dfgrt.pivitai.net Open in urlscan Pro
172.67.223.170 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://email.wantyourfeedback.com/ls/click?upn=u001.PD4nPnyJUo8oiEzSkSGLgaBNAMtLp9U5nstWElDmnpXtySPOXSs4GxXhEZNYegDWlOpy_1gt1aDjd5...
Effective URL:
https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%...
Submission: On April 25 via manual (April 25th 2024, 10:36:30 am UTC) from US — Scanned from NL

Summary HTTP 21 Redirects Behaviour Indicators

Summary

This website contacted 2 IPs in 2 countries across 3 domains to perform 21 HTTP transactions. The main IP is 172.67.223.170, located in United States and belongs to CLOUDFLARENET, US. The main domain is dfgrt.pivitai.net.
TLS certificate: Issued by GTS CA 1P5 on April 25th 2024. Valid for: 3 months.

This is the only time dfgrt.pivitai.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
2 2	188.114.97.3 188.114.97.3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
3 21	172.67.223.170 172.67.223.170	13335 (CLOUDFLAR...) (CLOUDFLARENET)
21	2

2 188.114.97.3 (Amsterdam, Netherlands) 2 redirects

ASN13335 (CLOUDFLARENET, US)

email.wantyourfeedback.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

21 172.67.223.170 (United States) 3 redirects

ASN13335 (CLOUDFLARENET, US)

dyjt.pivitai.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
bdfdbdf.pivitai.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dfgrt.pivitai.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
yukrtg.pivitai.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
dwqef.pivitai.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
wreg.pivitai.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
21	pivitai.net 3 redirects dyjt.pivitai.net bdfdbdf.pivitai.net dfgrt.pivitai.net yukrtg.pivitai.net dwqef.pivitai.net wreg.pivitai.net	401 KB
2	wantyourfeedback.com 2 redirects email.wantyourfeedback.com	930 B
0	office365.com Failed r4.res.office365.com Failed
21	3

	Domain	Requested by
11	wreg.pivitai.net	dfgrt.pivitai.net wreg.pivitai.net
3	yukrtg.pivitai.net	dfgrt.pivitai.net
2	dfgrt.pivitai.net	yukrtg.pivitai.net
2	bdfdbdf.pivitai.net	1 redirects wreg.pivitai.net
2	dyjt.pivitai.net	2 redirects
2	email.wantyourfeedback.com	2 redirects
1	dwqef.pivitai.net	dfgrt.pivitai.net
0	r4.res.office365.com Failed	bdfdbdf.pivitai.net
21	8

This site contains no links.

Subject Issuer	Validity	Valid
pivitai.net GTS CA 1P5	`2024-04-25` - `2024-07-24`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=1884ccdb-c223-e62f-a6f1-1e72757bebbf&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638496381806641572.fc10860b-a911-4722-909d-327f822832a5&state=Dcs7EoAwCABRouNxMEASPseJOmktvb4U-7otALBnW1YoAdPmPRJ2Uu08TM51M7nShTOYsZsIBsWDTWy5iDeZo-R71Peb9Qc&sso_reload=true
Frame ID: 412CB6B7E1DF36C9637A85DC326782B0
Requests: 23 HTTP requests in this frame

Frame: https://bdfdbdf.pivitai.net/owa/prefetch.aspx
Frame ID: 22A04830379FA798BA6671FD74D5F846
Requests: 3 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://email.wantyourfeedback.com/ls/click?upn=u001.PD4nPnyJUo8oiEzSkSGLgaBNAMtLp9U5nstWElDmnpXtySPOXSs4GxXhEZ... HTTP 307
https://email.wantyourfeedback.com/ls/click?upn=u001.PD4nPnyJUo8oiEzSkSGLgaBNAMtLp9U5nstWElDmnpXtySPOXSs4GxXhEZ... HTTP 302
https://dyjt.pivitai.net/wlFGCNZO HTTP 302
https://bdfdbdf.pivitai.net/owa/ HTTP 307
http://email.wantyourfeedback.com/ls/click?upn=u001.PD4nPnyJUo8oiEzSkSGLgaBNAMtLp9U5nstWElDmnpXtySPOXSs4GxXhEZ... HTTP 307
https://email.wantyourfeedback.com/ls/click?upn=u001.PD4nPnyJUo8oiEzSkSGLgaBNAMtLp9U5nstWElDmnpXtySPOXSs4GxXhEZ... HTTP 302
https://dyjt.pivitai.net/wlFGCNZO HTTP 302
https://bdfdbdf.pivitai.net/owa/ HTTP 302
https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redir... Page URL
https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redir... Page URL

Detected technologies

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]([\d.]*\d)[^/]*\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

