E8vVtnNZtRsWwuXscPGAzpFyu8G5SYwlv3T8mY2aarqiRy-4b8RKqmQhmj9VjmUsU2R6cssZHD3lRBahC9MFWpzlTT24Zdmm3MSG7iGfboAAWzztL2FZuUoIf81N6JYbBWBsfQ5eDa-osJdYeEJiimUG93quXYb3MkD-l_CEr1ik0F6lLueK2L0bkeqyuy0Che0CCHYeofGWwivwl6itNw9mFHFtr2Oxg6pOT4ySMM3dBxlw669gjQnin-W89TaL6uMsTHBsVG4sauC5JlgzcPDUcTuOFsdrIqrMcjUQCbwbLqJ2ESWx6qKMRF9KC95EAkO2cQsH3woK8nvWpH-NPu7Vi-7BBK-U10r6Ad_o4n5KIR_jmijUA7gH8FmuR0gteIXrvLwgX3QYl9wFNbZhhUtP3T798492-ndo7Tv2nb18_b3O5xYYtz6MbTq5Xsui4mt4E5S5s1RIj4UbsT5NRdfgzcfCHHWpiemQ0TbRyxth07_-0MSm5SMUQ7i8sF5tCUp7r9uW-27-m94I5uzdkfnwBjWki104ApVpnyQO79-1fXami8dQHhvBtbmpukvneNB4_DHp1gSmatcbY4aPNzTOjhSx71JC7Z-faYpmCRMxW2VeuDWLhWoc HTTP 307
https://office.offic0.online/TiTwvYXp HTTP 302
https://office.offic0.online/ HTTP 302
https://react.offic0.online/login HTTP 302
https://office.offic0.online/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638526973362872514.NmExYTZkYzYtNDkyYi00MjUxLThhN2MtMGQ4YjM2MjVjNmZjMGNmNjlkOWMtZWM3NS00MmU3LTkyMWMtNTMxYTg5MzdjOGQ3&ui_locales=en-US&mkt=en-US&client-request-id=5c70147a-b3a4-4000-8dee-77fb92dcb540&state=0fdaUNyapjKyufKKAhfhSIoWAKuxDxTAy3gwDAZ9NJRuRp29SKLsYvWujxqauUQS6lX7R--mCGs9lB7Ov7uiv-DJwMgpa4OIEvvek8IFqmpXpBEIBRNur5Ylbt2a4lSUPiR8XZwTnldmP-oQpXzxpQMxVyJmJIlzndcHcr2o5rmxlACR0trnUZEMiOJhQk_TUg8I4ZbcLZh_5CnM4eJzsOJfk1CSddR5EcMnSoidbcT4USTqwZWb5JVLYc_ighwbPbNW0RilP5fxsSv_2mVo7Q&x-client-SKU=ID_NET8_0&x-client-ver=7.3.1.0 Page URL
https://office.offic0.online/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638526973362872514.NmExYTZkYzYtNDkyYi00MjUxLThhN2MtMGQ4YjM2MjVjNmZjMGNmNjlkOWMtZWM3NS00MmU3LTkyMWMtNTMxYTg5MzdjOGQ3&ui_locales=en-US&mkt=en-US&client-request-id=5c70147a-b3a4-4000-8dee-77fb92dcb540&state=0fdaUNyapjKyufKKAhfhSIoWAKuxDxTAy3gwDAZ9NJRuRp29SKLsYvWujxqauUQS6lX7R--mCGs9lB7Ov7uiv-DJwMgpa4OIEvvek8IFqmpXpBEIBRNur5Ylbt2a4lSUPiR8XZwTnldmP-oQpXzxpQMxVyJmJIlzndcHcr2o5rmxlACR0trnUZEMiOJhQk_TUg8I4ZbcLZh_5CnM4eJzsOJfk1CSddR5EcMnSoidbcT4USTqwZWb5JVLYc_ighwbPbNW0RilP5fxsSv_2mVo7Q&x-client-SKU=ID_NET8_0&x-client-ver=7.3.1.0&sso_reload=true Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://url.us.m.mimecastprotect.com/s/Xqh9CG62WJHzVp9oCKji8L?domain=office.offic0.online HTTP 307
https://url.us.m.mimecastprotect.com/r/znsBYLmQ1_LF9FMmY_q1wtGxIEdtPO9fcmgTC-8DvaVftues10SqBo6K00sqNrlBkMuwxZklN8IjmOnll-y_snMaPHdhKsx69T9LH7rSauLM4EVHyGpLjJJooa3UvYuXPy04GrYwgmYEtMwmGRKfu53xlE7enHme-8AcPUSALHBIMqUi979WN7nJAAuf7YeOfXZ-9PnQeDypGPTwC5-Xsi9N70Z8d0WA91Lndl8iPCoD0Cs8jeE9f5c2BUIynAcsNr8TdC8CV7C1Wvr5T1UPuovL8OEuLBF23jo5-GfVHi6dUpAYLHkefSxq7nLEtzFuBdud56_U-jdkXeC0dEWQjDAQvS38zuup-8WGDlwhekoLhfGp5Cs5NdAVlyxU8gYk3yUf_6ebF8BUBAv22NLeylo4D-UUyS3rBGoa6eEC8GNung15wWnAjHCs8uFMhy79g1vtbQ03crJpiv6nXhfeelxoSayquGhqhpymR8_6m67O7ky2fGY22crDMfUIySUuncB13D-8mxCmNE7PujOfzFmSyC8_pIFXR5NkIWvlk2cZ2JuD2LTT3L5-4F9PxxyQ8RIuaiLyCzBczZCV4tS8BwuhaIx7W8KUgy4f7bdUa3CbdISY50LG4g9xocKXky7ixA_wjpWvgF_GJ84D4gI60Qknb2mlXQDLcNHrHFtkdVR8O8s_Gno7Cj2xqyJsvkscMm40unzF8fPZ5SYw2_5RRc34w9cq5Y3K6idUq7k2bdsJ6nMFGQOTTzZx7RXf6Q5omW9uOPGuPOdfm7F75wxlc5CqGMLVEUizAXlAm2WHf8gL9tg0VqBDL6v2HP2MxGlx8K9HYA467DjSBEY6i4gFVkcwgt284LhDn