urlquery.net
Investigate/Report/f3e94a6d-4dbf-4e16-aecc-ec29000333da
WEBSITE ANALYSIS REPORT

https://login.microsoft.com//////////////////////////////common/oauth2/v2.0/authorize?state=Y29yZXkua2VuZGlnQGhlcml0YWdlYWN0aW9uLmNvbQ==&scope=openid+profile+https%253A%252F%252Fgraph.microsoft.com%252FUser.Read&prompt=none&client_id=901b4323-f24e-4af4-884f-2faa6ac5931e&uri=https%253A%252F%252Fdeveloper.salesforce.com%252Fdashboard%252Fsession%252Fuser%252Fverify%252Fstep1&%255Ca3edq%250C+2e4c%250D%250A%2593bb66f835%2509%258C2979X%25BCint+Builder.Decode%250A%2509Context+%253A%253D+FlowEmail+%255B+OffsetStream+%253A=%2520Token%2509Data%2520%257C%2520Email%257Dfor%2520Stream%253A%253DPayloadBuilder+;+ValueContext+%257D+Trace%250A%2509Decode+.+SignalVector+%257B%2520Offset%257D%250Aa78c998ef06b569e%2597%25E9%252A%25CBa93627d06a07eba872664f4a92c74eae25f60308d1cad09a16e7beef0b79c03d8bd7528c4a7efc8bdb3fc053evar%252BVector-Secret%25250A%252509Decode%252B%25253B%252BBuffer%25250A%252509Encode%252B-%252BSession%25250A%252509Decode%252B%25255D%252BPayload%25250A%252509Offset%252B%25252B%252BBuilder%25250A%252509Builder%252B%252528%252BToken%25250A%252509Encode%252B.%252BKey%25250A%252509Context%252B%25257B%252BToken%25250A%25257D%25250Aelse%252BDecode%25252CBuilder%25250A%252509Stream%252B%25253A%25253D%252BHeader%25250A%252509Vector%252B%252526%252BVector%25250A%252509Payload%252B%25253D%252BBuilder%25250A%252509Value%252B%25257C%252BPayload%25250A%252509Secret%252B%25253D%252BBuffer%25250A%25257D%25250Aswitch%252BPayload%25252CSession%25250A%252509Payload%252B%252529%252BToken%25250A%252509Payload%252B%252526%252BBuilder%25250A%252509Data%252B%25257C%252BDecode%25250A%252509Secret%252B%25255B%252BStream%25250A%25257D%25250Astring%252BBody%252529Session%25250A%252509Session%252B%252528%252BTrace%25250A%252509Buffer%252B%25257B%252BSession%25250A%252509Vector%252B%25252A%252BVector%25250A%252509Context%252B%25253B%252BToken%25250A%252509Value%252B%25252A%252BData%25250A%252509Encode%252B%25253B%252BFlow%25250A%252509Trace%252B%252529%252BTrace%25250A%25257D%25250Aint%252BToken%25257CSignal%25250A%252509Header%252B%25255D%252BFlow%25250A%252509Body%252B.%252BKey%25250A%252509Vector%252B%252528%252BSignal%25250A%252509Session%252B%25252C%252BData%25250A%25257D%25250Ac2FuZGVlcEBmdmNvbS5hZQ==

public
Report tags
microsoft phishing dkstools aitm
Submit tags
Request review
Phishing detected

