{"report_id":"a3b79487-4baa-4bd6-bb0c-2eb590f25344","version":0,"status":"done","tags":["microsoft","phishing"],"date":"2026-07-04T10:13:49Z","url":{"schema":"https","addr":"login.gateways.quest/oauth20_authorize.srf?client_id=TcNGYbXH-T8bD-y3bf-Xx7N-ML8lxQeBK6X8\u0026response_type=code\u0026scope=XboxLive.signin+offline_access\u0026state=Jl8aqclBjBfelgB4nue36g\u0026nonce=NghAxmOnNlRdXMl8\u0026redirect_uri=https%3A%2F%2Flogin.gateways.quest%2Fcallback\u0026source=mcpvp\u0026uid=mcpvp","fqdn":"login.gateways.quest","domain":"gateways.quest","tld":"quest"},"ip":{"addr":"45.128.119.34","port":0,"asn":51177,"as":"Tipzor Media Srl","country":"Romania","country_code":"RO"},"final":{"url":{"schema":"https","addr":"login.gateways.quest/oauth20_authorize.srf?client_id=TcNGYbXH-T8bD-y3bf-Xx7N-ML8lxQeBK6X8\u0026response_type=code\u0026scope=XboxLive.signin+offline_access\u0026state=Jl8aqclBjBfelgB4nue36g\u0026nonce=NghAxmOnNlRdXMl8\u0026redirect_uri=https%3A%2F%2Flogin.gateways.quest%2Fcallback\u0026source=mcpvp\u0026uid=mcpvp","fqdn":"login.gateways.quest","domain":"gateways.quest","tld":"quest"},"title":"Sign in to your account","dom":{"size":39881,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (642)","md5":"30a0827b6a599fa762a7484e210e3e0e","sha1":"a11c076f4aea1f82a22ab6c64467d074da9d3b65","sha256":"5055dd7e56cc55dd6007be3199f300f3df48c6b7329d42f1045d627261286efa","sha512":"ee187e8e4b36a706c5b6093d7e3304eec2d3372fcf67de73de2fc3d5c65f045b4bb083a8d5c144e9b67cf804bfb24c2ed93cdef6858292c6c8a63fb1428fbf30","ssdeep":"768:TTObxKfeVdm1uCpFYe3aNPubRKcFS5icgDc0vf7jH:TTOAmuTNqNPUKcFS5icgDc0vf7jH","tlshash":"2d03b72a6ab321021697a0a977fb57493234c107d149cd6c3eac43998fc6ed4aef37d4","dom_hash":"domhash4b9a5fb8d36625a3034b65876fadad89","first_seen":"","last_seen":"","times_seen":0,"resource_available":false,"data":null}},"submit":{"url":{"schema":"https","addr":"login.gateways.quest/oauth20_authorize.srf?client_id=TcNGYbXH-T8bD-y3bf-Xx7N-ML8lxQeBK6X8\u0026response_type=code\u0026scope=XboxLive.signin+offline_access\u0026state=Jl8aqclBjBfelgB4nue36g\u0026nonce=NghAxmOnNlRdXMl8\u0026redirect_uri=https%3A%2F%2Flogin.gateways.quest%2Fcallback\u0026source=mcpvp\u0026uid=mcpvp","fqdn":"login.gateways.quest","domain":"gateways.quest","tld":"quest"},"ip":{"addr":"45.128.119.34","port":0,"asn":51177,"as":"Tipzor Media Srl","country":"Romania","country_code":"RO"},"tags":null,"meta":null},"settings":{"access":"public","device_type":"desktop","expires_at":"2027-08-08T10:13:49Z","useragent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0","referer":"","cookies":null,"exit_node":"qguvgzjxzsgb3vs"},"stats":{"alert_count":{"ids":0,"urlquery":2,"analyzer":1}},"detection":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-04","alert":"Sinkholed","trigger":"login.gateways.quest","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null},{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]},"summary":[{"fqdn":"aadcdn.msftauth.net","ip":{"addr":"23.36.79.136","port":443,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"domain_registered":"2018-10-25","domain_rank":5262,"first_seen":"2018-11-19T10:50:32Z","last_seen":"2026-06-29T13:16:45.913549Z","alert_count":0,"request_count":2,"received_data":3113,"sent_data":1238,"comment":"","tags":null,"fingerprints":null},{"fqdn":"login.gateways.quest","ip":{"addr":"45.128.119.34","port":443,"asn":51177,"as":"Tipzor