urlscan.io logo urlscan.io
SecurityTrails logo

pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev Open in urlscan Pro
2606:4700::6812:223  Malicious Activity! Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://thebutterbabe.com/dee/new/css/bw0wjq/a29jYW1wb0Bmb3J0aXNyZXAuY29t
Effective URL: https://pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev/cor.html
Submission: On July 14 via automatic, source openphish — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 7 IPs in 3 countries across 8 domains to perform 24 HTTP transactions. The main IP is 2606:4700::6812:223, located in United States and belongs to CLOUDFLARENET, US. The main domain is pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev.
TLS certificate: Issued by E1 on June 15th 2023. Valid for: 3 months.
This is the only time pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
1 2606:4700:303... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
16 2620:1ec:46::45 8075 (MICROSOFT...)
1 2001:4de0:ac1... 20446 (STACKPATH...)
1 64.185.227.156 18450 (WEBNX)
1 109.169.71.112 20860 (IOMART-AS)
2 2 2620:1ec:a92:... 8068 (MICROSOFT...)
3 2603:1026:300... 8075 (MICROSOFT...)
24 7
1    2606:4700:3037::6815:23a8 (United States)

ASN13335 (CLOUDFLARENET, US)
thebutterbabe.com
1    2606:4700::6812:223 (United States)

ASN13335 (CLOUDFLARENET, US)
pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev
16    2620:1ec:46::45 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
aadcdn.msauth.net
1    2001:4de0:ac18::1:a:1b (Netherlands)

ASN20446 (STACKPATH-CDN, US)
code.jquery.com
1    64.185.227.156 (Los Angeles, United States)

ASN18450 (WEBNX, US)
PTR: 64-185-227-156.static.webnx.com
api.ipify.org
1    109.169.71.112 (United Kingdom)

ASN20860 (IOMART-AS, GB)
smtpjs.com
2    2620:1ec:a92::156 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
www.office.com
3    2603:1026:3000:150::8 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
login.microsoftonline.com
Apex Domain
Subdomains		 Transfer
16 msauth.net
aadcdn.msauth.net — Cisco Umbrella Rank: 1163
322 KB
3 microsoftonline.com
login.microsoftonline.com — Cisco Umbrella Rank: 23
40 KB
2 office.com
www.office.com — Cisco Umbrella Rank: 4544
1 KB
1 smtpjs.com
smtpjs.com — Cisco Umbrella Rank: 94977
1 KB
1 ipify.org
api.ipify.org — Cisco Umbrella Rank: 2382
210 B
1 jquery.com
code.jquery.com — Cisco Umbrella Rank: 749
30 KB
1 r2.dev
pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev
21 KB
1 thebutterbabe.com
thebutterbabe.com
763 B
24 8
Domain Requested by
16 aadcdn.msauth.net pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev
login.microsoftonline.com
3 login.microsoftonline.com pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev
2 www.office.com 2 redirects
1 smtpjs.com pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev
1 api.ipify.org pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev
1 code.jquery.com pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev
1 pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev
1 thebutterbabe.com
24 8

This site contains no links.

Subject Issuer Validity Valid
*.r2.dev
E1		 2023-06-15 -
2023-09-13		 3 months crt.sh
aadcdn.msauth.net
DigiCert SHA2 Secure Server CA		 2023-04-28 -
2024-04-28		 a year crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA		 2023-07-11 -
2024-07-14		 a year crt.sh
*.ipify.org
Sectigo RSA Domain Validation Secure Server CA		 2023-02-07 -
2024-02-18		 a year crt.sh
smtpjs.com
R3		 2023-07-14 -
2023-10-12		 3 months crt.sh
stamp2.login.microsoftonline.com
DigiCert SHA2 Secure Server CA		 2023-05-25 -
2024-05-25		 a year crt.sh

This page contains 4 frames:

Primary Page: https://pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev/cor.html
Frame ID: 3E32405F269AFFE04EBDE61C908F129F
Requests: 9 HTTP requests in this frame

Frame: https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F&state=TP5qdtN7CeWoamVEk6MscZo_RVPbjldjkBtRKX-q1_ol_6yxe57U3iPYvRcCeApMWgFGbAp3rAvtrNAa9zkUI5CKi39VZFiSqgXijWdxIt1J7TiyTy1kZdR3S-REebrP&x-client-SKU=ID_NET6_0&x-client-ver=6.30.1.0
Frame ID: 356ECA19E9DE329E682871D8813DE907
Requests: 5 HTTP requests in this frame

Frame: https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F&state=NX8a4wGDnCe-eV46WfxaOdHGNXNTBlSsm1voOBhc34jL5PNu03kRCUNrWFrKatE0QtFIDdMOk86_6lulvRlOvU_R5OzFhQ_WnJoEkaY1g7esbwhDNdJW4TkfCMQOXluT&x-client-SKU=ID_NET6_0&x-client-ver=6.30.1.0
Frame ID: 07246DC9A9F340C83DB98A0E5035BAE1
Requests: 5 HTTP requests in this frame

