urlquery Phishing - Microsoft
VerdictPhishing
Severitymedium
WEBSITE ANALYSIS REPORT
https://u3609347.ct.sendgrid.net/ls/click?upn=u001.kazUZqGRKwx2DMd-2ByjDszNOkO8M5eLVS0TJ96pwkYxxj7DEIxvwgU-2B5GARfNXrwoti4qHN9SbC-2B9eJhAFwBN1UkhdDhcvEZdPBwnLj3kHMEimLKzg8pp67Ub-2FGECPKdT5Pb0BvmTszz0MkoLRSGprAya7XzC3vT1CggDbGpVcl4f8qB41LqvusNI-2FJnWJ89ypirV6wxOv8YQ8xmPRmg3xxgywmtQPG5J3Uso0K8jLU84768-2FOltysdXUP7uy-2B1whOD-2F3T1lLlzzjso5Pv7oKkyMqfqzvPvPIwgwgWqXEViNFzbjKew-2BuX6TnJgWG4bf8CQM7XmydjLQB0eBNlkulicHfakYNEDcE13hgc8ZKXXzBsVWQPMaZk4WTT0yRjPBO9c4ffQHRR-2BKDaMxCCZsaLfwuGG59qABn-2BKKNZN9oJI3-2BJcBZTDHykzCT5rWaDasMoGvQMIRCw6ZBKqRaFDNTzeblw-2BP6-2BtSueZvF-2Bbb4s6U3gEGe6Ag5J7nxm9WLpYizzIxls1g9FcKgYjup793fMus0rKf9S6a3E-2BCR-2BxxGVD9lcxYYfiUWIn4H8nMeu8b567vVTTQNbjfYaANNJz8iv-2FQ7FREyMjBAce-2F7rFm3b8kyGvWRaefM1a17iz-2FDTwbX7tE0Sgud4Kp76blfg6AKiVYdA-2F58yfatT9PsxD5gKkWHzfZGX3HxC7PU4wfjYhcm5K8aTu3S251-2Fyu-2FYNd0KInZk25oKbOyycTrHETqraADaZZyt-2FQBckMrBqHqbUMl8-2FQPA1tjh63SVtB44Awd9eJg-2BbB2m2HeTr8jdpaKoU6BPKfgka6LXyY-2FS2jmL8y-2BemEwQyDmoEJ1469UvEI21FtswENr5myy-2FtRRVklx5d3peypnbTfXHj76C6tuZpgcwQ9TlkgTVzZyJlHNVXGi19A-3D-3DPm0u_VPBbEfmxBWZAZRWYTvs1PVmo9VUZrS9DwSu5M9vQQBWuNAxaglEwHSccUTLVeYnsk1M1TbO0XWOAmd2XPTg96di6Razu-2BwrtwKzP6b7r-2BScz6OfMQklkMNPOSIdUNGVjG4iOoDSQAQZeItx534ZFYUtG3J0uhSgPyPiZpSwHrAmg44zp20j3Owjx4PgGx05O11lteq5BFBhTBY5aU6OGEatRhZH2cnOIDXTHa-2BwyfzE-3D
public
Phishing detected
Review evidence →3 detections · review the detection signals
Report summary
Submitted and final observations · captured HTTP activity
- Submitted URL
- https://u3609347.ct.sendgrid.net/ls/click?upn=u001.kazUZqGRKwx2DMd-2ByjDszNOkO8M5eLVS0TJ96pwkYxxj7DEIxvwgU-2B5GARfNXrwoti4qHN9SbC-2B9eJhAFwBN1UkhdDhcvEZdPBwnLj3kHMEimLKzg8pp67Ub-2FGECPKdT5Pb0BvmTszz0MkoLRSGprAya7XzC3vT1CggDbGpVcl4f8qB41LqvusNI-2FJnWJ89ypirV6wxOv8YQ8xmPRmg3xxgywmtQPG5J3Uso0K8jLU84768-2FOltysdXUP7uy-2B1whOD-2F3T1lLlzzjso5Pv7oKkyMqfqzvPvPIwgwgWqXEViNFzbjKew-2BuX6TnJgWG4bf8CQM7XmydjLQB0eBNlkulicHfakYNEDcE13hgc8ZKXXzBsVWQPMaZk4WTT0yRjPBO9c4ffQHRR-2BKDaMxCCZsaLfwuGG59qABn-2BKKNZN9oJI3-2BJcBZTDHykzCT5rWaDasMoGvQMIRCw6ZBKqRaFDNTzeblw-2BP6-2BtSueZvF-2Bbb4s6U3gEGe6Ag5J7nxm9WLpYizzIxls1g9FcKgYjup793fMus0rKf9S6a3E-2BCR-2BxxGVD9lcxYYfiUWIn4H8nMeu8b567vVTTQNbjfYaANNJz8iv-2FQ7FREyMjBAce-2F7rFm3b8kyGvWRaefM1a17iz-2FDTwbX7tE0Sgud4Kp76blfg6AKiVYdA-2F58yfatT9PsxD5gKkWHzfZGX3HxC7PU4wfjYhcm5K8aTu3S251-2Fyu-2FYNd0KInZk25oKbOyycTrHETqraADaZZyt-2FQBckMrBqHqbUMl8-2FQPA1tjh63SVtB44Awd9eJg-2BbB2m2HeTr8jdpaKoU6BPKfgka6LXyY-2FS2jmL8y-2BemEwQyDmoEJ1469UvEI21FtswENr5myy-2FtRRVklx5d3peypnbTfXHj76C6tuZpgcwQ9TlkgTVzZyJlHNVXGi19A-3D-3DPm0u_VPBbEfmxBWZAZRWYTvs1PVmo9VUZrS9DwSu5M9vQQBWuNAxaglEwHSccUTLVeYnsk1M1TbO0XWOAmd2XPTg96di6Razu-2BwrtwKzP6b7r-2BScz6OfMQklkMNPOSIdUNGVjG4iOoDSQAQZeItx534ZFYUtG3J0uhSgPyPiZpSwHrAmg44zp20j3Owjx4PgGx05O11lteq5BFBhTBY5aU6OGEatRhZH2cnOIDXTHa-2BwyfzE-3D
