10gin-rnicosotfon1ine.msfs0nln.com Open in urlscan Pro
18.207.204.205 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://10gin-rnicosotfon1ine.msfs0nln.com/8nh56fd
Effective URL:
https://10gin-rnicosotfon1ine.msfs0nln.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3...
Submission: On September 13 via manual (September 13th 2022, 1:21:10 pm UTC) from GB — Scanned from GB

Summary HTTP 16 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 16 HTTP transactions. The main IP is 18.207.204.205, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is 10gin-rnicosotfon1ine.msfs0nln.com.
TLS certificate: Issued by R3 on September 13th 2022. Valid for: 3 months.

This is the only time 10gin-rnicosotfon1ine.msfs0nln.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
3 7	18.207.204.205 18.207.204.205	14618 (AMAZON-AES) (AMAZON-AES)
12	152.199.23.37 152.199.23.37	15133 (EDGECAST) (EDGECAST)
16	2

7 18.207.204.205 (Ashburn, United States) 3 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-207-204-205.compute-1.amazonaws.com

10gin-rnicosotfon1ine.msfs0nln.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.msfs0nln.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
live.msfs0nln.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 152.199.23.37 (United States)

ASN15133 (EDGECAST, US)

aadcdn.msftauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	msftauth.net aadcdn.msftauth.net — Cisco Umbrella Rank: 2639	196 KB
7	msfs0nln.com 3 redirects 10gin-rnicosotfon1ine.msfs0nln.com www.msfs0nln.com live.msfs0nln.com	360 KB
16	2

	Domain	Requested by
12	aadcdn.msftauth.net	10gin-rnicosotfon1ine.msfs0nln.com aadcdn.msftauth.net
4	10gin-rnicosotfon1ine.msfs0nln.com	2 redirects 10gin-rnicosotfon1ine.msfs0nln.com
2	live.msfs0nln.com	10gin-rnicosotfon1ine.msfs0nln.com aadcdn.msftauth.net
1	www.msfs0nln.com	1 redirects
16	4

This site contains links to these domains. Also see Links.

Domain
live.msfs0nln.com
www.microsoft.com
privacy.microsoft.com

Subject Issuer	Validity	Valid
*.msfs0nln.com R3	`2022-09-13` - `2022-12-12`	3 months	crt.sh
aadcdn.msftauth.net DigiCert SHA2 Secure Server CA	`2022-04-01` - `2023-04-01`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://10gin-rnicosotfon1ine.msfs0nln.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637986720638313308.YjVlMjU1ZjItNTA3MC00ZGMyLWIwNTMtMTg5YmY2ZWVjY2IzMDNlZTU1MTYtNGNhZi00ODBmLWE5YmUtNDgwOWIyOTkyMTkx&ui_locales=en-GB&mkt=en-GB&state=L5kuq9zpMssqWQ8nCFdoDXTclpEt3gOI6JMW93eVmf_jIASwpeVgHb9szBKUz9paBa_fbzMBZBT7h5RzqSnqbLnGFli9vy4sSpfz0-7eX2QfeL3iT3VsiV5hQPsyxL3zzE6nqJclpwR7M743q_n3CzbnyQJ-PXUDFwoFnAHaaDImy62Yltz7U3nhBfjguYmCYf1Hg_DP71SRwKHEOKTpGaXbuz6UNYJMTqy0fLjeroBgZ6onc0mpuePKw_Pqqrf0jv8Zpelur6hfIq2neFiIOA&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.16.0.0&sso_reload=true
Frame ID: B65AB261EA7D11808E1856A4A9BE33D9
Requests: 15 HTTP requests in this frame

Frame: https://live.msfs0nln.com/Me.htm?v=3
Frame ID: F56A0A84433FF3F5099724E5CA2FAA9B
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in to your account

Page URL History Show full URLs

https://10gin-rnicosotfon1ine.msfs0nln.com/8nh56fd HTTP 302
https://10gin-rnicosotfon1ine.msfs0nln.com/ HTTP 302
https://www.msfs0nln.com/login HTTP 302
https://10gin-rnicosotfon1ine.msfs0nln.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&... Page URL
https://10gin-rnicosotfon1ine.msfs0nln.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&... Page URL

