exoduspoint-voicemail-login.wocaf.cfd Open in urlscan Pro
164.92.154.109 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://afchuanguogqtr.vfdtogo.com/fBSUkLfqtZHU9bW9kJmVydD1ZMmgxWVc0dVozVnZRR1Y0YjJSMWMzQnZhVzUwTG1OdmJRPT0mbXQ9NQ==pthq
Effective URL:
https://exoduspoint-voicemail-login.wocaf.cfd/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3...
Submission: On March 16 via manual (March 16th 2022, 9:05:18 am UTC) from GB — Scanned from GB

Summary HTTP 17 Redirects Links 2 Behaviour Indicators

Summary

This website contacted 2 IPs in 1 countries across 2 domains to perform 17 HTTP transactions. The main IP is 164.92.154.109, located in United States and belongs to DIGITALOCEAN-ASN, US. The main domain is exoduspoint-voicemail-login.wocaf.cfd.
TLS certificate: Issued by R3 on March 16th 2022. Valid for: 3 months.

This is the only time exoduspoint-voicemail-login.wocaf.cfd was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Microsoft (Consumer)

Domain & IP information

	IP Address	AS Autonomous System
1 1	2a06:98c1:312... 2a06:98c1:3120::7	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2 14	164.92.154.109 164.92.154.109	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
17	2

1 2a06:98c1:3120::7 (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

afchuanguogqtr.vfdtogo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

14 164.92.154.109 (United States) 2 redirects

ASN14061 (DIGITALOCEAN-ASN, US)

wocaf.cfd	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
exoduspoint-voicemail-d8ngmj9vrrkbza8.wocaf.cfd	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
exoduspoint-voicemail-login.wocaf.cfd	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
exoduspoint-voicemail-7np70a2gfq540.wocaf.cfd	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
exoduspoint-voicemail-5y15eftqgj4bey3p4vpbfgr9.wocaf.cfd	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
14	wocaf.cfd 2 redirects wocaf.cfd exoduspoint-voicemail-d8ngmj9vrrkbza8.wocaf.cfd exoduspoint-voicemail-login.wocaf.cfd exoduspoint-voicemail-7np70a2gfq540.wocaf.cfd exoduspoint-voicemail-5y15eftqgj4bey3p4vpbfgr9.wocaf.cfd	301 KB
1	vfdtogo.com 1 redirects afchuanguogqtr.vfdtogo.com	571 B
17	2

	Domain	Requested by
9	exoduspoint-voicemail-5y15eftqgj4bey3p4vpbfgr9.wocaf.cfd	exoduspoint-voicemail-login.wocaf.cfd exoduspoint-voicemail-5y15eftqgj4bey3p4vpbfgr9.wocaf.cfd
2	exoduspoint-voicemail-login.wocaf.cfd	exoduspoint-voicemail-login.wocaf.cfd
1	exoduspoint-voicemail-7np70a2gfq540.wocaf.cfd	exoduspoint-voicemail-login.wocaf.cfd exoduspoint-voicemail-5y15eftqgj4bey3p4vpbfgr9.wocaf.cfd
1	exoduspoint-voicemail-d8ngmj9vrrkbza8.wocaf.cfd	1 redirects
1	wocaf.cfd	1 redirects
1	afchuanguogqtr.vfdtogo.com	1 redirects
17	6

This site contains links to these domains. Also see Links.

Domain
exoduspoint-voicemail-d8ngmj8kd7b0wy5x3w.wocaf.cfd
exoduspoint-voicemail-2wc2dj3dgj43w9rdtvyj8.wocaf.cfd

Subject Issuer	Validity	Valid
wocaf.cfd R3	`2022-03-16` - `2022-06-14`	3 months	crt.sh

This page contains 2 frames:

Primary Page: https://exoduspoint-voicemail-login.wocaf.cfd/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637830183124068488.ZmI2NDBlNTItZmUyNy00NmMzLWE1NmYtMTc2OTc3NWIxYmZjNWNjODQyY2MtNGIwZC00NWQzLThmYTQtZTVjMGNhZDYzMzQ3&ui_locales=en-GB&mkt=en-GB&state=GnmokqEywedebLfVM8v6ykWjLGVdhvobxIZK1YPleNdbYSrQULPOx8jr__K1LFG0tptASpcy3R06XTqfV4XOBvWxkwXqjkSRGZ9-C9_ViCCVNmDEiFP-9_2ZE0TJC3CWQc561LY2I8g3L-BAH64TompIwesWoEdTrlG8jtESN8XhmxFUIyb2ldC6NkXlLtg8USUnglS0hmtXbDN8o52VFYzJ0KU--8SrIL9XAteMR99UWlQHe9RTbCgrHCchT-vXnL-cgECb3uXHz2l25Hc8Kw&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0&sso_reload=true
Frame ID: 14EADDFC5750E59A0DB0B28095943615
Requests: 16 HTTP requests in this frame

Frame: https://exoduspoint-voicemail-7np70a2gfq540.wocaf.cfd/Me.htm?v=3
Frame ID: 4E5FC9972BB339F821F6F240D5801722
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Sign in to Skype

Page URL History Show full URLs

https://afchuanguogqtr.vfdtogo.com/fBSUkLfqtZHU9bW9kJmVydD1ZMmgxWVc0dVozVnZRR1Y0YjJSMWMzQnZhVzUwTG1OdmJRPT0mbXQ... HTTP 302
https://wocaf.cfd/?emlkb=chuan.guo@exoduspoint.com HTTP 302
https://exoduspoint-voicemail-d8ngmj9vrrkbza8.wocaf.cfd/login HTTP 302
https://exoduspoint-voicemail-login.wocaf.cfd/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&... Page URL
https://exoduspoint-voicemail-login.wocaf.cfd/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&... Page URL

Page Statistics

17
Requests

71 %
HTTPS

50 %
IPv6

2
Domains

6
Subdomains

2
IPs

1
Countries

298 kB
Transfer

854 kB
Size

19
Cookies

2 Outgoing links

These are links going to different origins than the main page.

