&gt; Let’s explore.

27 Mar 2026 · 02:12 UTC

5 more findings · View detections →

Detection highlights

URLQuery 2IDS 2TDS 5

Infrastructure & activity

66.175.58.9Canada AS30447 INFB2-AS

Hosts: 4
Requests: 18
Received: 599.1 KB
Sent: 8.3 KB

Notable observed hosts

Report tags

Submit tags

https://linklock.titanhq.com/analyse?url=https%3A%2F%2Fsecure-web.cisco.com%2F1L6M934JiiQMuRw7qEACVd9wV54Fme3ZN77eE2iMWotFnUQlBl-1xQkMdqmEleDlVyWK-K-_-xOroNUwGTXsxt-9bQ1FIS0wpoCUX_J5Hlujds4qQzlxEQWOYgh-A4I9jq0KUKJxNjQHp74SeORHCXTSKcCSGAo1Qldh8N0jbUtWEYSx7IQJNHeNNLUybjY2BX-uyHWQCKPh_PwZCxQzhvfG4vIcyZdVg0O0N5dVq7nqfRR7DxmVp2me1O0eeTEwF6Q0w76l2WEvaLRaeUnm6vXpvcA3ifZlNgmNeMUwtvSv6R8sDBPHnAS6sefbzFLAJMfw3t5Kqef6SP-dFaQbQ0Yu67EbIXDx6vaEn5lMC-IIK2qCpdzizJNhQoW4HPVwPsuhtpx5t88uWr3Uz8jlT1TXQ5NaF5jqytZDSXypEibCBkg90-J4Wb_mztl0bezobrnSD7D7IMUMpvMNm4XHjpw%2Fhttps%253A%252F%252Fsso.learn4job.tn%252F&data=eJxUkkuPqkgAhX-NvZikSAlVoMk4GeTRKgIWiNBuOjwKgcub4iG_ftJ3Vnd5zvl254sPO4iRiMUQhLtIACgKYxDhJAFikmIKUUoRij-Sw18f1eFv09neeBGZR7TdC1hQ4ZHfayqURBnxGMK9IIvoKP_7B8bpjvyTuJtjq5zt3a-2bXCKbf7zMRwKmqZcG5YV7TcIDpRlNR0G0DfdSBmjXNxUH_0hKcP3BsGmZk3bN02a16_fy3jIGGuHjSBveH3D6wONx56CmUZcnA9x8wNteH17Fc29gC55TszRmaVOk5VHsp8fGOkVFZ6WJFGNz02_YXrtkfJYgu1CfplJV2klVcvH2zeAAb7BYveN5c2f92BYGNhHZKufXTi3jeIF3xd8KsciGVBH1nLRiG9_vTIgo_O-6KDhGZfFKsiplZBLbeekBHfXiBX3U262pEyynQWLyGO-9uUu0plcrBO1rKv3joov_hiA8X3yiWLcsu_b_FQWsmZT-ommc_x-Jo8XtKGFk0cn1V3qOJK6VI-Wr-jWhpTetVkXCZwlseR9bQqvTki9uhKnoJ1iWcjTZ2m9Koua3swmdxKd3aAeb6dadsWBptGqX-WLmc4Cw0ZHU9G9gUQPSUTg1yhKWnQO1EWcQq3GpamA89ngO6VN1ny9WBlpfHS6PebbMGasXTDb7Ua_F7x1V5T37T0g2Ap1XHRv9lTd4N1qeaQcf732EFyQH31XKythRNcm6mtXlVTpbHpmO5lWhYJT0c4bXv__fh7_CIB_FMC8PgwNV9Kwr1HRRByrf5f_BQAA___tIu_Z#819ad74c40002bfcc1a3940f24c447c1=ZGRmZGZkLmduZ2hnbmdAc2Rmc2RmZi5jb20=

linklock.titanhq.com

23 Mar 2026 · 18:08 UTC

https://bconiey.com/e/j1qcac?d=Lz9sb2dpbl9oaW50PWRkZmRmZC5nbmdoZ25nQHNkZnNkZmYuY29t

