portal.micosoftnonline.com Open in urlscan Pro
167.71.170.211  Malicious Activity! Public Scan

Submitted URL: https://click.email.miocrosoftonline.com/?mfa=bmdpbGxAc3RhbmZvcmRoZWFsdGhjYXJlLm9yZw==
Effective URL: https://portal.micosoftnonline.com/changePasswd/?mfa=bmdpbGxAc3RhbmZvcmRoZWFsdGhjYXJlLm9yZw==&redirect=https://login.microsoftonlin...
Submission: On September 24 via manual from US

Summary

This website contacted 3 IPs in 2 countries across 4 domains to perform 16 HTTP transactions. The main IP is 167.71.170.211, located in Clifton, United States and belongs to DIGITALOCEAN-ASN - DigitalOcean, LLC, US. The main domain is portal.micosoftnonline.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on September 20th 2019. Valid for: a month.
This is the only time portal.micosoftnonline.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

IP Address AS Autonomous System
3 4 167.71.170.211 14061 (DIGITALOC...)
14 2620:1ec:bdf::10 8068 (MICROSOFT...)
1 2603:1026:100... 8075 (MICROSOFT...)
16 3
Domain Requested by
14 aadcdn.msauth.net portal.micosoftnonline.com
aadcdn.msauth.net
3 portal.micosoftnonline.com 2 redirects
1 outlook.office365.com aadcdn.msauth.net
1 click.email.miocrosoftonline.com 1 redirects
16 4

This site contains links to these domains. Also see Links.

Domain
www.microsoft.com
privacy.microsoft.com
Subject Issuer Validity Valid
portal.micosoftnonline.com
Sectigo RSA Domain Validation Secure Server CA
2019-09-20 -
2019-10-20
a month crt.sh
aadcdn.msauth.net
Microsoft IT TLS CA 4
2018-11-07 -
2020-11-07
2 years crt.sh
outlook.com
DigiCert Cloud Services CA-1
2018-11-15 -
2020-11-15
2 years crt.sh

This page contains 2 frames:

Primary Page: https://portal.micosoftnonline.com/changePasswd/?mfa=bmdpbGxAc3RhbmZvcmRoZWFsdGhjYXJlLm9yZw==&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
Frame ID: D0DB43F1716AA227E6CF81931C74C33B
Requests: 15 HTTP requests in this frame

Frame: https://outlook.office365.com/owa/prefetch.aspx
Frame ID: E3D17B1AB4207D032240F4DD0BEA7BC1
Requests: 1 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://click.email.miocrosoftonline.com/?mfa=bmdpbGxAc3RhbmZvcmRoZWFsdGhjYXJlLm9yZw== HTTP 302
    https://portal.micosoftnonline.com/?mfa=bmdpbGxAc3RhbmZvcmRoZWFsdGhjYXJlLm9yZw== HTTP 302
    https://portal.micosoftnonline.com/changePasswd?mfa=bmdpbGxAc3RhbmZvcmRoZWFsdGhjYXJlLm9yZw==&redirect=https://l... HTTP 301
    https://portal.micosoftnonline.com/changePasswd/?mfa=bmdpbGxAc3RhbmZvcmRoZWFsdGhjYXJlLm9yZw==&redirect=https://... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /CentOS/i

Overall confidence: 100%
Detected patterns
  • headers server /OpenSSL(?:\/([\d.]+[a-z]?))?/i

Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^\/-])|(?:^|\b)HTTPD)/i

Page Statistics

16
Requests

100 %
HTTPS

67 %
IPv6

4
Domains

4
Subdomains

3
IPs

2
Countries

505 kB
Transfer

1040 kB
Size

3
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://click.email.miocrosoftonline.com/?mfa=bmdpbGxAc3RhbmZvcmRoZWFsdGhjYXJlLm9yZw== HTTP 302
    https://portal.micosoftnonline.com/?mfa=bmdpbGxAc3RhbmZvcmRoZWFsdGhjYXJlLm9yZw== HTTP 302
    https://portal.micosoftnonline.com/changePasswd?mfa=bmdpbGxAc3RhbmZvcmRoZWFsdGhjYXJlLm9yZw==&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri= HTTP 301
    https://portal.micosoftnonline.com/changePasswd/?mfa=bmdpbGxAc3RhbmZvcmRoZWFsdGhjYXJlLm9yZw==&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri= Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

