urlquery.net
WEBSITE ANALYSIS REPORT

https://login.microsoft.com//////////////////////////////common/oauth2/v2.0/authorize?state=YnJ1Y2Uuc2lsdmFAY29uc29saWRhdGVkLmNvbQ==&scope=openid+profile+https%253A%252F%252Fgraph.microsoft.com%252FUser.Read&prompt=none&client_id=11f62054-625f-4209-a073-f9494bd83920&uri=https%253A%252F%252Fdeveloper.salesforce.com%252Fdashboard%252Fsession%252Fuser%252Fverify%252Fstep1&%255Ca3edq%250C+2e4c%250D%250A%2593bb66f835%2509%258C2979X%25BCint+Builder.Decode%250A%2509Context+%253A%253D+FlowEmail+%255B+OffsetStream+%253A=%2520Token%2509Data%2520%257C%2520Email%257Dfor%2520Stream%253A%253DPayloadBuilder+;+ValueContext+%257D+Trace%250A%2509Decode+.+SignalVector+%257B%2520Offset%257D%250Aa78c998ef06b569e%2597%25E9%252A%25CBa93627d06a07eba872664f4a92c74eae25f60308d1cad09a16e7beef0b79c03d8bd7528c4a7efc8bdb3fc053evar%252BVector-Secret%25250A%252509Decode%252B%25253B%252BBuffer%25250A%252509Encode%252B-%252BSession%25250A%252509Decode%252B%25255D%252BPayload%25250A%252509Offset%252B%25252B%252BBuilder%25250A%252509Builder%252B%252528%252BToken%25250A%252509Encode%252B.%252BKey%25250A%252509Context%252B%25257B%252BToken%25250A%25257D%25250Aelse%252BDecode%25252CBuilder%25250A%252509Stream%252B%25253A%25253D%252BHeader%25250A%252509Vector%252B%252526%252BVector%25250A%252509Payload%252B%25253D%252BBuilder%25250A%252509Value%252B%25257C%252BPayload%25250A%252509Secret%252B%25253D%252BBuffer%25250A%25257D%25250Aswitch%252BPayload%25252CSession%25250A%252509Payload%252B%252529%252BToken%25250A%252509Payload%252B%252526%252BBuilder%25250A%252509Data%252B%25257C%252BDecode%25250A%252509Secret%252B%25255B%252BStream%25250A%25257D%25250Astring%252BBody%252529Session%25250A%252509Session%252B%252528%252BTrace%25250A%252509Buffer%252B%25257B%252BSession%25250A%252509Vector%252B%25252A%252BVector%25250A%252509Context%252B%25253B%252BToken%25250A%252509Value%252B%25252A%252BData%25250A%252509Encode%252B%25253B%252BFlow%25250A%252509Trace%252B%252529%252BTrace%25250A%25257D%25250Aint%252BToken%25257CSignal%25250A%252509Header%252B%25255D%252BFlow%25250A%252509Body%252B.%252BKey%25250A%252509Vector%252B%252528%252BSignal%25250A%252509Session%252B%25252C%252BData%25250A%25257D%25250Ac2FuZGVlcEBmdmNvbS5hZQ==

public
Submit tags
Request review
Malicious detection

4 detections · review the detection signals

Review evidence →

Report summary

Submitted and final observations · captured HTTP activity

Submitted URL
https://login.microsoft.com//////////////////////////////common/oauth2/v2.0/authorize?state=YnJ1Y2Uuc2lsdmFAY29uc29saWRhdGVkLmNvbQ==&scope=openid+profile+https%253A%252F%252Fgraph.microsoft.com%252FUser.Read&prompt=none&client_id=11f62054-625f-4209-a073-f9494bd83920&uri=https%253A%252F%252Fdeveloper.salesforce.com%252Fdashboard%252Fsession%252Fuser%252Fverify%252Fstep1&%255Ca3edq%250C+2e4c%250D%250A%2593bb66f835%2509%258C2979X%25BCint+Builder.Decode%250A%2509Context+%253A%253D+FlowEmail+%255B+OffsetStream+%253A=%2520Token%2509Data%2520%257C%2520Email%257Dfor%2520Stream%253A%253DPayloadBuilder+;+ValueContext+%257D+Trace%250A%2509Decode+.+SignalVector+%257B%2520Offset%257D%250Aa78c998ef06b569e%2597%25E9%252A%25CBa93627d06a07eba872664f4a92c74eae25f60308d1cad09a16e7beef0b79c03d8bd7528c4a7efc8bdb3fc053evar%252BVector-Secret%25250A%252509Decode%252B%25253B%252BBuffer%25250A%252509Encode%252B-%252BSession%25250A%252509Decode%252B%25255D%252BPayload%25250A%252509Offset%252B%25252B%252BBuilder%25250A%252509Builder%252B%252528%252BToken%25250A%252509Encode%252B.%252BKey%25250A%252509Context%252B%25257B%252BToken%25250A%25257D%25250Aelse%252BDecode%25252CBuilder%25250A%252509Stream%252B%25253A%25253D%252BHeader%25250A%252509Vector%252B%252526%252BVector%25250A%252509Payload%252B%25253D%252BBuilder%25250A%252509Value%252B%25257C%252BPayload%25250A%252509Secret%252B%25253D%252BBuffer%25250A%25257D%25250Aswitch%252BPayload%25252CSession%25250A%252509Payload%252B%252529%252BToken%25250A%252509Payload%252B%252526%252BBuilder%25250A%252509Data%252B%25257C%252BDecode%25250A%252509Secret%252B%25255B%252BStream%25250A%25257D%25250Astring%252BBody%252529Session%25250A%252509Session%252B%252528%252BTrace%25250A%252509Buffer%252B%25257B%252BSession%25250A%252509Vector%252B%25252A%252BVector%25250A%252509Context%252B%25253B%252BToken%25250A%252509Value%252B%25252A%252BData%25250A%252509Encode%252B%25253B%252BFlow%25250A%252509Trace%252B%252529%252BTrace%25250A%25257D%25250Aint%252BToken%25257CSignal%25250A%252509Header%252B%25255D%252BFlow%25250A%252509Body%252B.%252BKey%25250A%252509Vector%252B%252528%252BSignal%25250A%252509Session%252B%25252C%252BData%25250A%25257D%25250Ac2FuZGVlcEBmdmNvbS5hZQ==
Submitted IP / ASN
Sweden 40.126.53.11 AS8075 · Microsoft Corporation
Final URL
https://www.microsoft.com/en-us/microsoft-365/outlook/email-and-calendar-software-microsoft-outlook?deeplink=%2Fmail%2F&sdf=0&sessionId=8b4893dd-19cc-4c08-9dc3-50b5670f253c
Final IP / ASN
Norway 2.18.174.85 AS16625 · AKAMAI-AS