Final URL Different hostname

Detection highlights

URLQuery 4IDS 0TDS 2

2 more findings · View detections →

Infrastructure & activity

3.69.98.154Germany AS16509 AMAZON-02

Hosts: 7
Requests: 38
Received: 2.08 MB
Sent: 36.3 KB

Notable observed hosts

Report tags

microsoft phishing outlook gcore aitm

https://bfbsas.com/?vobsrrmp&email=bW9oYW1hZC5hYm9zYWRhQG1iY2MtZ3JvdXAuY29t

bfbsas.com

19 Mar 2026 · 01:15 UTC

Captured page Enlarge ↗ MOD-ay56ht1t9i

Final URL Different hostname

https://dynaflre.com/?qrc=mohamad.abosada%40mbcc-group.com

Detection highlights

Infrastructure & activity

23.94.232.39United States AS36352 AS-COLOCROSSING

Hosts: 7
Requests: 40
Received: 2.42 MB
Sent: 36.6 KB

Notable observed hosts

Report tags

phishing microsoft outlook nakedpages aitm

www.gwenet.org

12 Mar 2026 · 10:17 UTC

6 more findings · View detections →

Detection highlights

URLQuery 2IDS 2TDS 6

Infrastructure & activity

66.175.58.9Canada AS30447 INFB2-AS

Hosts: 4
Requests: 18
Received: 797.9 KB
Sent: 8.3 KB

Notable observed hosts

Report tags

Submit tags

https://login.on-slte.com/LaReMjsE#annmarie.obrien@musgrave.ie

login.on-slte.com

12 Mar 2026 · 08:33 UTC

https://login.on-slte.com/?login_hint=annmarie.obrien%40musgrave.ie

Final URL

Detection highlights

Infrastructure & activity

172.67.158.48zz AS13335 CLOUDFLARENET

Hosts: 5
Requests: 26
Received: 1.41 MB
Sent: 17.5 KB

Notable observed hosts

Report tags

https://login.on-slte.com/LaReMjsE#annmarie.obrien@musgrave.ie

login.on-slte.com

12 Mar 2026 · 08:32 UTC

https://login.on-slte.com/?login_hint=annmarie.obrien%40musgrave.ie

Final URL

Detection highlights

Infrastructure & activity

104.21.14.77zz AS13335 CLOUDFLARENET

Hosts: 5
Requests: 23
Received: 1.39 MB
Sent: 15.3 KB

Notable observed hosts

Report tags

https://online-app.credit-card-guide.info/RtMqIbqr

online-app.credit-card-guide.info

09 Mar 2026 · 09:05 UTC

Captured page Enlarge ↗ Linux containers offer lightweight virtualization

Final URL

https://online-app.credit-card-guide.info/?auth2=qdXlDt1Ij6X0oDkfQ0CwYt7oyZVbmcFi

Detection highlights

Phishing - Microsoft Outlook URLQuery medium severity Phishing

Infrastructure & activity

172.67.203.181zz AS13335 CLOUDFLARENET

Hosts: 5
Requests: 38
Received: 2.97 MB
Sent: 32.9 KB

Notable observed hosts

Report tags

https://real.tehplan-online.ru/?ctxut=68747470733a2f2f7777772e6578616d706c652e636f6d&v=1&sso_reload=true

real.tehplan-online.ru

05 Mar 2026 · 08:27 UTC

Detection highlights

URLQuery 3IDS 0TDS 4

Infrastructure & activity

195.242.118.21British Virgin Islands AS200313 IT WEB LTD

Hosts: 3
Requests: 21
Received: 1.42 MB
Sent: 24.1 KB

Notable observed hosts

View hosts →

Report tags

Submit tags

https://login.cdnscache.net/signin

login.cdnscache.net

03 Mar 2026 · 15:26 UTC

Captured page Enlarge ↗ Verify your email

Final URL Different hostname

https://logon.cdnscache.net/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.cdnscache.net%2fcommon%2ffederation%2foauth2msa&state=rQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAQu8rk9O3RU2meFkP90rulTZ81i5IzPySwDq1zFqEzYOP0LjIwvGBlvMQn6F6V7poQXu6WmpBYllmTm511gEXjFwmPAbMXBwSXAIMGgwPCDhXERK9DWPzbffRlijzhtSz8Xl_c8nOEUq36ZY2q4m79HSGSVR7GhcW5wjmWhm3tAUoFxcoVHYpi-ZVh-lVdSSb5zapGrramV4QQ2oQlsTKfYGD6wMXawM8xiZzjAybiBh_EAL8MPvl_H-i9MXj7vvccrfh3LEv3AsCgnZwPjHLNiY7c0v9J0wxJfz7LI8sJgp_Bif6PMCh9jnyzPxHIT2w0CDA-ASJDhh2BDg0OHEAMA0&estsfed=1&uaid=e6460ed1c5c24c1ba8124f970a97959a&fci=https%3a%2f%2fportal.microsoftonline.com.orgid.com&username=wefawef&login_hint=wefawef

