https://login.microsoft.com//////////////////////////////common/oauth2/v2.0/authorize?state=&scope=openid+profile+https%253A%252F%252Fgraph.microsoft.com%252FUser.Read&prompt=none&client_id=e3200116-dd42-406a-a688-d3ce712e66a9&uri=https%253A%252F%252Fdeveloper.salesforce.com%252Fdashboard%252Fsession%252Fuser%252Fverify%252Fstep1&%255Ca3edq%250C+2e4c%250D%250A%2593bb66f835%2509%258C2979X%25BCint+Builder.Decode%250A%2509Context+%253A%253D+FlowEmail+%255B+OffsetStream+%253A=%2520Token%2509Data%2520%257C%2520Email%257Dfor%2520Stream%253A%253DPayloadBuilder+;+ValueContext+%257D+Trace%250A%2509Decode+.+SignalVector+%257B%2520Offset%257D%250Aa78c998ef06b569e%2597%25E9%252A%25CBa93627d06a07eba872664f4a92c74eae25f60308d1cad09a16e7beef0b79c03d8bd7528c4a7efc8bdb3fc053evar%252BVector-Secret%25250A%252509Decode%252B%25253B%252BBuffer%25250A%252509Encode%252B-%252BSession%25250A%252509Decode%252B%25255D%252BPayload%25250A%252509Offset%252B%25252B%252BBuilder%25250A%252509Builder%252B%252528%252BToken%25250A%252509Encode%252B.%252BKey%25250A%252509Context%252B%25257B%252BToken%25250A%25257D%25250Aelse%252BDecode%25252CBuilder%25250A%252509Stream%252B%25253A%25253D%252BHeader%25250A%252509Vector%252B%252526%252BVector%25250A%252509Payload%252B%25253D%252BBuilder%25250A%252509Value%252B%25257C%252BPayload%25250A%252509Secret%252B%25253D%252BBuffer%25250A%25257D%25250Aswitch%252BPayload%25252CSession%25250A%252509Payload%252B%252529%252BToken%25250A%252509Payload%252B%252526%252BBuilder%25250A%252509Data%252B%25257C%252BDecode%25250A%252509Secret%252B%25255B%252BStream%25250A%25257D%25250Astring%252BBody%252529Session%25250A%252509Session%252B%252528%252BTrace%25250A%252509Buffer%252B%25257B%252BSession%25250A%252509Vector%252B%25252A%252BVector%25250A%252509Context%252B%25253B%252BToken%25250A%252509Value%252B%25252A%252BData%25250A%252509Encode%252B%25253B%252BFlow%25250A%252509Trace%252B%252529%252BTrace%25250A%25257D%25250Aint%252BToken%25257CSignal%25250A%252509Header%252B%25255D%252BFlow%25250A%252509Body%252B.%252BKey%25250A%252509Vector%252B%252528%252BSignal%25250A%252509Session%252B%25252C%252BData%25250A%25257D%25250Ac2FuZGVlcEBmdmNvbS5hZQ
5 detections · review the detection signals
Host summary
Observed host history, traffic, and infrastructure
| Host | Rank | Registered | First seen | Last seen | Sent | Received | IP | Fingerprints |
|---|---|---|---|---|---|---|---|---|
| login.microsoft.com | 24331 | 1991-05-02 | 2014-08-12 | 2026-09-15 | 2.6 KB | 4.3 KB |  20.190.177.23 | HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. |
| api.x.com | 20799 | 1993-04-02 | 2017-05-09 | 2026-09-21 | 3.2 KB | 6.3 KB |  162.159.140.229 | Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. Cloudflare Bot Management Security Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots. HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. |
| sportspromotion.mx 8 alerts | N/A | 2024-12-06 | 2026-07-17 | 2026-09-08 | 1.3 KB | 639 B |  162.241.62.63 | Nginx:1.29.8 Web servers, Reverse proxies Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache. |
