urlquery Phishing - Microsoft
VerdictPhishing
Severitymedium
WEBSITE ANALYSIS REPORT
https://login.microsoftonline.com/common/oauth2/v2.0/authorize?platform_type=desktop&client_id=f1742cc6-8e3f-46d8-846b-095084e8f906&scope=openid+profile+https%3A%2F%2Fgraph.microsoft.com%2FUser.Read&session_vector=legacy&graph_version=v1.0&prompt=none&load_strategy=deferred&sourceID=driveSync2025&uri=https%3A%2F%2Fwww.tiktok.com%2Fworkspace%2Fsession%2Fjoin%2Fexplore%2Fai%2Fstart&content_density=compact&tracking_group=priority_A1&view_type=compact&state=131132191191132319172526259017293312152923261719313219133191132624&compliance_mode=ccpa&return+Context%7DC%20on%0Atext%0A%09Decode+%29+Head%0Aer%09Builde%0D%0Ar%20%3D+Sessio%0D%0An%0ABo%0Ady%20%2C+Key%0A%09Stream+]%20De%0D%0Acode%7D%0Abyte+Builder%3DData%0A%09Decode+%0A%7D%20Body%0A%09Build%0Aer+%7B+Sessi%09on%0A%09Builde%0D%0Ar+-%20%20Ke%09y%0A%09Data+%3D+Header%0A%09Ses%20sion+.%20Ses%20sion%09Cont%09ext+%29%20Tok%0Aen%09%7Delse+%20Session%7DValueOffset+-+Head%20er%0ABody%20%09%2F%20Encode%20%0AKe%20y%20.+Data%0A%09H%0D%0Aeader%20=+De%09code%09Secret+%0D%0A%2F+Heade%09r%0A%7Drange+Of%0D%0Afset%3DKey%0A%09Data%20%5B+ResultDecode+(%20Value%0A%09Value%09%20.%20Context%09St%09r%09eam+%3A%3D+Res%20ult%0A%09Email+=+%20Token%0A%09Context%0D%0A+%7D+Token%0A%7D%0Afor+Dec%0D%0Aode%09[D%0D%0Aata%0A%09Decode+-+En%20cod%09e%0ATok%09en+%2A%09+Key%09Body%20]+%09Deco%20de%09Session+%3A%3D+%09Data%0A%09Secret+.%20Buffer%0A%7D
public
Phishing detected
Review evidence →5 detections · review the detection signals
Report summary
Submitted and final observations · captured HTTP activity
- Submitted URL
- https://login.microsoftonline.com/common/oauth2/v2.0/authorize?platform_type=desktop&client_id=f1742cc6-8e3f-46d8-846b-095084e8f906&scope=openid+profile+https%3A%2F%2Fgraph.microsoft.com%2FUser.Read&session_vector=legacy&graph_version=v1.0&prompt=none&load_strategy=deferred&sourceID=driveSync2025&uri=https%3A%2F%2Fwww.tiktok.com%2Fworkspace%2Fsession%2Fjoin%2Fexplore%2Fai%2Fstart&content_density=compact&tracking_group=priority_A1&view_type=compact&state=131132191191132319172526259017293312152923261719313219133191132624&compliance_mode=ccpa&return+Context%7DC%20on%0Atext%0A%09Decode+%29+Head%0Aer%09Builde%0D%0Ar%20%3D+Sessio%0D%0An%0ABo%0Ady%20%2C+Key%0A%09Stream+]%20De%0D%0Acode%7D%0Abyte+Builder%3DData%0A%09Decode+%0A%7D%20Body%0A%09Build%0Aer+%7B+Sessi%09on%0A%09Builde%0D%0Ar+-%20%20Ke%09y%0A%09Data+%3D+Header%0A%09Ses%20sion+.%20Ses%20sion%09Cont%09ext+%29%20Tok%0Aen%09%7Delse+%20Session%7DValueOffset+-+Head%20er%0ABody%20%09%2F%20Encode%20%0AKe%20y%20.+Data%0A%09H%0D%0Aeader%20=+De%09code%09Secret+%0D%0A%2F+Heade%09r%0A%7Drange+Of%0D%0Afset%3DKey%0A%09Data%20%5B+ResultDecode+(%20Value%0A%09Value%09%20.%20Context%09St%09r%09eam+%3A%3D+Res%20ult%0A%09Email+=+%20Token%0A%09Context%0D%0A+%7D+Token%0A%7D%0Afor+Dec%0D%0Aode%09[D%0D%0Aata%0A%09Decode+-+En%20cod%09e%0ATok%09en+%2A%09+Key%09Body%20]+%09Deco%20de%09Session+%3A%3D+%09Data%0A%09Secret+.%20Buffer%0A%7D
