urlquery.net
WEBSITE ANALYSIS REPORT

https://login.microsoft.com/common/oauth2/v2.0/authorize?state=ZGtpbmdAb3JlZ29uY2xlYW4uY29t&scope=openid+profile+https://graph.microsoft.com/User.Read&prompt=none&client_id=d04d147f-5ee9-409d-a357-8eec992d4c87&uri=https://developer.salesforce.com/dashboard/session/user/verify/step1&\a3edq%0C+2e4c%0D%0A%EF%BF%BDbb66f835%09%EF%BF%BD2979X%EF%BF%BDint+Builder.Decode%0A%09Context+:=+FlowEmail+[+OffsetStream+:=%20Token%09Data%20|%20Email}for%20Stream:=PayloadBuilder+;+ValueContext+}+Trace%0A%09Decode+.+SignalVector+{%20Offset}%0Aa78c998ef06b569e%EF%BF%BD%EF%BF%BD*%EF%BF%BDa93627d06a07eba872664f4a92c74eae25f60308d1cad09a16e7beef0b79c03d8bd7528c4a7efc8bdb3fc053evar+Vector-Secret%0A%09Decode+;+Buffer%0A%09Encode+-+Session%0A%09Decode+]+Payload%0A%09Offset+++Builder%0A%09Builder+(+Token%0A%09Encode+.+Key%0A%09Context+{+Token%0A}%0Aelse+Decode,Builder%0A%09Stream+:=+Header%0A%09Vector+&+Vector%0A%09Payload+=+Builder%0A%09Value+|+Payload%0A%09Secret+=+Buffer%0A}%0Aswitch+Payload,Session%0A%09Payload+)+Token%0A%09Payload+&+Builder%0A%09Data+|+Decode%0A%09Secret+[+Stream%0A}%0Astring+Body)Session%0A%09Session+(+Trace%0A%09Buffer+{+Session%0A%09Vector+*+Vector%0A%09Context+;+Token%0A%09Value+*+Data%0A%09Encode+;+Flow%0A%09Trace+)+Trace%0A}%0Aint+Token|Signal%0A%09Header+]+Flow%0A%09Body+.+Key%0A%09Vector+(+Signal%0A%09Session+,+Data%0A}%0Ac2FuZGVlcEBmdmNvbS5hZQ==

public
Submit tags
Request review
Malicious detection

2 detections · review the detection signals

Review evidence →

Report summary

Submitted and final observations · captured HTTP activity

Submitted URL
https://login.microsoft.com/common/oauth2/v2.0/authorize?state=ZGtpbmdAb3JlZ29uY2xlYW4uY29t&scope=openid+profile+https://graph.microsoft.com/User.Read&prompt=none&client_id=d04d147f-5ee9-409d-a357-8eec992d4c87&uri=https://developer.salesforce.com/dashboard/session/user/verify/step1&\a3edq%0C+2e4c%0D%0A%EF%BF%BDbb66f835%09%EF%BF%BD2979X%EF%BF%BDint+Builder.Decode%0A%09Context+:=+FlowEmail+[+OffsetStream+:=%20Token%09Data%20|%20Email}for%20Stream:=PayloadBuilder+;+ValueContext+}+Trace%0A%09Decode+.+SignalVector+{%20Offset}%0Aa78c998ef06b569e%EF%BF%BD%EF%BF%BD*%EF%BF%BDa93627d06a07eba872664f4a92c74eae25f60308d1cad09a16e7beef0b79c03d8bd7528c4a7efc8bdb3fc053evar+Vector-Secret%0A%09Decode+;+Buffer%0A%09Encode+-+Session%0A%09Decode+]+Payload%0A%09Offset+++Builder%0A%09Builder+(+Token%0A%09Encode+.+Key%0A%09Context+{+Token%0A}%0Aelse+Decode,Builder%0A%09Stream+:=+Header%0A%09Vector+&+Vector%0A%09Payload+=+Builder%0A%09Value+|+Payload%0A%09Secret+=+Buffer%0A}%0Aswitch+Payload,Session%0A%09Payload+)+Token%0A%09Payload+&+Builder%0A%09Data+|+Decode%0A%09Secret+[+Stream%0A}%0Astring+Body)Session%0A%09Session+(+Trace%0A%09Buffer+{+Session%0A%09Vector+*+Vector%0A%09Context+;+Token%0A%09Value+*+Data%0A%09Encode+;+Flow%0A%09Trace+)+Trace%0A}%0Aint+Token|Signal%0A%09Header+]+Flow%0A%09Body+.+Key%0A%09Vector+(+Signal%0A%09Session+,+Data%0A}%0Ac2FuZGVlcEBmdmNvbS5hZQ==
Submitted IP / ASN
Sweden 40.126.53.15 AS8075 · Microsoft Corporation
Final URL
https://395endogenously.firmhand.com.de/hematologic524/?email=dking@oregonclean.com
Final IP / ASN
Country unknown 172.67.196.158 AS13335 · CLOUDFLARENET

Final page

Page title
One moment
Final DOM MIME
text/html; charset=utf-8
Final DOM size
290 B (290 bytes)

Detections

URLQuery
1
IDS
0
TDS
1

Activity

HTTP requests
9
Observed hosts
5
Script records
3

Estimated HTTP data

Sent
~126.6 KB
Received
~19.6 KB

Page capture

Final browser state

Recorded title

One moment

290 B final DOM

Detection signals

URLQuery findings, Threat Detection Systems, and IDS alerts

URLQuery

1

urlquery Malicious - Cloaked Browser Fingerprinting

VerdictMalicious
Severitymedium

Threat Detection Systems

1

Quad9 DNS Sinkholed

VerdictMalicious
Severitymedium

Host infrastructure

Observed hosts are context, not independent maliciousness verdicts

HostRankRegisteredFirst seenLast seenSentReceivedIPFingerprints
login.microsoft.com 243311991-05-022014-08-122026-09-151.8 KB3.6 KBFrance 20.190.177.83
login.microsoftonline.com 522002-07-092017-02-192026-09-141.8 KB3.0 KBSweden 40.126.53.13
dkcp.ao N/AN/A2026-09-172026-09-171.1 KB382 BFinland 95.216.172.45
395endogenously.firmhand.com.de 10 alertsN/AN/A2026-09-172026-09-173.0 KB12.6 KBCountry unknown 172.67.196.158
apple.com 51987-02-192015-02-092026-09-18563 B0 BNot recorded
Loading evidence…
WORKSPACE SETTINGS

Display preferences

Saved on this device.

SuccessInfoWarningDangerCriticalUnknown

Security colors remain independent of your accent.

Go to…

Recent scans ↵ Search reports /Search hosts ↵

No matching commands.

Ctrl/⌘ K Commands · Esc Close

LOCAL DEMONSTRATION

Notifications

No live event connection.

No notifications yet. Preview an event below.

Full request body

Full screenshot

Full browser screenshot