outlook.office365.com
Open in
urlscan Pro
2603:1026:c03:680f::2
Public Scan
Submitted URL: https://url.emailprotection.link/?bDi5dbp9C_Now1fC5oiMiH807SnfvsgertsK31H6DaP0RqeEokCRnNMEa1dufzd--7nbgb-Kjp1-3hS8XjBeS8iKdyqBMXF...
Effective URL: https://outlook.office365.com/Encryption/authenticationpage.aspx?st=OTP&ru=https%3a%2f%2foutlook.office365.com%2fEncryption%2f...
Submission: On July 16 via manual from US — Scanned from GB
Effective URL: https://outlook.office365.com/Encryption/authenticationpage.aspx?st=OTP&ru=https%3a%2f%2foutlook.office365.com%2fEncryption%2f...
Submission: On July 16 via manual from US — Scanned from GB
Summary
This website contacted 3 IPs
in 2 countries
across 3 domains to perform 12 HTTP transactions.
The main IP is 2603:1026:c03:680f::2, located in
Amsterdam, Netherlands and
belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US.
The main domain is outlook.office365.com.
The Cisco Umbrella rank of the primary domain is 35.
TLS certificate: Issued by DigiCert Cloud Services CA-1 on July 5th 2022. Valid for: a year.
This is the only time outlook.office365.com was scanned on urlscan.io!
TLS certificate: Issued by DigiCert Cloud Services CA-1 on July 5th 2022. Valid for: a year.
This is the only time outlook.office365.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 9 | 64.78.56.115 64.78.56.115 | 16406 (AS-INTERM...) (AS-INTERMEDIA) | |
| 2 4 | 2603:1026:c03... 2603:1026:c03:680f::2 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
| 1 | 152.199.19.160 152.199.19.160 | () () | |
| 12 | 3 |
9
64.78.56.115
(United States)
ASN16406 (AS-INTERMEDIA, US)
PTR: intermedia.net
ASN16406 (AS-INTERMEDIA, US)
PTR: intermedia.net
| url.emailprotection.link |
4
2603:1026:c03:680f::2
(Amsterdam, Netherlands)
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
| outlook.office365.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 9 |
emailprotection.link
url.emailprotection.link — Cisco Umbrella Rank: 59983 |
402 KB |
| 4 |
office365.com
2 redirects
outlook.office365.com — Cisco Umbrella Rank: 35 |
9 KB |
| 1 |
aspnetcdn.com
ajax.aspnetcdn.com |
43 KB |
| 12 | 3 |
| Domain | Requested by | |
|---|---|---|
| 9 | url.emailprotection.link |
url.emailprotection.link
|
| 4 | outlook.office365.com |
2 redirects
url.emailprotection.link
outlook.office365.com |
| 1 | ajax.aspnetcdn.com |
outlook.office365.com
|
| 12 | 3 |
This site contains no links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| *.emailprotection.link GeoTrust RSA CA 2018 |
2020-07-16 - 2022-08-15 |
2 years | crt.sh |
| outlook.com DigiCert Cloud Services CA-1 |
2022-07-05 - 2023-07-05 |
a year | crt.sh |
| *.vo.msecnd.net DigiCert SHA2 Secure Server CA |
2022-07-11 - 2023-07-11 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://outlook.office365.com/Encryption/authenticationpage.aspx?st=OTP&ru=https%3a%2f%2foutlook.office365.com%2fEncryption%2fdefault.aspx%3fitemID%3dE4E_M_30d4f382-1b3f-44fe-a285-ac3fc556d99d&e4e_sdata=pmEbppeflVFzglrWzVG7wFyJRokDUZlbpUkWlzfoWSg3FGxSY7Rh3tTZytt4nxcmQtCjIR1TzjlWSPQcrjoHARiW7DKPS6caTNu%2bVWy6ySYRzTSeWEAJBO9eb1%2fmNouwYIPwFqsriJcLD7fxNX1DsCT8sbt1553TockjhETFXilUyMUu8L5GbyW25SFwAp5lJpE0uXpp3O%2biM0yI8ddu3whHHO%2bmpa3T4Na0xbpZCKL2WGRmQ5BSSSge6RQ7XwePDvUKrTQ5MjlBUsX8b%2ff4wEv1eSql5SLzcHsViKBpSSkySmM5MYdVUYZBCiy2b48R7cqHN5v5SoCKQS9V0QM0yA%3d%3d
Frame ID: 368EFA16A890641C80A85789669AF8D2
Requests: 12 HTTP requests in this frame
Screenshot
Page URL History Show full URLs
- https://url.emailprotection.link/?bDi5dbp9C_Now1fC5oiMiH807SnfvsgertsK31H6DaP0RqeEokCRnNMEa1dufzd--7nbgb-Kjp1... Page URL
-
https://outlook.office365.com/Encryption/retrieve.ashx?recipientemailaddress=aerin%40tdandsadvisors.com&se...
