login.microsoftonline.com

Summary

This website contacted 3 IPs in 3 countries across 4 domains to perform 4 HTTP transactions. The main IP is 2603:1026:3000:150::a, located in Amsterdam, Netherlands and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is login.microsoftonline.com. The Cisco Umbrella rank of the primary domain is 17.
TLS certificate: Issued by DigiCert SHA2 Secure Server CA on February 21st 2024. Valid for: a year.

This is the only time login.microsoftonline.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	2a06:98c1:312... 2a06:98c1:3120::3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 3	159.100.29.109 159.100.29.109	44066 (DE-FIRSTC...) (DE-FIRSTCOLO firstcolo.net)
1	2603:1026:300... 2603:1026:3000:150::a	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2620:1ec:46::45 2620:1ec:46::45	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
4	3

1 2a06:98c1:3120::3 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

leadaction.bestwebdevs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 159.100.29.109 (Germany) 2 redirects

ASN44066 (DE-FIRSTCOLO firstcolo.net, DE)

documents.p-legal.eu	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2603:1026:3000:150::a (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

login.microsoftonline.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:1ec:46::45 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

aadcdn.msauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
3	p-legal.eu 2 redirects documents.p-legal.eu	92 KB
2	msauth.net aadcdn.msauth.net — Cisco Umbrella Rank: 2249	22 KB
1	microsoftonline.com login.microsoftonline.com — Cisco Umbrella Rank: 17	2 KB
1	bestwebdevs.com 1 redirects leadaction.bestwebdevs.com	835 B
4	4

	Domain	Requested by
3	documents.p-legal.eu	2 redirects
2	aadcdn.msauth.net	login.microsoftonline.com
1	login.microsoftonline.com
1	leadaction.bestwebdevs.com	1 redirects
4	4

This site contains links to these domains. Also see Links.

Domain
www.microsoft.com
privacy.microsoft.com

Subject Issuer	Validity	Valid
p-legal.eu R3	`2024-02-23` - `2024-05-23`	3 months	crt.sh
stamp2.login.microsoftonline.com DigiCert SHA2 Secure Server CA	`2024-02-21` - `2025-02-21`	a year	crt.sh
aadcdn.msauth.net DigiCert SHA2 Secure Server CA	`2024-01-29` - `2025-01-29`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://login.microsoftonline.com/jsdisabled
Frame ID: CCFA6BA74A8DA025E9F263AC9C2666FC
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Er is iets fout gegaan

Page URL History Show full URLs

http://leadaction.bestwebdevs.com/kbas3Rkauskasx0qBM2Fe5dli2PnFe5dy9s3RWO3BM2 HTTP 302
https://documents.p-legal.eu/?organisation=medline.com&dse=a2JhY2thdXNrYXNAbWVkbGluZS5jb20= Page URL
https://documents.p-legal.eu/?organisation=medline.com&dse=a2JhY2thdXNrYXNAbWVkbGluZS5jb20= HTTP 302
https://documents.p-legal.eu/?organisation=medline.com&dse=a2JhY2thdXNrYXNAbWVkbGluZS5jb20= HTTP 302
https://login.microsoftonline.com/jsdisabled Page URL

Page Statistics

4
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

3
IPs

3
Countries

116 kB
Transfer

393 kB
Size

5
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://www.microsoft.com/nl-NL/servicesagreement/
Title: Gebruiksvoorwaarden

Search URL Search Domain Scan URL

URL: https://privacy.microsoft.com/nl-NL/privacystatement
Title: Privacy en cookies

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://leadaction.bestwebdevs.com/kbas3Rkauskasx0qBM2Fe5dli2PnFe5dy9s3RWO3BM2 HTTP 302
https://documents.p-legal.eu/?organisation=medline.com&dse=a2JhY2thdXNrYXNAbWVkbGluZS5jb20= Page URL
https://documents.p-legal.eu/?organisation=medline.com&dse=a2JhY2thdXNrYXNAbWVkbGluZS5jb20= HTTP 302
https://documents.p-legal.eu/?organisation=medline.com&dse=a2JhY2thdXNrYXNAbWVkbGluZS5jb20= HTTP 302
https://login.microsoftonline.com/jsdisabled Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://leadaction.bestwebdevs.com/kbas3Rkauskasx0qBM2Fe5dli2PnFe5dy9s3RWO3BM2 HTTP 302
https://documents.p-legal.eu/?organisation=medline.com&dse=a2JhY2thdXNrYXNAbWVkbGluZS5jb20=

