urlquery.net
Investigate/Report/79caebfd-5640-4d0c-ab87-d7fc3d43d65e
WEBSITE ANALYSIS REPORT

http://late-snowflake-775c.step103.workers.dev/?error=login_required&error_description=AADSTS50058:+A+silent+sign-in+request+was+sent+but+no+user+is+signed+in.+The+cookies+used+to+represent+the+user's+session+were+not+sent+in+the+request+to+Azure+AD.+This+can+happen+if+the+user+is+using+Internet+Explorer+or+Edge,+and+the+web+app+sending+the+silent+sign-in+request+is+in+different+IE+security+zone+than+the+Azure+AD+endpoint+(login.microsoftonline.com).+Trace+ID:+30265a62-12df-49d6-aa63-d77136875e00+Correlation+ID:+1cc27a92-172a-41f2-ae82-edf517ff933f+Timestamp:+2026-01-26+12:12:34Z&error_uri=https://login.microsoftonline.com/error?code=50058&state=19231125912490152314112592131129172691132624

public
Report tags
microsoft phishing outlook
Submit tags
Request review
Phishing detected

5 detections · review the detection signals

Review evidence →

Report summary

Submitted and final observations · captured HTTP activity

Submitted URL
http://late-snowflake-775c.step103.workers.dev/?error=login_required&error_description=AADSTS50058:+A+silent+sign-in+request+was+sent+but+no+user+is+signed+in.+The+cookies+used+to+represent+the+user's+session+were+not+sent+in+the+request+to+Azure+AD.+This+can+happen+if+the+user+is+using+Internet+Explorer+or+Edge,+and+the+web+app+sending+the+silent+sign-in+request+is+in+different+IE+security+zone+than+the+Azure+AD+endpoint+(login.microsoftonline.com).+Trace+ID:+30265a62-12df-49d6-aa63-d77136875e00+Correlation+ID:+1cc27a92-172a-41f2-ae82-edf517ff933f+Timestamp:+2026-01-26+12:12:34Z&error_uri=https://login.microsoftonline.com/error?code=50058&state=19231125912490152314112592131129172691132624
Submitted IP / ASN
Country unknown 104.21.34.100 AS13335 · CLOUDFLARENET
Final URL
https://awotqlobal.com/e/p9mr0k?d=Lz9sb2dpbl9oaW50PWlsYW4ubUBlbGRhbmNhcmdvLmNvbQ==
Final IP / ASN
Country unknown 172.67.155.220 AS13335 · CLOUDFLARENET

Final page

Page title
Sign in to your account
Final DOM MIME
text/html; charset=utf-8
Final DOM size
1.1 KB (1104 bytes)

Detections

URLQuery
3
IDS
1
TDS
1

Activity

HTTP requests
29
Observed hosts
5
Script records
224

Estimated HTTP data

Sent
~69.1 KB
Received
~1.98 MB

Page capture

Final browser state

awotqlobal.com
Final browser screenshot
Recorded title

Sign in to your account

1.1 KB final DOM

Detection signals

URLQuery findings, Threat Detection Systems, and IDS alerts

URLQuery

2

urlquery Phishing - Microsoft

VerdictPhishing
Severitymedium

urlquery Phishing - Microsoft Outlook

VerdictPhishing
Severitymedium

Threat Detection Systems

1

Cloudflare DNS Sinkholed

VerdictMalicious
Severitymedium

IDS

1

Suricata IDS ET INFO Observed Cloudflare workers.dev Domain in TLS SNI

VerdictVerdict not recorded
Severitylow

Host infrastructure

Observed hosts are context, not independent maliciousness verdicts

HostRankRegisteredFirst seenLast seenSentReceivedIPFingerprints
awotqlobal.com 34 alertsN/A2025-08-212026-01-262026-01-2619.1 KB1.46 MBCountry unknown 172.67.155.220
challenges.cloudflare.com 113932009-02-172021-10-202026-01-256.0 KB523.1 KBCountry unknown 104.18.95.41
portal.microsoftonline.com 2228622002-07-092014-01-232026-01-18549 B1.8 KBUnited States 150.171.73.13
late-snowflake-775c.step103.workers.dev 2 alertsN/A2019-02-082026-01-262026-01-262.2 KB5.5 KBCountry unknown 104.21.34.100
res.public.onecdn.static.microsoft 9302023-05-052024-03-212026-01-21473 B4.3 KBNorway 23.36.76.168
Loading evidence…
WORKSPACE SETTINGS

Display preferences

Saved on this device.

SuccessInfoWarningDangerCriticalUnknown

Security colors remain independent of your accent.

Go to…

Recent scans ↵ Search reports /Search hosts ↵

No matching commands.

Ctrl/⌘ K Commands · Esc Close
LOCAL DEMONSTRATION

Notifications

No live event connection.

No notifications yet. Preview an event below.

Full request body

Full screenshot

Full browser screenshot