office.hrcrch.com Open in urlscan Pro
67.205.131.145 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://sp.authpoint.usa.hrcrch.com/
Effective URL:
https://office.hrcrch.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3...
Submission: On September 13 via automatic, source certstream-suspicious (September 13th 2024, 1:55:28 am UTC) — Scanned from DE

Summary HTTP 15 Redirects Links 4 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 15 HTTP transactions. The main IP is 67.205.131.145, located in North Bergen, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is office.hrcrch.com.
TLS certificate: Issued by E5 on September 4th 2024. Valid for: 3 months.

This is the only time office.hrcrch.com was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
4 7	67.205.131.145 67.205.131.145	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
12	2606:2800:233... 2606:2800:233:1cb7:261b:1f9c:2074:3c	15133 (EDGECAST) (EDGECAST)
15	2

7 67.205.131.145 (North Bergen, United States) 4 redirects

ASN14061 (DIGITALOCEAN-ASN, US)

sp.authpoint.usa.hrcrch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
office.hrcrch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
react.hrcrch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ywnjb.hrcrch.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 2606:2800:233:1cb7:261b:1f9c:2074:3c (United States)

ASN15133 (EDGECAST, US)

aadcdn.msftauth.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
12	msftauth.net aadcdn.msftauth.net — Cisco Umbrella Rank: 2274	338 KB
7	hrcrch.com 4 redirects sp.authpoint.usa.hrcrch.com office.hrcrch.com react.hrcrch.com ywnjb.hrcrch.com	54 KB
15	2

	Domain	Requested by
12	aadcdn.msftauth.net	office.hrcrch.com aadcdn.msftauth.net
3	office.hrcrch.com	2 redirects
2	ywnjb.hrcrch.com	office.hrcrch.com aadcdn.msftauth.net
1	react.hrcrch.com	1 redirects
1	sp.authpoint.usa.hrcrch.com	1 redirects
15	5

This site contains links to these domains. Also see Links.

Domain
ywnjb.hrcrch.com
www.microsoft.com
privacy.microsoft.com

Subject Issuer	Validity	Valid
office.hrcrch.com E5	`2024-09-04` - `2024-12-03`	3 months	crt.sh
ywnjb.hrcrch.com E6	`2024-09-04` - `2024-12-03`	3 months	crt.sh
aadcdn.msftauth.net DigiCert SHA2 Secure Server CA	`2024-05-25` - `2025-05-25`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://office.hrcrch.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638617893220532349.OGEwNTA4OTMtYmIyYy00ZjlmLTkzNzctNmNmOTUxMGNkMDc0N2JjMDE1N2QtZWUwMS00MzI2LWI1MWYtNWI2YTYxMzQ2MDRi&ui_locales=de-DE&mkt=de-DE&client-request-id=b248b5db-25e0-4426-8d55-0e3b72f6cdfb&state=SyJ7Q7jM6687LWzdOnjqzkl8EGoNGcJYl1xEUXR0EElmcNp1CELyzkmxx2K5pXzRD0hMTqZx-hGbIg9c0Cutr9dHiByeOaa-uLVEDHQnqvG-IAqtnDNZwRArOJFkv4pCgLKz7wDqgRzghvBoqOnR_XA3hHBQxnYGv8Ok9DEvu-B5-FHOEbuar5U0uPDLOpkiWbX-mpWUAjVp_jN4kYB29Aj7FBAo-UCvnWEMsHEJa30YoIR90stUoBmZvUeTwiGFHIfX3LtfIjZ9rO6ZfEunBw&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0
Frame ID: 429F729846200C7986924DAC59657FD8
Requests: 14 HTTP requests in this frame

Frame: https://ywnjb.hrcrch.com/Me.htm?v=3
Frame ID: F8CF22F63B503C7D81796420AC7812E0
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Bei Ihrem Konto anmelden

Page URL History Show full URLs

https://sp.authpoint.usa.hrcrch.com/ HTTP 302
https://office.hrcrch.com/OJmPzqug HTTP 302
https://office.hrcrch.com/ HTTP 302
https://react.hrcrch.com/login HTTP 302
https://office.hrcrch.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&... Page URL

Page Statistics

15
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

5
Subdomains

2
IPs

1
Countries

389 kB
Transfer

1214 kB
Size

15
Cookies

4 Outgoing links

These are links going to different origins than the main page.