Page Statistics

16
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

4
Subdomains

2
IPs

1
Countries

552 kB
Transfer

878 kB
Size

16
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://live.msfs0nln.com/oauth20_authorize.srf?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&scope=openid+profile+https%3a%2f%2fwww.msfs0nln.com%2fv2%2fOfficeHome.All&redirect_uri=https%3a%2f%2fwww.msfs0nln.com%2flandingv2&response_type=code+id_token&state=L5kuq9zpMssqWQ8nCFdoDXTclpEt3gOI6JMW93eVmf_jIASwpeVgHb9szBKUz9paBa_fbzMBZBT7h5RzqSnqbLnGFli9vy4sSpfz0-7eX2QfeL3iT3VsiV5hQPsyxL3zzE6nqJclpwR7M743q_n3CzbnyQJ-PXUDFwoFnAHaaDImy62Yltz7U3nhBfjguYmCYf1Hg_DP71SRwKHEOKTpGaXbuz6UNYJMTqy0fLjeroBgZ6onc0mpuePKw_Pqqrf0jv8Zpelur6hfIq2neFiIOA&response_mode=form_post&nonce=637986720638313308.YjVlMjU1ZjItNTA3MC00ZGMyLWIwNTMtMTg5YmY2ZWVjY2IzMDNlZTU1MTYtNGNhZi00ODBmLWE5YmUtNDgwOWIyOTkyMTkx&x-client-SKU=ID_NETSTANDARD2_0&x-client-Ver=6.16.0.0&uaid=d41d0cb8a8b84d27963befc94512dca4&msproxy=1&issuer=mso&tenant=common&ui_locales=en-GB&signup=1&lw=1&fl=easi2&epct=AQABAAAAAAD--DLA3VO7QrddgJg7WevrIAjUX3sOJJYXEIYQlYJ9-oh1s8qMc46F0Age2DyOTy3QtGEexMDXgDB9ws2tQNzNB08TN7ihOfPyH04w36vAyxXl0klQINWRtMT9OtzGJZscummVjsv8r_y3kOKteDTrjgDL9FmZm9rJCYGsJworNwLnJsP8nE6CsDHu7fD5-5-nyh_v1oWtFBYBaFsnp8g2I35P2o4iwuCAQS3SDR0_aiAA&jshs=0
Title: Create one!

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/en-GB/servicesagreement/
Title: Terms of use

Search URL Search Domain Scan URL

URL: https://privacy.microsoft.com/en-GB/privacystatement
Title: Privacy & cookies

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://10gin-rnicosotfon1ine.msfs0nln.com/8nh56fd HTTP 302
https://10gin-rnicosotfon1ine.msfs0nln.com/ HTTP 302
https://www.msfs0nln.com/login HTTP 302
https://10gin-rnicosotfon1ine.msfs0nln.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637986720638313308.YjVlMjU1ZjItNTA3MC00ZGMyLWIwNTMtMTg5YmY2ZWVjY2IzMDNlZTU1MTYtNGNhZi00ODBmLWE5YmUtNDgwOWIyOTkyMTkx&ui_locales=en-GB&mkt=en-GB&state=L5kuq9zpMssqWQ8nCFdoDXTclpEt3gOI6JMW93eVmf_jIASwpeVgHb9szBKUz9paBa_fbzMBZBT7h5RzqSnqbLnGFli9vy4sSpfz0-7eX2QfeL3iT3VsiV5hQPsyxL3zzE6nqJclpwR7M743q_n3CzbnyQJ-PXUDFwoFnAHaaDImy62Yltz7U3nhBfjguYmCYf1Hg_DP71SRwKHEOKTpGaXbuz6UNYJMTqy0fLjeroBgZ6onc0mpuePKw_Pqqrf0jv8Zpelur6hfIq2neFiIOA&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.16.0.0 Page URL
https://10gin-rnicosotfon1ine.msfs0nln.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637986720638313308.YjVlMjU1ZjItNTA3MC00ZGMyLWIwNTMtMTg5YmY2ZWVjY2IzMDNlZTU1MTYtNGNhZi00ODBmLWE5YmUtNDgwOWIyOTkyMTkx&ui_locales=en-GB&mkt=en-GB&state=L5kuq9zpMssqWQ8nCFdoDXTclpEt3gOI6JMW93eVmf_jIASwpeVgHb9szBKUz9paBa_fbzMBZBT7h5RzqSnqbLnGFli9vy4sSpfz0-7eX2QfeL3iT3VsiV5hQPsyxL3zzE6nqJclpwR7M743q_n3CzbnyQJ-PXUDFwoFnAHaaDImy62Yltz7U3nhBfjguYmCYf1Hg_DP71SRwKHEOKTpGaXbuz6UNYJMTqy0fLjeroBgZ6onc0mpuePKw_Pqqrf0jv8Zpelur6hfIq2neFiIOA&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.16.0.0&sso_reload=true Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://10gin-rnicosotfon1ine.msfs0nln.com/8nh56fd HTTP 302
https://10gin-rnicosotfon1ine.msfs0nln.com/ HTTP 302
https://www.msfs0nln.com/login HTTP 302
https://10gin-rnicosotfon1ine.msfs0nln.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637986720638313308.YjVlMjU1ZjItNTA3MC00ZGMyLWIwNTMtMTg5YmY2ZWVjY2IzMDNlZTU1MTYtNGNhZi00ODBmLWE5YmUtNDgwOWIyOTkyMTkx&ui_locales=en-GB&mkt=en-GB&state=L5kuq9zpMssqWQ8nCFdoDXTclpEt3gOI6JMW93eVmf_jIASwpeVgHb9szBKUz9paBa_fbzMBZBT7h5RzqSnqbLnGFli9vy4sSpfz0-7eX2QfeL3iT3VsiV5hQPsyxL3zzE6nqJclpwR7M743q_n3CzbnyQJ-PXUDFwoFnAHaaDImy62Yltz7U3nhBfjguYmCYf1Hg_DP71SRwKHEOKTpGaXbuz6UNYJMTqy0fLjeroBgZ6onc0mpuePKw_Pqqrf0jv8Zpelur6hfIq2neFiIOA&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.16.0.0

