{"report_id":"4808a6ae-20aa-479b-961d-8871ce332da0","version":0,"status":"done","tags":["microsoft","phishing"],"date":"2026-09-26T19:12:37Z","url":{"schema":"http","addr":"x7tq54amsloginx7tq92.portal-login-access.net/","fqdn":"x7tq54amsloginx7tq92.portal-login-access.net","domain":"portal-login-access.net","tld":"net"},"ip":{"addr":"172.174.53.244","port":0,"asn":8075,"as":"Microsoft Corporation","country":"United States","country_code":"US"},"final":{"url":{"schema":"https","addr":"x7tq54amsloginx7tq92.portal-login-access.net/","fqdn":"x7tq54amsloginx7tq92.portal-login-access.net","domain":"portal-login-access.net","tld":"net"},"title":"Sign in to your Microsoft account","dom":{"size":25489,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text","md5":"e52f406e455c2f017db1df24b09778ba","sha1":"db95ca5f02844f8e8cb13a5fdb57673e61d81643","sha256":"29da65e735ed930fd0723ef090636e1e21dbfb0013c217679dc9a535a2575f5e","sha512":"00b994afa7accac0b04bce117ded36827f13de890d355c7783df34e398995419f7edd7f361ff8d726c6729ee8eb319831980431f5688ea71427fbb41bbda220e","ssdeep":"192:T/Bfrvi54Pkf9b99DZcXZd7XCTp4rFfVUMEF0KH6yJuKudQdp2iJ4xQS4zAUufBd:RrKdNOQnFSiDnBzAUufw42PFf95YmLQ","tlshash":"10b2716a21e314616d93a17927fb66053574c403c84ade287fec828c8f97e869d337de","dom_hash":"domhasha98e5aacc69c0eefc4b5942cec5703ce","first_seen":"2026-09-16T06:54:27.21708Z","last_seen":"2026-09-26T19:15:15.783423Z","times_seen":3,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"x7tq54amsloginx7tq92.portal-login-access.net/","fqdn":"x7tq54amsloginx7tq92.portal-login-access.net","domain":"portal-login-access.net","tld":"net"},"ip":{"addr":"172.174.53.244","port":0,"asn":8075,"as":"Microsoft Corporation","country":"United States","country_code":"US"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-10-31T19:12:37Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"31pu2ilhjrkmwpf"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":4}},"detection":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"x7tq54amsloginx7tq92.portal-login-access.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-26","alert":"Phishing Block","trigger":"x7tq54amsloginx7tq92.portal-login-access.net","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"x7tq54amsloginx7tq92.portal-login-access.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"x7tq54amsloginx7tq92.portal-login-access.net","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]},"summary":[{"fqdn":"x7tq54amsloginx7tq92.portal-login-access.net","ip":{"addr":"172.174.53.244","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"United States","country_code":"US"},"domain_registered":"2026-01-07","domain_rank":0,"first_seen":"2026-09-16T06:54:23.191045Z","last_seen":"2026-09-16T06:54:23.191045Z","alert_count":10,"request_count":2,"received_data":51682,"sent_data":1077,"comment":"","tags":null,"fingerprints":[{"name":"Microsoft ASP.NET","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]},{"name":"IIS:10.0","description":"Internet Information Services (IIS) is an extensible web server software created by Microsoft for use with the Windows NT family.","website":"https://www.iis.net","common_platform_enumeration":"cpe:2.3:a:microsoft:internet_information_server:*:*:*:*:*:*:*:*","icon":"Microsoft.svg","categories":["Web servers"]},{"name":"Windows Server","description":"Windows Server is a brand name for a group of server operating systems.","website":"https://microsoft.com/windowsserver","common_platform_enumeration":"","icon":"WindowsServer.png","categories":["Operating systems"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"x7tq54amsloginx7tq92.portal-login-access.net/","fqdn":"x7tq54amsloginx7tq92.portal-login-access.net","domain":"portal-login-access.net","tld":"net"},"ip":{"addr":"172.174.53.244","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"United