office.io8.tech Open in urlscan Pro
172.67.152.231 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://norteacompanhantes.com.br/yu7687uif597dc
Effective URL:
https://office.io8.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3...
Submission: On October 29 via manual (October 29th 2024, 6:37:44 pm UTC) from US — Scanned from DE

Summary HTTP 15 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 3 domains to perform 15 HTTP transactions. The main IP is 172.67.152.231, located in United States and belongs to CLOUDFLARENET, US. The main domain is office.io8.tech.
TLS certificate: Issued by WE1 on October 24th 2024. Valid for: 3 months.

This is the only time office.io8.tech was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
2 2	162.241.203.111 162.241.203.111	19871 (NETWORK-S...) (NETWORK-SOLUTIONS-HOSTING)
3 6	172.67.152.231 172.67.152.231	13335 (CLOUDFLAR...) (CLOUDFLARENET)
12	2606:2800:233... 2606:2800:233:1cb7:261b:1f9c:2074:3c	15133 (EDGECAST) (EDGECAST)
15	2

2 162.241.203.111 (United States) 2 redirects

ASN19871 (NETWORK-SOLUTIONS-HOSTING, US)
PTR: 162-241-203-111.unifiedlayer.com

norteacompanhantes.com.br	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 172.67.152.231 (United States) 3 redirects

ASN13335 (CLOUDFLARENET, US)

office.io8.tech	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
react.io8.tech	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ywnjb.io8.tech	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2606:2800:233:1cb7:261b:1f9c:2074:3c (United States)

ASN15133 (EDGECAST, US)

aadcdn.msftauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	msftauth.net aadcdn.msftauth.net — Cisco Umbrella Rank: 866	339 KB
6	io8.tech 3 redirects office.io8.tech react.io8.tech ywnjb.io8.tech	23 KB
2	norteacompanhantes.com.br 2 redirects norteacompanhantes.com.br	446 B
15	3

	Domain	Requested by
12	aadcdn.msftauth.net	office.io8.tech aadcdn.msftauth.net
3	office.io8.tech	2 redirects
2	ywnjb.io8.tech	office.io8.tech aadcdn.msftauth.net
2	norteacompanhantes.com.br	2 redirects
1	react.io8.tech	1 redirects
15	5

This site contains links to these domains. Also see Links.

Domain
ywnjb.io8.tech
www.microsoft.com
privacy.microsoft.com

Subject Issuer	Validity	Valid
io8.tech WE1	`2024-10-24` - `2025-01-22`	3 months	crt.sh
aadcdn.msftauth.net DigiCert SHA2 Secure Server CA	`2024-05-25` - `2025-05-25`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://office.io8.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638658238583926699.MGFkODE1MzgtNGQxOC00MDc1LWI3NjQtMGNmMmY5NzBjNzQ0ZDIyMTI3MTItMGMwMC00OGVmLTllZjUtMDI5ODA1ZGQ1Yzky&ui_locales=de-DE&mkt=de-DE&client-request-id=2d09430f-aff0-4426-b251-c193a71c9fd6&state=Dos9hgnBrpU5zljA2tAYikbY-dtY2BnYUKVLF7Ph8KJUpgO6C8AsQI-EKWXMlmDh0Xwt0yqWjJsmUFfM-wiZiYHzZd6Seu5wStvcYz-suhGsaCe-Ez4w_PYR3RC2m_dU3j0kThTZil58J_rgQ32rLmW3upicVP194YD2tBDkycSirp6BOMe4Nzu0XzkZ2jNyFqWpke6wiwmdmJDuDicnIRfgBymoyJmPOquVkeOUGSrzbGlbODzGS2K8Pg_rDjVXghyXzg5qUTrKAS_3uRScmg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0
Frame ID: 3C268B7548E8E26E8C071888A2349D4F
Requests: 14 HTTP requests in this frame

Frame: https://ywnjb.io8.tech/Me.htm?v=3
Frame ID: 502D2E003244E265ABDF11D6E9B96DF3
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Bei Ihrem Konto anmelden

Page URL History Show full URLs

https://norteacompanhantes.com.br/yu7687uif597dc HTTP 301
https://norteacompanhantes.com.br/yu7687uif597dc/ HTTP 302
https://office.io8.tech/uMmSxzzj HTTP 302
https://office.io8.tech/ HTTP 302
https://react.io8.tech/login HTTP 302
https://office.io8.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&... Page URL

