WEBSITE ANALYSIS REPORT

https://medium.com/m/global-identity-2?redirectUrl=https://msredirect-browser.com/

20 Aug 2026 · 06:38:43.000 UTCpublic

Report tags: microsoft phishing evilginx aitm
Submit tags

Request review

Phishing detected

8 detections · review the detection signals

Review evidence →

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

06:38:01.664 GET 307 document 0 B 190 ms —

06:38:01.864 GET 302 document 0 B 2063 ms —

06:38:03.932 GET 200 document 5.4 KB 62 ms —

06:38:04.247 GET 200 img 3.6 KB 106 ms —

06:38:04.251 GET 302 img 0 B 174 ms —

06:38:04.430 GET 200 img 5.4 KB 70 ms —

06:38:04.506 GET 302 img 0 B 150 ms —

06:38:04.661 GET 200 img 5.4 KB 37 ms —

06:38:14.761 GET 302 document 0 B 239 ms 3 alerts

06:38:15.009 GET 302 document 0 B 303 ms 3 alerts

06:38:15.318 GET 302 document 0 B 309 ms 2 alerts

06:38:15.634 GET 200 document 58.1 KB 443 ms 3 alerts

06:38:16.136 GET 200 stylesheet 111.5 KB 51 ms 2 alerts

06:38:16.137 GET 200 script 575.3 KB 978 ms 2 alerts

Transaction #02

Request / response

URL

GET HTTPS

https://cdn-2.srf-wsignin-live.com/shared/1.0/content/js/ConvergedLogin_PCore_iGr4o2yoBDyfwvXs2HIE3g2.js

IP / ASN

172.67.169.228

AS13335 · CLOUDFLARENET

Requested by: https://login.srf-wsignin-live.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=639228046955248910.N2QxNzA2OGItYzk2Mi00ZTA1LWI2ZmMtZGU3ZTgzOTZjMWUxNTc3ZDlhZGItMGY4Ny00YmJjLWIxNTQtNTZhMjdmODEyNTcy&ui_locales=en-US&mkt=en-US&client-request-id=89120a15-81d2-4a07-bf78-15b642bec6cc&siwa=1&siwg=1&state=rTvJFopIRhgCM7A4xvonznEQJfh5ITBX5U20llh1CO30tsmTJClqvwX4KYee5FfuQ0FNi43DreWfQIEfdByXBZoJ188DSzFj9W6kn2OOERlKZiofh4aNkufVgbNGalPtZOcA4pTLpMFEU58L1hQ-dR9zOZMV2y3viTmWZ5aNJkOnoy2qTqlivAWBladw33KqVzG5mjRt8hQaI3UNy_t1Olwa6UlcKckvmlJt1MyjybvITvNiHDv3nYZThh-GyAs0sJvVN7bJJpbKPV6eAF5bz0Dpl4AZlolEiIAeOf4I6TKbTUxFme9z0XL1UicsU0e_5DSKnynN3HdX8IWtX52zLZWMwq3NqRb3MfeSs8xVVPNKnTzxSIHLC7tneSYXhhcG-Ygc2YuHYeZaXg1BAWUYQf8um0Pd75XNuVWyD0oJpgKnwrnwxIGFXZ2PFie96plA&x-client-SKU=ID_NET8_0&x-client-ver=8.16.0.0

Resource information

File type: JavaScript source, ASCII text, with very long lines (64616)
MIME type: application/x-javascript
First seen (UTC): 20 Aug 2026 · 06:38:52.886 UTC
Last seen (UTC): 21 Aug 2026 · 17:56:42.782 UTC
Times seen: 2

Size: 575.3 KB (589069 bytes)
MD5: 249e8b4c9a96080b9181056c898ab969
SHA1: 5589f0dfc2dd58473aef83e4f188092934f86461
SHA256: c211c74f2f169342f092b53475024f487eb5b2f7de92c993a7794b313e465764