Frame: https://login.microsoftonline.com/logout.srf?ct=1548343592&rver=64.4.6456.0&lc=1033&id=501392
Frame ID: B64600F24658203B64CE1CE6DCF28410
Requests: 5 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Sign in to your Microsoft account

Detected technologies

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

24
Requests

96 %
HTTPS

75 %
IPv6

8
Domains

8
Subdomains

7
IPs

3
Countries

414 kB
Transfer

1501 kB
Size

14
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 7
  • https://www.office.com/estslogout?ru=/ HTTP 302
  • https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F&state=TP5qdtN7CeWoamVEk6MscZo_RVPbjldjkBtRKX-q1_ol_6yxe57U3iPYvRcCeApMWgFGbAp3rAvtrNAa9zkUI5CKi39VZFiSqgXijWdxIt1J7TiyTy1kZdR3S-REebrP&x-client-SKU=ID_NET6_0&x-client-ver=6.30.1.0
Request Chain 8
  • https://www.office.com/estslogout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F HTTP 302
  • https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F&state=NX8a4wGDnCe-eV46WfxaOdHGNXNTBlSsm1voOBhc34jL5PNu03kRCUNrWFrKatE0QtFIDdMOk86_6lulvRlOvU_R5OzFhQ_WnJoEkaY1g7esbwhDNdJW4TkfCMQOXluT&x-client-SKU=ID_NET6_0&x-client-ver=6.30.1.0

24 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
a29jYW1wb0Bmb3J0aXNyZXAuY29t
thebutterbabe.com/dee/new/css/bw0wjq/ 		0
763 B 		Document
General
Check archive.org
Download Go to
Full URL
http://thebutterbabe.com/dee/new/css/bw0wjq/a29jYW1wb0Bmb3J0aXNyZXAuY29t
Protocol
HTTP/1.1
Server
2606:4700:3037::6815:23a8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

CF-Cache-Status
DYNAMIC
CF-RAY
7e6c5fbcfa2539d0-FRA
Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html; charset=UTF-8
Date
Fri, 14 Jul 2023 20:04:18 GMT
NEL
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YB7yMALLavmokZ2nr9bsKqMHuHG382%2BhFDE8GZnZdDdiPOcvD%2BTsmb0pcl1%2BpqjzYeEvtJp5URTIZ5g%2F1KBFSSF5pTLnV0G5x0pYBlHOsCb3ktw8KROju7LQ%2F%2Fze6NRUtBbryq50dOe6YL6LwQt%2F0g%3D%3D"}],"group":"cf-nel","max_age":604800}
Server
cloudflare
Transfer-Encoding
chunked
alt-svc
h3=":443"; ma=86400
refresh
0;url=https://pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev/cor.html#kocampo@fortisrep.com
Primary Request cor.html
pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev/ 		108 KB
21 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev/cor.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ae4332a3247fc82d1f20a3ff47d707d68b04f6ae3fb4f2dd77813034039eef45

Request headers

Referer
http://thebutterbabe.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

CF-RAY
7e6c5fbf3b219a17-FRA
Connection
keep-alive
Content-Encoding
gzip
Content-Type
text/html
Date
Fri, 14 Jul 2023 20:04:18 GMT
ETag
W/"2e6d3bbf81604abebf025bfcd57a7ee7"
Last-Modified
Wed, 12 Jul 2023 14:42:52 GMT
Server
cloudflare
Transfer-Encoding
chunked
Vary
Accept-Encoding
microsoft_logo_ed9c9eb0dce17d752bedea6b5acda6d9.png
aadcdn.msauth.net/ests/2.1/content/images/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aadcdn.msauth.net/ests/2.1/content/images/microsoft_logo_ed9c9eb0dce17d752bedea6b5acda6d9.png
Requested by
Host: pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev
URL: https://pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev/cor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
date
Fri, 14 Jul 2023 20:04:18 GMT
last-modified
Fri, 02 Nov 2018 20:25:31 GMT
etag
0x8D641015620C409
x-azure-ref
20230714T200418Z-f3sqygkk5514187exzcmpbk8fg000000066000000001czf1
x-cache
TCP_HIT
content-type
image/png
access-control-allow-origin
*
x-ms-request-id
87cb801e-601e-0051-0271-b67f42000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=604800
x-ms-version
2009-09-19
accept-ranges
bytes
content-length
1057
arrow_left_7cc096da6aa2dba3f81fcc1c8262157c.png
aadcdn.msauth.net/ests/2.1/content/images/ 		240 B
725 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aadcdn.msauth.net/ests/2.1/content/images/arrow_left_7cc096da6aa2dba3f81fcc1c8262157c.png
Requested by
Host: pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev
URL: https://pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev/cor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
ab50358475adae73a435466c72d1a48ab124e8ae06614663716a46dce5ac8b83