21
Requests

86 %
HTTPS

0 %
IPv6

3
Domains

8
Subdomains

2
IPs

2
Countries

396 kB
Transfer

1310 kB
Size

14
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://email.wantyourfeedback.com/ls/click?upn=u001.PD4nPnyJUo8oiEzSkSGLgaBNAMtLp9U5nstWElDmnpXtySPOXSs4GxXhEZNYegDWlOpy_1gt1aDjd5mPVItYgazWgABkVm-2FZUH6kt1lIvkdtkRWsfoyQV18ixDvOX-2B0tU4ZH6SMN7PC0YJjM3gcvFPvh6CbZuFXlOBXf3FWLiJkpKJ7Hjba3S4-2FzhpmkR8VdprfK8GO3qSu-2BzqpIaLLC-2Bva9kOn7HY5B7OIgz5EOl88o1lnRSRpayTzqRzTSFhtg2Bi-2BI4dAZ7qHRbJ3vb9lcrxBKqAk13I-2BCAvndhSK1Vi4ubCjlp2xQlrXIHfzqmLiSPjl7tEmTsLYr99h3esBOPv8ASLIpf873P512I7xYEOjogT1gQCerfZNqh6K2IdWU6lDJ2r3wpU6ug02vU9Zslw4DYpuNNZQNVtap5mqv9Xf8D1PYQxYI5BK4owXOV2wEXeRIjST24XAw6EO9D1tdiGoHDRaxW2QofayefCuiW9Z191aML90svJWojHiQp1Fq-2BXFLiyEx8V1eLa7dixfJ23RRWtHvg1jOrHp7lqvXRA7dobs-3D HTTP 307
https://email.wantyourfeedback.com/ls/click?upn=u001.PD4nPnyJUo8oiEzSkSGLgaBNAMtLp9U5nstWElDmnpXtySPOXSs4GxXhEZNYegDWlOpy_1gt1aDjd5mPVItYgazWgABkVm-2FZUH6kt1lIvkdtkRWsfoyQV18ixDvOX-2B0tU4ZH6SMN7PC0YJjM3gcvFPvh6CbZuFXlOBXf3FWLiJkpKJ7Hjba3S4-2FzhpmkR8VdprfK8GO3qSu-2BzqpIaLLC-2Bva9kOn7HY5B7OIgz5EOl88o1lnRSRpayTzqRzTSFhtg2Bi-2BI4dAZ7qHRbJ3vb9lcrxBKqAk13I-2BCAvndhSK1Vi4ubCjlp2xQlrXIHfzqmLiSPjl7tEmTsLYr99h3esBOPv8ASLIpf873P512I7xYEOjogT1gQCerfZNqh6K2IdWU6lDJ2r3wpU6ug02vU9Zslw4DYpuNNZQNVtap5mqv9Xf8D1PYQxYI5BK4owXOV2wEXeRIjST24XAw6EO9D1tdiGoHDRaxW2QofayefCuiW9Z191aML90svJWojHiQp1Fq-2BXFLiyEx8V1eLa7dixfJ23RRWtHvg1jOrHp7lqvXRA7dobs-3D HTTP 302
https://dyjt.pivitai.net/wlFGCNZO HTTP 302
https://bdfdbdf.pivitai.net/owa/ HTTP 307
http://email.wantyourfeedback.com/ls/click?upn=u001.PD4nPnyJUo8oiEzSkSGLgaBNAMtLp9U5nstWElDmnpXtySPOXSs4GxXhEZNYegDWlOpy_1gt1aDjd5mPVItYgazWgABkVm-2FZUH6kt1lIvkdtkRWsfoyQV18ixDvOX-2B0tU4ZH6SMN7PC0YJjM3gcvFPvh6CbZuFXlOBXf3FWLiJkpKJ7Hjba3S4-2FzhpmkR8VdprfK8GO3qSu-2BzqpIaLLC-2Bva9kOn7HY5B7OIgz5EOl88o1lnRSRpayTzqRzTSFhtg2Bi-2BI4dAZ7qHRbJ3vb9lcrxBKqAk13I-2BCAvndhSK1Vi4ubCjlp2xQlrXIHfzqmLiSPjl7tEmTsLYr99h3esBOPv8ASLIpf873P512I7xYEOjogT1gQCerfZNqh6K2IdWU6lDJ2r3wpU6ug02vU9Zslw4DYpuNNZQNVtap5mqv9Xf8D1PYQxYI5BK4owXOV2wEXeRIjST24XAw6EO9D1tdiGoHDRaxW2QofayefCuiW9Z191aML90svJWojHiQp1Fq-2BXFLiyEx8V1eLa7dixfJ23RRWtHvg1jOrHp7lqvXRA7dobs-3D HTTP 307
https://email.wantyourfeedback.com/ls/click?upn=u001.PD4nPnyJUo8oiEzSkSGLgaBNAMtLp9U5nstWElDmnpXtySPOXSs4GxXhEZNYegDWlOpy_1gt1aDjd5mPVItYgazWgABkVm-2FZUH6kt1lIvkdtkRWsfoyQV18ixDvOX-2B0tU4ZH6SMN7PC0YJjM3gcvFPvh6CbZuFXlOBXf3FWLiJkpKJ7Hjba3S4-2FzhpmkR8VdprfK8GO3qSu-2BzqpIaLLC-2Bva9kOn7HY5B7OIgz5EOl88o1lnRSRpayTzqRzTSFhtg2Bi-2BI4dAZ7qHRbJ3vb9lcrxBKqAk13I-2BCAvndhSK1Vi4ubCjlp2xQlrXIHfzqmLiSPjl7tEmTsLYr99h3esBOPv8ASLIpf873P512I7xYEOjogT1gQCerfZNqh6K2IdWU6lDJ2r3wpU6ug02vU9Zslw4DYpuNNZQNVtap5mqv9Xf8D1PYQxYI5BK4owXOV2wEXeRIjST24XAw6EO9D1tdiGoHDRaxW2QofayefCuiW9Z191aML90svJWojHiQp1Fq-2BXFLiyEx8V1eLa7dixfJ23RRWtHvg1jOrHp7lqvXRA7dobs-3D HTTP 302
https://dyjt.pivitai.net/wlFGCNZO HTTP 302
https://bdfdbdf.pivitai.net/owa/ HTTP 302
https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=1884ccdb-c223-e62f-a6f1-1e72757bebbf&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638496381806641572.fc10860b-a911-4722-909d-327f822832a5&state=Dcs7EoAwCABRouNxMEASPseJOmktvb4U-7otALBnW1YoAdPmPRJ2Uu08TM51M7nShTOYsZsIBsWDTWy5iDeZo-R71Peb9Qc Page URL
https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=1884ccdb-c223-e62f-a6f1-1e72757bebbf&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638496381806641572.fc10860b-a911-4722-909d-327f822832a5&state=Dcs7EoAwCABRouNxMEASPseJOmktvb4U-7otALBnW1YoAdPmPRJ2Uu08TM51M7nShTOYsZsIBsWDTWy5iDeZo-R71Peb9Qc&sso_reload=true Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

http://email.wantyourfeedback.com/ls/click?upn=u001.PD4nPnyJUo8oiEzSkSGLgaBNAMtLp9U5nstWElDmnpXtySPOXSs4GxXhEZNYegDWlOpy_1gt1aDjd5mPVItYgazWgABkVm-2FZUH6kt1lIvkdtkRWsfoyQV18ixDvOX-2B0tU4ZH6SMN7PC0YJjM3gcvFPvh6CbZuFXlOBXf3FWLiJkpKJ7Hjba3S4-2FzhpmkR8VdprfK8GO3qSu-2BzqpIaLLC-2Bva9kOn7HY5B7OIgz5EOl88o1lnRSRpayTzqRzTSFhtg2Bi-2BI4dAZ7qHRbJ3vb9lcrxBKqAk13I-2BCAvndhSK1Vi4ubCjlp2xQlrXIHfzqmLiSPjl7tEmTsLYr99h3esBOPv8ASLIpf873P512I7xYEOjogT1gQCerfZNqh6K2IdWU6lDJ2r3wpU6ug02vU9Zslw4DYpuNNZQNVtap5mqv9Xf8D1PYQxYI5BK4owXOV2wEXeRIjST24XAw6EO9D1tdiGoHDRaxW2QofayefCuiW9Z191aML90svJWojHiQp1Fq-2BXFLiyEx8V1eLa7dixfJ23RRWtHvg1jOrHp7lqvXRA7dobs-3D HTTP 307
https://email.wantyourfeedback.com/ls/click?upn=u001.PD4nPnyJUo8oiEzSkSGLgaBNAMtLp9U5nstWElDmnpXtySPOXSs4GxXhEZNYegDWlOpy_1gt1aDjd5mPVItYgazWgABkVm-2FZUH6kt1lIvkdtkRWsfoyQV18ixDvOX-2B0tU4ZH6SMN7PC0YJjM3gcvFPvh6CbZuFXlOBXf3FWLiJkpKJ7Hjba3S4-2FzhpmkR8VdprfK8GO3qSu-2BzqpIaLLC-2Bva9kOn7HY5B7OIgz5EOl88o1lnRSRpayTzqRzTSFhtg2Bi-2BI4dAZ7qHRbJ3vb9lcrxBKqAk13I-2BCAvndhSK1Vi4ubCjlp2xQlrXIHfzqmLiSPjl7tEmTsLYr99h3esBOPv8ASLIpf873P512I7xYEOjogT1gQCerfZNqh6K2IdWU6lDJ2r3wpU6ug02vU9Zslw4DYpuNNZQNVtap5mqv9Xf8D1PYQxYI5BK4owXOV2wEXeRIjST24XAw6EO9D1tdiGoHDRaxW2QofayefCuiW9Z191aML90svJWojHiQp1Fq-2BXFLiyEx8V1eLa7dixfJ23RRWtHvg1jOrHp7lqvXRA7dobs-3D HTTP 302
https://dyjt.pivitai.net/wlFGCNZO HTTP 302
https://bdfdbdf.pivitai.net/owa/ HTTP 307
http://email.wantyourfeedback.com/ls/click?upn=u001.PD4nPnyJUo8oiEzSkSGLgaBNAMtLp9U5nstWElDmnpXtySPOXSs4GxXhEZNYegDWlOpy_1gt1aDjd5mPVItYgazWgABkVm-2FZUH6kt1lIvkdtkRWsfoyQV18ixDvOX-2B0tU4ZH6SMN7PC0YJjM3gcvFPvh6CbZuFXlOBXf3FWLiJkpKJ7Hjba3S4-2FzhpmkR8VdprfK8GO3qSu-2BzqpIaLLC-2Bva9kOn7HY5B7OIgz5EOl88o1lnRSRpayTzqRzTSFhtg2Bi-2BI4dAZ7qHRbJ3vb9lcrxBKqAk13I-2BCAvndhSK1Vi4ubCjlp2xQlrXIHfzqmLiSPjl7tEmTsLYr99h3esBOPv8ASLIpf873P512I7xYEOjogT1gQCerfZNqh6K2IdWU6lDJ2r3wpU6ug02vU9Zslw4DYpuNNZQNVtap5mqv9Xf8D1PYQxYI5BK4owXOV2wEXeRIjST24XAw6EO9D1tdiGoHDRaxW2QofayefCuiW9Z191aML90svJWojHiQp1Fq-2BXFLiyEx8V1eLa7dixfJ23RRWtHvg1jOrHp7lqvXRA7dobs-3D HTTP 307
https://email.wantyourfeedback.com/ls/click?upn=u001.PD4nPnyJUo8oiEzSkSGLgaBNAMtLp9U5nstWElDmnpXtySPOXSs4GxXhEZNYegDWlOpy_1gt1aDjd5mPVItYgazWgABkVm-2FZUH6kt1lIvkdtkRWsfoyQV18ixDvOX-2B0tU4ZH6SMN7PC0YJjM3gcvFPvh6CbZuFXlOBXf3FWLiJkpKJ7Hjba3S4-2FzhpmkR8VdprfK8GO3qSu-2BzqpIaLLC-2Bva9kOn7HY5B7OIgz5EOl88o1lnRSRpayTzqRzTSFhtg2Bi-2BI4dAZ7qHRbJ3vb9lcrxBKqAk13I-2BCAvndhSK1Vi4ubCjlp2xQlrXIHfzqmLiSPjl7tEmTsLYr99h3esBOPv8ASLIpf873P512I7xYEOjogT1gQCerfZNqh6K2IdWU6lDJ2r3wpU6ug02vU9Zslw4DYpuNNZQNVtap5mqv9Xf8D1PYQxYI5BK4owXOV2wEXeRIjST24XAw6EO9D1tdiGoHDRaxW2QofayefCuiW9Z191aML90svJWojHiQp1Fq-2BXFLiyEx8V1eLa7dixfJ23RRWtHvg1jOrHp7lqvXRA7dobs-3D HTTP 302
https://dyjt.pivitai.net/wlFGCNZO HTTP 302
https://bdfdbdf.pivitai.net/owa/ HTTP 302
https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=1884ccdb-c223-e62f-a6f1-1e72757bebbf&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638496381806641572.fc10860b-a911-4722-909d-327f822832a5&state=Dcs7EoAwCABRouNxMEASPseJOmktvb4U-7otALBnW1YoAdPmPRJ2Uu08TM51M7nShTOYsZsIBsWDTWy5iDeZo-R71Peb9Qc