Media Srl","country":"Romania","country_code":"RO"},"domain_registered":"2026-05-13","domain_rank":0,"first_seen":"2026-06-21T18:52:38.511206Z","last_seen":"2026-07-04T00:47:03.550693Z","alert_count":8,"request_count":4,"received_data":995036,"sent_data":3131,"comment":"","tags":null,"fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}]}],"files":null,"artifacts":{"windows_shortcuts":null,"files":null,"telegram":null,"pdfs":null,"clipboard":null},"sensors":{"ids":null,"analyzer":null,"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]},"javascript":{"script":[{"url":{"schema":"https","addr":"login.gateways.quest/oauth20_authorize.srf?client_id=TcNGYbXH-T8bD-y3bf-Xx7N-ML8lxQeBK6X8\u0026response_type=code\u0026scope=XboxLive.signin+offline_access\u0026state=Jl8aqclBjBfelgB4nue36g\u0026nonce=NghAxmOnNlRdXMl8\u0026redirect_uri=https%3A%2F%2Flogin.gateways.quest%2Fcallback\u0026source=mcpvp\u0026uid=mcpvp","fqdn":"login.gateways.quest","domain":"gateways.quest","tld":"quest"},"ip":{"addr":"45.128.119.34","port":443,"asn":51177,"as":"Tipzor Media Srl","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":true,"md5":"575ad64fd798e38853ceb5ed6e61e19a","sha1":"b790157d3744f0a52594da7a656acd055510af55","sha256":"a959ad56a007802e68dee48cd8ed955d4f226fb75b67517b1839afb38169e092","sha512":"650e3c07fbfe95bf3a291349ed802290b95f3e736172271bbb531c710f40661cfddbad9fe29b8e95f3b075d780a7ddc0622ac5e3341be0eb7258b9ac73079dbe","ssdeep":"","tlshash":"6841233d56732172697b90de6ba756857d352013a00fc96c3a2ccec65fc4a145cf22fa","size":2201,"data":"","first_seen":"2026-07-04T10:13:50.352592Z","last_seen":"2026-07-04T10:13:50.352592Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"login.gateways.quest/oauth20_authorize.srf?client_id=TcNGYbXH-T8bD-y3bf-Xx7N-ML8lxQeBK6X8\u0026response_type=code\u0026scope=XboxLive.signin+offline_access\u0026state=Jl8aqclBjBfelgB4nue36g\u0026nonce=NghAxmOnNlRdXMl8\u0026redirect_uri=https%3A%2F%2Flogin.gateways.quest%2Fcallback\u0026source=mcpvp\u0026uid=mcpvp","fqdn":"login.gateways.quest","domain":"gateways.quest","tld":"quest"},"ip":{"addr":"45.128.119.34","port":443,"asn":51177,"as":"Tipzor Media Srl","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":true,"md5":"abdefffe372151d616cb9a296ce18cbd","sha1":"6cf00502c7c6d872ede42caeca40a0d18ff7be2c","sha256":"f73b526fc50027043153207fedafe29133dbc8a9dfc0cf884007eccdd49af77a","sha512":"da193f796727a27c5ec61440cd8d41f4aec3520eea6332b27534dcda2713bae7bf679e134ce6cc84b309da62c0cc191c7d5d3f3b53c890d1672d5c897228218e","ssdeep":"","tlshash":"ae314121e1b2640b1063104ca29a63d938256007a59f8f4dba4c4746ffd9cf7faf6789","size":1655,"data":"","first_seen":"2026-07-04T10:13:50.353496Z","last_seen":"2026-07-04T10:13:50.353496Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"login.gateways.quest/oauth20_authorize.srf?client_id=TcNGYbXH-T8bD-y3bf-Xx7N-ML8lxQeBK6X8\u0026response_type=code\u0026scope=XboxLive.signin+offline_access\u0026state=Jl8aqclBjBfelgB4nue36g\u0026nonce=NghAxmOnNlRdXMl8\u0026redirect_uri=https%3A%2F%2Flogin.gateways.quest%2Fcallback\u0026source=mcpvp\u0026uid=mcpvp","fqdn":"login.gateways.quest","domain":"gateways.quest","tld":"quest"},"ip":{"addr":"45.128.119.34","port":443,"asn":51177,"as":"Tipzor Media