4 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

/ Show response
documents.p-legal.eu/
Redirect Chain

http://leadaction.bestwebdevs.com/kbas3Rkauskasx0qBM2Fe5dli2PnFe5dy9s3RWO3BM2
https://documents.p-legal.eu/?organisation=medline.com&dse=a2JhY2thdXNrYXNAbWVkbGluZS5jb20=

279 KB
92 KB

537ms
420ms

Document
text/html

159.100.29.109
DE-FIRSTCOLO firs...

General

Check archive.org

Show headers Download Go to

Full URL: https://documents.p-legal.eu/?organisation=medline.com&dse=a2JhY2thdXNrYXNAbWVkbGluZS5jb20=
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 159.100.29.109 , Germany, ASN44066 (DE-FIRSTCOLO firstcolo.net, DE),
Reverse DNS
Software: nginx /
Resource Hash: bf180edbbeb7840dc62d3511ff22934ddce0c5522e820877b34084e116124f9a

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

content-encoding: gzip
content-type: text/html; charset=utf-8
date: Tue, 19 Mar 2024 13:08:57 GMT
server: nginx
vary: Accept-Encoding

Redirect headers

CF-Cache-Status: DYNAMIC
CF-RAY: 866db1adeec7b8fd-AMS
Connection: keep-alive
Content-Type: text/html; charset=UTF-8
Date: Tue, 19 Mar 2024 13:08:56 GMT
Location: https://documents.p-legal.eu/?organisation=medline.com&dse=a2JhY2thdXNrYXNAbWVkbGluZS5jb20=#/common/authorize?document=0.80672140503615-0ff1-0.31789279417968&auth=10.044347063193259-0.6262766237493
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hmiQhEtjtR%2BAVrwjt84PPN8yIAmI00J2vVu0TIcHE%2B6d3y4I9ADOpgF5rRorhI%2BNysXADEAuATzpOcnLlLVMQLSsOsFqNXnoXAlR%2F%2FPTG0W9Ga8o0t1NABqu6tozUe6oxJgr81%2F846YQ%2FousCv4E3md%2FOV4j30m65g%3D%3D"}],"group":"cf-nel","max_age":604800}
Server: cloudflare
Transfer-Encoding: chunked
alt-svc: h3=":443"; ma=86400

GET
H2

200

Primary Request jsdisabled Show response
login.microsoftonline.com/
Redirect Chain

https://documents.p-legal.eu/?organisation=medline.com&dse=a2JhY2thdXNrYXNAbWVkbGluZS5jb20=
https://documents.p-legal.eu/?organisation=medline.com&dse=a2JhY2thdXNrYXNAbWVkbGluZS5jb20=
https://login.microsoftonline.com/jsdisabled

3 KB
2 KB

160ms
67ms

Document
text/html

2603:1026:3000:150::a
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://login.microsoftonline.com/jsdisabled

Protocol

H2

Security

TLS 1.3, , AES_256_GCM

Server

2603:1026:3000:150::a Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

/

Resource Hash

fe329db6b8e363d7ca74276a209346f1c604b62a6123d39a7f4aa5c65069c62e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://documents.p-legal.eu
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

cache-control: no-store, no-cache
content-encoding: gzip
content-length: 1115
content-type: text/html; charset=utf-8
date: Tue, 19 Mar 2024 13:08:57 GMT
expires: -1
link: <https://aadcdn.msauth.net>; rel=preconnect; crossorigin <https://aadcdn.msauth.net>; rel=dns-prefetch <https://aadcdn.msftauth.net>; rel=dns-prefetch
nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
p3p: CP="DSP CUR OTPi IND OTRi ONL FIN"
pragma: no-cache
referrer-policy: strict-origin-when-cross-origin
report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+ams2"}]}
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
x-content-type-options: nosniff
x-dns-prefetch-control: on
x-ms-ests-server: 2.1.17573.4 - SEC ProdSlices
x-ms-request-id: 5e1e1f66-9bca-462a-8532-9506aa564800
x-xss-protection: 0

Redirect headers

content-type: text/html; charset=utf-8
date: Tue, 19 Mar 2024 13:08:58 GMT
location: https://login.microsoftonline.com/jsdisabled
referrer-policy: no-referrer
server: nginx