- Submitted IP / ASN
63.34.147.103 AS16509 · Amazon.com, Inc.
- Final URL
- https://ocprq.weplanit.it.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=639268243389882747.ODk5NTI1YTktZTYzYS00Y2U2LTljNTEtNDc1ODZkZTU5NjUxYTFmNWQ0YmEtMWQwNi00NjE3LWE3NTktMTA4YjIzMGMwNzIy&ui_locales=en-US&mkt=en-US&client-request-id=434df7c0-1013-4e57-8d53-8b9ed1d32071&siwa=1&siwg=1&state=gnA-fM9cg6TI0niWS9caJo47k1mo_aCkr-mI7t_fvEestIU4u_PX3JxZWrDBOhkhKTf3922MK93UcLxrfg8jU6V1IVWKBKPkHELZROon0EIhZLtWExiUx_R6mjHKRiyL72Hn2oDpK49NgoSFLnI2hfQ1R6ghUO25c5FEYYO-S81ilx2ZBmxQiKNPNLsNYSuc1DfR1D6vRek_ZJcz8ogXfULXhIVRUVCa6iUa5_Ohxj9tWLHSB7jnBJnsPzw-fErBIwXQgu6ZaDGdT8EeYzadQC1GKuWnDi2zfahsZ7fhhte1bYV13VLYpHOUsNw-JsuZ1cL2Z7RtEuZRAN91DUNbjH_guy0Drpn8engB4CRKzIHjnPmRc8Qi-2E055SKlk1VYIVDJaLW_xKsmKMrolCgCTa4WUi5aiyaGk0_2dyGMKDoZupSDR-jRxvw8QxGg2yR&x-client-SKU=ID_NET8_0&x-client-ver=8.16.0.0
- Final IP / ASN
104.21.67.9 AS13335 · CLOUDFLARENET
Final page
- Page title
- Sign in to your account
- Final DOM MIME
- text/html; charset=utf-8
- Final DOM size
- 61.7 KB (63165 bytes)
Detections
Activity
- HTTP requests
- 14
- Observed hosts
- 8
- Script records
- 0
Estimated HTTP data
- Sent
- ~12.1 KB
- Received
- ~83.8 KB
Page capture
Final browser state
ocprq.weplanit.it.com
Screenshot unavailableNo screenshot pixels areavailable for this report.
Detection signals
URLQuery findings, Threat Detection Systems, and IDS alerts
URLQuery
2urlquery Phishing - Microsoft Authentication Reverse Proxy
VerdictPhishing
Severityhigh
Host infrastructure
Observed hosts are context, not independent maliciousness verdicts
| Host | Rank | Registered | First seen | Last seen | Sent | Received | IP | Fingerprints |
|---|---|---|---|---|---|---|---|---|
| ocprq.weplanit.it.com 4 alerts | N/A | 1992-10-23 | 2026-10-05 | 2026-10-05 | 2.9 KB | 69.9 KB | 104.21.67.9 | Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. |
| hefbew.weplanit.it.com 1 alerts | N/A | 1992-10-23 | 2026-10-05 | 2026-10-05 | 536 B | 2.6 KB | 104.21.67.9 | Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. |
| u3609347.ct.sendgrid.net | N/A | 2009-04-20 | 2026-10-05 | 2026-10-05 | 1.7 KB | 883 B | 54.77.152.7 | Nginx Web servers, Reverse proxies Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache. |
| gfht-53jijgzzd-435gtjlse354-23455gjslre4-w453gfdg.s3.us-east-1.amazonaws.com | N/A | 2005-08-18 | 2026-10-05 | 2026-10-05 | 1.4 KB | 7.8 KB |  16.15.237.224 | Amazon Web Services PaaS Amazon Web Services (AWS) is a comprehensive cloud services platform offering compute power, database storage, content delivery and other functionality. Amazon S3 CDN Amazon S3 or Amazon Simple Storage Service is a service offered by Amazon Web Services (AWS) that provides object storage through a web service interface. |
| www.google.com | 22 | 1997-09-15 | 2015-05-10 | 2026-10-04 | 1.7 KB | 1.4 KB | 142.251.150.119 | Google Web Server Web servers Not recorded HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. |
| aadcdn.msauth.net | 5248 | 2018-10-25 | 2018-11-19 | 2026-09-30 | 2.2 KB | 0 B | Not recorded | |
| secure-web.cisco.com | 197347 | 1987-05-14 | 2014-02-25 | 2026-10-04 | 1.1 KB | 400 B | 146.112.255.69 | OpenResty:1.27.1.2 Web servers OpenResty is a web platform based on nginx which can run Lua scripts using its LuaJIT engine. Nginx Web servers, Reverse proxies Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache. |
| rgknyq98shxfwfwragc.weplanit.it.com 1 alerts | N/A | 1992-10-23 | 2026-10-05 | 2026-10-05 | 568 B | 821 B | 104.21.67.9 | Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. |