WEBSITE ANALYSIS REPORT

https://login.microsoft.com//////////////////////////////common/oauth2/v2.0/authorize?state=Y29yZXkua2VuZGlnQGhlcml0YWdlYWN0aW9uLmNvbQ==&scope=openid+profile+https%253A%252F%252Fgraph.microsoft.com%252FUser.Read&prompt=none&client_id=901b4323-f24e-4af4-884f-2faa6ac5931e&uri=https%253A%252F%252Fdeveloper.salesforce.com%252Fdashboard%252Fsession%252Fuser%252Fverify%252Fstep1&%255Ca3edq%250C+2e4c%250D%250A%2593bb66f835%2509%258C2979X%25BCint+Builder.Decode%250A%2509Context+%253A%253D+FlowEmail+%255B+OffsetStream+%253A=%2520Token%2509Data%2520%257C%2520Email%257Dfor%2520Stream%253A%253DPayloadBuilder+;+ValueContext+%257D+Trace%250A%2509Decode+.+SignalVector+%257B%2520Offset%257D%250Aa78c998ef06b569e%2597%25E9%252A%25CBa93627d06a07eba872664f4a92c74eae25f60308d1cad09a16e7beef0b79c03d8bd7528c4a7efc8bdb3fc053evar%252BVector-Secret%25250A%252509Decode%252B%25253B%252BBuffer%25250A%252509Encode%252B-%252BSession%25250A%252509Decode%252B%25255D%252BPayload%25250A%252509Offset%252B%25252B%252BBuilder%25250A%252509Builder%252B%252528%252BToken%25250A%252509Encode%252B.%252BKey%25250A%252509Context%252B%25257B%252BToken%25250A%25257D%25250Aelse%252BDecode%25252CBuilder%25250A%252509Stream%252B%25253A%25253D%252BHeader%25250A%252509Vector%252B%252526%252BVector%25250A%252509Payload%252B%25253D%252BBuilder%25250A%252509Value%252B%25257C%252BPayload%25250A%252509Secret%252B%25253D%252BBuffer%25250A%25257D%25250Aswitch%252BPayload%25252CSession%25250A%252509Payload%252B%252529%252BToken%25250A%252509Payload%252B%252526%252BBuilder%25250A%252509Data%252B%25257C%252BDecode%25250A%252509Secret%252B%25255B%252BStream%25250A%25257D%25250Astring%252BBody%252529Session%25250A%252509Session%252B%252528%252BTrace%25250A%252509Buffer%252B%25257B%252BSession%25250A%252509Vector%252B%25252A%252BVector%25250A%252509Context%252B%25253B%252BToken%25250A%252509Value%252B%25252A%252BData%25250A%252509Encode%252B%25253B%252BFlow%25250A%252509Trace%252B%252529%252BTrace%25250A%25257D%25250Aint%252BToken%25257CSignal%25250A%252509Header%252B%25255D%252BFlow%25250A%252509Body%252B.%252BKey%25250A%252509Vector%252B%252528%252BSignal%25250A%252509Session%252B%25252C%252BData%25250A%25257D%25250Ac2FuZGVlcEBmdmNvbS5hZQ==

06 Oct 2026 · 12:10:02.000 UTCpublic

Report tags: microsoft phishing dkstools aitm
Submit tags

Request review

Phishing detected

3 detections · review the detection signals

Review evidence →

Domain graph

Hostnames and connections captured in this scan

Loading domain graph…

Network requests

Click any request row to expand it in place. Multiple transactions can remain open.

