WEBSITE ANALYSIS REPORT

https://login.secure-crossriver.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=639282094264119780.NmQ3MDdlNmUtNWUwZi00ODI1LTkzODUtMzkwOTQ3NjI3NzRiYzhhOTA1MWQtMzQyOC00YjJlLTljOGYtOTE1NzUxYTc5ODBl&ui_locales=en-US&mkt=en-US&client-request-id=0cd1e3cd-2f07-4fc1-a5c2-8eb1a50eb09b&siwa=1&siwg=1&state=m1mfXEzCg3hzxicLCM7D5E-PSkNoSurynt22of31KWg9D7ZYajkMtqGJ1y-Gg5G81THdzPLaO4mVR6q6QLHs-B1GnU3cHvZeHQRzsh7IKzdx8FOfDENB_pWF0PjjHPPqDDwTXEDpSD9zlgcR9IJf-aGa8X7hqovvpFyA3OpOhECR9XG6myhjV5iVWsdxmibKanNy4M5Vf-lp548EpkBqTQKuinsIpSDVaA7uKOctjPyUy2Cig2bDXBC7LkzJ-B9opbLe21TZFFRGCpHuTMERdnpn9xA4-AiyQGIJ8GF8VWxCxMLxd55gTfQVONBwO8BCv9_KCfBtSDNAfEP2nl4i2bgBrkWpmpPBwEjytIsQ05S4oabxhqUeoFfOBiOAzebvOY8KP3NvEwme_CRfDJ55T17mSuS6qhmiLcCcl_EsuiO4NGnt-Knl3nmb3_9-rdaS&x-client-SKU=ID_NET8_0&x-client-ver=8.16.0.0

22 Oct 2026 · 08:31:54.000 UTCpublic

Report tags
Submit tags: openphish

Request review

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Captured HTTP requests; click any summary row or use its hostname button to expand transaction details.
Timestamp (UTC)	Method	Status	Type	Size	Duration	Signals
08:31:17.061	GET	200	document	0 B	0 ms	1 alerts