16 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
portal.micosoftnonline.com/changePasswd/
Redirect Chain
  • https://click.email.miocrosoftonline.com/?mfa=bmdpbGxAc3RhbmZvcmRoZWFsdGhjYXJlLm9yZw==
  • https://portal.micosoftnonline.com/?mfa=bmdpbGxAc3RhbmZvcmRoZWFsdGhjYXJlLm9yZw==
  • https://portal.micosoftnonline.com/changePasswd?mfa=bmdpbGxAc3RhbmZvcmRoZWFsdGhjYXJlLm9yZw==&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000...
  • https://portal.micosoftnonline.com/changePasswd/?mfa=bmdpbGxAc3RhbmZvcmRoZWFsdGhjYXJlLm9yZw==&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-00...
31 KB
31 KB
Document
General
Full URL
https://portal.micosoftnonline.com/changePasswd/?mfa=bmdpbGxAc3RhbmZvcmRoZWFsdGhjYXJlLm9yZw==&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
167.71.170.211 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN - DigitalOcean, LLC, US),
Reverse DNS
Software
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips /
Resource Hash
73db0a4976f802656912f49e7f39f61cbdf9ef6c3b49d29b76bbfcdb945ae356

Request headers

Host
portal.micosoftnonline.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
none
Accept-Encoding
gzip, deflate, br
Cookie
PHPSESSID=4b2d4708995abec236db118ab6f177eb
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1

Response headers

Date
Tue, 24 Sep 2019 20:11:29 GMT
Server
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips
Expires
Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control
no-store, no-cache, must-revalidate
Pragma
no-cache
Keep-Alive
timeout=5, max=98
Connection
Keep-Alive
Transfer-Encoding
chunked
Content-Type
text/html;charset=utf-8

Redirect headers

Date
Tue, 24 Sep 2019 20:11:29 GMT
Server
Apache/2.4.6 (CentOS) OpenSSL/1.0.2k-fips
Location
https://portal.micosoftnonline.com/changePasswd/?mfa=bmdpbGxAc3RhbmZvcmRoZWFsdGhjYXJlLm9yZw==&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
Content-Length
437
Keep-Alive
timeout=5, max=99
Connection
Keep-Alive
Content-Type
text/html; charset=iso-8859-1
converged.v2.login.min_mbqre5pw01euigudkiymsa2.css
aadcdn.msauth.net/ests/2.1/content/cdnbundles/
99 KB
19 KB
Stylesheet
General
Full URL
https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_mbqre5pw01euigudkiymsa2.css
Requested by
Host: portal.micosoftnonline.com
URL: https://portal.micosoftnonline.com/changePasswd/?mfa=bmdpbGxAc3RhbmZvcmRoZWFsdGhjYXJlLm9yZw==&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:bdf::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
ea073d6416a1c80db854b3d255c4984331bb66512a8357a48c1a1f61a0c5258a

Request headers

Sec-Fetch-Mode
cors
Referer
https://portal.micosoftnonline.com/changePasswd/?mfa=bmdpbGxAc3RhbmZvcmRoZWFsdGhjYXJlLm9yZw==&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
Origin
https://portal.micosoftnonline.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 24 Sep 2019 20:11:29 GMT
content-encoding
gzip
x-azure-ref-originshield
0nqeEXQAAAABrj6f9cSZzSZd+NS5cEOcMQU1TRURHRTA2MjIAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-md5
xJKtSYbttmVAbDLC1zk6Bw==
x-cache
TCP_HIT
status
200
content-length
18662
x-ms-lease-status
unlocked
last-modified
Wed, 21 Aug 2019 20:49:36 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
0x8D72679143905C7
x-azure-ref
0cniKXQAAAABqe+158ZANSYcgMR47J1U8VklFRURHRTAyMjEAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
666b2b67-601e-0041-4395-6fcf60000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
ux.converged.login.pcore.min_hx0_-wwgs2ojfxkzusmiqa2.js
aadcdn.msauth.net/ests/2.1/content/cdnbundles/
583 KB
150 KB
Script
General
Full URL
https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/ux.converged.login.pcore.min_hx0_-wwgs2ojfxkzusmiqa2.js
Requested by
Host: portal.micosoftnonline.com
URL: https://portal.micosoftnonline.com/changePasswd/?mfa=bmdpbGxAc3RhbmZvcmRoZWFsdGhjYXJlLm9yZw==&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:bdf::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
032bc87c655bcdd8cc7424bcf4e36dad4b1f25a9f0f3f38c0c3ca085420e5212

