{"report_id":"4d314b2a-bd74-482d-ad8c-7486383c14f0","version":0,"status":"done","tags":[],"date":"2026-07-17T08:25:46Z","url":{"schema":"http","addr":"account.msauth.live/error.aspx?lang=de-AT\u0026refd=account.live.com\u0026refp=landing\u0026e=400","fqdn":"account.msauth.live","domain":"msauth.live","tld":"live"},"ip":{"addr":"94.154.172.98","port":0,"asn":208046,"as":"ColocationX Ltd.","country":"Bulgaria","country_code":"BG"},"final":{"url":{"schema":"https","addr":"account.msauth.live/error.aspx?lang=de-AT\u0026refd=account.live.com\u0026refp=landing\u0026e=400","fqdn":"account.msauth.live","domain":"msauth.live","tld":"live"},"title":"Microsoft account","dom":{"size":308561,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (5885)","md5":"159144dea508c52ce33d268711bcd5ab","sha1":"cbf67d0ccd243cf3ddcb03b927e3f060465fe989","sha256":"710e2082a1b96bb6a8d5cca39e4489bf7b3e3f95ef6953f5555138943783a196","sha512":"fbaa2f04c4052c740f9ad18b171056ecd3e6a87e22230679798ccd70df11a32643f93445e63bef79030c56fe2c974a62242002a59dfb2bb6fc3a6d13385f28af","ssdeep":"6144:B8XCBTKpG6rapIdeFD0qkU4bF5LBt4MFMumcqTE:6XCM8e40qkU4bF5LBJFMuz","tlshash":"96645e887990343241674231b0eb7d0bf2351553aa26c869f22dddea9f79e8f0723f59","dom_hash":"domhash4e7880978fbfef8fc76e2b59977269b4","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"http","addr":"account.msauth.live/error.aspx?lang=de-AT\u0026refd=account.live.com\u0026refp=landing\u0026e=400","fqdn":"account.msauth.live","domain":"msauth.live","tld":"live"},"ip":{"addr":"94.154.172.98","port":0,"asn":208046,"as":"ColocationX Ltd.","country":"Bulgaria","country_code":"BG"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-21T08:25:46Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":0,"analyzer":3}},"detection":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"account.msauth.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"account.msauth.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"account.msauth.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null},"summary":[{"fqdn":"account.msauth.live","ip":{"addr":"94.154.172.98","port":443,"asn":208046,"as":"ColocationX Ltd.","country":"Bulgaria","country_code":"BG"},"domain_registered":"2024-09-17","domain_rank":0,"first_seen":"2026-07-16T15:08:53.341493Z","last_seen":"2026-07-16T15:08:53.341493Z","alert_count":9,"request_count":3,"received_data":619927,"sent_data":2132,"comment":"","tags":null,"fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}]},{"fqdn":"acctcdn.msauth.net","ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"domain_registered":"2018-10-25","domain_rank":24304,"first_seen":"2019-01-25T22:56:43Z","last_seen":"2026-07-16T15:08:54.019369Z","alert_count":0,"request_count":2,"received_data":17839,"sent_data":1059,"comment":"","tags":null,"fingerprints":[{"name":"Azure Front Door","description":"Azure Front Door is a scalable and secure entry point for fast delivery of your global web applications.","website":"https://docs.microsoft.com/en-us/azure/frontdoor/","common_platform_enumeration":"","icon":"Azure.svg","categories":["Load balancers"]},{"name":"Azure","description":"Azure is a cloud computing service for building, testing, deploying, and managing applications and services through Microsoft-managed data centers.","website":"https://azure.microsoft.com","common_platform_enumeration":"","icon":"Azure.svg","categories":["PaaS"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":null},"javascript":{"script":null,"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"account.msauth.live/error.aspx?e=404","fqdn":"account.msauth.live","domain":"msauth.live","tld":"live"},"ip":{"addr":"94.154.172.98","port":443,"asn":208046,"as":"ColocationX Ltd.","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://account.msauth.live/error.aspx?lang=de-AT\u0026refd=account.live.com\u0026refp=landing\u0026e=400","date":"2026-07-17T08:25:10.907Z","timestamp":1784276710907,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"msauth.live","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:37:27 GMT","end":"Wed, 14 Oct 2026 21:37:26 GMT"},"fingerprint":{"sha1":"A5:AB:F1:10:A6:C9:CD:3E:05:B0:B7:3D:24:0A:AE:19:40:45:DE:05","sha256":"09:23:29:CE:0C:66:FE:8B:F5:06:ED:A2:4A:51:68:D2:D9:49:E9:6C:E2:88:79:68:5C:A2:55:94:30:7B:DB:BB"}}},"request":{"raw":"GET /error.aspx?e=404 HTTP/1.1\r\nHost: account.msauth.