URL: https://ywnjb.hrcrch.com/oauth20_authorize.srf?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&scope=openid+profile+https%3a%2f%2freact.hrcrch.com%2fv2%2fOfficeHome.All&redirect_uri=https%3a%2f%2freact.hrcrch.com%2flandingv2&response_type=code+id_token&state=SyJ7Q7jM6687LWzdOnjqzkl8EGoNGcJYl1xEUXR0EElmcNp1CELyzkmxx2K5pXzRD0hMTqZx-hGbIg9c0Cutr9dHiByeOaa-uLVEDHQnqvG-IAqtnDNZwRArOJFkv4pCgLKz7wDqgRzghvBoqOnR_XA3hHBQxnYGv8Ok9DEvu-B5-FHOEbuar5U0uPDLOpkiWbX-mpWUAjVp_jN4kYB29Aj7FBAo-UCvnWEMsHEJa30YoIR90stUoBmZvUeTwiGFHIfX3LtfIjZ9rO6ZfEunBw&response_mode=form_post&nonce=638617893220532349.OGEwNTA4OTMtYmIyYy00ZjlmLTkzNzctNmNmOTUxMGNkMDc0N2JjMDE1N2QtZWUwMS00MzI2LWI1MWYtNWI2YTYxMzQ2MDRi&x-client-SKU=ID_NET8_0&x-client-Ver=7.5.1.0&uaid=b248b5db25e044268d550e3b72f6cdfb&msproxy=1&issuer=mso&tenant=common&ui_locales=de-DE&signup=1&lw=1&fl=easi2&epct=PAQABDgEAAAApTwJmzXqdR4BN2miheQMYC2TTRSeEwiXe6HcFu_jAwb6FXyrRHMaLEiCxU6sDsBo2bTqRATAFNWjWVD596_LxFKd6r3rDBHDvLY2VkVdOItaSo_i8M4bBkXGJqAIGYIUecMwrQ3tmiQEF8eh9ciMFCQrI7oBUo-gv4d8xrjn4C4P0ZEZ0kXNHJNhqKcyHK5HKA25qx-RtJYRji4weSG52nhHrW2mKYLjS4t0jLaei3SAA&jshs=0
Title: Erstellen Sie jetzt eins!

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/de-DE/servicesagreement/
Title: Nutzungsbedingungen

Search URL Search Domain Scan URL

URL: https://privacy.microsoft.com/de-DE/privacystatement
Title: Datenschutz und Cookies

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/de-de/corporate/rechtliche-hinweise/impressum.aspx
Title: Haftungsausschluss

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://sp.authpoint.usa.hrcrch.com/ HTTP 302
https://office.hrcrch.com/OJmPzqug HTTP 302
https://office.hrcrch.com/ HTTP 302
https://react.hrcrch.com/login HTTP 302
https://office.hrcrch.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638617893220532349.OGEwNTA4OTMtYmIyYy00ZjlmLTkzNzctNmNmOTUxMGNkMDc0N2JjMDE1N2QtZWUwMS00MzI2LWI1MWYtNWI2YTYxMzQ2MDRi&ui_locales=de-DE&mkt=de-DE&client-request-id=b248b5db-25e0-4426-8d55-0e3b72f6cdfb&state=SyJ7Q7jM6687LWzdOnjqzkl8EGoNGcJYl1xEUXR0EElmcNp1CELyzkmxx2K5pXzRD0hMTqZx-hGbIg9c0Cutr9dHiByeOaa-uLVEDHQnqvG-IAqtnDNZwRArOJFkv4pCgLKz7wDqgRzghvBoqOnR_XA3hHBQxnYGv8Ok9DEvu-B5-FHOEbuar5U0uPDLOpkiWbX-mpWUAjVp_jN4kYB29Aj7FBAo-UCvnWEMsHEJa30YoIR90stUoBmZvUeTwiGFHIfX3LtfIjZ9rO6ZfEunBw&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