Request headers

Sec-Fetch-Mode
cors
Referer
https://portal.micosoftnonline.com/changePasswd/?mfa=bmdpbGxAc3RhbmZvcmRoZWFsdGhjYXJlLm9yZw==&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
Origin
https://portal.micosoftnonline.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 24 Sep 2019 20:11:29 GMT
content-encoding
gzip
x-azure-ref-originshield
0JcGEXQAAAADLoK479IChRIlSQTe+TwNSQU1TRURHRTA2MTgAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-md5
cr1NDHXrICkvO3Oth020zg==
x-cache
TCP_HIT
status
200
content-length
153658
x-ms-lease-status
unlocked
last-modified
Thu, 05 Sep 2019 17:01:30 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
0x8D73222B2EB2F62
x-azure-ref
0cniKXQAAAABRfVl69jRVT6c4jVPv/2SDVklFRURHRTAyMjEAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
9fec0b80-901e-0056-2482-6fae4c000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
ux.converged.login.strings-en.min_o0no6jtkpeomrosmp5svcq2.js
aadcdn.msauth.net/ests/2.1/content/cdnbundles/
32 KB
10 KB
Script
General
Full URL
https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_o0no6jtkpeomrosmp5svcq2.js
Requested by
Host: portal.micosoftnonline.com
URL: https://portal.micosoftnonline.com/changePasswd/?mfa=bmdpbGxAc3RhbmZvcmRoZWFsdGhjYXJlLm9yZw==&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:bdf::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
4dca0651f566540f06dada2c1cec4b5722fa56acc551ddfda0369dfdbbf967a1

Request headers

Sec-Fetch-Mode
cors
Referer
https://portal.micosoftnonline.com/changePasswd/?mfa=bmdpbGxAc3RhbmZvcmRoZWFsdGhjYXJlLm9yZw==&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
Origin
https://portal.micosoftnonline.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 24 Sep 2019 20:11:29 GMT
content-encoding
gzip
x-azure-ref-originshield
04J2EXQAAAADBuCvUxTUQSoxMGoozkswdQU1TRURHRTA2MTQAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-md5
kw1wVU63MhDWS9ecPll6Lg==
x-cache
TCP_HIT
status
200
content-length
10408
x-ms-lease-status
unlocked
last-modified
Thu, 05 Sep 2019 17:01:33 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
0x8D73222B49D68BB
x-azure-ref
0cniKXQAAAAAOz4KCkTIES5tdaMgKvq9tVklFRURHRTAyMjEAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
095beb95-e01e-0021-3293-6f8d42000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
Cookie set prefetch.aspx
outlook.office365.com/owa/ Frame E3D1
0
0
Document
General
Full URL
https://outlook.office365.com/owa/prefetch.aspx
Requested by
Host: aadcdn.msauth.net
URL: https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/ux.converged.login.pcore.min_hx0_-wwgs2ojfxkzusmiqa2.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2603:1026:100:17::2 Paris, France, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Host
outlook.office365.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Sec-Fetch-Site
cross-site
Referer
https://portal.micosoftnonline.com/changePasswd/?mfa=bmdpbGxAc3RhbmZvcmRoZWFsdGhjYXJlLm9yZw==&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
Accept-Encoding
gzip, deflate, br
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Mode
nested-navigate
Referer
https://portal.micosoftnonline.com/changePasswd/?mfa=bmdpbGxAc3RhbmZvcmRoZWFsdGhjYXJlLm9yZw==&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=