URL: https://exoduspoint-voicemail-d8ngmj8kd7b0wy5x3w.wocaf.cfd/en-GB/servicesagreement/
Title: Terms of use

Search URL Search Domain Scan URL

URL: https://exoduspoint-voicemail-2wc2dj3dgj43w9rdtvyj8.wocaf.cfd/en-GB/privacystatement
Title: Privacy & cookies

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://afchuanguogqtr.vfdtogo.com/fBSUkLfqtZHU9bW9kJmVydD1ZMmgxWVc0dVozVnZRR1Y0YjJSMWMzQnZhVzUwTG1OdmJRPT0mbXQ9NQ==pthq HTTP 302
https://wocaf.cfd/?emlkb=chuan.guo@exoduspoint.com HTTP 302
https://exoduspoint-voicemail-d8ngmj9vrrkbza8.wocaf.cfd/login HTTP 302
https://exoduspoint-voicemail-login.wocaf.cfd/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637830183124068488.ZmI2NDBlNTItZmUyNy00NmMzLWE1NmYtMTc2OTc3NWIxYmZjNWNjODQyY2MtNGIwZC00NWQzLThmYTQtZTVjMGNhZDYzMzQ3&ui_locales=en-GB&mkt=en-GB&state=GnmokqEywedebLfVM8v6ykWjLGVdhvobxIZK1YPleNdbYSrQULPOx8jr__K1LFG0tptASpcy3R06XTqfV4XOBvWxkwXqjkSRGZ9-C9_ViCCVNmDEiFP-9_2ZE0TJC3CWQc561LY2I8g3L-BAH64TompIwesWoEdTrlG8jtESN8XhmxFUIyb2ldC6NkXlLtg8USUnglS0hmtXbDN8o52VFYzJ0KU--8SrIL9XAteMR99UWlQHe9RTbCgrHCchT-vXnL-cgECb3uXHz2l25Hc8Kw&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0 Page URL
https://exoduspoint-voicemail-login.wocaf.cfd/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637830183124068488.ZmI2NDBlNTItZmUyNy00NmMzLWE1NmYtMTc2OTc3NWIxYmZjNWNjODQyY2MtNGIwZC00NWQzLThmYTQtZTVjMGNhZDYzMzQ3&ui_locales=en-GB&mkt=en-GB&state=GnmokqEywedebLfVM8v6ykWjLGVdhvobxIZK1YPleNdbYSrQULPOx8jr__K1LFG0tptASpcy3R06XTqfV4XOBvWxkwXqjkSRGZ9-C9_ViCCVNmDEiFP-9_2ZE0TJC3CWQc561LY2I8g3L-BAH64TompIwesWoEdTrlG8jtESN8XhmxFUIyb2ldC6NkXlLtg8USUnglS0hmtXbDN8o52VFYzJ0KU--8SrIL9XAteMR99UWlQHe9RTbCgrHCchT-vXnL-cgECb3uXHz2l25Hc8Kw&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0&sso_reload=true Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 0

https://afchuanguogqtr.vfdtogo.com/fBSUkLfqtZHU9bW9kJmVydD1ZMmgxWVc0dVozVnZRR1Y0YjJSMWMzQnZhVzUwTG1OdmJRPT0mbXQ9NQ==pthq HTTP 302
https://wocaf.cfd/?emlkb=chuan.guo@exoduspoint.com HTTP 302
https://exoduspoint-voicemail-d8ngmj9vrrkbza8.wocaf.cfd/login HTTP 302
https://exoduspoint-voicemail-login.wocaf.cfd/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637830183124068488.ZmI2NDBlNTItZmUyNy00NmMzLWE1NmYtMTc2OTc3NWIxYmZjNWNjODQyY2MtNGIwZC00NWQzLThmYTQtZTVjMGNhZDYzMzQ3&ui_locales=en-GB&mkt=en-GB&state=GnmokqEywedebLfVM8v6ykWjLGVdhvobxIZK1YPleNdbYSrQULPOx8jr__K1LFG0tptASpcy3R06XTqfV4XOBvWxkwXqjkSRGZ9-C9_ViCCVNmDEiFP-9_2ZE0TJC3CWQc561LY2I8g3L-BAH64TompIwesWoEdTrlG8jtESN8XhmxFUIyb2ldC6NkXlLtg8USUnglS0hmtXbDN8o52VFYzJ0KU--8SrIL9XAteMR99UWlQHe9RTbCgrHCchT-vXnL-cgECb3uXHz2l25Hc8Kw&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0