21 HTTP transactions
5 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H3	200	authorize Show response dfgrt.pivitai.net/common/oauth2/ Redirect Chain http://email.wantyourfeedback.com/ls/click?upn=u001.PD4nPnyJUo8oiEzSkSGLgaBNAMtLp9U5nstWElDmnpXtySPOXSs4GxXhEZNYegDWlOpy_1gt1aDjd5mPVItYgazWgABkVm-2FZUH6kt1lIvkdtkRWsfoyQV18ixDvOX-2B0tU4ZH6SMN7PC0Y... https://email.wantyourfeedback.com/ls/click?upn=u001.PD4nPnyJUo8oiEzSkSGLgaBNAMtLp9U5nstWElDmnpXtySPOXSs4GxXhEZNYegDWlOpy_1gt1aDjd5mPVItYgazWgABkVm-2FZUH6kt1lIvkdtkRWsfoyQV18ixDvOX-2B0tU4ZH6SMN7PC0... https://dyjt.pivitai.net/wlFGCNZO https://bdfdbdf.pivitai.net/owa/ http://email.wantyourfeedback.com/ls/click?upn=u001.PD4nPnyJUo8oiEzSkSGLgaBNAMtLp9U5nstWElDmnpXtySPOXSs4GxXhEZNYegDWlOpy_1gt1aDjd5mPVItYgazWgABkVm-2FZUH6kt1lIvkdtkRWsfoyQV18ixDvOX-2B0tU4ZH6SMN7PC0Y... https://email.wantyourfeedback.com/ls/click?upn=u001.PD4nPnyJUo8oiEzSkSGLgaBNAMtLp9U5nstWElDmnpXtySPOXSs4GxXhEZNYegDWlOpy_1gt1aDjd5mPVItYgazWgABkVm-2FZUH6kt1lIvkdtkRWsfoyQV18ixDvOX-2B0tU4ZH6SMN7PC0... https://dyjt.pivitai.net/wlFGCNZO https://bdfdbdf.pivitai.net/owa/ https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000...	22 KB 11 KB	1760ms 1663ms	Document text/html	172.67.223.170 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=1884ccdb-c223-e62f-a6f1-1e72757bebbf&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638496381806641572.fc10860b-a911-4722-909d-327f822832a5&state=Dcs7EoAwCABRouNxMEASPseJOmktvb4U-7otALBnW1YoAdPmPRJ2Uu08TM51M7nShTOYsZsIBsWDTWy5iDeZo-R71Peb9Qc Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.223.170 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `2f4688f9f05517273c12309db634dce9cda32628fec44980e82e3f75725bab4e` Request headers Accept-Language nl-NL,nl;q=0.9;q=0.9 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers alt-svc h3=":443"; ma=86400 cache-control no-store, no-cache cf-cache-status DYNAMIC cf-ray 879db10af9feb75e-AMS content-encoding br content-type text/html; charset=utf-8 date Thu, 25 Apr 2024 10:36:23 GMT expires -1 nel {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} p3p CP="DSP CUR OTPi IND OTRi ONL FIN" pragma no-cache referrer-policy strict-origin-when-cross-origin report-to {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+sin"}]} server cloudflare vary Accept-Encoding x-ms-ests-server 2.1.17910.10 - JPE ProdSlices x-ms-request-id 4292128a-4308-45e6-99d6-5cdfbaf3f400 x-ms-srs 1.P Redirect headers alt-svc h3=":443"; ma=86400 cf-cache-status DYNAMIC cf-ray 879db0ffa958b75e-AMS content-type text/html; charset=utf-8 date Thu, 25 Apr 2024 10:36:21 GMT location https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=1884ccdb-c223-e62f-a6f1-1e72757bebbf&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638496381806641572.fc10860b-a911-4722-909d-327f822832a5&state=Dcs7EoAwCABRouNxMEASPseJOmktvb4U-7otALBnW1YoAdPmPRJ2Uu08TM51M7nShTOYsZsIBsWDTWy5iDeZo-R71Peb9Qc nel {"report_to":"NelOfficeUpload1","max_age":7200,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} p3p CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" report-to {"group":"NelOfficeUpload1","max_age":7200,"endpoints":[{"url":"https://exo.nel.measure.office.net/api/report?TenantId=&FrontEnd=Cafe&DestinationEndpoint=XSP&RemoteIP=2403:cfc0:1114::"}],"include_subdomains":true} request-id 1884ccdb-c223-e62f-a6f1-1e72757bebbf server cloudflare x-backend-begin 2024-04-25T10:36:20.664 x-backend-end 2024-04-25T10:36:20.664 x-backendhttpstatus 302 302 x-beserver TYZPR02MB4718 x-besku WCS6 x-calculatedbetarget TYZPR02MB4718.apcprd02.PROD.OUTLOOK.COM x-calculatedfetarget TYCP286CU003.internal.outlook.com x-diaginfo TYZPR02MB4718 x-feefzinfo XSP x-feproxyinfo SG2PR02CA0071.APCPRD02.PROD.OUTLOOK.COM x-feserver TYCP286CA0041 SG2PR02CA0071 x-firsthopcafeefz XSP x-iids 0 x-owa-diagnosticsinfo 1;0;0 x-proxy-backendserverstatus 302 x-proxy-routingcorrectness 1 x-rum-notupdatequerieddbcopy 1 x-rum-notupdatequeriedpath 1 x-rum-validated 1 x-ua-compatible IE=EmulateIE7
GET H3	200	BssoInterrupt_Core_Ggyc2EJnCaHFrI6xkBPLcg2.js yukrtg.pivitai.net/shared/1.0/content/js/	138 KB 50 KB	64ms 34ms	Script application/x-javascript	172.67.223.170 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://yukrtg.pivitai.net/shared/1.0/content/js/BssoInterrupt_Core_Ggyc2EJnCaHFrI6xkBPLcg2.js Requested by Host: dfgrt.pivitai.net URL: https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=1884ccdb-c223-e62f-a6f1-1e72757bebbf&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638496381806641572.fc10860b-a911-4722-909d-327f822832a5&state=Dcs7EoAwCABRouNxMEASPseJOmktvb4U-7otALBnW1YoAdPmPRJ2Uu08TM51M7nShTOYsZsIBsWDTWy5iDeZo-R71Peb9Qc Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.223.170 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://dfgrt.pivitai.net/ Accept-Language nl-NL,nl;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 25 Apr 2024 10:36:23 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-md5 OdlDOzXlgXZa124Z7O0jlA== age 24326 x-cache HIT alt-svc h3=":443"; ma=86400 x-ms-lease-status unlocked last-modified Mon, 01 Apr 2024 18:06:40 GMT server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=R4J09Y%2FFB6%2FaeAXO%2BGKTbtZp78sDved9dyHkT01PW8jvCD3y6BROXKb0it%2B4D8ckFxvi9J%2FOpq6UCXqp8D5Q%2BAdEPMn9FfTrJbTLMOl%2FKbZ5t%2F6BXZNcMB8XxzfrlgB6clvf89o%3D"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript access-control-allow-origin * x-ms-request-id d2ecfd5c-a01e-0015-3dfe-856d0e000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 cf-ray 879db117ba46b75e-AMS
GET DATA	200 OK	truncated Show response /	341 B 0		Script text/javascript
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `90682803943448f3acffc81014c87fdd71f30d8cf97335fcea451fac1e568221` Request headers Accept-Language nl-NL,nl;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Type text/javascript
GET DATA	200 OK	truncated /	875 B 0		Script text/javascript
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash Request headers Accept-Language nl-NL,nl;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Type text/javascript
GET H3	200	Primary Request authorize Show response dfgrt.pivitai.net/common/oauth2/	39 KB 17 KB	1528ms 1528ms	Document text/html	172.67.223.170 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=1884ccdb-c223-e62f-a6f1-1e72757bebbf&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638496381806641572.fc10860b-a911-4722-909d-327f822832a5&state=Dcs7EoAwCABRouNxMEASPseJOmktvb4U-7otALBnW1YoAdPmPRJ2Uu08TM51M7nShTOYsZsIBsWDTWy5iDeZo-R71Peb9Qc&sso_reload=true Requested by Host: yukrtg.pivitai.net URL: https://yukrtg.pivitai.net/shared/1.0/content/js/BssoInterrupt_Core_Ggyc2EJnCaHFrI6xkBPLcg2.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.223.170 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `c2ffc260a37236328831525588132349d430ff120257ae3150c3f233e6dec743` Request headers Accept-Language nl-NL,nl;q=0.9;q=0.9 Referer https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=1884ccdb-c223-e62f-a6f1-1e72757bebbf&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638496381806641572.fc10860b-a911-4722-909d-327f822832a5&state=Dcs7EoAwCABRouNxMEASPseJOmktvb4U-7otALBnW1YoAdPmPRJ2Uu08TM51M7nShTOYsZsIBsWDTWy5iDeZo-R71Peb9Qc Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers alt-svc h3=":443"; ma=86400 cache-control no-store, no-cache cf-cache-status DYNAMIC cf-ray 879db1195b21b75e-AMS content-encoding br content-type text/html; charset=utf-8 date Thu, 25 Apr 2024 10:36:25 GMT expires -1 link <https://aadcdn.msauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msauth.net>; rel=dns-prefetch,<https://aadcdn.msftauth.net>; rel=dns-prefetch nel {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} p3p CP="DSP CUR OTPi IND OTRi ONL FIN" pragma no-cache referrer-policy strict-origin-when-cross-origin report-to {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+sin"}]} server cloudflare vary Accept-Encoding x-dns-prefetch-control on x-ms-ests-server 2.1.17846.6 - SEASLR1 ProdSlices x-ms-request-id a6e1c9aa-b887-4911-bd7e-2844d4f00c01 x-ms-srs 1.P
GET		favicon.ico dfgrt.pivitai.net/	0 0

