login.microsoftonline.com Open in urlscan Pro
2603:1027:1:d8::9 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://wd103.myworkday.com/crestnicholson/d/inst/1$247/247$1600.htmld
Effective URL:
https://login.microsoftonline.com/bdd51e2c-3db0-4b59-b17d-7c70ac9bdec9/saml2
Submission: On July 31 via manual (July 31st 2024, 9:06:18 am UTC) from ZA — Scanned from DE

Summary HTTP 12 Redirects Behaviour Indicators

Summary

This website contacted 5 IPs in 2 countries across 5 domains to perform 12 HTTP transactions. The main IP is 2603:1027:1:d8::9, located in Dublin, Ireland and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is login.microsoftonline.com. The Cisco Umbrella rank of the primary domain is 15.
TLS certificate: Issued by DigiCert SHA2 Secure Server CA on May 27th 2024. Valid for: a year.

This is the only time login.microsoftonline.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
2 4	64.69.24.26 64.69.24.26	209242 (CLOUDFLAR...) (CLOUDFLARESPECTRUM Cloudflare)
2	2603:1027:1:d... 2603:1027:1:d8::9	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2606:2800:233... 2606:2800:233:1cb7:261b:1f9c:2074:3c	() ()
3	2620:1ec:bdf::42 2620:1ec:bdf::42	() ()
12	5

4 64.69.24.26 (United States) 2 redirects

ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US)

wd103.myworkday.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2603:1027:1:d8::9 (Dublin, Ireland)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

login.microsoftonline.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:2800:233:1cb7:261b:1f9c:2074:3c (None, )

ASN- ()

aadcdn.msftauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:bdf::42 (None, )

ASN- ()

aadcdn.msauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
4	myworkday.com 2 redirects wd103.myworkday.com — Cisco Umbrella Rank: 343541	3 KB
3	msauth.net aadcdn.msauth.net Failed	50 KB
2	microsoftonline.com login.microsoftonline.com — Cisco Umbrella Rank: 15	18 KB
1	msftauth.net aadcdn.msftauth.net	20 KB
0	live.com Failed login.live.com Failed
12	5

	Domain	Requested by
4	wd103.myworkday.com	2 redirects wd103.myworkday.com
3	aadcdn.msauth.net	login.microsoftonline.com
2	login.microsoftonline.com	aadcdn.msauth.net
1	aadcdn.msftauth.net	login.microsoftonline.com
0	login.live.com Failed	login.microsoftonline.com
12	5

This site contains no links.

Subject Issuer	Validity	Valid
wd103.myworkday.com GeoTrust TLS RSA CA G1	`2023-09-29` - `2024-10-29`	a year	crt.sh
stamp2.login.microsoftonline.com DigiCert SHA2 Secure Server CA	`2024-05-27` - `2025-05-27`	a year	crt.sh
aadcdn.msftauth.net DigiCert SHA2 Secure Server CA	`2024-05-25` - `2025-05-25`	a year	crt.sh
aadcdn.msauth.net DigiCert SHA2 Secure Server CA	`2024-04-30` - `2025-04-30`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://login.microsoftonline.com/bdd51e2c-3db0-4b59-b17d-7c70ac9bdec9/saml2
Frame ID: 65F3629525CBD6A6F05A9B55E5FC89FE
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://wd103.myworkday.com/crestnicholson/d/inst/1$247/247$1600.htmld HTTP 307
https://wd103.myworkday.com/crestnicholson/d/inst/1$247/247$1600.htmld Page URL
https://wd103.myworkday.com/wday/authgwy/crestnicholson/login.htmld?returnTo=%2fcrestnicholson%2fd%2fins... HTTP 302
https://wd103.myworkday.com/crestnicholson/login-saml2.htmld HTTP 302
https://wd103.myworkday.com/wday/authgwy/crestnicholson/login-saml2.htmld Page URL
https://login.microsoftonline.com/bdd51e2c-3db0-4b59-b17d-7c70ac9bdec9/saml2 Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