17 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	authorize Show response exoduspoint-voicemail-login.wocaf.cfd/common/oauth2/v2.0/ Redirect Chain https://afchuanguogqtr.vfdtogo.com/fBSUkLfqtZHU9bW9kJmVydD1ZMmgxWVc0dVozVnZRR1Y0YjJSMWMzQnZhVzUwTG1OdmJRPT0mbXQ9NQ==pthq https://wocaf.cfd/?emlkb=chuan.guo@exoduspoint.com https://exoduspoint-voicemail-d8ngmj9vrrkbza8.wocaf.cfd/login https://exoduspoint-voicemail-login.wocaf.cfd/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20...	151 KB 55 KB	322ms 207ms	Document text/html	164.92.154.109 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://exoduspoint-voicemail-login.wocaf.cfd/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637830183124068488.ZmI2NDBlNTItZmUyNy00NmMzLWE1NmYtMTc2OTc3NWIxYmZjNWNjODQyY2MtNGIwZC00NWQzLThmYTQtZTVjMGNhZDYzMzQ3&ui_locales=en-GB&mkt=en-GB&state=GnmokqEywedebLfVM8v6ykWjLGVdhvobxIZK1YPleNdbYSrQULPOx8jr__K1LFG0tptASpcy3R06XTqfV4XOBvWxkwXqjkSRGZ9-C9_ViCCVNmDEiFP-9_2ZE0TJC3CWQc561LY2I8g3L-BAH64TompIwesWoEdTrlG8jtESN8XhmxFUIyb2ldC6NkXlLtg8USUnglS0hmtXbDN8o52VFYzJ0KU--8SrIL9XAteMR99UWlQHe9RTbCgrHCchT-vXnL-cgECb3uXHz2l25Hc8Kw&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 164.92.154.109 , United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software / Resource Hash `8e1cea1671dc82375dfd754833972254b20e1bca518432403adf3a57a10d7121` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Accept-Language en-GB,en;q=0.9 Response headers Cache-Control no-store, no-cache Content-Encoding gzip Content-Length 55554 Content-Type text/html; charset=utf-8 Date Wed, 16 Mar 2022 09:05:12 GMT Expires -1 Nel {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} P3p CP="DSP CUR OTPi IND OTRi ONL FIN" Pragma no-cache Report-To {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+dub2"}]} Vary Accept-Encoding X-Ms-Clitelem 1,50168,0,, X-Ms-Ests-Server 2.1.12529.17 - NEULR1 ProdSlices X-Ms-Request-Id 2b159272-dcc1-405c-a7d9-bd8fa0524100 Redirect headers Content-Encoding gzip Content-Length 28 Content-Type text/html; charset=utf-8 Date Wed, 16 Mar 2022 09:05:11 GMT Location https://exoduspoint-voicemail-login.wocaf.cfd/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637830183124068488.ZmI2NDBlNTItZmUyNy00NmMzLWE1NmYtMTc2OTc3NWIxYmZjNWNjODQyY2MtNGIwZC00NWQzLThmYTQtZTVjMGNhZDYzMzQ3&ui_locales=en-GB&mkt=en-GB&state=GnmokqEywedebLfVM8v6ykWjLGVdhvobxIZK1YPleNdbYSrQULPOx8jr__K1LFG0tptASpcy3R06XTqfV4XOBvWxkwXqjkSRGZ9-C9_ViCCVNmDEiFP-9_2ZE0TJC3CWQc561LY2I8g3L-BAH64TompIwesWoEdTrlG8jtESN8XhmxFUIyb2ldC6NkXlLtg8USUnglS0hmtXbDN8o52VFYzJ0KU--8SrIL9XAteMR99UWlQHe9RTbCgrHCchT-vXnL-cgECb3uXHz2l25Hc8Kw&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0 Request-Context appId= Vary Accept-Encoding X-Cache CONFIG_NOCACHE X-Msedge-Ref Ref A: 23EECE9C362A4841B0A0E1A5FD2A2892 Ref B: AMS04EDGE2719 Ref C: 2022-03-16T09:05:12Z X-Ua-Compatible IE=edge,chrome=1
GET H/1.1	200 OK	Primary Request authorize Show response exoduspoint-voicemail-login.wocaf.cfd/common/oauth2/v2.0/	197 KB 51 KB	243ms 242ms	Document text/html	164.92.154.109 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://exoduspoint-voicemail-login.wocaf.cfd/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637830183124068488.ZmI2NDBlNTItZmUyNy00NmMzLWE1NmYtMTc2OTc3NWIxYmZjNWNjODQyY2MtNGIwZC00NWQzLThmYTQtZTVjMGNhZDYzMzQ3&ui_locales=en-GB&mkt=en-GB&state=GnmokqEywedebLfVM8v6ykWjLGVdhvobxIZK1YPleNdbYSrQULPOx8jr__K1LFG0tptASpcy3R06XTqfV4XOBvWxkwXqjkSRGZ9-C9_ViCCVNmDEiFP-9_2ZE0TJC3CWQc561LY2I8g3L-BAH64TompIwesWoEdTrlG8jtESN8XhmxFUIyb2ldC6NkXlLtg8USUnglS0hmtXbDN8o52VFYzJ0KU--8SrIL9XAteMR99UWlQHe9RTbCgrHCchT-vXnL-cgECb3uXHz2l25Hc8Kw&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0&sso_reload=true Requested by Host: exoduspoint-voicemail-login.wocaf.cfd URL: https://exoduspoint-voicemail-login.wocaf.cfd/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637830183124068488.ZmI2NDBlNTItZmUyNy00NmMzLWE1NmYtMTc2OTc3NWIxYmZjNWNjODQyY2MtNGIwZC00NWQzLThmYTQtZTVjMGNhZDYzMzQ3&ui_locales=en-GB&mkt=en-GB&state=GnmokqEywedebLfVM8v6ykWjLGVdhvobxIZK1YPleNdbYSrQULPOx8jr__K1LFG0tptASpcy3R06XTqfV4XOBvWxkwXqjkSRGZ9-C9_ViCCVNmDEiFP-9_2ZE0TJC3CWQc561LY2I8g3L-BAH64TompIwesWoEdTrlG8jtESN8XhmxFUIyb2ldC6NkXlLtg8USUnglS0hmtXbDN8o52VFYzJ0KU--8SrIL9XAteMR99UWlQHe9RTbCgrHCchT-vXnL-cgECb3uXHz2l25Hc8Kw&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0 Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 164.92.154.109 , United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software / Resource Hash `9e1651f276301f90f44ae3320443ff27be0e97cc17b2b1c725c500b5711cd16e` Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Accept-Language en-GB,en;q=0.9 Referer https://exoduspoint-voicemail-login.wocaf.cfd/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637830183124068488.ZmI2NDBlNTItZmUyNy00NmMzLWE1NmYtMTc2OTc3NWIxYmZjNWNjODQyY2MtNGIwZC00NWQzLThmYTQtZTVjMGNhZDYzMzQ3&ui_locales=en-GB&mkt=en-GB&state=GnmokqEywedebLfVM8v6ykWjLGVdhvobxIZK1YPleNdbYSrQULPOx8jr__K1LFG0tptASpcy3R06XTqfV4XOBvWxkwXqjkSRGZ9-C9_ViCCVNmDEiFP-9_2ZE0TJC3CWQc561LY2I8g3L-BAH64TompIwesWoEdTrlG8jtESN8XhmxFUIyb2ldC6NkXlLtg8USUnglS0hmtXbDN8o52VFYzJ0KU--8SrIL9XAteMR99UWlQHe9RTbCgrHCchT-vXnL-cgECb3uXHz2l25Hc8Kw&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0 Response headers Cache-Control no-store, no-cache Content-Encoding gzip Content-Length 50325 Content-Type text/html; charset=utf-8 Date Wed, 16 Mar 2022 09:05:12 GMT Expires -1 Link <https://aadcdn.msftauth.net>; rel=preconnect; crossorigin <https://aadcdn.msftauth.net>; rel=dns-prefetch <https://aadcdn.msauth.net>; rel=dns-prefetch Nel {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0} P3p CP="DSP CUR OTPi IND OTRi ONL FIN" Pragma no-cache Report-To {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+dub2"}]} Vary Accept-Encoding X-Dns-Prefetch-Control on X-Ms-Clitelem 1,0,0,, X-Ms-Ests-Server 2.1.12529.17 - NEULR2 ProdSlices X-Ms-Request-Id 94807af2-f0fc-4e44-b858-a84341f03600