3 detections · review the detection signals

Review evidence →

Indicators

Exact observed values · repeated evidence is grouped by type and value

75 visible
KindValueSignalsCopy
IP104.17.25.14URLQuery 0IDS 0TDS 0
IP104.21.6.63URLQuery 14IDS 0TDS 0
IP151.101.1.229URLQuery 0IDS 0TDS 0
IP151.101.129.155URLQuery 0IDS 0TDS 0
IP20.190.177.20URLQuery 0IDS 0TDS 0
IP20.190.177.22URLQuery 0IDS 0TDS 0
IP23.33.119.106URLQuery 0IDS 0TDS 0
IP3.5.133.211URLQuery 0IDS 0TDS 0
IP40.126.53.21URLQuery 0IDS 0TDS 0
Domaincloudflare.comURLQuery 0IDS 0TDS 0
Domainjquery.comURLQuery 0IDS 0TDS 0
Domainjsdelivr.netURLQuery 0IDS 0TDS 0
Domainlive.comURLQuery 0IDS 0TDS 0
Domainmicrosoft.comURLQuery 0IDS 0TDS 0
Domainmicrosoftonline.comURLQuery 0IDS 0TDS 0
Domainmorivantela.comURLQuery 14IDS 0TDS 0
Domainmsftauth.netURLQuery 0IDS 0TDS 0
Domains3.us-east-2.amazonaws.comURLQuery 0IDS 0TDS 0
FQDNaadcdn.msftauth.netURLQuery 0IDS 0TDS 0
FQDNcdn.jsdelivr.netURLQuery 0IDS 0TDS 0
FQDNcdnjs.cloudflare.comURLQuery 0IDS 0TDS 0
FQDNcode.jquery.comURLQuery 0IDS 0TDS 0
FQDNctcpzqinsm.morivantela.comURLQuery 14IDS 0TDS 0
FQDNlogin.live.comURLQuery 0IDS 0TDS 0
FQDNlogin.microsoft.comURLQuery 0IDS 0TDS 0
FQDNlogin.microsoftonline.comURLQuery 0IDS 0TDS 0
FQDNs3.us-east-2.amazonaws.comURLQuery 0IDS 0TDS 0
URLhttps://aadcdn.msftauth.net/shared/1.0/content/js/FetchSessions_Core_H5IgszKn6xuaSfUqCqn3HQ2.jsURLQuery 0IDS 0TDS 0
URLhttps://cdn.jsdelivr.net/npm/bootstrap@5.3.8/dist/js/bootstrap.min.jsURLQuery 0IDS 0TDS 0
URLhttps://cdnjs.cloudflare.com/ajax/libs/socket.io/4.8.1/socket.io.min.jsURLQuery 0IDS 0TDS 0
URLhttps://code.jquery.com/jquery-4.0.0.min.jsURLQuery 0IDS 0TDS 0
URLhttps://ctcpzqinsm.morivantela.com/URLQuery 2IDS 0TDS 0
URLhttps://ctcpzqinsm.morivantela.com/?email=corey.kendig@heritageaction.comURLQuery 4IDS 0TDS 0
URLhttps://ctcpzqinsm.morivantela.com/b/drlkrsxlialihntdcdfjhvbtpURLQuery 2IDS 0TDS 0
URLhttps://ctcpzqinsm.morivantela.com/cloud9_boat8_bird1_car10_shadow9_bread1_dog7_door6_cliff9_ship3_space3_coffee7_dog2_sand10_bike6_pepper4_salt1_space4_galaxy9_wall2_sheep2_town7_soil6_day6_door8_evening7_book8_plane4URLQuery 2IDS 0TDS 0
URLhttps://ctcpzqinsm.morivantela.com/favicon.icoURLQuery 2IDS 0TDS 0
URLhttps://ctcpzqinsm.morivantela.com/jp/rlncysqkbwimwbitjhxklbughURLQuery 2IDS 0TDS 0
URLhttps://login.live.com/%3Canonymous%20code%3EURLQuery 0IDS 0TDS 0
URLhttps://login.live.com/Me.htm?v=3URLQuery 0IDS 0TDS 0