HTTP 302
https://outlook.office365.com/Encryption/default.aspx?itemID=E4E_M_30d4f382-1b3f-44fe-a285-ac3fc556d99d HTTP 302
https://outlook.office365.com/Encryption/authenticationpage.aspx?st=OTP&ru=https%3a%2f%2foutlook.office365... Page URL
Detected technologies
Microsoft ASP.NET
(Web Frameworks)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- \.aspx?(?:$|\?)
jQuery
(JavaScript Libraries)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- jquery[.-]([\d.]*\d)[^/]*\.js
- jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
- https://url.emailprotection.link/?bDi5dbp9C_Now1fC5oiMiH807SnfvsgertsK31H6DaP0RqeEokCRnNMEa1dufzd--7nbgb-Kjp1-3hS8XjBeS8iKdyqBMXFe2Y3XIGxeJfXxpAYWpAZWjXbfZ783jA-DU77zBkjzPswuEpuX8vuWSNCrRxjSbtqqIV_EP2-yZ8JMDpziPQey41uJZ3gJ40wpUGWr_orvj36BBBNT02_YZvCwebi--UDdp6IDOKtzKjklRCwZ1QFiWcRuXPV0JYVeqNk-X1plx3g5QZff_ZySP8EQ0TQVREW71wk4Ek3NLmvAZ0c_wN89Xx7tLCx0YYXse72vMZvo88eFRhAI1s3qJ87UCL-xBaAuWGyolg-dfe3_8H6yXzOV8bdYtxDWV7VV85iBzBPJO3wHgyvE8rWN289ao0fhCOkQ07dwrnUe6gU9iUVJbcpFnYxObHkDLTytm72kPgHQK_-42mhQqCdLrzp4Iy3zhbIE5JhhH-Y6Rl1hpOxi8ESwOF1ujAm9LIa2TpAVBrjkkXFk-vYQZln1HjPHYtKVRj2Z88fpiSCqkuPJgCsRXpRkq6QXrEw4lXbF1NBDVWUDN--rLyX5HHM1gsBqdEOMD0YZU_YUFKq9KEyo3qPJlKNOGfCLFs9c32yVXhQWfl4_6Sx5N-9uKrwQf2SN8cbasl6q2MjWP6Ij8InROJXJbrj2ISsYN50U0QnNIebu35do9IWnoJCnnOPQ4-zbiN9cN6wBKxGLoVWtAZFjA0ouK_bByvBAObRprVEQlfpb_ol3-vp2EOQNUD_gY00G6CYdwR5xEbYEcuFKtY465118p2IOmGytEL2j0dxU-U9k8ck972S-aQVMPism7G9dTU6qYUtV9-diJ-deHORblnsf0lA-xpQNVszyQvYdVO_DK7xCQHnifyjloDTACIEzOQiOvWOthZwiANM7VhPWU2sSOYWGWIv5LFyPND5hHZbjNx9gfAgZ3EuwTsb_9cTeQz8zsy7DuqKXi86OWTFw_-j_uxT-Qzp5Qv-9Tnlab93tIyXleiQxPH6ZEjUjFaaraoK_O96q689HNygXtg4rnqcX5xXBpQ4MDsVrBo8gu2PxMMN49C5LaWvSUBE4axmd5_a5TaVJ9pcGSuroMT6d4Hkk6bnKaafJV5JzSukalgW56XLMbO5LUPpAXoEowgqv_-FnorIk-eth_hT3c4JU~ Page URL
-
https://outlook.office365.com/Encryption/retrieve.ashx?recipientemailaddress=aerin%40tdandsadvisors.com&senderemailaddress=callcenter%40llic.com&senderorganization=AwF9AAAAAnkAAAADAQAAAFMCch4%2fffdOkPfI35UUrH1PVT13c2ZncnAub25taWNyb3NvZnQuY29tLE9VPU1pY3Jvc29mdCBFeGNoYW5nZSBIb3N0ZWQgT3JnYW5pemF0aW9ucyxEQz1OQU1QUjIyQTAwNyxEQz1QUk9ELERDPU9VVExPT0ssREM9Q09N%2f09CfIiwv06Gp0PVSpwwhENOPUNvbmZpZ3VyYXRpb24sQ049d3NmZ3JwLm9ubWljcm9zb2Z0LmNvbSxDTj1Db25maWd1cmF0aW9uVW5pdHMsREM9TkFNUFIyMkEwMDcsREM9UFJPRCxEQz1PVVRMT09LLERDPUNPTQE%3d&messageid=%3c4b856ecd6d6d4972a71c9d63f2aad337%40westernsouthernlife.com%3e&cfmRecipient=SystemMailbox%7bD0E409A0-AF9B-4720-92FE-AAC869B0D201%7d%40wsfgrp.onmicrosoft.com&consumerEncryption=false&senderorgid=d9c291f0-5b8f-4d98-8138-0f2009a37da9&urldecoded=1&e4e_sdata=o%2blpDP3Gc8QX0tEycxpchnpdrRIpRWQxhP1TvvSrfNI5SoKJx0yXU48%2fUIAuJFhhjeIwVN%2fbKbADmtG2MMYZshRmXHeSmS4uT2hADGmmfRu%2bQp0yhKy%2fCb9opjhBXCFXjanEq89q8c%2fN8TMbx%2feGmwyBBMbBQPbQJ9LoM2prBXd1lIeBrGbIN210m0M5tDMQbwBDKiLynPTmNWFwMqXaP%2fhtdaIUma8w9LKIMQgBzxWnxWAGJlRbIfCqhouo6e1jOQmGJDAImI55FmIUOBTKBRIEHrlf3M0FSGMBDEkpUR8tI9dxfPrrOMRA5K8l4ybEVHZ9Ght75MnFZh9K8VWaMA%3d%3d