Response headers

Cache-Control
private, no-store
Content-Length
1240
Content-Type
text/html; charset=utf-8
Content-Encoding
gzip
Vary
Accept-Encoding
Server
Microsoft-IIS/10.0
request-id
054919fa-c493-46d5-aa3d-87f60cb932ab
X-CalculatedFETarget
MR2P264CU002.internal.outlook.com
X-BackEndHttpStatus
200 200
Set-Cookie
ClientId=874B97EA419048BEB7602543A03D8493; expires=Thu, 24-Sep-2020 20:11:30 GMT; path=/; secure ClientId=874B97EA419048BEB7602543A03D8493; expires=Thu, 24-Sep-2020 20:11:30 GMT; path=/; secure OIDC=1; expires=Tue, 24-Mar-2020 20:11:30 GMT; path=/; secure; HttpOnly OWAPF=v:16.3278.2.2710622&l:mouse; path=/
X-FEProxyInfo
MR2P264CA0037.FRAP264.PROD.OUTLOOK.COM
X-CalculatedBETarget
MR2P264MB0641.FRAP264.PROD.OUTLOOK.COM
X-RUM-Validated
1
X-Content-Type-Options
nosniff
X-BeSku
WCS5
X-OWA-Version
15.20.2284.26
X-OWA-DiagnosticsInfo
1;0;0
X-BackEnd-Begin
2019-09-24T20:11:30.243
X-BackEnd-End
2019-09-24T20:11:30.245
X-DiagInfo
MR2P264MB0641
X-BEServer
MR2P264MB0641
X-UA-Compatible
IE=EmulateIE7
Strict-Transport-Security
max-age=31536000; includeSubDomains max-age=31536000; includeSubDomains
X-Proxy-BackendServerStatus
200
X-FEServer
MR2P264CA0037 PR0P264CA0151
Date
Tue, 24 Sep 2019 20:11:29 GMT
microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
aadcdn.msauth.net/ests/2.1/content/images/
4 KB
2 KB
Image
General
Full URL
https://aadcdn.msauth.net/ests/2.1/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:bdf::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://portal.micosoftnonline.com/changePasswd/?mfa=bmdpbGxAc3RhbmZvcmRoZWFsdGhjYXJlLm9yZw==&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 24 Sep 2019 20:11:29 GMT
content-encoding
gzip
x-azure-ref-originshield
0wKeEXQAAAABObGNOqJVOR4Zcfy4HHKKeQU1TRURHRTA2MTUAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-md5
nzaLxFgP7ZB3dfMcaybWzw==
x-cache
TCP_HIT
status
200
content-length
1435
x-ms-lease-status
unlocked
last-modified
Fri, 02 Nov 2018 20:25:31 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
0x8D64101560D5E58
x-azure-ref
0cniKXQAAAAAiDpduQyDOR59Pd9l/GdyiVklFRURHRTAyMTUAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
bee83f06-701e-0048-428e-6fbc73000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=604800
x-ms-version
2009-09-19
ellipsis_white_5ac590ee72bfe06a7cecfd75b588ad73.svg
aadcdn.msauth.net/ests/2.1/content/images/
915 B
557 B
Image
General
Full URL
https://aadcdn.msauth.net/ests/2.1/content/images/ellipsis_white_5ac590ee72bfe06a7cecfd75b588ad73.svg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:bdf::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
6075736ea9c281d69c4a3d78ff97bb61b9416a5809919babe5a0c5596f99aaea

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://portal.micosoftnonline.com/changePasswd/?mfa=bmdpbGxAc3RhbmZvcmRoZWFsdGhjYXJlLm9yZw==&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 24 Sep 2019 20:11:29 GMT
content-encoding
gzip
x-azure-ref-originshield
04q2EXQAAAABZ4u2lxzAvQLDC0lN4lnwqQU1TRURHRTA2MTYAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-md5
HMwsHhNXdtrfirQDkzcqMA==
x-cache
TCP_HIT
status
200
content-length
263
x-ms-lease-status
unlocked
last-modified
Fri, 02 Nov 2018 20:25:24 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
0x8D64101521A1ED5
x-azure-ref
0cniKXQAAAAD/MS1UMYRvToGniNaA+5XrVklFRURHRTAyMTUAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
167b8b5a-d01e-0052-5e84-6f0244000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=604800
x-ms-version
2009-09-19
ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c.svg
aadcdn.msauth.net/ests/2.1/content/images/
915 B
928 B
Image
General
Full URL
https://aadcdn.msauth.net/ests/2.1/content/images/ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c.svg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:bdf::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
16c3f6531d0fa5b4d16e82abf066233b2a9f284c068c663699313c09f5e8d6e6

