DNS4EU Sinkholed
VerdictMalicious
Severitymedium
WEBSITE ANALYSIS REPORT
https://login.microsoft.com//////////////////////////////common/oauth2/v2.0/authorize?state=1202&scope=openid+profile+https%253A%252F%252Fgraph.microsoft.com%252FUser.Read&prompt=none&client_id=967ac14a-0b4d-4175-ab8d-694fdba23afa&uri=https%253A%252F%252Fdeveloper.salesforce.com%252Fdashboard%252Fsession%252Fuser%252Fverify%252Fstep1&%255Ca3edq%250C+2e4c%250D%250A%2593bb66f835%2509%258C2979X%25BCint+Builder.Decode%250A%2509Context+%253A%253D+FlowEmail+%255B+OffsetStream+%253A=%2520Token%2509Data%2520%257C%2520Email%257Dfor%2520Stream%253A%253DPayloadBuilder+;+ValueContext+%257D+Trace%250A%2509Decode+.+SignalVector+%257B%2520Offset%257D%250Aa78c998ef06b569e%2597%25E9%252A%25CBa93627d06a07eba872664f4a92c74eae25f60308d1cad09a16e7beef0b79c03d8bd7528c4a7efc8bdb3fc053evar%252BVector-Secret%25250A%252509Decode%252B%25253B%252BBuffer%25250A%252509Encode%252B-%252BSession%25250A%252509Decode%252B%25255D%252BPayload%25250A%252509Offset%252B%25252B%252BBuilder%25250A%252509Builder%252B%252528%252BToken%25250A%252509Encode%252B.%252BKey%25250A%252509Context%252B%25257B%252BToken%25250A%25257D%25250Aelse%252BDecode%25252CBuilder%25250A%252509Stream%252B%25253A%25253D%252BHeader%25250A%252509Vector%252B%252526%252BVector%25250A%252509Payload%252B%25253D%252BBuilder%25250A%252509Value%252B%25257C%252BPayload%25250A%252509Secret%252B%25253D%252BBuffer%25250A%25257D%25250Aswitch%252BPayload%25252CSession%25250A%252509Payload%252B%252529%252BToken%25250A%252509Payload%252B%252526%252BBuilder%25250A%252509Data%252B%25257C%252BDecode%25250A%252509Secret%252B%25255B%252BStream%25250A%25257D%25250Astring%252BBody%252529Session%25250A%252509Session%252B%252528%252BTrace%25250A%252509Buffer%252B%25257B%252BSession%25250A%252509Vector%252B%25252A%252BVector%25250A%252509Context%252B%25253B%252BToken%25250A%252509Value%252B%25252A%252BData%25250A%252509Encode%252B%25253B%252BFlow%25250A%252509Trace%252B%252529%252BTrace%25250A%25257D%25250Aint%252BToken%25257CSignal%25250A%252509Header%252B%25255D%252BFlow%25250A%252509Body%252B.%252BKey%25250A%252509Vector%252B%252528%252BSignal%25250A%252509Session%252B%25252C%252BData%25250A%25257D%25250Ac2FuZGVlcEBmdmNvbS5hZQ
public
Report summary
Submitted and final observations · captured HTTP activity
- Submitted URL
- https://login.microsoft.com//////////////////////////////common/oauth2/v2.0/authorize?state=1202&scope=openid+profile+https%253A%252F%252Fgraph.microsoft.com%252FUser.Read&prompt=none&client_id=967ac14a-0b4d-4175-ab8d-694fdba23afa&uri=https%253A%252F%252Fdeveloper.salesforce.com%252Fdashboard%252Fsession%252Fuser%252Fverify%252Fstep1&%255Ca3edq%250C+2e4c%250D%250A%2593bb66f835%2509%258C2979X%25BCint+Builder.Decode%250A%2509Context+%253A%253D+FlowEmail+%255B+OffsetStream+%253A=%2520Token%2509Data%2520%257C%2520Email%257Dfor%2520Stream%253A%253DPayloadBuilder+;+ValueContext+%257D+Trace%250A%2509Decode+.+SignalVector+%257B%2520Offset%257D%250Aa78c998ef06b569e%2597%25E9%252A%25CBa93627d06a07eba872664f4a92c74eae25f60308d1cad09a16e7beef0b79c03d8bd7528c4a7efc8bdb3fc053evar%252BVector-Secret%25250A%252509Decode%252B%25253B%252BBuffer%25250A%252509Encode%252B-%252BSession%25250A%252509Decode%252B%25255D%252BPayload%25250A%252509Offset%252B%25252B%252BBuilder%25250A%252509Builder%252B%252528%252BToken%25250A%252509Encode%252B.