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
date
Fri, 14 Jul 2023 20:04:18 GMT
last-modified
Fri, 02 Nov 2018 20:25:10 GMT
etag
0x8D64101494D74DC
x-azure-ref
20230714T200418Z-f3sqygkk5514187exzcmpbk8fg000000066000000001czf2
x-cache
TCP_HIT
content-type
image/png
access-control-allow-origin
*
x-ms-request-id
ffcd17f6-001e-006b-2e30-b65046000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=604800
x-ms-version
2009-09-19
accept-ranges
bytes
content-length
240
ellipsis_white_0ad43084800fd8b50a2576b5173746fe.png
aadcdn.msauth.net/ests/2.1/content/images/ 		207 B
692 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aadcdn.msauth.net/ests/2.1/content/images/ellipsis_white_0ad43084800fd8b50a2576b5173746fe.png
Requested by
Host: pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev
URL: https://pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev/cor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
2c03ee38a4eba6a047c3a5bacb3eb461efe14be8acd46ae772350a4dea2f0175

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
date
Fri, 14 Jul 2023 20:04:18 GMT
last-modified
Fri, 02 Nov 2018 20:25:24 GMT
etag
0x8D6410151EBB082
x-azure-ref
20230714T200418Z-f3sqygkk5514187exzcmpbk8fg000000066000000001czf3
x-cache
TCP_HIT
content-type
image/png
access-control-allow-origin
*
x-ms-request-id
c2eeda64-401e-006f-0e67-b3fc4e000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=604800
x-ms-version
2009-09-19
accept-ranges
bytes
content-length
207
jquery-3.1.1.min.js
code.jquery.com/ 		85 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.1.1.min.js
Requested by
Host: pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev
URL: https://pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev/cor.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac18::1:a:1b , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software
nginx /
Resource Hash
85556761a8800d14ced8fcd41a6b8b26bf012d44a318866c0d81a62092efd9bf

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Fri, 14 Jul 2023 20:04:18 GMT
content-encoding
gzip
last-modified
Fri, 18 Oct 1991 12:00:00 GMT
server
nginx
etag
W/"28feccc0-152b5"
vary
Accept-Encoding
x-hw
1689365058.dop258.am5.t,1689365058.cds322.am5.hn,1689365058.cds116.am5.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
30070
/
api.ipify.org/ 		36 B
210 B 		Script
General
Check archive.org
Download Go to
Full URL
https://api.ipify.org/?format=jsonp&callback=getPublic
Requested by
Host: pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev
URL: https://pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev/cor.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
64.185.227.156 Los Angeles, United States, ASN18450 (WEBNX, US),
Reverse DNS
64-185-227-156.static.webnx.com
Software
nginx/1.25.1 /
Resource Hash
b702c91425176bbfd3e3beda2c22f1e11f5554c3c7968bd0beb96ac9347de479

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

Date
Fri, 14 Jul 2023 20:04:18 GMT
Server
nginx/1.25.1
Connection
keep-alive
Content-Length
36
Vary
Origin
Content-Type
application/javascript
smtp.js
smtpjs.com/v3/ 		871 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://smtpjs.com/v3/smtp.js
Requested by
Host: pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev
URL: https://pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev/cor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
109.169.71.112 , United Kingdom, ASN20860 (IOMART-AS, GB),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
1fd711cb491a361ef91e29c50de0680a4b156c0b34bb91e18570d0037263a776

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

date
Fri, 14 Jul 2023 20:04:18 GMT
last-modified
Tue, 10 Nov 2020 17:17:51 GMT
server
Microsoft-IIS/10.0
etag
"162f436b85b7d61:0"
x-powered-by
ASP.NET
content-type
application/javascript
access-control-allow-origin
*
accept-ranges
bytes
content-length
871
logout
login.microsoftonline.com/common/oauth2/ Frame 356E
Redirect Chain
  • https://www.office.com/estslogout?ru=/
  • https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F&state=TP5qdtN7CeWoamVEk6MscZo_RVPbjldjkBtRKX-q1_ol_6yxe57U3iPYvRcCeApMWgFGbAp3rAvtrNA...
30 KB
13 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F&state=TP5qdtN7CeWoamVEk6MscZo_RVPbjldjkBtRKX-q1_ol_6yxe57U3iPYvRcCeApMWgFGbAp3rAvtrNAa9zkUI5CKi39VZFiSqgXijWdxIt1J7TiyTy1kZdR3S-REebrP&x-client-SKU=ID_NET6_0&x-client-ver=6.30.1.0
Requested by
Host: pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev
URL: https://pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev/cor.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2603:1026:3000:150::8 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
3d0f9cef8119802f705d5b64c3c90d3b58537e33de9e16b103636092347e6e35
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
no-store, no-cache
Content-Encoding
gzip
Content-Length
11254
Content-Type
text/html; charset=utf-8
Date
Fri, 14 Jul 2023 20:04:17 GMT
Expires
-1
Link
<https://aadcdn.msauth.net>; rel=preconnect; crossorigin <https://aadcdn.msauth.net>; rel=dns-prefetch <https://aadcdn.msftauth.net>; rel=dns-prefetch
P3P
CP="DSP CUR OTPi IND OTRi ONL FIN"
Pragma
no-cache
Referrer-Policy
strict-origin-when-cross-origin
Strict-Transport-Security
max-age=31536000; includeSubDomains
Vary
Accept-Encoding
X-Content-Type-Options
nosniff
X-DNS-Prefetch-Control
on
X-XSS-Protection
0
nel
{"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
report-to
{"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+ams2"}]}
x-ms-clitelem
1,0,0,,
x-ms-ests-server
2.1.15771.4 - NEULR1 ProdSlices
x-ms-request-id
bca7e121-fc82-41e3-a0c4-ac40db698f00

