urlscan.io logo urlscan.io
SecurityTrails logo

login.microsoftonline.com Open in urlscan Pro
2603:1027:1:d8::7  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://acrobatsign.replit.app/wp-xml.php?url=https://wen.foundation/alQ3Ex-d5glQ3Ennl-QdukQ3E-Q3EnQ3Ergy-d58Kvo-y5
Effective URL: https://login.microsoftonline.com/jsdisabled
Submission: On February 04 via manual from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 3 IPs in 3 countries across 4 domains to perform 4 HTTP transactions. The main IP is 2603:1027:1:d8::7, located in Dublin, Ireland and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is login.microsoftonline.com. The Cisco Umbrella rank of the primary domain is 11.
TLS certificate: Issued by DigiCert SHA2 Secure Server CA on November 28th 2023. Valid for: a year.
This is the only time login.microsoftonline.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 34.117.33.233 396982 (GOOGLE-CL...)
1 2 109.61.95.11 60068 (CDN77 _)
1 2603:1027:1:d... 8075 (MICROSOFT...)
2 2620:1ec:bdf::60 8075 (MICROSOFT...)
4 3
Apex Domain
Subdomains		 Transfer
2 msauth.net
aadcdn.msauth.net — Cisco Umbrella Rank: 921
22 KB
2 winfieldcoc.com
adobesign.winfieldcoc.com
89 KB
1 microsoftonline.com
login.microsoftonline.com — Cisco Umbrella Rank: 11
3 KB
1 replit.app
acrobatsign.replit.app
344 B
4 4
Domain Requested by
2 aadcdn.msauth.net login.microsoftonline.com
2 adobesign.winfieldcoc.com 1 redirects
1 login.microsoftonline.com
1 acrobatsign.replit.app 1 redirects
4 4

This site contains links to these domains. Also see Links.

Domain
www.microsoft.com
privacy.microsoft.com
Subject Issuer Validity Valid
winfieldcoc.com
R3		 2024-02-01 -
2024-05-01		 3 months crt.sh
stamp2.login.microsoftonline.com
DigiCert SHA2 Secure Server CA		 2023-11-28 -
2024-11-28		 a year crt.sh
aadcdn.msauth.net
DigiCert SHA2 Secure Server CA		 2024-01-29 -
2025-01-29		 a year crt.sh

This page contains 1 frames:

Primary Page: https://login.microsoftonline.com/jsdisabled
Frame ID: D261E71DE2901C919F6E0216B2DE8BF3
Requests: 4 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Es ist ein Problem aufgetreten.

Page URL History Show full URLs

  1. https://acrobatsign.replit.app/wp-xml.php?url=https://wen.foundation/alQ3Ex-d5glQ3Ennl-QdukQ3E-Q3EnQ3Ergy-d... HTTP 302
    https://adobesign.winfieldcoc.com/?organisation=duke-energy.com&amp=YWxleC5nbGVubkBkdWtlLWVuZXJneS5jb20= Page URL
  2. https://adobesign.winfieldcoc.com/?organisation=duke-energy.com&amp=YWxleC5nbGVubkBkdWtlLWVuZXJneS5jb20= HTTP 302
    https://login.microsoftonline.com/jsdisabled Page URL

Page Statistics

4
Requests

100 %
HTTPS

50 %
IPv6

4
Domains

4
Subdomains

3
IPs

3
Countries

113 kB
Transfer

381 kB
Size

4
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://acrobatsign.replit.app/wp-xml.php?url=https://wen.foundation/alQ3Ex-d5glQ3Ennl-QdukQ3E-Q3EnQ3Ergy-d58Kvo-y5 HTTP 302
    https://adobesign.winfieldcoc.com/?organisation=duke-energy.com&amp=YWxleC5nbGVubkBkdWtlLWVuZXJneS5jb20= Page URL
  2. https://adobesign.winfieldcoc.com/?organisation=duke-energy.com&amp=YWxleC5nbGVubkBkdWtlLWVuZXJneS5jb20= HTTP 302
    https://login.microsoftonline.com/jsdisabled Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0
  • https://acrobatsign.replit.app/wp-xml.php?url=https://wen.foundation/alQ3Ex-d5glQ3Ennl-QdukQ3E-Q3EnQ3Ergy-d58Kvo-y5 HTTP 302
  • https://adobesign.winfieldcoc.com/?organisation=duke-energy.com&amp=YWxleC5nbGVubkBkdWtlLWVuZXJneS5jb20=

4 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
/
adobesign.winfieldcoc.com/
Redirect Chain
  • https://acrobatsign.replit.app/wp-xml.php?url=https://wen.foundation/alQ3Ex-d5glQ3Ennl-QdukQ3E-Q3EnQ3Ergy-d58Kvo-y5
  • https://adobesign.winfieldcoc.com/?organisation=duke-energy.com&amp=YWxleC5nbGVubkBkdWtlLWVuZXJneS5jb20=
267 KB
89 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://adobesign.winfieldcoc.com/?organisation=duke-energy.com&amp=YWxleC5nbGVubkBkdWtlLWVuZXJneS5jb20=
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
109.61.95.11 London, United Kingdom, ASN60068 (CDN77 _, GB),
Reverse DNS
unn-109-61-95-11.datapacket.com
Software
nginx /
Resource Hash
80502c31c19d32a9234d58c7738e622846a9b5321245e82fd90feb17c05790f8

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
gzip
content-type
text/html; charset=utf-8
date
Sun, 04 Feb 2024 03:46:53 GMT
server
nginx
vary
Accept-Encoding

