https://login.microsoft.com//////////////////////////////common/oauth2/v2.0/authorize?state=&scope=openid+profile+https%253A%252F%252Fgraph.microsoft.com%252FUser.Read&prompt=none&client_id=e3200116-dd42-406a-a688-d3ce712e66a9&uri=https%253A%252F%252Fdeveloper.salesforce.com%252Fdashboard%252Fsession%252Fuser%252Fverify%252Fstep1&%255Ca3edq%250C+2e4c%250D%250A%2593bb66f835%2509%258C2979X%25BCint+Builder.Decode%250A%2509Context+%253A%253D+FlowEmail+%255B+OffsetStream+%253A=%2520Token%2509Data%2520%257C%2520Email%257Dfor%2520Stream%253A%253DPayloadBuilder+;+ValueContext+%257D+Trace%250A%2509Decode+.+SignalVector+%257B%2520Offset%257D%250Aa78c998ef06b569e%2597%25E9%252A%25CBa93627d06a07eba872664f4a92c74eae25f60308d1cad09a16e7beef0b79c03d8bd7528c4a7efc8bdb3fc053evar%252BVector-Secret%25250A%252509Decode%252B%25253B%252BBuffer%25250A%252509Encode%252B-%252BSession%25250A%252509Decode%252B%25255D%252BPayload%25250A%252509Offset%252B%25252B%252BBuilder%25250A%252509Builder%252B%252528%252BToken%25250A%252509Encode%252B.%252BKey%25250A%252509Context%252B%25257B%252BToken%25250A%25257D%25250Aelse%252BDecode%25252CBuilder%25250A%252509Stream%252B%25253A%25253D%252BHeader%25250A%252509Vector%252B%252526%252BVector%25250A%252509Payload%252B%25253D%252BBuilder%25250A%252509Value%252B%25257C%252BPayload%25250A%252509Secret%252B%25253D%252BBuffer%25250A%25257D%25250Aswitch%252BPayload%25252CSession%25250A%252509Payload%252B%252529%252BToken%25250A%252509Payload%252B%252526%252BBuilder%25250A%252509Data%252B%25257C%252BDecode%25250A%252509Secret%252B%25255B%252BStream%25250A%25257D%25250Astring%252BBody%252529Session%25250A%252509Session%252B%252528%252BTrace%25250A%252509Buffer%252B%25257B%252BSession%25250A%252509Vector%252B%25252A%252BVector%25250A%252509Context%252B%25253B%252BToken%25250A%252509Value%252B%25252A%252BData%25250A%252509Encode%252B%25253B%252BFlow%25250A%252509Trace%252B%252529%252BTrace%25250A%25257D%25250Aint%252BToken%25257CSignal%25250A%252509Header%252B%25255D%252BFlow%25250A%252509Body%252B.%252BKey%25250A%252509Vector%252B%252528%252BSignal%25250A%252509Session%252B%25252C%252BData%25250A%25257D%25250Ac2FuZGVlcEBmdmNvbS5hZQ
5 detections · review the detection signals
Host summary
Observed host history, traffic, and infrastructure
| Host | Rank | Registered | First seen | Last seen | Sent | Received | IP | Fingerprints |
|---|---|---|---|---|---|---|---|---|
| aadcdn.msftauth.net | 5262 | 2018-10-25 | 2018-11-19 | 2026-09-21 | 550 B | 148.1 KB |  23.33.119.104 | |
| appleid.cdn-apple.com | 21465 | 2010-11-04 | 2013-09-15 | 2026-09-18 | 496 B | 42.4 KB | 23.36.76.98 | HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. |
| play.google.com | 48 | 1997-09-15 | 2013-05-30 | 2026-09-21 | 555 B | 517 B |  142.250.178.110 | |