24qqLj6ad4AuN0Qdfiap9V7jC1VriWcCNdF4aWVo6zl6dEK7Cph80cfJHv01SHDb3RaDBD4OPge6euBI4CFc6RROQPq9aK9r2FLemn57xoUxb7fqgVt8N1-WqHg7-iQBhGIpo9UiKpReTtgMxSYZdYXo64ercDYnpjWX2YMT9YFq3oCSv5Uu99ZRTVxHXElkhRc0SiAL9g3gVRwgDVpGSu16L7n0SZ-HU7yagqIG0zZ6lU5v775LP1ucs3s5vKVqQgaJ3ed9OQw5Vc6DN2IqkeGpcwz3NCNeKb2I-hzUBe0t06LVsPT3eh2hPLqdQNoQfO3Ewy-BDExYBMSoNV2P46js2NIgEmwYw0LJX0o9TUzxp9-vquRHHWuwFFK8XDgAQCGhpbyOVZ_tEQRTM0fzekVrxpPrvI-wd3s4hKJ3oMxGXxdovCAUvkJzMVO2UJndEJMhoZEXkoF6cxb8QKE59oHBZnhKQBUHLEHmrwR10mQcDZxFbUXJ4ymNbHJkJFdjlKOOXXXtZX6g_VJ-bFkBfXLraqb8RMZo-Za1BlW97AHK1IODPdo5ASdUlZtaw07DHhybLRpvXkAt-XkU_HksUg2nchRL3STgDQOJev4UgFTPwQOcn2rD91cr53O-RPAcngvrOj2MqTS8PWfmjUIxei2qgJ6sqrAJg356vtEpvyXhKro8Sz8vHLd3bwv2BU-d9hUztO5RYbVFYXAlsMsQyxEfF8Og6-iUg9bT9_ZeZRqJFC-q8Chh8X-ygMyBIzEk3cevgWGXOaNVrmcOARfgCB8c--ySZSANwtD7VhwyLNpgjQ3KNM3BFrV5sXZFim3iB1hfR0O2OAGOm7L-Fss0YaGDQL_BdQBOiC2CfgFKzHupOkqODoyC18Sfp6HFDydBC5vyncW5PvKOiX0uzZsQCy1L-71zUHs92Li8z3sLp8tkDVbX7ja9R928i28LSmXu4RHRulM31cpuMDOjS1nBckgmRCDOVCfq753drUNBFNpOGizVl9X0-T21yzdpypqFKxe4fB0ndQT4dd9oP0nfTBT8CEB2kO0ovn09psIuV4CCJYzptWEsACk8y_Gv8SjzCJIaPzUe83IcyIGMlShh3bSaUCIeT4WyPV_VJMoJY2ggG2qdjiyreo9SoLfb59O_OlMaPxUwZtZZgARAvcyXMP6VJhBd4bCradd9U1b1gIkPebj31jLITuQXncg9yWYX5-31x3VA5epepsLYta9SlvekhBnWBH23KUBZ_nURNQPjqPnIpKoOWxYlVobYAly638OySMmiQO9Nqt5nKyBOy6ShBR2mrjw_HbosV-kKagXk-ZBonToZ7-9yTHiCth9HVvd65gRlYZFNyaF1D4gRl0yhb5R-YOP-RVdsFjH1tLhxB1rAf4LladihcBz3l-mOQTMaaC_9_unBvAYGJZcel2kGaAdrm4SrYmsbgt0wzfKm8xEQo0EGX4XSacnZ2zEG3T-5jm6x-IH9pF6CQpuruMHziYj4zMw-cWRbzh2wQwsMLRwAtHtJS6wWHbTrCbgpaNF_GMkuL8mnKliMidTYuTSfe_KLwWg-IKhwE0c_GuX3pczHPD4l-6mTqF7xNkvfxuGErBsxOBtVG0CloX5g45iZ-SyyTfn7aVg4bGVuxkA86izEJGsK8SmkTO96E17K_t_PIxRhk9ow56VTM0E8vVtnNZtRsWwuXscPGAzpFyu8G5SYwlv3T8mY2aarqiRy-4b8RKqmQhmj9VjmUsU2R6cssZHD3lRBahC9MFWpzlTT24Zdmm3MSG7iGfboAAWzztL2FZuUoIf81N6JYbBWBsfQ5eDa-osJdYeEJiimUG93quXYb3MkD-l_CEr1ik0F6lLueK2L0bkeqyuy0Che0CCHYeofGWwivwl6itNw9mFHFtr2Oxg6pOT4ySMM3dBxlw669gjQnin-W89TaL6uMsTHBsVG4sauC5JlgzcPDUcTuOFsdrIqrMcjUQCbwbLqJ2ESWx6qKMRF9KC95EAkO2cQsH3woK8nvWpH-NPu7Vi-7BBK-U10r6Ad_o4n5KIR_jmijUA7gH8FmuR0gteIXrvLwgX3QYl9wFNbZhhUtP3T798492-ndo7Tv2nb18_b3O5xYYtz6MbTq5Xsui4mt4E5S5s1RIj4UbsT5NRdfgzcfCHHWpiemQ0TbRyxth07_-0MSm5SMUQ7i8sF5tCUp7r9uW-27-m94I5uzdkfnwBjWki104ApVpnyQO79-1fXami8dQHhvBtbmpukvneNB4_DHp1gSmatcbY4aPNzTOjhSx71JC7Z-faYpmCRMxW2VeuDWLhWoc HTTP 307
https://office.offic0.online/TiTwvYXp HTTP 302
https://office.offic0.online/ HTTP 302
https://react.offic0.online/login HTTP 302
https://office.offic0.online/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638526973362872514.NmExYTZkYzYtNDkyYi00MjUxLThhN2MtMGQ4YjM2MjVjNmZjMGNmNjlkOWMtZWM3NS00MmU3LTkyMWMtNTMxYTg5MzdjOGQ3&ui_locales=en-US&mkt=en-US&client-request-id=5c70147a-b3a4-4000-8dee-77fb92dcb540&state=0fdaUNyapjKyufKKAhfhSIoWAKuxDxTAy3gwDAZ9NJRuRp29SKLsYvWujxqauUQS6lX7R--mCGs9lB7Ov7uiv-DJwMgpa4OIEvvek8IFqmpXpBEIBRNur5Ylbt2a4lSUPiR8XZwTnldmP-oQpXzxpQMxVyJmJIlzndcHcr2o5rmxlACR0trnUZEMiOJhQk_TUg8I4ZbcLZh_5CnM4eJzsOJfk1CSddR5EcMnSoidbcT4USTqwZWb5JVLYc_ighwbPbNW0RilP5fxsSv_2mVo7Q&x-client-SKU=ID_NET8_0&x-client-ver=7.3.1.0