Srl","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":true,"md5":"fa89468f1ba9d53eabf3391446254fa2","sha1":"ace66dadec1ade3d6e0b52fff48d36b0aae00e98","sha256":"a10352b1904a97af3b60374b4790d735628c14bcbb0a93942c3cec5f11b756c6","sha512":"ca2d382311733e6ad5b5671514214095fb01dff45afaa367fc4cae60c7e4ca2f97d1dc7b15505c7b57224553199448a8f0d01a2e2b754736cdc8ca1e82666986","ssdeep":"","tlshash":"ca61305d25b372ae0ed324fe33cb0504319140177858888c7d9c87099fa6eaeaf727d9","size":3380,"data":"","first_seen":"2026-07-04T10:13:50.354463Z","last_seen":"2026-07-04T10:13:50.354463Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"login.gateways.quest/oauth20_authorize.srf?client_id=TcNGYbXH-T8bD-y3bf-Xx7N-ML8lxQeBK6X8\u0026response_type=code\u0026scope=XboxLive.signin+offline_access\u0026state=Jl8aqclBjBfelgB4nue36g\u0026nonce=NghAxmOnNlRdXMl8\u0026redirect_uri=https%3A%2F%2Flogin.gateways.quest%2Fcallback\u0026source=mcpvp\u0026uid=mcpvp","fqdn":"login.gateways.quest","domain":"gateways.quest","tld":"quest"},"ip":{"addr":"45.128.119.34","port":443,"asn":51177,"as":"Tipzor Media Srl","country":"Romania","country_code":"RO"},"introduction_type":"scriptElement","is_inline":true,"md5":"94c73e4864789b2b9787045fcbe0ef18","sha1":"55bd0cff1cfc723d6f176a8942874ce233fedb3d","sha256":"3e5b0b027ac94d3afdafc076a6e0e3b0f5e49b5934ba1aa4b3f2290bf8023ef7","sha512":"ad251014966b583df91181699a434206b4961163dcccce14770a666e2ce3e53485df514fc2470bbbe695f83a0bc0b5046b0d4ca9f3b7ae6b7be04be2ec954a7c","ssdeep":"192:nQt5NGuMmdgZ25/SCijXcVOkHoA7yfEKVTRUmLJ6ycJCvwyrzDwFqroGfjwri7yh:n65NGDr25KjjXcAkI3fBVRZ9c0vfwzyU","tlshash":"6712cd293973512045eba1bba7df57483234822f2584aa593d3d83991fe0e5437f2bf1","size":9410,"data":"","first_seen":"2026-07-04T10:13:50.369699Z","last_seen":"2026-07-04T10:13:50.369699Z","times_seen":1,"alerts":{"ids":null,"analyzer":null,"urlquery":null}}],"eval":null,"write":null,"console":null},"http":[{"url":{"schema":"https","addr":"aadcdn.msftauth.net/shared/1.0/content/images/picker_account_msa_3b879963b4f70829fd7a25cbc9519792.svg","fqdn":"aadcdn.msftauth.net","domain":"msftauth.net","tld":"net"},"ip":{"addr":"23.36.79.136","port":443,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://login.gateways.quest/oauth20_authorize.srf?client_id=TcNGYbXH-T8bD-y3bf-Xx7N-ML8lxQeBK6X8\u0026response_type=code\u0026scope=XboxLive.signin+offline_access\u0026state=Jl8aqclBjBfelgB4nue36g\u0026nonce=NghAxmOnNlRdXMl8\u0026redirect_uri=https%3A%2F%2Flogin.gateways.quest%2Fcallback\u0026source=mcpvp\u0026uid=mcpvp","date":"2026-07-04T10:13:25.192Z","timestamp":1783160005192,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"idnaakamaicdn.msftauth.net","organization":""},"issuer":{"commonName":"Microsoft TLS G2 ECC CA OCSP 02","organization":"Microsoft Corporation"},"validity":{"start":"Tue, 10 Feb 2026 18:29:15 GMT","end":"Fri, 05 Feb 2027 18:29:15 GMT"},"fingerprint":{"sha1":"11:6E:B1:51:6A:18:5E:8A:A2:FA:F0:B4:38:78:7E:52:0D:55:06:B5","sha256":"26:06:65:FC:25:8B:05:0E:C1:76:C6:E2:3C:FF:76:A2:A3:52:4E:8D:FC:2D:48:D0:74:7E:6E:33:DA:49:4A:3D"}}},"request":{"raw":"GET /shared/1.0/content/images/picker_account_msa_3b879963b4f70829fd7a25cbc9519792.svg HTTP/1.1\r\nHost: aadcdn.msftauth.