Let’s explore.

Use report fields, exact indicators, quoted text, and Boolean operators. Open the search guide.

QUERY RESULTS: REPORTS

4 matches · showing 1–4 · 3.021798742s

login.secure-crossriver.com

https://login.secure-crossriver.com/bZpEBFBm?uid=4c9c93df-f92e-4068-ae84-1251b8d4417d

22 Oct 2026 · 08:32 UTC

Captured page Enlarge ↗ Sign in to your account

Final URL

https://login.secure-crossriver.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=639282546856236262.Yjg1YjZjYTYtYzgyMi00NDZhLWJiNmEtNTcxY2I0NDZlZDlkODVmMjQ3ZDYtYWY1OS00NDk0LWFhNjMtMjlhYzE2NWVjYzU1&ui_locales=en-US&mkt=en-US&client-request-id=1ccd788f-6805-47aa-a3b7-e8290d478ff2&siwa=1&siwg=1&state=R2lyHt12SGhCmWFtQmTDOxgbMDmCkwJkKgo08kVtOOSC1D-I33Z1mODh9n-whq6C4-7e1L0tnmCznjNsAvMWQAn9qyURp5opKjL6rEEPMAqTyfKRPHshIX6tHprfUMvUGce777u29ouzXzR-IOhKFoegi7a3uayQpXsrbcGKF8kp4EDSGj9LQ8NOONj0pd9LiorE2OEyYsUhm3kOHVThyRa6kaw532TPrTVx0V5E5RQVx53idJ37Pg7qJ-9F51UMib5w-dIG0FFtsx_uzcGwsxt9CgPMpp2XD6wgVpzcuGPpeq0_zdK-KsXkIDBNK5DN4k4ALryF8AQPdua_PhXYVXK7iBiricgXT_nHsXLGRsX5HKRrh0FAlfZe9H8NajunSlma2erzrA_daD37foxB5JKPMOPPEGO4xk5g9VwEL2VKbfPnQwoB_lxtQNIv6I4P&x-client-SKU=ID_NET8_0&x-client-ver=8.16.0.0

Detection highlights

URLQuery 3IDS 0TDS 3

1 more findings · View detections →

Infrastructure & activity

16.52.153.229Canada AS16509 Amazon.com, Inc.

Hosts: 3
Requests: 9
Received: 72.7 KB
Sent: 10.3 KB

Inspect network →

Notable observed hosts

Report tags

microsoft phishing reverse_proxy

Submit tags

Open report →

login.secure-crossriver.com

https://login.secure-crossriver.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=639282094264119780.NmQ3MDdlNmUtNWUwZi00ODI1LTkzODUtMzkwOTQ3NjI3NzRiYzhhOTA1MWQtMzQyOC00YjJlLTljOGYtOTE1NzUxYTc5ODBl&ui_locales=en-US&mkt=en-US&client-request-id=0cd1e3cd-2f07-4fc1-a5c2-8eb1a50eb09b&siwa=1&siwg=1&state=m1mfXEzCg3hzxicLCM7D5E-PSkNoSurynt22of31KWg9D7ZYajkMtqGJ1y-Gg5G81THdzPLaO4mVR6q6QLHs-B1GnU3cHvZeHQRzsh7IKzdx8FOfDENB_pWF0PjjHPPqDDwTXEDpSD9zlgcR9IJf-aGa8X7hqovvpFyA3OpOhECR9XG6myhjV5iVWsdxmibKanNy4M5Vf-lp548EpkBqTQKuinsIpSDVaA7uKOctjPyUy2Cig2bDXBC7LkzJ-B9opbLe21TZFFRGCpHuTMERdnpn9xA4-AiyQGIJ8GF8VWxCxMLxd55gTfQVONBwO8BCv9_KCfBtSDNAfEP2nl4i2bgBrkWpmpPBwEjytIsQ05S4oabxhqUeoFfOBiOAzebvOY8KP3NvEwme_CRfDJ55T17mSuS6qhmiLcCcl_EsuiO4NGnt-Knl3nmb3_9-rdaS&x-client-SKU=ID_NET8_0&x-client-ver=8.16.0.0

22 Oct 2026 · 08:31 UTC

Captured page Enlarge ↗ Sign in to your account

Final URL Different hostname

https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=9199bf20-a13f-4107-85dc-02114787ef48&scope=https%3A%2F%2Foutlook.office.com%2F.default%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Foutlook.office.com%2Fmail%2F&client-request-id=c81d4c94-570c-35fc-0dd9-e067f32c169c&response_mode=fragment&client_info=1&clidata=1&prompt=select_account&nonce=01a162bc-77ad-7e8f-bcce-db259ae1fa4c&state=eyJpZCI6IjAxYTE2MmJjLTc3YWMtN2VlZS1hMDE4LTMyOTY4N2IwYTQxMCIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoicmVkaXJlY3QifX0%3D%7CaHR0cHM6Ly9vdXRsb29rLm9mZmljZS5jb20vbWFpbC8&claims=%7B%22access_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&x-client-SKU=msal.js.browser&x-client-VER=5.12.0&response_type=code&code_challenge=UpFx0HdHYHsxrJso_lUkUIlWfQGSnt4W0q-WqmHDT2U&code_challenge_method=S256

Detection highlights

URLQuery 0IDS 0TDS 1

Sinkholed DNS4EU medium severity Malicious

View detections →

Infrastructure & activity

16.52.153.229Canada AS16509 Amazon.com, Inc.