GET H3	200	watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js yukrtg.pivitai.net/ests/2.1/content/cdnbundles/	117 KB 41 KB	30ms 29ms	Script application/x-javascript	172.67.223.170 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://yukrtg.pivitai.net/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js Requested by Host: dfgrt.pivitai.net URL: https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=1884ccdb-c223-e62f-a6f1-1e72757bebbf&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638496381806641572.fc10860b-a911-4722-909d-327f822832a5&state=Dcs7EoAwCABRouNxMEASPseJOmktvb4U-7otALBnW1YoAdPmPRJ2Uu08TM51M7nShTOYsZsIBsWDTWy5iDeZo-R71Peb9Qc Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.223.170 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://dfgrt.pivitai.net/ Accept-Language nl-NL,nl;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 25 Apr 2024 10:36:24 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-md5 HWW92uTq7vx3y5z+zFZbXQ== age 24324 x-cache HIT alt-svc h3=":443"; ma=86400 x-ms-lease-status unlocked last-modified Fri, 26 Feb 2021 06:18:37 GMT server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=T1E3mVI%2F%2FOzl%2B384BsLikiA8ZzhsgNJ17pf4pSMvkalnxZtlHPb5zR9kJAwQkwbs1zR9bb54A5O0VJCpLfKPYLSZZkdg29PvaMpd1MYqm09em1VM%2BEbfHOuDO0o0Tb9ndqPfkUg%3D"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript access-control-allow-origin * x-ms-request-id 7150edc7-801e-00fb-7dd4-7eda64000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 cf-ray 879db11f6e2db75e-AMS
GET H3	200	frameworksupport.min_oadrnc13magb009k4d20lg2.js yukrtg.pivitai.net/ests/2.1/content/cdnbundles/	12 KB 6 KB	185ms 183ms	Script application/x-javascript	172.67.223.170 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://yukrtg.pivitai.net/ests/2.1/content/cdnbundles/frameworksupport.min_oadrnc13magb009k4d20lg2.js Requested by Host: dfgrt.pivitai.net URL: https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=1884ccdb-c223-e62f-a6f1-1e72757bebbf&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638496381806641572.fc10860b-a911-4722-909d-327f822832a5&state=Dcs7EoAwCABRouNxMEASPseJOmktvb4U-7otALBnW1YoAdPmPRJ2Uu08TM51M7nShTOYsZsIBsWDTWy5iDeZo-R71Peb9Qc Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.223.170 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://dfgrt.pivitai.net/ Accept-Language nl-NL,nl;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 25 Apr 2024 10:36:25 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} content-md5 A8dgUeRfi6/VknMbox6Cuw== age 136 x-cache HIT alt-svc h3=":443"; ma=86400 x-ms-lease-status unlocked last-modified Thu, 22 Oct 2020 20:43:24 GMT server cloudflare vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3TQi6Xg4l2llQ38x414wM8gGAyMmLQ4sKR7vcku8ctBtA4qKP6PwaiBKiogLSo9I%2BjTxDdI5W66wsReU13v%2BjBnfb1GTWJkrIaPBZXOkixI9CNfc8Wdbr7kXVJupjPZnr6md8%2FM%3D"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript access-control-allow-origin * x-ms-request-id ba814717-001e-00df-48d1-7ee75f000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 cf-ray 879db1216f2bb75e-AMS
GET		watson.min_q5ptmu8aniymd4ftuqdkda2.js yukrtg.pivitai.net/ests/2.1/content/cdnbundles/	0 0

