WEBSITE ANALYSIS REPORT

https://login.secure-crossriver.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=639282094264119780.NmQ3MDdlNmUtNWUwZi00ODI1LTkzODUtMzkwOTQ3NjI3NzRiYzhhOTA1MWQtMzQyOC00YjJlLTljOGYtOTE1NzUxYTc5ODBl&ui_locales=en-US&mkt=en-US&client-request-id=0cd1e3cd-2f07-4fc1-a5c2-8eb1a50eb09b&siwa=1&siwg=1&state=m1mfXEzCg3hzxicLCM7D5E-PSkNoSurynt22of31KWg9D7ZYajkMtqGJ1y-Gg5G81THdzPLaO4mVR6q6QLHs-B1GnU3cHvZeHQRzsh7IKzdx8FOfDENB_pWF0PjjHPPqDDwTXEDpSD9zlgcR9IJf-aGa8X7hqovvpFyA3OpOhECR9XG6myhjV5iVWsdxmibKanNy4M5Vf-lp548EpkBqTQKuinsIpSDVaA7uKOctjPyUy2Cig2bDXBC7LkzJ-B9opbLe21TZFFRGCpHuTMERdnpn9xA4-AiyQGIJ8GF8VWxCxMLxd55gTfQVONBwO8BCv9_KCfBtSDNAfEP2nl4i2bgBrkWpmpPBwEjytIsQ05S4oabxhqUeoFfOBiOAzebvOY8KP3NvEwme_CRfDJ55T17mSuS6qhmiLcCcl_EsuiO4NGnt-Knl3nmb3_9-rdaS&x-client-SKU=ID_NET8_0&x-client-ver=8.16.0.0

22 Oct 2026 · 08:31:54.000 UTCpublic

Report tags
Submit tags: openphish

Request review

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Captured HTTP requests; click any summary row or use its hostname button to expand transaction details.
Timestamp (UTC)	Method	Status	Type	Size	Duration	Signals
08:31:17.061	GET	200	document	0 B	0 ms	1 alerts