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://portal.micosoftnonline.com/changePasswd/?mfa=bmdpbGxAc3RhbmZvcmRoZWFsdGhjYXJlLm9yZw==&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 24 Sep 2019 20:11:29 GMT
content-encoding
gzip
x-azure-ref-originshield
0ir+EXQAAAAAaroxk0ptwSaKJl2QGUakYQU1TRURHRTA2MDcAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-md5
/a3y/mpA+HRaVAiPACrsog==
x-cache
TCP_HIT
status
200
content-length
263
x-ms-lease-status
unlocked
last-modified
Fri, 02 Nov 2018 20:25:23 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
0x8D641015168A4FB
x-azure-ref
0cniKXQAAAACy/DhDDUC6QJ83fP8dJ6OIVklFRURHRTAyMTUAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
36b769cf-801e-0037-1299-6fc76c000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=604800
x-ms-version
2009-09-19
33-small_138bcee624fa04ef9b75e86211a9fe0d.jpg
aadcdn.msauth.net/ests/2.1/content/images/appbackgrounds/
3 KB
3 KB
Image
General
Full URL
https://aadcdn.msauth.net/ests/2.1/content/images/appbackgrounds/33-small_138bcee624fa04ef9b75e86211a9fe0d.jpg
Requested by
Host: aadcdn.msauth.net
URL: https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/ux.converged.login.pcore.min_hx0_-wwgs2ojfxkzusmiqa2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:bdf::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
f89e908280791803bbf1f33b596ff4a2179b355a8e15ad02ebaa2b1da11127ea

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://portal.micosoftnonline.com/changePasswd/?mfa=bmdpbGxAc3RhbmZvcmRoZWFsdGhjYXJlLm9yZw==&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 24 Sep 2019 20:11:29 GMT
x-azure-ref-originshield
0k6OEXQAAAABuaPGA+ijcRol2owkzYakiQU1TRURHRTA2MDYAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-md5
E4vO5iT6BO+bdehiEan+DQ==
x-cache
TCP_HIT
status
200
content-length
3006
x-ms-lease-status
unlocked
last-modified
Wed, 13 Mar 2019 20:50:28 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
0x8D6A7F58641DEFF
x-azure-ref
0cniKXQAAAACVvucQMA39RKbBfxf933zwVklFRURHRTAyMTUAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-type
image/jpeg
access-control-allow-origin
*
x-ms-request-id
6eacf4af-701e-0020-5087-6fa640000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
33_a5dbd4393ff6a725c7e62b61df7e72f0.jpg
aadcdn.msauth.net/ests/2.1/content/images/appbackgrounds/
277 KB
277 KB
Image
General
Full URL
https://aadcdn.msauth.net/ests/2.1/content/images/appbackgrounds/33_a5dbd4393ff6a725c7e62b61df7e72f0.jpg
Requested by
Host: aadcdn.msauth.net
URL: https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/ux.converged.login.pcore.min_hx0_-wwgs2ojfxkzusmiqa2.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:bdf::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
211a907de2da0ff4a0e90917ac8054e2f35c351180977550c26e51b4909f2beb

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://portal.micosoftnonline.com/changePasswd/?mfa=bmdpbGxAc3RhbmZvcmRoZWFsdGhjYXJlLm9yZw==&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 24 Sep 2019 20:11:29 GMT
x-azure-ref-originshield
0p5GEXQAAAAAUYO2dPMUNTI7I4hwEF/C6QU1TRURHRTA1MjEAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-md5
pdvUOT/2pyXH5ith335y8A==
x-cache
TCP_HIT
status
200
content-length
283351
x-ms-lease-status
unlocked
last-modified
Wed, 13 Mar 2019 20:50:28 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
0x8D6A7F5866686F7
x-azure-ref
0cniKXQAAAACuNIg1YCykSIxqNZqriwPiVklFRURHRTAyMTUAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-type
image/jpeg
access-control-allow-origin
*
x-ms-request-id
3f0dbb60-f01e-0014-788c-6f2b59000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
37_533e293f0c8947ada653b47c00e394e2.png
aadcdn.msauth.net/ests/2.1/content/images/applogos/
2 KB
2 KB
Image
General
Full URL
https://aadcdn.msauth.net/ests/2.1/content/images/applogos/37_533e293f0c8947ada653b47c00e394e2.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:bdf::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
b5d587f6c48a9b22bbe97150249e0c0655ac1780bd273431480a22f8a5bfef6c