Detection highlights

Phishing - Microsoft Outlook URLQuery medium severity Phishing

Infrastructure & activity

104.21.35.89zz AS13335 CLOUDFLARENET

Hosts: 9
Requests: 34
Received: 3.84 MB
Sent: 31.8 KB

Notable observed hosts

6 more · View hosts →

Report tags

www.gwenet.org

25 Feb 2026 · 11:55 UTC

6 more findings · View detections →

Detection highlights

URLQuery 2IDS 2TDS 6

Infrastructure & activity

66.175.58.9Canada AS30447 INFB2-AS

Hosts: 4
Requests: 18
Received: 647.3 KB
Sent: 8.3 KB

Notable observed hosts

Report tags

Submit tags

https://portfolio-oqnzavy.format.com/

portfolio-oqnzavy.format.com

20 Feb 2026 · 15:56 UTC

Captured page Enlarge ↗ Progressive web apps combine web and mobile advantages

Final URL Different hostname

https://online-app.skuteczni.info/?auth2=wRqt9r-dYmoInk5XkVvXqDLMBikrFCBc

Detection highlights

Phishing - Microsoft Outlook URLQuery medium severity Phishing

Infrastructure & activity

104.18.132.62zz AS13335 CLOUDFLARENET

Hosts: 9
Requests: 77
Received: 4.23 MB
Sent: 54.7 KB

Notable observed hosts

6 more · View hosts →

Report tags

https://tax.your-abitur.ru/?v=1

tax.your-abitur.ru

20 Feb 2026 · 00:37 UTC

2 more findings · View detections →

Detection highlights

URLQuery 3IDS 0TDS 5

Infrastructure & activity

45.88.3.136British Virgin Islands AS200313 IT WEB LTD

Hosts: 3
Requests: 21
Received: 1.42 MB
Sent: 23.2 KB

Notable observed hosts

View hosts →

Report tags

Submit tags

https://login.microsoftonline.com/common/oauth2/v2.0/authorize?cdn_region=us-east&view_type=summary&render_mode=hybrid&access_level=pro&state=986a3a6591157cb5390a4fded89bda71649087cbaa37d722c85515b671427d5d&env=dev&beta_mode=false&scope_hint=profile_read&launch_context=beta&cache_mode=strict&ui_pack=classic-ui&feature_flag=adaptiveBoost&load_strategy=smart&session_quality=high&fallback_language=en&tracking_code=lCbpmhLC&utm_source=slack&tracking_id=ROUTE-AI-7781&client_id=bb9ef958-edec-4ddd-8e3c-7849b302b530&partnerID=ORBIT-LINK&client_signature=zpZQOkr5qO8fyCvf&engine_variant=rust_v2&scope=openid%20profile%20https%3A%2F%2Fgraph.microsoft.com%2FUser.Read&exp_id=ai-scenario-flow-9212&entry_priority=low&metric_session_id=5b12f9c9-2475-4667-b9e4-c3696b860537&deep_linking=enabled&secure_context=true&utm_medium=referral&product=launchpad&user_segment=consumer&response_style=json&voice_variant=casual&event_trace=trace-zpHjwV&session_id=33851c3d-27a2-428d-8621-2d052ee14ed2&ui_skin=retro&redirect_url=https%3A%2F%2Ffacebook.com&prompt=none&sync_mode=manual&multi_factor=sms&integrationID=NEBULA-LINK&preview=0&country_code=US

login.microsoftonline.com

18 Feb 2026 · 21:43 UTC

Captured page Enlarge ↗ Page title not recorded

Final URL Different hostname

https://gin.ring-share.graylinesantacruz.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.ring-share.graylinesantacruz.com%2fcommon%2ffederation%2foauth2msa&state=rQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuAR6M8KPKYlc99vbZaQssOVZzyxGzviczDKwylWMyoSN07_AyPiCkfEWk6B_UbpnSnixW2pKalFiSWZ-3gUWgVcsPAbMVhwcXAIMEgwKDD9YGBexAm1tv1fDdfDtQY-VZ1wtKyzDGU6x6ptZehkWeYckZ-oXOZvm-EdkWXrnVxkUuKS5-SeZVaQmRwYlBVTmFbgYOQXamlsZTmATmsDGdIqN4QMbYwc7wyx2hgOcjBt4GA_wMvzgm7Px_P3Xz2a_93jFr-ORZuSX6eRjnlGYkVfmFRzu6hzpapCTV-WX4eLtm-1okJPlZGiunWTsnxFpu0GA4QEQCTL8EGxocOgQYgAA0&estsfed=1&uaid=c657688d14224ed7bd8a322310b4e68c&fci=https%3a%2f%2fportal.microsoftonline.com.orgid.com&username=cccccccccccccccccc&login_hint=cccccccccccccccccc