Page Statistics

15
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

5
Subdomains

2
IPs

1
Countries

358 kB
Transfer

1215 kB
Size

15
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://ywnjb.io8.tech/oauth20_authorize.srf?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&scope=openid+profile+https%3a%2f%2freact.io8.tech%2fv2%2fOfficeHome.All&redirect_uri=https%3a%2f%2freact.io8.tech%2flandingv2&response_type=code+id_token&state=Dos9hgnBrpU5zljA2tAYikbY-dtY2BnYUKVLF7Ph8KJUpgO6C8AsQI-EKWXMlmDh0Xwt0yqWjJsmUFfM-wiZiYHzZd6Seu5wStvcYz-suhGsaCe-Ez4w_PYR3RC2m_dU3j0kThTZil58J_rgQ32rLmW3upicVP194YD2tBDkycSirp6BOMe4Nzu0XzkZ2jNyFqWpke6wiwmdmJDuDicnIRfgBymoyJmPOquVkeOUGSrzbGlbODzGS2K8Pg_rDjVXghyXzg5qUTrKAS_3uRScmg&response_mode=form_post&nonce=638658238583926699.MGFkODE1MzgtNGQxOC00MDc1LWI3NjQtMGNmMmY5NzBjNzQ0ZDIyMTI3MTItMGMwMC00OGVmLTllZjUtMDI5ODA1ZGQ1Yzky&x-client-SKU=ID_NET8_0&x-client-Ver=7.5.1.0&uaid=2d09430faff04426b251c193a71c9fd6&msproxy=1&issuer=mso&tenant=common&ui_locales=de-DE&signup=1&lw=1&fl=easi2&epct=PAQABDgEAAADW6jl31mB3T7ugrWTT8pFeuRtFUyhP8XtOeSFzOb-4LiufRGeMhPrVn7dh9f1NOiAo-jQTKmAPZyDkLQqVSPoHDvwX98V70Iz1WF9hLCTox5n2hhMKHXQFzgiBXn0JM8HBNr9P5qVvVjhdDWkWeE8RQoTSZaCEIpc6GKdh9Yd4t_EGmBMb0mUNfkLMwEnZAwalQHpM2CY51b54IKczbrqS4pPHk3M1aAZSvD_sPJd4fyAA&jshs=0
Title: Erstellen Sie jetzt eins!

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/de-DE/servicesagreement/
Title: Nutzungsbedingungen

Search URL Search Domain Scan URL

URL: https://privacy.microsoft.com/de-DE/privacystatement
Title: Datenschutz und Cookies

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/de-de/corporate/rechtliche-hinweise/impressum.aspx
Title: Haftungsausschluss