08:31:17.688	GET	301	document	0 B	30 ms	—

08:31:17.727	GET	200	document	13.9 KB	21 ms	—

08:31:18.143	GET	200	script	212.1 KB	48 ms	—

08:31:18.147	GET	200	script	409.2 KB	77 ms	—

08:31:18.150	GET	200	stylesheet	1.24 MB	73 ms	—

08:31:18.153	GET	200	stylesheet	272.8 KB	70 ms	—

08:31:18.155	GET	200	stylesheet	126.4 KB	64 ms	—

08:31:18.157	GET	200	script	2.80 MB	63 ms	—

08:31:18.161	GET	200	script	46.5 KB	8 ms	—

08:31:18.164	GET	200	script	2.34 MB	39 ms	—

08:31:18.166	GET	200	script	248.8 KB	35 ms	—

08:31:18.168	GET	200	script	6.0 KB	34 ms	—

08:31:18.170	GET	200	script	28.3 KB	35 ms	—

08:31:18.218	GET	200	lazy-img	3.1 KB	9 ms	—

08:31:18.522	GET	200	script	248.8 KB	6 ms	—

08:31:18.523	GET	200	script	6.0 KB	5 ms	—

08:31:18.526	GET	200	script	46.5 KB	6 ms	—

08:31:18.527	GET	200	script	28.3 KB	4 ms	—

08:31:18.549	GET	200	img	15.1 KB	5 ms	—

08:31:18.551	GET	200	img	9.4 KB	6 ms	—

08:31:18.620	GET	302	subdocument	0 B	0 ms	—

08:31:18.692	GET	200	script	184.9 KB	5 ms	—

08:31:20.869	GET	200	subdocument	0 B	0 ms	—

08:31:21.038	GET	200	document	55.3 KB	2331 ms	—
Transaction #20 Request / response URL Navigation request GET HTTPS https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=9199bf20-a13f-4107-85dc-02114787ef48&scope=https%3A%2F%2Foutlook.office.com%2F.default%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Foutlook.office.com%2Fmail%2F&client-request-id=c81d4c94-570c-35fc-0dd9-e067f32c169c&response_mode=fragment&client_info=1&clidata=1&prompt=select_account&nonce=01a162bc-77ad-7e8f-bcce-db259ae1fa4c&state=eyJpZCI6IjAxYTE2MmJjLTc3YWMtN2VlZS1hMDE4LTMyOTY4N2IwYTQxMCIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoicmVkaXJlY3QifX0%3D%7CaHR0cHM6Ly9vdXRsb29rLm9mZmljZS5jb20vbWFpbC8&claims=%7B%22access_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&x-client-SKU=msal.js.browser&x-client-VER=5.12.0&response_type=code&code_challenge=UpFx0HdHYHsxrJso_lUkUIlWfQGSnt4W0q-WqmHDT2U&code_challenge_method=S256 IP / ASN 20.190.181.4 AS8075 · MICROSOFT-CORP-MSN-AS-BLOCK Transaction actions#20 Investigate Download resource55.3 KB (56618 bytes) Resource unavailableThe captured bytes cannot be retrieved. External sources Requested by Not recorded Resource information File type HTML document, Unicode text, UTF-8 text, with very long lines (38295), with CRLF, LF line terminators MIME type text/html; charset=utf-8 First seen (UTC) 22 Oct 2026 · 08:32:08.833 UTC Last seen (UTC) 22 Oct 2026 · 08:32:08.833 UTC Times seen 1 Size 55.3 KB (56618 bytes) MD5 d7e1c8bea96c9bf51090940b1b26d28f SHA1 64566baa5aa6815b492904988cbb74e98615f356 SHA256 79cafe4133390a6d729a54f82844093443fba8a49e2e18f861a7b3c00eb70019 Certificate information Issuer Microsoft Corporation · Microsoft TLS G2 RSA CA OCSP 04 Subject stamp2.login.microsoftonline.com Protocol / cipher TLSv1.3 · TLS_AES_256_GCM_SHA384 SHA1 fingerprint 26:DE:3D:54:A5:9F:3C:CB:8C:47:DD:3B:9A:59:5D:27:3D:6F:F3:9A Valid from Thu, 15 Oct 2026 22:32:44 GMT Valid until Sat, 23 Jan 2027 21:32:44 GMT Technology fingerprints HSTS (Security) HTTP headers Request headers GET /common/oauth2/v2.0/authorize?client_id=9199bf20-a13f-4107-85dc-02114787ef48&scope=https%3A%2F%2Foutlook.office.com%2F.default%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Foutlook.office.com%2Fmail%2F&client-request-id=c81d4c94-570c-35fc-0dd9-e067f32c169c&response_mode=fragment&client_info=1&clidata=1&prompt=select_account&nonce=01a162bc-77ad-7e8f-bcce-db259ae1fa4c&state=eyJpZCI6IjAxYTE2MmJjLTc3YWMtN2VlZS1hMDE4LTMyOTY4N2IwYTQxMCIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoicmVkaXJlY3QifX0%3D%7CaHR0cHM6Ly9vdXRsb29rLm9mZmljZS5jb20vbWFpbC8&claims=%7B%22access_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&x-client-SKU=msal.js.browser&x-client-VER=5.12.0&response_type=code&code_challenge=UpFx0HdHYHsxrJso_lUkUIlWfQGSnt4W0q-WqmHDT2U&code_challenge_method=S256 HTTP/1.1 Host: login.microsoftonline.