| abs.twimg.com | 23325 | 2008-09-22 | 2013-04-10 | 2026-09-21 | 327.4 KB | 8.00 MB |  199.232.172.159 | HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. |
| x.com | 84 | 1993-04-02 | 2012-08-16 | 2026-09-17 | 2.0 KB | 328.4 KB | 172.66.0.227 | Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. Plaid Payment processors, Miscellaneous Plaid is a fintech company that facilitates communication between financial services apps and users' banks and credit card providers. Arkose Labs Security Arkose Labs is a toolkit for fraud prevention that provides solutions to detect and mitigate malicious activity across digital platforms. |
| jf.x.com | N/A | 1993-04-02 | 2025-05-21 | 2026-09-17 | 3.6 KB | 1.1 KB | Not recorded | Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. Cloudflare Bot Management Security Cloudflare bot management solution identifies and mitigates automated traffic to protect websites from bad bots. |
| deliquesce294.devoraf.co.uk 2 alerts | N/A | 2026-03-25 | 2026-09-21 | 2026-09-21 | 1.2 KB | 3.4 KB | 104.21.77.72 | HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. |
| login.microsoftonline.com | 52 | 2002-07-09 | 2017-02-19 | 2026-09-21 | 2.5 KB | 30.2 KB | 20.190.147.2 | HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. |
| aadcdn.msftauth.net | 5262 | 2018-10-25 | 2018-11-19 | 2026-09-14 | 550 B | 0 B |  23.33.119.41 | |
| appleid.cdn-apple.com | 21465 | 2010-11-04 | 2013-09-15 | 2026-09-18 | 496 B | 0 B | Not recorded | |
| accounts.google.com | 103 | 1997-09-15 | 2012-05-23 | 2026-09-21 | 450 B | 0 B | Not recorded |
Observed certificates
Distinct fingerprints recorded in HTTP transactions
| Subject | Issuer | Valid from | Valid until | Fingerprint | Hosts |
|---|---|---|---|---|---|
| *.twimg.com | Let's Encrypt · YR2 | Tue, 15 Sep 2026 20:20:31 GMT | Mon, 14 Dec 2026 20:20:30 GMT | SHA25600:D1:C1:04:88:9E:3E:75:02:A2:DA:AC:8A:26:54:24:D9:E7:0E:E4:9A:DE:C2:7F:4D:94:B0:2A:6A:5A:A5:FC | abs.twimg.com |
| *.x.com | Let's Encrypt · YR2 | Fri, 14 Aug 2026 17:47:59 GMT | Thu, 12 Nov 2026 17:47:58 GMT | SHA25622:86:05:C7:DA:F9:E4:C5:53:08:9B:1F:20:F9:87:0D:43:DD:A9:80:4B:1C:13:9C:56:01:7C:BF:0D:71:6B:A0 | x.com |
| graph.windows.net | DigiCert Inc · DigiCert Global G2 TLS RSA SHA256 2020 CA1 | Fri, 18 Sep 2026 00:00:00 GMT | Sun, 27 Dec 2026 23:59:59 GMT | SHA2563F:F5:DE:C1:38:38:15:83:19:8C:13:76:9F:0B:89:52:95:87:91:72:06:9A:E5:3D:8F:17:AE:83:3E:34:DA:B1 | login.microsoft.com |
| api.x.com | Let's Encrypt · YR2 | Fri, 14 Aug 2026 17:21:20 GMT | Thu, 12 Nov 2026 17:21:19 GMT | SHA25627:67:1F:FF:2D:69:EF:BB:82:81:00:B0:34:BB:A4:D9:06:12:D6:5C:C8:4B:7C:AB:12:99:EE:DA:BB:65:D0:72 | api.x.com |
| devoraf.co.uk | Let's Encrypt · YE2 | Fri, 18 Sep 2026 14:20:10 GMT | Thu, 17 Dec 2026 14:20:09 GMT | SHA25661:80:11:09:F3:96:19:98:B2:50:96:7E:6B:BB:1C:E8:97:2D:ED:A2:47:B9:21:48:62:15:51:4C:33:C0:FC:C5 | deliquesce294.devoraf.co.uk |
| stamp2.login.microsoftonline.com | DigiCert Inc · DigiCert Global G2 TLS RSA SHA256 2020 CA1 | Fri, 14 Aug 2026 00:00:00 GMT | Sun, 22 Nov 2026 23:59:59 GMT | SHA256C0:C5:98:BF:58:F6:EB:C4:2E:F1:41:AE:FB:20:23:1A:4E:EA:DF:33:EE:91:CA:44:0C:6C:C3:E1:0A:A6:35:EE | login.microsoftonline.com |