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://login.gateways.quest/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-length: 254\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\ncontent-md5: hHpCErmbkHbuOTKLJM0wrw==\r\nlast-modified: Thu, 05 Dec 2024 00:02:57 GMT\r\naccept-ranges: bytes\r\netag: \"0x8DD14C02CEBC1FD\"\r\nx-ms-request-id: bec00a3d-801e-0088-5010-67b1c7000000\r\nx-ms-version: 2018-03-28\r\naccess-control-expose-headers: Accept-Ranges,Cache-Control,Content-Encoding,Content-Length,Content-MD5,Content-Type,Date,ETag,Last-Modified,Server,x-ms-request-id,x-ms-version\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=28496186\r\ndate: Sat, 04 Jul 2026 10:13:25 GMT\r\nvary: Accept-Encoding\r\nakamai-grn: 0.f44d2417.1783160005.1381a7be\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":379,"size_decoded":932,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"2d8f86059be176833897099ee6ddedeb","sha1":"93a2e327027deed53076e86bfa7d9eebbf0cc4b9","sha256":"34d8da073f47030ee94b99d84fbe68e3345bd8aaa37ea909ff2da00238447486","sha512":"64d75b1f35180ff61f5bf11d21544454df016d0854573d75d277fcb933ce845d1436bdc822445b78c627a1ff730b39fc34b72c27d45a39e237f2ccf0876fca4e","ssdeep":"","tlshash":"afe0d8f342aca54d85558f281668318275a7a1cd737a022db7806b052e00aef64bad65","first_seen":"2023-05-05T15:55:38Z","last_seen":"2026-07-04T10:13:50.347964Z","times_seen":7109,"resource_available":false,"data":null}},"time_used":228,"timings":{"blocked":-1,"dns":4,"connect":2,"send":0,"wait":6,"receive":0,"ssl":216},"alerts":{"ids":null,"analyzer":null,"urlquery":null}},{"url":{"schema":"https","addr":"login.gateways.quest/Sign%20In%20Flow/assets/signin-options-icon.svg","fqdn":"login.gateways.quest","domain":"gateways.quest","tld":"quest"},"ip":{"addr":"45.128.119.34","port":443,"asn":51177,"as":"Tipzor Media Srl","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://login.gateways.quest/oauth20_authorize.srf?client_id=TcNGYbXH-T8bD-y3bf-Xx7N-ML8lxQeBK6X8\u0026response_type=code\u0026scope=XboxLive.signin+offline_access\u0026state=Jl8aqclBjBfelgB4nue36g\u0026nonce=NghAxmOnNlRdXMl8\u0026redirect_uri=https%3A%2F%2Flogin.gateways.quest%2Fcallback\u0026source=mcpvp\u0026uid=mcpvp","date":"2026-07-04T10:13:25.193Z","timestamp":1783160005193,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"login.gateways.quest","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 13 May 2026 13:52:06 GMT","end":"Tue, 11 Aug 2026 13:52:05 GMT"},"fingerprint":{"sha1":"84:CB:B7:0A:80:17:31:70:1A:B2:BD:59:AD:B4:39:22:CC:CF:76:48","sha256":"D9:26:A6:7B:24:7C:1A:08:81:02:52:40:50:A0:D4:5D:30:FA:56:1F:66:A5:11:33:0C:22:45:4B:3E:6F:13:90"}}},"request":{"raw":"GET /Sign%20In%20Flow/assets/signin-options-icon.svg HTTP/1.1\r\nHost: login.gateways.quest\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://login.gateways.quest/oauth20_authorize.srf?client_id=TcNGYbXH-T8bD-y3bf-Xx7N-ML8lxQeBK6X8\u0026response_type=code\u0026scope=XboxLive.signin+offline_access\u0026state=Jl8aqclBjBfelgB4nue36g\u0026nonce=NghAxmOnNlRdXMl8\u0026redirect_uri=https%3A%2F%2Flogin.gateways.quest%2Fcallback\u0026source=mcpvp\u0026uid=mcpvp\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=4, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 04 Jul 2026 10:13:25 GMT\r\ncontent-type: image/svg+xml\r\ncache-control: public, max-age=2592000, immutable\r\ncontent-security-policy: connect-src 