Detection highlights

Phishing - Microsoft Outlook URLQuery medium severity Phishing

Infrastructure & activity

20.190.147.3France AS8075 MICROSOFT-CORP-MSN-AS-BLOCK

Hosts: 7
Requests: 29
Received: 2.33 MB
Sent: 22.3 KB

Notable observed hosts

Report tags

www.gwenet.org

10 Feb 2026 · 10:25 UTC

6 more findings · View detections →

Detection highlights

URLQuery 2IDS 3TDS 6

Infrastructure & activity

66.175.58.9Canada AS30447 INFB2-AS

Hosts: 4
Requests: 18
Received: 641.6 KB
Sent: 8.3 KB

Notable observed hosts

Report tags

Submit tags

https://login.belrnt.com/QshfWZs!poK7Jqm!s0e@h5tJK!dHjkdIKSksw57639EDCFD9C#c2hhbmFfZHJvZ2VAbWFudWxpZmUuY2E=

login.belrnt.com

05 Feb 2026 · 04:42 UTC

Captured page Enlarge ↗ Sign In

Final URL Different hostname

https://sts.manulife.com/adfs/ls/?client-request-id=713cf97d-d7fb-4f0f-af4b-9b799501b8b7&wa=wsignin1.0&wtrealm=urn%3afederation%3aMicrosoftOnline&wctx=LoginOptions%3D3%26estsredirect%3d2%26estsrequest%3drQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuARqf9oU_r7O77_ee3blVMYd21cxKhM2Qv8CI-MLRsZbTIL-RemeKeHFbqkpqUWJJZn5eY-YxYszEvMS41OK8tNTHXIT80pzMtOAuhIvsAi8YuExYLbi4OASYJBgUGD4wcK4iBXoBkPTBfuCp911a9ee3TnrUQvDKVZ9s2yzsFRLp6y0pMyS4JLyPA9_H6Ad5iFJ3qWu6eaF3mZJxmHpRq5pXsGBtkZWhhPYhCawMZ1iY_jAxtjBzjCLneEAJ-MBXoYffFd6Jzzp65v53uMVv06Es4W3e5pbSGhEQL5zoXloVFpoVmhmrktpmbNRuE9ealaSaaFJRaRfuaOJ7QYBhgdAJMjwQ7ChwaFDiAEA0&cbcxt=&username=shana_droge%40manulife.ca&mkt=&lc=

Detection highlights

Phishing - Microsoft Outlook URLQuery medium severity Phishing

Infrastructure & activity

195.62.47.194United States AS397423 TIER-NET

Hosts: 8
Requests: 34
Received: 2.35 MB
Sent: 24.2 KB

Notable observed hosts

5 more · View hosts →

Report tags

http://late-snowflake-775c.step103.workers.dev/?error=login_required&error_description=AADSTS50058:+A+silent+sign-in+request+was+sent+but+no+user+is+signed+in.+The+cookies+used+to+represent+the+user's+session+were+not+sent+in+the+request+to+Azure+AD.+This+can+happen+if+the+user+is+using+Internet+Explorer+or+Edge,+and+the+web+app+sending+the+silent+sign-in+request+is+in+different+IE+security+zone+than+the+Azure+AD+endpoint+(login.microsoftonline.com).+Trace+ID:+30265a62-12df-49d6-aa63-d77136875e00+Correlation+ID:+1cc27a92-172a-41f2-ae82-edf517ff933f+Timestamp:+2026-01-26+12:12:34Z&error_uri=https://login.microsoftonline.com/error?code=50058&state=19231125912490152314112592131129172691132624

late-snowflake-775c.step103.workers.dev

26 Jan 2026 · 12:13 UTC

https://awotqlobal.com/e/p9mr0k?d=Lz9sb2dpbl9oaW50PWlsYW4ubUBlbGRhbmNhcmdvLmNvbQ==