URLhttps://login.microsoft.com//////////////////////////////common/oauth2/v2.0/authorize?state=Y29yZXkua2VuZGlnQGhlcml0YWdlYWN0aW9uLmNvbQ==&scope=openid+profile+https%253A%252F%252Fgraph.microsoft.com%252FUser.Read&prompt=none&client_id=901b4323-f24e-4af4-884f-2faa6ac5931e&uri=https%253A%252F%252Fdeveloper.salesforce.com%252Fdashboard%252Fsession%252Fuser%252Fverify%252Fstep1&%255Ca3edq%250C+2e4c%250D%250A%2593bb66f835%2509%258C2979X%25BCint+Builder.Decode%250A%2509Context+%253A%253D+FlowEmail+%255B+OffsetStream+%253A=%2520Token%2509Data%2520%257C%2520Email%257Dfor%2520Stream%253A%253DPayloadBuilder+;+ValueContext+%257D+Trace%250A%2509Decode+.+SignalVector+%257B%2520Offset%257D%250Aa78c998ef06b569e%2597%25E9%252A%25CBa93627d06a07eba872664f4a92c74eae25f60308d1cad09a16e7beef0b79c03d8bd7528c4a7efc8bdb3fc053evar%252BVector-Secret%25250A%252509Decode%252B%25253B%252BBuffer%25250A%252509Encode%252B-%252BSession%25250A%252509Decode%252B%25255D%252BPayload%25250A%252509Offset%252B%25252B%252BBuilder%25250A%252509Builder%252B%252528%252BToken%25250A%252509Encode%252B.%252BKey%25250A%252509Context%252B%25257B%252BToken%25250A%25257D%25250Aelse%252BDecode%25252CBuilder%25250A%252509Stream%252B%25253A%25253D%252BHeader%25250A%252509Vector%252B%252526%252BVector%25250A%252509Payload%252B%25253D%252BBuilder%25250A%252509Value%252B%25257C%252BPayload%25250A%252509Secret%252B%25253D%252BBuffer%25250A%25257D%25250Aswitch%252BPayload%25252CSession%25250A%252509Payload%252B%252529%252BToken%25250A%252509Payload%252B%252526%252BBuilder%25250A%252509Data%252B%25257C%252BDecode%25250A%252509Secret%252B%25255B%252BStream%25250A%25257D%25250Astring%252BBody%252529Session%25250A%252509Session%252B%252528%252BTrace%25250A%252509Buffer%252B%25257B%252BSession%25250A%252509Vector%252B%25252A%252BVector%25250A%252509Context%252B%25253B%252BToken%25250A%252509Value%252B%25252A%252BData%25250A%252509Encode%252B%25253B%252BFlow%25250A%252509Trace%252B%252529%252BTrace%25250A%25257D%25250Aint%252BToken%25257CSignal%25250A%252509Header%252B%25255D%252BFlow%25250A%252509Body%252B.%252BKey%25250A%252509Vector%252B%252528%252BSignal%25250A%252509Session%252B%25252C%252BData%25250A%25257D%25250Ac2FuZGVlcEBmdmNvbS5hZQ==URLQuery 0IDS 0TDS 0
URLhttps://login.microsoftonline.com/common/oauth2/v2.0/authorize?state=Y29yZXkua2VuZGlnQGhlcml0YWdlYWN0aW9uLmNvbQ==&scope=openid+profile+https%253A%252F%252Fgraph.microsoft.com%252FUser.Read&prompt=none&client_id=901b4323-f24e-4af4-884f-2faa6ac5931e&uri=https%253A%252F%252Fdeveloper.salesforce.com%252Fdashboard%252Fsession%252Fuser%252Fverify%252Fstep1&%255Ca3edq%250C+2e4c%250D%250A%2593bb66f835%2509%258C2979X%25BCint+Builder.Decode%250A%2509Context+%253A%253D+FlowEmail+%255B+OffsetStream+%253A=%2520Token%2509Data%2520%257C%2520Email%257Dfor%2520Stream%253A%253DPayloadBuilder+;+ValueContext+%257D+Trace%250A%2509Decode+.