Report Overview

  1. Submitted URL

    ygvq5.sa.com/cloud/services/protection/bGJ1c2hhcnRAdHJpdGl1bXBhcnRuZXJzLmNvbQ==

  2. IP

    91.185.215.4

    ASN

    #41828 Telemach Slovenija d.o.o.

  3. Submitted

    2024-05-07 14:58:19

    Access

    public

  4. Website Title

    Sign in to Outlook

  5. Final URL

    login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=76cbe9c2-4a3c-6612-c727-6a720052b839&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638506906734052869.1924c482-167f-4b41-a16a-d7d5632bf031&state=Dcs7EoAgDABR0PE4kfxI4DggQ2vp9U3xttucUjrDETJGkpu0itbRXBQrN-s3ddZHGwOZb9CpBINswPJVTXhuFMrxXuX9RvkB

  6. urlquery detections

    Phishing - Microsoft Outlook

Detections

  1. urlquery

    3

  2. Network Intrusion Detection

    0

  3. Threat Detection Systems

    0

Domain Summary

Domain / FQDNRankRegisteredFirst SeenLast Seen
webmailonline.thebrokeinvestmentgroup.co.ukunknownunknownNo dataNo data
ygvq5.sa.comunknown2023-11-222023-12-172024-03-23
outlook.office365.com512005-06-202013-04-112021-03-15
login.microsoftonline.com252002-07-092017-02-192019-07-18
aadcdn.msftauth.net14552018-10-252018-11-192024-05-06
r4.res.office365.com1802005-06-202017-03-032024-05-06

Related reports

Network Intrusion Detection Systems

Suricata /w Emerging Threats Pro

No alerts detected

Threat Detection Systems

Public InfoSec YARA rules

No alerts detected


OpenPhish

No alerts detected


PhishTank

No alerts detected


mnemonic secure dns

No alerts detected


Quad9 DNS

No alerts detected


ThreatFox

No alerts detected


JavaScript (165)

HTTP Transactions (26)

URLIPResponseSize
ygvq5.sa.com/cloud/services/protection/bGJ1c2hhcnRAdHJpdGl1bXBhcnRuZXJzLmNvbQ==
91.185.215.4 0 B
outlook.office365.com/
40.99.202.18302 Found0 B
outlook.office365.com/owa/
40.99.202.18302 Found786 B
login.microsoftonline.com/common/oauth2/authorize?client_id=00000002-0000-0ff1-ce00-000000000000&redirect_uri=https%3a%2f%2foutlook.office365.com%2fowa%2f&resource=00000002-0000-0ff1-ce00-000000000000&response_mode=form_post&response_type=code+id_token&scope=openid&msafed=1&msaredir=1&client-request-id=76cbe9c2-4a3c-6612-c727-6a720052b839&protectedtoken=true&claims=%7b%22id_token%22%3a%7b%22xms_cc%22%3a%7b%22values%22%3a%5b%22CP1%22%5d%7d%7d%7d&nonce=638506906734052869.1924c482-167f-4b41-a16a-d7d5632bf031&state=Dcs7EoAgDABR0PE4kfxI4DggQ2vp9U3xttucUjrDETJGkpu0itbRXBQrN-s3ddZHGwOZb9CpBINswPJVTXhuFMrxXuX9RvkB
20.190.177.21200 OK14 kB
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css
152.199.23.37200 OK20 kB
aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_0lriinjhzchre9aqecvmpg2.js
152.199.23.37200 OK16 kB
aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_IDwaQXicOTFiRVOQGoK9bQ2.js
152.199.23.37200 OK121 kB
aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
152.199.23.37200 OK17 kB
aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_8e14dcf0e3ff5580d170.js
152.199.23.37200 OK54 kB
outlook.office365.com/owa/prefetch.aspx
52.97.230.130200 OK1.2 kB
r4.res.office365.com/owa/prem/15.20.7544.42/scripts/boot.worldwide.0.mouse.js
95.101.10.161200 OK180 kB
aadcdn.msftauth.net/shared/1.0/content/images/appbackgrounds/49-small_2055002f2daae2ed8f69f03944c0e5d9.jpg
152.199.23.37200 OK987 B
aadcdn.msftauth.net/shared/1.0/content/images/applogos/53_7a3c80bf9694448bac31a9589d2e9e92.png
152.199.23.37200 OK5.1 kB
aadcdn.msftauth.net/shared/1.0/content/images/appbackgrounds/49_6ffe0a92d779c878835b40171ffc2e13.jpg
152.199.23.37200 OK18 kB
r4.res.office365.com/owa/prem/15.20.7544.42/scripts/boot.worldwide.1.mouse.js
95.101.10.161200 OK163 kB
aadcdn.msftauth.net/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg
152.199.23.37200 OK1.4 kB
aadcdn.msftauth.net/shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_ea3e62a2bdfb2b2ee8c8.js
152.199.23.37200 OK36 kB
r4.res.office365.com/owa/prem/15.20.7544.42/scripts/boot.worldwide.2.mouse.js
95.101.10.161200 OK170 kB
aadcdn.msftauth.net/shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg
152.199.23.37200 OK621 B
r4.res.office365.com/owa/prem/15.20.7544.42/scripts/boot.worldwide.3.mouse.js
95.101.10.161200 OK146 kB
r4.res.office365.com/owa/prem/15.20.7544.42/resources/images/0/sprite1.mouse.png
95.101.10.161200 OK132 B
r4.res.office365.com/owa/prem/15.20.7544.42/resources/images/0/sprite1.mouse.css
95.101.10.161200 OK288 B
r4.res.office365.com/owa/prem/15.20.7544.42/resources/styles/0/boot.worldwide.mouse.css
95.101.10.161200 OK44 kB
r4.res.office365.com/owa/prem/15.20.7544.42/resources/styles/fonts/office365icons.woff
95.101.10.161200 OK78 kB
r4.res.office365.com/owa/prem/15.20.7544.42/resources/styles/fonts/office365icons.woff
95.101.10.161200 OK78 kB
webmailonline.thebrokeinvestmentgroup.co.uk/?username=lbushart@tritiumpartners.com
94.156.64.215302 Found36 kB