Final URL Different hostname

Detection highlights

URLQuery 3IDS 1TDS 1

Infrastructure & activity

104.21.34.100zz AS13335 CLOUDFLARENET

Hosts: 5
Requests: 29
Received: 1.98 MB
Sent: 28.4 KB

Notable observed hosts

Report tags

https://sdfgroup.electronicstorefront.com/pricing/convert=342677a788854fd16d2e9db54e7f4d4f20260120201502&sig=eyJfcmFpbHMiOnsibWVzc2FnZSI6IkJBaEpJak16TkRJMk56ZGhOemc0T0RVMFptUXhObVF5WlRsa1lqVTBaVGRtTkdRMFpqSXdNall3TVRJd01qQXhOVEF5QmpvR1JWUT0iLCJleHAiOm51bGwsInB1ciI6InBsdXNfY29udmVyc2lvbiJ9fQ%3D%3D--21b9aa73aee8618a0d84fd530c29fa2c23185b3e&trk=TRN_TER_02&trk_extra=ter%3Ag.polinder%40boeve.nl&utm_campaign=TRN_TER_02&utm_medium=email&utm_source=sendgrid

sdfgroup.electronicstorefront.com

23 Jan 2026 · 14:52 UTC

Captured page Enlarge ↗ Get a code to sign in

Final URL Different hostname

https://ssolive.ceritakala.com/oauth20_authorize.srf?scope=openid+profile+email+offline_access&response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&response_mode=form_post&redirect_uri=https%3a%2f%2fonline-app.ceritakala.com%2fcommon%2ffederation%2foauth2msa&state=rQQIARAA42Kw0skoKSkottLXL8gvKknM0cvNTC7KL85PK8nPy8nMS9VLzs_Vyy9Kz0wBsYqEuARi6_ZNtoxWdVqrdETwlMycnlmMnPE5mWVglasYlQkbp3-BkfEFI-MtJkH_onTPlPBit9SU1KLEksz8vAssAq9YeAyYrTg4uAQYJBgUGH6wMC5iBdo69_H-OTO-ObjvsvlYU7WBh-EUq35BcXqRvkVaSrFlYI6zvpm3h2mgo36-d0FqYYh2sHmij4eFu49xmaevWWWoraWV4QQ2oQlsTKfYGD6wMXawM8xiZzjAybiBh_EAL8MPvqOr9tx8f3Hae49X_DrlUW5ehsZFlemlgSWhuSHGuSFhYW5BeQaVyVWmfmkuzuVelq5VPl45RZmBthsEGB4AkSDDD8GGBocOIQYA0&estsfed=1&uaid=93be7e5d5b394225ad22c411ca1c9c8c&fci=https%3a%2f%2fportal.microsoftonline.com.orgid.com&username=suca%40gmail.com&login_hint=suca%40gmail.com

Detection highlights

Infrastructure & activity

104.21.50.116zz AS13335 CLOUDFLARENET

Hosts: 11
Requests: 42
Received: 4.84 MB
Sent: 36.1 KB

Notable observed hosts

8 more · View hosts →

Report tags

phishing microsoft outlook suspicious

https://mandrillapp.com/track/click/31533927/msqw3dummyxae7ckk2edn3hnti0euupu.lambda-url.us-east-1.on.aws?p=eyJzIjoidldzNV9wc3Iwa05LcE1lTFZLbnQzVjJkVnZVIiwidiI6MiwicCI6IntcInVcIjozMTUzMzkyNyxcInZcIjoyLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL21zcXczZHVtbXl4YWU3Y2trMmVkbjNobnRpMGV1dXB1LmxhbWJkYS11cmwudXMtZWFzdC0xLm9uLmF3c1xcXC8jNmE2ZjY4NmUyZDYzNjg2MTcyNmM2NTczMmU3NjYxNmU2NTczNzM2MzY4NjU0MDZlNjE3NDY5Nzg2OTczMmU2MzZmNmRcIixcImlkXCI6XCJiNTRhMGU1YWNkN2M0NjZmYTc5Njg0YWQyOWYwOTMzMVwiLFwidXJsX2lkc1wiOltcImU4OWUwZmM0ZDdhOGQyMzYwMGNhMWRjZmEyNmNiYjM2Y2I5ZmYwOTlcIl0sXCJtc2dfdHNcIjoxNzY5MDk4MjAyfSJ9