12
Requests

67 %
HTTPS

75 %
IPv6

5
Domains

5
Subdomains

5
IPs

2
Countries

90 kB
Transfer

288 kB
Size

14
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://wd103.myworkday.com/crestnicholson/d/inst/1$247/247$1600.htmld HTTP 307
https://wd103.myworkday.com/crestnicholson/d/inst/1$247/247$1600.htmld Page URL
https://wd103.myworkday.com/wday/authgwy/crestnicholson/login.htmld?returnTo=%2fcrestnicholson%2fd%2finst%2f1%24247%2f247%241600.htmld HTTP 302
https://wd103.myworkday.com/crestnicholson/login-saml2.htmld HTTP 302
https://wd103.myworkday.com/wday/authgwy/crestnicholson/login-saml2.htmld Page URL
https://login.microsoftonline.com/bdd51e2c-3db0-4b59-b17d-7c70ac9bdec9/saml2 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://wd103.myworkday.com/crestnicholson/d/inst/1$247/247$1600.htmld HTTP 307
https://wd103.myworkday.com/crestnicholson/d/inst/1$247/247$1600.htmld

Request Chain 1

https://wd103.myworkday.com/wday/authgwy/crestnicholson/login.htmld?returnTo=%2fcrestnicholson%2fd%2finst%2f1%24247%2f247%241600.htmld HTTP 302
https://wd103.myworkday.com/crestnicholson/login-saml2.htmld HTTP 302
https://wd103.myworkday.com/wday/authgwy/crestnicholson/login-saml2.htmld

12 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

247$1600.htmld
wd103.myworkday.com/crestnicholson/d/inst/1$247/
Redirect Chain

http://wd103.myworkday.com/crestnicholson/d/inst/1$247/247$1600.htmld
https://wd103.myworkday.com/crestnicholson/d/inst/1$247/247$1600.htmld

447 B
1 KB

302ms
77ms

Document
text/html

64.69.24.26
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://wd103.myworkday.com/crestnicholson/d/inst/1$247/247$1600.htmld

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

64.69.24.26 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache
cf-cache-status: BYPASS
cf-ray: 8abc6e19fe982bd6-FRA
content-encoding: br
content-language: en
content-type: text/html;charset=UTF-8
date: Wed, 31 Jul 2024 09:06:01 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
pragma: no-cache
referer: /crestnicholson/d/inst/1$247/247$1600.htmld
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
x-robots-tag: noindex, nofollow

Redirect headers

Location: https://wd103.myworkday.com/crestnicholson/d/inst/1$247/247$1600.htmld
Non-Authoritative-Reason: HttpsUpgrades

GET
H2

200

https://wd103.myworkday.com/wday/authgwy/crestnicholson/login.htmld?returnTo=%2fcrestnicholson%2fd%2finst%2f1%24247%2f247%241600.htmld
https://wd103.myworkday.com/crestnicholson/login-saml2.htmld
https://wd103.myworkday.com/wday/authgwy/crestnicholson/login-saml2.htmld

966 B
778 B

257ms
214ms

Document
text/html

64.69.24.26
CLOUDFLARESPECTRU...

General

Check archive.org

Show headers Download Go to

Full URL

https://wd103.myworkday.com/wday/authgwy/crestnicholson/login-saml2.htmld

Requested by

Host: wd103.myworkday.com
URL: https://wd103.myworkday.com/crestnicholson/d/inst/1$247/247$1600.htmld

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

64.69.24.26 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),

Reverse DNS

Software

cloudflare /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://wd103.myworkday.com/crestnicholson/d/inst/1$247/247$1600.htmld
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=86400
cf-cache-status: BYPASS
cf-ray: 8abc6e219f1c2bd6-FRA
content-encoding: gzip
content-language: de-DE
content-type: text/html;charset=UTF-8
date: Wed, 31 Jul 2024 09:06:03 GMT
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains
vary: accept-encoding
x-frame-options: SAMEORIGIN
x-robots-tag: noindex, nofollow