18 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H3	200	authorize Show response office.offic0.online/common/oauth2/v2.0/ Redirect Chain https://url.us.m.mimecastprotect.com/s/Xqh9CG62WJHzVp9oCKji8L?domain=office.offic0.online https://url.us.m.mimecastprotect.com/r/znsBYLmQ1_LF9FMmY_q1wtGxIEdtPO9fcmgTC-8DvaVftues10SqBo6K00sqNrlBkMuwxZklN8IjmOnll-y_snMaPHdhKsx69T9LH7rSauLM4EVHyGpLjJJooa3UvYuXPy04GrYwgmYEtMwmGRKfu53xlE7enH... https://office.offic0.online/TiTwvYXp https://office.offic0.online/ https://react.offic0.online/login https://office.offic0.online/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=op...	21 KB 10 KB	447ms 447ms	Document text/html	172.67.166.217 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://office.offic0.online/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638526973362872514.NmExYTZkYzYtNDkyYi00MjUxLThhN2MtMGQ4YjM2MjVjNmZjMGNmNjlkOWMtZWM3NS00MmU3LTkyMWMtNTMxYTg5MzdjOGQ3&ui_locales=en-US&mkt=en-US&client-request-id=5c70147a-b3a4-4000-8dee-77fb92dcb540&state=0fdaUNyapjKyufKKAhfhSIoWAKuxDxTAy3gwDAZ9NJRuRp29SKLsYvWujxqauUQS6lX7R--mCGs9lB7Ov7uiv-DJwMgpa4OIEvvek8IFqmpXpBEIBRNur5Ylbt2a4lSUPiR8XZwTnldmP-oQpXzxpQMxVyJmJIlzndcHcr2o5rmxlACR0trnUZEMiOJhQk_TUg8I4ZbcLZh_5CnM4eJzsOJfk1CSddR5EcMnSoidbcT4USTqwZWb5JVLYc_ighwbPbNW0RilP5fxsSv_2mVo7Q&x-client-SKU=ID_NET8_0&x-client-ver=7.3.1.0 Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.166.217 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `b429d10c1efe3664720dc4e85b9283c8934e4a95db8217375229b8a3d7a1b976` Request headers Accept-Language en-US,en;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers alt-svc h3=":443"; ma=86400 cache-control no-store, no-cache cf-cache-status DYNAMIC cf-ray 88c16f70ff3f0a16-MIA content-encoding br content-type text/html; charset=utf-8 date Thu, 30 May 2024 20:22:16 GMT expires -1 nel {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} p3p CP="DSP CUR OTPi IND OTRi ONL FIN" pragma no-cache referrer-policy strict-origin-when-cross-origin report-to {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+est"}]} server cloudflare vary Accept-Encoding x-ms-clitelem 1,50168,0,, x-ms-ests-server 2.1.18105.6 - SCUS ProdSlices x-ms-request-id 484fba15-6837-47e6-9ff5-8a83f7a00401 x-ms-srs 1.P Redirect headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 88c16f6e8bb90a16-MIA content-type text/html; charset=utf-8 date Thu, 30 May 2024 20:22:16 GMT location https://office.offic0.online/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638526973362872514.NmExYTZkYzYtNDkyYi00MjUxLThhN2MtMGQ4YjM2MjVjNmZjMGNmNjlkOWMtZWM3NS00MmU3LTkyMWMtNTMxYTg5MzdjOGQ3&ui_locales=en-US&mkt=en-US&client-request-id=5c70147a-b3a4-4000-8dee-77fb92dcb540&state=0fdaUNyapjKyufKKAhfhSIoWAKuxDxTAy3gwDAZ9NJRuRp29SKLsYvWujxqauUQS6lX7R--mCGs9lB7Ov7uiv-DJwMgpa4OIEvvek8IFqmpXpBEIBRNur5Ylbt2a4lSUPiR8XZwTnldmP-oQpXzxpQMxVyJmJIlzndcHcr2o5rmxlACR0trnUZEMiOJhQk_TUg8I4ZbcLZh_5CnM4eJzsOJfk1CSddR5EcMnSoidbcT4USTqwZWb5JVLYc_ighwbPbNW0RilP5fxsSv_2mVo7Q&x-client-SKU=ID_NET8_0&x-client-ver=7.3.1.0 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} referrer-policy strict-origin-when-cross-origin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rrr2kWsqLf1Uo2pWMnDkFXnLY4m03nu4zEe7tuyNx4yMLy47Z9gN9qo21XWvZy7DfUGqyzQRgwWbITfo307bXHvRaqgbFrOHKz%2BZF2%2BHzSfNCXO0qbluqapizleOhsbvHDyVAb8m"}],"group":"cf-nel","max_age":604800} request-context appId= server cloudflare vary Accept-Encoding x-cache CONFIG_NOCACHE x-msedge-ref Ref A: C9948D5677E94DA4969A30F34E1EA757 Ref B: DEN301000105031 Ref C: 2024-05-30T20:22:16Z x-ua-compatible IE=edge,chrome=1