- Submitted IP / ASN
20.190.181.3 AS8075 · MICROSOFT-CORP-MSN-AS-BLOCK
- Final URL
- https://steep-fog-2dea.icu/e/frlw6n?d=Lz9sb2dpbl9oaW50PWNhdGlhLmNsaWdub25AZ3J1YmVybG9naXN0aWNzLmNvbQ==
- Final IP / ASN
188.114.96.1 AS13335 · CLOUDFLARENET
Final page
- Page title
- Sign in to your account
- Final DOM MIME
- text/html; charset=utf-8
- Final DOM size
- 1.1 KB (1104 bytes)
Detections
Activity
- HTTP requests
- 34
- Observed hosts
- 8
- Script records
- 252
Estimated HTTP data
- Sent
- ~119.7 KB
- Received
- ~2.19 MB
Page capture
Final browser state
steep-fog-2dea.icu
Screenshot unavailableNo screenshot pixels areavailable for this report.
Detection signals
URLQuery findings, Threat Detection Systems, and IDS alerts
URLQuery
2urlquery Phishing - Microsoft Outlook
VerdictPhishing
Severitymedium
IDS
2Suricata IDS ET INFO Observed Cloudflare workers.dev Domain in TLS SNI
VerdictVerdict not recorded
Severitylow
Suricata IDS ET INFO Suspicious Domain (*.icu) in TLS SNI
VerdictVerdict not recorded
Severitymedium
Host infrastructure
Observed hosts are context, not independent maliciousness verdicts
| Host | Rank | Registered | First seen | Last seen | Sent | Received | IP | Fingerprints |
|---|---|---|---|---|---|---|---|---|
| login.microsoftonline.com | 52 | 2002-07-09 | 2017-02-19 | 2026-01-12 | 4.3 KB | 26.0 KB |  20.190.147.9 | HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. |
| res.public.onecdn.static.microsoft | 930 | 2023-05-05 | 2024-03-21 | 2026-01-14 | 477 B | 4.3 KB |  23.36.76.160 | HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. |
| bitter-term-b73c.roundcubegh.workers.dev | N/A | 2019-02-08 | 2026-01-16 | 2026-01-16 | 1.4 KB | 5.5 KB | 104.21.88.199 | Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. |
| challenges.cloudflare.com | 11393 | 2009-02-17 | 2021-10-20 | 2026-01-11 | 7.2 KB | 563.1 KB | 104.18.94.41 | Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. |
| steep-fog-2dea.icu 34 alerts | N/A | 2026-01-15 | 2026-01-16 | 2026-01-16 | 19.5 KB | 1.46 MB | 188.114.96.1 | Cloudflare CDN Cloudflare is a web-infrastructure and website-security company, providing content-delivery-network services, DDoS mitigation, Internet security, and distributed domain-name-server services. |
| aadcdn.msauth.net | 5248 | 2018-10-25 | 2018-11-19 | 2026-01-14 | 523 B | 147.7 KB |  13.107.246.53 | Azure Front Door Load balancers Azure Front Door is a scalable and secure entry point for fast delivery of your global web applications. Azure PaaS Azure is a cloud computing service for building, testing, deploying, and managing applications and services through Microsoft-managed data centers. |
| portal.microsoftonline.com | 222862 | 2002-07-09 | 2014-01-23 | 2026-01-11 | 553 B | 1.8 KB | 150.171.73.13 | |
| login.live.com | 179 | 1994-12-28 | 2012-05-21 | 2026-01-14 | 536 B | 4.1 KB | 40.126.53.11 | HSTS Security HTTP Strict Transport Security (HSTS) informs browsers that the site should only be accessed using HTTPS. |