Redirect headers

cache-control
no-cache
content-encoding
gzip
content-length
0
content-type
text/html; charset=utf-8
date
Fri, 14 Jul 2023 20:04:18 GMT
location
https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F&state=TP5qdtN7CeWoamVEk6MscZo_RVPbjldjkBtRKX-q1_ol_6yxe57U3iPYvRcCeApMWgFGbAp3rAvtrNAa9zkUI5CKi39VZFiSqgXijWdxIt1J7TiyTy1kZdR3S-REebrP&x-client-SKU=ID_NET6_0&x-client-ver=6.30.1.0
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
request-context
appId=
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-msedge-ref
Ref A: D5F9FAAB3A26445091B6E8B06036C51C Ref B: AMS231032603017 Ref C: 2023-07-14T20:04:18Z
x-ua-compatible
IE=edge,chrome=1
x-xss-protection
1; mode=block
logout
login.microsoftonline.com/common/oauth2/ Frame 0724
Redirect Chain
  • https://www.office.com/estslogout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F
  • https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F&state=NX8a4wGDnCe-eV46WfxaOdHGNXNTBlSsm1voOBhc34jL5PNu03kRCUNrWFrKatE0QtFIDdMOk86_6lu...
30 KB
13 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F&state=NX8a4wGDnCe-eV46WfxaOdHGNXNTBlSsm1voOBhc34jL5PNu03kRCUNrWFrKatE0QtFIDdMOk86_6lulvRlOvU_R5OzFhQ_WnJoEkaY1g7esbwhDNdJW4TkfCMQOXluT&x-client-SKU=ID_NET6_0&x-client-ver=6.30.1.0
Requested by
Host: pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev
URL: https://pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev/cor.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2603:1026:3000:150::8 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
9bc7173dc746216a7d5ad064c0534ae15fda67242b25e8013c2d9feba374c59e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
no-store, no-cache
Content-Encoding
gzip
Content-Length
11246
Content-Type
text/html; charset=utf-8
Date
Fri, 14 Jul 2023 20:04:17 GMT
Expires
-1
Link
<https://aadcdn.msauth.net>; rel=preconnect; crossorigin <https://aadcdn.msauth.net>; rel=dns-prefetch <https://aadcdn.msftauth.net>; rel=dns-prefetch
P3P
CP="DSP CUR OTPi IND OTRi ONL FIN"
Pragma
no-cache
Referrer-Policy
strict-origin-when-cross-origin
Strict-Transport-Security
max-age=31536000; includeSubDomains
Vary
Accept-Encoding
X-Content-Type-Options
nosniff
X-DNS-Prefetch-Control
on
X-XSS-Protection
0
nel
{"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
report-to
{"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+ams2"}]}
x-ms-clitelem
1,0,0,,
x-ms-ests-server
2.1.15771.4 - WEULR1 ProdSlices
x-ms-request-id
79f32da6-4eab-4788-86cd-b5f287039d00