GET H2	200	BssoInterrupt_Core_RY3pVDLvjU_KKLtTKxjDFA2.js Show response aadcdn.msauth.net/shared/1.0/content/js/	138 KB 49 KB	189ms 57ms	Script application/x-javascript	2620:1ec:bdf::40 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msauth.net/shared/1.0/content/js/BssoInterrupt_Core_RY3pVDLvjU_KKLtTKxjDFA2.js Requested by Host: office.offic0.online URL: https://office.offic0.online/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638526973362872514.NmExYTZkYzYtNDkyYi00MjUxLThhN2MtMGQ4YjM2MjVjNmZjMGNmNjlkOWMtZWM3NS00MmU3LTkyMWMtNTMxYTg5MzdjOGQ3&ui_locales=en-US&mkt=en-US&client-request-id=5c70147a-b3a4-4000-8dee-77fb92dcb540&state=0fdaUNyapjKyufKKAhfhSIoWAKuxDxTAy3gwDAZ9NJRuRp29SKLsYvWujxqauUQS6lX7R--mCGs9lB7Ov7uiv-DJwMgpa4OIEvvek8IFqmpXpBEIBRNur5Ylbt2a4lSUPiR8XZwTnldmP-oQpXzxpQMxVyJmJIlzndcHcr2o5rmxlACR0trnUZEMiOJhQk_TUg8I4ZbcLZh_5CnM4eJzsOJfk1CSddR5EcMnSoidbcT4USTqwZWb5JVLYc_ighwbPbNW0RilP5fxsSv_2mVo7Q&x-client-SKU=ID_NET8_0&x-client-ver=7.3.1.0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:bdf::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash `3332d913029f564f91b3ee85abb4fa444d8db0f97b346804088fa4b9da643f66` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://office.offic0.online/ Origin https://office.offic0.online Accept-Language en-US,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 30 May 2024 20:22:17 GMT content-encoding gzip x-cache TCP_HIT x-fd-int-roxy-purgeid 4554691 content-length 49700 x-ms-lease-status unlocked last-modified Mon, 29 Apr 2024 17:13:55 GMT etag 0x8DC686FC03AF5D0 x-azure-ref 20240530T202217Z-1598d476d88shzmzp81571yz640000000g3g000000013hwv content-type application/x-javascript access-control-allow-origin * x-ms-request-id 850b4e64-201e-0030-3266-aac48f000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H3	200	Primary Request authorize Show response office.offic0.online/common/oauth2/v2.0/	44 KB 17 KB	542ms 541ms	Document text/html	172.67.166.217 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://office.offic0.online/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638526973362872514.NmExYTZkYzYtNDkyYi00MjUxLThhN2MtMGQ4YjM2MjVjNmZjMGNmNjlkOWMtZWM3NS00MmU3LTkyMWMtNTMxYTg5MzdjOGQ3&ui_locales=en-US&mkt=en-US&client-request-id=5c70147a-b3a4-4000-8dee-77fb92dcb540&state=0fdaUNyapjKyufKKAhfhSIoWAKuxDxTAy3gwDAZ9NJRuRp29SKLsYvWujxqauUQS6lX7R--mCGs9lB7Ov7uiv-DJwMgpa4OIEvvek8IFqmpXpBEIBRNur5Ylbt2a4lSUPiR8XZwTnldmP-oQpXzxpQMxVyJmJIlzndcHcr2o5rmxlACR0trnUZEMiOJhQk_TUg8I4ZbcLZh_5CnM4eJzsOJfk1CSddR5EcMnSoidbcT4USTqwZWb5JVLYc_ighwbPbNW0RilP5fxsSv_2mVo7Q&x-client-SKU=ID_NET8_0&x-client-ver=7.3.1.0&sso_reload=true Requested by Host: aadcdn.msauth.net URL: https://aadcdn.msauth.net/shared/1.0/content/js/BssoInterrupt_Core_RY3pVDLvjU_KKLtTKxjDFA2.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.166.217 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `3b02a795eede80f57df9fee211b02e4a85ec68cc112540c28827f996fbcccf54` Request headers Accept-Language en-US,en;q=0.9;q=0.9 Referer https://office.offic0.online/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638526973362872514.NmExYTZkYzYtNDkyYi00MjUxLThhN2MtMGQ4YjM2MjVjNmZjMGNmNjlkOWMtZWM3NS00MmU3LTkyMWMtNTMxYTg5MzdjOGQ3&ui_locales=en-US&mkt=en-US&client-request-id=5c70147a-b3a4-4000-8dee-77fb92dcb540&state=0fdaUNyapjKyufKKAhfhSIoWAKuxDxTAy3gwDAZ9NJRuRp29SKLsYvWujxqauUQS6lX7R--mCGs9lB7Ov7uiv-DJwMgpa4OIEvvek8IFqmpXpBEIBRNur5Ylbt2a4lSUPiR8XZwTnldmP-oQpXzxpQMxVyJmJIlzndcHcr2o5rmxlACR0trnUZEMiOJhQk_TUg8I4ZbcLZh_5CnM4eJzsOJfk1CSddR5EcMnSoidbcT4USTqwZWb5JVLYc_ighwbPbNW0RilP5fxsSv_2mVo7Q&x-client-SKU=ID_NET8_0&x-client-ver=7.3.1.0 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers alt-svc h3=":443"; ma=86400 cache-control no-store, no-cache cf-cache-status DYNAMIC cf-ray 88c16f756cb50a16-MIA content-encoding br content-type text/html; charset=utf-8 date Thu, 30 May 2024 20:22:17 GMT expires -1 link <https://aadcdn.msauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msauth.net>; rel=dns-prefetch,<https://aadcdn.msftauth.net>; rel=dns-prefetch nel {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} p3p CP="DSP CUR OTPi IND OTRi ONL FIN" pragma no-cache referrer-policy strict-origin-when-cross-origin report-to {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+est"}]} server cloudflare vary Accept-Encoding x-dns-prefetch-control on x-ms-clitelem 1,0,0,, x-ms-ests-server 2.1.18105.6 - NCUS ProdSlices x-ms-request-id dad7131f-53fc-4d0f-8b6e-a6cbe91e5701 x-ms-srs 1.P
GET		favicon.ico office.offic0.online/	0 0