15 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request authorize Show response office.hrcrch.com/common/oauth2/v2.0/ Redirect Chain https://sp.authpoint.usa.hrcrch.com/ https://office.hrcrch.com/OJmPzqug https://office.hrcrch.com/ https://react.hrcrch.com/login https://office.hrcrch.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openi...	45 KB 47 KB	527ms 303ms	Document text/html	67.205.131.145 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://office.hrcrch.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638617893220532349.OGEwNTA4OTMtYmIyYy00ZjlmLTkzNzctNmNmOTUxMGNkMDc0N2JjMDE1N2QtZWUwMS00MzI2LWI1MWYtNWI2YTYxMzQ2MDRi&ui_locales=de-DE&mkt=de-DE&client-request-id=b248b5db-25e0-4426-8d55-0e3b72f6cdfb&state=SyJ7Q7jM6687LWzdOnjqzkl8EGoNGcJYl1xEUXR0EElmcNp1CELyzkmxx2K5pXzRD0hMTqZx-hGbIg9c0Cutr9dHiByeOaa-uLVEDHQnqvG-IAqtnDNZwRArOJFkv4pCgLKz7wDqgRzghvBoqOnR_XA3hHBQxnYGv8Ok9DEvu-B5-FHOEbuar5U0uPDLOpkiWbX-mpWUAjVp_jN4kYB29Aj7FBAo-UCvnWEMsHEJa30YoIR90stUoBmZvUeTwiGFHIfX3LtfIjZ9rO6ZfEunBw&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 67.205.131.145 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software / Resource Hash `7c7f6e7cfa97fd02425ab94e519fa90368df332547b7d189621dd7b5b2791a2e` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Cache-Control no-store, no-cache Connection close Content-Type text/html; charset=utf-8 Date Fri, 13 Sep 2024 01:55:22 GMT Expires -1 Link <https://aadcdn.msftauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msftauth.net>; rel=dns-prefetch,<https://aadcdn.msauth.net>; rel=dns-prefetch Nel {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} P3p CP="DSP CUR OTPi IND OTRi ONL FIN" Pragma no-cache Referrer-Policy strict-origin-when-cross-origin Report-To {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+bno"}]} Transfer-Encoding chunked Vary Accept-Encoding X-Dns-Prefetch-Control on X-Ms-Clitelem 1,0,0,, X-Ms-Ests-Server 2.1.18841.2 - SCUS ProdSlices X-Ms-Request-Id 08c57dd4-0920-4a27-ad7d-1f4392590a01 X-Ms-Srs 1.P Redirect headers Connection close Content-Encoding gzip Content-Type text/html; charset=utf-8 Date Fri, 13 Sep 2024 01:55:21 GMT Location https://office.hrcrch.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638617893220532349.OGEwNTA4OTMtYmIyYy00ZjlmLTkzNzctNmNmOTUxMGNkMDc0N2JjMDE1N2QtZWUwMS00MzI2LWI1MWYtNWI2YTYxMzQ2MDRi&ui_locales=de-DE&mkt=de-DE&client-request-id=b248b5db-25e0-4426-8d55-0e3b72f6cdfb&state=SyJ7Q7jM6687LWzdOnjqzkl8EGoNGcJYl1xEUXR0EElmcNp1CELyzkmxx2K5pXzRD0hMTqZx-hGbIg9c0Cutr9dHiByeOaa-uLVEDHQnqvG-IAqtnDNZwRArOJFkv4pCgLKz7wDqgRzghvBoqOnR_XA3hHBQxnYGv8Ok9DEvu-B5-FHOEbuar5U0uPDLOpkiWbX-mpWUAjVp_jN4kYB29Aj7FBAo-UCvnWEMsHEJa30YoIR90stUoBmZvUeTwiGFHIfX3LtfIjZ9rO6ZfEunBw&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 Referrer-Policy strict-origin-when-cross-origin Request-Context appId= Transfer-Encoding chunked Vary Accept-Encoding X-Cache CONFIG_NOCACHE X-Msedge-Ref Ref A: D37136B6E9B248378FDBA5DE32BE205D Ref B: EWR311000104029 Ref C: 2024-09-13T01:55:22Z X-Ua-Compatible IE=edge,chrome=1
GET H/1.1	200 OK	Me.htm ywnjb.hrcrch.com/	0 0	582ms 330ms	Other text/html	67.205.131.145 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://ywnjb.hrcrch.com/Me.htm?v=3 Requested by Host: office.hrcrch.com URL: https://office.hrcrch.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638617893220532349.OGEwNTA4OTMtYmIyYy00ZjlmLTkzNzctNmNmOTUxMGNkMDc0N2JjMDE1N2QtZWUwMS00MzI2LWI1MWYtNWI2YTYxMzQ2MDRi&ui_locales=de-DE&mkt=de-DE&client-request-id=b248b5db-25e0-4426-8d55-0e3b72f6cdfb&state=SyJ7Q7jM6687LWzdOnjqzkl8EGoNGcJYl1xEUXR0EElmcNp1CELyzkmxx2K5pXzRD0hMTqZx-hGbIg9c0Cutr9dHiByeOaa-uLVEDHQnqvG-IAqtnDNZwRArOJFkv4pCgLKz7wDqgRzghvBoqOnR_XA3hHBQxnYGv8Ok9DEvu-B5-FHOEbuar5U0uPDLOpkiWbX-mpWUAjVp_jN4kYB29Aj7FBAo-UCvnWEMsHEJa30YoIR90stUoBmZvUeTwiGFHIfX3LtfIjZ9rO6ZfEunBw&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 67.205.131.145 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Referer https://office.hrcrch.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers
GET H2	200	converged.v2.login.min_qzvqnltrxpy99ajspyxbgq2.css aadcdn.msftauth.net/ests/2.1/content/cdnbundles/	111 KB 20 KB	166ms 40ms	Stylesheet text/css	2606:2800:233:1cb7:261b:1f9c:2074:3c EDGECAST
