WEBSITE ANALYSIS REPORT

https://login.secure-crossriver.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=639282094264119780.NmQ3MDdlNmUtNWUwZi00ODI1LTkzODUtMzkwOTQ3NjI3NzRiYzhhOTA1MWQtMzQyOC00YjJlLTljOGYtOTE1NzUxYTc5ODBl&ui_locales=en-US&mkt=en-US&client-request-id=0cd1e3cd-2f07-4fc1-a5c2-8eb1a50eb09b&siwa=1&siwg=1&state=m1mfXEzCg3hzxicLCM7D5E-PSkNoSurynt22of31KWg9D7ZYajkMtqGJ1y-Gg5G81THdzPLaO4mVR6q6QLHs-B1GnU3cHvZeHQRzsh7IKzdx8FOfDENB_pWF0PjjHPPqDDwTXEDpSD9zlgcR9IJf-aGa8X7hqovvpFyA3OpOhECR9XG6myhjV5iVWsdxmibKanNy4M5Vf-lp548EpkBqTQKuinsIpSDVaA7uKOctjPyUy2Cig2bDXBC7LkzJ-B9opbLe21TZFFRGCpHuTMERdnpn9xA4-AiyQGIJ8GF8VWxCxMLxd55gTfQVONBwO8BCv9_KCfBtSDNAfEP2nl4i2bgBrkWpmpPBwEjytIsQ05S4oabxhqUeoFfOBiOAzebvOY8KP3NvEwme_CRfDJ55T17mSuS6qhmiLcCcl_EsuiO4NGnt-Knl3nmb3_9-rdaS&x-client-SKU=ID_NET8_0&x-client-ver=8.16.0.0

22 Oct 2026 · 08:31:54.000 UTCpublic

Report tags
Submit tags: openphish

Request review

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

08:31:17.061 GET 200 document 0 B 0 ms 1 alerts

Transaction #27

Request / response

URL

GET HTTPS

https://login.secure-crossriver.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=639282094264119780.NmQ3MDdlNmUtNWUwZi00ODI1LTkzODUtMzkwOTQ3NjI3NzRiYzhhOTA1MWQtMzQyOC00YjJlLTljOGYtOTE1NzUxYTc5ODBl&ui_locales=en-US&mkt=en-US&client-request-id=0cd1e3cd-2f07-4fc1-a5c2-8eb1a50eb09b&siwa=1&siwg=1&state=m1mfXEzCg3hzxicLCM7D5E-PSkNoSurynt22of31KWg9D7ZYajkMtqGJ1y-Gg5G81THdzPLaO4mVR6q6QLHs-B1GnU3cHvZeHQRzsh7IKzdx8FOfDENB_pWF0PjjHPPqDDwTXEDpSD9zlgcR9IJf-aGa8X7hqovvpFyA3OpOhECR9XG6myhjV5iVWsdxmibKanNy4M5Vf-lp548EpkBqTQKuinsIpSDVaA7uKOctjPyUy2Cig2bDXBC7LkzJ-B9opbLe21TZFFRGCpHuTMERdnpn9xA4-AiyQGIJ8GF8VWxCxMLxd55gTfQVONBwO8BCv9_KCfBtSDNAfEP2nl4i2bgBrkWpmpPBwEjytIsQ05S4oabxhqUeoFfOBiOAzebvOY8KP3NvEwme_CRfDJ55T17mSuS6qhmiLcCcl_EsuiO4NGnt-Knl3nmb3_9-rdaS&x-client-SKU=ID_NET8_0&x-client-ver=8.16.0.0

IP / ASN

16.52.153.229

Unknown

Requested by: Not recorded

Resource information

File type: Not recorded
MIME type: Not recorded
First seen (UTC): Not recorded
Last seen (UTC): 23 Oct 2026 · 11:29:46.060 UTC
Times seen: 19305524

Size: 0 B (0 bytes)
MD5: d41d8cd98f00b204e9800998ecf8427e
SHA1: da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Certificate information

Certificate and TLS information not recorded.