GET DATA	200 OK	truncated Show response /	341 B 0		Script text/javascript
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `90682803943448f3acffc81014c87fdd71f30d8cf97335fcea451fac1e568221` Request headers Accept-Language nl-NL,nl;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Type text/javascript
GET H3	200	Me.htm dwqef.pivitai.net/	0 0	1660ms 1621ms	Other text/html	172.67.223.170 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://dwqef.pivitai.net/Me.htm?v=3 Requested by Host: dfgrt.pivitai.net URL: https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=1884ccdb-c223-e62f-a6f1-1e72757bebbf&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638496381806641572.fc10860b-a911-4722-909d-327f822832a5&state=Dcs7EoAwCABRouNxMEASPseJOmktvb4U-7otALBnW1YoAdPmPRJ2Uu08TM51M7nShTOYsZsIBsWDTWy5iDeZo-R71Peb9Qc&sso_reload=true Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.223.170 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://dfgrt.pivitai.net/ Accept-Language nl-NL,nl;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers
GET H3	200	converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css wreg.pivitai.net/ests/2.1/content/cdnbundles/	110 KB 20 KB	138ms 48ms	Stylesheet text/css	172.67.223.170 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://wreg.pivitai.net/ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css Requested by Host: dfgrt.pivitai.net URL: https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=1884ccdb-c223-e62f-a6f1-1e72757bebbf&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638496381806641572.fc10860b-a911-4722-909d-327f822832a5&state=Dcs7EoAwCABRouNxMEASPseJOmktvb4U-7otALBnW1YoAdPmPRJ2Uu08TM51M7nShTOYsZsIBsWDTWy5iDeZo-R71Peb9Qc&sso_reload=true Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.223.170 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `4b01a0a34ce8ed4bc8a8713be0442d49da6a756236b7b4424622ca3dee820f41` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://dfgrt.pivitai.net/ Accept-Language nl-NL,nl;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 25 Apr 2024 10:36:25 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 24324 x-cache TCP_HIT x-fd-int-roxy-purgeid 0 alt-svc h3=":443"; ma=86400 x-ms-lease-status unlocked last-modified Wed, 27 Dec 2023 18:18:12 GMT server cloudflare x-azure-ref 20240425T035101Z-15b4f9478487vmzr3r64sg19xs00000008rg000000005a8q report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ntPA84HpYWei33gP%2BY0MTDIx22arhDjob%2F4wvccRbbaPc0N%2F1aW3LhVtrSlWMu4g9HcwlgtRztZEEIseBql9i78wqvBtJFBTJeFDWQq%2FwNWGzINKlIm%2BLVlPzBAMfcypZIIe"}],"group":"cf-nel","max_age":604800} content-type text/css access-control-allow-origin * x-ms-request-id e3099cbe-501e-0003-1043-929898000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 vary Accept-Encoding cf-ray 879db12639c3b75e-AMS
GET H3	200	ConvergedLogin_PCore_jHSrlUosdD1xxbmcR_lMNA2.js Show response wreg.pivitai.net/shared/1.0/content/js/	434 KB 115 KB	194ms 105ms	Script application/x-javascript	172.67.223.170 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://wreg.pivitai.net/shared/1.0/content/js/ConvergedLogin_PCore_jHSrlUosdD1xxbmcR_lMNA2.js Requested by Host: dfgrt.pivitai.net URL: https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=1884ccdb-c223-e62f-a6f1-1e72757bebbf&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638496381806641572.fc10860b-a911-4722-909d-327f822832a5&state=Dcs7EoAwCABRouNxMEASPseJOmktvb4U-7otALBnW1YoAdPmPRJ2Uu08TM51M7nShTOYsZsIBsWDTWy5iDeZo-R71Peb9Qc&sso_reload=true Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.223.170 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `f2a6aec6bd796879be1868adc44ca6e22bf7bbac484e6a2a896f09b08463d41c` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://dfgrt.pivitai.net/ Accept-Language nl-NL,nl;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 25 Apr 2024 10:36:25 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 4100 x-cache TCP_HIT x-fd-int-roxy-purgeid 4554691 alt-svc h3=":443"; ma=86400 x-ms-lease-status unlocked last-modified Wed, 27 Mar 2024 20:03:18 GMT server cloudflare x-azure-ref 20240425T092805Z-r1869b9b46cmf9rw5e2qm6e7kg00000001xg00000000n1gk report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NZtfzN%2B0lCoJ5EujoH2tm6nDZ6T4QJ0m1kfs1aFj3XVpqzdLKP4LsXdsoELorw0%2Bx9cE%2FFnKfqSII2LONICXLzSNfb7dPzIgniqZV0Xwl9VyhWu03Z9T8f%2FxCcnUwfmHPd62"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript access-control-allow-origin * x-ms-request-id ec2ae9f4-f01e-004d-32f0-95e994000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 vary Accept-Encoding cf-ray 879db12639c2b75e-AMS
GET H3	200	ux.converged.login.strings-nl.min_so1vlfg6dwq81xnm1w7qww2.js Show response wreg.pivitai.net/ests/2.1/content/cdnbundles/	57 KB 17 KB	2717ms 2628ms	Script application/x-javascript	172.67.223.170 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://wreg.pivitai.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-nl.min_so1vlfg6dwq81xnm1w7qww2.js Requested by Host: dfgrt.pivitai.net URL: https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=1884ccdb-c223-e62f-a6f1-1e72757bebbf&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638496381806641572.fc10860b-a911-4722-909d-327f822832a5&state=Dcs7EoAwCABRouNxMEASPseJOmktvb4U-7otALBnW1YoAdPmPRJ2Uu08TM51M7nShTOYsZsIBsWDTWy5iDeZo-R71Peb9Qc&sso_reload=true Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.223.170 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `54b66901592d09fe8d36292e4e275bc23b99764073dc6b32bc99c3d7bbc6e1c8` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://dfgrt.pivitai.net/ Accept-Language nl-NL,nl;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 25 Apr 2024 10:36:28 GMT content-encoding br cf-cache-status MISS nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} x-cache TCP_MISS x-fd-int-roxy-purgeid 0 alt-svc h3=":443"; ma=86400 x-ms-lease-status unlocked last-modified Thu, 28 Mar 2024 02:23:54 GMT server cloudflare x-azure-ref 20240425T103626Z-r1869b9b46cmf9rw5e2qm6e7kg00000001vg0000000195k0 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zX5zHmaC9jOwtdBwEZGxeUNgujwE0qO4galSj0NTlsedJHwNVT4c067dh4Y1uW0nu%2BAGRalZh60rjJeT2mDt2ZtNgp%2BHtLp7oZz82kkbLHe%2BCN2ERmc0sr0inFag7MJILS%2BL"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript access-control-allow-origin * x-ms-request-id d7247505-e01e-0000-21fc-96e59e000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 vary Accept-Encoding cf-ray 879db12639c1b75e-AMS
GET DATA	200 OK	truncated Show response /	875 B 0		Script text/javascript
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash `663053ef895163d7525641d5b675f92e1a3eeb361b6a2ae766bd04a0ac1549c9` Request headers Accept-Language nl-NL,nl;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Type text/javascript