+SignalVector+%257B%2520Offset%257D%250Aa78c998ef06b569e%2597%25E9%252A%25CBa93627d06a07eba872664f4a92c74eae25f60308d1cad09a16e7beef0b79c03d8bd7528c4a7efc8bdb3fc053evar%252BVector-Secret%25250A%252509Decode%252B%25253B%252BBuffer%25250A%252509Encode%252B-%252BSession%25250A%252509Decode%252B%25255D%252BPayload%25250A%252509Offset%252B%25252B%252BBuilder%25250A%252509Builder%252B%252528%252BToken%25250A%252509Encode%252B.%252BKey%25250A%252509Context%252B%25257B%252BToken%25250A%25257D%25250Aelse%252BDecode%25252CBuilder%25250A%252509Stream%252B%25253A%25253D%252BHeader%25250A%252509Vector%252B%252526%252BVector%25250A%252509Payload%252B%25253D%252BBuilder%25250A%252509Value%252B%25257C%252BPayload%25250A%252509Secret%252B%25253D%252BBuffer%25250A%25257D%25250Aswitch%252BPayload%25252CSession%25250A%252509Payload%252B%252529%252BToken%25250A%252509Payload%252B%252526%252BBuilder%25250A%252509Data%252B%25257C%252BDecode%25250A%252509Secret%252B%25255B%252BStream%25250A%25257D%25250Astring%252BBody%252529Session%25250A%252509Session%252B%252528%252BTrace%25250A%252509Buffer%252B%25257B%252BSession%25250A%252509Vector%252B%25252A%252BVector%25250A%252509Context%252B%25253B%252BToken%25250A%252509Value%252B%25252A%252BData%25250A%252509Encode%252B%25253B%252BFlow%25250A%252509Trace%252B%252529%252BTrace%25250A%25257D%25250Aint%252BToken%25257CSignal%25250A%252509Header%252B%25255D%252BFlow%25250A%252509Body%252B.%252BKey%25250A%252509Vector%252B%252528%252BSignal%25250A%252509Session%252B%25252C%252BData%25250A%25257D%25250Ac2FuZGVlcEBmdmNvbS5hZQ==URLQuery 0IDS 0TDS 0
URLhttps://s3.us-east-2.amazonaws.com/dexila-zubrop.if/safaphodinose.html?error=interaction_required&error_description=Session+information+is+not+sufficient+for+single-sign-on.&state=Y29yZXkua2VuZGlnQGhlcml0YWdlYWN0aW9uLmNvbQ%3d%3dURLQuery 0IDS 0TDS 0
SHA2561149ec49be30cb30c1092d8ee1dded8a46fbc12884f97ec245a36c92841f9694URLQuery 2IDS 0TDS 0
SHA25612f5489ce2f8472ae707bb4267213443fcb080f9e40eabfc7bd4d9b76301e8b1URLQuery 0IDS 0TDS 0
SHA256192da130f94f49638272d107fedb59aa0bab78d594a8542317585a017c85bf42URLQuery 0IDS 0TDS 0
SHA25623f1573e73653080f6d03a77396ef8feee1891dd09f83c98ef907f68190b2f37URLQuery 0IDS 0TDS 0
SHA25628ace32b793c707a511cdf19eb8dcf53194d976344bc49bf6c700d4c4e52b218URLQuery 0IDS 0TDS 0
SHA2562b53ea1bde4f9b1cd32461735814a0ab6213e66c7c675c701aa58c06da76d257URLQuery 0IDS 0TDS 0
SHA2563183fd2dd773bb518c96604298532202c0d010cf0fd256472f7a527de8e890a5URLQuery 0IDS 0TDS 0
SHA25639a546ea9ad97f8bfaf5d3e0e8f8556adb415e470e59007ada9759dce472adaaURLQuery 0IDS 0TDS 0
SHA2563c3cbdb71d0d2c22f504f4d63d8a6ffe8d250cde7e58300619be35b6bbab26a1URLQuery 0IDS 0TDS 0