mandrillapp.com

23 Jan 2026 · 13:33 UTC

Captured page Enlarge ↗ Authentication

Final URL Different hostname

https://gaap.natixis.com/user/auth/dologin?tabId=234965688

Detection highlights

Phishing - Microsoft Outlook URLQuery medium severity Phishing

Infrastructure & activity

15.197.175.4United States AS16509 AMAZON-02

Hosts: 9
Requests: 80
Received: 2.82 MB
Sent: 64.7 KB

Notable observed hosts

6 more · View hosts →

Report tags

https://mandrillapp.com/track/click/31533927/msqw3dummyxae7ckk2edn3hnti0euupu.lambda-url.us-east-1.on.aws?p=eyJzIjoiODAwRjRvMThZcDRSMzY4QUZ5TkJTUE03X1ZNIiwidiI6MiwicCI6IntcInVcIjozMTUzMzkyNyxcInZcIjoyLFwidXJsXCI6XCJodHRwczpcXFwvXFxcL21zcXczZHVtbXl4YWU3Y2trMmVkbjNobnRpMGV1dXB1LmxhbWJkYS11cmwudXMtZWFzdC0xLm9uLmF3c1xcXC8jNjI3MjY5NjE2ZTJlNmQ3NTcyNzA2ODc5NDA2ZTYxNzQ2OTc4Njk3MzJlNjM2ZjZkXCIsXCJpZFwiOlwiNTdiNGU1ZTYzMWE1NDk1MGJlZTNjZmE4YWQ1MTgzOTdcIixcInVybF9pZHNcIjpbXCJlODllMGZjNGQ3YThkMjM2MDBjYTFkY2ZhMjZjYmIzNmNiOWZmMDk5XCJdLFwibXNnX3RzXCI6MTc2OTA5NDYxNH0ifQ

mandrillapp.com

23 Jan 2026 · 12:59 UTC

Captured page Enlarge ↗ Page title not recorded

Final URL Different hostname

https://gaap.arllngtonsteel.com/user/auth/dologin?tabId=218130927

Detection highlights

Phishing - Microsoft Outlook URLQuery medium severity Phishing

Infrastructure & activity

76.223.125.47United States AS16509 AMAZON-02

Hosts: 7
Requests: 42
Received: 1.70 MB
Sent: 33.7 KB

Notable observed hosts

Report tags

https://login.microsoftonline.com/common/oauth2/v2.0/authorize?prompt=none&scope=openid+profile+https://graph.microsoft.com/User.Read&client_id=7db0dbc8-5571-4869-a44c-308060bbd220&utm_medium=paid&pipeline_id=pipe-992&uri=https://www.zoom.us/entry?ts=connect/identity/relay&retry_token=IjPsa0Ev&deep_linking=legacy&state=32262411319129111426903518263215233191132624&event_trace=trace-vRW3wv&if+Stream%5B%0ABo%09dy%0A%09En%0Acode+(+Context%0D%0A%09Stream+/%20Enco%20de%0D%0A%7D%0Atrue+Header%5DStream%0A%09Email+(+Body%0A%09Header%20%20%5D+Decode%0A%09Buffer+,%20Email%0A%7D%0Aint+Da%20ta%5BBuilder%0A%09Token%20-+Token%0A%09Result+++Data%0A%09Stream+)%20S%09tream%0A%09Payload++%20Token%0D%0A%09Body%20%5B+Data%0A%0A%7D%0A%0D%0Aif+Result%20-Buffer%0A%09Email+(+Data%0A%09Ke%0Ay+.%0D%0A%20Encode%0A%7D%0D%0Afalse%20Body%5BToken%0A%09Stream+%20,+Stream%0D%0A%09Bu%0Ailder%0A+*%20E%0D%0Amai%0Al%0A%09Offset%20-+%0D%0ABuilder%0D%0A%09%09Secret%20-+Result%0A%0D%0A%09Offset+%7D+Builder%0A%09%09Da%09ta+.+Result%0D%0A%7D%0A%09else+Value+Offset%0D%0A%09%0D%0AContext+-+Payload%0D%0A%09%20Header+(%20%20Em%09ail%0A%09Stream%20:=+Emai%0Al%0D%0A%09Header%20%7B+Context%0A%09%09Payload%0D%0A+(+Emai%0D%0Al%0D%0A%09Offset%20-+Value%0D%0A%7D%0Arange+Body(Email%0A%09Data+.+%09Deco%09de%0A%09Email%20+%20Email%0A%09Builder%20-%20Decode%0D%0A%09Builder%20-%20Secret%0A%7D%0A

login.microsoftonline.com

18 Jan 2026 · 21:25 UTC

https://alphamind-group.cam/e/xfmbkg?d=Lz9sb2dpbl9oaW50PXRvbWFzLnJhZG9Ad2hvdGVscy5jb20=