16 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	authorize Show response 10gin-rnicosotfon1ine.msfs0nln.com/common/oauth2/v2.0/ Redirect Chain https://10gin-rnicosotfon1ine.msfs0nln.com/8nh56fd https://10gin-rnicosotfon1ine.msfs0nln.com/ https://www.msfs0nln.com/login https://10gin-rnicosotfon1ine.msfs0nln.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_...	152 KB 153 KB	978ms 751ms	Document text/html	18.207.204.205 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://10gin-rnicosotfon1ine.msfs0nln.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637986720638313308.YjVlMjU1ZjItNTA3MC00ZGMyLWIwNTMtMTg5YmY2ZWVjY2IzMDNlZTU1MTYtNGNhZi00ODBmLWE5YmUtNDgwOWIyOTkyMTkx&ui_locales=en-GB&mkt=en-GB&state=L5kuq9zpMssqWQ8nCFdoDXTclpEt3gOI6JMW93eVmf_jIASwpeVgHb9szBKUz9paBa_fbzMBZBT7h5RzqSnqbLnGFli9vy4sSpfz0-7eX2QfeL3iT3VsiV5hQPsyxL3zzE6nqJclpwR7M743q_n3CzbnyQJ-PXUDFwoFnAHaaDImy62Yltz7U3nhBfjguYmCYf1Hg_DP71SRwKHEOKTpGaXbuz6UNYJMTqy0fLjeroBgZ6onc0mpuePKw_Pqqrf0jv8Zpelur6hfIq2neFiIOA&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.16.0.0 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 18.207.204.205 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-207-204-205.compute-1.amazonaws.com Software / Resource Hash `dccc1de1009df30e7e282dd5d090fe7afdbe81367efb91f9aa50166a2ddc31eb` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 accept-language en-GB,en;q=0.9 Response headers Cache-Control no-store, no-cache Connection close Content-Type text/html; charset=utf-8 Date Tue, 13 Sep 2022 13:21:03 GMT Expires -1 Nel {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} P3p CP="DSP CUR OTPi IND OTRi ONL FIN" Pragma no-cache Referrer-Policy strict-origin-when-cross-origin Report-To {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+dub1"}]} Transfer-Encoding chunked Vary Accept-Encoding X-Ms-Clitelem 1,50168,0,, X-Ms-Ests-Server 2.1.13622.7 - WEULR2 ProdSlices X-Ms-Request-Id a1987f62-3507-4f05-a491-2c6e5e0c1900 Redirect headers Connection close Content-Encoding gzip Content-Type text/html; charset=utf-8 Date Tue, 13 Sep 2022 13:21:02 GMT Location https://10gin-rnicosotfon1ine.msfs0nln.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637986720638313308.YjVlMjU1ZjItNTA3MC00ZGMyLWIwNTMtMTg5YmY2ZWVjY2IzMDNlZTU1MTYtNGNhZi00ODBmLWE5YmUtNDgwOWIyOTkyMTkx&ui_locales=en-GB&mkt=en-GB&state=L5kuq9zpMssqWQ8nCFdoDXTclpEt3gOI6JMW93eVmf_jIASwpeVgHb9szBKUz9paBa_fbzMBZBT7h5RzqSnqbLnGFli9vy4sSpfz0-7eX2QfeL3iT3VsiV5hQPsyxL3zzE6nqJclpwR7M743q_n3CzbnyQJ-PXUDFwoFnAHaaDImy62Yltz7U3nhBfjguYmCYf1Hg_DP71SRwKHEOKTpGaXbuz6UNYJMTqy0fLjeroBgZ6onc0mpuePKw_Pqqrf0jv8Zpelur6hfIq2neFiIOA&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.16.0.0 Referrer-Policy strict-origin-when-cross-origin Request-Context appId= Transfer-Encoding chunked Vary Accept-Encoding X-Cache CONFIG_NOCACHE X-Msedge-Ref Ref A: C05ACBF8CD2047868933DBC16EA50B48 Ref B: AMS04EDGE2712 Ref C: 2022-09-13T13:21:03Z X-Ua-Compatible IE=edge,chrome=1
GET H/1.1	200 OK	Primary Request authorize Show response 10gin-rnicosotfon1ine.msfs0nln.com/common/oauth2/v2.0/	199 KB 200 KB	892ms 665ms	Document text/html	18.207.204.205 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://10gin-rnicosotfon1ine.msfs0nln.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637986720638313308.YjVlMjU1ZjItNTA3MC00ZGMyLWIwNTMtMTg5YmY2ZWVjY2IzMDNlZTU1MTYtNGNhZi00ODBmLWE5YmUtNDgwOWIyOTkyMTkx&ui_locales=en-GB&mkt=en-GB&state=L5kuq9zpMssqWQ8nCFdoDXTclpEt3gOI6JMW93eVmf_jIASwpeVgHb9szBKUz9paBa_fbzMBZBT7h5RzqSnqbLnGFli9vy4sSpfz0-7eX2QfeL3iT3VsiV5hQPsyxL3zzE6nqJclpwR7M743q_n3CzbnyQJ-PXUDFwoFnAHaaDImy62Yltz7U3nhBfjguYmCYf1Hg_DP71SRwKHEOKTpGaXbuz6UNYJMTqy0fLjeroBgZ6onc0mpuePKw_Pqqrf0jv8Zpelur6hfIq2neFiIOA&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.16.0.0&sso_reload=true Requested by Host: 10gin-rnicosotfon1ine.msfs0nln.com URL: https://10gin-rnicosotfon1ine.msfs0nln.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637986720638313308.YjVlMjU1ZjItNTA3MC00ZGMyLWIwNTMtMTg5YmY2ZWVjY2IzMDNlZTU1MTYtNGNhZi00ODBmLWE5YmUtNDgwOWIyOTkyMTkx&ui_locales=en-GB&mkt=en-GB&state=L5kuq9zpMssqWQ8nCFdoDXTclpEt3gOI6JMW93eVmf_jIASwpeVgHb9szBKUz9paBa_fbzMBZBT7h5RzqSnqbLnGFli9vy4sSpfz0-7eX2QfeL3iT3VsiV5hQPsyxL3zzE6nqJclpwR7M743q_n3CzbnyQJ-PXUDFwoFnAHaaDImy62Yltz7U3nhBfjguYmCYf1Hg_DP71SRwKHEOKTpGaXbuz6UNYJMTqy0fLjeroBgZ6onc0mpuePKw_Pqqrf0jv8Zpelur6hfIq2neFiIOA&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.16.0.0 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 18.207.204.205 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-207-204-205.compute-1.amazonaws.com Software / Resource Hash `c69c432185f7e506f0621295e9e8779c2d2e05a18e77db9f33cfc4c002c8b4bf` Request headers Referer https://10gin-rnicosotfon1ine.msfs0nln.