HTTP 302
https://outlook.office365.com/Encryption/default.aspx?itemID=E4E_M_30d4f382-1b3f-44fe-a285-ac3fc556d99d HTTP 302
https://outlook.office365.com/Encryption/authenticationpage.aspx?st=OTP&ru=https%3a%2f%2foutlook.office365.com%2fEncryption%2fdefault.aspx%3fitemID%3dE4E_M_30d4f382-1b3f-44fe-a285-ac3fc556d99d&e4e_sdata=pmEbppeflVFzglrWzVG7wFyJRokDUZlbpUkWlzfoWSg3FGxSY7Rh3tTZytt4nxcmQtCjIR1TzjlWSPQcrjoHARiW7DKPS6caTNu%2bVWy6ySYRzTSeWEAJBO9eb1%2fmNouwYIPwFqsriJcLD7fxNX1DsCT8sbt1553TockjhETFXilUyMUu8L5GbyW25SFwAp5lJpE0uXpp3O%2biM0yI8ddu3whHHO%2bmpa3T4Na0xbpZCKL2WGRmQ5BSSSge6RQ7XwePDvUKrTQ5MjlBUsX8b%2ff4wEv1eSql5SLzcHsViKBpSSkySmM5MYdVUYZBCiy2b48R7cqHN5v5SoCKQS9V0QM0yA%3d%3d Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
12 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H/1.1 |
/
url.emailprotection.link/ |
9 KB 6 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
new_style.css
url.emailprotection.link/new/css/ |
8 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
new_screenshot.js
url.emailprotection.link/new/js/ |
1 KB 956 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
tooltipster.css
url.emailprotection.link/new/css/ |
10 KB 3 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery-1.9.1.js
url.emailprotection.link/new/js/libs/ |
142 KB 47 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
jquery.tooltipster.min.js
url.emailprotection.link/new/js/libs/ |
17 KB 6 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
new_scanning.js
url.emailprotection.link/new/js/ |
947 B 735 B |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
scanning_70.gif
url.emailprotection.link/new/images/ |
30 KB 30 KB |
Image
image/gif |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
notosans-regular.ttf
url.emailprotection.link/new/fonts/ |
306 KB 306 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
Primary Request
authenticationpage.aspx
outlook.office365.com/Encryption/ Redirect Chain
|
7 KB 3 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
jquery-1.12.4.min.js
ajax.aspnetcdn.com/ajax/jQuery/ |
95 KB 43 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H/1.1 |
authentication.css
outlook.office365.com/Encryption/ |
3 KB 2 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
8 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation15 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| outlook.office365.com/ | Name: X-E4E-CorrelationId Value: 1bdb8ddf-46e4-4f01-bdea-2cabbfe74acd |