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://norteacompanhantes.com.br/yu7687uif597dc HTTP 301
https://norteacompanhantes.com.br/yu7687uif597dc/ HTTP 302
https://office.io8.tech/uMmSxzzj HTTP 302
https://office.io8.tech/ HTTP 302
https://react.io8.tech/login HTTP 302
https://office.io8.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638658238583926699.MGFkODE1MzgtNGQxOC00MDc1LWI3NjQtMGNmMmY5NzBjNzQ0ZDIyMTI3MTItMGMwMC00OGVmLTllZjUtMDI5ODA1ZGQ1Yzky&ui_locales=de-DE&mkt=de-DE&client-request-id=2d09430f-aff0-4426-b251-c193a71c9fd6&state=Dos9hgnBrpU5zljA2tAYikbY-dtY2BnYUKVLF7Ph8KJUpgO6C8AsQI-EKWXMlmDh0Xwt0yqWjJsmUFfM-wiZiYHzZd6Seu5wStvcYz-suhGsaCe-Ez4w_PYR3RC2m_dU3j0kThTZil58J_rgQ32rLmW3upicVP194YD2tBDkycSirp6BOMe4Nzu0XzkZ2jNyFqWpke6wiwmdmJDuDicnIRfgBymoyJmPOquVkeOUGSrzbGlbODzGS2K8Pg_rDjVXghyXzg5qUTrKAS_3uRScmg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H3	200	Primary Request authorize Show response office.io8.tech/common/oauth2/v2.0/ Redirect Chain https://norteacompanhantes.com.br/yu7687uif597dc https://norteacompanhantes.com.br/yu7687uif597dc/ https://office.io8.tech/uMmSxzzj https://office.io8.tech/ https://react.io8.tech/login https://office.io8.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%...	45 KB 17 KB	891ms 890ms	Document text/html	172.67.152.231 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://office.io8.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638658238583926699.MGFkODE1MzgtNGQxOC00MDc1LWI3NjQtMGNmMmY5NzBjNzQ0ZDIyMTI3MTItMGMwMC00OGVmLTllZjUtMDI5ODA1ZGQ1Yzky&ui_locales=de-DE&mkt=de-DE&client-request-id=2d09430f-aff0-4426-b251-c193a71c9fd6&state=Dos9hgnBrpU5zljA2tAYikbY-dtY2BnYUKVLF7Ph8KJUpgO6C8AsQI-EKWXMlmDh0Xwt0yqWjJsmUFfM-wiZiYHzZd6Seu5wStvcYz-suhGsaCe-Ez4w_PYR3RC2m_dU3j0kThTZil58J_rgQ32rLmW3upicVP194YD2tBDkycSirp6BOMe4Nzu0XzkZ2jNyFqWpke6wiwmdmJDuDicnIRfgBymoyJmPOquVkeOUGSrzbGlbODzGS2K8Pg_rDjVXghyXzg5qUTrKAS_3uRScmg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.152.231 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `c69c0d705764a68d6817577574b56e983575b92725c43c0b64549ff7467c44b2` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=86400 cache-control no-store, no-cache cf-cache-status DYNAMIC cf-ray 8da5472c4c289019-FRA content-encoding br content-type text/html; charset=utf-8 date Tue, 29 Oct 2024 18:37:39 GMT expires -1 link <https://aadcdn.msftauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msftauth.net>; rel=dns-prefetch,<https://aadcdn.msauth.net>; rel=dns-prefetch nel {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} p3p CP="DSP CUR OTPi IND OTRi ONL FIN" pragma no-cache referrer-policy strict-origin-when-cross-origin report-to {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+wst"}]} server cloudflare server-timing cfL4;desc="?proto=QUIC&rtt=10678&sent=20&recv=17&lost=0&retrans=0&sent_bytes=9240&recv_bytes=6858&delivery_rate=2332&cwnd=12000&unsent_bytes=0&cid=407576ff370ba3e2&ts=3523&x=1" cfHdrFlush;dur=0 vary Accept-Encoding x-dns-prefetch-control on x-ms-clitelem 1,0,0,, x-ms-ests-server 2.1.19267.5 - EUS ProdSlices x-ms-request-id 1352a95d-cd19-432c-a04b-f0a4cad26f00 x-ms-srs 1.P Redirect headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 8da54726ff319019-FRA content-type text/html; charset=utf-8 date Tue, 29 Oct 2024 18:37:38 GMT location https://office.io8.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638658238583926699.MGFkODE1MzgtNGQxOC00MDc1LWI3NjQtMGNmMmY5NzBjNzQ0ZDIyMTI3MTItMGMwMC00OGVmLTllZjUtMDI5ODA1ZGQ1Yzky&ui_locales=de-DE&mkt=de-DE&client-request-id=2d09430f-aff0-4426-b251-c193a71c9fd6&state=Dos9hgnBrpU5zljA2tAYikbY-dtY2BnYUKVLF7Ph8KJUpgO6C8AsQI-EKWXMlmDh0Xwt0yqWjJsmUFfM-wiZiYHzZd6Seu5wStvcYz-suhGsaCe-Ez4w_PYR3RC2m_dU3j0kThTZil58J_rgQ32rLmW3upicVP194YD2tBDkycSirp6BOMe4Nzu0XzkZ2jNyFqWpke6wiwmdmJDuDicnIRfgBymoyJmPOquVkeOUGSrzbGlbODzGS2K8Pg_rDjVXghyXzg5qUTrKAS_3uRScmg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} referrer-policy strict-origin-when-cross-origin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YrTjy5b8dtPRqtt%2BJcuoQ7Q5V2XGs34D3mrHgC1F4wgJlJ95Wn3NctvxnjRzezoLQ4cZn8pvMm1jAnTnmV9VHRABEr0IDXED%2BUOtOtdTP5OjOgcCjFgDuZUUfK8on89p8g%3D%3D"}],"group":"cf-nel","max_age":604800} request-context appId= server cloudflare server-timing cfL4;desc="?proto=QUIC&rtt=10973&sent=17&recv=14&lost=0&retrans=0&sent_bytes=7084&recv_bytes=5465&delivery_rate=2418&cwnd=12000&unsent_bytes=0&cid=407576ff370ba3e2&ts=2615&x=1" cfHdrFlush;dur=0 vary Accept-Encoding x-cache CONFIG_NOCACHE x-msedge-ref Ref A: BA8DB73051A545BEB4D8830B56AC21D5 Ref B: BY3EDGE0220 Ref C: 2024-10-29T18:37:38Z x-ua-compatible IE=edge,chrome=1