| abs.twimg.com | 23325 | 2008-09-22 | 2013-04-10 | 2026-09-21 | 326.4 KB | 7.99 MB |  199.232.172.159 | HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. |
| x.com | 84 | 1993-04-02 | 2012-08-16 | 2026-09-17 | 2.0 KB | 328.6 KB |  172.66.0.227 | HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. Arkose Labs Security Arkose Labs is a toolkit for fraud prevention that provides solutions to detect and mitigate malicious activity across digital platforms. Plaid Payment processors, Miscellaneous Plaid is a fintech company that facilitates communication between financial services apps and users' banks and credit card providers. Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. |
| jf.x.com | N/A | 1993-04-02 | 2025-05-21 | 2026-09-17 | 3.6 KB | 15.0 KB | 162.159.140.229 | HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. Cloudflare Bot Management Security Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots. |
| deliquesce294.devoraf.co.uk 1 alerts | N/A | 2026-03-25 | 2026-09-21 | 2026-09-21 | 693 B | 1.1 KB | 104.21.77.72 | Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. |
| login.microsoftonline.com | 52 | 2002-07-09 | 2017-02-19 | 2026-09-21 | 7.0 KB | 31.3 KB |  20.190.181.1 | HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. |
| login.microsoft.com | 24331 | 1991-05-02 | 2014-08-12 | 2026-09-15 | 2.6 KB | 4.3 KB |  20.190.177.21 | HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. |
| sportspromotion.mx 8 alerts | N/A | 2024-12-06 | 2026-07-17 | 2026-09-21 | 1.3 KB | 639 B | 162.241.62.63 | Nginx:1.29.8 Web servers, Reverse proxies Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache. |
| api.x.com | 20799 | 1993-04-02 | 2017-05-09 | 2026-09-21 | 4.1 KB | 8.2 KB | 162.159.140.229 | Cloudflare Bot Management Security Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots. Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. |
| accounts.google.com | 103 | 1997-09-15 | 2012-05-23 | 2026-09-21 | 1.7 KB | 460.8 KB | 172.253.148.84 | |
| fonts.gstatic.com | N/A | 2008-02-11 | 2014-04-02 | 2026-09-20 | 1.1 KB | 109.4 KB | 142.250.178.35 | |
| login.live.com | 179 | 1994-12-28 | 2012-05-21 | 2026-09-17 | 571 B | 4.1 KB | 20.190.177.83 | HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. |
Observed certificates
Distinct fingerprints recorded in HTTP transactions
| Subject | Issuer | Valid from | Valid until | Fingerprint | Hosts |
|---|---|---|---|---|---|
| *.twimg.com | Let's Encrypt · YR2 | Tue, 15 Sep 2026 20:20:31 GMT | Mon, 14 Dec 2026 20:20:30 GMT | SHA25600:D1:C1:04:88:9E:3E:75:02:A2:DA:AC:8A:26:54:24:D9:E7:0E:E4:9A:DE:C2:7F:4D:94:B0:2A:6A:5A:A5:FC | abs.twimg.com |