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637986720638313308.YjVlMjU1ZjItNTA3MC00ZGMyLWIwNTMtMTg5YmY2ZWVjY2IzMDNlZTU1MTYtNGNhZi00ODBmLWE5YmUtNDgwOWIyOTkyMTkx&ui_locales=en-GB&mkt=en-GB&state=L5kuq9zpMssqWQ8nCFdoDXTclpEt3gOI6JMW93eVmf_jIASwpeVgHb9szBKUz9paBa_fbzMBZBT7h5RzqSnqbLnGFli9vy4sSpfz0-7eX2QfeL3iT3VsiV5hQPsyxL3zzE6nqJclpwR7M743q_n3CzbnyQJ-PXUDFwoFnAHaaDImy62Yltz7U3nhBfjguYmCYf1Hg_DP71SRwKHEOKTpGaXbuz6UNYJMTqy0fLjeroBgZ6onc0mpuePKw_Pqqrf0jv8Zpelur6hfIq2neFiIOA&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.16.0.0 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 accept-language en-GB,en;q=0.9 Response headers Cache-Control no-store, no-cache Connection close Content-Type text/html; charset=utf-8 Date Tue, 13 Sep 2022 13:21:05 GMT Expires -1 Link <https://aadcdn.msftauth.net>; rel=preconnect; crossorigin <https://aadcdn.msftauth.net>; rel=dns-prefetch <https://aadcdn.msauth.net>; rel=dns-prefetch Nel {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} P3p CP="DSP CUR OTPi IND OTRi ONL FIN" Pragma no-cache Referrer-Policy strict-origin-when-cross-origin Report-To {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+dub1"}]} Transfer-Encoding chunked Vary Accept-Encoding X-Dns-Prefetch-Control on X-Ms-Clitelem 1,0,0,, X-Ms-Ests-Server 2.1.13562.12 - NEULR2 ProdSlices X-Ms-Request-Id c3e3089e-6d32-43a9-a9e0-b430c8b5d000
GET H/1.1	200 OK	Me.htm live.msfs0nln.com/	0 0	1160ms 900ms	Other text/html	18.207.204.205 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://live.msfs0nln.com/Me.htm?v=3 Requested by Host: 10gin-rnicosotfon1ine.msfs0nln.com URL: https://10gin-rnicosotfon1ine.msfs0nln.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637986720638313308.YjVlMjU1ZjItNTA3MC00ZGMyLWIwNTMtMTg5YmY2ZWVjY2IzMDNlZTU1MTYtNGNhZi00ODBmLWE5YmUtNDgwOWIyOTkyMTkx&ui_locales=en-GB&mkt=en-GB&state=L5kuq9zpMssqWQ8nCFdoDXTclpEt3gOI6JMW93eVmf_jIASwpeVgHb9szBKUz9paBa_fbzMBZBT7h5RzqSnqbLnGFli9vy4sSpfz0-7eX2QfeL3iT3VsiV5hQPsyxL3zzE6nqJclpwR7M743q_n3CzbnyQJ-PXUDFwoFnAHaaDImy62Yltz7U3nhBfjguYmCYf1Hg_DP71SRwKHEOKTpGaXbuz6UNYJMTqy0fLjeroBgZ6onc0mpuePKw_Pqqrf0jv8Zpelur6hfIq2neFiIOA&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.16.0.0&sso_reload=true Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 18.207.204.205 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-207-204-205.compute-1.amazonaws.com Software / Resource Hash Request headers accept-language en-GB,en;q=0.9 Referer https://10gin-rnicosotfon1ine.msfs0nln.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers
GET H2	200	ConvergedLogin_PCore_rEkixmwXrnf1ZoXlPzTPPA2.js Show response aadcdn.msftauth.net/shared/1.0/content/js/	383 KB 109 KB	136ms 29ms	Script application/x-javascript	152.199.23.37 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_rEkixmwXrnf1ZoXlPzTPPA2.js Requested by Host: 10gin-rnicosotfon1ine.msfs0nln.com URL: https://10gin-rnicosotfon1ine.msfs0nln.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637986720638313308.YjVlMjU1ZjItNTA3MC00ZGMyLWIwNTMtMTg5YmY2ZWVjY2IzMDNlZTU1MTYtNGNhZi00ODBmLWE5YmUtNDgwOWIyOTkyMTkx&ui_locales=en-GB&mkt=en-GB&state=L5kuq9zpMssqWQ8nCFdoDXTclpEt3gOI6JMW93eVmf_jIASwpeVgHb9szBKUz9paBa_fbzMBZBT7h5RzqSnqbLnGFli9vy4sSpfz0-7eX2QfeL3iT3VsiV5hQPsyxL3zzE6nqJclpwR7M743q_n3CzbnyQJ-PXUDFwoFnAHaaDImy62Yltz7U3nhBfjguYmCYf1Hg_DP71SRwKHEOKTpGaXbuz6UNYJMTqy0fLjeroBgZ6onc0mpuePKw_Pqqrf0jv8Zpelur6hfIq2neFiIOA&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.16.0.0&sso_reload=true Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.23.37 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (lhd/35A2) / Resource Hash `564118b5f28d90632e7ca3487f8a208b0e7b5fe68fcda0c950986107a5ce2c65` Request headers Referer https://10gin-rnicosotfon1ine.msfs0nln.com/ Origin https://10gin-rnicosotfon1ine.msfs0nln.com accept-language en-GB,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 13 Sep 2022 13:21:06 GMT content-encoding gzip content-md5 fK2AK6jDg6/4KCAAbseoGQ== age 3356803 x-cache HIT content-length 111291 x-ms-lease-status unlocked last-modified Thu, 04 Aug 2022 19:52:57 GMT server ECAcc (lhd/35A2) etag 0x8DA7652EDA85098 vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id 90445180-101e-0063-46ec-a8af16000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	converged.v2.login.min_8owwt4u-33ps0wawi7tmow2.css aadcdn.msftauth.net/ests/2.1/content/cdnbundles/	0 20 KB	120ms 33ms	Other text/css	152.199.23.37 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_8owwt4u-33ps0wawi7tmow2.css Requested by Host: 10gin-rnicosotfon1ine.msfs0nln.com URL: https://10gin-rnicosotfon1ine.msfs0nln.