Redirect headers

alt-svc: h3=":443"; ma=86400
cache-control: no-store, no-cache
cf-cache-status: MISS
cf-ray: 8abc6e20ae372bd6-FRA
content-language: en
content-length: 0
date: Wed, 31 Jul 2024 09:06:03 GMT
expires: Thu, 01 Jan 1970 00:00:00 GMT
location: https://wd103.myworkday.com/wday/authgwy/crestnicholson/login-saml2.htmld
pragma: no-cache
referer: /crestnicholson/login-saml2.htmld
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding
x-robots-tag: noindex, nofollow

POST
H/1.1 200
OK Primary Request saml2 Show response
login.microsoftonline.com/bdd51e2c-3db0-4b59-b17d-7c70ac9bdec9/ 38 KB
16 KB 1052ms
163ms Document
text/html 2603:1027:1:d8::9
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://login.microsoftonline.com/bdd51e2c-3db0-4b59-b17d-7c70ac9bdec9/saml2

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2603:1027:1:d8::9 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

8afa468ac07b612f01e16b96667b1f1f291caf01db80f28a1f7e6d207360b85b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://wd103.myworkday.com
Referer: https://wd103.myworkday.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

Cache-Control: no-store, no-cache
Content-Encoding: gzip
Content-Length: 14597
Content-Type: text/html; charset=utf-8
Date: Wed, 31 Jul 2024 09:06:04 GMT
Expires: -1
Link: <https://aadcdn.msauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msauth.net>; rel=dns-prefetch,<https://aadcdn.msftauth.net>; rel=dns-prefetch
P3P: CP="DSP CUR OTPi IND OTRi ONL FIN"
Pragma: no-cache
Referrer-Policy: strict-origin-when-cross-origin
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-DNS-Prefetch-Control: on
X-Frame-Options: DENY
X-XSS-Protection: 0
nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+dub2"}]}
x-ms-ests-server: 2.1.18565.7 - SEC ProdSlices
x-ms-request-id: 19aa7e03-db8e-45ca-96fb-c5c4b41c1f00
x-ms-srs: 1.P

GET converged.v2.login.min_qzvqnltrxpy99ajspyxbgq2.css
aadcdn.msauth.net/ests/2.1/content/cdnbundles/ 0
0

GET ConvergedLogin_PCore_Q3A1xKaK6oPrhbQSUwvJBQ2.js
aadcdn.msauth.net/shared/1.0/content/js/ 0
0

GET ux.converged.login.strings-de.min_mwkrjugjbdtxzv3fly3p-q2.js
aadcdn.msauth.net/ests/2.1/content/cdnbundles/ 0
0

GET Me.htm
login.live.com/ 0
0

GET
H2 200 converged.v2.login.min_qzvqnltrxpy99ajspyxbgq2.css
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ 111 KB
20 KB 1239ms
88ms Stylesheet
text/css 2606:2800:233:1cb7:261b:1f9c:2074:3c

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_qzvqnltrxpy99ajspyxbgq2.css
Requested by: Host: login.microsoftonline.com
URL: https://login.microsoftonline.com/bdd51e2c-3db0-4b59-b17d-7c70ac9bdec9/saml2
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:233:1cb7:261b:1f9c:2074:3c -, , ASN (),
Reverse DNS
Software: ECAcc (frc/4D08) /
Resource Hash: 1f8ceb44fe7cfcf7e71dbd5122210335ca3821d697a851d2900b95af7d92d69d

Request headers

Referer: https://login.microsoftonline.com/
Origin: https://login.microsoftonline.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 31 Jul 2024 09:06:09 GMT
content-encoding: gzip
content-md5: SJgdPPV+fFjKfj6FHvk1Tg==
age: 2292489
x-cache: HIT
content-length: 20414
x-ms-lease-status: unlocked
last-modified: Wed, 03 Jul 2024 21:49:46 GMT
server: ECAcc (frc/4D08)
etag: 0x8DC9BAA0E5931F9
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 22c2d1bd-501e-006a-1b4f-ce1611000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js Show response
aadcdn.msauth.net/ests/2.1/content/cdnbundles/ 117 KB
40 KB 783ms
81ms Script
application/x-javascript 2620:1ec:bdf::42