GET
H2 200 converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css
aadcdn.msauth.net/ests/2.1/content/cdnbundles/ 110 KB
20 KB 114ms
41ms Stylesheet
text/css 2620:1ec:46::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css
Requested by: Host: login.microsoftonline.com
URL: https://login.microsoftonline.com/jsdisabled
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 4b01a0a34ce8ed4bc8a8713be0442d49da6a756236b7b4424622ca3dee820f41

Request headers

Referer: https://login.microsoftonline.com/
Origin: https://login.microsoftonline.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 19 Mar 2024 13:08:58 GMT
content-encoding: gzip
x-cache: TCP_HIT
x-fd-int-roxy-purgeid: 4554691
content-length: 20314
x-ms-lease-status: unlocked
last-modified: Wed, 27 Dec 2023 18:18:12 GMT
etag: 0x8DC07082FBB8D2B
x-azure-ref: 20240319T130858Z-a6eadgs7w17kf03ntsq91ebg5s00000001q000000000ggf2
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 987e9ee1-e01e-0078-1d4d-794f8f000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 microsoft_logo_ea19b2112f4dfd8e90b4505ef7dcb4f9.png
aadcdn.msauth.net/shared/1.0/content/images/ 1 KB
2 KB 101ms
21ms Image
image/png 2620:1ec:46::45
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_ea19b2112f4dfd8e90b4505ef7dcb4f9.png
Requested by: Host: login.microsoftonline.com
URL: https://login.microsoftonline.com/jsdisabled
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://login.microsoftonline.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.128 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 19 Mar 2024 13:08:58 GMT
x-cache: TCP_HIT
x-fd-int-roxy-purgeid: 4554691
content-length: 1057
x-ms-lease-status: unlocked
last-modified: Wed, 24 May 2023 10:11:48 GMT
etag: 0x8DB5C3F48FD7E08
x-azure-ref: 20240319T130858Z-66ryqtepc15bx7whxmddx0tppg00000000fg00000000kxdg
content-type: image/png
access-control-allow-origin: *
x-ms-request-id: e348c861-201e-0030-6dec-79c48f000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

5 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.p-legal.eu/	1969-12-31 23:59:59	Name: dSm1nU Value: "YWM5YTM1OGMtNGZiMC00Mzc2LWFiMTQtOTVjNmRlYmVmNDE4OjI2NzdlYzY4LTUwZjMtNGUyMC1iYTAyLWZhMmY1NzliNmNkYQ=="
login.microsoftonline.com/	1970-01-20 19:57:25	Name: fpc Value: AobjEZNW53hJjZCntVWe4NQ
.login.microsoftonline.com/	1969-12-31 23:59:59	Name: esctx Value: PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd84lKlmLebiBn6IMTyo_LYPRo8BjEhwQsDMcwJsBAz5JBwPZyzhU_A0QzMsQesw30IF43eROmgjSFGGNb7V2FEq1TJb42MC7jp7AgnXL2PALhwk1goCHD6NeqAHXQEu8G9GuxoC0hQTixHT1pIMoHWayI-vJ0kZWH9d1cNf5RoKNAgAA
login.microsoftonline.com/	1969-12-31 23:59:59	Name: x-ms-gateway-slice Value: estsfd
login.microsoftonline.com/	1969-12-31 23:59:59	Name: stsservicecookie Value: estsfd

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msauth.net
documents.p-legal.eu
leadaction.bestwebdevs.com
login.microsoftonline.com
159.100.29.109
2603:1026:3000:150::a
2620:1ec:46::45
2a06:98c1:3120::3
4b01a0a34ce8ed4bc8a8713be0442d49da6a756236b7b4424622ca3dee820f41
bf180edbbeb7840dc62d3511ff22934ddce0c5522e820877b34084e116124f9a
f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c
fe329db6b8e363d7ca74276a209346f1c604b62a6123d39a7f4aa5c65069c62e

login.microsoftonline.com Open in urlscan Pro 2603:1026:3000:150::a Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

4 Requests

100 %HTTPS

75 %IPv6

4 Domains

4 Subdomains

3 IPs

3 Countries

116 kBTransfer

393 kBSize

5 Cookies

2 Outgoing links

Page URL History

Redirected requests

4 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

5 Cookies

Indicators

login.microsoftonline.com Open in urlscan Pro
2603:1026:3000:150::a Public Scan

Screenshot
Live screenshot

Full Image

4
Requests

100 %
HTTPS

75 %
IPv6

4
Domains

4
Subdomains

3
IPs

3
Countries

116 kB
Transfer

393 kB
Size

5
Cookies

4 HTTP transactions
0 data transactions