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637986720638313308.YjVlMjU1ZjItNTA3MC00ZGMyLWIwNTMtMTg5YmY2ZWVjY2IzMDNlZTU1MTYtNGNhZi00ODBmLWE5YmUtNDgwOWIyOTkyMTkx&ui_locales=en-GB&mkt=en-GB&state=L5kuq9zpMssqWQ8nCFdoDXTclpEt3gOI6JMW93eVmf_jIASwpeVgHb9szBKUz9paBa_fbzMBZBT7h5RzqSnqbLnGFli9vy4sSpfz0-7eX2QfeL3iT3VsiV5hQPsyxL3zzE6nqJclpwR7M743q_n3CzbnyQJ-PXUDFwoFnAHaaDImy62Yltz7U3nhBfjguYmCYf1Hg_DP71SRwKHEOKTpGaXbuz6UNYJMTqy0fLjeroBgZ6onc0mpuePKw_Pqqrf0jv8Zpelur6hfIq2neFiIOA&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.16.0.0&sso_reload=true Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.23.37 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (lhd/35DF) / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language en-GB,en;q=0.9 Referer https://10gin-rnicosotfon1ine.msfs0nln.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 13 Sep 2022 13:21:06 GMT content-encoding gzip content-md5 9K2/nGCj75WAmmAI9nZNCA== age 3356802 x-cache HIT content-length 19970 x-ms-lease-status unlocked last-modified Thu, 04 Aug 2022 19:37:00 GMT server ECAcc (lhd/35DF) etag 0x8DA7650B375AC9B vary Accept-Encoding content-type text/css access-control-allow-origin * x-ms-request-id 1880728f-601e-003a-08ec-a835be000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	ux.converged.login.strings-en-gb.min_oy15s3rolvbiuqiq4jjeew2.js aadcdn.msftauth.net/ests/2.1/content/cdnbundles/	0 13 KB	120ms 33ms	Other application/x-javascript	152.199.23.37 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en-gb.min_oy15s3rolvbiuqiq4jjeew2.js Requested by Host: 10gin-rnicosotfon1ine.msfs0nln.com URL: https://10gin-rnicosotfon1ine.msfs0nln.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637986720638313308.YjVlMjU1ZjItNTA3MC00ZGMyLWIwNTMtMTg5YmY2ZWVjY2IzMDNlZTU1MTYtNGNhZi00ODBmLWE5YmUtNDgwOWIyOTkyMTkx&ui_locales=en-GB&mkt=en-GB&state=L5kuq9zpMssqWQ8nCFdoDXTclpEt3gOI6JMW93eVmf_jIASwpeVgHb9szBKUz9paBa_fbzMBZBT7h5RzqSnqbLnGFli9vy4sSpfz0-7eX2QfeL3iT3VsiV5hQPsyxL3zzE6nqJclpwR7M743q_n3CzbnyQJ-PXUDFwoFnAHaaDImy62Yltz7U3nhBfjguYmCYf1Hg_DP71SRwKHEOKTpGaXbuz6UNYJMTqy0fLjeroBgZ6onc0mpuePKw_Pqqrf0jv8Zpelur6hfIq2neFiIOA&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.16.0.0&sso_reload=true Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.23.37 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (lhd/3595) / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers accept-language en-GB,en;q=0.9 Referer https://10gin-rnicosotfon1ine.msfs0nln.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 13 Sep 2022 13:21:06 GMT content-encoding gzip content-md5 HiI4MeP+AvX+9JWdctPzVQ== age 3352992 x-cache HIT content-length 13586 x-ms-lease-status unlocked last-modified Fri, 05 Aug 2022 00:57:12 GMT server ECAcc (lhd/3595) etag 0x8DA767D6E69AC61 vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id 527d0280-001e-0069-76f4-a88554000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	convergedlogin_pfetchsessionsprogress_49afc9cacb9cfd40c503.js Show response aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/	15 KB 6 KB	115ms 30ms	Script application/x-javascript	152.199.23.37 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_49afc9cacb9cfd40c503.js Requested by Host: aadcdn.msftauth.net URL: https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_rEkixmwXrnf1ZoXlPzTPPA2.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.23.37 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (lhd/35A9) / Resource Hash `f78a659d1f272f9c0aceb7be9ee1c095a2c52e136ba712602520e7a268583b66` Request headers accept-language en-GB,en;q=0.9 Referer https://10gin-rnicosotfon1ine.msfs0nln.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 13 Sep 2022 13:21:06 GMT content-encoding gzip content-md5 GBMq8b7F7EUzg0oe2bIzrg== age 3900170 x-cache HIT content-length 5529 x-ms-lease-status unlocked last-modified Tue, 26 Jul 2022 23:51:51 GMT server ECAcc (lhd/35A9) etag 0x8DA6F61CFC685FC vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id 0d7a4abe-301e-009f-1dfa-a3a60b000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	marching_ants_white_166de53471265253ab3a456defe6da23.gif aadcdn.msftauth.net/shared/1.0/content/images/	3 KB 3 KB	115ms 32ms	Image image/gif	152.199.23.37 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msftauth.net/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.23.37 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (lhd/35DC) / Resource Hash `a46201581a7c7c667fd42787cd1e9adf2f6bf809efb7596e61a03e8dba9ada13` Request headers accept-language en-GB,en;q=0.9 Referer https://10gin-rnicosotfon1ine.msfs0nln.