GET H/1.1	200 OK	Me.htm exoduspoint-voicemail-7np70a2gfq540.wocaf.cfd/	0 0	362ms 207ms	Other text/html	164.92.154.109 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://exoduspoint-voicemail-7np70a2gfq540.wocaf.cfd/Me.htm?v=3 Requested by Host: exoduspoint-voicemail-login.wocaf.cfd URL: https://exoduspoint-voicemail-login.wocaf.cfd/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637830183124068488.ZmI2NDBlNTItZmUyNy00NmMzLWE1NmYtMTc2OTc3NWIxYmZjNWNjODQyY2MtNGIwZC00NWQzLThmYTQtZTVjMGNhZDYzMzQ3&ui_locales=en-GB&mkt=en-GB&state=GnmokqEywedebLfVM8v6ykWjLGVdhvobxIZK1YPleNdbYSrQULPOx8jr__K1LFG0tptASpcy3R06XTqfV4XOBvWxkwXqjkSRGZ9-C9_ViCCVNmDEiFP-9_2ZE0TJC3CWQc561LY2I8g3L-BAH64TompIwesWoEdTrlG8jtESN8XhmxFUIyb2ldC6NkXlLtg8USUnglS0hmtXbDN8o52VFYzJ0KU--8SrIL9XAteMR99UWlQHe9RTbCgrHCchT-vXnL-cgECb3uXHz2l25Hc8Kw&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0&sso_reload=true Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 164.92.154.109 , United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software / Resource Hash Request headers Accept-Language en-GB,en;q=0.9 Referer https://exoduspoint-voicemail-login.wocaf.cfd/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers
GET H/1.1	200 OK	ConvergedLogin_PCore_SdrJFAkNJd_B8kX711WxRg2.js Show response exoduspoint-voicemail-5y15eftqgj4bey3p4vpbfgr9.wocaf.cfd/shared/1.0/content/js/	373 KB 108 KB	251ms 126ms	Script application/x-javascript	164.92.154.109 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://exoduspoint-voicemail-5y15eftqgj4bey3p4vpbfgr9.wocaf.cfd/shared/1.0/content/js/ConvergedLogin_PCore_SdrJFAkNJd_B8kX711WxRg2.js Requested by Host: exoduspoint-voicemail-login.wocaf.cfd URL: https://exoduspoint-voicemail-login.wocaf.cfd/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637830183124068488.ZmI2NDBlNTItZmUyNy00NmMzLWE1NmYtMTc2OTc3NWIxYmZjNWNjODQyY2MtNGIwZC00NWQzLThmYTQtZTVjMGNhZDYzMzQ3&ui_locales=en-GB&mkt=en-GB&state=GnmokqEywedebLfVM8v6ykWjLGVdhvobxIZK1YPleNdbYSrQULPOx8jr__K1LFG0tptASpcy3R06XTqfV4XOBvWxkwXqjkSRGZ9-C9_ViCCVNmDEiFP-9_2ZE0TJC3CWQc561LY2I8g3L-BAH64TompIwesWoEdTrlG8jtESN8XhmxFUIyb2ldC6NkXlLtg8USUnglS0hmtXbDN8o52VFYzJ0KU--8SrIL9XAteMR99UWlQHe9RTbCgrHCchT-vXnL-cgECb3uXHz2l25Hc8Kw&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0&sso_reload=true Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 164.92.154.109 , United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software ECAcc (ama/8ADF) / Resource Hash `2b1af609f2ed4ecbbc07115481d01d4a38736b2bbae2a3b570b557c9a398c720` Request headers Referer https://exoduspoint-voicemail-login.wocaf.cfd/ Origin https://exoduspoint-voicemail-login.wocaf.cfd Accept-Language en-GB,en;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers X-Ms-Blob-Type BlockBlob Date Wed, 16 Mar 2022 09:05:13 GMT Content-Encoding gzip Content-Md5 4XRp9wzO5b02KEKNPEKoDA== Age 2910092 X-Cache HIT Content-Length 109373 X-Ms-Lease-Status unlocked Last-Modified Wed, 09 Feb 2022 17:32:36 GMT Server ECAcc (ama/8ADF) Etag 0x8D9EBF229D95FBF Vary Accept-Encoding Content-Type application/x-javascript Access-Control-Allow-Origin * X-Ms-Request-Id 7137f3c6-f01e-0098-2c9d-1ebec7000000 Access-Control-Expose-Headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Cache-Control public, max-age=31536000 Access-Control-Allow-Credentials true X-Ms-Version 2009-09-19 Accept-Ranges bytes
GET H/1.1	200 OK	converged.v2.login.min_zmhwgv_kbcs-aml46kcgfg2.css exoduspoint-voicemail-5y15eftqgj4bey3p4vpbfgr9.wocaf.cfd/ests/2.1/content/cdnbundles/	0 20 KB	163ms 59ms	Other text/css	164.92.154.109 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://exoduspoint-voicemail-5y15eftqgj4bey3p4vpbfgr9.wocaf.cfd/ests/2.1/content/cdnbundles/converged.v2.login.min_zmhwgv_kbcs-aml46kcgfg2.css Requested by Host: exoduspoint-voicemail-login.wocaf.cfd URL: https://exoduspoint-voicemail-login.wocaf.cfd/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637830183124068488.ZmI2NDBlNTItZmUyNy00NmMzLWE1NmYtMTc2OTc3NWIxYmZjNWNjODQyY2MtNGIwZC00NWQzLThmYTQtZTVjMGNhZDYzMzQ3&ui_locales=en-GB&mkt=en-GB&state=GnmokqEywedebLfVM8v6ykWjLGVdhvobxIZK1YPleNdbYSrQULPOx8jr__K1LFG0tptASpcy3R06XTqfV4XOBvWxkwXqjkSRGZ9-C9_ViCCVNmDEiFP-9_2ZE0TJC3CWQc561LY2I8g3L-BAH64TompIwesWoEdTrlG8jtESN8XhmxFUIyb2ldC6NkXlLtg8USUnglS0hmtXbDN8o52VFYzJ0KU--8SrIL9XAteMR99UWlQHe9RTbCgrHCchT-vXnL-cgECb3uXHz2l25Hc8Kw&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0&sso_reload=true Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 164.92.154.109 , United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software ECAcc (ama/8A97) / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept-Language en-GB,en;q=0.9 Referer https://exoduspoint-voicemail-login.wocaf.cfd/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers X-Ms-Blob-Type BlockBlob Date Wed, 16 Mar 2022 09:05:13 GMT Content-Encoding gzip Content-Md5 gQeGSiXz86BaUj7ZBvfbVQ== Age 7805917 X-Cache HIT Content-Length 19946 X-Ms-Lease-Status unlocked Last-Modified Wed, 15 Dec 2021 19:03:11 GMT Server ECAcc (ama/8A97) Etag 0x8D9BFFD8A59586D Vary Accept-Encoding Content-Type text/css Access-Control-Allow-Origin * X-Ms-Request-Id 28aff972-a01e-003d-5c16-f22d72000000 Access-Control-Expose-Headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Cache-Control public, max-age=31536000 X-Ms-Version 2009-09-19 Accept-Ranges bytes