Technology fingerprints

HSTS (Security)
Nginx (Web servers, Reverse proxies)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
DNS4EU Sinkholed	medium	Malicious

HTTP headers

Request headers

GET /common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=639282094264119780.NmQ3MDdlNmUtNWUwZi00ODI1LTkzODUtMzkwOTQ3NjI3NzRiYzhhOTA1MWQtMzQyOC00YjJlLTljOGYtOTE1NzUxYTc5ODBl&ui_locales=en-US&mkt=en-US&client-request-id=0cd1e3cd-2f07-4fc1-a5c2-8eb1a50eb09b&siwa=1&siwg=1&state=m1mfXEzCg3hzxicLCM7D5E-PSkNoSurynt22of31KWg9D7ZYajkMtqGJ1y-Gg5G81THdzPLaO4mVR6q6QLHs-B1GnU3cHvZeHQRzsh7IKzdx8FOfDENB_pWF0PjjHPPqDDwTXEDpSD9zlgcR9IJf-aGa8X7hqovvpFyA3OpOhECR9XG6myhjV5iVWsdxmibKanNy4M5Vf-lp548EpkBqTQKuinsIpSDVaA7uKOctjPyUy2Cig2bDXBC7LkzJ-B9opbLe21TZFFRGCpHuTMERdnpn9xA4-AiyQGIJ8GF8VWxCxMLxd55gTfQVONBwO8BCv9_KCfBtSDNAfEP2nl4i2bgBrkWpmpPBwEjytIsQ05S4oabxhqUeoFfOBiOAzebvOY8KP3NvEwme_CRfDJ55T17mSuS6qhmiLcCcl_EsuiO4NGnt-Knl3nmb3_9-rdaS&x-client-SKU=ID_NET8_0&x-client-ver=8.16.0.0 HTTP/1.1
Host: login.secure-crossriver.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br, zstd
Sec-GPC: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Priority: u=0, i
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/2 200 
server: nginx
date: Thu, 22 Oct 2026 08:31:17 GMT
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store
strict-transport-security: max-age=63072000
X-Firefox-Spdy: h2

08:31:17.688 GET 301 document 0 B 30 ms —

08:31:17.727 GET 200 document 13.9 KB 21 ms —

08:31:18.143 GET 200 script 212.1 KB 48 ms —

08:31:18.147 GET 200 script 409.2 KB 77 ms —

08:31:18.150 GET 200 stylesheet 1.24 MB 73 ms —

08:31:18.153 GET 200 stylesheet 272.8 KB 70 ms —

08:31:18.155 GET 200 stylesheet 126.4 KB 64 ms —

08:31:18.157 GET 200 script 2.80 MB 63 ms —

08:31:18.161 GET 200 script 46.5 KB 8 ms —

08:31:18.164 GET 200 script 2.34 MB 39 ms —

08:31:18.166 GET 200 script 248.8 KB 35 ms —

08:31:18.168 GET 200 script 6.0 KB 34 ms —

08:31:18.170 GET 200 script 28.3 KB 35 ms —

08:31:18.218 GET 200 lazy-img 3.1 KB 9 ms —

08:31:18.522 GET 200 script 248.8 KB 6 ms —

08:31:18.523 GET 200 script 6.0 KB 5 ms —

08:31:18.526 GET 200 script 46.5 KB 6 ms —

08:31:18.527 GET 200 script 28.3 KB 4 ms —

08:31:18.549 GET 200 img 15.1 KB 5 ms —

08:31:18.551 GET 200 img 9.4 KB 6 ms —

08:31:18.620 GET 302 subdocument 0 B 0 ms —

08:31:18.692 GET 200 script 184.9 KB 5 ms —

08:31:20.869 GET 200 subdocument 0 B 0 ms —

08:31:21.038 GET 200 document 55.3 KB 2331 ms —

08:31:23.429 GET 200 stylesheet 111.5 KB 54 ms —

08:31:23.433 GET 200 script 586.8 KB 50 ms —

08:31:23.434 GET 200 script 60.8 KB 78 ms —

08:31:23.569 GET 200 script 185.7 KB 30 ms —

08:31:23.604 GET 200 img 16.8 KB 4 ms —

08:31:23.678 GET 200 script 399.3 KB 8 ms —

08:31:23.909 GET 200 script 15.4 KB 13 ms —

08:31:23.914 GET 200 img 2.6 KB 7 ms —

08:31:23.915 GET 200 img 3.5 KB 7 ms —

08:31:23.988 GET 200 img 45.5 KB 3 ms —

08:31:23.990 GET 200 img 3.6 KB 3 ms —

08:31:24.037 GET 200 subdocument 3.4 KB 2906 ms —

08:31:27.453 GET 200 img 1.6 KB 5 ms —

08:31:29.097 OPTIONS 200 xhr 0 B 2504 ms —

Domain graph

Hostnames

Connections

Network requests

Transaction #27

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

Display preferences

Go to…

Notifications

Full request body

Full screenshot

[Domain graph]

Hostnames

Connections

[Network requests]

Transaction #27

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

Detections

HTTP headers

Request headers

Response headers

Domain graph

Network requests