GET H3	200	Me.htm ywnjb.io8.tech/	0 0	1135ms 1093ms	Other text/html	172.67.152.231 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ywnjb.io8.tech/Me.htm?v=3 Requested by Host: office.io8.tech URL: https://office.io8.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638658238583926699.MGFkODE1MzgtNGQxOC00MDc1LWI3NjQtMGNmMmY5NzBjNzQ0ZDIyMTI3MTItMGMwMC00OGVmLTllZjUtMDI5ODA1ZGQ1Yzky&ui_locales=de-DE&mkt=de-DE&client-request-id=2d09430f-aff0-4426-b251-c193a71c9fd6&state=Dos9hgnBrpU5zljA2tAYikbY-dtY2BnYUKVLF7Ph8KJUpgO6C8AsQI-EKWXMlmDh0Xwt0yqWjJsmUFfM-wiZiYHzZd6Seu5wStvcYz-suhGsaCe-Ez4w_PYR3RC2m_dU3j0kThTZil58J_rgQ32rLmW3upicVP194YD2tBDkycSirp6BOMe4Nzu0XzkZ2jNyFqWpke6wiwmdmJDuDicnIRfgBymoyJmPOquVkeOUGSrzbGlbODzGS2K8Pg_rDjVXghyXzg5qUTrKAS_3uRScmg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.152.231 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://office.io8.tech/ Response headers
GET H2	200	converged.v2.login.min_nin8k2ycrbzww8zl5vxkaq2.css aadcdn.msftauth.net/ests/2.1/content/cdnbundles/	111 KB 20 KB	74ms 24ms	Stylesheet text/css	2606:2800:233:1cb7:261b:1f9c:2074:3c EDGECAST
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_nin8k2ycrbzww8zl5vxkaq2.css Requested by Host: office.io8.tech URL: https://office.io8.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638658238583926699.MGFkODE1MzgtNGQxOC00MDc1LWI3NjQtMGNmMmY5NzBjNzQ0ZDIyMTI3MTItMGMwMC00OGVmLTllZjUtMDI5ODA1ZGQ1Yzky&ui_locales=de-DE&mkt=de-DE&client-request-id=2d09430f-aff0-4426-b251-c193a71c9fd6&state=Dos9hgnBrpU5zljA2tAYikbY-dtY2BnYUKVLF7Ph8KJUpgO6C8AsQI-EKWXMlmDh0Xwt0yqWjJsmUFfM-wiZiYHzZd6Seu5wStvcYz-suhGsaCe-Ez4w_PYR3RC2m_dU3j0kThTZil58J_rgQ32rLmW3upicVP194YD2tBDkycSirp6BOMe4Nzu0XzkZ2jNyFqWpke6wiwmdmJDuDicnIRfgBymoyJmPOquVkeOUGSrzbGlbODzGS2K8Pg_rDjVXghyXzg5qUTrKAS_3uRScmg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/4D03) / Resource Hash `68c2994e21a564345eb3b4091dd2334c9cbddb0aecda45ee963c6de2e1629b93` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://office.io8.tech Referer https://office.io8.tech/ Response headers content-md5 8N6amNvfqMAnQs5tkvslJA== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip x-ms-lease-status unlocked etag 0x8DCDDAB171F8006 age 2865280 x-ms-version 2009-09-19 x-cache HIT date Tue, 29 Oct 2024 18:37:40 GMT content-type text/css last-modified Wed, 25 Sep 2024 21:43:27 GMT vary Accept-Encoding cache-control public, max-age=31536000 x-ms-request-id 2f1e0c5f-d01e-0050-1b22-104337000000 accept-ranges bytes access-control-allow-origin * content-length 20400 x-ms-blob-type BlockBlob server ECAcc (frc/4D03)
GET H2	200	ConvergedLogin_PCore_QLF_8apNRJD3OCol8jwtxw2.js Show response aadcdn.msftauth.net/shared/1.0/content/js/	439 KB 120 KB	62ms 12ms	Script application/x-javascript	2606:2800:233:1cb7:261b:1f9c:2074:3c EDGECAST
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_QLF_8apNRJD3OCol8jwtxw2.js Requested by Host: office.io8.tech URL: https://office.io8.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638658238583926699.MGFkODE1MzgtNGQxOC00MDc1LWI3NjQtMGNmMmY5NzBjNzQ0ZDIyMTI3MTItMGMwMC00OGVmLTllZjUtMDI5ODA1ZGQ1Yzky&ui_locales=de-DE&mkt=de-DE&client-request-id=2d09430f-aff0-4426-b251-c193a71c9fd6&state=Dos9hgnBrpU5zljA2tAYikbY-dtY2BnYUKVLF7Ph8KJUpgO6C8AsQI-EKWXMlmDh0Xwt0yqWjJsmUFfM-wiZiYHzZd6Seu5wStvcYz-suhGsaCe-Ez4w_PYR3RC2m_dU3j0kThTZil58J_rgQ32rLmW3upicVP194YD2tBDkycSirp6BOMe4Nzu0XzkZ2jNyFqWpke6wiwmdmJDuDicnIRfgBymoyJmPOquVkeOUGSrzbGlbODzGS2K8Pg_rDjVXghyXzg5qUTrKAS_3uRScmg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/4CE0) / Resource Hash `9019f3cffb86bf28f83d0e85eebf21fd0a37c4bf159edfcb6f18d0df12cb5e02` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://office.io8.tech Referer https://office.io8.tech/ Response headers content-md5 0mJaO3qA+eD2v9j9vu2xZA== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip x-ms-lease-status unlocked etag 0x8DCE31CBFE0A3E9 age 2309279 x-ms-version 2009-09-19 x-cache HIT date Tue, 29 Oct 2024 18:37:40 GMT content-type application/x-javascript last-modified Wed, 02 Oct 2024 19:59:39 GMT vary Accept-Encoding cache-control public, max-age=31536000 x-ms-request-id 7dbecff1-801e-00ef-3730-153fd9000000 accept-ranges bytes access-control-allow-origin * content-length 122269 x-ms-blob-type BlockBlob server ECAcc (frc/4CE0)