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://portal.micosoftnonline.com/changePasswd/?mfa=bmdpbGxAc3RhbmZvcmRoZWFsdGhjYXJlLm9yZw==&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 24 Sep 2019 20:11:29 GMT
x-azure-ref-originshield
05J2EXQAAAADIWP03UmrZR5DYpeDhjBCxQU1TRURHRTA1MTkAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-md5
Uz4pPwyJR62mU7R8AOOU4g==
x-cache
TCP_HIT
status
200
content-length
1750
x-ms-lease-status
unlocked
last-modified
Wed, 13 Mar 2019 20:50:51 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
0x8D6A7F594080DCC
x-azure-ref
0cniKXQAAAAC1vi2qJxa3RpigspQhxcjjVklFRURHRTAyMTUAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-type
image/png
access-control-allow-origin
*
x-ms-request-id
53a8e09b-c01e-0033-2c81-6f6b64000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
picker_account_aad_9de70d1c5191d1852a0d5aac28b44a6c.svg
aadcdn.msauth.net/ests/2.1/content/images/
756 B
865 B
Image
General
Full URL
https://aadcdn.msauth.net/ests/2.1/content/images/picker_account_aad_9de70d1c5191d1852a0d5aac28b44a6c.svg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:bdf::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
5d3357bd875b7335ace42e8ee3a64578e4253bed1a4e279109de403eedae3a69

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://portal.micosoftnonline.com/changePasswd/?mfa=bmdpbGxAc3RhbmZvcmRoZWFsdGhjYXJlLm9yZw==&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 24 Sep 2019 20:11:29 GMT
content-encoding
gzip
x-azure-ref-originshield
0T5iEXQAAAAD8pu8KOxijRozOuqcM6+8hQU1TRURHRTA2MjAAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-md5
Sm6wIsHj8wthIZkm/aQWhA==
x-cache
TCP_HIT
status
200
content-length
394
x-ms-lease-status
unlocked
last-modified
Fri, 02 Nov 2018 20:25:36 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
0x8D64101593D933D
x-azure-ref
0cniKXQAAAADz6WGezweYSZ9z86/sZFxeVklFRURHRTAyMTUAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
86fe87af-401e-007f-4490-6f4c6c000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=604800
x-ms-version
2009-09-19
picker_more_7568a43cf440757c55d2e7f51557ae1f.svg
aadcdn.msauth.net/ests/2.1/content/images/
899 B
557 B
Image
General
Full URL
https://aadcdn.msauth.net/ests/2.1/content/images/picker_more_7568a43cf440757c55d2e7f51557ae1f.svg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:bdf::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
b7fcd37eaafe3f08647ed072d5289eadfff6c660a26cdef31532b3fcfb4a0bb2

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://portal.micosoftnonline.com/changePasswd/?mfa=bmdpbGxAc3RhbmZvcmRoZWFsdGhjYXJlLm9yZw==&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 24 Sep 2019 20:11:29 GMT
content-encoding
gzip
x-azure-ref-originshield
0EK6EXQAAAACKXKg2EXSES7m9NGlU1bZHQU1TRURHRTA1MjEAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-md5
K28EA/F25txr6jQahXym+g==
x-cache
TCP_HIT
status
200
content-length
257
x-ms-lease-status
unlocked
last-modified
Fri, 02 Nov 2018 20:25:40 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
0x8D641015B4AAC42
x-azure-ref
0cniKXQAAAACFV2c6BYLLRI3+TGPvLxViVklFRURHRTAyMTUAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
31ac9d8e-001e-007b-7698-6fe064000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=604800
x-ms-version
2009-09-19
marching_ants_white_166de53471265253ab3a456defe6da23.gif
aadcdn.msauth.net/ests/2.1/content/images/
3 KB
3 KB
Image
General
Full URL
https://aadcdn.msauth.net/ests/2.1/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:bdf::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
a46201581a7c7c667fd42787cd1e9adf2f6bf809efb7596e61a03e8dba9ada13

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://portal.micosoftnonline.com/changePasswd/?mfa=bmdpbGxAc3RhbmZvcmRoZWFsdGhjYXJlLm9yZw==&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 24 Sep 2019 20:11:29 GMT
x-azure-ref-originshield
0e6OEXQAAAADOiyTqVAorSpl4rUH4CiFMQU1TRURHRTA2MTMAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-md5
Fm3lNHEmUlOrOkVt7+baIw==
x-cache
TCP_HIT
status
200
content-length
2672
x-ms-lease-status
unlocked
last-modified
Fri, 02 Nov 2018 20:25:29 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
0x8D6410154F5B6A5
x-azure-ref
0cniKXQAAAACSzRykf/K2RpuMFZE+1Ga0VklFRURHRTAyMTUAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-type
image/gif
access-control-allow-origin
*
x-ms-request-id
ebadfcef-901e-003e-8089-6fb47f000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=604800
x-ms-version
2009-09-19
marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif
aadcdn.msauth.net/ests/2.1/content/images/
4 KB
4 KB
Image
General
Full URL
https://aadcdn.msauth.net/ests/2.1/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:bdf::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
8737d721808655f37b333f08a90185699e7e8b9bdaaa15cdb63c8448b426f95d