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br, zstd Sec-GPC: 1 Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Priority: u=0, i Pragma: no-cache Cache-Control: no-cache Response headers HTTP/1.1 200 OK Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Content-Encoding: gzip Expires: -1 Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff X-Frame-Options: DENY Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to="coop-endpoint" Reporting-Endpoints: coop-endpoint="https://coop.msauth.net:443/api/coopReport?client_type=spa-msal&client_id=9199bf20-a13f-4107-85dc-02114787ef48&correlation_id=c81d4c94-570c-35fc-0dd9-e067f32c169c&sku=MsalJsBrowser&version=5.12.0&is1p=1" Link: <https://aadcdn.msftauth.net>; rel=preconnect; crossorigin, <https://aadcdn.msftauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msftauth.net>; rel=dns-prefetch, <https://aadcdn.msftauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msftauth.net>; rel=dns-prefetch,<https://aadcdn.msauth.net>; rel=dns-prefetch X-DNS-Prefetch-Control: on P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 8f334ee4-8c58-42fe-9bf1-91391d98cc00 x-ms-ests-server: 2.1.25353.4 - SEC ProdSlices x-ms-clitelem: 1,16000,0,, x-ms-srs: 1.P Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-sINDSFbaFQZXivE0fMiPKQ' 'unsafe-inline' 'unsafe-eval' https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net https://.outlook.com https://.office.com https://.office365.com https://.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-All X-XSS-Protection: 0 Set-Cookie: buid=1.AQUAMe_N-B6jSkuT5F9XHpElWiC_mZE_oQdBhdwCEUeH70gAAAAFAA.BgABGgEAAAA9VeaV3ywaSLp1O3c4_Et5RXZvU3RzQXJ0aWZhY3RzAwAAAAAAoIT5IxhAtgvFlRDHp8PS-oyKXjkmrXb3qnhutFhKGZuZ0-_1NfrS5dtW4pkvMUR8NAB_4smanhtt8iKeaJckrZvic_CXghJ8Z1iFveD-7w6G6wYBa_wuiygADmV6RKsYlS81kU5naoHKM7HIgBVMvLCAC8NdvroO1juG9Uy5M7tH7Iwl5DKgySYWFF2ZnAj22Prc3vzj2WMuCWUZ2rAPngSC45qhhiR-sw2zF-u0maa6iOYrEgJTcpimOXiqyNMqzEQgmM7Ahixt5Y9iNglCL3WVJ2xN9M7WL5jEJtA6jeL-gEH0C8mwVV4XiWT7FxEBGTkuHCGxdDkU2mQejxU2_DUmjS4DDH5asuXmwrH2lNFCbwVBuiEUHQBuC6-cIj7ceGfTGdNR_7BqtEcY_XH0AEUcNorer9PhIJVqEFoY2GeCoGFSVZ7tQd9vAWvW7RrL--elJf7A2PoLoXcD2M5vDUZXKjBXwIQ7do5f-y6NcY7lOS_QnDiMKc6vCHstgeT_APsf7CmAgIR_YaF1MjzKLx8C8dfBq37O9TyAw8OtpbZCK_xqUl7C0rE4tAQD1gfyPsn1vcpt5uZWn2OF5_1e_JOrzZy8-zYOZo_qTbGvuj6yvAv4PigcIzYpRVyk_DG7vJFVFyaqmvNKPS6ukXx75EgD0yRUycQPCgmwuEdulLMgAA; expires=Sat, 21-Nov-2026 08:31:23 GMT; path=/; secure; HttpOnly; SameSite=None esctx=PBgABBwEAAAA9VeaV3ywaSLp1O3c4_Et5RXZvU3RzQXJ0aWZhY3RzDQAAAAAA4gRvsk4_8t_ZrgoxbVeuWGR0hqQBzpCo2cq8ffTsEGsQuc59ajFu0nc9LE-M0H6oKVwgl2HTBgPrwaGn02UY9EzOUms9-ZhrZlXIkm9MVYgqu1b1RA2IH7nuTwwQFDiGyrzEyC4gmJdR5SsZX7RARc_ds0Da8W0t5cfqy-tpkhXh19155ozlq35pi2Oida1_RAZp8HLyIqXWSrmh7boDLJguHDz9jIDNzLqfQucWmpx1yn5lcKWEYB3xQ0eCEyMs1EZccw7uxNpGAgfcFYOpAEy92p-vGzHd3HZSGFeSOnpADwhpLj0WLo72OrECFuMm9508MrKpzgYarkahKUhOzr-Qlu_WlUNi2eq4p7z3zCAMOSREOrddmBT9JZBB3HXX_hZ4qXM-AMS5CW6VAOYAR3UVqg_0msNRHl9v8EnYTIyeH3ltzXPNZuZ0zlxE9hyytKAraOXaCHAMVDzRd6wgytdyTyB6GbbNUcKfNr_0An3tmLDNyb30b3krUoJPMkn-FluYaP_gGUVlJfW1Mt9G6QWYaAFEwwRLu3O-C-PkTi66tzDBf1GPWooM73VcHjFHoMbdpql0kQwU-NeA9p-KX-MjyoYRka4wh-1plJP4mP-h4HKrkW-lCyPI-hTw-gkajiVngmzAGmFEXJkIHQAGRFfhDvsXNy8vcNhk9RqP6qM3AAalL34pCPu_57pepmvQ-6OyZlFT-mszZAlgSXqTS6AC99Dd07FGumILHNCEWFYgAA; domain=.login.microsoftonline.com; path=/; secure; HttpOnly; SameSite=None esctx-IbGlR5bsrY=BgABCQEAAAA9VeaV3ywaSLp1O3c4_Et5RXZvU3RzQXJ0aWZhY3RzDQAAAAAAfkJJRV_EuT-b6wg2Yo8GKtjIXhCUJ8mv4YVn-yhlx61NVGWi_bfh6mwoFx9z8J0Mvp9HS4QC35dpxE4hPjDJWL7TVi1Sl0_cKwhK4oIpHv12gwXRiWodkhkxQ_L3km5d0e1PqNabVFKZeRQv678doJxoch8GLuU1dLR_s_zCG8Kv_s2ayqus3ybWK9wby6yEXpTLFsdP_VSbSbfACndb2V4LZr6FhLqCxFQeibUQBsOGmt9M0hHUGdrVk4qZtofU0M9ATQsnEGAI9l9EGdzFAXa3N1ekG-A-rt4HpcGZIYN7yx2q77t6NRwEdU5B4ooKSP2_xwzom_KP_vU6q3CIcKWIL-fC99VVpa193qkWlHTP0UUtIS3dsH-OyKJ6TCDOy_wrqwxA18jjKF22IBq4vOJPPVAx51rIFYe8Z7iO8TDyuFUycLOo4nHZDUwswzn9m0KvSi18vT3Dvs2MfdFr3MASEq0UeqCn_tN0tlg1jU57libuMHX8EYnvclTRiOWOtVLDrNk9d0KdISFQcpeO3SOkqMz1-H7oo45uqmS76lxBSunwQ8I3iCpISM8iMD5HVAXtMTL1XvrijHsOYgg8KnCiL-sMmqSu3t2I_4V91R_YfXyV5vy7tab7lO9YcwmqQEwK0yV2k08I_-2UBYeeHMkyt16BNA5_0jgku0ot_7sUgP5APQIe90UEN3JCT6DqIAA; domain=.login.microsoftonline.com; path=/; secure; HttpOnly; SameSite=None fpc=Ao84cUsP5qNJhr0uBgA8vAPZRKGgAQAAANrAa-IOAAAA; expires=Sat, 21-Nov-2026 08:31:23 GMT; path=/; secure; HttpOnly; SameSite=None x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly stsservicecookie=estsfd; path=/; secure; samesite=none; httponly Date: Thu, 22 Oct 2026 08:31:22 GMT Content-Length: 22699
08:31:23.429	GET	200	stylesheet	111.5 KB	54 ms	—