GET H2	200	ux.converged.login.strings-de.min_ko72obxvu9yj3q3_akvs9q2.js Show response aadcdn.msftauth.net/ests/2.1/content/cdnbundles/	63 KB 18 KB	60ms 10ms	Script application/x-javascript	2606:2800:233:1cb7:261b:1f9c:2074:3c EDGECAST
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-de.min_ko72obxvu9yj3q3_akvs9q2.js Requested by Host: office.io8.tech URL: https://office.io8.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638658238583926699.MGFkODE1MzgtNGQxOC00MDc1LWI3NjQtMGNmMmY5NzBjNzQ0ZDIyMTI3MTItMGMwMC00OGVmLTllZjUtMDI5ODA1ZGQ1Yzky&ui_locales=de-DE&mkt=de-DE&client-request-id=2d09430f-aff0-4426-b251-c193a71c9fd6&state=Dos9hgnBrpU5zljA2tAYikbY-dtY2BnYUKVLF7Ph8KJUpgO6C8AsQI-EKWXMlmDh0Xwt0yqWjJsmUFfM-wiZiYHzZd6Seu5wStvcYz-suhGsaCe-Ez4w_PYR3RC2m_dU3j0kThTZil58J_rgQ32rLmW3upicVP194YD2tBDkycSirp6BOMe4Nzu0XzkZ2jNyFqWpke6wiwmdmJDuDicnIRfgBymoyJmPOquVkeOUGSrzbGlbODzGS2K8Pg_rDjVXghyXzg5qUTrKAS_3uRScmg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/4D09) / Resource Hash `b9df4bf16fcb24c8da35cf1a1e891f5a4c8d4bceb89a7cf1ffd5a0f29a6d43ba` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Origin https://office.io8.tech Referer https://office.io8.tech/ Response headers content-md5 Xk63t4Ut+m7GAuwKIOriFg== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip x-ms-lease-status unlocked etag 0x8DCC6D4DD6BA0A8 age 5364689 x-ms-version 2009-09-19 x-cache HIT date Tue, 29 Oct 2024 18:37:40 GMT content-type application/x-javascript last-modified Tue, 27 Aug 2024 20:14:32 GMT vary Accept-Encoding cache-control public, max-age=31536000 x-ms-request-id 6e4a5774-301e-0056-4166-f9a521000000 accept-ranges bytes access-control-allow-origin * content-length 17996 x-ms-blob-type BlockBlob server ECAcc (frc/4D09)
GET H2	200	convergedlogin_pcustomizationloader_117b650bccea354984d8.js Show response aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/	397 KB 114 KB	56ms 13ms	Script application/x-javascript	2606:2800:233:1cb7:261b:1f9c:2074:3c EDGECAST
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_117b650bccea354984d8.js Requested by Host: aadcdn.msftauth.net URL: https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_QLF_8apNRJD3OCol8jwtxw2.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/4CD4) / Resource Hash `da4a8df0c326292b5bee9c732b3c962fd67aaf2f99d850f1bf65068d573c5619` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://office.io8.tech/ Response headers content-md5 LT++1t3XGfzBv7UAthL87A== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip x-ms-lease-status unlocked etag 0x8DCBD52F37806EC age 6417581 x-ms-version 2009-09-19 x-cache HIT date Tue, 29 Oct 2024 18:37:40 GMT content-type application/x-javascript last-modified Thu, 15 Aug 2024 17:51:54 GMT vary Accept-Encoding cache-control public, max-age=31536000 x-ms-request-id 4a5ad515-a01e-0009-79d3-ef111d000000 accept-ranges bytes access-control-allow-origin * content-length 116365 x-ms-blob-type BlockBlob server ECAcc (frc/4CD4)
GET H2	200	favicon_a_eupayfgghqiai7k9sol6lg2.ico aadcdn.msftauth.net/shared/1.0/content/images/	17 KB 17 KB	23ms 11ms	Other image/x-icon	2606:2800:233:1cb7:261b:1f9c:2074:3c EDGECAST
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/4CBA) / Resource Hash `90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://office.io8.tech/ Response headers content-md5 EuPayFgGHQiAI7K9SOL6lg== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-lease-status unlocked x-ms-version 2009-09-19 etag 0x8D8731240E548EB age 18975419 x-cache HIT date Tue, 29 Oct 2024 18:37:40 GMT content-type image/x-icon last-modified Sun, 18 Oct 2020 03:02:30 GMT cache-control public, max-age=31536000 x-ms-request-id debb0496-801e-00bf-299d-7da57d000000 accept-ranges bytes access-control-allow-origin * content-length 17174 x-ms-blob-type BlockBlob server ECAcc (frc/4CBA)
GET H2	200	convergedlogin_pfetchsessionsprogress_d0a803279e7397bef834.js Show response aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/	15 KB 6 KB	20ms 19ms	Script application/x-javascript	2606:2800:233:1cb7:261b:1f9c:2074:3c EDGECAST