GET H/1.1	200 OK	ux.converged.login.strings-en-gb.min_fyurblx_a1h4k1nfdjinxq2.js exoduspoint-voicemail-5y15eftqgj4bey3p4vpbfgr9.wocaf.cfd/ests/2.1/content/cdnbundles/	0 14 KB	172ms 69ms	Other application/x-javascript	164.92.154.109 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://exoduspoint-voicemail-5y15eftqgj4bey3p4vpbfgr9.wocaf.cfd/ests/2.1/content/cdnbundles/ux.converged.login.strings-en-gb.min_fyurblx_a1h4k1nfdjinxq2.js Requested by Host: exoduspoint-voicemail-login.wocaf.cfd URL: https://exoduspoint-voicemail-login.wocaf.cfd/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=637830183124068488.ZmI2NDBlNTItZmUyNy00NmMzLWE1NmYtMTc2OTc3NWIxYmZjNWNjODQyY2MtNGIwZC00NWQzLThmYTQtZTVjMGNhZDYzMzQ3&ui_locales=en-GB&mkt=en-GB&state=GnmokqEywedebLfVM8v6ykWjLGVdhvobxIZK1YPleNdbYSrQULPOx8jr__K1LFG0tptASpcy3R06XTqfV4XOBvWxkwXqjkSRGZ9-C9_ViCCVNmDEiFP-9_2ZE0TJC3CWQc561LY2I8g3L-BAH64TompIwesWoEdTrlG8jtESN8XhmxFUIyb2ldC6NkXlLtg8USUnglS0hmtXbDN8o52VFYzJ0KU--8SrIL9XAteMR99UWlQHe9RTbCgrHCchT-vXnL-cgECb3uXHz2l25Hc8Kw&x-client-SKU=ID_NETSTANDARD2_0&x-client-ver=6.12.1.0&sso_reload=true Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 164.92.154.109 , United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software ECAcc (ama/8B51) / Resource Hash `e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855` Request headers Accept-Language en-GB,en;q=0.9 Referer https://exoduspoint-voicemail-login.wocaf.cfd/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers X-Ms-Blob-Type BlockBlob Date Wed, 16 Mar 2022 09:05:13 GMT Content-Encoding gzip Content-Md5 2+eZtLhebyQ0YKasylTYaA== Age 1388251 X-Cache HIT Content-Length 13260 X-Ms-Lease-Status unlocked Last-Modified Tue, 08 Feb 2022 00:54:25 GMT Server ECAcc (ama/8B51) Etag 0x8D9EA9D8DC6BAF1 Vary Accept-Encoding Content-Type application/x-javascript Access-Control-Allow-Origin * X-Ms-Request-Id 9a00a7af-701e-0030-6274-2c1ffc000000 Access-Control-Expose-Headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Cache-Control public, max-age=31536000 X-Ms-Version 2009-09-19 Accept-Ranges bytes
GET H/1.1	200 OK	convergedlogin_pfetchsessionsprogress_44f0ead6879bcdeee729.js Show response exoduspoint-voicemail-5y15eftqgj4bey3p4vpbfgr9.wocaf.cfd/shared/1.0/content/js/asyncchunk/	15 KB 6 KB	163ms 64ms	Script application/x-javascript	164.92.154.109 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://exoduspoint-voicemail-5y15eftqgj4bey3p4vpbfgr9.wocaf.cfd/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_44f0ead6879bcdeee729.js Requested by Host: exoduspoint-voicemail-5y15eftqgj4bey3p4vpbfgr9.wocaf.cfd URL: https://exoduspoint-voicemail-5y15eftqgj4bey3p4vpbfgr9.wocaf.cfd/shared/1.0/content/js/ConvergedLogin_PCore_SdrJFAkNJd_B8kX711WxRg2.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 164.92.154.109 , United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software ECAcc (ama/8B3A) / Resource Hash `1cf86bca3f40e07ab5ace2955ba41fac52c4426724f61ec6bc0d219b663c3b26` Request headers Accept-Language en-GB,en;q=0.9 Referer https://exoduspoint-voicemail-login.wocaf.cfd/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers X-Ms-Blob-Type BlockBlob Date Wed, 16 Mar 2022 09:05:13 GMT Content-Encoding gzip Content-Md5 90Yv9OO715k9vpqDuD+oiA== Age 1473524 X-Cache HIT Content-Length 5461 X-Ms-Lease-Status unlocked Last-Modified Wed, 09 Feb 2022 17:32:25 GMT Server ECAcc (ama/8B3A) Etag 0x8D9EBF2231A9B29 Vary Accept-Encoding Content-Type application/x-javascript Access-Control-Allow-Origin * X-Ms-Request-Id 0d5561f6-701e-0036-29ae-2bf93d000000 Access-Control-Expose-Headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Cache-Control public, max-age=31536000 X-Ms-Version 2009-09-19 Accept-Ranges bytes
GET H/1.1	200 OK	marching_ants_white_166de53471265253ab3a456defe6da23.gif exoduspoint-voicemail-5y15eftqgj4bey3p4vpbfgr9.wocaf.cfd/shared/1.0/content/images/	3 KB 3 KB	157ms 58ms	Image image/gif	164.92.154.109 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://exoduspoint-voicemail-5y15eftqgj4bey3p4vpbfgr9.wocaf.cfd/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 164.92.154.109 , United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software ECAcc (ama/8B37) / Resource Hash `a46201581a7c7c667fd42787cd1e9adf2f6bf809efb7596e61a03e8dba9ada13` Request headers Accept-Language en-GB,en;q=0.9 Referer https://exoduspoint-voicemail-login.wocaf.cfd/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers X-Ms-Blob-Type BlockBlob Date Wed, 16 Mar 2022 09:05:13 GMT Content-Md5 Fm3lNHEmUlOrOkVt7+baIw== Age 20928846 X-Cache HIT Content-Length 2672 X-Ms-Lease-Status unlocked Last-Modified Thu, 16 Jan 2020 00:32:52 GMT Server ECAcc (ama/8B37) Etag 0x8D79A1B9F2C6EC8 Content-Type image/gif Access-Control-Allow-Origin * X-Ms-Request-Id 4c39405d-101e-0042-2cbc-7a2f4a000000 Access-Control-Expose-Headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Cache-Control public, max-age=31536000 X-Ms-Version 2009-09-19 Accept-Ranges bytes