GET H3	200	convergedlogin_pcustomizationloader_7f0a8c2a247460fad87f.js Show response wreg.pivitai.net/shared/1.0/content/js/asyncchunk/	219 KB 51 KB	49ms 35ms	Script application/x-javascript	172.67.223.170 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://wreg.pivitai.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_7f0a8c2a247460fad87f.js Requested by Host: wreg.pivitai.net URL: https://wreg.pivitai.net/shared/1.0/content/js/ConvergedLogin_PCore_jHSrlUosdD1xxbmcR_lMNA2.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.223.170 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `df2e852c347ecf82f70a0c8a4b91713fbb0914d58f2cbab01316bfe646abee7c` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://dfgrt.pivitai.net/ Accept-Language nl-NL,nl;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 25 Apr 2024 10:36:28 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 4098 x-cache TCP_HIT x-fd-int-roxy-purgeid 4554691 alt-svc h3=":443"; ma=86400 x-ms-lease-status unlocked last-modified Thu, 15 Feb 2024 19:13:15 GMT server cloudflare x-azure-ref 20240425T092810Z-r1869b9b46cmf9rw5e2qm6e7kg00000001xg00000000n21w report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ksGqByKL8PGOy2EEIe1NYrpUsOtTYX6Jgj6GbNN6pVmBWE6k6J%2BMuCGQUHZoxMGWi3gwzdADhUyClui%2Fp14Oe7qssIQQNcc0uYY10nAlfmUpiwuV41gXgrYWkh5lhPyoePtO"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript access-control-allow-origin * x-ms-request-id 3e7b70ee-301e-0015-2969-96d2b6000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 vary Accept-Encoding cf-ray 879db1374bd7b75e-AMS
GET H3	200	prefetch.aspx bdfdbdf.pivitai.net/owa/ Frame 22A0	3 KB 2 KB	1530ms 1516ms	Document text/html	172.67.223.170 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://bdfdbdf.pivitai.net/owa/prefetch.aspx Requested by Host: wreg.pivitai.net URL: https://wreg.pivitai.net/shared/1.0/content/js/ConvergedLogin_PCore_jHSrlUosdD1xxbmcR_lMNA2.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.223.170 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash Request headers Accept-Language nl-NL,nl;q=0.9;q=0.9 Referer https://dfgrt.pivitai.net/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" sec-ch-ua-mobile ?0 sec-ch-ua-platform "Win32" Response headers alt-svc h3=":443"; ma=86400 cache-control private, no-store cf-cache-status DYNAMIC cf-ray 879db1383c89b75e-AMS content-encoding br content-type text/html; charset=utf-8 date Thu, 25 Apr 2024 10:36:30 GMT nel {"report_to":"NelOfficeUpload1","max_age":7200,"include_subdomains":true,"failure_fraction":1.0,"success_fraction":0.01} report-to {"group":"NelOfficeUpload1","max_age":7200,"endpoints":[{"url":"https://exo.nel.measure.office.net/api/report?TenantId=&FrontEnd=Cafe&DestinationEndpoint=XSP&RemoteIP=2403:cfc0:1114::"}],"include_subdomains":true} request-id aefe021b-a326-93e4-1834-818931dd57c0 server cloudflare vary Accept-Encoding x-backend-begin 2024-04-25T10:36:29.740 x-backend-end 2024-04-25T10:36:29.740 x-backendhttpstatus 200 200 x-beserver TYZPR02MB7008 x-besku WCS7 x-calculatedbetarget TYZPR02MB7008.apcprd02.prod.outlook.com x-calculatedfetarget TYAPR01CU008.internal.outlook.com x-diaginfo TYZPR02MB7008 x-feefzinfo XSP x-feproxyinfo SG2PR02CA0071.APCPRD02.PROD.OUTLOOK.COM x-feserver TYAPR01CA0176 SG2PR02CA0071 x-firsthopcafeefz XSP x-iids 0 x-owa-diagnosticsinfo 2;0;0 x-owa-version 15.20.7472.44 x-proxy-backendserverstatus 200 x-proxy-routingcorrectness 1 x-rum-notupdatequerieddbcopy 1 x-rum-notupdatequeriedpath 1 x-rum-validated 1 x-ua-compatible IE=EmulateIE7
GET H3	200	49-small_2055002f2daae2ed8f69f03944c0e5d9.jpg wreg.pivitai.net/shared/1.0/content/images/appbackgrounds/	987 B 2 KB	35ms 35ms	Image image/jpeg	172.67.223.170 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://wreg.pivitai.net/shared/1.0/content/images/appbackgrounds/49-small_2055002f2daae2ed8f69f03944c0e5d9.jpg Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.223.170 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `8b34a475187302935336bf43a2bf2a4e0adb9a1e87953ea51f6fcf0ef52a4a1d` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://dfgrt.pivitai.net/ Accept-Language nl-NL,nl;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 25 Apr 2024 10:36:29 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 4095 x-cache TCP_HIT x-cache-info L1_T2 x-fd-int-roxy-purgeid 4554691 alt-svc h3=":443"; ma=86400 x-ms-lease-status unlocked last-modified Wed, 24 May 2023 10:11:42 GMT server cloudflare etag 0x8DB5C3F457E15E1 x-azure-ref 20240425T092813Z-r1869b9b46cmf9rw5e2qm6e7kg00000001xg00000000n2dd report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=PMpoTKlbuBuJxmollcNSHZyDbwRHgq61DFbfOZvcVq12KFKzuXM%2FVK7yIE%2BD1L%2BKbxgz8Q%2BkFL%2B91sfVnpKm5eFlXisbt2mEOc0vHtMyhpobezWneyKEX4PSOXjeVz4SSBTc"}],"group":"cf-nel","max_age":604800} content-type image/jpeg access-control-allow-origin * x-ms-request-id 5efdb8a1-f01e-0071-7d34-963c9c000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 vary Accept-Encoding cf-ray 879db1399d50b75e-AMS
GET H3	200	49_6ffe0a92d779c878835b40171ffc2e13.jpg wreg.pivitai.net/shared/1.0/content/images/appbackgrounds/	17 KB 18 KB	43ms 43ms	Image image/jpeg	172.67.223.170 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://wreg.pivitai.net/shared/1.0/content/images/appbackgrounds/49_6ffe0a92d779c878835b40171ffc2e13.jpg Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.223.170 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `d8f5ab3e00202fd3b45be1acd95d677b137064001e171bc79b06826d98f1e1d3` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://dfgrt.pivitai.net/ Accept-Language nl-NL,nl;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 25 Apr 2024 10:36:29 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 4095 x-cache TCP_HIT x-cache-info L1_T2 x-fd-int-roxy-purgeid 4554691 alt-svc h3=":443"; ma=86400 x-ms-lease-status unlocked last-modified Wed, 24 May 2023 10:11:42 GMT server cloudflare etag 0x8DB5C3F4584F323 x-azure-ref 20240425T092813Z-r1869b9b46cmf9rw5e2qm6e7kg00000001xg00000000n2da report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jz8VuVAfYOVh1sxAALfLlBSy7HPf0B1Lp44dgSFoRaBcTGeG20jc%2BOJUanUSgZy5P%2BmiFO74gNMPkz%2FHtsZjCttAUVhE2IcP%2FTYb1C4TgfOk3Irbc%2BBARMGTyQDIofcxDb9m"}],"group":"cf-nel","max_age":604800} content-type image/jpeg access-control-allow-origin * x-ms-request-id 68f06eff-901e-005b-2e38-96a3ba000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 vary Accept-Encoding cf-ray 879db1399d52b75e-AMS