'self'\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":1592,"size_decoded":1804,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"4e48046ce74f4b89d45037c90576bfac","sha1":"4a41b3b51ed787f7b33294202da72220c7cd2c32","sha256":"8e6db1634f1812d42516778fc890010aa57f3e39914fb4803df2c38abbf56d93","sha512":"b2bba2a68edaa1a08cfa31ed058afb5e6a3150aabb9a78db9f5ccc2364186d44a015986a57707b57e2cc855fa7da57861ad19fc4e7006c2c239c98063fe903cf","ssdeep":"","tlshash":"b931787f43b45ae7239017741760626c13f4ee917169d0b4dba30c9a8d4bd33327843a","first_seen":"2023-04-14T20:16:11Z","last_seen":"2026-07-13T15:21:14.471906Z","times_seen":86508,"resource_available":false,"data":null}},"time_used":171,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":171,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-04","alert":"Sinkholed","trigger":"login.gateways.quest","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"login.gateways.quest/Sign%20In%20Flow/assets/ms.ico","fqdn":"login.gateways.quest","domain":"gateways.quest","tld":"quest"},"ip":{"addr":"45.128.119.34","port":443,"asn":51177,"as":"Tipzor Media Srl","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://login.gateways.quest/oauth20_authorize.srf?client_id=TcNGYbXH-T8bD-y3bf-Xx7N-ML8lxQeBK6X8\u0026response_type=code\u0026scope=XboxLive.signin+offline_access\u0026state=Jl8aqclBjBfelgB4nue36g\u0026nonce=NghAxmOnNlRdXMl8\u0026redirect_uri=https%3A%2F%2Flogin.gateways.quest%2Fcallback\u0026source=mcpvp\u0026uid=mcpvp","date":"2026-07-04T10:13:25.522Z","timestamp":1783160005522,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"login.gateways.quest","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 13 May 2026 13:52:06 GMT","end":"Tue, 11 Aug 2026 13:52:05 GMT"},"fingerprint":{"sha1":"84:CB:B7:0A:80:17:31:70:1A:B2:BD:59:AD:B4:39:22:CC:CF:76:48","sha256":"D9:26:A6:7B:24:7C:1A:08:81:02:52:40:50:A0:D4:5D:30:FA:56:1F:66:A5:11:33:0C:22:45:4B:3E:6F:13:90"}}},"request":{"raw":"GET /Sign%20In%20Flow/assets/ms.ico HTTP/1.1\r\nHost: login.gateways.quest\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://login.gateways.quest/oauth20_authorize.srf?client_id=TcNGYbXH-T8bD-y3bf-Xx7N-ML8lxQeBK6X8\u0026response_type=code\u0026scope=XboxLive.signin+offline_access\u0026state=Jl8aqclBjBfelgB4nue36g\u0026nonce=NghAxmOnNlRdXMl8\u0026redirect_uri=https%3A%2F%2Flogin.gateways.quest%2Fcallback\u0026source=mcpvp\u0026uid=mcpvp\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: u=6\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 04 Jul 2026 10:13:25 GMT\r\ncontent-type: image/x-icon\r\ncache-control: public, max-age=2592000, immutable\r\ncontent-security-policy: connect-src 'self'\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":17174,"size_decoded":17385,"mime_type":"image/x-icon","magic":"MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors","md5":"12e3dac858061d088023b2bd48e2fa96","sha1":"e08ce1a144eceae0c3c2ea7a9d6fbc5658f24ce5","sha256":"90cdaf487716184e4034000935c605d1633926d348116d198f355a98b8c6cd21","sha512":"c5030c55a855e7a9e20e22f4c70bf1e0f3c558a9b7d501cfab6992ac2656ae5e41b050ccac541efa55f9603e0d349b247eb4912ee169d44044271789c719cd01","ssdeep":"24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO","tlshash":"b772e35b1f5f4981ec4b0db80b125e80c5e49c973854dffbdb76b62888b0364ab845eb","first_seen":"2023-04-05T03:19:57Z","last_seen":"2026-07-13T15:21:14.444609Z","times_seen":168415,"resource_available":false,"data":null}},"time_used":141,"timings":{"blocked":0,"dns":0,"connect":0,"send":0,"wait":141,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-04","alert":"Sinkholed","trigger":"login.gateways.quest","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"login.gateways.quest/oauth20_authorize.srf?client_id=TcNGYbXH-T8bD-y3bf-Xx7N-ML8lxQeBK6X8\u0026response_type=code\u0026scope=XboxLive.signin+offline_access\u0026state=Jl8aqclBjBfelgB4nue36g\u0026nonce=NghAxmOnNlRdXMl8\u0026redirect_uri=https%3A%2F%2Flogin.gateways.quest%2Fcallback\u0026source=mcpvp\u0026uid=mcpvp","fqdn":"login.gateways.quest","domain":"gateways.quest","tld":"quest"},"ip":{"addr":"45.128.119.34","port":443,"asn":51177,"as":"Tipzor