Redirect headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
content-type
text/html; charset=UTF-8
date
Sun, 04 Feb 2024 03:46:53 GMT
location
https://adobesign.winfieldcoc.com/?organisation=duke-energy.com&amp=YWxleC5nbGVubkBkdWtlLWVuZXJneS5jb20=#/61?document=ieeonpdverepayj-61-&doc=25-67-ieeonpdverepayj
server
Google Frontend
strict-transport-security
max-age=63072000; includeSubDomains
via
1.1 google
x-cloud-trace-context
a07e7856a57b350cfec6b928f371fb29
x-powered-by
PHP/8.2.0RC7
Primary Request jsdisabled
login.microsoftonline.com/
Redirect Chain
  • https://adobesign.winfieldcoc.com/?organisation=duke-energy.com&amp=YWxleC5nbGVubkBkdWtlLWVuZXJneS5jb20=
  • https://login.microsoftonline.com/jsdisabled
3 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://login.microsoftonline.com/jsdisabled
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2603:1027:1:d8::7 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
4f33feb203ece12d5b12a60ead90381014df481ca18e3c308b7f624bd00f50a2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://adobesign.winfieldcoc.com
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Cache-Control
no-store, no-cache
Content-Encoding
gzip
Content-Length
1209
Content-Type
text/html; charset=utf-8
Date
Sun, 04 Feb 2024 03:46:53 GMT
Expires
-1
Link
<https://aadcdn.msauth.net>; rel=preconnect; crossorigin <https://aadcdn.msauth.net>; rel=dns-prefetch <https://aadcdn.msftauth.net>; rel=dns-prefetch
P3P
CP="DSP CUR OTPi IND OTRi ONL FIN"
Pragma
no-cache
Referrer-Policy
strict-origin-when-cross-origin
Strict-Transport-Security
max-age=31536000; includeSubDomains
Vary
Accept-Encoding
X-Content-Type-Options
nosniff
X-DNS-Prefetch-Control
on
X-XSS-Protection
0
nel
{"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}
report-to
{"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+dub2"}]}
x-ms-ests-server
2.1.17216.2 - SEC ProdSlices
x-ms-request-id
ce8d6b49-8010-4a34-b676-d0a6810ab800

Redirect headers

content-type
text/html; charset=utf-8
date
Sun, 04 Feb 2024 03:46:53 GMT
location
https://login.microsoftonline.com/jsdisabled
referrer-policy
no-referrer
server
nginx
converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css
aadcdn.msauth.net/ests/2.1/content/cdnbundles/ 		110 KB
20 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css
Requested by
Host: login.microsoftonline.com
URL: https://login.microsoftonline.com/jsdisabled
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:bdf::60 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
4b01a0a34ce8ed4bc8a8713be0442d49da6a756236b7b4424622ca3dee820f41

Request headers

Referer
https://login.microsoftonline.com/
Origin
https://login.microsoftonline.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Sun, 04 Feb 2024 03:46:54 GMT
content-encoding
gzip
x-cache
TCP_HIT
x-fd-int-roxy-purgeid
4554691
content-length
20314
x-ms-lease-status
unlocked
last-modified
Wed, 27 Dec 2023 18:18:12 GMT
etag
0x8DC07082FBB8D2B
x-azure-ref
20240204T034654Z-pusrbbwew132m5sc0p0kczvc5n00000001zg00000000c786
content-type
text/css
access-control-allow-origin
*
x-ms-request-id
987d4a30-a01e-0050-3576-5586ad000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
microsoft_logo_ea19b2112f4dfd8e90b4505ef7dcb4f9.png
aadcdn.msauth.net/shared/1.0/content/images/ 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_ea19b2112f4dfd8e90b4505ef7dcb4f9.png
Requested by
Host: login.microsoftonline.com
URL: https://login.microsoftonline.com/jsdisabled
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:bdf::60 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
f664b8138c2da6ec7565500a7cc839da6372614a31dc04c5a2169a26b8d9767c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://login.microsoftonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Sun, 04 Feb 2024 03:46:54 GMT
x-cache
TCP_HIT
x-fd-int-roxy-purgeid
4554691
content-length
1057
x-ms-lease-status
unlocked
last-modified
Wed, 24 May 2023 10:11:48 GMT
etag
0x8DB5C3F48FD7E08
x-azure-ref
20240204T034654Z-ezufh8b57t5fhf5f81gxedgs1s00000002qg00000000cxne
content-type
image/png
access-control-allow-origin
*
x-ms-request-id
a41ca0a8-b01e-0075-5675-559094000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Domain/Path Name / Value
login.microsoftonline.com/ Name: fpc
Value: Aocam_fY9otHh2klRWpg21U
.login.microsoftonline.com/ Name: esctx
Value: PAQABAAEAAAAmoFfGtYxvRrNriQdPKIZ-eIEx0hwcm_L0clAua3r5j431gDnPpRSxKqSMgjtzfSNJURD7rT9xgNc_ICUlwM-zkIanryQrn6K193x_Dhv3BROg3Wh_HRsTUB-Fg3j-P8XXjqM3B1Wwk0-N8C3tw7hMJRO3rjW1LCjOEDwhaSAt_Lp0XWDNAnTw9FolZZuP11EgAA
login.microsoftonline.com/ Name: x-ms-gateway-slice
Value: estsfd
login.microsoftonline.com/ Name: stsservicecookie
Value: estsfd

1 Console Messages

Source Level URL
Text
rendering warning URL: https://adobesign.winfieldcoc.com/?organisation=duke-energy.com&amp=YWxleC5nbGVubkBkdWtlLWVuZXJneS5jb20=(Line 15)
Message:
WebGL: this extension has very low support on mobile devices; do not rely on it for rendering effects: WEBGL_polygon_mode