Redirect headers

cache-control
no-cache
content-encoding
gzip
content-length
0
content-type
text/html; charset=utf-8
date
Fri, 14 Jul 2023 20:04:18 GMT
location
https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F&state=NX8a4wGDnCe-eV46WfxaOdHGNXNTBlSsm1voOBhc34jL5PNu03kRCUNrWFrKatE0QtFIDdMOk86_6lulvRlOvU_R5OzFhQ_WnJoEkaY1g7esbwhDNdJW4TkfCMQOXluT&x-client-SKU=ID_NET6_0&x-client-ver=6.30.1.0
pragma
no-cache
referrer-policy
strict-origin-when-cross-origin
request-context
appId=
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-msedge-ref
Ref A: FCA9DB18CAE5431291C853DE0CC666B2 Ref B: AMS231032603017 Ref C: 2023-07-14T20:04:18Z
x-ua-compatible
IE=edge,chrome=1
x-xss-protection
1; mode=block
logout.srf
login.microsoftonline.com/ Frame B646 		30 KB
13 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://login.microsoftonline.com/logout.srf?ct=1548343592&rver=64.4.6456.0&lc=1033&id=501392
Requested by
Host: pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev
URL: https://pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev/cor.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2603:1026:3000:150::8 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
7691b39f4493e51046018971cee253d9609801176f2959c786b11e9f13e81e03
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
no-store, no-cache
Content-Encoding
gzip
Content-Length
10846
Content-Type
text/html; charset=utf-8
Date
Fri, 14 Jul 2023 20:04:17 GMT
Expires
-1
Link
<https://aadcdn.msauth.net>; rel=preconnect; crossorigin <https://aadcdn.msauth.net>; rel=dns-prefetch <https://aadcdn.msftauth.net>; rel=dns-prefetch
P3P
CP="DSP CUR OTPi IND OTRi ONL FIN"
Pragma
no-cache
Referrer-Policy
strict-origin-when-cross-origin
Strict-Transport-Security
max-age=31536000; includeSubDomains
Vary
Accept-Encoding
X-Content-Type-Options
nosniff
X-DNS-Prefetch-Control
on
X-XSS-Protection
0
nel
{"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
report-to
{"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+ams2"}]}
x-ms-ests-server
2.1.15771.4 - WEULR1 ProdSlices
x-ms-request-id
9089589b-821b-444c-a055-8b3b834dcf00
2_bc3d32a696895f78c19df6c717586a5d.svg
aadcdn.msauth.net/ests/2.1/content/images/backgrounds/ 		2 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aadcdn.msauth.net/ests/2.1/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg
Requested by
Host: pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev
URL: https://pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev/cor.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://pub-06239b48eabe419abaeabc71a5b93e7b.r2.dev/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 14 Jul 2023 20:04:18 GMT
content-encoding
gzip
x-cache
TCP_HIT
content-length
673
x-ms-lease-status
unlocked
last-modified
Thu, 13 Feb 2020 02:05:12 GMT
etag
0x8D7B0292911C366
x-azure-ref
20230714T200418Z-f3sqygkk5514187exzcmpbk8fg000000066000000001czf4
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
52509389-001e-0003-2bd8-b34a75000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
converged.v2.login.min_xs4q-enqjizb-pd0ha63sw2.css
aadcdn.msauth.net/ests/2.1/content/cdnbundles/ Frame B646 		108 KB
20 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_xs4q-enqjizb-pd0ha63sw2.css
Requested by
Host: login.microsoftonline.com
URL: https://login.microsoftonline.com/logout.srf?ct=1548343592&rver=64.4.6456.0&lc=1033&id=501392
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
09bcfd473f343f606206e638d6aa7c7436ab54f40fca8f3ea2247fc068147ffe

Request headers

Referer
https://login.microsoftonline.com/
Origin
https://login.microsoftonline.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 14 Jul 2023 20:04:18 GMT
content-encoding
gzip
x-cache
TCP_HIT
content-length
20105
x-ms-lease-status
unlocked
last-modified
Wed, 17 May 2023 19:54:03 GMT
etag
0x8DB5710770A6D5D
x-azure-ref
20230714T200418Z-vmtz974b010g9517sqb37cgak400000005u000000001zw2g
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
9080552d-c01e-001f-805b-b30e4e000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
jquery.3.5.min_dc940oomzau4rsu8qesnvg2.js
aadcdn.msauth.net/ests/2.1/content/cdnbundles/ Frame B646 		117 KB
40 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/jquery.3.5.min_dc940oomzau4rsu8qesnvg2.js
Requested by
Host: login.microsoftonline.com
URL: https://login.microsoftonline.com/logout.srf?ct=1548343592&rver=64.4.6456.0&lc=1033&id=501392
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
df2aa8537c1992c94846a0ffffaa9031d430d9d0210b9e396ec059aff62627e0

Request headers

Referer
https://login.microsoftonline.com/
Origin
https://login.microsoftonline.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 14 Jul 2023 20:04:18 GMT
content-encoding
gzip
x-cache
TCP_HIT
content-length
40454
x-ms-lease-status
unlocked
last-modified
Fri, 26 Feb 2021 06:12:05 GMT
etag
0x8D8DA1D70FBDD97
x-azure-ref
20230714T200418Z-vmtz974b010g9517sqb37cgak400000005u000000001zw2k
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
0f563397-701e-0058-6c92-af0c51000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
aad.login.min_kx1da7l2dz6nhe9kugk19a2.js
aadcdn.msauth.net/ests/2.1/content/cdnbundles/ Frame B646 		178 KB
44 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/aad.login.min_kx1da7l2dz6nhe9kugk19a2.js
Requested by
Host: login.microsoftonline.com
URL: https://login.microsoftonline.com/logout.srf?ct=1548343592&rver=64.4.6456.0&lc=1033&id=501392
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
585c15f044d19a1f0a1ba994b70992ce92e30cfd9443bab663d3f17b13d69708