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_qzvqnltrxpy99ajspyxbgq2.css Requested by Host: office.hrcrch.com URL: https://office.hrcrch.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638617893220532349.OGEwNTA4OTMtYmIyYy00ZjlmLTkzNzctNmNmOTUxMGNkMDc0N2JjMDE1N2QtZWUwMS00MzI2LWI1MWYtNWI2YTYxMzQ2MDRi&ui_locales=de-DE&mkt=de-DE&client-request-id=b248b5db-25e0-4426-8d55-0e3b72f6cdfb&state=SyJ7Q7jM6687LWzdOnjqzkl8EGoNGcJYl1xEUXR0EElmcNp1CELyzkmxx2K5pXzRD0hMTqZx-hGbIg9c0Cutr9dHiByeOaa-uLVEDHQnqvG-IAqtnDNZwRArOJFkv4pCgLKz7wDqgRzghvBoqOnR_XA3hHBQxnYGv8Ok9DEvu-B5-FHOEbuar5U0uPDLOpkiWbX-mpWUAjVp_jN4kYB29Aj7FBAo-UCvnWEMsHEJa30YoIR90stUoBmZvUeTwiGFHIfX3LtfIjZ9rO6ZfEunBw&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/4D08) / Resource Hash `1f8ceb44fe7cfcf7e71dbd5122210335ca3821d697a851d2900b95af7d92d69d` Request headers Referer https://office.hrcrch.com/ Origin https://office.hrcrch.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Fri, 13 Sep 2024 01:55:23 GMT content-encoding gzip content-md5 SJgdPPV+fFjKfj6FHvk1Tg== age 6068243 x-cache HIT content-length 20414 x-ms-lease-status unlocked last-modified Wed, 03 Jul 2024 21:49:46 GMT server ECAcc (frc/4D08) etag 0x8DC9BAA0E5931F9 vary Accept-Encoding content-type text/css access-control-allow-origin * x-ms-request-id 22c2d1bd-501e-006a-1b4f-ce1611000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	ConvergedLogin_PCore_MPdO7dOdkI4kz5U_F5jz_A2.js Show response aadcdn.msftauth.net/shared/1.0/content/js/	439 KB 120 KB	202ms 77ms	Script application/x-javascript	2606:2800:233:1cb7:261b:1f9c:2074:3c EDGECAST
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_MPdO7dOdkI4kz5U_F5jz_A2.js Requested by Host: office.hrcrch.com URL: https://office.hrcrch.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638617893220532349.OGEwNTA4OTMtYmIyYy00ZjlmLTkzNzctNmNmOTUxMGNkMDc0N2JjMDE1N2QtZWUwMS00MzI2LWI1MWYtNWI2YTYxMzQ2MDRi&ui_locales=de-DE&mkt=de-DE&client-request-id=b248b5db-25e0-4426-8d55-0e3b72f6cdfb&state=SyJ7Q7jM6687LWzdOnjqzkl8EGoNGcJYl1xEUXR0EElmcNp1CELyzkmxx2K5pXzRD0hMTqZx-hGbIg9c0Cutr9dHiByeOaa-uLVEDHQnqvG-IAqtnDNZwRArOJFkv4pCgLKz7wDqgRzghvBoqOnR_XA3hHBQxnYGv8Ok9DEvu-B5-FHOEbuar5U0uPDLOpkiWbX-mpWUAjVp_jN4kYB29Aj7FBAo-UCvnWEMsHEJa30YoIR90stUoBmZvUeTwiGFHIfX3LtfIjZ9rO6ZfEunBw&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/4D08) / Resource Hash `9cda4fc8f6f0ed5026abba17cbab8a8f4b2910b4c07cafef892c878926bcf832` Request headers Referer https://office.hrcrch.com/ Origin https://office.hrcrch.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Fri, 13 Sep 2024 01:55:23 GMT content-encoding gzip content-md5 oV6jW3nBAiXnyi0hpysSuA== age 83782 x-cache HIT content-length 122174 x-ms-lease-status unlocked last-modified Fri, 16 Aug 2024 22:51:50 GMT server ECAcc (frc/4D08) etag 0x8DCBE4604122A4D vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id 5c008c46-f01e-0001-31bc-0495f0000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	ux.converged.login.strings-de.min_tribuq1vapo7ftte8npyfg2.js Show response aadcdn.msftauth.net/ests/2.1/content/cdnbundles/	62 KB 18 KB	170ms 44ms	Script application/x-javascript	2606:2800:233:1cb7:261b:1f9c:2074:3c EDGECAST
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-de.min_tribuq1vapo7ftte8npyfg2.js Requested by Host: office.hrcrch.com URL: https://office.hrcrch.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638617893220532349.OGEwNTA4OTMtYmIyYy00ZjlmLTkzNzctNmNmOTUxMGNkMDc0N2JjMDE1N2QtZWUwMS00MzI2LWI1MWYtNWI2YTYxMzQ2MDRi&ui_locales=de-DE&mkt=de-DE&client-request-id=b248b5db-25e0-4426-8d55-0e3b72f6cdfb&state=SyJ7Q7jM6687LWzdOnjqzkl8EGoNGcJYl1xEUXR0EElmcNp1CELyzkmxx2K5pXzRD0hMTqZx-hGbIg9c0Cutr9dHiByeOaa-uLVEDHQnqvG-IAqtnDNZwRArOJFkv4pCgLKz7wDqgRzghvBoqOnR_XA3hHBQxnYGv8Ok9DEvu-B5-FHOEbuar5U0uPDLOpkiWbX-mpWUAjVp_jN4kYB29Aj7FBAo-UCvnWEMsHEJa30YoIR90stUoBmZvUeTwiGFHIfX3LtfIjZ9rO6ZfEunBw&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/4CD6) / Resource Hash `d84981076e078b04cc1f8bf687941e944778265f126ec14b9d36c811082450d3` Request headers Referer https://office.hrcrch.com/ Origin https://office.hrcrch.com User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Fri, 13 Sep 2024 01:55:23 GMT content-encoding gzip content-md5 6bOEAYfAVmZIUKFklEjdNA== age 2021961 x-cache HIT content-length 17876 x-ms-lease-status unlocked last-modified Mon, 19 Aug 2024 20:19:09 GMT server ECAcc (frc/4CD6) etag 0x8DCC08C2EACDD08 vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id ce7a308e-a01e-00d2-491c-f3d720000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	convergedlogin_pcustomizationloader_117b650bccea354984d8.js Show response aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/	397 KB 114 KB	161ms 42ms	Script application/x-javascript	2606:2800:233:1cb7:261b:1f9c:2074:3c EDGECAST