GET H3	200	Me.htm ywnjb.offic0.online/	0 0	708ms 695ms	Other text/html	172.67.166.217 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ywnjb.offic0.online/Me.htm?v=3 Requested by Host: office.offic0.online URL: https://office.offic0.online/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638526973362872514.NmExYTZkYzYtNDkyYi00MjUxLThhN2MtMGQ4YjM2MjVjNmZjMGNmNjlkOWMtZWM3NS00MmU3LTkyMWMtNTMxYTg5MzdjOGQ3&ui_locales=en-US&mkt=en-US&client-request-id=5c70147a-b3a4-4000-8dee-77fb92dcb540&state=0fdaUNyapjKyufKKAhfhSIoWAKuxDxTAy3gwDAZ9NJRuRp29SKLsYvWujxqauUQS6lX7R--mCGs9lB7Ov7uiv-DJwMgpa4OIEvvek8IFqmpXpBEIBRNur5Ylbt2a4lSUPiR8XZwTnldmP-oQpXzxpQMxVyJmJIlzndcHcr2o5rmxlACR0trnUZEMiOJhQk_TUg8I4ZbcLZh_5CnM4eJzsOJfk1CSddR5EcMnSoidbcT4USTqwZWb5JVLYc_ighwbPbNW0RilP5fxsSv_2mVo7Q&x-client-SKU=ID_NET8_0&x-client-ver=7.3.1.0&sso_reload=true Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.166.217 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://office.offic0.online/ Accept-Language en-US,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers
GET H2	200	converged.v2.login.min_9oft0ybq1qhuafkqh5wryq2.css aadcdn.msauth.net/ests/2.1/content/cdnbundles/	110 KB 20 KB	36ms 34ms	Stylesheet text/css	2620:1ec:bdf::40 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_9oft0ybq1qhuafkqh5wryq2.css Requested by Host: office.offic0.online URL: https://office.offic0.online/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638526973362872514.NmExYTZkYzYtNDkyYi00MjUxLThhN2MtMGQ4YjM2MjVjNmZjMGNmNjlkOWMtZWM3NS00MmU3LTkyMWMtNTMxYTg5MzdjOGQ3&ui_locales=en-US&mkt=en-US&client-request-id=5c70147a-b3a4-4000-8dee-77fb92dcb540&state=0fdaUNyapjKyufKKAhfhSIoWAKuxDxTAy3gwDAZ9NJRuRp29SKLsYvWujxqauUQS6lX7R--mCGs9lB7Ov7uiv-DJwMgpa4OIEvvek8IFqmpXpBEIBRNur5Ylbt2a4lSUPiR8XZwTnldmP-oQpXzxpQMxVyJmJIlzndcHcr2o5rmxlACR0trnUZEMiOJhQk_TUg8I4ZbcLZh_5CnM4eJzsOJfk1CSddR5EcMnSoidbcT4USTqwZWb5JVLYc_ighwbPbNW0RilP5fxsSv_2mVo7Q&x-client-SKU=ID_NET8_0&x-client-ver=7.3.1.0&sso_reload=true Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:bdf::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash `7363adbb18193c85ac24339ab57b08df1c8ef875186edbc85d1ce9184a05a20b` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://office.offic0.online/ Origin https://office.offic0.online Accept-Language en-US,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 30 May 2024 20:22:17 GMT content-encoding gzip x-cache TCP_HIT x-fd-int-roxy-purgeid 4554691 content-length 20323 x-ms-lease-status unlocked last-modified Fri, 03 May 2024 20:13:14 GMT etag 0x8DC6BAD769FFC3E x-azure-ref 20240530T202217Z-1598d476d88shzmzp81571yz640000000g3g000000013hzf content-type text/css access-control-allow-origin * x-ms-request-id 13ca0521-401e-0072-626c-aa419a000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	ConvergedLogin_PCore_T2EBBtMmyv072RjbQwNpoQ2.js Show response aadcdn.msauth.net/shared/1.0/content/js/	434 KB 119 KB	37ms 36ms	Script application/x-javascript	2620:1ec:bdf::40 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_T2EBBtMmyv072RjbQwNpoQ2.js Requested by Host: office.offic0.online URL: https://office.offic0.online/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638526973362872514.NmExYTZkYzYtNDkyYi00MjUxLThhN2MtMGQ4YjM2MjVjNmZjMGNmNjlkOWMtZWM3NS00MmU3LTkyMWMtNTMxYTg5MzdjOGQ3&ui_locales=en-US&mkt=en-US&client-request-id=5c70147a-b3a4-4000-8dee-77fb92dcb540&state=0fdaUNyapjKyufKKAhfhSIoWAKuxDxTAy3gwDAZ9NJRuRp29SKLsYvWujxqauUQS6lX7R--mCGs9lB7Ov7uiv-DJwMgpa4OIEvvek8IFqmpXpBEIBRNur5Ylbt2a4lSUPiR8XZwTnldmP-oQpXzxpQMxVyJmJIlzndcHcr2o5rmxlACR0trnUZEMiOJhQk_TUg8I4ZbcLZh_5CnM4eJzsOJfk1CSddR5EcMnSoidbcT4USTqwZWb5JVLYc_ighwbPbNW0RilP5fxsSv_2mVo7Q&x-client-SKU=ID_NET8_0&x-client-ver=7.3.1.0&sso_reload=true Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:bdf::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash `6fe19f0c972beb2f67cceaa67786f882fb6fca4cebc27c411e7236932eda340b` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://office.offic0.online/ Origin https://office.offic0.online Accept-Language en-US,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 30 May 2024 20:22:17 GMT content-encoding gzip x-cache TCP_HIT x-fd-int-roxy-purgeid 4554691 content-length 121438 x-ms-lease-status unlocked last-modified Thu, 02 May 2024 00:42:33 GMT etag 0x8DC6A40C1A376F5 x-azure-ref 20240530T202217Z-1598d476d88shzmzp81571yz640000000g3g000000013hzg content-type application/x-javascript access-control-allow-origin * x-ms-request-id 212b8a3f-d01e-0063-7565-aadaba000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	ux.converged.login.strings-en.min_vtf__v_j2jh3v2otg9k3lq2.js Show response aadcdn.msauth.net/ests/2.1/content/cdnbundles/	54 KB 16 KB	36ms 35ms	Script application/x-javascript	2620:1ec:bdf::40 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_vtf__v_j2jh3v2otg9k3lq2.js Requested by Host: office.offic0.online URL: https://office.offic0.online/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638526973362872514.NmExYTZkYzYtNDkyYi00MjUxLThhN2MtMGQ4YjM2MjVjNmZjMGNmNjlkOWMtZWM3NS00MmU3LTkyMWMtNTMxYTg5MzdjOGQ3&ui_locales=en-US&mkt=en-US&client-request-id=5c70147a-b3a4-4000-8dee-77fb92dcb540&state=0fdaUNyapjKyufKKAhfhSIoWAKuxDxTAy3gwDAZ9NJRuRp29SKLsYvWujxqauUQS6lX7R--mCGs9lB7Ov7uiv-DJwMgpa4OIEvvek8IFqmpXpBEIBRNur5Ylbt2a4lSUPiR8XZwTnldmP-oQpXzxpQMxVyJmJIlzndcHcr2o5rmxlACR0trnUZEMiOJhQk_TUg8I4ZbcLZh_5CnM4eJzsOJfk1CSddR5EcMnSoidbcT4USTqwZWb5JVLYc_ighwbPbNW0RilP5fxsSv_2mVo7Q&x-client-SKU=ID_NET8_0&x-client-ver=7.3.1.0&sso_reload=true Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:bdf::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash `1ec2987c5ca4dc62e68f417fd75187c267e3ed438167546396ce913019f9fffc` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://office.offic0.online/ Origin https://office.offic0.online Accept-Language en-US,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 30 May 2024 20:22:17 GMT content-encoding gzip x-cache TCP_HIT x-fd-int-roxy-purgeid 4554691 content-length 15917 x-ms-lease-status unlocked last-modified Wed, 24 Apr 2024 05:49:08 GMT etag 0x8DC64224217DD14 x-azure-ref 20240530T202217Z-1598d476d88shzmzp81571yz640000000g3g000000013hzh content-type application/x-javascript access-control-allow-origin * x-ms-request-id cf32c5b8-a01e-0014-1d65-aaf9b4000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	convergedlogin_pcustomizationloader_8e14dcf0e3ff5580d170.js Show response aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/	219 KB 54 KB	150ms 61ms	Script application/x-javascript	2620:1ec:bdf::40 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_8e14dcf0e3ff5580d170.js Requested by Host: aadcdn.msauth.net URL: https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_T2EBBtMmyv072RjbQwNpoQ2.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:bdf::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash `474ce0790ceb18a100cebaf1ac0915a51389fcae0830c3b44bfa1e365d40b2b4` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://office.offic0.online/ Accept-Language en-US,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 30 May 2024 20:22:18 GMT content-encoding gzip x-cache TCP_HIT x-fd-int-roxy-purgeid 4554691 content-length 54318 x-ms-lease-status unlocked last-modified Thu, 28 Mar 2024 21:22:21 GMT etag 0x8DC4F6D2782F92A x-azure-ref 20240530T202218Z-1598d476d887s7h7xz1s3vy23s0000000g0g00000000ke77 content-type application/x-javascript access-control-allow-origin * x-ms-request-id 4c933898-e01e-0010-0c6c-aa55bc000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	favicon_a_eupayfgghqiai7k9sol6lg2.ico aadcdn.msauth.net/shared/1.0/content/images/	17 KB 17 KB	126ms 59ms	Other image/x-icon	2620:1ec:bdf::40 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:bdf::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash `90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://office.offic0.online/ Accept-Language en-US,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 30 May 2024 20:22:18 GMT x-cache TCP_HIT x-fd-int-roxy-purgeid 4554691 content-length 17174 x-ms-lease-status unlocked last-modified Sun, 18 Oct 2020 03:02:03 GMT etag 0x8D8731230C851A6 x-azure-ref 20240530T202218Z-1598d476d887s7h7xz1s3vy23s0000000g0g00000000ke76 content-type image/x-icon access-control-allow-origin * x-ms-request-id 4adf0bd4-e01e-0054-1069-aa2aa5000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	convergedlogin_pfetchsessionsprogress_7c1aa7609345f99e4914.js Show response aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/	15 KB 6 KB	30ms 29ms	Script application/x-javascript	2620:1ec:bdf::40 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_7c1aa7609345f99e4914.js Requested by Host: aadcdn.msauth.net URL: https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_T2EBBtMmyv072RjbQwNpoQ2.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:bdf::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash `35afb11dab6edcbc989a25fe5cf19f5d8289499232b7ec775f318d8b8a5bbf78` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://office.offic0.online/ Accept-Language en-US,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 30 May 2024 20:22:18 GMT content-encoding gzip x-cache TCP_HIT x-fd-int-roxy-purgeid 4554691 content-length 5515 x-ms-lease-status unlocked last-modified Thu, 28 Mar 2024 21:22:21 GMT etag 0x8DC4F6D27C66D37 x-azure-ref 20240530T202218Z-1598d476d887s7h7xz1s3vy23s0000000g0g00000000ke7h content-type application/x-javascript access-control-allow-origin * x-ms-request-id f373ec45-301e-0005-746c-aa6294000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif aadcdn.msauth.net/shared/1.0/content/images/	3 KB 3 KB	30ms 29ms	Image image/gif	2620:1ec:bdf::40 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:bdf::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash `a46201581a7c7c667fd42787cd1e9adf2f6bf809efb7596e61a03e8dba9ada13` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://office.offic0.online/ Accept-Language en-US,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 30 May 2024 20:22:18 GMT x-cache TCP_HIT x-fd-int-roxy-purgeid 4554691 content-length 2672 x-ms-lease-status unlocked last-modified Wed, 24 May 2023 10:11:47 GMT etag 0x8DB5C3F48EC4154 x-azure-ref 20240530T202218Z-1598d476d887s7h7xz1s3vy23s0000000g0g00000000ke7k content-type image/gif access-control-allow-origin * x-ms-request-id 7870f2bc-801e-007e-6d53-aab583000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif aadcdn.msauth.net/shared/1.0/content/images/	4 KB 4 KB	30ms 29ms	Image image/gif	2620:1ec:bdf::40 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:bdf::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash `8737d721808655f37b333f08a90185699e7e8b9bdaaa15cdb63c8448b426f95d` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://office.offic0.online/ Accept-Language en-US,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 30 May 2024 20:22:18 GMT x-cache TCP_HIT x-fd-int-roxy-purgeid 4554691 content-length 3620 x-ms-lease-status unlocked last-modified Wed, 24 May 2023 10:11:48 GMT etag 0x8DB5C3F4904824B x-azure-ref 20240530T202218Z-1598d476d887s7h7xz1s3vy23s0000000g0g00000000ke7m