| *.x.com | Let's Encrypt · YR2 | Fri, 14 Aug 2026 17:47:59 GMT | Thu, 12 Nov 2026 17:47:58 GMT | SHA25622:86:05:C7:DA:F9:E4:C5:53:08:9B:1F:20:F9:87:0D:43:DD:A9:80:4B:1C:13:9C:56:01:7C:BF:0D:71:6B:A0 | x.com jf.x.com api.x.com |
| *.sportspromotion.mx | Let's Encrypt · YR1 | Sun, 13 Sep 2026 13:17:47 GMT | Sat, 12 Dec 2026 13:17:46 GMT | SHA256D4:A3:81:A6:0E:4C:5E:50:EB:E7:6C:C8:C8:95:06:C9:22:D9:C1:BA:8B:9F:2D:D1:F0:E3:C5:80:95:34:51:D4 | sportspromotion.mx |
| stamp2.login.microsoftonline.com | Microsoft Corporation · Microsoft TLS G2 RSA CA OCSP 04 | Tue, 08 Sep 2026 17:50:32 GMT | Thu, 17 Dec 2026 16:50:32 GMT | SHA2562E:CC:85:F6:4C:CC:5D:1C:A8:F5:6A:ED:21:6A:33:63:A3:0F:27:A2:15:B4:36:DF:7F:55:7F:66:8F:87:7C:25 | login.microsoftonline.com |
| *.google.com | Google Trust Services · WR2 | Fri, 04 Sep 2026 08:04:41 GMT | Fri, 27 Nov 2026 08:04:40 GMT | SHA25627:A0:25:F5:B2:3F:C8:25:B7:BF:72:41:6C:48:6A:75:BC:C8:0D:C3:44:11:27:96:CE:FB:61:3D:59:34:73:06 | accounts.google.com |
| *.gstatic.com | Google Trust Services · WE2 | Fri, 04 Sep 2026 08:06:14 GMT | Fri, 27 Nov 2026 08:06:13 GMT | SHA25644:EE:C5:6A:08:A1:AE:B6:0C:23:F4:3C:53:06:12:05:DD:B7:E6:D4:54:60:3B:8E:37:C2:E8:85:98:FD:83:85 | fonts.gstatic.com |
| login.live.com | DigiCert Inc · DigiCert Global G2 TLS RSA SHA256 2020 CA1 | Wed, 05 Aug 2026 00:00:00 GMT | Fri, 13 Nov 2026 23:59:59 GMT | SHA256CA:14:9A:74:6A:7D:2A:BB:9E:26:89:3F:6C:D7:06:AF:05:9A:A1:E0:5E:98:1E:8A:FE:41:AA:86:A5:EC:39:19 | login.live.com |
| idnaakamaicdn.msftauth.net | Microsoft Corporation · Microsoft TLS G2 ECC CA OCSP 02 | Tue, 10 Feb 2026 18:29:15 GMT | Fri, 05 Feb 2027 18:29:15 GMT | SHA25626:06:65:FC:25:8B:05:0E:C1:76:C6:E2:3C:FF:76:A2:A3:52:4E:8D:FC:2D:48:D0:74:7E:6E:33:DA:49:4A:3D | aadcdn.msftauth.net |
| accounts.google.com | Google Trust Services · WR2 | Fri, 04 Sep 2026 08:06:54 GMT | Fri, 27 Nov 2026 08:06:53 GMT | SHA25674:BB:7D:05:6B:1C:F1:37:1E:0F:13:92:8A:05:90:C6:45:A6:1C:CC:25:8F:AE:71:FA:79:54:03:35:4C:18:32 | accounts.google.com |
| appleid.cdn-apple.com | Apple Inc. · Apple Public EV Server RSA CA 1 - G1 | Tue, 18 Aug 2026 15:48:55 GMT | Wed, 17 Feb 2027 20:41:16 GMT | SHA256A0:53:67:8A:35:A8:D1:2D:7F:B4:4F:14:21:B1:94:01:BF:9F:3E:74:88:62:53:B0:7A:D0:6C:2B:89:AC:27:17 | appleid.cdn-apple.com |
| *.google.com | Google Trust Services · WE2 | Fri, 04 Sep 2026 08:04:49 GMT | Fri, 27 Nov 2026 08:04:48 GMT | SHA2560E:75:68:E9:92:5A:62:3C:49:65:DA:A4:6F:14:24:90:A0:4C:FE:71:77:99:0A:9A:3D:64:F4:15:CA:CA:43:66 | play.google.com |
| graph.windows.net | DigiCert Inc · DigiCert Global G2 TLS RSA SHA256 2020 CA1 | Fri, 18 Sep 2026 00:00:00 GMT | Sun, 27 Dec 2026 23:59:59 GMT | SHA25689:F2:A7:7A:EE:E2:44:36:04:E2:C8:A6:CA:D0:83:38:40:54:70:04:EC:1D:4A:87:14:80:18:B4:80:CA:2A:45 | login.microsoft.com |