Request headers

Referer
https://login.microsoftonline.com/
Origin
https://login.microsoftonline.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 14 Jul 2023 20:04:18 GMT
content-encoding
gzip
x-cache
TCP_HIT
content-length
44785
x-ms-lease-status
unlocked
last-modified
Wed, 20 Apr 2022 04:33:13 GMT
etag
0x8DA2286E1DA9029
x-azure-ref
20230714T200418Z-vmtz974b010g9517sqb37cgak400000005u000000001zw2h
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
088e392d-201e-002d-7a62-b3795b000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
microsoft_logo_ea19b2112f4dfd8e90b4505ef7dcb4f9.png
aadcdn.msauth.net/shared/1.0/content/images/ Frame B646 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_ea19b2112f4dfd8e90b4505ef7dcb4f9.png
Requested by
Host: login.microsoftonline.com
URL: https://login.microsoftonline.com/logout.srf?ct=1548343592&rver=64.4.6456.0&lc=1033&id=501392
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://login.microsoftonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
date
Fri, 14 Jul 2023 20:04:18 GMT
last-modified
Wed, 24 May 2023 10:11:48 GMT
etag
0x8DB5C3F48FD7E08
x-azure-ref
20230714T200418Z-f3sqygkk5514187exzcmpbk8fg000000066000000001czfs
x-cache
TCP_HIT
content-type
image/png
access-control-allow-origin
*
x-ms-request-id
a10f3afd-801e-004f-3836-b36d7d000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
content-length
1057
converged.v2.login.min_xs4q-enqjizb-pd0ha63sw2.css
aadcdn.msauth.net/ests/2.1/content/cdnbundles/ Frame 356E 		108 KB
20 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_xs4q-enqjizb-pd0ha63sw2.css
Requested by
Host: login.microsoftonline.com
URL: https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F&state=TP5qdtN7CeWoamVEk6MscZo_RVPbjldjkBtRKX-q1_ol_6yxe57U3iPYvRcCeApMWgFGbAp3rAvtrNAa9zkUI5CKi39VZFiSqgXijWdxIt1J7TiyTy1kZdR3S-REebrP&x-client-SKU=ID_NET6_0&x-client-ver=6.30.1.0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
09bcfd473f343f606206e638d6aa7c7436ab54f40fca8f3ea2247fc068147ffe

Request headers

Referer
https://login.microsoftonline.com/
Origin
https://login.microsoftonline.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 14 Jul 2023 20:04:18 GMT
content-encoding
gzip
x-cache
TCP_HIT
content-length
20105
x-ms-lease-status
unlocked
last-modified
Wed, 17 May 2023 19:54:03 GMT
etag
0x8DB5710770A6D5D
x-azure-ref
20230714T200418Z-vmtz974b010g9517sqb37cgak400000005u000000001zw34
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
9080552d-c01e-001f-805b-b30e4e000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
jquery.3.5.min_dc940oomzau4rsu8qesnvg2.js
aadcdn.msauth.net/ests/2.1/content/cdnbundles/ Frame 356E 		117 KB
40 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/jquery.3.5.min_dc940oomzau4rsu8qesnvg2.js
Requested by
Host: login.microsoftonline.com
URL: https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F&state=TP5qdtN7CeWoamVEk6MscZo_RVPbjldjkBtRKX-q1_ol_6yxe57U3iPYvRcCeApMWgFGbAp3rAvtrNAa9zkUI5CKi39VZFiSqgXijWdxIt1J7TiyTy1kZdR3S-REebrP&x-client-SKU=ID_NET6_0&x-client-ver=6.30.1.0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
df2aa8537c1992c94846a0ffffaa9031d430d9d0210b9e396ec059aff62627e0

Request headers

Referer
https://login.microsoftonline.com/
Origin
https://login.microsoftonline.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 14 Jul 2023 20:04:18 GMT
content-encoding
gzip
x-cache
TCP_HIT
content-length
40454
x-ms-lease-status
unlocked
last-modified
Fri, 26 Feb 2021 06:12:05 GMT
etag
0x8D8DA1D70FBDD97
x-azure-ref
20230714T200418Z-vmtz974b010g9517sqb37cgak400000005u000000001zw35
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
0f563397-701e-0058-6c92-af0c51000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
aad.login.min_kx1da7l2dz6nhe9kugk19a2.js
aadcdn.msauth.net/ests/2.1/content/cdnbundles/ Frame 356E 		178 KB
44 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/aad.login.min_kx1da7l2dz6nhe9kugk19a2.js
Requested by
Host: login.microsoftonline.com
URL: https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F&state=TP5qdtN7CeWoamVEk6MscZo_RVPbjldjkBtRKX-q1_ol_6yxe57U3iPYvRcCeApMWgFGbAp3rAvtrNAa9zkUI5CKi39VZFiSqgXijWdxIt1J7TiyTy1kZdR3S-REebrP&x-client-SKU=ID_NET6_0&x-client-ver=6.30.1.0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
585c15f044d19a1f0a1ba994b70992ce92e30cfd9443bab663d3f17b13d69708