08:31:17.688	GET	301	document	0 B	30 ms	—

08:31:17.727	GET	200	document	13.9 KB	21 ms	—

08:31:18.143	GET	200	script	212.1 KB	48 ms	—

08:31:18.147	GET	200	script	409.2 KB	77 ms	—

08:31:18.150	GET	200	stylesheet	1.24 MB	73 ms	—

08:31:18.153	GET	200	stylesheet	272.8 KB	70 ms	—

08:31:18.155	GET	200	stylesheet	126.4 KB	64 ms	—

08:31:18.157	GET	200	script	2.80 MB	63 ms	—

08:31:18.161	GET	200	script	46.5 KB	8 ms	—

08:31:18.164	GET	200	script	2.34 MB	39 ms	—

08:31:18.166	GET	200	script	248.8 KB	35 ms	—

08:31:18.168	GET	200	script	6.0 KB	34 ms	—

08:31:18.170	GET	200	script	28.3 KB	35 ms	—

08:31:18.218	GET	200	lazy-img	3.1 KB	9 ms	—

08:31:18.522	GET	200	script	248.8 KB	6 ms	—

08:31:18.523	GET	200	script	6.0 KB	5 ms	—

08:31:18.526	GET	200	script	46.5 KB	6 ms	—

08:31:18.527	GET	200	script	28.3 KB	4 ms	—

08:31:18.549	GET	200	img	15.1 KB	5 ms	—

08:31:18.551	GET	200	img	9.4 KB	6 ms	—

08:31:18.620	GET	302	subdocument	0 B	0 ms	—
Transaction #33 Request / response URL GET HTTPS https://login.microsoftonline.com/organizations/oauth2/v2.0/authorize?client_id=9199bf20-a13f-4107-85dc-02114787ef48&scope=https%3A%2F%2Foutlook.office.com%2F.default%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Foutlook.office.com%2Fmail%2FoauthRedirect.html&client-request-id=c81d4c94-570c-35fc-0dd9-e067f32c169c&response_mode=fragment&client_info=1&clidata=1&prompt=none&nonce=01a162bc-6e3c-7be5-8248-6b6c192bab9c&state=eyJpZCI6IjAxYTE2MmJjLTZlM2ItNzZlZi1iOWVmLWMxYjMxNDMxMjRkMSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19%7CeyJtc2FsVmVyc2lvbiI6IjUuMTIuMCJ9%7CaHR0cHM6Ly9vdXRsb29rLm9mZmljZS5jb20vbWFpbC8&claims=%7B%22access_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&x-client-SKU=msal.js.browser&x-client-VER=5.12.0&response_type=code&code_challenge=czp5na_WfOp4clH7D3zQXG1lWTx5Q-CQ56hStJOfm7I&code_challenge_method=S256 IP / ASN 20.190.181.2 AS8075 · MICROSOFT-CORP-MSN-AS-BLOCK Transaction actions#33 Investigate Download resource0 B (0 bytes) Captured resources may contain malicious code. Sign in to download Raw file and protected ZIP External sources Requested by https://outlook.office.com/mail/ Resource information File type Not recorded MIME type Not recorded First seen (UTC) Not recorded Last seen (UTC) 23 Oct 2026 · 10:29:54.605 UTC Times seen 19304282 Size 0 B (0 bytes) MD5 d41d8cd98f00b204e9800998ecf8427e SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709 SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Certificate information Issuer DigiCert Inc · DigiCert Global G2 TLS RSA SHA256 2020 CA1 Subject stamp2.login.microsoftonline.com Protocol / cipher TLSv1.3 · TLS_AES_256_GCM_SHA384 SHA1 fingerprint EC:D3:89:35:E4:95:28:55:1D:68:C0:E0:15:25:98:37:90:1D:50:27 Valid from Thu, 15 Oct 2026 00:00:00 GMT Valid until Sat, 23 Jan 2027 23:59:59 GMT Technology fingerprints HSTS (Security) HTTP headers Request headers GET /organizations/oauth2/v2.0/authorize?client_id=9199bf20-a13f-4107-85dc-02114787ef48&scope=https%3A%2F%2Foutlook.office.com%2F.default%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Foutlook.office.com%2Fmail%2FoauthRedirect.html&client-request-id=c81d4c94-570c-35fc-0dd9-e067f32c169c&response_mode=fragment&client_info=1&clidata=1&prompt=none&nonce=01a162bc-6e3c-7be5-8248-6b6c192bab9c&state=eyJpZCI6IjAxYTE2MmJjLTZlM2ItNzZlZi1iOWVmLWMxYjMxNDMxMjRkMSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19%7CeyJtc2FsVmVyc2lvbiI6IjUuMTIuMCJ9%7CaHR0cHM6Ly9vdXRsb29rLm9mZmljZS5jb20vbWFpbC8&claims=%7B%22access_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&x-client-SKU=msal.js.browser&x-client-VER=5.12.0&response_type=code&code_challenge=czp5na_WfOp4clH7D3zQXG1lWTx5Q-CQ56hStJOfm7I&code_challenge_method=S256 HTTP/1.1 Host: login.microsoftonline.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-US,en;q=0.9 Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Storage-Access: none Sec-GPC: 1 Connection: keep-alive Upgrade-Insecure-Requests: 1 Sec-Fetch-Dest: iframe Sec-Fetch-Mode: navigate Sec-Fetch-Site: cross-site Priority: u=4 Pragma: no-cache Cache-Control: no-cache Response headers HTTP/1.1 302 Found Cache-Control: no-store, no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Content-Encoding: gzip Expires: -1 Location: https://outlook.office.com/mail/oauthRedirect.html#error=login_required&error_description=AADSTS50058%3a+A+silent+sign-in+request+was+sent+but+no+user+is+signed+in.+The+cookies+used+to+represent+the+user%27s+session+were+not+sent+in+the+request+to+Azure+AD.+This+can+happen+if+the+user+is+using+Internet+Explorer+or+Edge%2c+and+the+web+app+sending+the+silent+sign-in+request+is+in+different+IE+security+zone+than+the+Azure+AD+endpoint+(login.microsoftonline.com).+Trace+ID%3a+4b231136-c4e1-4f5a-999b-364491051402+Correlation+ID%3a+c81d4c94-570c-35fc-0dd9-e067f32c169c+Timestamp%3a+2026-10-22+08%3a31%3a20Z&error_uri=https%3a%2f%2flogin.microsoftonline.com%2ferror%3fcode%3d50058&state=eyJpZCI6IjAxYTE2MmJjLTZlM2ItNzZlZi1iOWVmLWMxYjMxNDMxMjRkMSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoic2lsZW50In19%7ceyJtc2FsVmVyc2lvbiI6IjUuMTIuMCJ9%7caHR0cHM6Ly9vdXRsb29rLm9mZmljZS5jb20vbWFpbC8&clientdata=e%7c50058%7c%7cmicrosoftonline.com%7cnone Vary: Accept-Encoding Strict-Transport-Security: max-age=31536000; includeSubDomains X-Content-Type-Options: nosniff x-ms-clientdata: e\|50058\|\|microsoftonline.com\|none P3P: CP="DSP CUR OTPi IND OTRi ONL FIN" x-ms-request-id: 4b231136-c4e1-4f5a-999b-364491051402 x-ms-ests-server: 2.1.25353.4 - SEC ProdSlices x-ms-clitelem: 1,50058,0,, x-ms-srs: 1.P Referrer-Policy: strict-origin-when-cross-origin Content-Security-Policy-Report-Only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-HKlxWmQEsSU0uGfAJaOnWw' 'unsafe-inline' 'unsafe-eval' https://.msauth.net https://.msftauth.net https://.msftauthimages.net https://.msauthimages.net https://.msidentity.com https://.microsoftonline-p.com https://.microsoftazuread-sso.com https://.azureedge.net https://.outlook.com https://.office.com https://.office365.com https://.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-All X-XSS-Protection: 0 Set-Cookie: buid=1.AQYAMe_N-B6jSkuT5F9XHpElWiC_mZE_oQdBhdwCEUeH70gAAAAGAA.BgABGgEAAAA9VeaV3ywaSLp1O3c4_Et5RXZvU3RzQXJ0aWZhY3RzAwAAAAAANKmIe1IUGZRP9EDoZYGhrhDVipH_-vk6NJoPCGI0dJy04sni_e1zx0wK75Uy7GklqdlzciFvMgV_3wBIZ2-LYnUu73mqmbvKJVex_V-Rm4TDTchFOTmsmgLtYYM7RZa1_9dELPeaBLvPm3h5EZVwIFo-s1XHBffoGj9HfGm70AgR73zAWtrL97Z41-zXnW38KBgSD5p8TSILeMR_BnVZ52hkNR4BEKN9AsVZQ5q3UMMWXYHcg78wWIIAmOM96BlGO-07Eb6Mse8EBIczDblLrVdkP67MOUocGEJQi2Wp9l-C24n3zCIF6PL_FP2bKS9xlKP8KxVT6sw1J737tPoye80fTzMCHj_-3dXa5UA8xTDYHDPXvX-Ra979Q0Y064V4H3W-hplVRaLtGO6chnJRgllt88eahcEFWYL3ZjYOOyeudZg2kOAE0pIc0bSgNfgovXGQL2twvelBJnq-iNEmYuQQHdleurtgy00F5gnLC16pwF3MoENO4IH0T47ZGAEuNdZcvHtGqcZXe1i2c4Omo1jayiwf8fq2-4vzjaCJVSnk2dsLt1Kr6zUjamOVipGNSM70PsyQW-7I79tL92svbp6ZoeowVzY4QxhLbI9LI9fJ4jxwKMk16GTymgbcpTRJMXVyjOjl70gIYDqYhAZ2OIUai-Op5hYAiX7O98ckSxIgAA; expires=Sat, 21-Nov-2026 08:31:20 GMT; path=/; secure; HttpOnly; SameSite=None fpc=AjyXlLEPAxdEhR_ULnbi1BjZRKGgAQAAANjAa-IOAAAA; expires=Sat, 21-Nov-2026 08:31:20 GMT; path=/; secure; HttpOnly; SameSite=None x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly stsservicecookie=estsfd; path=/; secure; samesite=none; httponly Date: Thu, 22 Oct 2026 08:31:19 GMT Content-Length: 888
08:31:18.692	GET	200	script	184.9 KB	5 ms	—

