urlquery Phishing - Microsoft
VerdictPhishing
Severitymedium
WEBSITE ANALYSIS REPORT
https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=78ce50cb-54eb-42b2-9e79-9c71b0309da7&response_type=code&response_mode=query&scope=openid+profile+email+https%3A%2F%2Fgraph.microsoft.com%2FUser.Read&prompt=none&state=aS5zY2FuZG9sYXJhQG9jcmltLmNvbQ==
public
Phishing detected
Review evidence →4 detections · review the detection signals
Report summary
Submitted and final observations · captured HTTP activity
- Submitted URL
- https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=78ce50cb-54eb-42b2-9e79-9c71b0309da7&response_type=code&response_mode=query&scope=openid+profile+email+https%3A%2F%2Fgraph.microsoft.com%2FUser.Read&prompt=none&state=aS5zY2FuZG9sYXJhQG9jcmltLmNvbQ==
- Submitted IP / ASN
20.190.147.5 AS8075 · MICROSOFT-CORP-MSN-AS-BLOCK
- Final URL
- https://pricemacr-ent.taintariors.co.uk/common/login
- Final IP / ASN
137.184.30.104 AS14061 · DIGITALOCEAN-ASN
Final page
- Page title
- Sign in to your account
- Final DOM MIME
- text/html; charset=utf-8
- Final DOM size
- 1.1 KB (1104 bytes)
Detections
Activity
- HTTP requests
- 46
- Observed hosts
- 8
- Script records
- 407
Estimated HTTP data
- Sent
- ~38.0 KB
- Received
- ~2.59 MB
Page capture
Final browser state
pricemacr-ent.taintariors.co.uk
Screenshot unavailableNo screenshot pixels areavailable for this report.
Detection signals
URLQuery findings, Threat Detection Systems, and IDS alerts
URLQuery
2urlquery Phishing - Microsoft Outlook
VerdictPhishing
Severitymedium
Threat Detection Systems
1DNS4EU Sinkholed
VerdictMalicious
Severitymedium
Host infrastructure
Observed hosts are context, not independent maliciousness verdicts
| Host | Rank | Registered | First seen | Last seen | Sent | Received | IP | Fingerprints |
|---|---|---|---|---|---|---|---|---|
| login.live.com | 179 | 1994-12-28 | 2012-05-21 | 2026-04-15 | 1.4 KB | 5.6 KB | 20.190.147.5 | HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. |
| portal.microsoftonline.com | 222862 | 2002-07-09 | 2014-01-23 | 2026-04-18 | 1.2 KB | 3.5 KB | 150.171.74.13 | |
| login.microsoftonline.com | 52 | 2002-07-09 | 2017-02-19 | 2026-04-20 | 2.2 KB | 28.4 KB |  40.126.53.6 | HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. |
| aadcdn.msauth.net | 5248 | 2018-10-25 | 2018-11-19 | 2026-04-15 | 523 B | 147.7 KB | 13.107.246.53 | Azure Front Door Load balancers Azure Front Door is a scalable and secure entry point for fast delivery of your global web applications. Azure PaaS Azure is a cloud computing service for building, testing, deploying, and managing applications and services through Microsoft-managed data centers. |
| aadcdn.msftauth.net | 5262 | 2018-10-25 | 2018-11-19 | 2026-04-20 | 12.0 KB | 2.22 MB | 2.22.225.32 | |
| solarworldbotswana.co.bw 2 alerts | N/A | 2023-08-14 | 2026-04-09 | 2026-04-20 | 1.3 KB | 3.1 KB | 192.250.227.228 | LiteSpeed Web servers LiteSpeed is a high-scalability web server. |
| pricemacr-ent.taintariors.co.uk 22 alerts | N/A | 2026-02-11 | 2026-04-22 | 2026-04-22 | 14.0 KB | 166.0 KB | 137.184.30.104 | |
| autologon.microsoftazuread-sso.com | 5151 | 2016-07-22 | 2017-01-30 | 2026-04-16 | 651 B | 21.3 KB | 20.231.128.65 | jQuery JavaScript libraries jQuery is a JavaScript library which is a free, open-source software designed to simplify HTML DOM tree traversal and manipulation, as well as event handling, CSS animation, and Ajax. |