Request headers

Referer
https://login.microsoftonline.com/
Origin
https://login.microsoftonline.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 14 Jul 2023 20:04:18 GMT
content-encoding
gzip
x-cache
TCP_HIT
content-length
44785
x-ms-lease-status
unlocked
last-modified
Wed, 20 Apr 2022 04:33:13 GMT
etag
0x8DA2286E1DA9029
x-azure-ref
20230714T200418Z-vmtz974b010g9517sqb37cgak400000005u000000001zw36
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
088e392d-201e-002d-7a62-b3795b000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
microsoft_logo_ea19b2112f4dfd8e90b4505ef7dcb4f9.png
aadcdn.msauth.net/shared/1.0/content/images/ Frame 356E 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_ea19b2112f4dfd8e90b4505ef7dcb4f9.png
Requested by
Host: login.microsoftonline.com
URL: https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F&state=TP5qdtN7CeWoamVEk6MscZo_RVPbjldjkBtRKX-q1_ol_6yxe57U3iPYvRcCeApMWgFGbAp3rAvtrNAa9zkUI5CKi39VZFiSqgXijWdxIt1J7TiyTy1kZdR3S-REebrP&x-client-SKU=ID_NET6_0&x-client-ver=6.30.1.0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://login.microsoftonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
date
Fri, 14 Jul 2023 20:04:18 GMT
last-modified
Wed, 24 May 2023 10:11:48 GMT
etag
0x8DB5C3F48FD7E08
x-azure-ref
20230714T200418Z-f3sqygkk5514187exzcmpbk8fg000000066000000001czg4
x-cache
TCP_HIT
content-type
image/png
access-control-allow-origin
*
x-ms-request-id
a10f3afd-801e-004f-3836-b36d7d000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
content-length
1057
converged.v2.login.min_xs4q-enqjizb-pd0ha63sw2.css
aadcdn.msauth.net/ests/2.1/content/cdnbundles/ Frame 0724 		108 KB
20 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_xs4q-enqjizb-pd0ha63sw2.css
Requested by
Host: login.microsoftonline.com
URL: https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F&state=NX8a4wGDnCe-eV46WfxaOdHGNXNTBlSsm1voOBhc34jL5PNu03kRCUNrWFrKatE0QtFIDdMOk86_6lulvRlOvU_R5OzFhQ_WnJoEkaY1g7esbwhDNdJW4TkfCMQOXluT&x-client-SKU=ID_NET6_0&x-client-ver=6.30.1.0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
09bcfd473f343f606206e638d6aa7c7436ab54f40fca8f3ea2247fc068147ffe

Request headers

Referer
https://login.microsoftonline.com/
Origin
https://login.microsoftonline.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 14 Jul 2023 20:04:18 GMT
content-encoding
gzip
x-cache
TCP_HIT
content-length
20105
x-ms-lease-status
unlocked
last-modified
Wed, 17 May 2023 19:54:03 GMT
etag
0x8DB5710770A6D5D
x-azure-ref
20230714T200418Z-vmtz974b010g9517sqb37cgak400000005u000000001zw3h
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
9080552d-c01e-001f-805b-b30e4e000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
jquery.3.5.min_dc940oomzau4rsu8qesnvg2.js
aadcdn.msauth.net/ests/2.1/content/cdnbundles/ Frame 0724 		117 KB
40 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/jquery.3.5.min_dc940oomzau4rsu8qesnvg2.js
Requested by
Host: login.microsoftonline.com
URL: https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F&state=NX8a4wGDnCe-eV46WfxaOdHGNXNTBlSsm1voOBhc34jL5PNu03kRCUNrWFrKatE0QtFIDdMOk86_6lulvRlOvU_R5OzFhQ_WnJoEkaY1g7esbwhDNdJW4TkfCMQOXluT&x-client-SKU=ID_NET6_0&x-client-ver=6.30.1.0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
df2aa8537c1992c94846a0ffffaa9031d430d9d0210b9e396ec059aff62627e0

Request headers

Referer
https://login.microsoftonline.com/
Origin
https://login.microsoftonline.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 14 Jul 2023 20:04:18 GMT
content-encoding
gzip
x-cache
TCP_HIT
content-length
40454
x-ms-lease-status
unlocked
last-modified
Fri, 26 Feb 2021 06:12:05 GMT
etag
0x8D8DA1D70FBDD97
x-azure-ref
20230714T200418Z-vmtz974b010g9517sqb37cgak400000005u000000001zw3k
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
0f563397-701e-0058-6c92-af0c51000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
aad.login.min_kx1da7l2dz6nhe9kugk19a2.js
aadcdn.msauth.net/ests/2.1/content/cdnbundles/ Frame 0724 		178 KB
44 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/aad.login.min_kx1da7l2dz6nhe9kugk19a2.js
Requested by
Host: login.microsoftonline.com
URL: https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F&state=NX8a4wGDnCe-eV46WfxaOdHGNXNTBlSsm1voOBhc34jL5PNu03kRCUNrWFrKatE0QtFIDdMOk86_6lulvRlOvU_R5OzFhQ_WnJoEkaY1g7esbwhDNdJW4TkfCMQOXluT&x-client-SKU=ID_NET6_0&x-client-ver=6.30.1.0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
585c15f044d19a1f0a1ba994b70992ce92e30cfd9443bab663d3f17b13d69708