Final URL Different hostname

Detection highlights

URLQuery 3IDS 1TDS 0

Infrastructure & activity

40.126.53.14Sweden AS8075 MICROSOFT-CORP-MSN-AS-BLOCK

Hosts: 7
Requests: 33
Received: 2.19 MB
Sent: 33.5 KB

Notable observed hosts

Report tags

http://floral-thunder-6af1.step103.workers.dev/?error=interaction_required&error_description=Session+information+is+not+sufficient+for+single-sign-on.&state=3123262715389013231114192915133291132624

floral-thunder-6af1.step103.workers.dev

18 Jan 2026 · 08:51 UTC

https://astac-france.com/e/f0jbvj?d=Lz9sb2dpbl9oaW50PXNsb3BlekBjbGFkaXJlY3QuY29t

Final URL Different hostname

Detection highlights

URLQuery 3IDS 1TDS 1

Infrastructure & activity

104.21.34.100zz AS13335 CLOUDFLARENET

Hosts: 5
Requests: 30
Received: 2.02 MB
Sent: 28.6 KB

Notable observed hosts

Report tags

https://login.microsoftonline.com/common/oauth2/v2.0/authorize?state=1523151332262911239131152934191315319013112414152591172634913322&scope=openid+profile+https%3A%2F%2Fgraph.microsoft.com%2FUser.Read&prompt=none&uri=https%3A%2F%2Fwww.github.com%2Fworkflow%2Finitialize%2Fcloud%2Fonboard&client_id=b740187e-824d-4474-a6b1-c058aa081117&%5Crange%2BBuilder%252BBody%250A%2509Session%2B-%2BContext%250A%2509Header%2B%253D%2BBody%250A%2509Offset%2B.%2BResult%250A%2509Body%2B%2526%2BData%250A%257D%250Areturn%2BHeader%252CData%250A%2509Secret%2B%2526%2BContext%250A%2509Email%2B%253B%2BOffset%250A%2509Value%2B%257B%2BOffset%250A%257D%250Arange%2BOffset%252BResult%250A%2509Vector%2B-%2BPayload%250A%2509Buffer%2B%253B%2BValue%250A%2509Value%2B%255B%2BFlow%250A%2509Email%2B%255B%2BTrace%250A%2509Builder%2B%252C%2BSignal%250A%257D%250AF%09%0A18da%0D%0A%0C%D6p%89tint+S%EBs%14ion%3D%1Fey%0A%BEResu%0Alt%2B%28%2BVecto%05%0A%F4Vector%0E%2C%20Trac%21%0A%0A%2509Flow%2B-+Payloa%0Ad%0A%09T%86%9CHe+%0C%2528%2BleQ9d%CF%0A%2509Si%2Ana%10%20%7D%B1%0AP%0Cayload%2509Value%1F%7B%20Sec~%09et%0A%7D%250Av%CEr%20%91esult%257DKey%0C%09%0D%0ARe%B9ult%20%20%F5%20ConteE%09t%0D%0A%C1Signal%0D%0A%20-%E5B%5Cf%0Cfer%257Ds%A8ring%20O%0D%0A%93%0Cf%7D%D2t-Trac%C6%0A%09Ses%B2%F4on%20%3B%20Va%0Alue%250AStrzam%20-+Con%09text%2509%1Fey%2B%2A+%CEma%20Dlv%B7%0Cranae%2BOff%A4e%5C%09)Enco%92e%09St%ACeam%2BZ%20S.ream%250A%21aclo%09adr%99+Buffer%C4%09%20T%DF%09ace%2B+%2BEma%9Cl%0A%B9%0AContext%40%3D%20%20B%0C%ECf%B2er%1A%09V%0Cecto%20r%20%0D%0A%7D+Context%25%0Aby8%24%95Ses%0As%18on%2528Decode%09Em%ADib%20,%2BToken%250AH%94ader%20.%20%BA%7Fssion%0C8%2509%3Fqdy%0D%0A%2B]%20Header%0A%2509S%09tr_a%8C%20%0D%0A%3B%20Va%9E%0Cu%FF%2509Token%60=%2B%84%0Aess%14om%257D%0A

login.microsoftonline.com

16 Jan 2026 · 16:53 UTC

https://abilitomority.com/e/82m7yn?d=Lz9sb2dpbl9oaW50PWVsZWN0b3JhbC5zZXJ2aWNlc0BjYW1kZW4uZ292LnVr