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_d0a803279e7397bef834.js Requested by Host: aadcdn.msftauth.net URL: https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_QLF_8apNRJD3OCol8jwtxw2.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/4CDF) / Resource Hash `bc6804d058d5bd5b24fc04e479fc8973bef5d3efeafaa9c19c60a009bf0fac0b` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://office.io8.tech/ Response headers content-md5 betEqf4nMmbvq8MhS5mLoA== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip x-ms-lease-status unlocked etag 0x8DCBD52F3A242D0 age 6125362 x-ms-version 2009-09-19 x-cache HIT date Tue, 29 Oct 2024 18:37:40 GMT content-type application/x-javascript last-modified Thu, 15 Aug 2024 17:51:55 GMT vary Accept-Encoding cache-control public, max-age=31536000 x-ms-request-id 07f922bf-601e-00aa-267b-f2ea3a000000 accept-ranges bytes access-control-allow-origin * content-length 5529 x-ms-blob-type BlockBlob server ECAcc (frc/4CDF)
GET H2	200	marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif aadcdn.msftauth.net/shared/1.0/content/images/	3 KB 3 KB	14ms 14ms	Image image/gif	2606:2800:233:1cb7:261b:1f9c:2074:3c EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msftauth.net/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/4CDE) / Resource Hash `a46201581a7c7c667fd42787cd1e9adf2f6bf809efb7596e61a03e8dba9ada13` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://office.io8.tech/ Response headers content-md5 Fm3lNHEmUlOrOkVt7+baIw== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-lease-status unlocked x-ms-version 2009-09-19 etag 0x8DB5C3F4982FD30 age 18975420 x-cache HIT date Tue, 29 Oct 2024 18:37:40 GMT content-type image/gif last-modified Wed, 24 May 2023 10:11:48 GMT cache-control public, max-age=31536000 x-ms-request-id 08f58f55-a01e-00e9-639d-7d3c42000000 accept-ranges bytes access-control-allow-origin * content-length 2672 x-ms-blob-type BlockBlob server ECAcc (frc/4CDE)
GET H2	200	marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif aadcdn.msftauth.net/shared/1.0/content/images/	4 KB 4 KB	17ms 17ms	Image image/gif	2606:2800:233:1cb7:261b:1f9c:2074:3c EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msftauth.net/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/4D04) / Resource Hash `8737d721808655f37b333f08a90185699e7e8b9bdaaa15cdb63c8448b426f95d` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://office.io8.tech/ Response headers content-md5 tUCo5RgDcZLjLE/li/Lbqw== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding x-ms-lease-status unlocked x-ms-version 2009-09-19 etag 0x8DB5C3F492F3EE5 age 18975319 x-cache HIT date Tue, 29 Oct 2024 18:37:40 GMT content-type image/gif last-modified Wed, 24 May 2023 10:11:48 GMT cache-control public, max-age=31536000 x-ms-request-id b6e17d00-601e-00a1-2e9d-7db742000000 accept-ranges bytes access-control-allow-origin * content-length 3620 x-ms-blob-type BlockBlob server ECAcc (frc/4D04)
GET H2	200	2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/	2 KB 838 B	9ms 8ms	Image image/svg+xml	2606:2800:233:1cb7:261b:1f9c:2074:3c EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/4CBF) / Resource Hash `0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://office.io8.tech/ Response headers content-md5 DhdidjYrlCeaRJJRG/y9mA== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip x-ms-lease-status unlocked etag 0x8DB5C3F466DE917 age 18975462 x-ms-version 2009-09-19 x-cache HIT date Tue, 29 Oct 2024 18:37:40 GMT content-type image/svg+xml last-modified Wed, 24 May 2023 10:11:43 GMT vary Accept-Encoding cache-control public, max-age=31536000 x-ms-request-id 920c4446-a01e-00e9-709c-7d3c42000000 accept-ranges bytes access-control-allow-origin * content-length 673 x-ms-blob-type BlockBlob server ECAcc (frc/4CBF)
GET H2	200	microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg aadcdn.msftauth.net/shared/1.0/content/images/	4 KB 2 KB	11ms 11ms	Image image/svg+xml	2606:2800:233:1cb7:261b:1f9c:2074:3c EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msftauth.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/4C94) / Resource Hash `04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://office.io8.tech/ Response headers content-md5 nzaLxFgP7ZB3dfMcaybWzw== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip x-ms-lease-status unlocked etag 0x8DB5C3F495F4B8C age 18975499 x-ms-version 2009-09-19 x-cache HIT date Tue, 29 Oct 2024 18:37:40 GMT content-type image/svg+xml last-modified Wed, 24 May 2023 10:11:48 GMT vary Accept-Encoding cache-control public, max-age=31536000 x-ms-request-id f2ff5853-201e-0065-619c-7d9f0e000000 accept-ranges bytes access-control-allow-origin * content-length 1435 x-ms-blob-type BlockBlob server ECAcc (frc/4C94)