content-type image/gif access-control-allow-origin * x-ms-request-id 53a6dcff-e01e-0078-4357-aa4f8f000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg aadcdn.msauth.net/shared/1.0/content/images/backgrounds/	2 KB 1 KB	31ms 31ms	Image image/svg+xml	2620:1ec:bdf::40 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:bdf::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash `0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://office.offic0.online/ Accept-Language en-US,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 30 May 2024 20:22:18 GMT content-encoding gzip x-cache TCP_HIT x-fd-int-roxy-purgeid 4554691 content-length 673 x-ms-lease-status unlocked last-modified Wed, 24 May 2023 10:11:46 GMT etag 0x8DB5C3F47E260FD x-azure-ref 20240530T202218Z-1598d476d887s7h7xz1s3vy23s0000000g0g00000000ke7s content-type image/svg+xml access-control-allow-origin * x-ms-request-id 90c4d596-901e-005b-1d6c-aaa3ba000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg aadcdn.msauth.net/shared/1.0/content/images/	4 KB 2 KB	30ms 30ms	Image image/svg+xml	2620:1ec:bdf::40 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:bdf::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash `04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://office.offic0.online/ Accept-Language en-US,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 30 May 2024 20:22:18 GMT content-encoding gzip x-cache TCP_HIT x-fd-int-roxy-purgeid 4554691 content-length 1435 x-ms-lease-status unlocked last-modified Wed, 24 May 2023 10:11:48 GMT etag 0x8DB5C3F4911527F x-azure-ref 20240530T202218Z-1598d476d887s7h7xz1s3vy23s0000000g0g00000000ke7t content-type image/svg+xml access-control-allow-origin * x-ms-request-id a2640ed3-001e-001e-636c-aaf7a1000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H3	200	Me.htm Show response ywnjb.offic0.online/ Frame 3C38	2 KB 2 KB	436ms 436ms	Document text/html	172.67.166.217 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ywnjb.offic0.online/Me.htm?v=3 Requested by Host: aadcdn.msauth.net URL: https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_T2EBBtMmyv072RjbQwNpoQ2.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.166.217 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `c7c382c7d0cc42b407f4f51e96beff767470408ee66f96ec79e269cd6f25943b` Request headers Accept-Language en-US,en;q=0.9;q=0.9 Referer https://office.offic0.online/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers alt-svc h3=":443"; ma=86400 cache-control max-age=315360000 cf-cache-status DYNAMIC cf-ray 88c16f7c3d950a16-MIA content-encoding br content-type text/html; charset=utf-8 date Thu, 30 May 2024 20:22:18 GMT expires Sun, 28 May 2034 20:22:18 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} p3p CP="DSP CUR OTPi IND OTRi ONL FIN" ppserver PPV: 30 H: PH1PEPF00011E2F V: 0 referrer-policy strict-origin-when-cross-origin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HG4DhFk8vS3OwfI7GUEJyVnTsUgqa2ZHx7RwuiNKbKOcQah4OycoTxt1sH927ZIIF6KoB%2BhxRIfLrJUqRnf5A60Wo4p0AoRdwU7W9ARZVoz0UGRp59f78dug9f5eNGP%2BGnh8Ba1C"}],"group":"cf-nel","max_age":604800} server cloudflare vary Accept-Encoding x-ms-request-id 72367c89-a2a4-4157-a0b6-dbe3b94eb353 x-ms-route-info C526_BAY
GET H2	200	convergedlogin_pstringcustomizationhelper_ea3e62a2bdfb2b2ee8c8.js Show response aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/	111 KB 36 KB	70ms 69ms	Script application/x-javascript	2620:1ec:bdf::40 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_ea3e62a2bdfb2b2ee8c8.js Requested by Host: aadcdn.msauth.net URL: https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_T2EBBtMmyv072RjbQwNpoQ2.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:bdf::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash `4be11c075187615adaf493d54cb7b05556e76806aed2b3b082d72952d0025be5` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://office.offic0.online/ Accept-Language en-US,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 30 May 2024 20:22:18 GMT content-encoding gzip x-cache TCP_HIT x-fd-int-roxy-purgeid 4554691 content-length 35807 x-ms-lease-status unlocked last-modified Thu, 28 Mar 2024 21:22:22 GMT etag 0x8DC4F6D2855897D x-azure-ref 20240530T202218Z-1598d476d887s7h7xz1s3vy23s0000000g0g00000000keax content-type application/x-javascript access-control-allow-origin * x-ms-request-id 55a34443-f01e-0025-636c-aaf3a7000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg aadcdn.msauth.net/shared/1.0/content/images/	2 KB 1 KB	56ms 56ms	Image image/svg+xml	2620:1ec:bdf::40 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msauth.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2620:1ec:bdf::40 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash `8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93` Request headers sec-ch-ua "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125" Referer https://office.offic0.online/ Accept-Language en-US,en;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 30 May 2024 20:22:18 GMT content-encoding gzip x-cache TCP_HIT x-fd-int-roxy-purgeid 4554691 content-length 621 x-ms-lease-status unlocked last-modified Wed, 24 May 2023 10:11:49 GMT etag 0x8DB5C3F49ED96E0 x-azure-ref 20240530T202218Z-1598d476d887s7h7xz1s3vy23s0000000g0g00000000keb0 content-type image/svg+xml access-control-allow-origin * x-ms-request-id 7e65b9c5-101e-002b-5357-aa51ba000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: office.offic0.online
URL: https://office.offic0.online/favicon.ico