Media Srl","country":"Romania","country_code":"RO"},"is_navigation_request":true,"resource_type":"document","requested_by":"","date":"2026-07-04T10:13:23.903Z","timestamp":1783160003903,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"login.gateways.quest","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 13 May 2026 13:52:06 GMT","end":"Tue, 11 Aug 2026 13:52:05 GMT"},"fingerprint":{"sha1":"84:CB:B7:0A:80:17:31:70:1A:B2:BD:59:AD:B4:39:22:CC:CF:76:48","sha256":"D9:26:A6:7B:24:7C:1A:08:81:02:52:40:50:A0:D4:5D:30:FA:56:1F:66:A5:11:33:0C:22:45:4B:3E:6F:13:90"}}},"request":{"raw":"GET /oauth20_authorize.srf?client_id=TcNGYbXH-T8bD-y3bf-Xx7N-ML8lxQeBK6X8\u0026response_type=code\u0026scope=XboxLive.signin+offline_access\u0026state=Jl8aqclBjBfelgB4nue36g\u0026nonce=NghAxmOnNlRdXMl8\u0026redirect_uri=https%3A%2F%2Flogin.gateways.quest%2Fcallback\u0026source=mcpvp\u0026uid=mcpvp HTTP/1.1\r\nHost: login.gateways.quest\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nUpgrade-Insecure-Requests: 1\r\nSec-Fetch-Dest: document\r\nSec-Fetch-Mode: navigate\r\nSec-Fetch-Site: none\r\nPriority: u=0, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 04 Jul 2026 10:13:24 GMT\r\ncontent-type: text/html; charset=utf-8\r\ncache-control: no-store\r\ncontent-security-policy: connect-src 'self'\r\ncontent-encoding: gzip\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":40763,"size_decoded":10272,"mime_type":"text/html; charset=utf-8","magic":"HTML document, Unicode text, UTF-8 text, with very long lines (627)","md5":"efb220305f6b487ed6c72b49b6a983bb","sha1":"c11d4b28a6467af3ed75999f6f888fea9611f035","sha256":"430d2abe021d9fc339a9cc2b8ab43098efc234ab3b758eb3948170c7a9c89d6c","sha512":"f81ec89d772ae445acda23aaf2df57becbac0725dbd8cb7093dc9acb2a24c13bdc2835e75a7b57f6e6ddecc024768a802791acdcd24d0fc537d4ad7dc8a74653","ssdeep":"768:pTObxKfeVdm1uCpFYe3UNxbbGKcFS5icgDc0vf7jL:pTOAmuTNENxOKcFS5icgDc0vf7jL","tlshash":"5003d76a7ab320021697e0a937fb57093234c107d549cd6c3eac47998fc6e94aaf37d4","first_seen":"2026-07-04T10:13:50.34963Z","last_seen":"2026-07-04T10:13:50.34963Z","times_seen":1,"resource_available":true,"data":null}},"time_used":792,"timings":{"blocked":-1,"dns":447,"connect":59,"send":0,"wait":158,"receive":0,"ssl":127},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-04","alert":"Sinkholed","trigger":"login.gateways.quest","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"login.gateways.quest/minecraft-bg.webp","fqdn":"login.gateways.quest","domain":"gateways.quest","tld":"quest"},"ip":{"addr":"45.128.119.34","port":443,"asn":51177,"as":"Tipzor Media Srl","country":"Romania","country_code":"RO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://login.gateways.quest/oauth20_authorize.srf?client_id=TcNGYbXH-T8bD-y3bf-Xx7N-ML8lxQeBK6X8\u0026response_type=code\u0026scope=XboxLive.signin+offline_access\u0026state=Jl8aqclBjBfelgB4nue36g\u0026nonce=NghAxmOnNlRdXMl8\u0026redirect_uri=https%3A%2F%2Flogin.gateways.quest%2Fcallback\u0026source=mcpvp\u0026uid=mcpvp","date":"2026-07-04T10:13:25.181Z","timestamp":1783160005181,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_128_GCM_SHA256","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"login.gateways.quest","organization":""},"issuer":{"commonName":"E7","organization":"Let's