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 13 Sep 2022 13:21:06 GMT content-md5 Fm3lNHEmUlOrOkVt7+baIw== age 10762076 x-cache HIT content-length 2672 x-ms-lease-status unlocked last-modified Thu, 16 Jan 2020 00:32:52 GMT server ECAcc (lhd/35DC) etag 0x8D79A1B9F2C6EC8 content-type image/gif access-control-allow-origin * x-ms-request-id 3cb1ccf0-e01e-007c-1992-652fdd000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif aadcdn.msftauth.net/shared/1.0/content/images/	4 KB 4 KB	112ms 29ms	Image image/gif	152.199.23.37 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msftauth.net/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.23.37 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (lhd/35B5) / Resource Hash `8737d721808655f37b333f08a90185699e7e8b9bdaaa15cdb63c8448b426f95d` Request headers accept-language en-GB,en;q=0.9 Referer https://10gin-rnicosotfon1ine.msfs0nln.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 13 Sep 2022 13:21:06 GMT content-md5 tUCo5RgDcZLjLE/li/Lbqw== age 10762076 x-cache HIT content-length 3620 x-ms-lease-status unlocked last-modified Thu, 16 Jan 2020 00:32:52 GMT server ECAcc (lhd/35B5) etag 0x8D79A1B9F8A840E content-type image/gif access-control-allow-origin * x-ms-request-id 94c54aee-301e-0034-4592-65f450000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	convergedlogin_pcustomizationloader_ce7e28197b4125ce53e0.js Show response aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/	107 KB 32 KB	29ms 29ms	Script application/x-javascript	152.199.23.37 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_ce7e28197b4125ce53e0.js Requested by Host: aadcdn.msftauth.net URL: https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_rEkixmwXrnf1ZoXlPzTPPA2.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.23.37 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (lhd/35E2) / Resource Hash `106c7ae6e865f487b4fc75aac19b535d73fa8f13507884259be7393b5c5f5494` Request headers accept-language en-GB,en;q=0.9 Referer https://10gin-rnicosotfon1ine.msfs0nln.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 13 Sep 2022 13:21:07 GMT content-encoding gzip content-md5 uFX3Qhp/F7U6+waIHizpeA== age 3356803 x-cache HIT content-length 32173 x-ms-lease-status unlocked last-modified Tue, 02 Aug 2022 03:12:31 GMT server ECAcc (lhd/35E2) etag 0x8DA7434D67D7930 vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id 90233c83-401e-0083-0cec-a8d5a0000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	2_bc3d32a696895f78c19df6c717586a5d.svg aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/	2 KB 837 B	30ms 28ms	Image image/svg+xml	152.199.23.37 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.23.37 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (lhd/359B) / Resource Hash `0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68` Request headers accept-language en-GB,en;q=0.9 Referer https://10gin-rnicosotfon1ine.msfs0nln.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 13 Sep 2022 13:21:07 GMT content-encoding gzip content-md5 DhdidjYrlCeaRJJRG/y9mA== age 10762074 x-cache HIT content-length 673 x-ms-lease-status unlocked last-modified Wed, 12 Feb 2020 22:01:50 GMT server ECAcc (lhd/359B) etag 0x8D7B007297AE131 vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-ms-request-id b3a7c299-201e-005c-1592-65518c000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg aadcdn.msftauth.net/shared/1.0/content/images/	4 KB 2 KB	35ms 34ms	Image image/svg+xml	152.199.23.37 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msftauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.23.37 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (lhd/35E6) / Resource Hash `04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a` Request headers accept-language en-GB,en;q=0.9 Referer https://10gin-rnicosotfon1ine.msfs0nln.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 13 Sep 2022 13:21:07 GMT content-encoding gzip content-md5 nzaLxFgP7ZB3dfMcaybWzw== age 10762071 x-cache HIT content-length 1435 x-ms-lease-status unlocked last-modified Thu, 16 Jan 2020 00:32:52 GMT server ECAcc (lhd/35E6) etag 0x8D79A1B9F5E121A vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-ms-request-id 44c12dc5-e01e-0018-6392-654682000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	marching_ants_white_166de53471265253ab3a456defe6da23.gif aadcdn.msftauth.net/shared/1.0/content/images/	3 KB 3 KB	35ms 34ms	Image image/gif	152.199.23.37 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msftauth.net/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif Requested by Host: aadcdn.msftauth.net URL: https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_rEkixmwXrnf1ZoXlPzTPPA2.