GET login.microsoftonline.com/favicon.ico
0.0.0.0 0 B URL GET login.microsoftonline.com/favicon.ico
IP 0.0.0.0:0
Requested by https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=7b284e94-91e1-4ee4-ae5c-45d40252b398&response_type=code&redirect_uri=https://reviewsign-docsharedeco.vercel.app/&scope=openid%20profile%20https://graph.microsoft.com/User.Read&state=tim:tim@slurpmail.net&prompt=none
Certificate IssuerDigiCert Inc
Subjectstamp2.login.microsoftonline.com
Fingerprint4D:09:56:F1:54:58:A5:82:A9:0A:F1:C1:48:A8:87:B9:CF:15:B6:B6
ValidityMon, 26 May 2025 00:00:00 GMT - Wed, 26 Nov 2025 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /favicon.ico HTTP/1.1
Host: login.microsoftonline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=7b284e94-91e1-4ee4-ae5c-45d40252b398&response_type=code&redirect_uri=https://reviewsign-docsharedeco.vercel.app/&scope=openid%20profile%20https://graph.microsoft.com/User.Read&state=tim:tim@slurpmail.net&prompt=none
DNT: 1
Connection: keep-alive
Cookie: buid=1.AUIAYvWey6L6LUCXR6DJTYWzrZROKHvhkeROrlxF1AJSs5hCAABCAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEp3zoxILSH7Qk18E0nenANqMtltyNuMbs3_1EGExMJctJqztd9wbYzxKBs181VwVwYuHmx_Yi9WddWIExK2jlY-BzFVyZ1JCJnYxFar6NcikgAA; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEFjFawlyQZp7KlUEXJwL6PPwExRUsFgwIh0eiYxWjnF2VyQBvPJouJaF9NlVqkiu8cRKaASj9UiywsKdZVPosFOMe7RENo2XVLDKtHylbE0KKiSp0IjO_9S5qVeMOh2eyCGQMuW87Ma9T1rrdr3ad6-JWZpfoIuJJtQNEaNgrQdYgAA; esctx-rvEvTm1i2U=AQABCQEAAABVrSpeuWamRam2jAF1XRQEzLVsMC70meylKixgAxxS9tkmrs1fzuU-tcvY5kMu_NkQc_fCgd6a-uHaduEIVE5qykWqBIoaL-aZCSnVF1pC5iaRHk78qGgz2CcTcWn3p-f_pKVSS6YXDnh6n2zkIOIwRIp2Miq9H-mXME21--LJ3CAA; fpc=AqKX7lGCiDRAi3MKjYb8fWc26dqSAQAAAOAvC-AOAAAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
GET login.live.com/Me.htm?v=3
20.190.181.2200 OK 3.4 kB URL GET login.live.com/Me.htm?v=3
IP 20.190.181.2:443
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested by https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=7b284e94-91e1-4ee4-ae5c-45d40252b398&response_type=code&redirect_uri=https://reviewsign-docsharedeco.vercel.app/&scope=openid%20profile%20https://graph.microsoft.com/User.Read&state=tim:tim@slurpmail.net&prompt=none
Certificate IssuerDigiCert Inc
Subjectlogin.live.com
FingerprintDC:D4:A3:92:59:4E:B8:B8:29:F1:E3:EB:7E:BE:C7:98:77:4F:A0:FC
ValidityMon, 14 Jul 2025 00:00:00 GMT - Wed, 14 Jan 2026 23:59:59 GMT
File type JavaScript source, ASCII text, with very long lines (3445), with CRLF line terminators
Hash acdec8dad3164fba20e86d50f1b979f1
0c5fd1cca5becdb0080d20e6a90ccd91bc0d5894
1d2cde2e778a731cbd158758f735e1bcc2508a8252720d261d94068aff45aacc
GET /Me.htm?v=3 HTTP/1.1
Host: login.live.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://login.microsoftonline.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Cache-Control: max-age=315360000
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Expires: Sun, 15 Jul 2035 17:54:41 GMT
Vary: Accept-Encoding
P3P: CP="DSP CUR OTPi IND OTRi ONL FIN"
Referrer-Policy: strict-origin-when-cross-origin
x-ms-route-info: C503_BAY
x-ms-request-id: 72e0a4c9-30f1-4053-8950-2211e1e691ae
PPServer: PPV: 30 H: PH1PEPF0001B6EC V: 0
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000
X-XSS-Protection: 1; mode=block
Set-Cookie: uaid=54e25f20a9c14979a0ba09a33d6ea40c; domain=login.live.com; Secure; path=/; SameSite=None; HttpOnly