Encrypt"},"validity":{"start":"Wed, 13 May 2026 13:52:06 GMT","end":"Tue, 11 Aug 2026 13:52:05 GMT"},"fingerprint":{"sha1":"84:CB:B7:0A:80:17:31:70:1A:B2:BD:59:AD:B4:39:22:CC:CF:76:48","sha256":"D9:26:A6:7B:24:7C:1A:08:81:02:52:40:50:A0:D4:5D:30:FA:56:1F:66:A5:11:33:0C:22:45:4B:3E:6F:13:90"}}},"request":{"raw":"GET /minecraft-bg.webp HTTP/1.1\r\nHost: login.gateways.quest\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://login.gateways.quest/oauth20_authorize.srf?client_id=TcNGYbXH-T8bD-y3bf-Xx7N-ML8lxQeBK6X8\u0026response_type=code\u0026scope=XboxLive.signin+offline_access\u0026state=Jl8aqclBjBfelgB4nue36g\u0026nonce=NghAxmOnNlRdXMl8\u0026redirect_uri=https%3A%2F%2Flogin.gateways.quest%2Fcallback\u0026source=mcpvp\u0026uid=mcpvp\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: same-origin\r\nPriority: i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\nserver: nginx\r\ndate: Sat, 04 Jul 2026 10:13:25 GMT\r\ncontent-type: image/webp\r\ncache-control: public, max-age=2592000, immutable\r\ncontent-security-policy: connect-src 'self'\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":[{"name":"Nginx","description":"Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache.","website":"https://nginx.org/en","common_platform_enumeration":"cpe:2.3:a:f5:nginx:*:*:*:*:*:*:*:*","icon":"Nginx.svg","categories":["Web servers","Reverse proxies"]}],"data":{"size":934654,"size_decoded":934863,"mime_type":"image/webp","magic":"RIFF (little-endian) data, Web/P image","md5":"4f1fc60bc90966bf47cbf722d14e9991","sha1":"b077e130f5bb55ed6a595281acd9742e7ce7de5b","sha256":"a1f06bfa159960322c79beb3f58b7b470967178cbbb4e711ff969a6db02812c1","sha512":"d334dfdc75c029809c049514882ea82e85dd689ab96de366636d5385dedf04000415f5355ceba57c51bed7dda3feeaabcbbfa7da5c57dacffab024cc81a1d13b","ssdeep":"24576:UjaTOpH0aPoBdEIgFP9NijFHKygy/N+ieHivuiUilaVL:bArPoBalPDijUygyl+iqivrUiOL","tlshash":"e91533832047542f52fd1002a086007dceded1bfc3778967687abba469a531f6f7ad4a","first_seen":"2026-07-04T10:13:50.350986Z","last_seen":"2026-07-04T10:13:50.350986Z","times_seen":1,"resource_available":false,"data":null}},"time_used":123,"timings":{"blocked":-1,"dns":0,"connect":0,"send":0,"wait":123,"receive":0,"ssl":0},"alerts":{"ids":null,"analyzer":[{"sensor_name":"dns4eu","sensor_type":"DNS","title":"DNS4EU","description":"DNS4EU","scan_date":"2026-07-04","alert":"Sinkholed","trigger":"login.gateways.quest","verdict":"malicious","severity":"medium","comment":"","link":"https://www.joindns4.eu/","meta":null}],"urlquery":[{"sensor_name":"urlquery","alert":"Phishing - Microsoft","verdict":"phishing","severity":"medium","comment":"Resource associated with Microsoft phishing","tags":["microsoft","phishing"],"meta":null}]}},{"url":{"schema":"https","addr":"aadcdn.msftauth.net/shared/1.0/content/images/picker_account_aad_a8332c62695d74843a11daf39a74e552.svg","fqdn":"aadcdn.msftauth.net","domain":"msftauth.net","tld":"net"},"ip":{"addr":"23.36.79.136","port":443,"asn":20940,"as":"Akamai International