%252BKey%25250A%252509Context%252B%25257B%252BToken%25250A%25257D%25250Aelse%252BDecode%25252CBuilder%25250A%252509Stream%252B%25253A%25253D%252BHeader%25250A%252509Vector%252B%252526%252BVector%25250A%252509Payload%252B%25253D%252BBuilder%25250A%252509Value%252B%25257C%252BPayload%25250A%252509Secret%252B%25253D%252BBuffer%25250A%25257D%25250Aswitch%252BPayload%25252CSession%25250A%252509Payload%252B%252529%252BToken%25250A%252509Payload%252B%252526%252BBuilder%25250A%252509Data%252B%25257C%252BDecode%25250A%252509Secret%252B%25255B%252BStream%25250A%25257D%25250Astring%252BBody%252529Session%25250A%252509Session%252B%252528%252BTrace%25250A%252509Buffer%252B%25257B%252BSession%25250A%252509Vector%252B%25252A%252BVector%25250A%252509Context%252B%25253B%252BToken%25250A%252509Value%252B%25252A%252BData%25250A%252509Encode%252B%25253B%252BFlow%25250A%252509Trace%252B%252529%252BTrace%25250A%25257D%25250Aint%252BToken%25257CSignal%25250A%252509Header%252B%25255D%252BFlow%25250A%252509Body%252B.%252BKey%25250A%252509Vector%252B%252528%252BSignal%25250A%252509Session%252B%25252C%252BData%25250A%25257D%25250Ac2FuZGVlcEBmdmNvbS5hZQ
- Submitted IP / ASN
20.231.128.67 AS8075 · MICROSOFT-CORP-MSN-AS-BLOCK
- Final URL
- about://about:neterror?e=httpErrorPage&u=https%3A//newsharsdocs.webxitytechnologiencfs.vu/wcjSod%3Ferror%3Dlogin_required%26error_description%3DAADSTS50058%253a+A+silent+sign-in+request+was+sent+but+no+user+is+signed+in.+The+cookies+used+to+represent+the+user%2527s+session+were+not+sent+in+the+request+to+Azure+AD.+This+can+happen+if+the+user+is+using+Internet+Explorer+or+Edge%252c+and+the+web+app+sending+the+silent+sign-in+request+is+in+different+IE+security+zone+than+the+Azure+AD+endpoint+%28login.microsoftonline.com%29.+Trace+ID%253a+e7df41cf-6361-45c5-8a3a-61355c3b8a00+Correlation+ID%253a+9ce9cd5f-e57b-402b-ad98-c72b6c09bf9d+Timestamp%253a+2026-08-30+18%253a51%253a03Z%26error_uri%3Dhttps%253a%252f%252flogin.microsoftonline.com%252ferror%253fcode%253d50058%26state%3D1202%23&c=UTF-8&d=https%3A//newsharsdocs.webxitytechnologiencfs.vu/wcjSod%3Ferror%3Dlogin_required%26error_description%3DAADSTS50058%3A+A+silent+sign-in+request+was+sent+but+no+user+is+signed+in.+The+cookies+used+to+represent+the+user%27s+session+were+not+sent+in+the+request+to+Azure+AD.+This+can+happen+if+the+user+is+using+Internet+Explorer+or+Edge%2C+and+the+web+app+sending+the+silent+sign-in+request+is+in+different+IE+security+zone+than+the+Azure+AD+endpoint+%28login.microsoftonline.com%29.+Trace+ID%3A+e7df41cf-6361-45c5-8a3a-61355c3b8a00+Correlation+ID%3A+9ce9cd5f-e57b-402b-ad98-c72b6c09bf9d+Timestamp%3A+2026-08-30+18%3A51%3A03Z%26error_uri%3Dhttps%3A//login.microsoftonline.com/error%3Fcode%3D50058%26state%3D1202%23%20sent%20back%20an%20error.&a=
- Final IP / ASN
- Not recorded
Final page
- Page title
- Problem loading page
- Final DOM MIME
- text/html; charset=utf-8
- Final DOM size
- 812 B (812 bytes)
Detections
Activity
- HTTP requests
- 3
- Observed hosts
- 3
- Script records
- 0
Estimated HTTP data
- Sent
- ~6.2 KB
- Received
- ~7.9 KB
Page capture
Final browser state
Detection signals
URLQuery findings, Threat Detection Systems, and IDS alerts
Threat Detection Systems
1Host infrastructure
Observed hosts are context, not independent maliciousness verdicts
| Host | Rank | Registered | First seen | Last seen | Sent | Received | IP | Fingerprints |
|---|---|---|---|---|---|---|---|---|
| login.microsoft.com | 24331 | 1991-05-02 | 2014-08-12 | 2026-08-24 | 2.6 KB | 4.3 KB |  20.190.177.82 | HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. |
| login.microsoftonline.com | 52 | 2002-07-09 | 2017-02-19 | 2026-08-24 | 2.6 KB | 2.4 KB | 20.190.147.2 | HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. |
| newsharsdocs.webxitytechnologiencfs.vu 1 alerts | N/A | N/A | 2026-08-30 | 2026-08-30 | 1.1 KB | 1.2 KB |  172.67.143.109 | Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. |