Request headers

Referer
https://login.microsoftonline.com/
Origin
https://login.microsoftonline.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Fri, 14 Jul 2023 20:04:18 GMT
content-encoding
gzip
x-cache
TCP_HIT
content-length
44785
x-ms-lease-status
unlocked
last-modified
Wed, 20 Apr 2022 04:33:13 GMT
etag
0x8DA2286E1DA9029
x-azure-ref
20230714T200418Z-vmtz974b010g9517sqb37cgak400000005u000000001zw3m
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
088e392d-201e-002d-7a62-b3795b000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
microsoft_logo_ea19b2112f4dfd8e90b4505ef7dcb4f9.png
aadcdn.msauth.net/shared/1.0/content/images/ Frame 0724 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_ea19b2112f4dfd8e90b4505ef7dcb4f9.png
Requested by
Host: login.microsoftonline.com
URL: https://login.microsoftonline.com/common/oauth2/logout?post_logout_redirect_uri=https%3A%2F%2Fwww.office.com%2F&state=NX8a4wGDnCe-eV46WfxaOdHGNXNTBlSsm1voOBhc34jL5PNu03kRCUNrWFrKatE0QtFIDdMOk86_6lulvRlOvU_R5OzFhQ_WnJoEkaY1g7esbwhDNdJW4TkfCMQOXluT&x-client-SKU=ID_NET6_0&x-client-ver=6.30.1.0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:46::45 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://login.microsoftonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.198 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
date
Fri, 14 Jul 2023 20:04:18 GMT
last-modified
Wed, 24 May 2023 10:11:48 GMT
etag
0x8DB5C3F48FD7E08
x-azure-ref
20230714T200418Z-f3sqygkk5514187exzcmpbk8fg000000066000000001czge
x-cache
TCP_HIT
content-type
image/png
access-control-allow-origin
*
x-ms-request-id
a10f3afd-801e-004f-3836-b36d7d000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
content-length
1057

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

16 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 boolean| credentialless object| onbeforetoggle object| onscrollend function| $ function| jQuery string| wrfweewdwedew string| hudiswjs string| LINK function| kiujytredscvbrddszsasa function| getPublic object| Email function| redirectCU function| redirectKK

14 Cookies

Domain/Path Name / Value
login.microsoftonline.com/ Name: ESTSSSOTILES
Value: 1
login.microsoftonline.com/ Name: AADSSOTILES
Value: 1
login.microsoftonline.com/ Name: ESTSAUTHLIGHT
Value: +
login.microsoftonline.com/ Name: fpc
Value: AhHE9D15md9Hm55U5aU7fNk
.login.microsoftonline.com/ Name: esctx
Value: PAQABAAEAAAD--DLA3VO7QrddgJg7Wevr0sFOZTdJjNPAlevpHoVvNjt5-Gh9RJ5sTkd6XbPzGj7vzoRXkj91MeqydtGcvsIehEIaNvwfCmyYiueAK3GoMpRXjuEANmyVFkd2g6nFRJj6Zp-MJeRfUvydTRUZsFQO6K6kaZOvNhhUlmq1MJdrGjkPSIxmu50yCYzIBHnHpusgAA
login.microsoftonline.com/ Name: x-ms-gateway-slice
Value: estsfd
login.microsoftonline.com/ Name: stsservicecookie
Value: estsfd
www.office.com/ Name: OH.DCAffinity
Value: OH-weu
www.office.com/ Name: OH.SID
Value: 6d1ab75e-ffd8-4a43-af65-1bff8a49176f
www.office.com/ Name: OH.FLID
Value: eb0f078c-4d88-4112-8cba-7f36d527d8bd
.login.microsoftonline.com/ Name: SignInStateCookie
Value: CAgABAAIAAAD--DLA3VO7QrddgJg7WevrAgDs_wUA9P-LiIZUgB1pmvmtdqyLSBz7H-T0Isya2-I9UxKV0uGlnw3gVgXVscA7_p1plYGGN3A-QzfWTIqj-Q
.login.microsoftonline.com/ Name: ESTSAUTHPERSISTENT
Value: AgABAAQAAAD--DLA3VO7QrddgJg7WevrAgDs_wUA9P9A6heR5cj3JzH4Sh56vyYxCzpdTw6P9nchhFeNgHDbviizWnyTdZd811N3oYNklP1IlK5FxwXCEw
.login.microsoftonline.com/ Name: ESTSAUTH
Value: AgABAAQAAAD--DLA3VO7QrddgJg7WevrAgDs_wUA9P_tQn_C6dZPCVO28wGNvJQwJ_BHQctwfX7OcwPuYl9jZXpDKAe9UsXSbmGeqv_-MTqb1eHSaEGiPg
login.microsoftonline.com/ Name: buid
Value: AQABAAEAAAD--DLA3VO7QrddgJg7Wevr9HZkQpWRw_HrLgNf1CgcKUNY-3nQErfrnyxL6jbXr10ZTMq5iK2ykovLWpZglFYKtI6FO42hNeahNHjjMlNSWhRZa0JQasZ69sJLkxcUQjAgAA