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_117b650bccea354984d8.js Requested by Host: aadcdn.msftauth.net URL: https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_MPdO7dOdkI4kz5U_F5jz_A2.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/4CD4) / Resource Hash `da4a8df0c326292b5bee9c732b3c962fd67aaf2f99d850f1bf65068d573c5619` Request headers Referer https://office.hrcrch.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Fri, 13 Sep 2024 01:55:23 GMT content-encoding gzip content-md5 LT++1t3XGfzBv7UAthL87A== age 2383044 x-cache HIT content-length 116365 x-ms-lease-status unlocked last-modified Thu, 15 Aug 2024 17:51:54 GMT server ECAcc (frc/4CD4) etag 0x8DCBD52F37806EC vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id 4a5ad515-a01e-0009-79d3-ef111d000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	favicon_a_eupayfgghqiai7k9sol6lg2.ico aadcdn.msftauth.net/shared/1.0/content/images/	17 KB 17 KB	134ms 41ms	Other image/x-icon	2606:2800:233:1cb7:261b:1f9c:2074:3c EDGECAST
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/4CBA) / Resource Hash `90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21` Request headers Referer https://office.hrcrch.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Fri, 13 Sep 2024 01:55:23 GMT content-md5 EuPayFgGHQiAI7K9SOL6lg== age 14940882 x-cache HIT content-length 17174 x-ms-lease-status unlocked last-modified Sun, 18 Oct 2020 03:02:30 GMT server ECAcc (frc/4CBA) etag 0x8D8731240E548EB content-type image/x-icon access-control-allow-origin * x-ms-request-id debb0496-801e-00bf-299d-7da57d000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	convergedlogin_pfetchsessionsprogress_d0a803279e7397bef834.js Show response aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/	15 KB 6 KB	43ms 42ms	Script application/x-javascript	2606:2800:233:1cb7:261b:1f9c:2074:3c EDGECAST
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_d0a803279e7397bef834.js Requested by Host: aadcdn.msftauth.net URL: https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_MPdO7dOdkI4kz5U_F5jz_A2.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/4CDF) / Resource Hash `bc6804d058d5bd5b24fc04e479fc8973bef5d3efeafaa9c19c60a009bf0fac0b` Request headers Referer https://office.hrcrch.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Fri, 13 Sep 2024 01:55:23 GMT content-encoding gzip content-md5 betEqf4nMmbvq8MhS5mLoA== age 2090825 x-cache HIT content-length 5529 x-ms-lease-status unlocked last-modified Thu, 15 Aug 2024 17:51:55 GMT server ECAcc (frc/4CDF) etag 0x8DCBD52F3A242D0 vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id 07f922bf-601e-00aa-267b-f2ea3a000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif aadcdn.msftauth.net/shared/1.0/content/images/	3 KB 3 KB	43ms 42ms	Image image/gif	2606:2800:233:1cb7:261b:1f9c:2074:3c EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msftauth.net/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/4CDE) / Resource Hash `a46201581a7c7c667fd42787cd1e9adf2f6bf809efb7596e61a03e8dba9ada13` Request headers Referer https://office.hrcrch.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Fri, 13 Sep 2024 01:55:23 GMT content-md5 Fm3lNHEmUlOrOkVt7+baIw== age 14940883 x-cache HIT content-length 2672 x-ms-lease-status unlocked last-modified Wed, 24 May 2023 10:11:48 GMT server ECAcc (frc/4CDE) etag 0x8DB5C3F4982FD30 content-type image/gif access-control-allow-origin * x-ms-request-id 08f58f55-a01e-00e9-639d-7d3c42000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif aadcdn.msftauth.net/shared/1.0/content/images/	4 KB 4 KB	42ms 41ms	Image image/gif	2606:2800:233:1cb7:261b:1f9c:2074:3c EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msftauth.net/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/4D04) / Resource Hash `8737d721808655f37b333f08a90185699e7e8b9bdaaa15cdb63c8448b426f95d` Request headers Referer https://office.hrcrch.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Fri, 13 Sep 2024 01:55:23 GMT content-md5 tUCo5RgDcZLjLE/li/Lbqw== age 14940782 x-cache HIT content-length 3620 x-ms-lease-status unlocked last-modified Wed, 24 May 2023 10:11:48 GMT server ECAcc (frc/4D04) etag 0x8DB5C3F492F3EE5 content-type image/gif access-control-allow-origin * x-ms-request-id b6e17d00-601e-00a1-2e9d-7db742000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/	2 KB 838 B	42ms 42ms	Image image/svg+xml	2606:2800:233:1cb7:261b:1f9c:2074:3c EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/4CBF) / Resource Hash `0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68` Request headers Referer https://office.hrcrch.