|
| outlook.office365.com/ | Name: X-OmeVersion Value: V2 |
|
| outlook.office365.com/ | Name: X-ConsumerEncryption Value: false |
|
| outlook.office365.com/ | Name: X-CfmRecipientAddress Value: SystemMailbox%7bD0E409A0-AF9B-4720-92FE-AAC869B0D201%7d%40wsfgrp.onmicrosoft.com |
|
| outlook.office365.com/ | Name: E4EAnchorMailbox Value: SystemMailbox{D0E409A0-AF9B-4720-92FE-AAC869B0D201}@wsfgrp.onmicrosoft.com |
|
| outlook.office365.com/ | Name: X-RecipientEmailAddress Value: aerin@tdandsadvisors.com |
|
| outlook.office365.com/ | Name: X-SenderEmailAddress Value: callcenter@llic.com |
|
| outlook.office365.com/ | Name: X-SenderOrganization Value: AwF9AAAAAnkAAAADAQAAAFMCch4/ffdOkPfI35UUrH1PVT13c2ZncnAub25taWNyb3NvZnQuY29tLE9VPU1pY3Jvc29mdCBFeGNoYW5nZSBIb3N0ZWQgT3JnYW5pemF0aW9ucyxEQz1OQU1QUjIyQTAwNyxEQz1QUk9ELERDPU9VVExPT0ssREM9Q09N/09CfIiwv06Gp0PVSpwwhENOPUNvbmZpZ3VyYXRpb24sQ049d3NmZ3JwLm9ubWljcm9zb2Z0LmNvbSxDTj1Db25maWd1cmF0aW9uVW5pdHMsREM9TkFNUFIyMkEwMDcsREM9UFJPRCxEQz1PVVRMT09LLERDPUNPTQE= |
|
| outlook.office365.com/ | Name: X-MessageId Value: %3c4b856ecd6d6d4972a71c9d63f2aad337%40westernsouthernlife.com%3e |
|
| outlook.office365.com/ | Name: X-StoreObjectId Value: |
|
| outlook.office365.com/ | Name: X-RecipientPrimarySmtp Value: |
|
| outlook.office365.com/ | Name: E4E_M_30d4f382-1b3f-44fe-a285-ac3fc556d99d Value: MWHPR22MB0464 |
|
| outlook.office365.com/ | Name: X-OTPItemId Value: E4E_M_30d4f382-1b3f-44fe-a285-ac3fc556d99d |
|
| outlook.office365.com/ | Name: X-SenderExternalOrganizationId Value: d9c291f0-5b8f-4d98-8138-0f2009a37da9 |
|
| outlook.office365.com/ | Name: X-AnonResource Value: true |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
ajax.aspnetcdn.com
outlook.office365.com
url.emailprotection.link
152.199.19.160
2603:1026:c03:680f::2
64.78.56.115
04ba8897950ca15879762ccae3323b8f0952259461c13c3e90d6d973b213133c
08a857eeec64d9c6b3ece76762eed837929e0e6f8a29d1315a04d38c3053b4b6
408aaf12b8d2f8aabfdd58205e6deae6d62cadc789f15e7d45e9b566e6b253d3
668b046d12db350ccba6728890476b3efee53b2f42dbb84743e5e9f1ae0cc404
6938c77be180b60f67086ac99a2692f9af393675279711f0dad73d541b675964
8be2e88f4beed8e6d7c70115a1b71fa50c5da67abbc6e7f393a4960613079069
b12ac9e2fa728424155567aa27e3d36d764b33f07d663e496dc178974048a6f8
b39e5e0d297a718b77aa0802cdec5dd67e7769f29ee6405f6f26ad25201e3bec
c8cff31fcae0edc0e4ffd3628f36361dfc24d71cc5b9793e5ffad8e76e6f182b
c92b1aece38d5bae7bfb72e26a5070d5663d40774c7aceb973631025d6e6e592
ca8178a737bdd4e6d2394e6c5609d1ca001254667458bb9cd1130bacea58cb86
e337f687babe708a9f8e6642d7793ee3ed5eb4696cf11e28dd0682a858a591ea