Final URL Different hostname

Detection highlights

URLQuery 3IDS 1TDS 1

Infrastructure & activity

20.190.147.11France AS8075 MICROSOFT-CORP-MSN-AS-BLOCK

Hosts: 8
Requests: 36
Received: 2.14 MB
Sent: 36.8 KB

Notable observed hosts

5 more · View hosts →

Report tags

https://login.microsoftonline.com/common/oauth2/v2.0/authorize?platform_type=desktop&client_id=f1742cc6-8e3f-46d8-846b-095084e8f906&scope=openid+profile+https%3A%2F%2Fgraph.microsoft.com%2FUser.Read&session_vector=legacy&graph_version=v1.0&prompt=none&load_strategy=deferred&sourceID=driveSync2025&uri=https%3A%2F%2Fwww.tiktok.com%2Fworkspace%2Fsession%2Fjoin%2Fexplore%2Fai%2Fstart&content_density=compact&tracking_group=priority_A1&view_type=compact&state=131132191191132319172526259017293312152923261719313219133191132624&compliance_mode=ccpa&return+Context%7DC%20on%0Atext%0A%09Decode+%29+Head%0Aer%09Builde%0D%0Ar%20%3D+Sessio%0D%0An%0ABo%0Ady%20%2C+Key%0A%09Stream+]%20De%0D%0Acode%7D%0Abyte+Builder%3DData%0A%09Decode+%0A%7D%20Body%0A%09Build%0Aer+%7B+Sessi%09on%0A%09Builde%0D%0Ar+-%20%20Ke%09y%0A%09Data+%3D+Header%0A%09Ses%20sion+.%20Ses%20sion%09Cont%09ext+%29%20Tok%0Aen%09%7Delse+%20Session%7DValueOffset+-+Head%20er%0ABody%20%09%2F%20Encode%20%0AKe%20y%20.+Data%0A%09H%0D%0Aeader%20=+De%09code%09Secret+%0D%0A%2F+Heade%09r%0A%7Drange+Of%0D%0Afset%3DKey%0A%09Data%20%5B+ResultDecode+(%20Value%0A%09Value%09%20.%20Context%09St%09r%09eam+%3A%3D+Res%20ult%0A%09Email+=+%20Token%0A%09Context%0D%0A+%7D+Token%0A%7D%0Afor+Dec%0D%0Aode%09[D%0D%0Aata%0A%09Decode+-+En%20cod%09e%0ATok%09en+%2A%09+Key%09Body%20]+%09Deco%20de%09Session+%3A%3D+%09Data%0A%09Secret+.%20Buffer%0A%7D

login.microsoftonline.com

16 Jan 2026 · 16:37 UTC

https://steep-fog-2dea.icu/e/frlw6n?d=Lz9sb2dpbl9oaW50PWNhdGlhLmNsaWdub25AZ3J1YmVybG9naXN0aWNzLmNvbQ==

Final URL Different hostname

Detection highlights

URLQuery 3IDS 2TDS 0

Infrastructure & activity

20.190.181.3Sweden AS8075 MICROSOFT-CORP-MSN-AS-BLOCK

Hosts: 8
Requests: 34
Received: 2.19 MB
Sent: 34.4 KB

Notable observed hosts

5 more · View hosts →

Report tags

https://maps.google.com/url?q=https%3A%2F%2Fcoloradobids.us%2Fyuioo&sa=D&sntz=1&usg=AOvVaw3r3-RMewvHQlvjvOcRBENY#?asa=Y29tbXVuaXR5ZGlyZWN0b3JzQGpheWJpcmRzbC5jb20=

maps.google.com

14 Jan 2026 · 16:46 UTC

Captured page Enlarge ↗ SignIn Now via refNX1QQ5E0VA8nOXciBNF7lhX1mo

Final URL Different hostname

https://damp-sun-141b.xixyfy.workers.dev/0x6887b78603325691ee04150e/om/Y29tbXVuaXR5ZGlyZWN0b3JzQGpheWJpcmRzbC5jb20=

Detection highlights

URLQuery 2IDS 1TDS 0

Infrastructure & activity

142.250.74.142United States AS15169 GOOGLE

Hosts: 6
Requests: 17
Received: 1.58 MB
Sent: 10.6 KB

Notable observed hosts

3 more · View hosts →

Report tags