Hosts: 7
Requests: 39
Received: 9.75 MB
Sent: 23.2 KB

Inspect network →

Notable observed hosts

4 more · View hosts →

Submit tags

Open report →

login.secure-crossriver.com

https://login.secure-crossriver.com/bZpEBFBm?uid=4c9c93df-f92e-4068-ae84-1251b8d4417d

22 Oct 2026 · 05:36 UTC

Captured page Enlarge ↗ Sign in to your account

Final URL

https://login.secure-crossriver.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=639282441708714103.NGNkYjIxMTEtNzZkYy00MjUyLTkwZWUtMjFkZTMyZjQ3NjJiODQ1YjI0NjMtNGRlZi00ODgwLThhMWQtOGQ5MDYyN2IzODA4&ui_locales=en-US&mkt=en-US&client-request-id=7f9ff6a4-b6d6-4220-bfa8-37564a5ed0c1&siwa=1&siwg=1&state=t8EaNH5tNdCzd8sTrcuR_JcJ5OmkXgE8ntfiCFRuu_vFce2pW5t_iZk-IKSU2eBTuBOWgy8jPyLeh6okoDIvf3mGcaJcH_zIvyyZgTU5zLOFjBW94cuerhVOLQM61Ud48b2CkHr6hS603U-AZGqFY8oO7b5loi0VUTH8zwyWFZ3ZNLjDooEhWIJdiWRIWsX-O4ZkQrgi86NvXZPSoOixnu0Mz3-vzTvp0zFFChrFSixDZ2rma1Pz5GaLrlFGMmtuuAjesofmDYv1Yi55Uk05yy98sZJZzhE9A4SR7K9iU6tus83iM8RDX8Sk4qZIownIxS-WA4erKHvmof9eCbl-SA6xd6z8SMTOYlEYgzrXdqGc9lZ9OJKKDVM3a6NtlQcTw-HA5tGnh6Ooplyta4qouCHhhLq7tXY1cIJb5AVwz3OhpysG17-T3ncfWBF6k1ee&x-client-SKU=ID_NET8_0&x-client-ver=8.16.0.0

Detection highlights

URLQuery 3IDS 0TDS 3

1 more findings · View detections →

Infrastructure & activity

16.52.153.229Canada AS16509 Amazon.com, Inc.

Hosts: 3
Requests: 9
Received: 72.6 KB
Sent: 10.3 KB

Inspect network →

Notable observed hosts

Report tags

microsoft phishing reverse_proxy

Submit tags

Open report →

login.secure-crossriver.com

https://login.secure-crossriver.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=639282094264119780.NmQ3MDdlNmUtNWUwZi00ODI1LTkzODUtMzkwOTQ3NjI3NzRiYzhhOTA1MWQtMzQyOC00YjJlLTljOGYtOTE1NzUxYTc5ODBl&ui_locales=en-US&mkt=en-US&client-request-id=0cd1e3cd-2f07-4fc1-a5c2-8eb1a50eb09b&siwa=1&siwg=1&state=m1mfXEzCg3hzxicLCM7D5E-PSkNoSurynt22of31KWg9D7ZYajkMtqGJ1y-Gg5G81THdzPLaO4mVR6q6QLHs-B1GnU3cHvZeHQRzsh7IKzdx8FOfDENB_pWF0PjjHPPqDDwTXEDpSD9zlgcR9IJf-aGa8X7hqovvpFyA3OpOhECR9XG6myhjV5iVWsdxmibKanNy4M5Vf-lp548EpkBqTQKuinsIpSDVaA7uKOctjPyUy2Cig2bDXBC7LkzJ-B9opbLe21TZFFRGCpHuTMERdnpn9xA4-AiyQGIJ8GF8VWxCxMLxd55gTfQVONBwO8BCv9_KCfBtSDNAfEP2nl4i2bgBrkWpmpPBwEjytIsQ05S4oabxhqUeoFfOBiOAzebvOY8KP3NvEwme_CRfDJ55T17mSuS6qhmiLcCcl_EsuiO4NGnt-Knl3nmb3_9-rdaS&x-client-SKU=ID_NET8_0&x-client-ver=8.16.0.0

22 Oct 2026 · 05:36 UTC

Captured page Enlarge ↗ Sign in to your account

Final URL Different hostname

https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=9199bf20-a13f-4107-85dc-02114787ef48&scope=https%3A%2F%2Foutlook.office.com%2F.default%20openid%20profile%20offline_access&redirect_uri=https%3A%2F%2Foutlook.office.com%2Fmail%2F&client-request-id=3cf3c86a-fe85-0dce-4490-0a5250cc4fa7&response_mode=fragment&client_info=1&clidata=1&prompt=select_account&nonce=01a1621c-1d4d-7ef1-b557-89e9b10aad8e&state=eyJpZCI6IjAxYTE2MjFjLTFkNGMtNzZjMC1iZmQzLTExMDhkN2VhMjYzZSIsIm1ldGEiOnsiaW50ZXJhY3Rpb25UeXBlIjoicmVkaXJlY3QifX0%3D%7CaHR0cHM6Ly9vdXRsb29rLm9mZmljZS5jb20vbWFpbC8&claims=%7B%22access_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&x-client-SKU=msal.js.browser&x-client-VER=5.12.0&response_type=code&code_challenge=ibDeJIHyIXtxOQrAIrQQ1Z0E5kA7hYME68blwwH78Ho&code_challenge_method=S256

Detection highlights

URLQuery 0IDS 0TDS 1

Sinkholed DNS4EU medium severity Malicious

View detections →

Infrastructure & activity

16.52.153.229Canada AS16509 Amazon.com, Inc.

Hosts: 3
Requests: 6
Received: 60.1 KB
Sent: 4.9 KB

Inspect network →

Notable observed hosts

Submit tags

Open report →

Loading evidence…