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.23.37 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (lhd/35DC) / Resource Hash `a46201581a7c7c667fd42787cd1e9adf2f6bf809efb7596e61a03e8dba9ada13` Request headers accept-language en-GB,en;q=0.9 Referer https://10gin-rnicosotfon1ine.msfs0nln.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 13 Sep 2022 13:21:07 GMT content-md5 Fm3lNHEmUlOrOkVt7+baIw== age 10762077 x-cache HIT content-length 2672 x-ms-lease-status unlocked last-modified Thu, 16 Jan 2020 00:32:52 GMT server ECAcc (lhd/35DC) etag 0x8D79A1B9F2C6EC8 content-type image/gif access-control-allow-origin * x-ms-request-id 3cb1ccf0-e01e-007c-1992-652fdd000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif aadcdn.msftauth.net/shared/1.0/content/images/	4 KB 4 KB	36ms 35ms	Image image/gif	152.199.23.37 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msftauth.net/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif Requested by Host: aadcdn.msftauth.net URL: https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_rEkixmwXrnf1ZoXlPzTPPA2.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.23.37 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (lhd/35B5) / Resource Hash `8737d721808655f37b333f08a90185699e7e8b9bdaaa15cdb63c8448b426f95d` Request headers accept-language en-GB,en;q=0.9 Referer https://10gin-rnicosotfon1ine.msfs0nln.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 13 Sep 2022 13:21:07 GMT content-md5 tUCo5RgDcZLjLE/li/Lbqw== age 10762077 x-cache HIT content-length 3620 x-ms-lease-status unlocked last-modified Thu, 16 Jan 2020 00:32:52 GMT server ECAcc (lhd/35B5) etag 0x8D79A1B9F8A840E content-type image/gif access-control-allow-origin * x-ms-request-id 94c54aee-301e-0034-4592-65f450000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H/1.1	200 OK	Me.htm Show response live.msfs0nln.com/ Frame F56A	2 KB 3 KB	827ms 595ms	Document text/html	18.207.204.205 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://live.msfs0nln.com/Me.htm?v=3 Requested by Host: aadcdn.msftauth.net URL: https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_rEkixmwXrnf1ZoXlPzTPPA2.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 18.207.204.205 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS ec2-18-207-204-205.compute-1.amazonaws.com Software / Resource Hash `5fe2ac5f287973903434a3f9f4a49075ef0a2cd2ca46757aca7f890f31b1cf78` Request headers Referer https://10gin-rnicosotfon1ine.msfs0nln.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 accept-language en-GB,en;q=0.9 Response headers Cache-Control max-age=315360000 Connection close Content-Type text/html; charset=utf-8 Date Tue, 13 Sep 2022 13:21:07 GMT Expires Fri, 10 Sep 2032 13:21:07 GMT P3p CP="DSP CUR OTPi IND OTRi ONL FIN" Ppserver PPV: 30 H: BL02PFBA5FEC66C V: 0 Referrer-Policy strict-origin-when-cross-origin Transfer-Encoding chunked Vary Accept-Encoding X-Ms-Request-Id be56a624-c15b-4779-b567-a7f8f1aadab4 X-Ms-Route-Info R3_BL2
GET H2	200	signin-options_4e48046ce74f4b89d45037c90576bfac.svg aadcdn.msftauth.net/shared/1.0/content/images/	2 KB 795 B	29ms 29ms	Image image/svg+xml	152.199.23.37 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msftauth.net/shared/1.0/content/images/signin-options_4e48046ce74f4b89d45037c90576bfac.svg Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.199.23.37 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (lhd/3589) / Resource Hash `8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93` Request headers accept-language en-GB,en;q=0.9 Referer https://10gin-rnicosotfon1ine.msfs0nln.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.5195.102 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 13 Sep 2022 13:21:08 GMT content-encoding gzip content-md5 R2FAVxfpONfnQAuxVxXbHg== age 10762077 x-cache HIT content-length 621 x-ms-lease-status unlocked last-modified Tue, 10 Nov 2020 03:41:05 GMT server ECAcc (lhd/3589) etag 0x8D8852A740F01B9 vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-ms-request-id 101484d9-e01e-005b-7792-654940000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