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nReferer: https://account.msauth.live/error.aspx?lang=de-AT\u0026refd=account.live.com\u0026refp=landing\u0026e=400\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nCookie: amcanary=0; amsc=Qd3QrU2xcEiwV/+99WSCwMIh2SZouLSgf+4bB9ptykaKUMifjcub8hK1nMBqAytXZMShtO53wNYosqCYJ9E39ut+bLUszOeeTPbbS5gSYokKT0z6DEXyJVdjeQIKG1RMrtnhnkOPtIimnYO7lCEe/XHtG/XuxUV4Rwerjkg4bz0mVCt4zt9pvdAGemi2tS07KdvgdImG9+vaSp1Tjq81uZOS/BI06EAVLQbqsbTRnjDVv8o12VnmJNFEF8Vzspep:2:3c\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Fri, 17 Jul 2026 08:25:11 GMT\r\nContent-Type: text/html; charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: Express\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS\r\nAccess-Control-Allow-Headers: Content-Type, Authorization, client-request-id, canary, hpgact, hpgid, hpgrequestid\r\nPermissions-Policy: local-network-access=(), bluetooth=(), usb=(), serial=(), camera=(), microphone=(), display-capture=(), interest-cohort=(), publickey-credentials-get=(self)\r\nSet-Cookie: amcanary=0; path=/; secure; HttpOnly; SameSite=None; domain=account.msauth.live\r\nETag: W/\"4b5d8-VNL4SSKu+kbhPcy5krr8lCz6CZQ\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]}],"data":{"size":308696,"size_decoded":101903,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (5948), with CRLF, LF line terminators","md5":"ebbbc4925fe815c26bc5244e713124ff","sha1":"54d2f84922aefa46e13dccb992bafc942cfa0994","sha256":"a666922c457d8300f5289d5daa63223446cb96b1cd2afe72f2324d8ece3503d6","sha512":"b80d761eda7d22699bac257fb064b211159578a4005f0195cf1676b35b3c45c0030c19e329d8b4ee340763e7ff64fbc5ef9bd92cf32adf5216d491ef11280a6e","ssdeep":"6144:hXCBTKpG6rapIedF00qkU4bF5MBt4MqMVkUqMr:hXCM8eH0qkU4bF5MBJqMVF","tlshash":"c1645e887990343241774231b0eb7d0bf2311543aa268969f22dedea5f79e8f4723f59","first_seen":"2026-07-17T08:25:47.616301Z","last_seen":"2026-07-17T08:25:47.616301Z","times_seen":1,"resource_available":false,"data":null}},"time_used":510,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":462,"receive":48,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"account.msauth.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"account.msauth.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"account.msauth.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"acctcdn.msauth.net/jquerypackage_1.10_E5e45mTJBEuTNlPjggio9A2.js?v=1","fqdn":"acctcdn.msauth.net","domain":"msauth.net","tld":"net"},"ip":{"addr":"","port":0,"asn":0,"as":"","country":"","country_code":"zz"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://account.msauth.live/error.aspx?lang=de-AT\u0026refd=account.live.com\u0026refp=landing\u0026e=400","date":"2026-07-17T08:25:11.641Z","timestamp":1784276711641,"http_version":"","security_state":"","security_info":null,"request":{"raw":"GET /jquerypackage_1.10_E5e45mTJBEuTNlPjggio9A2.js?v=1 HTTP/1.1\r\nHost: acctcdn.msauth.