States","country_code":"US"},"introduction_type":"scriptElement","is_inline":true,"md5":"2ff38db0469800d3cc00f22c0367c137","sha1":"62b86461f93201e51b558e0fcf3172dac56f65a1","sha256":"12c509796756b89f5af246324b2aa6de3cd651bb2f85d40e126fa8e0af2801ac","sha512":"d7762b72c00bc93444c8fbb5007283337d68395dbf0af9eb4ac071a8c9071eb69d3f1f82bfd177d33885de55be548746c59ca0f19a02d35e23fbe279f6f604ef","ssdeep":"192:42iJ4xQS4zAUufBuUMcWJUI1tUuv8Ne+E/FLac9m9iacYmdLyufZcKL:4nBzAUufw42PFf95YmLx","tlshash":"2332507a21d714b00deba12e63efa154307485071c46e920bebcc74d0f7ae579a727ea","size":11487,"data":"","first_seen":"2026-09-16T06:54:27.220536Z","last_seen":"2026-09-26T19:15:15.784852Z","times_seen":3,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":[{"level":"info","text":"phishing page paramsmap[actor:server1.conn0.watcher17.process7//obj20 class:Object extensible:true frozen:false isError:false ownPropertyLength:3 preview:map[kind:Object ownProperties:map[campaignId:map[configurable:true enumerable:true value:map[type:null] writable:true] targetId:map[configurable:true enumerable:true value:map[type:null] writable:true] trackingId:map[configurable:true enumerable:true value:map[type:null] writable:true]] ownPropertiesLength:3] sealed:false type:object]","filename":"https://x7tq54amsloginx7tq92.portal-login-access.net/","line_number":567,"column_number":17}]},"http":[{"url":{"schema":"https","addr":"x7tq54amsloginx7tq92.portal-login-access.net/","fqdn":"x7tq54amsloginx7tq92.portal-login-access.net","domain":"portal-login-access.net","tld":"net"},"ip":{"addr":"172.174.53.244","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"United States","country_code":"US"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-09-26T19:12:08.715Z","timestamp":1790449928715,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"portal-login-access.net","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 15 Sep 2026 04:46:28 GMT","end":"Mon, 14 Dec 2026 04:46:27 GMT"},"fingerprint":{"sha1":"CB:79:F8:82:F9:16:09:B1:76:29:13:53:0E:AD:45:73:A9:5A:5E:4C","sha256":"31:C8:05:18:A5:90:59:0D:45:FC:35:ED:29:FC:FB:39:64:B5:19:0E:83:2E:14:5A:00:18:B5:84:49:E4:E7:F1"}}},"request":{"raw":"GET / HTTP/1.1\r\nHost: x7tq54amsloginx7tq92.portal-login-access.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/html\r\ncontent-encoding: gzip\r\nlast-modified: Fri, 27 Feb 2026 09:15:15 GMT\r\naccept-ranges: bytes\r\netag: \"80535695c9a7dc1:0\"\r\nvary: Accept-Encoding\r\nserver: Microsoft-IIS/10.0\r\nx-powered-by: ASP.NET\r\ndate: Sat, 26 Sep 2026 19:12:08 GMT\r\ncontent-length: 5378\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Microsoft ASP.NET","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]},{"name":"IIS:10.0","description":"Internet Information Services (IIS) is an extensible web server software created by Microsoft for use with the Windows NT family.","website":"https://www.iis.net","common_platform_enumeration":"cpe:2.3:a:microsoft:internet_information_server:*:*:*:*:*:*:*:*","icon":"Microsoft.svg","categories":["Web servers"]},{"name":"Windows Server","description":"Windows Server is a brand name for a group of server operating systems.","website":"https://microsoft.com/windowsserver","common_platform_enumeration":"","icon":"WindowsServer.png","categories":["Operating systems"]}],"data":{"size":25529,"size_decoded":5690,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"3cddd3fc79dae82f67dbd13d7ae02683","sha1":"98bec187d5dc2ad7941aabfbfa378d54d274b0fb","sha256":"73b405b61aea008dfacd8874eac2a50005efe684d2911cae98abc5277f9698d7","sha512":"fabd415a351912e1d42940fd3dd1b166e360c58a91dc6fb90811379595ef35413e74df9dcff29bf34d56d1423c16cec62aff5fc6862b68b73bf5f1d2b3c604cb","ssdeep":"192:D/Bfrvi54Pkf9b99DZcXZd7XCTp4rFfVUMEF0KH6yJoDu4Qdp2iJ4xQS4zAUufBL:BrKdNOQnFR7DnBzAUufw42PFf95YmLu","tlshash":"f7b2716a21e314616d93a17927fba6053574c403c84ade287fec828c8f97e859d337de","first_seen":"2026-09-16T06:54:27.219255Z","last_seen":"2026-09-26T19:15:15.784181Z","times_seen":3,"resource_available":true,"data":null}},"time_used":303,"timings":{"blocked":-1,"dns":14,"connect":94,"send":0,"wait":93,"receive":0,"ssl":102},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"x7tq54amsloginx7tq92.portal-login-access.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-26","alert":"Phishing Block","trigger":"x7tq54amsloginx7tq92.portal-login-access.net","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"x7tq54amsloginx7tq92.portal-login-access.