30 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

16 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.msfs0nln.com/	1970-01-20 05:57:58	Name: wfAr Value: f9d5d7c4d074562ddf0b54a3d691ed99415b3287c7d9feb738634719b40f7ded
.10gin-rnicosotfon1ine.msfs0nln.com/	1969-12-31 23:59:59	Name: esctx Value: AQABAAAAAAD--DLA3VO7QrddgJg7WevrXGLFXrDIA6gVEUkrzyZ631lsvfK5R18KQc_dHyeUJD2IyqEeYkmhEKVXRBZiOvjBRuQDndtd5nhJTfKRmT_TwP5hZ58jb1x8nxjqlegrH7iQgkxJPzXQsThVntFwsXQtjxM8-2A9mkbGAGQa-7cRthaOeatlDztUC3FktrcAn2IgAA
10gin-rnicosotfon1ine.msfs0nln.com/	1969-12-31 23:59:59	Name: x-ms-gateway-slice Value: estsfd
10gin-rnicosotfon1ine.msfs0nln.com/	1969-12-31 23:59:59	Name: stsservicecookie Value: estsfd
www.msfs0nln.com/	1970-01-20 05:58:24	Name: OH.DCAffinity Value: OH-weu
www.msfs0nln.com/	1970-01-20 14:43:31	Name: OH.FLID Value: 30405b77-3320-4fb6-9d46-56f67f435910
www.msfs0nln.com/	1970-01-20 05:57:56	Name: .AspNetCore.OpenIdConnect.Nonce.uc8hBYRrBZs_ZGnlYtZY2riwbn0uBHCy0m2ooTPDvtPOU2zidAbu-tbKicek3omiH0PPHpMfFNXi4-AQNBBkrr30jz10CM_CF-thFrY6S11rAyWYpIzGrF57r1cx8KXkev4Fk6cSx8O9VM1QhvpvTBuqBHpUHBilUg65HjW4U1m7pA4G6fZgsB8xfI7m01_5OA4EoTccTLVxQN7oujZID3eDCI0Xst6b9qeaiHnhrht-tFqG78D3Fs3Q8soN7dg9 Value: N
www.msfs0nln.com/	1970-01-20 05:57:56	Name: .AspNetCore.Correlation.OpenIdConnectV2.fcBkZdqjHsHySjFYLd1myy2D0AbqRYmCX7CCAggjOhQ Value: N
.msfs0nln.com/	1970-01-20 15:19:31	Name: MUID Value: 219B6BE1CBBA6576243B79FFCA3964B4
.10gin-rnicosotfon1ine.msfs0nln.com/	1969-12-31 23:59:59	Name: AADSSO Value: NA\|NoExtension
10gin-rnicosotfon1ine.msfs0nln.com/	1970-01-20 05:57:55	Name: SSOCOOKIEPULLED Value: 1
10gin-rnicosotfon1ine.msfs0nln.com/	1970-01-20 06:41:07	Name: buid Value: 0.ATAAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAD--DLA3VO7QrddgJg7WevrrmkW6u6Ik8ZYdhMnz0yGCqY1cNUpfbnhlYF5KqNJ7NVWBA6lJCg53yklJRr_fVaquN6ecYaCbBuNNlNyP6jOui5ID7ZDlMxDjZiwrwSIJiogAA
10gin-rnicosotfon1ine.msfs0nln.com/	1970-01-20 06:41:07	Name: fpc Value: AjrznCRnBw1IoPNORRq0tZa8Ae7AAQAAAMB6stoOAAAA
.10gin-rnicosotfon1ine.msfs0nln.com/	1970-01-20 15:19:31	Name: brcap Value: 0
.live.msfs0nln.com/	1969-12-31 23:59:59	Name: MSPRequ Value: id=N&lt=1663075267&co=1
.live.msfs0nln.com/	1969-12-31 23:59:59	Name: uaid Value: ef889ff2f2bb47c685c8c9402740aec7

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

10gin-rnicosotfon1ine.msfs0nln.com
aadcdn.msftauth.net
live.msfs0nln.com
www.msfs0nln.com
152.199.23.37
18.207.204.205
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
106c7ae6e865f487b4fc75aac19b535d73fa8f13507884259be7393b5c5f5494
564118b5f28d90632e7ca3487f8a208b0e7b5fe68fcda0c950986107a5ce2c65
5fe2ac5f287973903434a3f9f4a49075ef0a2cd2ca46757aca7f890f31b1cf78
8737d721808655f37b333f08a90185699e7e8b9bdaaa15cdb63c8448b426f95d
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93
a46201581a7c7c667fd42787cd1e9adf2f6bf809efb7596e61a03e8dba9ada13
c69c432185f7e506f0621295e9e8779c2d2e05a18e77db9f33cfc4c002c8b4bf
dccc1de1009df30e7e282dd5d090fe7afdbe81367efb91f9aa50166a2ddc31eb
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
f78a659d1f272f9c0aceb7be9ee1c095a2c52e136ba712602520e7a268583b66

10gin-rnicosotfon1ine.msfs0nln.com Open in urlscan Pro 18.207.204.205 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

16 Requests

100 %HTTPS

0 %IPv6

2 Domains

4 Subdomains

2 IPs

1 Countries

552 kBTransfer

878 kBSize

16 Cookies

3 Outgoing links

Page URL History

Redirected requests

16 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

30 JavaScript Global Variables

16 Cookies

Indicators

10gin-rnicosotfon1ine.msfs0nln.com Open in urlscan Pro
18.207.204.205 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

16
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

4
Subdomains

2
IPs

1
Countries

552 kB
Transfer

878 kB
Size

16
Cookies

16 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!