B.V.","country":"Norway","country_code":"NO"},"is_navigation_request":false,"resource_type":"img","requested_by":"https://login.gateways.quest/oauth20_authorize.srf?client_id=TcNGYbXH-T8bD-y3bf-Xx7N-ML8lxQeBK6X8\u0026response_type=code\u0026scope=XboxLive.signin+offline_access\u0026state=Jl8aqclBjBfelgB4nue36g\u0026nonce=NghAxmOnNlRdXMl8\u0026redirect_uri=https%3A%2F%2Flogin.gateways.quest%2Fcallback\u0026source=mcpvp\u0026uid=mcpvp","date":"2026-07-04T10:13:25.190Z","timestamp":1783160005190,"http_version":"HTTP/2","security_state":"secure","security_info":{"cipher_suite":"TLS_AES_256_GCM_SHA384","key_group_name":"x25519","signature_name":"ECDSA-P256-SHA256","protocol":"TLSv1.3","cert":{"subject":{"commonName":"idnaakamaicdn.msftauth.net","organization":""},"issuer":{"commonName":"Microsoft TLS G2 ECC CA OCSP 02","organization":"Microsoft Corporation"},"validity":{"start":"Tue, 10 Feb 2026 18:29:15 GMT","end":"Fri, 05 Feb 2027 18:29:15 GMT"},"fingerprint":{"sha1":"11:6E:B1:51:6A:18:5E:8A:A2:FA:F0:B4:38:78:7E:52:0D:55:06:B5","sha256":"26:06:65:FC:25:8B:05:0E:C1:76:C6:E2:3C:FF:76:A2:A3:52:4E:8D:FC:2D:48:D0:74:7E:6E:33:DA:49:4A:3D"}}},"request":{"raw":"GET /shared/1.0/content/images/picker_account_aad_a8332c62695d74843a11daf39a74e552.svg HTTP/1.1\r\nHost: aadcdn.msftauth.net\r\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0\r\nAccept: image/avif,image/webp,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5\r\nAccept-Language: en-US,en;q=0.9\r\nAccept-Encoding: gzip, deflate, br, zstd\r\nSec-Fetch-Storage-Access: none\r\nSec-GPC: 1\r\nConnection: keep-alive\r\nReferer: https://login.gateways.quest/\r\nSec-Fetch-Dest: image\r\nSec-Fetch-Mode: no-cors\r\nSec-Fetch-Site: cross-site\r\nPriority: u=5, i\r\nPragma: no-cache\r\nCache-Control: no-cache\r\n\r\n","headers":null,"cookies":null,"method":"GET"},"response":{"raw":"HTTP/2 200 \r\ncontent-length: 628\r\ncontent-type: image/svg+xml\r\ncontent-encoding: gzip\r\ncontent-md5: b2jpiB3xj44lGrV9V4Yjmw==\r\nlast-modified: Thu, 05 Dec 2024 00:02:58 GMT\r\naccept-ranges: bytes\r\netag: \"0x8DD14C02D80CABA\"\r\nx-ms-request-id: 409984a6-e01e-0074-139d-66b597000000\r\nx-ms-version: 2018-03-28\r\naccess-control-expose-headers: Accept-Ranges,Cache-Control,Content-Encoding,Content-Length,Content-MD5,Content-Type,Date,ETag,Last-Modified,Server,x-ms-request-id,x-ms-version\r\naccess-control-allow-origin: *\r\ncache-control: public, max-age=30151686\r\ndate: Sat, 04 Jul 2026 10:13:25 GMT\r\nvary: Accept-Encoding\r\nakamai-grn: 0.f44d2417.1783160005.1381a704\r\nX-Firefox-Spdy: h2\r\n\r\n","headers":null,"cookies":null,"status_code":"200","status_text":"","fingerprints":null,"data":{"size":1378,"size_decoded":1306,"mime_type":"image/svg+xml","magic":"SVG Scalable Vector Graphics image","md5":"f83ebff69a4a1685e4dc9650cdab8886","sha1":"fd21658884945b00157557ae06803daa6a9f10c6","sha256":"7b1669da90261cdb1483950bb480ad96875f84b09bc48d1055303ce94821bf64","sha512":"aa21a03ab84fa0129afced8a56e499757a6625c9b24a81ee08f5775b9b542f71ba67eae817d633cb4e4533a8cf6a0dda80bd7ee8a90e95ab3d39a77f88073f23","ssdeep":"","tlshash":"2f219c3f02249aebd180bb4c5d69770936718eca36b9c5c847932e6a9c067b3f038595","first_seen":"2023-05-05T16:05:50Z","last_seen":"2026-07-04T10:13:50.352044Z","times_seen":6907,"resource_available":false,"data":null}},"time_used":26,"timings":{"blocked":-1,"dns":6,"connect":1,"send":0,"wait":4,"receive":0,"ssl":15},"alerts":{"ids":null,"analyzer":null,"urlquery":null}}]}