08:31:20.869	GET	200	subdocument	0 B	0 ms	—

08:31:21.038	GET	200	document	55.3 KB	2331 ms	—

08:31:23.429	GET	200	stylesheet	111.5 KB	54 ms	—

08:31:23.433	GET	200	script	586.8 KB	50 ms	—

08:31:23.434	GET	200	script	60.8 KB	78 ms	—

08:31:23.569	GET	200	script	185.7 KB	30 ms	—

08:31:23.604	GET	200	img	16.8 KB	4 ms	—

08:31:23.678	GET	200	script	399.3 KB	8 ms	—

08:31:23.909	GET	200	script	15.4 KB	13 ms	—

08:31:23.914	GET	200	img	2.6 KB	7 ms	—

08:31:23.915	GET	200	img	3.5 KB	7 ms	—

08:31:23.988	GET	200	img	45.5 KB	3 ms	—

08:31:23.990	GET	200	img	3.6 KB	3 ms	—

08:31:24.037	GET	200	subdocument	3.4 KB	2906 ms	—

08:31:27.453	GET	200	img	1.6 KB	5 ms	—

08:31:29.097	OPTIONS	200	xhr	0 B	2504 ms	—

Domain graph

Hostnames

Connections

Network requests

Transaction #33

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

HTTP headers

Request headers

Response headers

Display preferences

Go to…

Notifications

Full request body

Full screenshot

[Domain graph]

Hostnames

Connections

[Network requests]

Transaction #33

URL

IP / ASN

Resource information

Certificate information

Technology fingerprints

HTTP headers

Request headers

Response headers

Domain graph

Network requests