GET H3	200	Me.htm Show response ywnjb.io8.tech/ Frame 502D	3 KB 2 KB	1143ms 1142ms	Document text/html	172.67.152.231 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ywnjb.io8.tech/Me.htm?v=3 Requested by Host: aadcdn.msftauth.net URL: https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_QLF_8apNRJD3OCol8jwtxw2.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.152.231 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `e400893928e4346d805ecd3c974c69c073c1efc267ea619c7816a38975210a43` Request headers Referer https://office.io8.tech/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=86400 cache-control max-age=315360000 cf-cache-status DYNAMIC cf-ray 8da547373f399019-FRA content-encoding br content-type text/html; charset=utf-8 date Tue, 29 Oct 2024 18:37:41 GMT expires Fri, 27 Oct 2034 18:37:41 GMT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} p3p CP="DSP CUR OTPi IND OTRi ONL FIN" ppserver PPV: 30 H: PH1PEPF00011EE7 V: 0 referrer-policy strict-origin-when-cross-origin report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JhHZUCV%2FZYeAHwuEQz3jjsws3cq8boMAPGuT8%2BJLCBGQDlXBPeopa82qmDh9t2eLcIZYaYlaFa6yCUrDc3Ri2B8lNlkh4W0BzeLgZWpamnA6mtaDqX1%2FWjeNBA6LEy3U5w%3D%3D"}],"group":"cf-nel","max_age":604800} server cloudflare server-timing cfL4;desc="?proto=QUIC&rtt=13217&sent=48&recv=33&lost=5&retrans=6&sent_bytes=34295&recv_bytes=8437&delivery_rate=2164&cwnd=8400&unsent_bytes=0&cid=407576ff370ba3e2&ts=5523&x=1" cfHdrFlush;dur=0 vary Accept-Encoding x-ms-request-id 76185588-7636-43a8-a8d3-c883c5bef9d7 x-ms-route-info C539_BAY
GET H2	200	convergedlogin_pstringcustomizationhelper_4285088f1dbaf52a876d.js Show response aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/	111 KB 35 KB	9ms 9ms	Script application/x-javascript	2606:2800:233:1cb7:261b:1f9c:2074:3c EDGECAST
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_4285088f1dbaf52a876d.js Requested by Host: aadcdn.msftauth.net URL: https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_QLF_8apNRJD3OCol8jwtxw2.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/4CF5) / Resource Hash `ddd0bb1c19b3d2d045bfcde85d2020bba57854c887a6691b66dba3da1bb3afbe` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://office.io8.tech/ Response headers content-md5 07aumYbfJEqwNBLMcAM10A== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip x-ms-lease-status unlocked etag 0x8DCBD52F42903D2 age 6417582 x-ms-version 2009-09-19 x-cache HIT date Tue, 29 Oct 2024 18:37:41 GMT content-type application/x-javascript last-modified Thu, 15 Aug 2024 17:51:56 GMT vary Accept-Encoding cache-control public, max-age=31536000 x-ms-request-id d1c2c6fb-901e-00d7-28d3-efd052000000 accept-ranges bytes access-control-allow-origin * content-length 35168 x-ms-blob-type BlockBlob server ECAcc (frc/4CF5)
GET H2	200	signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg aadcdn.msftauth.net/shared/1.0/content/images/	2 KB 773 B	13ms 12ms	Image image/svg+xml	2606:2800:233:1cb7:261b:1f9c:2074:3c EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msftauth.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/4CA2) / Resource Hash `8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93` Request headers User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Referer https://office.io8.tech/ Response headers content-md5 R2FAVxfpONfnQAuxVxXbHg== access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding content-encoding gzip x-ms-lease-status unlocked etag 0x8DB5C3F4BB4F03C age 18975462 x-ms-version 2009-09-19 x-cache HIT date Tue, 29 Oct 2024 18:37:41 GMT content-type image/svg+xml last-modified Wed, 24 May 2023 10:11:52 GMT vary Accept-Encoding cache-control public, max-age=31536000 x-ms-request-id cc0763e7-101e-0082-0a9c-7d5b77000000 accept-ranges bytes access-control-allow-origin * content-length 621 x-ms-blob-type BlockBlob server ECAcc (frc/4CA2)