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js
Requested by: Host: login.microsoftonline.com
URL: https://login.microsoftonline.com/bdd51e2c-3db0-4b59-b17d-7c70ac9bdec9/saml2
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:bdf::42 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: df2aa8537c1992c94846a0ffffaa9031d430d9d0210b9e396ec059aff62627e0

Request headers

Referer: https://login.microsoftonline.com/
Origin: https://login.microsoftonline.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 31 Jul 2024 09:06:09 GMT
content-encoding: gzip
x-cache: TCP_HIT
x-fd-int-roxy-purgeid: 4554691
content-length: 40454
x-ms-lease-status: unlocked
last-modified: Fri, 26 Feb 2021 06:13:13 GMT
etag: 0x8D8DA1D997CA245
x-azure-ref: 20240731T090609Z-16b8f8f97cf7pzsbyd29cw1fmg00000009ug00000000taf7
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 5794b126-401e-0026-4e02-de8ea1000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 frameworksupport.min_oadrnc13magb009k4d20lg2.js Show response
aadcdn.msauth.net/ests/2.1/content/cdnbundles/ 12 KB
5 KB 278ms
124ms Script
application/x-javascript 2620:1ec:bdf::42

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/frameworksupport.min_oadrnc13magb009k4d20lg2.js
Requested by: Host: login.microsoftonline.com
URL: https://login.microsoftonline.com/bdd51e2c-3db0-4b59-b17d-7c70ac9bdec9/saml2
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:bdf::42 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: c8cef105fcaf7cbf3f8682c861045505c24d41cf6686c20c1c03e14031a3db69

Request headers

Referer: https://login.microsoftonline.com/
Origin: https://login.microsoftonline.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 31 Jul 2024 09:06:11 GMT
content-encoding: gzip
x-cache: TCP_HIT
x-fd-int-roxy-purgeid: 0
content-length: 4880
x-ms-lease-status: unlocked
last-modified: Thu, 22 Oct 2020 20:43:21 GMT
etag: 0x8D876CB1D67B929
x-azure-ref: 20240731T090611Z-16b8f8f97cf7pzsbyd29cw1fmg00000009ug00000000tapd
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: d66f46e5-201e-0058-2ee1-dddebc000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

GET
H2 200 watson.min_q5ptmu8aniymd4ftuqdkda2.js Show response
aadcdn.msauth.net/ests/2.1/content/cdnbundles/ 9 KB
4 KB 138ms
34ms Script
application/x-javascript 2620:1ec:bdf::42

General

Check archive.org

Show headers Download Go to

Full URL: https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/watson.min_q5ptmu8aniymd4ftuqdkda2.js
Requested by: Host: login.microsoftonline.com
URL: https://login.microsoftonline.com/bdd51e2c-3db0-4b59-b17d-7c70ac9bdec9/saml2
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2620:1ec:bdf::42 -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 441bfa485fb0eb8ad2be7001209868b57c41769cae9512a774419f5882c093e6

Request headers

Referer: https://login.microsoftonline.com/
Origin: https://login.microsoftonline.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 31 Jul 2024 09:06:12 GMT
content-encoding: gzip
x-cache: TCP_HIT
x-fd-int-roxy-purgeid: 0
content-length: 3921
x-ms-lease-status: unlocked
last-modified: Tue, 28 Jun 2022 20:27:38 GMT
etag: 0x8DA5944A4FF258E
x-azure-ref: 20240731T090612Z-16b8f8f97cf7pzsbyd29cw1fmg00000009ug00000000tarv
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 125929df-a01e-0027-76d8-dda32d000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
x-ms-version: 2009-09-19
accept-ranges: bytes

POST
H/1.1 200
OK watson Show response
login.microsoftonline.com/common/handlers/ 265 B
1 KB 319ms
153ms XHR
application/json 2603:1027:1:d8::9
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://login.microsoftonline.com/common/handlers/watson