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nOrigin: https://account.msauth.live\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://account.msauth.live/\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: cors\r\nSec-Fetch-Site: cross-site\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"","headers":null,"cookies":null,"status_code":"","status_text":"","fingerprints":null,"data":{"size":0,"size_decoded":0,"mime_type":"","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T14:40:26.336623Z","times_seen":17316417,"resource_available":true,"data":null}},"time_used":0,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":0,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"acctcdn.msauth.net/images/favicon.ico?v=2","fqdn":"acctcdn.msauth.net","domain":"msauth.net","tld":"net"},"ip":{"addr":"13.107.246.53","port":443,"asn":8075,"as":"MICROSOFT-CORP-MSN-AS-BLOCK","country":"United States","country_code":"US"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://account.msauth.live/error.aspx?lang=de-AT\u0026refd=account.live.com\u0026refp=landing\u0026e=400","date":"2026-07-17T08:25:12.634Z","timestamp":1784276712634,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"P256","signature_name":"RSA-PSS-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"identitycdn.msauth.net","organization":""},"issuer":{"commonName":"Microsoft TLS G2 RSA CA OCSP 10","organization":"Microsoft Corporation"},"validity":{"start":"Tue, 07 Jul 2026 23:53:26 GMT","end":"Sun, 03 Jan 2027 23:53:26 GMT"},"fingerprint":{"sha1":"88:6F:19:4E:A2:60:01:AB:AA:D5:C0:B0:DC:95:97:50:E0:6E:E4:CD","sha256":"25:1F:69:3B:20:2C:96:0A:98:A6:7B:4E:42:EE:8B:49:07:08:2B:73:4C:87:8D:63:2B:EC:AB:C3:E4:01:02:76"}}},"request":{"raw":"GET /images/favicon.ico?v=2 HTTP/1.1\r\nHost: acctcdn.msauth.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://account.msauth.live/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ndate: Fri, 17 Jul 2026 08:25:12 GMT\r\ncontent-type: image/x-icon\r\ncontent-length: 17174\r\ncache-control: public, max-age=31536000\r\nlast-modified: Tue, 14 Jul 2026 04:51:33 GMT\r\netag: \"0x8DEE163945080E6\"\r\nx-ms-request-id: 35f02705-901e-00a2-0989-1379b2000000\r\nx-ms-version: 2018-03-28\r\naccess-control-expose-headers: Accept-Ranges,Cache-Control,Content-Length,Content-Range,Content-Type,Date,ETag,Last-Modified,Server,x-ms-request-id,x-ms-version\r\naccess-control-allow-origin: *\r\nx-azure-ref: 20260717T082512Z-158c8677bf9ggtc8hC1SVGmrew000000092g000000001q53\r\nx-fd-int-roxy-purgeid: 79215828\r\nx-cache: TCP_HIT\r\naccept-ranges: bytes\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Azure Front Door","description":"Azure Front Door is a scalable and secure entry point for fast delivery of your global web applications.","website":"https://docs.microsoft.com/en-us/azure/frontdoor/","common_platform_enumeration":"","icon":"Azure.svg","categories":["Load balancers"]},{"name":"Azure","description":"Azure is a cloud computing service for building, testing, deploying, and managing applications and services through Microsoft-managed data centers.","website":"https://azure.microsoft.com","common_platform_enumeration":"","icon":"Azure.svg","categories":["PaaS"]}],"data":{"size":17174,"size_decoded":17839,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors","md5":"12e3dac858061d088023b2bd48e2fa96","sha1":"e08ce1a144eceae0c3c2ea7a9d6fbc5658f24ce5","sha256":"90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21","sha512":"c5030c55a855e7a9e20e22f4c70bf1e0f3c558a9b7d501cfab6992ac2656ae5e41b050ccac541efa55f9603e0d349b247eb4912ee169d44044271789c719cd01","ssdeep":"24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO","tlshash":"b772e35b1f5f4981ec4b0db80b125e80c5e49c973854dffbdb76b62888b0364ab845eb","first_seen":"2023-04-05T03:19:57Z","last_seen":"2026-07-17T14:16:52.091757Z","times_seen":169040,"resource_available":false,"data":null}},"time_used":38,"timings":{"blocked":0,"dns":0,"connect":8,"send":0,"wait":12,"receive":0,"ssl":18},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"account.msauth.live/error.aspx?lang=de-AT\u0026refd=account.live.com\u0026refp=landing\u0026e=400","fqdn":"account.msauth.live","domain":"msauth.live","tld":"live"},"ip":{"addr":"94.154.172.98","port":443,"asn":208046,"as":"ColocationX Ltd.","country":"Bulgaria","country_code":"BG"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-17T08:25:09.116Z","timestamp":1784276709116,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"msauth.live","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:37:27 GMT","end":"Wed, 14 Oct 2026 21:37:26 GMT"},"fingerprint":{"sha1":"A5:AB:F1:10:A6:C9:CD:3E:05:B0:B7:3D:24:0A:AE:19:40:45:DE:05","sha256":"09:23:29:CE:0C:66:FE:8B:F5:06:ED:A2:4A:51:68:D2:D9:49:E9:6C:E2:88:79:68:5C:A2:55:94:30:7B:DB:BB"}}},"request":{"raw":"GET /error.aspx?lang=de-AT\u0026refd=account.live.com\u0026refp=landing\u0026e=400 HTTP/1.1\r\nHost: account.msauth.