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

18 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.offic0.online/	1970-01-20 20:58:24	Name: 74ee-8f38 Value: 106856eca0ac53886092b94da79bbda573b88fbf92abeb46e32b18a3154912f0
office.offic0.online/	1969-12-31 23:59:59	Name: x-ms-gateway-slice Value: estsfd
office.offic0.online/	1969-12-31 23:59:59	Name: stsservicecookie Value: estsfd
react.offic0.online/	1970-01-20 20:58:49	Name: OH.DCAffinity Value: OH-scu
react.offic0.online/	1970-01-21 05:43:56	Name: OH.FLID Value: faac57e5-9207-4bd9-bc55-149f4f22c223
react.offic0.online/	1970-01-20 20:58:21	Name: .AspNetCore.OpenIdConnect.Nonce.W2OUV0Qee7VWqlfbm4DtwvegCwp1OKuBADVFA2tZe9P3qJlYTl-zPM_0eKLCVrmmpSXi6vcZSoRIl3iQtTM_dR7uYLwYXgbXiOON096HEQUPM2lzPVge5iAmACOZZ7hTCUYmsyGsw3K6gAqDOBFh5ea1hc7DkTnhk4kEwve292KTvoDmF_JC2tQIPNqofXDaCGTxthdDVU7sTb7xRhY6trmGQWRfwOis0ieQD2OR5V1ANH9rcuYKNVCMgz9_CL0p Value: N
react.offic0.online/	1970-01-20 20:58:21	Name: .AspNetCore.Correlation.0m0iIdmxS9qBqzFMHJebgQFCvti9QnzsRhAZj9u45uQ Value: N
.offic0.online/	1970-01-21 06:19:56	Name: MUID Value: 3B3519DCF44C681D03F00D53F59569B8
.office.offic0.online/	1969-12-31 23:59:59	Name: esctx-kVKxGOnjxk Value: AQABCQEAAADnfolhJpSnRYB1SVj-Hgd81U4-4yyoBwY0k-dsGlaKK2v2xg_WtMzwxpbysSMNZySJXIGdOQRq8swT-YUCl2W5S3CXEj4usmtX9R81LeAAS4HfQUXDYGb8nlDlfYyN-KqSwQLDt-oTbQvXD_L23AzNKtQ7PJjp7nF0C2-VS_m9-yAA
.office.offic0.online/	1969-12-31 23:59:59	Name: AADSSO Value: NA\|NoExtension
office.offic0.online/	1970-01-20 20:58:20	Name: SSOCOOKIEPULLED Value: 1
office.offic0.online/	1970-01-20 21:41:32	Name: buid Value: 0.AUUAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd83WnqNI1UkBWN-IYn_qTcx0WcPbc0r692kWBFOuR4Tg0K-HkUTDerX5Lyl0TEE_8xqYKqMqbHNHu9sDaXYFu2JiBhgw8Wh07KjNWNHDpsnEAgAA
.office.offic0.online/	1969-12-31 23:59:59	Name: esctx Value: PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd87gydnagdJTAg51kVC_fxSGBb4ZqsOt-23pwrMPrujmJpzwgWHj6wpurQWqwBM8KJZN7GXmIT4lO1ycR6aNWDGGLaIEd54kUeGS9CfjlwjeJ_LIy9-A8iTniSDWutMvUoy7kqcq_eEzfg5iB3CAbZ6S1Z_6scnyku8CCBesz5vFkgAA
.office.offic0.online/	1969-12-31 23:59:59	Name: esctx-FzrB98FCw8I Value: AQABCQEAAADnfolhJpSnRYB1SVj-Hgd83YE2xjD9ljwAftH0KIJIqMZ68O4rP9dIH1S3GMMSvtiQwKTnc9X47uFcsCnsGUZ2rpOf85AqQLf1uGAasMNt3beTnA4aaoALLcEIaK_DdyfR8IIkkMYfAqT2G3qAOWWOycIJGr6oupVFz7_zbUnBIiAA
office.offic0.online/	1970-01-20 21:41:32	Name: fpc Value: Av3oiSdTrIlBh6a0abE60Bu8Ae7AAQAAAPjW6t0OAAAA
.office.offic0.online/	1970-01-21 06:19:56	Name: brcap Value: 0
.ywnjb.offic0.online/	1969-12-31 23:59:59	Name: MSPRequ Value: id=N&lt=1717100538&co=1
.ywnjb.offic0.online/	1969-12-31 23:59:59	Name: uaid Value: 6bf0908cbea2471ab635d840d178e1f3

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://office.offic0.online/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638526973362872514.NmExYTZkYzYtNDkyYi00MjUxLThhN2MtMGQ4YjM2MjVjNmZjMGNmNjlkOWMtZWM3NS00MmU3LTkyMWMtNTMxYTg5MzdjOGQ3&ui_locales=en-US&mkt=en-US&client-request-id=5c70147a-b3a4-4000-8dee-77fb92dcb540&state=0fdaUNyapjKyufKKAhfhSIoWAKuxDxTAy3gwDAZ9NJRuRp29SKLsYvWujxqauUQS6lX7R--mCGs9lB7Ov7uiv-DJwMgpa4OIEvvek8IFqmpXpBEIBRNur5Ylbt2a4lSUPiR8XZwTnldmP-oQpXzxpQMxVyJmJIlzndcHcr2o5rmxlACR0trnUZEMiOJhQk_TUg8I4ZbcLZh_5CnM4eJzsOJfk1CSddR5EcMnSoidbcT4USTqwZWb5JVLYc_ighwbPbNW0RilP5fxsSv_2mVo7Q&x-client-SKU=ID_NET8_0&x-client-ver=7.3.1.0&sso_reload=true Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msauth.net
office.offic0.online
react.offic0.online
url.us.m.mimecastprotect.com
ywnjb.offic0.online
office.offic0.online
172.67.166.217
205.139.111.117
2620:1ec:bdf::40
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
1ec2987c5ca4dc62e68f417fd75187c267e3ed438167546396ce913019f9fffc
3332d913029f564f91b3ee85abb4fa444d8db0f97b346804088fa4b9da643f66
35afb11dab6edcbc989a25fe5cf19f5d8289499232b7ec775f318d8b8a5bbf78
3b02a795eede80f57df9fee211b02e4a85ec68cc112540c28827f996fbcccf54
474ce0790ceb18a100cebaf1ac0915a51389fcae0830c3b44bfa1e365d40b2b4
4be11c075187615adaf493d54cb7b05556e76806aed2b3b082d72952d0025be5
6fe19f0c972beb2f67cceaa67786f882fb6fca4cebc27c411e7236932eda340b
7363adbb18193c85ac24339ab57b08df1c8ef875186edbc85d1ce9184a05a20b
8737d721808655f37b333f08a90185699e7e8b9bdaaa15cdb63c8448b426f95d
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21
a46201581a7c7c667fd42787cd1e9adf2f6bf809efb7596e61a03e8dba9ada13
b429d10c1efe3664720dc4e85b9283c8934e4a95db8217375229b8a3d7a1b976
c7c382c7d0cc42b407f4f51e96beff767470408ee66f96ec79e269cd6f25943b
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

office.offic0.online Open in urlscan Pro 172.67.166.217 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

18 Requests

94 %HTTPS

33 %IPv6

3 Domains

5 Subdomains

3 IPs

1 Countries

357 kBTransfer

1179 kBSize

18 Cookies

3 Outgoing links

Page URL History

Redirected requests

18 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

22 JavaScript Global Variables

18 Cookies

1 Console Messages

Indicators

office.offic0.online Open in urlscan Pro
172.67.166.217 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

18
Requests

94 %
HTTPS

33 %
IPv6

3
Domains

5
Subdomains

3
IPs

1
Countries

357 kB
Transfer

1179 kB
Size

18
Cookies

18 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!