Requested by

Host: aadcdn.msauth.net
URL: https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2603:1027:1:d8::9 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

f75847b4b8fd3297b0bd484f42399194196f336929ee52ae89ea8c11b0290fe2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
client-request-id: 594ce9b8-7625-4ae0-95ef-f6b47b25b502
canary: PAQABDgEAAAApTwJmzXqdR4BN2miheQMY4Dklzj2UmYY4Q5JGVYLKOCaCuqSkYxEDBELrvg5meQW6nhe3RDtdUQG03CypPdoXupGo6y0Ywn8U2wGmVZpLYgwdW98ZCBcJt6EA5c_GzyvshG7Oifzb0xW-XYo7ubMG7vzdAzS_zG2-PrgqRmx1S9Ksb8hcmVBEpp-lw2l2BDi7Rm7NNjfnKRpouwGwaUdlnqzBVW31dL61Mexbvm_jyyAA
Content-Type: application/json; charset=UTF-8
hpgid: 1104
Accept: application/json
Referer: https://login.microsoftonline.com/bdd51e2c-3db0-4b59-b17d-7c70ac9bdec9/saml2
X-Requested-With: XMLHttpRequest
hpgact: 1900

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Date: Wed, 31 Jul 2024 09:06:12 GMT
X-Content-Type-Options: nosniff
nel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
client-request-id: 594ce9b8-7625-4ae0-95ef-f6b47b25b502
P3P: CP="DSP CUR OTPi IND OTRi ONL FIN"
Content-Length: 265
X-XSS-Protection: 0
Pragma: no-cache
x-ms-srs: 1.P
Referrer-Policy: strict-origin-when-cross-origin
report-to: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+dub2"}]}
Content-Type: application/json; charset=utf-8
x-ms-request-id: 8c160622-bfff-4009-a4c7-8ea76e102100
Cache-Control: no-store, no-cache
x-ms-ests-server: 2.1.18565.7 - NEULR1 ProdSlices
Expires: -1

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: aadcdn.msauth.net
URL: https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_qzvqnltrxpy99ajspyxbgq2.css

Domain: aadcdn.msauth.net
URL: https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_Q3A1xKaK6oPrhbQSUwvJBQ2.js

Domain: aadcdn.msauth.net
URL: https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-de.min_mwkrjugjbdtxzv3fly3p-q2.js