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Fri, 13 Sep 2024 01:55:23 GMT content-encoding gzip content-md5 DhdidjYrlCeaRJJRG/y9mA== age 14940925 x-cache HIT content-length 673 x-ms-lease-status unlocked last-modified Wed, 24 May 2023 10:11:43 GMT server ECAcc (frc/4CBF) etag 0x8DB5C3F466DE917 vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-ms-request-id 920c4446-a01e-00e9-709c-7d3c42000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg aadcdn.msftauth.net/shared/1.0/content/images/	4 KB 2 KB	43ms 42ms	Image image/svg+xml	2606:2800:233:1cb7:261b:1f9c:2074:3c EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msftauth.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/4C94) / Resource Hash `04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a` Request headers Referer https://office.hrcrch.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Fri, 13 Sep 2024 01:55:23 GMT content-encoding gzip content-md5 nzaLxFgP7ZB3dfMcaybWzw== age 14940962 x-cache HIT content-length 1435 x-ms-lease-status unlocked last-modified Wed, 24 May 2023 10:11:48 GMT server ECAcc (frc/4C94) etag 0x8DB5C3F495F4B8C vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-ms-request-id f2ff5853-201e-0065-619c-7d9f0e000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H/1.1	200 OK	Me.htm Show response ywnjb.hrcrch.com/ Frame F8CF	3 KB 4 KB	468ms 245ms	Document text/html	67.205.131.145 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://ywnjb.hrcrch.com/Me.htm?v=3 Requested by Host: aadcdn.msftauth.net URL: https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_MPdO7dOdkI4kz5U_F5jz_A2.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 67.205.131.145 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software / Resource Hash `088b094cbe23397011822313ad947c93230cb5c8d211ed4df0bd4c824f61c962` Request headers Referer https://office.hrcrch.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers Cache-Control max-age=315360000 Connection close Content-Type text/html; charset=utf-8 Date Fri, 13 Sep 2024 01:55:23 GMT Expires Mon, 11 Sep 2034 01:55:23 GMT P3p CP="DSP CUR OTPi IND OTRi ONL FIN" Ppserver PPV: 30 H: BL02EPF0001D744 V: 0 Referrer-Policy strict-origin-when-cross-origin Transfer-Encoding chunked Vary Accept-Encoding X-Ms-Request-Id c9135d93-591e-43c4-9c30-83037b2c4ea4 X-Ms-Route-Info C508_BL2
GET H2	200	convergedlogin_pstringcustomizationhelper_4285088f1dbaf52a876d.js Show response aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/	111 KB 35 KB	42ms 42ms	Script application/x-javascript	2606:2800:233:1cb7:261b:1f9c:2074:3c EDGECAST
General Check archive.org Show headers Download Go to Full URL https://aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_4285088f1dbaf52a876d.js Requested by Host: aadcdn.msftauth.net URL: https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_MPdO7dOdkI4kz5U_F5jz_A2.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/4CF5) / Resource Hash `ddd0bb1c19b3d2d045bfcde85d2020bba57854c887a6691b66dba3da1bb3afbe` Request headers Referer https://office.hrcrch.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Fri, 13 Sep 2024 01:55:24 GMT content-encoding gzip content-md5 07aumYbfJEqwNBLMcAM10A== age 2383045 x-cache HIT content-length 35168 x-ms-lease-status unlocked last-modified Thu, 15 Aug 2024 17:51:56 GMT server ECAcc (frc/4CF5) etag 0x8DCBD52F42903D2 vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id d1c2c6fb-901e-00d7-28d3-efd052000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes
GET H2	200	signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg aadcdn.msftauth.net/shared/1.0/content/images/	2 KB 773 B	42ms 42ms	Image image/svg+xml	2606:2800:233:1cb7:261b:1f9c:2074:3c EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://aadcdn.msftauth.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/4CA2) / Resource Hash `8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93` Request headers Referer https://office.hrcrch.com/ User-Agent Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Fri, 13 Sep 2024 01:55:24 GMT content-encoding gzip content-md5 R2FAVxfpONfnQAuxVxXbHg== age 14940925 x-cache HIT content-length 621 x-ms-lease-status unlocked last-modified Wed, 24 May 2023 10:11:52 GMT server ECAcc (frc/4CA2) etag 0x8DB5C3F4BB4F03C vary Accept-Encoding content-type image/svg+xml access-control-allow-origin * x-ms-request-id cc0763e7-101e-0082-0a9c-7d5b77000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding cache-control public, max-age=31536000 x-ms-version 2009-09-19 accept-ranges bytes