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://portal.micosoftnonline.com/changePasswd/?mfa=bmdpbGxAc3RhbmZvcmRoZWFsdGhjYXJlLm9yZw==&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 24 Sep 2019 20:11:29 GMT
x-azure-ref-originshield
06p6EXQAAAAD3mO5Phz9nRa0cJ7mVhfvOQU1TRURHRTA2MDkAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-md5
tUCo5RgDcZLjLE/li/Lbqw==
x-cache
TCP_HIT
status
200
content-length
3620
x-ms-lease-status
unlocked
last-modified
Fri, 02 Nov 2018 20:25:29 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
0x8D6410154B877AA
x-azure-ref
0cniKXQAAAADXepCSFpUDTIUVOW4z3yQaVklFRURHRTAyMTUAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-type
image/gif
access-control-allow-origin
*
x-ms-request-id
7694c5b9-f01e-0050-018f-6f5440000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=604800
x-ms-version
2009-09-19
picker_account_add_56e73414003cdb676008ff7857343074.svg
aadcdn.msauth.net/ests/2.1/content/images/
222 B
483 B
Image
General
Full URL
https://aadcdn.msauth.net/ests/2.1/content/images/picker_account_add_56e73414003cdb676008ff7857343074.svg
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:1ec:bdf::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
749f85621d92a5b31b2a377a8c385a36d48a83327dad9a8a8da93cd831b8c9a2

Request headers

Sec-Fetch-Mode
no-cors
Referer
https://portal.micosoftnonline.com/changePasswd/?mfa=bmdpbGxAc3RhbmZvcmRoZWFsdGhjYXJlLm9yZw==&redirect=https://login.microsoftonline.com/common/oauth2/authorize?client_id=00000000-0000-ffff-1111-000000000000&redirect_uri=
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 24 Sep 2019 20:11:29 GMT
content-encoding
gzip
x-azure-ref-originshield
0HsmEXQAAAAAvrXQS+zIFQ7OPrelPe+GgQU1TRURHRTA1MDkAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-md5
ykuOnMaTo0vw2Gx/ZceiPg==
x-cache
TCP_HIT
status
200
content-length
184
x-ms-lease-status
unlocked
last-modified
Fri, 02 Nov 2018 20:25:37 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
0x8D6410159A239F1
x-azure-ref
0cniKXQAAAACO/ApJNR54R6MLcTgae+HIVklFRURHRTAyMTUAMzlhMTJmN2UtODk5Zi00NmNmLWE2ZDAtMjRiYmJhMjdkOTU2
content-type
image/svg+xml
access-control-allow-origin
*
x-ms-request-id
b1ff5c07-a01e-005d-4b86-6f8b5b000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=604800
x-ms-version
2009-09-19

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

19 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onformdata object| onpointerrawupdate object| $Config object| $Debug object| $Do function| $Loader object| $WebWatson function| GetString function| GetErrorString function| GetUrl object| $B object| ServerData function| webpackJsonp object| ko object| PROOF object| StringRepository boolean| __ConvergedLogin_PCore boolean| __ object| mydate

3 Cookies

Domain/Path Name / Value
portal.micosoftnonline.com/ Name: localdate
Value: Tue Sep 24 2019 22:11:30 GMT+0200 (Central European Summer Time)
portal.micosoftnonline.com/ Name: PHPSESSID
Value: 4b2d4708995abec236db118ab6f177eb
portal.micosoftnonline.com/changePasswd Name: CkTst
Value: G1569355890096

1 Console Messages

Source Level URL
Text
console-api info URL: https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/ux.converged.login.pcore.min_hx0_-wwgs2ojfxkzusmiqa2.js(Line 23)
Message:
BSSO Telemetry: {"result":"Error","error":"bssoNotSupported","type":"TBAuthTelemetry","data":{"BSSO.info":"not-supported"},"traces":["BrowserSSO Initialized","window.navigator.msLaunchUri is not available for _pullBrowserSsoCookie"]}