GET H/1.1	200 OK	marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif exoduspoint-voicemail-5y15eftqgj4bey3p4vpbfgr9.wocaf.cfd/shared/1.0/content/images/	4 KB 4 KB	160ms 59ms	Image image/gif	164.92.154.109 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://exoduspoint-voicemail-5y15eftqgj4bey3p4vpbfgr9.wocaf.cfd/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 164.92.154.109 , United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software ECAcc (ama/8B1B) / Resource Hash `8737d721808655f37b333f08a90185699e7e8b9bdaaa15cdb63c8448b426f95d` Request headers Accept-Language en-GB,en;q=0.9 Referer https://exoduspoint-voicemail-login.wocaf.cfd/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers X-Ms-Blob-Type BlockBlob Date Wed, 16 Mar 2022 09:05:13 GMT Content-Md5 tUCo5RgDcZLjLE/li/Lbqw== Age 22668369 X-Cache HIT Content-Length 3620 X-Ms-Lease-Status unlocked Last-Modified Thu, 16 Jan 2020 00:32:52 GMT Server ECAcc (ama/8B1B) Etag 0x8D79A1B9F8A840E Content-Type image/gif Access-Control-Allow-Origin * X-Ms-Request-Id 2990de78-a01e-003b-26ea-6acbb3000000 Access-Control-Expose-Headers x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Cache-Control public, max-age=31536000 X-Ms-Version 2009-09-19 Accept-Ranges bytes
GET H/1.1	200 OK	convergedlogin_pcustomizationloader_2a4182e4b053971e74a8.js Show response exoduspoint-voicemail-5y15eftqgj4bey3p4vpbfgr9.wocaf.cfd/shared/1.0/content/js/asyncchunk/	107 KB 32 KB	81ms 81ms	Script application/x-javascript	164.92.154.109 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Full URL https://exoduspoint-voicemail-5y15eftqgj4bey3p4vpbfgr9.wocaf.cfd/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_2a4182e4b053971e74a8.js Requested by Host: exoduspoint-voicemail-5y15eftqgj4bey3p4vpbfgr9.wocaf.cfd URL: https://exoduspoint-voicemail-5y15eftqgj4bey3p4vpbfgr9.wocaf.cfd/shared/1.0/content/js/ConvergedLogin_PCore_SdrJFAkNJd_B8kX711WxRg2.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 164.92.154.109 , United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software ECAcc (ama/8AE3) / Resource Hash `737d187421fff17f6f039dea81806b0ea7cf6653058389b038506ce9ffcf747e` Request headers Accept-Language en-GB,en;q=0.9 Referer https://exoduspoint-voicemail-login.wocaf.cfd/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers X-Ms-Blob-Type BlockBlob Date Wed, 16 Mar 2022 09:05:13 GMT Content-Encoding gzip Content-Md5 KTqlpp/umJx0ufW3DtQIzA== Age 2999782 X-Cache HIT Content-Length 32117 X-Ms-Lease-Status unlocked Last-Modified Mon, 07 Feb 2022 19:42:32 GMT Server ECAcc (ama/8AE3) Etag 0x8D9EA71FB9AAB83 Vary Accept-Encoding Content-Type application/x-javascript Access-Control-Allow-Origin * X-Ms-Request-Id 01c4817f-801e-006c-2dcc-1d90f5000000 Access-Control-Expose-Headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Cache-Control public, max-age=31536000 X-Ms-Version 2009-09-19 Accept-Ranges bytes
GET H/1.1	200 OK	2_bc3d32a696895f78c19df6c717586a5d.svg exoduspoint-voicemail-5y15eftqgj4bey3p4vpbfgr9.wocaf.cfd/shared/1.0/content/images/backgrounds/	2 KB 2 KB	59ms 59ms	Image image/svg+xml	164.92.154.109 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://exoduspoint-voicemail-5y15eftqgj4bey3p4vpbfgr9.wocaf.cfd/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 164.92.154.109 , United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software ECAcc (ama/8B5B) / Resource Hash `0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68` Request headers Accept-Language en-GB,en;q=0.9 Referer https://exoduspoint-voicemail-login.wocaf.cfd/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers X-Ms-Blob-Type BlockBlob Date Wed, 16 Mar 2022 09:05:13 GMT Content-Encoding gzip Content-Md5 DhdidjYrlCeaRJJRG/y9mA== Age 19551845 X-Cache HIT Content-Length 673 X-Ms-Lease-Status unlocked Last-Modified Wed, 12 Feb 2020 22:01:50 GMT Server ECAcc (ama/8B5B) Etag 0x8D7B007297AE131 Vary Accept-Encoding Content-Type image/svg+xml Access-Control-Allow-Origin * X-Ms-Request-Id a28a1008-f01e-0033-0442-87ec9c000000 Access-Control-Expose-Headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Cache-Control public, max-age=31536000 X-Ms-Version 2009-09-19 Accept-Ranges bytes
GET H/1.1	200 OK	microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg exoduspoint-voicemail-5y15eftqgj4bey3p4vpbfgr9.wocaf.cfd/shared/1.0/content/images/	4 KB 2 KB	60ms 60ms	Image image/svg+xml	164.92.154.109 DIGITALOCEAN-ASN
General Check archive.org Show headers Download Go to Show image Full URL https://exoduspoint-voicemail-5y15eftqgj4bey3p4vpbfgr9.wocaf.cfd/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 164.92.154.109 , United States, ASN14061 (DIGITALOCEAN-ASN, US), Reverse DNS Software ECAcc (ama/8AB2) / Resource Hash `04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a` Request headers Accept-Language en-GB,en;q=0.9 Referer https://exoduspoint-voicemail-login.wocaf.cfd/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/99.0.4844.51 Safari/537.36 Response headers X-Ms-Blob-Type BlockBlob Date Wed, 16 Mar 2022 09:05:13 GMT Content-Encoding gzip Content-Md5 nzaLxFgP7ZB3dfMcaybWzw== Age 24470471 X-Cache HIT Content-Length 1435 X-Ms-Lease-Status unlocked Last-Modified Thu, 16 Jan 2020 00:32:52 GMT Server ECAcc (ama/8AB2) Etag 0x8D79A1B9F5E121A Vary Accept-Encoding Content-Type image/svg+xml Access-Control-Allow-Origin * X-Ms-Request-Id cece708d-401e-000f-1486-5ae166000000 Access-Control-Expose-Headers x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding Cache-Control public, max-age=31536000 X-Ms-Version 2009-09-19 Accept-Ranges bytes
GET		marching_ants_white_166de53471265253ab3a456defe6da23.gif exoduspoint-voicemail-5y15eftqgj4bey3p4vpbfgr9.wocaf.cfd/shared/1.0/content/images/	0 0

