WEBSITE ANALYSIS REPORT
https://login.microsoft.com/common/oauth2/v2.0/authorize?state=ZGtpbmdAb3JlZ29uY2xlYW4uY29t&scope=openid+profile+https://graph.microsoft.com/User.Read&prompt=none&client_id=d04d147f-5ee9-409d-a357-8eec992d4c87&uri=https://developer.salesforce.com/dashboard/session/user/verify/step1&\a3edq%0C+2e4c%0D%0A%EF%BF%BDbb66f835%09%EF%BF%BD2979X%EF%BF%BDint+Builder.Decode%0A%09Context+:=+FlowEmail+[+OffsetStream+:=%20Token%09Data%20|%20Email}for%20Stream:=PayloadBuilder+;+ValueContext+}+Trace%0A%09Decode+.+SignalVector+{%20Offset}%0Aa78c998ef06b569e%EF%BF%BD%EF%BF%BD*%EF%BF%BDa93627d06a07eba872664f4a92c74eae25f60308d1cad09a16e7beef0b79c03d8bd7528c4a7efc8bdb3fc053evar+Vector-Secret%0A%09Decode+;+Buffer%0A%09Encode+-+Session%0A%09Decode+]+Payload%0A%09Offset+++Builder%0A%09Builder+(+Token%0A%09Encode+.+Key%0A%09Context+{+Token%0A}%0Aelse+Decode,Builder%0A%09Stream+:=+Header%0A%09Vector+&+Vector%0A%09Payload+=+Builder%0A%09Value+|+Payload%0A%09Secret+=+Buffer%0A}%0Aswitch+Payload,Session%0A%09Payload+)+Token%0A%09Payload+&+Builder%0A%09Data+|+Decode%0A%09Secret+[+Stream%0A}%0Astring+Body)Session%0A%09Session+(+Trace%0A%09Buffer+{+Session%0A%09Vector+*+Vector%0A%09Context+;+Token%0A%09Value+*+Data%0A%09Encode+;+Flow%0A%09Trace+)+Trace%0A}%0Aint+Token|Signal%0A%09Header+]+Flow%0A%09Body+.+Key%0A%09Vector+(+Signal%0A%09Session+,+Data%0A}%0Ac2FuZGVlcEBmdmNvbS5hZQ==
public
Malicious detection
Review evidence →2 detections · review the detection signals
Domain graph
Hostnames and connections captured in this scan
Loading domain graph…
Hostnames
- 395endogenously.firmhand.com.de5 captured requests
- apple.com1 captured requests
- dkcp.ao1 captured requests
- login.microsoft.com1 captured requests
- login.microsoftonline.com1 captured requests
Connections
- 395endogenously.firmhand.com.de → apple.comRedirects to1 captured connections
- dkcp.ao → 395endogenously.firmhand.com.deRedirects to1 captured connections
- login.microsoft.com → login.microsoftonline.comRedirects to1 captured connections
- login.microsoftonline.com → dkcp.aoRedirects to1 captured connections
Network requests
Click any request row to expand it in place. Multiple transactions can remain open.
| Timestamp (UTC) | Method | Status | Host / path | Type | Size | Duration | Signals |
|---|---|---|---|---|---|---|---|
| GET | 302 | document | 0 B | 0 ms | — | ||
| GET | 302 | document | 0 B | 0 ms | — | ||
| GET | 200 | document | 0 B | 0 ms | — | ||
| GET | 200 | document | 1.3 KB | 378 ms | 2 alerts | ||
| GET | 200 | script | 4.3 KB | 248 ms | 2 alerts | ||
| GET | 200 | img | 138 B | 28 ms | 2 alerts | ||
| POST | 200 | document | 0 B | 0 ms | 2 alerts | ||
| GET | No response | document | 0 B | 0 ms | — | ||
| GET | 404 | img | 1.2 KB | 223 ms | 2 alerts | ||