urlquery Phishing - Microsoft
VerdictPhishing
Severitymedium
WEBSITE ANALYSIS REPORT
http://app1.sfrt.com/r/bd93a37714d586c105eaa85
public
Phishing detected
Review evidence →3 detections · review the detection signals
Report summary
Submitted and final observations · captured HTTP activity
- Submitted URL
- http://app1.sfrt.com/r/bd93a37714d586c105eaa85
- Submitted IP / ASN
198.46.85.196 AS54641 · IMH-IAD
- Final URL
- https://app1.sfrt.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=639200688517356824.OWMwNjcxMWEtMDRmMi00OTJkLTgxMDEtNDE0OWRlMTgzMGFmMjAzOWU2OWEtYjllZS00ZTkzLTk3NGMtNWYyZDMzOWE2MGEz&ui_locales=en-US&mkt=en-US&client-request-id=bedb2ef2-89a5-4d2c-b90b-eb928acdcc2d&state=43uQae5lNZ8mZA52u3f1MkLz6pWMF2zG1ILY9wZKdDpVwX05DwIwAya8WW24g461HIRjtVDX0ug0aYUTH-W9Ca1xf8glK23xyz5TT5FLrgdHcMIycEzEa-qGDlFVCZLQJ0Gd32BoFC7gs1P7OPDPMfnK8RzsvORnp3b_w_22DSIM39lSXwC061Cte1mc-w4aCBTtGgM6Jti-pW6an5NQ6OB3Z31b9NQBt07hCrgCZmX5xi02ZzLIx50P_151nuVp6sAAN5UImROfx0wxDpzyiIx2PWUdGeQT73xErN3bOvBrbMd8xUxpJUksM0onn6onZhD0Ub2Is3O9L7QTDuFnBPeiTskCwsCXzDRFwI5cSsemNEPMyFm5jwQW43kJ6aKfXgWe7rxKTeVrM6p2NjS3AMPfxVEH41XMspxbHTTYzbM&x-client-SKU=ID_NET8_0&x-client-ver=8.14.0.0
- Final IP / ASN
- 198.46.85.196 AS54641 · IMH-IAD
Final page
- Page title
- Sign in to your account
- Final DOM MIME
- text/html; charset=utf-8
- Final DOM size
- 89.1 KB (91220 bytes)
Detections
Activity
- HTTP requests
- 18
- Observed hosts
- 5
- Script records
- 178
Estimated HTTP data
- Sent
- ~11.8 KB
- Received
- ~1.46 MB
Page capture
Final browser state
Detection signals
URLQuery findings, Threat Detection Systems, and IDS alerts
URLQuery
2urlquery Phishing - Evilginx MitM Proxy
VerdictPhishing
Severityhigh
Host infrastructure
Observed hosts are context, not independent maliciousness verdicts
| Host | Rank | Registered | First seen | Last seen | Sent | Received | IP | Fingerprints |
|---|---|---|---|---|---|---|---|---|
| browser.events.data.microsoft.com | 380 | 1991-05-02 | 2018-05-25 | 2026-07-16 | 746 B | 599 B | 4.150.223.103 | HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. Microsoft HTTPAPI:2.0 Web servers Microsoft HTTPAPI is a kernel-mode HTTP driver in the Windows operating system responsible for handling HTTP requests and responses with efficiency, scalability, and security. |
| www.sfrt.com 1 alerts | N/A | N/A | 2026-06-25 | 2026-06-25 | 533 B | 2.4 KB | 198.46.85.196 | Nginx:1.24.0 Web servers, Reverse proxies Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache. |
| aadcdn.msftauth.net | 5262 | 2018-10-25 | 2018-11-19 | 2026-07-13 | 6.7 KB | 1.39 MB |  23.36.77.176 | |
| s2.sfrt.com 1 alerts | N/A | N/A | N/A | N/A | 570 B | 4.1 KB | 198.46.85.196 | Nginx:1.24.0 Web servers, Reverse proxies Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache. |
| app1.sfrt.com 6 alerts | N/A | N/A | N/A | N/A | 3.3 KB | 57.3 KB | 198.46.85.196 | Nginx:1.24.0 Web servers, Reverse proxies Nginx is a web server that can also be used as a reverse proxy, load balancer, mail proxy and HTTP cache. |