GET		marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif exoduspoint-voicemail-5y15eftqgj4bey3p4vpbfgr9.wocaf.cfd/shared/1.0/content/images/	0 0

GET		Me.htm exoduspoint-voicemail-7np70a2gfq540.wocaf.cfd/ Frame 4E5F	0 0

GET		converged.v2.login.min_zmhwgv_kbcs-aml46kcgfg2.css exoduspoint-voicemail-5y15eftqgj4bey3p4vpbfgr9.wocaf.cfd/ests/2.1/content/cdnbundles/	0 0

GET		ux.converged.login.strings-en-gb.min_fyurblx_a1h4k1nfdjinxq2.js exoduspoint-voicemail-5y15eftqgj4bey3p4vpbfgr9.wocaf.cfd/ests/2.1/content/cdnbundles/	0 0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: exoduspoint-voicemail-5y15eftqgj4bey3p4vpbfgr9.wocaf.cfd
URL: https://exoduspoint-voicemail-5y15eftqgj4bey3p4vpbfgr9.wocaf.cfd/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif

Domain: exoduspoint-voicemail-5y15eftqgj4bey3p4vpbfgr9.wocaf.cfd
URL: https://exoduspoint-voicemail-5y15eftqgj4bey3p4vpbfgr9.wocaf.cfd/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif

Domain: exoduspoint-voicemail-7np70a2gfq540.wocaf.cfd
URL: https://exoduspoint-voicemail-7np70a2gfq540.wocaf.cfd/Me.htm?v=3

Domain: exoduspoint-voicemail-5y15eftqgj4bey3p4vpbfgr9.wocaf.cfd
URL: https://exoduspoint-voicemail-5y15eftqgj4bey3p4vpbfgr9.wocaf.cfd/ests/2.1/content/cdnbundles/converged.v2.login.min_zmhwgv_kbcs-aml46kcgfg2.css

Domain: exoduspoint-voicemail-5y15eftqgj4bey3p4vpbfgr9.wocaf.cfd
URL: https://exoduspoint-voicemail-5y15eftqgj4bey3p4vpbfgr9.wocaf.cfd/ests/2.1/content/cdnbundles/ux.converged.login.strings-en-gb.min_fyurblx_a1h4k1nfdjinxq2.js

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Microsoft (Consumer)