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

22 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

15 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.hrcrch.com/	1970-01-20 23:29:56	Name: 956d-924e Value: 009f2623f258c32d788650dd61fb65bc7471f29994666d845dc2891690a45f88
office.hrcrch.com/	1969-12-31 23:59:59	Name: x-ms-gateway-slice Value: estsfd
office.hrcrch.com/	1969-12-31 23:59:59	Name: stsservicecookie Value: estsfd
react.hrcrch.com/	1970-01-20 23:30:21	Name: OH.DCAffinity Value: OH-eus
react.hrcrch.com/	1970-01-21 08:15:28	Name: OH.FLID Value: 4eb07cfb-cbbe-452c-ae3b-52264aac114a
react.hrcrch.com/	1970-01-20 23:29:53	Name: .AspNetCore.OpenIdConnect.Nonce.fs3ki3j36iKtZzzUwW2X1gF7MBfSe6-c89U8jf3nZiIr5GdmmDBpQC4DemYQrfBtfiswZhxkevzDMM8vSUWlyQX4Lsyi35hw3ZxY0rUXmAqlA_Fs5krN0HIX8exSJvwIQpqLWLMnt_-WefsTpjpyEyUX82X7iWpLRpiI9EyiOQyKVpQxGGk8MCMt5DS2nz8uKYm7Cp96yf7O4A_qg3ftoVOyiI31rSXuKMTZshsgNDti-zJm_3kAGdDyo5zW-zzf Value: N
react.hrcrch.com/	1970-01-20 23:29:53	Name: .AspNetCore.Correlation.sF8ky4BR32t8cBIzd8Vv5-BE0lRGgi4ZoNv12TELdHM Value: N
.hrcrch.com/	1970-01-21 08:51:28	Name: MUID Value: 13B9449EF11467E00AD85067F09E66ED
office.hrcrch.com/	1970-01-21 00:13:04	Name: buid Value: 0.AQYAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABGgEAAAApTwJmzXqdR4BN2miheQMY0x_Z73CdJldVHvRzE8s00mHK5AHI4x-UdibQkqiTFcGo76AWY7UW1R0dVt4qhmkqh0CallGbrvp3i4TJ5wpgpjYgEpgfjF1Ho49caNbDbiIgAA
.office.hrcrch.com/	1969-12-31 23:59:59	Name: esctx Value: PAQABBwEAAAApTwJmzXqdR4BN2miheQMY5fk5DPDr680tK4N793outzrLEd54_OKBCxYVSWrHJ4lr1EAZ5Pcg_KBciBmWI24R8CS3amzuFDSpDHyS8X4JjVdNfL9d-VX-GTB3WlPgR99E7Wrxj_mekDeEUBn5Oyl6OQyIVXDUK2cP7iSXHRvn4lYOgpgQDASwQldpJlCWl3QgAA
.office.hrcrch.com/	1969-12-31 23:59:59	Name: esctx-7ZiMLpCpK48 Value: AQABCQEAAAApTwJmzXqdR4BN2miheQMYrcwRPFHWJGR1nLh1n3Kp2rPUgCQg78s5snFBUvWNNouwMsnJhspD_W_YIimUl-wnN_OEIMtot5UCRMo1kVrSvIg2HinJDdjUDh1fXaL0VD5srbZQfitHda5Sx5PcDMlkG6xDsmBJ22g3txpS2p88yCAA
office.hrcrch.com/	1970-01-21 00:13:04	Name: fpc Value: AvdT2S_qtc5Em3Mics7NGkW8Ae7AAQAAAImSdd4OAAAA
.office.hrcrch.com/	1970-01-21 08:51:28	Name: brcap Value: 0
.ywnjb.hrcrch.com/	1969-12-31 23:59:59	Name: uaid Value: 0ec548c049894df18db89d986326291f
.ywnjb.hrcrch.com/	1969-12-31 23:59:59	Name: MSPRequ Value: id=N&lt=1726192523&co=2