SHA2564062edaf750fb8074e7e83e0c9028c94e32468a8b6f1614774328ef045150f93URLQuery 2IDS 0TDS 0
SHA2564db734f2d95c9beb2133c971c8f5292484bde470da7895c7b986d3841b15b433URLQuery 0IDS 0TDS 0
SHA256570942a42286a32298d75560d62ff5d4c8c2fe5d9def6076642de2d941ce7bf6URLQuery 0IDS 0TDS 0
SHA25661e6d4f07f8ed6e5788ea66931a14ffaa013f7ef411c1788ab0cdc92d039b352URLQuery 0IDS 0TDS 0
SHA2566487e4bdd0f51bbfd9105810a41755847fdae2c274e2fc325cd22356d7707e35URLQuery 0IDS 0TDS 0
SHA2566ccc133a5bddf9c226ca2d1249d1d1e3c9e2833a3102c6034c1ffe208358f33dURLQuery 2IDS 0TDS 0
SHA25676275a8f4e0fe843b36b35e2286d8aadf19adb7b222fbd5ad3b76aa73ddb4f02URLQuery 0IDS 0TDS 0
SHA2567951cfa7c79101bd18273fc112f283b989a0b87b7dd762c983ec4b6b59acb281URLQuery 0IDS 0TDS 0
SHA2567b0f14895d69247fd88e93840489cfd47c55bd3fd27eb0a6c12a14cc5f492207URLQuery 0IDS 0TDS 0
SHA2568816db77bfe4d98a62b3a9461fe3d2aa69d45e0b1eeb55ba7b9e04d6b3c14110URLQuery 0IDS 0TDS 0
SHA2568d7aae101acef589ba53c35d4c70bd81ba98e39191ccca3ffeb088e73ab55ad1URLQuery 2IDS 0TDS 0
SHA256932098dd17ebf611e85a14f5ea9f9ea3e8482137113346e2ac79169f668e969bURLQuery 0IDS 0TDS 0
SHA2569ab5016d573d7545f0123b598888c8c8ca542515b2df5ffa543f195d3e7fc175URLQuery 0IDS 0TDS 0
SHA2569aee824af9dcf82139a3622c3419fe8cfef5a05555e57c2c2cf820b8a9a28b54URLQuery 0IDS 0TDS 0
SHA256a078c49c9f3231538ed7fcf956e188a70617053e23616894b58d954a992487bcURLQuery 0IDS 0TDS 0
SHA256ac70434f0c8d5eecdc8a5700d9a79cec6ed9398ec5c0860097cd588f64df1a47URLQuery 0IDS 0TDS 0
SHA256b0e735814f8dcfecd6cdb8a7ce95a297a7e1e5f2727a29e6f5901801d52fa0c5URLQuery 0IDS 0TDS 0
SHA256b9809b8ff5a5bf421610ecc630a903c14d6f736e9c1a3633ff74058c6a4a10f8URLQuery 0IDS 0TDS 0
SHA256ce3b2634b7c86e88b2048f67b775eeb9055e2399d992cc8998bfba48338f52e9URLQuery 0IDS 0TDS 0
SHA256d8cd6ca33bd54572858b71b1c592921f68e1423a5ddf7ed436f9829a4d7ddb3dURLQuery 0IDS 0TDS 0
SHA256daf9458e872ef8650a34ea778448449d1ba24874a21a10e06456b2b55380c6c8URLQuery 0IDS 0TDS 0
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855URLQuery 6IDS 0TDS 0
SHA256e4a142cc967c2f020d1a8744f58cadc0788e1e5696bf6f3313aa9e3f1c9fb813URLQuery 0IDS 0TDS 0
SHA256e621b1d4b7053e6f44c907d80196c377c04059f68f242ffda0a96dec58d613f7URLQuery 0IDS 0TDS 0
Loading evidence…
WORKSPACE SETTINGS

Display preferences

Saved on this device.

SuccessInfoWarningDangerCriticalUnknown

Security colors remain independent of your accent.

Go to…

Recent scans ↵ Search reports /Search hosts ↵

No matching commands.

Ctrl/⌘ K Commands · Esc Close
LOCAL DEMONSTRATION

Notifications

No live event connection.

No notifications yet. Preview an event below.

Full request body

Full screenshot

Full browser screenshot