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"x7tq54amsloginx7tq92.portal-login-access.net","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"x7tq54amsloginx7tq92.portal-login-access.net/favicon.ico","fqdn":"x7tq54amsloginx7tq92.portal-login-access.net","domain":"portal-login-access.net","tld":"net"},"ip":{"addr":"172.174.53.244","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://x7tq54amsloginx7tq92.portal-login-access.net/","date":"2026-09-26T19:12:09.201Z","timestamp":1790449929201,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"portal-login-access.net","organization":""},"issuer":{"commonName":"YR2","organization":"Let's Encrypt"},"validity":{"start":"Tue, 15 Sep 2026 04:46:28 GMT","end":"Mon, 14 Dec 2026 04:46:27 GMT"},"fingerprint":{"sha1":"CB:79:F8:82:F9:16:09:B1:76:29:13:53:0E:AD:45:73:A9:5A:5E:4C","sha256":"31:C8:05:18:A5:90:59:0D:45:FC:35:ED:29:FC:FB:39:64:B5:19:0E:83:2E:14:5A:00:18:B5:84:49:E4:E7:F1"}}},"request":{"raw":"GET /favicon.ico HTTP/1.1\r\nHost: x7tq54amsloginx7tq92.portal-login-access.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://x7tq54amsloginx7tq92.portal-login-access.net/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-type: text/html\r\ncontent-encoding: gzip\r\nlast-modified: Fri, 27 Feb 2026 09:15:15 GMT\r\naccept-ranges: bytes\r\netag: \"80535695c9a7dc1:0\"\r\nvary: Accept-Encoding\r\nserver: Microsoft-IIS/10.0\r\nx-powered-by: ASP.NET\r\ndate: Sat, 26 Sep 2026 19:12:08 GMT\r\ncontent-length: 5378\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Microsoft ASP.NET","description":"ASP.NET is an open-source, server-side web-application framework designed for web development to produce dynamic web pages.","website":"https://www.asp.net","common_platform_enumeration":"cpe:2.3:a:microsoft:asp.net:*:*:*:*:*:*:*:*","icon":"Microsoft ASP.NET.svg","categories":["Web frameworks"]},{"name":"IIS:10.0","description":"Internet Information Services (IIS) is an extensible web server software created by Microsoft for use with the Windows NT family.","website":"https://www.iis.net","common_platform_enumeration":"cpe:2.3:a:microsoft:internet_information_server:*:*:*:*:*:*:*:*","icon":"Microsoft.svg","categories":["Web servers"]},{"name":"Windows Server","description":"Windows Server is a brand name for a group of server operating systems.","website":"https://microsoft.com/windowsserver","common_platform_enumeration":"","icon":"WindowsServer.png","categories":["Operating systems"]}],"data":{"size":25529,"size_decoded":5690,"mime_type":"text/html","magic":"HTML document, Unicode text, UTF-8 text","md5":"3cddd3fc79dae82f67dbd13d7ae02683","sha1":"98bec187d5dc2ad7941aabfbfa378d54d274b0fb","sha256":"73b405b61aea008dfacd8874eac2a50005efe684d2911cae98abc5277f9698d7","sha512":"fabd415a351912e1d42940fd3dd1b166e360c58a91dc6fb90811379595ef35413e74df9dcff29bf34d56d1423c16cec62aff5fc6862b68b73bf5f1d2b3c604cb","ssdeep":"192:D/Bfrvi54Pkf9b99DZcXZd7XCTp4rFfVUMEF0KH6yJoDu4Qdp2iJ4xQS4zAUufBL:BrKdNOQnFR7DnBzAUufw42PFf95YmLu","tlshash":"f7b2716a21e314616d93a17927fba6053574c403c84ade287fec828c8f97e859d337de","first_seen":"2026-09-16T06:54:27.219255Z","last_seen":"2026-09-26T19:15:15.784181Z","times_seen":3,"resource_available":true,"data":null}},"time_used":94,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":94,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"x7tq54amsloginx7tq92.portal-login-access.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"x7tq54amsloginx7tq92.portal-login-access.net","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null},{"sensor_name":"quad9","sensor_type":"DNS","title":"Quad9 DNS","description":"Quad9 DNS","scan_date":"2026-09-26","alert":"Sinkholed","trigger":"x7tq54amsloginx7tq92.portal-login-access.net","verdict":"malicious","severity":"medium","comment":"Sinkholed in DNS","link":"https://www.quad9.net","meta":null},{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-09-26","alert":"Phishing Block","trigger":"x7tq54amsloginx7tq92.portal-login-access.net","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]}}]}