UTC · milliseconds

Timestamp (UTC) Method Status Host / path Type Size Duration Signals

12:09:18.393 GET 302 document 0 B 2284 ms —

12:09:20.690 GET 200 document 26.7 KB 2727 ms —

12:09:23.838 GET 200 script 0 B 0 ms —

12:09:26.434 GET 200 document 1.4 KB 5698 ms —

12:09:32.291 GET 200 document 10.5 KB 1050 ms 2 alerts

12:09:33.455 GET 404 img 0 B 646 ms 2 alerts

12:09:37.912 POST 302 document 0 B 279 ms 2 alerts

12:09:38.194 GET 302 document 0 B 278 ms 2 alerts

12:09:38.477 GET 200 document 2.2 KB 274 ms 2 alerts

12:09:38.792 GET 200 script 45.7 KB 46 ms —

12:09:38.794 GET 200 script 76.9 KB 45 ms —

12:09:38.797 GET 200 script 59.1 KB 49 ms —

12:09:38.809 POST 200 fetch 11 B 279 ms 2 alerts

12:09:39.093 GET 200 script 722.6 KB 764 ms 2 alerts

Transaction #05

Request / response

URL

GET HTTPS

https://ctcpzqinsm.morivantela.com/b/drlkrsxlialihntdcdfjhvbtp

IP / ASN

104.21.6.63

AS13335 · CLOUDFLARENET

Requested by: https://ctcpzqinsm.morivantela.com/cloud9_boat8_bird1_car10_shadow9_bread1_dog7_door6_cliff9_ship3_space3_coffee7_dog2_sand10_bike6_pepper4_salt1_space4_galaxy9_wall2_sheep2_town7_soil6_day6_door8_evening7_book8_plane4

Resource information

File type: JavaScript source, ASCII text, with very long lines (65536), with no line terminators
MIME type: text/javascript; charset=UTF-8
First seen (UTC): 01 Oct 2026 · 17:02:10.096 UTC
Last seen (UTC): 23 Oct 2026 · 02:55:37.497 UTC
Times seen: 32

Size: 722.6 KB (739958 bytes)
MD5: b90a0d77432bf0a00c7646d7a856d100
SHA1: 0f7d1f4981c880d1b8c4c1a55483f62662d75b43
SHA256: 6ccc133a5bddf9c226ca2d1249d1d1e3c9e2833a3102c6034c1ffe208358f33d

Certificate information

Issuer: Let's Encrypt · YE1
Subject: morivantela.com
Protocol / cipher: TLSv1.3 · TLS_AES_128_GCM_SHA256
SHA1 fingerprint: FC:52:97:1F:A9:06:9E:B2:6E:9B:B5:56:CB:2F:CD:F0:F9:92:6A:5D
Valid from: Wed, 30 Sep 2026 21:55:47 GMT
Valid until: Tue, 29 Dec 2026 21:55:46 GMT

Technology fingerprints

PHP:8.3.31 (Programming languages)
Cloudflare (CDN)

Detections

Detection observations attached to this HTTP transaction.
Detection	Severity	Verdict
urlquery Phishing - Microsoft	medium	Phishing
urlquery Phishing - Dark Knight Tools Phishing Kit	high	Phishing

HTTP headers

Request headers

GET /b/drlkrsxlialihntdcdfjhvbtp HTTP/1.1
Host: ctcpzqinsm.morivantela.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.9
Accept-Encoding: gzip, deflate, br, zstd
Sec-GPC: 1
Connection: keep-alive
Referer: https://ctcpzqinsm.morivantela.com/cloud9_boat8_bird1_car10_shadow9_bread1_dog7_door6_cliff9_ship3_space3_coffee7_dog2_sand10_bike6_pepper4_salt1_space4_galaxy9_wall2_sheep2_town7_soil6_day6_door8_evening7_book8_plane4
Cookie: PHPSESSID=6f96ec661ead80266a73253c152cb9f2; preload=1; rt=cloud9_boat8_bird1_car10_shadow9_bread1_dog7_door6_cliff9_ship3_space3_coffee7_dog2_sand10_bike6_pepper4_salt1_space4_galaxy9_wall2_sheep2_town7_soil6_day6_door8_evening7_book8_plane4
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache

Response headers

HTTP/3 200 
date: Tue, 06 Oct 2026 12:09:39 GMT
server: cloudflare
x-powered-by: PHP/8.3.31
vary: Accept-Encoding,User-Agent
content-encoding: gzip
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=x9RD1ryKG66Neh2HxuCDbhAti7WnGoHM2zPapktOWsf%2F6CRXNB6%2BS4aiJ%2BrelBASVXyq0GXiZWtQSbA7xCFQBugoRBy1UXq1iJPaZs9YbcjopIMrCKKxIkbmh6hhK396%2FkyrJWrHAQ9FO7gzUA%3D%3D"}]}
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
priority: u=3,i=?0
content-type: text/javascript; charset: UTF-8;charset=UTF-8
cf-cache-status: DYNAMIC
cf-ray: a4648ef358a71ae6-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfExtPri

Domain graph

Hostnames

Connections