GET H3	200	53_7a3c80bf9694448bac31a9589d2e9e92.png wreg.pivitai.net/shared/1.0/content/images/applogos/	5 KB 6 KB	81ms 80ms	Image image/png	172.67.223.170 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://wreg.pivitai.net/shared/1.0/content/images/applogos/53_7a3c80bf9694448bac31a9589d2e9e92.png Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.223.170 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `e4e1e65871749d18aea150643c07e0aab2057da057c6c57ec1c3c43580e1c898` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://dfgrt.pivitai.net/ Accept-Language nl-NL,nl;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 25 Apr 2024 10:36:29 GMT cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 4095 x-cache TCP_HIT x-cache-info L1_T2 x-fd-int-roxy-purgeid 4554691 alt-svc h3=":443"; ma=86400 x-ms-lease-status unlocked last-modified Wed, 24 May 2023 10:11:45 GMT server cloudflare etag 0x8DB5C3F475BAFC0 x-azure-ref 20240425T092813Z-r1869b9b46cmf9rw5e2qm6e7kg00000001xg00000000n2d8 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B81xbfzHh8Dn%2FbjnMdWfMS11%2FAjz9RhzFj3Taies9%2FuIh6jGf5boQKuw%2F%2FJAeKYWJvCX6XNcODS9TmFj4BMajqEAiOHGWxNQRjqenrdR0Y0ecDoWWRmSIy8yMQkEaYWs5LNr"}],"group":"cf-nel","max_age":604800} content-type image/png access-control-allow-origin * x-ms-request-id 7467f48d-601e-0070-05bc-95179e000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 vary Accept-Encoding cf-ray 879db1399d54b75e-AMS
GET H3	200	microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg wreg.pivitai.net/shared/1.0/content/images/	4 KB 2 KB	89ms 89ms	Image image/svg+xml	172.67.223.170 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://wreg.pivitai.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.223.170 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://dfgrt.pivitai.net/ Accept-Language nl-NL,nl;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 25 Apr 2024 10:36:29 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 4095 x-cache TCP_HIT x-fd-int-roxy-purgeid 4554691 alt-svc h3=":443"; ma=86400 x-ms-lease-status unlocked last-modified Wed, 24 May 2023 10:11:48 GMT server cloudflare x-azure-ref 20240425T092813Z-r1869b9b46cmf9rw5e2qm6e7kg00000001xg00000000n2de report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LdlQlkgmI2VhxS5HVnQuKqu1y1skuIVurIMndxr0KHDYBHvhqPxmgntNv%2B7tmXYjVh2ldA7OC%2Bai%2FoEky5ONkraN9LmOAlLnw62xgtJ%2Bm0noMlKkN5DZ29a%2BAYHOTCDjG82B"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml access-control-allow-origin * x-ms-request-id 51475654-901e-001f-1cc3-95dca3000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 vary Accept-Encoding cf-ray 879db1399d55b75e-AMS
GET H3	200	convergedlogin_pstringcustomizationhelper_eb638da25d4055fbbb57.js Show response wreg.pivitai.net/shared/1.0/content/js/asyncchunk/	111 KB 36 KB	80ms 79ms	Script application/x-javascript	172.67.223.170 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://wreg.pivitai.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_eb638da25d4055fbbb57.js Requested by Host: wreg.pivitai.net URL: https://wreg.pivitai.net/shared/1.0/content/js/ConvergedLogin_PCore_jHSrlUosdD1xxbmcR_lMNA2.js Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.223.170 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `7530b843a86f3155ce07cda787a40da87052664b09c22f3d4db5e9238664dbe0` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://dfgrt.pivitai.net/ Accept-Language nl-NL,nl;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 25 Apr 2024 10:36:29 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 4095 x-cache TCP_HIT x-fd-int-roxy-purgeid 4554691 alt-svc h3=":443"; ma=86400 x-ms-lease-status unlocked last-modified Thu, 15 Feb 2024 19:13:16 GMT server cloudflare x-azure-ref 20240425T092813Z-r1869b9b46cnc5zjgkyrrgbnk0000000019000000001daww report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=yfboXGPrP7hgyGANjfp7VvFGyi0pI0M2jfnd4laormdfddYMHy1XQyhU6ky5GDTI76k7jUImN5aCIa1mhMYKpYMWcJK%2FNtlF3yd0tHoV6qCglOaT9LOSjG3DDK9pWnjQBGLh"}],"group":"cf-nel","max_age":604800} content-type application/x-javascript access-control-allow-origin * x-ms-request-id 2bbf2a48-a01e-0040-4bb1-96368f000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 vary Accept-Encoding cf-ray 879db139ad62b75e-AMS
GET H3	200	favicon_a_eupayfgghqiai7k9sol6lg2.ico wreg.pivitai.net/shared/1.0/content/images/	17 KB 1 KB	175ms 154ms	Other image/x-icon	172.67.223.170 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://wreg.pivitai.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.223.170 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://dfgrt.pivitai.net/ Accept-Language nl-NL,nl;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 25 Apr 2024 10:36:29 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 4095 x-cache TCP_HIT x-fd-int-roxy-purgeid 4554691 alt-svc h3=":443"; ma=86400 x-ms-lease-status unlocked last-modified Sun, 18 Oct 2020 03:02:03 GMT server cloudflare x-azure-ref 20240425T092813Z-r1869b9b46cnc5zjgkyrrgbnk0000000019000000001dax3 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BC09ljaA6fGpX%2BOZe4QbEPvOwGLfzTk%2FxHRlC%2Fmg1CWccUmCDccFcTP1%2BdDmBYGk9O5RvFGfKXyjnkamQjVLPND38Eo3UTRc5B3q%2FjPtVlNxBpML3%2FezX%2FGvNWjvn0xYhKAP"}],"group":"cf-nel","max_age":604800} content-type image/x-icon access-control-allow-origin * x-ms-request-id 957e8c64-301e-0039-5255-96b79c000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 vary Accept-Encoding cf-ray 879db13abdd7b75e-AMS
GET H3	200	signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg wreg.pivitai.net/shared/1.0/content/images/	2 KB 1 KB	121ms 63ms	Image image/svg+xml	172.67.223.170 CLOUDFLARENET
General Check archive.org Show headers Download Go to Show image Full URL https://wreg.pivitai.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg Protocol H3 Security QUIC, , AES_128_GCM Server 172.67.223.170 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash `8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93` Request headers sec-ch-ua "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124" Referer https://dfgrt.pivitai.net/ Accept-Language nl-NL,nl;q=0.9;q=0.9 sec-ch-ua-mobile ?0 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 sec-ch-ua-platform "Win32" Response headers x-ms-blob-type BlockBlob date Thu, 25 Apr 2024 10:36:29 GMT content-encoding br cf-cache-status HIT nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} age 4095 x-cache TCP_HIT x-fd-int-roxy-purgeid 4554691 alt-svc h3=":443"; ma=86400 x-ms-lease-status unlocked last-modified Wed, 24 May 2023 10:11:49 GMT server cloudflare x-azure-ref 20240425T092814Z-r1869b9b46cnc5zjgkyrrgbnk0000000019000000001day1 report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=x3ORTqO58wzhfYjOENbcZ1JiZPLB8brgAvRsFNnkWfLhXpOZBLdpGmsMaZtHKT8tkIF58CkMw1Pew5RR9NlBa7v6fhwMWN5sDYn4DQ%2FktH2km8R%2BwOG3NOFpp3w6Srt%2F3Nc9"}],"group":"cf-nel","max_age":604800} content-type image/svg+xml access-control-allow-origin * x-ms-request-id 15325a5e-b01e-000d-5f57-963a85000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 vary Accept-Encoding cf-ray 879db13ccf03b75e-AMS
GET DATA	200 OK	truncated / Frame 22A0	341 B 0		Script text/javascript
General Check archive.org Show headers Download Go to Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash Request headers Accept-Language nl-NL,nl;q=0.9;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 Response headers Content-Type text/javascript
GET		boot.worldwide.0.mouse.js r4.res.office365.com/owa/prem/15.20.7472.44/scripts/ Frame 22A0	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: dfgrt.pivitai.net
URL: https://dfgrt.pivitai.net/favicon.ico