Final page

Page title
Microsoft Outlook Personal Email and Calendar | Microsoft 365
Final DOM MIME
text/html; charset=utf-8
Final DOM size
951.7 KB (974530 bytes)

Detections

URLQuery
1
IDS
0
TDS
3

Activity

HTTP requests
213
Observed hosts
22
Script records
81

Estimated HTTP data

Sent
~354.0 KB
Received
~27.95 MB

Page capture

Final browser state

Recorded title

Microsoft Outlook Personal Email and Calendar | Microsoft 365

951.7 KB final DOM

Detection signals

URLQuery findings, Threat Detection Systems, and IDS alerts

URLQuery

1

urlquery Malicious - Cloaked Browser Fingerprinting

VerdictMalicious
Severitymedium

Threat Detection Systems

3

Cloudflare DNS Sinkholed

VerdictMalicious
Severitymedium

DNS4EU Sinkholed

VerdictMalicious
Severitymedium

Quad9 DNS Sinkholed

VerdictMalicious
Severitymedium

Host infrastructure

Observed hosts are context, not independent maliciousness verdicts

HostRankRegisteredFirst seenLast seenSentReceivedIPFingerprints
www.microsoft.com 8121991-05-022012-05-212026-09-2895.5 KB14.04 MBNorway 2.18.174.85
res.public.onecdn.static.microsoft 9302023-05-052024-03-212026-09-288.3 KB5.10 MBCountry unknown 104.18.19.203
browser.events.data.microsoft.com 3801991-05-022018-05-252026-09-251.5 KB603 BUnited States 52.168.117.170
login.microsoftonline.com 522002-07-092017-02-192026-09-287.8 KB39.2 KBSweden 40.126.53.14
admin.microsoft.com 48781991-05-022018-01-102026-09-242.4 KB0 BNot recorded
catalogapi.azure.com 967141994-10-252019-03-042026-06-021.6 KB2.3 KBUnited States 13.107.246.53
outlook.com 1591994-08-182012-06-012026-09-261.0 KB1.4 KBUnited States 52.96.172.98
rum.hlx.page 267142019-08-202022-06-302026-09-25488 B1.7 KBUnited States 151.101.129.91
uhf.microsoft.com 465761991-05-022017-02-012026-09-242.0 KB630.0 KBNorway 23.49.24.19
login.live.com 1791994-12-282012-05-212026-09-252.7 KB3.5 KBFrance 20.190.147.0
res-1.cdn.office.net 9901994-11-142020-12-082026-09-24589 B0 BNot recorded
outlook.live.com 4901994-12-282012-12-232026-09-23496 B22.7 KBNorway 40.99.215.18
uhf-exp-fd-gbcrdgggfbggh0g3.b02.azurefd.net N/A2018-05-082026-04-032026-09-231.1 KB1.7 KBUnited States 13.107.213.53
login.microsoft.com 243311991-05-022014-08-122026-09-222.6 KB4.4 KBSweden 40.126.53.6
play.vidyard.com 469962011-01-272013-05-292026-09-25460 B71.7 KBUnited States 151.101.1.181
aadcdn.msauth.net 52482018-10-252018-11-192026-09-23548 B0 BUnited States 13.107.246.53
eu-office.events.data.microsoft.com 55851991-05-022022-07-182026-09-20830 B897 BIreland 4.207.44.65
cdn-dynmedia-1.microsoft.com 542951991-05-022020-01-312026-09-2516.1 KB7.61 MBNorway 23.33.119.104
catalogartifact.azureedge.net 4294662014-01-222019-03-042026-06-032.0 KB51.7 KBUnited States 13.107.246.53
c.s-microsoft.com 461402012-02-072013-11-062026-09-222.2 KB125.3 KBNorway 2.18.174.85
wcpstatic.microsoft.com 378151991-05-022020-09-152026-09-23449 B277.4 KBUnited States 13.107.213.53
firefighter789.meritpay.com.de 4 alertsN/AN/AN/AN/A766 B1.1 KBCountry unknown 172.67.194.200
Loading evidence…
WORKSPACE SETTINGS

Display preferences

Saved on this device.

SuccessInfoWarningDangerCriticalUnknown

Security colors remain independent of your accent.

Go to…

Recent scans ↵ Search reports /Search hosts ↵

No matching commands.

Ctrl/⌘ K Commands · Esc Close

LOCAL DEMONSTRATION

Notifications

No live event connection.

No notifications yet. Preview an event below.

Full request body

Full screenshot

Full browser screenshot