Domain: login.live.com
URL: https://login.live.com/Me.htm?v=3

Verdicts & Comments Add Verdict or Comment

10 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

14 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
wd103.myworkday.com/	1969-12-31 23:59:59	Name: wd-browser-id Value: 0c65c4f8-3253-4d37-b736-b53d292c952d
wd103.myworkday.com/	1969-12-31 23:59:59	Name: ui-cke Value: "0570a719ff04de7f"
wd103.myworkday.com/	1969-12-31 23:59:59	Name: WorkdayLB_UI_Apache Value: !smNnRKBtHt+R8ysg9hK5GYr8EM80tvEJAIw0i1490BpYScpsfwZBvmFFTeC2GXwjG6aotb5lWpzqSe0Vw0apXlwlVSyn4cNSNFFH/hA9g6fuH8YPIlhlh85mDCgk70QaEZl1zbrRQSrtRMfNmM/gJyh+Y0qZPbA=
.wd103.myworkday.com/	1970-01-20 22:26:58	Name: __cf_bm Value: dNBeH_0nKJ61zhiZog_WmpiimgWvX5pqjncs8y61YGo-1722416761-1.0.1.1-vSw2iTeZFxf_VOqQhxDNUvqGjmb_O1Ihdq17LPfofJiADka9EFGQ.DQjw68dMrIVJ4.rpJsPx89XsVXYojc8iQ
wd103.myworkday.com/	1970-01-20 22:28:19	Name: __cflb Value: 02DiuCuKdwNAvrkgeU4UUQqe5kFB2aShXU9sc4R18LxBW
wd103.myworkday.com/	1969-12-31 23:59:59	Name: JSESSIONID Value: CDEBF8D94287F6DAA111E228AF5FB0DD.authgwy-55c875bdff-rx7s6
wd103.myworkday.com/	1969-12-31 23:59:59	Name: wd-alt-sessionid Value: bc955c76069166d51373261daa8c6d8083e7c3a26daf630c2ab944bb1ae2fa7d.authgwy-55c875bdff-rx7s6
wd103.myworkday.com/	1969-12-31 23:59:59	Name: authgwy-cke Value: "c1e7a56370b53b5d"
login.microsoftonline.com/	1970-01-20 23:10:08	Name: buid Value: 0.AQwALB7VvbA9WUuxfXxwrJveyTurR4ZksWZFvSGzJkhE0sOWAAA.AQABGgEAAAApTwJmzXqdR4BN2miheQMYndpV3st6YtcDt9N0FewFGswGp9Np2G4AMb4eDLVFLy9gg1qsiPnxJrH25ndokfjsEObz2AB59CANsls3vnwHId-mjhYmot1eeOuWtB2Z5uUgAA
.login.microsoftonline.com/	1969-12-31 23:59:59	Name: esctx Value: PAQABBwEAAAApTwJmzXqdR4BN2miheQMY3Z6FDs0UOIgAnkLMCdZw0fAm48JaE8YzXiEfwVQjENBkCVxC24cIEfnR4vYS7ry8Noab-cKJ0QPvgoUlTWBBN_27qHQnBCSmPBa8A0mtpLkj56_E5jHmM4bKGg3gCG4fMc96YMdPAF0Rt-j0H6T0_cplCabctV5c9Iikyl51kv8gAA
.login.microsoftonline.com/	1969-12-31 23:59:59	Name: esctx-Uy0I3e9q2lU Value: AQABCQEAAAApTwJmzXqdR4BN2miheQMYY1ZOx3PSSI3xM2bp2cybnR45wXbvDjT9GO8IMOlnKTGx5Onidl55d42VWBK17n_cIqAWLm5wjH7ZeOWmm3UKZoFBLNLhLwkUlUvW6t7kNZPKaCdtIA5XknodZsy58O2VXLXy8aasGUPTiIzx5dihSSAA
login.microsoftonline.com/	1970-01-20 23:10:08	Name: fpc Value: Aia7VFIzdH5AgzBg7NZIWGJJw3UFAQAAAHv1O94OAAAA
login.microsoftonline.com/	1969-12-31 23:59:59	Name: x-ms-gateway-slice Value: estsfd
login.microsoftonline.com/	1969-12-31 23:59:59	Name: stsservicecookie Value: estsfd

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msauth.net
aadcdn.msftauth.net
login.live.com
login.microsoftonline.com
wd103.myworkday.com
aadcdn.msauth.net
login.live.com
2603:1027:1:d8::9
2606:2800:233:1cb7:261b:1f9c:2074:3c
2620:1ec:bdf::42
64.69.24.26
1f8ceb44fe7cfcf7e71dbd5122210335ca3821d697a851d2900b95af7d92d69d
441bfa485fb0eb8ad2be7001209868b57c41769cae9512a774419f5882c093e6
8afa468ac07b612f01e16b96667b1f1f291caf01db80f28a1f7e6d207360b85b
c8cef105fcaf7cbf3f8682c861045505c24d41cf6686c20c1c03e14031a3db69
df2aa8537c1992c94846a0ffffaa9031d430d9d0210b9e396ec059aff62627e0
f75847b4b8fd3297b0bd484f42399194196f336929ee52ae89ea8c11b0290fe2

login.microsoftonline.com Open in urlscan Pro 2603:1027:1:d8::9 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

12 Requests

67 %HTTPS

75 %IPv6

5 Domains

5 Subdomains

5 IPs

2 Countries

90 kBTransfer

288 kBSize

14 Cookies

0 Outgoing links

Page URL History

Redirected requests

12 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

10 JavaScript Global Variables

14 Cookies

Security Headers

Indicators

login.microsoftonline.com Open in urlscan Pro
2603:1027:1:d8::9 Public Scan

Screenshot
Live screenshot

Full Image

12
Requests

67 %
HTTPS

75 %
IPv6

5
Domains

5
Subdomains

5
IPs

2
Countries

90 kB
Transfer

288 kB
Size

14
Cookies

12 HTTP transactions
0 data transactions