Certificate information

Issuer: Google Trust Services · WE1
Subject: srf-wsignin-live.com
Protocol / cipher: TLSv1.3 · TLS_AES_128_GCM_SHA256
SHA1 fingerprint: CF:7D:D5:5B:D1:43:74:21:45:96:7C:60:C9:85:D2:94:F9:6F:AD:0B
Valid from: Fri, 31 Jul 2026 03:33:31 GMT
Valid until: Thu, 29 Oct 2026 04:33:15 GMT

Technology fingerprints

Azure Front Door (Load balancers)
Azure (PaaS)
Cloudflare (CDN)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
urlquery Phishing - Evilginx MitM Proxy	high	Phishing
DNS4EU Sinkholed	medium	Malicious

HTTP headers

Request headers

GET /shared/1.0/content/js/ConvergedLogin_PCore_iGr4o2yoBDyfwvXs2HIE3g2.js HTTP/1.1
Host: cdn-2.srf-wsignin-live.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br, zstd
Referer: https://login.srf-wsignin-live.com/
Origin: https://login.srf-wsignin-live.com
Sec-GPC: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Priority: u=2
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/3 200 
content-encoding: zstd
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,ETag,Last-Modified,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=31536000
priority: u=2,i=?0
content-type: application/x-javascript
date: Thu, 20 Aug 2026 06:38:16 GMT
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
last-modified: Wed, 12 Aug 2026 20:33:50 GMT
server: cloudflare
x-azure-ref: 20260820T063816Z-177f98779c6rtvgkhC1FRA5n4c00000004cg00000000bnnp
x-cache: TCP_HIT
x-fd-int-roxy-purgeid: 0
x-ms-blob-type: BlockBlob
x-ms-lease-status: unlocked
x-ms-request-id: ceb7ede6-501e-0007-1edc-2b9098000000
x-ms-version: 2009-09-19
cf-cache-status: MISS
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=ed0kbVzOO1ZYY%2FVK8kxsTAg4uKOSbI2SNeoCENqNZrWhHkdBfAjj6wYg%2BwRcdw4nnqVs0OqOqlUXCpp6tDaY99doT1yXQBs6qoqIfS1SJ0ZfUKJcgZJsy8UoLcFMXCRhv8I3NAN3PDnRMKe0Kw%3D%3D"}]}
cf-ray: a2df64e6ed4456a2-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri

06:38:16.139 GET 200 script 60.8 KB 518 ms 2 alerts

06:38:16.140 GET 200 script 551 B 247 ms 3 alerts

06:38:16.142 GET 200 script 796 B 240 ms 3 alerts

06:38:17.194 GET 200 script 185.7 KB 33 ms 2 alerts

06:38:17.213 GET No response fetch 0 B 0 ms 3 alerts

06:38:17.227 GET 302 script 0 B 18 ms 3 alerts

06:38:17.250 GET 200 script 20.9 KB 19 ms 3 alerts

06:38:17.289 GET 200 script 399.0 KB 666 ms 2 alerts

06:38:17.427 POST 200 xhr 0 B 64 ms 3 alerts

06:38:17.496 GET 200 img 16.8 KB 76 ms 2 alerts

06:38:18.040 GET 200 script 15.4 KB 33 ms 2 alerts

06:38:18.045 GET 200 img 2.6 KB 30 ms 2 alerts

06:38:18.047 GET 200 img 3.5 KB 71 ms 2 alerts

06:38:18.131 GET 200 img 45.5 KB 32 ms 2 alerts

06:38:18.132 GET 200 img 3.6 KB 33 ms 2 alerts

06:38:18.161 GET 200 subdocument 3.4 KB 407 ms 2 alerts

06:38:18.926 GET 200 img 1.6 KB 284 ms 2 alerts

06:38:18.928 GET 200 img 1.4 KB 74 ms 2 alerts

06:38:18.929 GET 200 img 932 B 325 ms 2 alerts

06:38:20.595 OPTIONS 200 xhr 0 B 435 ms 2 alerts

https://medium.com/m/global-identity-2?redirectUrl=https://msredirect-browser.com/

Domain graph

Hostnames

Connections