08:31:23.433	GET	200	script	586.8 KB	50 ms	—

08:31:23.434	GET	200	script	60.8 KB	78 ms	—

08:31:23.569	GET	200	script	185.7 KB	30 ms	—

08:31:23.604	GET	200	img	16.8 KB	4 ms	—

08:31:23.678	GET	200	script	399.3 KB	8 ms	—

08:31:23.909	GET	200	script	15.4 KB	13 ms	—

08:31:23.914	GET	200	img	2.6 KB	7 ms	—

08:31:23.915	GET	200	img	3.5 KB	7 ms	—

08:31:23.988	GET	200	img	45.5 KB	3 ms	—

08:31:23.990	GET	200	img	3.6 KB	3 ms	—

08:31:24.037	GET	200	subdocument	3.4 KB	2906 ms	—

08:31:27.453	GET	200	img	1.6 KB	5 ms	—

08:31:29.097	OPTIONS	200	xhr	0 B	2504 ms	—

Domain graph

Hostnames

Connections

Network requests

Transaction #20

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

HTTP headers

Request headers

Response headers

Display preferences

Go to…

Notifications

Full request body

Full screenshot

[Domain graph]

Hostnames

Connections

[Network requests]

Transaction #20

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

HTTP headers

Request headers

Response headers

Domain graph

Network requests