Domain: yukrtg.pivitai.net
URL: https://yukrtg.pivitai.net/ests/2.1/content/cdnbundles/watson.min_q5ptmu8aniymd4ftuqdkda2.js

Domain: r4.res.office365.com
URL: https://r4.res.office365.com/owa/prem/15.20.7472.44/scripts/boot.worldwide.0.mouse.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

18 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

14 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.pivitai.net/	1970-01-20 20:07:24	Name: FAro Value: 7f9c5b1ba69a39011bb4096625e371152d68283dfea8ba7a69b183ae0258a878
bdfdbdf.pivitai.net/	1970-01-21 04:52:57	Name: ClientId Value: 1506AC3B28A149638E46FEC324012E3D
bdfdbdf.pivitai.net/	1970-01-21 00:30:52	Name: OIDC Value: 1
bdfdbdf.pivitai.net/	1970-01-20 20:07:24	Name: OpenIdConnect.nonce.v3.ZwLIvHpqssqINVc1E8sYuK9XPX2ggsl_KLkihCt7hS8 Value: 638496381806641572.fc10860b-a911-4722-909d-327f822832a5
bdfdbdf.pivitai.net/	1970-01-20 20:07:43	Name: X-OWA-RedirectHistory Value: ArLym14BpAH1ixNl3Ag
.dfgrt.pivitai.net/	1969-12-31 23:59:59	Name: esctx-8RbvBztpH0 Value: AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8yBwsvJPr5q1NoUgPJ2NBUd8Sei7Dvn0pQ-FYsOhhv85Xq7F9XhqKG6utOZkv3rVblNc8ibKggA7tem_QfLuVZuqDO6CjRlojVmWGu5eg7_-yCjg59RsEXFAuK6USwa2KattIfdj-iaEjxXGpYa3tUiAA
dfgrt.pivitai.net/	1969-12-31 23:59:59	Name: x-ms-gateway-slice Value: estsfd
dfgrt.pivitai.net/	1969-12-31 23:59:59	Name: stsservicecookie Value: estsfd
.dfgrt.pivitai.net/	1969-12-31 23:59:59	Name: AADSSO Value: NA\|NoExtension
dfgrt.pivitai.net/	1970-01-20 20:07:21	Name: SSOCOOKIEPULLED Value: 1
dfgrt.pivitai.net/	1970-01-20 20:50:33	Name: buid Value: 0.AVUAMe_N-B6jSkuT5F9XHpElWgIAAAAAAPEPzgAAAAAAAAABAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8lyIKPlRpSANx5oILQJcj6BM3JFy7LWAyExS9yzfUS5kkpBF0T9FulsYQh3Nphi7Iq2ds6NqdS0wbrBn4lSPx9RjucAySw8pMG9OC9giYwMggAA
.dfgrt.pivitai.net/	1969-12-31 23:59:59	Name: esctx Value: PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8uU3wDMMYCVjEyX1l-g8jqKXYaszHyAGMARabfBVvB3TjMgBlQyTAGQ_T4dE1uZ4EzBiF0DfjuubetxeXgMvWAGBZyZd9X5MtDNiHWjQ1o-s6IKirsw0Q8QbscrFRnkCDKZ_Y19f-DUq6FLfcOhER9vfggpePjqTvXxHArySIuJAgAA
.dfgrt.pivitai.net/	1969-12-31 23:59:59	Name: esctx-WA5BK8BKVM Value: AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8thVnKE635HQwNPanPQ8eQEdZXk2TrzhhfPuL7hQ6PYjk2ld28TbdiVg9t0R_4C0kxmIdAkSl7nupyjsXIdRX8FD21ds8j70frgilNSJkWnyNaHhYaRyez41dQGfGM3h4MAmt9paqmDuAvHPhhCPr2SAA
dfgrt.pivitai.net/	1970-01-20 20:50:33	Name: fpc Value: ApbsyaCc09hNlZ2bFGjh2tyerOTJAQAAACcpvN0OAAAA

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://dfgrt.pivitai.net/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=1884ccdb-c223-e62f-a6f1-1e72757bebbf&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638496381806641572.fc10860b-a911-4722-909d-327f822832a5&state=Dcs7EoAwCABRouNxMEASPseJOmktvb4U-7otALBnW1YoAdPmPRJ2Uu08TM51M7nShTOYsZsIBsWDTWy5iDeZo-R71Peb9Qc&sso_reload=true Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bdfdbdf.pivitai.net
dfgrt.pivitai.net
dwqef.pivitai.net
dyjt.pivitai.net
email.wantyourfeedback.com
r4.res.office365.com
wreg.pivitai.net
yukrtg.pivitai.net
dfgrt.pivitai.net
r4.res.office365.com
yukrtg.pivitai.net
172.67.223.170
188.114.97.3
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
2f4688f9f05517273c12309db634dce9cda32628fec44980e82e3f75725bab4e
4b01a0a34ce8ed4bc8a8713be0442d49da6a756236b7b4424622ca3dee820f41
54b66901592d09fe8d36292e4e275bc23b99764073dc6b32bc99c3d7bbc6e1c8
663053ef895163d7525641d5b675f92e1a3eeb361b6a2ae766bd04a0ac1549c9
7530b843a86f3155ce07cda787a40da87052664b09c22f3d4db5e9238664dbe0
8b34a475187302935336bf43a2bf2a4e0adb9a1e87953ea51f6fcf0ef52a4a1d
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93
90682803943448f3acffc81014c87fdd71f30d8cf97335fcea451fac1e568221
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21
c2ffc260a37236328831525588132349d430ff120257ae3150c3f233e6dec743
d8f5ab3e00202fd3b45be1acd95d677b137064001e171bc79b06826d98f1e1d3
df2e852c347ecf82f70a0c8a4b91713fbb0914d58f2cbab01316bfe646abee7c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4e1e65871749d18aea150643c07e0aab2057da057c6c57ec1c3c43580e1c898
f2a6aec6bd796879be1868adc44ca6e22bf7bbac484e6a2a896f09b08463d41c

dfgrt.pivitai.net Open in urlscan Pro 172.67.223.170 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

21 Requests

86 %HTTPS

0 %IPv6

3 Domains

8 Subdomains

2 IPs

2 Countries

396 kBTransfer

1310 kBSize

14 Cookies

0 Outgoing links

Page URL History

Redirected requests

21 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 5 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

18 JavaScript Global Variables

14 Cookies

1 Console Messages

Indicators

dfgrt.pivitai.net Open in urlscan Pro
172.67.223.170 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

21
Requests

86 %
HTTPS

0 %
IPv6

3
Domains

8
Subdomains

2
IPs

2
Countries

396 kB
Transfer

1310 kB
Size

14
Cookies

21 HTTP transactions
5 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!