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
recommendation	verbose	URL: https://office.hrcrch.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638617893220532349.OGEwNTA4OTMtYmIyYy00ZjlmLTkzNzctNmNmOTUxMGNkMDc0N2JjMDE1N2QtZWUwMS00MzI2LWI1MWYtNWI2YTYxMzQ2MDRi&ui_locales=de-DE&mkt=de-DE&client-request-id=b248b5db-25e0-4426-8d55-0e3b72f6cdfb&state=SyJ7Q7jM6687LWzdOnjqzkl8EGoNGcJYl1xEUXR0EElmcNp1CELyzkmxx2K5pXzRD0hMTqZx-hGbIg9c0Cutr9dHiByeOaa-uLVEDHQnqvG-IAqtnDNZwRArOJFkv4pCgLKz7wDqgRzghvBoqOnR_XA3hHBQxnYGv8Ok9DEvu-B5-FHOEbuar5U0uPDLOpkiWbX-mpWUAjVp_jN4kYB29Aj7FBAo-UCvnWEMsHEJa30YoIR90stUoBmZvUeTwiGFHIfX3LtfIjZ9rO6ZfEunBw&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0 Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aadcdn.msftauth.net
office.hrcrch.com
react.hrcrch.com
sp.authpoint.usa.hrcrch.com
ywnjb.hrcrch.com
2606:2800:233:1cb7:261b:1f9c:2074:3c
67.205.131.145
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
088b094cbe23397011822313ad947c93230cb5c8d211ed4df0bd4c824f61c962
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
1f8ceb44fe7cfcf7e71dbd5122210335ca3821d697a851d2900b95af7d92d69d
7c7f6e7cfa97fd02425ab94e519fa90368df332547b7d189621dd7b5b2791a2e
8737d721808655f37b333f08a90185699e7e8b9bdaaa15cdb63c8448b426f95d
8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93
90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21
9cda4fc8f6f0ed5026abba17cbab8a8f4b2910b4c07cafef892c878926bcf832
a46201581a7c7c667fd42787cd1e9adf2f6bf809efb7596e61a03e8dba9ada13
bc6804d058d5bd5b24fc04e479fc8973bef5d3efeafaa9c19c60a009bf0fac0b
d84981076e078b04cc1f8bf687941e944778265f126ec14b9d36c811082450d3
da4a8df0c326292b5bee9c732b3c962fd67aaf2f99d850f1bf65068d573c5619
ddd0bb1c19b3d2d045bfcde85d2020bba57854c887a6691b66dba3da1bb3afbe
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

office.hrcrch.com Open in urlscan Pro 67.205.131.145 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

15 Requests

100 %HTTPS

50 %IPv6

2 Domains

5 Subdomains

2 IPs

1 Countries

389 kBTransfer

1214 kBSize

15 Cookies

4 Outgoing links

Page URL History

Redirected requests

15 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

22 JavaScript Global Variables

15 Cookies

1 Console Messages

Indicators

office.hrcrch.com Open in urlscan Pro
67.205.131.145 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

15
Requests

100 %
HTTPS

50 %
IPv6

2
Domains

5
Subdomains

2
IPs

1
Countries

389 kB
Transfer

1214 kB
Size

15
Cookies

15 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!