26 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

19 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
wocaf.cfd/	1970-01-20 02:20:13	Name: fpc Value: Amf5SpunNGFGtKb6Yklrvhk
.wocaf.cfd/	1969-12-31 23:59:59	Name: esctx Value: AQABAAAAAAD--DLA3VO7QrddgJg7WevrtDth3UFy1e7Qq5ZAqrsqQ3Qhg64vHOkVahvqTfuuekmXi3-D-mSja2yswZ0RrI__ZGQExvxZjiwrXnK5JGfM6mHe3PKf3YtKMPkJqmUoYe-cQC5mgh_uXS28AlHPjTTvg64FRB0rfoGl4MW4V_j8buPb3_7Nb511WUACU-jbVo0gAA
wocaf.cfd/	1969-12-31 23:59:59	Name: x-ms-gateway-slice Value: estsfd
wocaf.cfd/	1969-12-31 23:59:59	Name: stsservicecookie Value: estsfd
.wocaf.cfd/	1970-01-21 09:18:24	Name: bgd Value: chuan.guo@exoduspoint.com
exoduspoint-voicemail-d8ngmj9vrrkbza8.wocaf.cfd/	1970-01-20 01:37:30	Name: OH.DCAffinity Value: OH-weu
exoduspoint-voicemail-d8ngmj9vrrkbza8.wocaf.cfd/	1970-01-20 10:22:37	Name: OH.FLID Value: 104389b9-9bbe-4de5-a27c-1299a30638a2
exoduspoint-voicemail-d8ngmj9vrrkbza8.wocaf.cfd/	1970-01-20 01:37:02	Name: .AspNetCore.OpenIdConnect.Nonce.yJcpgKev-fUtUTg6FXp7Bf3BLowRhMdmqKXHZG6TdjP7uh-E-Vqgh5u1XroU0kEDG596h3qKFGQmf6sTgJOMrEJyQQozqajxhn2AMn1K-HXzEh-K5CmGuqAok3EZ2peBBFH1CXr1XeMcKw1Mfx_6t2y1G1_H5oO1vit3WpyILC-9NgAHAvqWsWlokSvA1JIfNQ1NoUi5jp5pyzT4YOoDeGAtz71jarVNbHQhjfYsOgBvwYzZSKhe3H2yIoFAfR-1 Value: N
exoduspoint-voicemail-d8ngmj9vrrkbza8.wocaf.cfd/	1970-01-20 01:37:02	Name: .AspNetCore.Correlation.OpenIdConnectV2.5qd5sDokVeMFyOsnf_Ba4pdi7Sa-1MwY3GOw75Fz294 Value: N
.wocaf.cfd/	1970-01-20 10:58:37	Name: MUID Value: 0B20441877AE603D29535571762D61E0
exoduspoint-voicemail-login.wocaf.cfd/	1969-12-31 23:59:59	Name: x-ms-gateway-slice Value: estsfd
exoduspoint-voicemail-login.wocaf.cfd/	1969-12-31 23:59:59	Name: stsservicecookie Value: estsfd
.exoduspoint-voicemail-login.wocaf.cfd/	1969-12-31 23:59:59	Name: AADSSO Value: NA\|NoExtension
exoduspoint-voicemail-login.wocaf.cfd/	1970-01-20 01:37:01	Name: SSOCOOKIEPULLED Value: 1
exoduspoint-voicemail-login.wocaf.cfd/	1970-01-20 02:20:13	Name: buid Value: 0.ATEAMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABAAEAAAD--DLA3VO7QrddgJg7Wevrf9_t7iw_t0akRciDXG_qoInnit2DCt3T71bSDGjE__yqehNg5B1gK51SeIVlxcUPl3tz7UQV_RS0KZMFCIEhX6xV9EUmnxnkY1FVTlKNF1kgAA
exoduspoint-voicemail-login.wocaf.cfd/	1970-01-20 02:20:13	Name: fpc Value: AthDkKFkrRZOtlK44YW9KPO8Ae7AAQAAAEifw9kOAAAA
.wocaf.cfd/	1969-12-31 23:59:59	Name: uaid Value: b0ec7cffeb2d4602a4fbc1f856a4dd27
.wocaf.cfd/	1969-12-31 23:59:59	Name: MSPRequ Value: id=N&lt=1647421513&co=1
.exoduspoint-voicemail-login.wocaf.cfd/	1970-01-20 10:58:37	Name: brcap Value: 0

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

afchuanguogqtr.vfdtogo.com
exoduspoint-voicemail-5y15eftqgj4bey3p4vpbfgr9.wocaf.cfd
exoduspoint-voicemail-7np70a2gfq540.wocaf.cfd
exoduspoint-voicemail-d8ngmj9vrrkbza8.wocaf.cfd
exoduspoint-voicemail-login.wocaf.cfd
wocaf.cfd
exoduspoint-voicemail-5y15eftqgj4bey3p4vpbfgr9.wocaf.cfd
exoduspoint-voicemail-7np70a2gfq540.wocaf.cfd
164.92.154.109
2a06:98c1:3120::7
04d29248ee3a13a074518c93a18d6efc491bf1f298f9b87fc989a6ae4b9fad7a
0e88b6fcbb8591edfd28184fa70a04b6dd3af8a14367c628edd7caba32e58c68
1cf86bca3f40e07ab5ace2955ba41fac52c4426724f61ec6bc0d219b663c3b26
2b1af609f2ed4ecbbc07115481d01d4a38736b2bbae2a3b570b557c9a398c720
737d187421fff17f6f039dea81806b0ea7cf6653058389b038506ce9ffcf747e
8737d721808655f37b333f08a90185699e7e8b9bdaaa15cdb63c8448b426f95d
8e1cea1671dc82375dfd754833972254b20e1bca518432403adf3a57a10d7121
9e1651f276301f90f44ae3320443ff27be0e97cc17b2b1c725c500b5711cd16e
a46201581a7c7c667fd42787cd1e9adf2f6bf809efb7596e61a03e8dba9ada13
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

exoduspoint-voicemail-login.wocaf.cfd Open in urlscan Pro 164.92.154.109 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Page Statistics

17 Requests

71 %HTTPS

50 %IPv6

2 Domains

6 Subdomains

2 IPs

1 Countries

298 kBTransfer

854 kBSize

19 Cookies

2 Outgoing links

Page URL History

Redirected requests

17 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Failed requests

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

26 JavaScript Global Variables

19 Cookies

Indicators

exoduspoint-voicemail-login.wocaf.cfd Open in urlscan Pro
164.92.154.109 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

17
Requests

71 %
HTTPS

50 %
IPv6

2
Domains

6
Subdomains

2
IPs

1
Countries

298 kB
Transfer

854 kB
Size

19
Cookies

17 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!