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nUpgrade-Insecure-Requests: 1\r\nConnection: keep-alive\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 200 OK\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Fri, 17 Jul 2026 08:25:10 GMT\r\nContent-Type: text/html; charset=utf-8\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nX-Powered-By: Express\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS\r\nAccess-Control-Allow-Headers: Content-Type, Authorization, client-request-id, canary, hpgact, hpgid, hpgrequestid\r\nPermissions-Policy: local-network-access=(), bluetooth=(), usb=(), serial=(), camera=(), microphone=(), display-capture=(), interest-cohort=(), publickey-credentials-get=(self)\r\nSet-Cookie: amcanary=0; path=/; secure; HttpOnly; SameSite=None; domain=account.msauth.live\namcanary=0; path=/; secure; HttpOnly; SameSite=None; domain=account.msauth.live\namsc=Qd3QrU2xcEiwV/+99WSCwMIh2SZouLSgf+4bB9ptykaKUMifjcub8hK1nMBqAytXZMShtO53wNYosqCYJ9E39ut+bLUszOeeTPbbS5gSYokKT0z6DEXyJVdjeQIKG1RMrtnhnkOPtIimnYO7lCEe/XHtG/XuxUV4Rwerjkg4bz0mVCt4zt9pvdAGemi2tS07KdvgdImG9+vaSp1Tjq81uZOS/BI06EAVLQbqsbTRnjDVv8o12VnmJNFEF8Vzspep:2:3c; domain=.msauth.live; path=/; secure; HttpOnly; SameSite=None\r\nETag: W/\"4b5d1-s2wFTs+ShfxgsKHYG9rVeE0EHiw\"\r\nContent-Encoding: gzip\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"OK","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":308689,"size_decoded":102295,"mime_type":"text/html; charset=utf-8","magic":"JavaScript source, ASCII text, with very long lines (5948), with CRLF, LF line terminators","md5":"197696edf2df2f77f10c41361710c0d4","sha1":"b36c054ecf9285fc60b0a1d81bdad5784d041e2c","sha256":"b88edcca735bb98ee7d867ab1f0a7bca62481c54a603ddd0b17d1f771244e978","sha512":"01cb0f551837ec165fdfdbcb14d623204d538fd7a1a50a4d307e06d1e8928951bd5dc577308dc8ad6a7eb509955538bf22384ae332062b436c685963b54e164a","ssdeep":"6144:PXCBTKpG6rapIKeFD0qkU4bF50Bt4MAM8MkqWr:PXCM8eX0qkU4bF50BJAM8T","tlshash":"2a645e887980343241774231b0eb7d0bf2351553aa268969f22dedea5f79e8f0723f59","first_seen":"2026-07-17T08:25:47.621656Z","last_seen":"2026-07-17T08:25:47.621656Z","times_seen":1,"resource_available":true,"data":null}},"time_used":1320,"timings":{"blocked":-1,"dns":298,"connect":36,"send":0,"wait":875,"receive":45,"ssl":65},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"account.msauth.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"account.msauth.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"account.msauth.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}},{"url":{"schema":"https","addr":"account.msauth.live/mailer-client-log.js","fqdn":"account.msauth.live","domain":"msauth.live","tld":"live"},"ip":{"addr":"94.154.172.98","port":443,"asn":208046,"as":"ColocationX Ltd.","country":"Bulgaria","country_code":"BG"},"is_navigation_request":false,"resource_type":"script","requested_by":"https://account.msauth.live/error.aspx?lang=de-AT\u0026refd=account.live.com\u0026refp=landing\u0026e=400","date":"2026-07-17T08:25:10.612Z","timestamp":1784276710612,"http_version":"HTTP/1.1","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"msauth.live","organization":""},"issuer":{"commonName":"YE2","organization":"Let's Encrypt"},"validity":{"start":"Thu, 16 Jul 2026 21:37:27 GMT","end":"Wed, 14 Oct 2026 21:37:26 GMT"},"fingerprint":{"sha1":"A5:AB:F1:10:A6:C9:CD:3E:05:B0:B7:3D:24:0A:AE:19:40:45:DE:05","sha256":"09:23:29:CE:0C:66:FE:8B:F5:06:ED:A2:4A:51:68:D2:D9:49:E9:6C:E2:88:79:68:5C:A2:55:94:30:7B:DB:BB"}}},"request":{"raw":"GET /mailer-client-log.js HTTP/1.1\r\nHost: account.msauth.live\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: */*\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://account.msauth.live/error.aspx?lang=de-AT\u0026refd=account.live.com\u0026refp=landing\u0026e=400\r\nCookie: amcanary=0; amsc=Qd3QrU2xcEiwV/+99WSCwMIh2SZouLSgf+4bB9ptykaKUMifjcub8hK1nMBqAytXZMShtO53wNYosqCYJ9E39ut+bLUszOeeTPbbS5gSYokKT0z6DEXyJVdjeQIKG1RMrtnhnkOPtIimnYO7lCEe/XHtG/XuxUV4Rwerjkg4bz0mVCt4zt9pvdAGemi2tS07KdvgdImG9+vaSp1Tjq81uZOS/BI06EAVLQbqsbTRnjDVv8o12VnmJNFEF8Vzspep:2:3c\r\nSec-Fetch-Dest: script\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/1.1 302 Found\r\nServer: nginx/1.24.0 (Ubuntu)\r\nDate: Fri, 17 Jul 2026 08:25:10 GMT\r\nContent-Type: text/plain; charset=utf-8\r\nContent-Length: 39\r\nConnection: keep-alive\r\nX-Powered-By: Express\r\nAccess-Control-Allow-Origin: *\r\nAccess-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS\r\nAccess-Control-Allow-Headers: Content-Type, Authorization, client-request-id, canary, hpgact, hpgid, hpgrequestid\r\nPermissions-Policy: local-network-access=(), bluetooth=(), usb=(), serial=(), camera=(), microphone=(), display-capture=(), interest-cohort=(), publickey-credentials-get=(self)\r\nLocation: /error.aspx?e=404\r\nVary: Accept\r\n\r\n","headers":null,"cookies":null,"status_code":"302","status_text":"Found","fingerprints":[{"name":"Nginx:1.24.0","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]},{"name":"Express","description":"Express is a web application framework for Node.js, released as free and open-source software under the MIT License. It is designed for building web applications and APIs.","website":"https://expressjs.com","common_platform_enumeration":"cpe:2.3:a:expressjs:express:*:*:*:*:*:*:*:*","icon":"Express.svg","categories":["Web frameworks","Web servers"]},{"name":"Node.js","description":"Node.js is an open-source, cross-platform, JavaScript runtime environment that executes JavaScript code outside a web browser.","website":"https://nodejs.org","common_platform_enumeration":"cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*","icon":"Node.js.svg","categories":["Programming languages"]},{"name":"Ubuntu","description":"Ubuntu is a free and open-source operating system on Linux for the enterprise server, desktop, cloud, and IoT.","website":"https://www.ubuntu.com/server","common_platform_enumeration":"cpe:2.3:o:canonical:ubuntu_linux:*:*:*:*:*:*:*:*","icon":"Ubuntu.svg","categories":["Operating systems"]}],"data":{"size":0,"size_decoded":0,"mime_type":"text/html; charset=utf-8","magic":"","md5":"d41d8cd98f00b204e9800998ecf8427e","sha1":"da39a3ee5e6b4b0d3255bfef95601890afd80709","sha256":"e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855","sha512":"cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e","ssdeep":"","tlshash":"","first_seen":"0001-01-01T00:00:00Z","last_seen":"2026-07-17T14:40:26.336623Z","times_seen":17316417,"resource_available":true,"data":null}},"time_used":289,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":289,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"opendns","sensor_type":"DNS","title":"OpenDNS","description":"OpenDNS","scan_date":"2026-07-17","alert":"Phishing Block","trigger":"account.msauth.live","verdict":"phishing","severity":"medium","comment":"","link":"https://www.opendns.com/","meta":null},{"sensor_name":"cloudflare_dns","sensor_type":"DNS","title":"Cloudflare DNS","description":"Cloudflare DNS","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"account.msauth.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.cloudflare.com/application-services/products/dns/","meta":null},{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-17","alert":"Sinkholed","trigger":"account.msauth.live","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":null}}]}