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

15 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.io8.tech/	1970-01-21 00:37:10	Name: 139e-36fc Value: 2b0d8302fcaf8170254a700d5a2f461b2a24099f39850f004f8005f7eb212256
office.io8.tech/	1969-12-31 23:59:59	Name: x-ms-gateway-slice Value: estsfd
office.io8.tech/	1969-12-31 23:59:59	Name: stsservicecookie Value: estsfd
react.io8.tech/	1970-01-21 00:37:35	Name: OH.DCAffinity Value: OH-wus
react.io8.tech/	1970-01-21 09:22:43	Name: OH.FLID Value: 58df77f8-f919-45c2-8e03-27a7d6095862
react.io8.tech/	1970-01-21 00:37:07	Name: .AspNetCore.OpenIdConnect.Nonce.kYLI1Mie1joZM3p72_td8btxDhclU2UrjM4rCMqqNK-h1dudW666eTmNUY_hJL20KZoycgePuxskX5Dur5S2J4QFiDDkztqZn1uS6eAyyLRJjbgbr8RKo3B7fRXC5pXUD2WDYseTT2nMvKG60RV13E81w6x4ewaFmWHAccz9JklY4zaNVoh3QHxSxFOtXJGJ4F6FIDirh85QBPEon_y2S5bk-tb5nZwyFu_FqYm3iXFhVfBfQ2muuz6yX0d2mpTU Value: N
react.io8.tech/	1970-01-21 00:37:07	Name: .AspNetCore.Correlation.Pd2HVhtHzzoHluntaUIfNECRv4x2phnbU--b4Z6UhPY Value: N
.io8.tech/	1970-01-21 09:58:43	Name: MUID Value: 32ED283DDB806CD314153D1ADACC6D15
office.io8.tech/	1970-01-21 01:20:19	Name: buid Value: 0.ATUAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABGgEAAADW6jl31mB3T7ugrWTT8pFeE-zwJ5puuc-KkKCjAYD5HSIF2l2LTUpWDkjY6-H4_c2BaIDdO5-BYbLlWiVeu5J-fYwfTPJVDZxRFajTfRpNAfCE6VHEUeeq3JxXwwc2mP8gAA
.office.io8.tech/	1969-12-31 23:59:59	Name: esctx Value: PAQABBwEAAADW6jl31mB3T7ugrWTT8pFe2vbsgxUsDiU6fxpoiUYG53h-IFLVS5px9v25WDJRbLiPRSRcHnqS0b272E9g5Sm3CTB9XX2ztJmFKtkuL6X9biBMOSaL5yFR3OWVaWAxFNa56xYPJ6RZpKeqbGPYtPkUxWQbymVEPDgnVPoFGMHouVwFxcfadcqHP0OT2YVe8_sgAA
.office.io8.tech/	1969-12-31 23:59:59	Name: esctx-omGXjMza65g Value: AQABCQEAAADW6jl31mB3T7ugrWTT8pFe4oFUvLrxV0lKHuJiJQl7ECa8FpP66MXpllcS4L62Ca6YNaE7Jwtbgxnj7owtNhAfoK-XPPA2FXQ-8UDl3IrDH-L5MryNBSnTJPiGHYmts_KEbY4_GbKxDzCsUFPL_OBkEirZHJ54UeekXQ-v5n9-YSAA
office.io8.tech/	1970-01-21 01:20:19	Name: fpc Value: Aosaj9WeLJpOp_HwkkufMUC8Ae7AAQAAAHIis94OAAAA
.office.io8.tech/	1970-01-21 09:58:43	Name: brcap Value: 0
.ywnjb.io8.tech/	1969-12-31 23:59:59	Name: uaid Value: cf654d1e0c5d447fb14f66d95a09b6ad
.ywnjb.io8.tech/	1969-12-31 23:59:59	Name: MSPRequ Value: id=N&lt=1730227061&co=1

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://office.io8.tech/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638658238583926699.MGFkODE1MzgtNGQxOC00MDc1LWI3NjQtMGNmMmY5NzBjNzQ0ZDIyMTI3MTItMGMwMC00OGVmLTllZjUtMDI5ODA1ZGQ1Yzky&ui_locales=de-DE&mkt=de-DE&client-request-id=2d09430f-aff0-4426-b251-c193a71c9fd6&state=Dos9hgnBrpU5zljA2tAYikbY-dtY2BnYUKVLF7Ph8KJUpgO6C8AsQI-EKWXMlmDh0Xwt0yqWjJsmUFfM-wiZiYHzZd6Seu5wStvcYz-suhGsaCe-Ez4w_PYR3RC2m_dU3j0kThTZil58J_rgQ32rLmW3upicVP194YD2tBDkycSirp6BOMe4Nzu0XzkZ2jNyFqWpke6wiwmdmJDuDicnIRfgBymoyJmPOquVkeOUGSrzbGlbODzGS2K8Pg_rDjVXghyXzg5qUTrKAS_3uRScmg&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msftauth.net
norteacompanhantes.com.br
office.io8.tech
react.io8.tech
ywnjb.io8.tech
162.241.203.111
172.67.152.231
2606:2800:233:1cb7:261b:1f9c:2074:3c
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
68c2994e21a564345eb3b4091dd2334c9cbddb0aecda45ee963c6de2e1629b93
8737d721808655f37b333f08a90185699e7e8b9bdaaa15cdb63c8448b426f95d
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93
9019f3cffb86bf28f83d0e85eebf21fd0a37c4bf159edfcb6f18d0df12cb5e02
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21
a46201581a7c7c667fd42787cd1e9adf2f6bf809efb7596e61a03e8dba9ada13
b9df4bf16fcb24c8da35cf1a1e891f5a4c8d4bceb89a7cf1ffd5a0f29a6d43ba
bc6804d058d5bd5b24fc04e479fc8973bef5d3efeafaa9c19c60a009bf0fac0b
c69c0d705764a68d6817577574b56e983575b92725c43c0b64549ff7467c44b2
da4a8df0c326292b5bee9c732b3c962fd67aaf2f99d850f1bf65068d573c5619
ddd0bb1c19b3d2d045bfcde85d2020bba57854c887a6691b66dba3da1bb3afbe
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e400893928e4346d805ecd3c974c69c073c1efc267ea619c7816a38975210a43

office.io8.tech Open in urlscan Pro 172.67.152.231 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

15 Requests

100 %HTTPS

33 %IPv6

3 Domains

5 Subdomains

2 IPs

1 Countries

358 kBTransfer

1215 kBSize

15 Cookies

4 Outgoing links

Page URL History

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

22 JavaScript Global Variables

15 Cookies

1 Console Messages

Indicators

office.io8.tech Open in urlscan Pro
172.67.152.231 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

100 %
HTTPS

33 %
IPv6

3
Domains

5
Subdomains

2
IPs

1
Countries

358 kB
Transfer

1215 kB
Size

15
Cookies

15 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!