MSPRequ=id=N<=1752774881&co=1; domain=login.live.com; Secure; path=/; SameSite=None; HttpOnly
Date: Thu, 17 Jul 2025 17:54:41 GMT
Content-Length: 1393
GET i.imgur.com/gYg28C4.png
199.232.196.193302 Found 503 B IP 199.232.196.193:443
Requested by https://reviewsign-docsharedeco.vercel.app/?error=interaction_required&error_description=Session+information+is+not+sufficient+for+single-sign-on.&state=tim%3atim%40slurpmail.net
Certificate IssuerSectigo Limited
Subject*.imgur.com
FingerprintE4:72:56:8F:0D:0E:0B:E1:47:1E:79:39:7A:0F:AB:05:30:AF:2A:2D
ValidityWed, 29 Jan 2025 00:00:00 GMT - Sat, 14 Feb 2026 23:59:59 GMT
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /gYg28C4.png HTTP/1.1
Host: i.imgur.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://reviewsign-docsharedeco.vercel.app/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 302 Found
retry-after: 0
location: https://i.imgur.com/removed.png
accept-ranges: bytes
age: 0
date: Thu, 17 Jul 2025 17:54:42 GMT
x-served-by: cache-iad-kiad7000110-IAD, cache-hel1410024-HEL
x-cache: HIT, MISS
x-cache-hits: 0, 0
x-timer: S1752774882.496210,VS0,VE112
strict-transport-security: max-age=300
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: *
server: cat factory 1.0
content-length: 0
X-Firefox-Spdy: h2
GET botnation.ru//
104.21.88.233200 OK 294 kB IP 104.21.88.233:443
Requested by https://9hcfrxf.63641176768ab8234f981fbe.workers.dev/#Mtim%40slurpmail.net
Certificate IssuerGoogle Trust Services
Subjectbotnation.ru
Fingerprint31:23:30:A9:BA:29:39:CE:11:87:35:AE:92:94:FD:0C:EA:90:E2:19
ValidityMon, 30 Jun 2025 20:24:19 GMT - Sun, 28 Sep 2025 21:22:52 GMT
File type ASCII text, with very long lines (65536), with no line terminators
Size 294 kB (294480 bytes)
Hash 05113b0df261d6761d36da62dd9ab96f
6bcb70f36f606c238e59c0dc2bafb72bef37ad0e
4bb9ac5127caf4cec1160fd1944ad5f239b16a8e4331e1683350c57e2ce3b390
GET // HTTP/1.1
Host: botnation.ru
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://9hcfrxf.63641176768ab8234f981fbe.workers.dev/
Origin: https://9hcfrxf.63641176768ab8234f981fbe.workers.dev
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 17 Jul 2025 17:54:47 GMT
content-type: application/json
content-length: 69566
x-powered-by: PHP/7.3.33
access-control-allow-origin: *
content-encoding: gzip
vary: Accept-Encoding
server: cloudflare
x-turbo-charged-by: LiteSpeed
cf-cache-status: DYNAMIC
nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800}
report-to: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=%2Fp%2BhQcPGqFRcm9k8L0o95e9MBu3F%2B2hipmnKwnaZbFJ7KHjRvGhirEmK3Am2Wg%2BrvYgkhMdwwvps%2FRvCjKQET%2F9W2kxWXv0wEO8%3D"}]}
cf-ray: 960b9b38cc347127-OSL
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET aadcdn.msauth.net/shared/1.0/content/js/FetchSessions_Core_Wf9_2dFUKcS5ak2Iz4F-sA2.js
13.107.246.53200 OK 150 kB URL GET aadcdn.msauth.net/shared/1.0/content/js/FetchSessions_Core_Wf9_2dFUKcS5ak2Iz4F-sA2.js
IP 13.107.246.53:443
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested by https://login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=7b284e94-91e1-4ee4-ae5c-45d40252b398&response_type=code&redirect_uri=https://reviewsign-docsharedeco.vercel.app/&scope=openid%20profile%20https://graph.microsoft.com/User.Read&state=tim:tim@slurpmail.net&prompt=none
Certificate IssuerDigiCert Inc
Subjectaadcdn.msauth.net
Fingerprint38:05:DB:30:B5:83:1A:A0:A9:AD:24:B2:62:0F:E7:F6:60:9B:7C:00
ValidityTue, 29 Oct 2024 00:00:00 GMT - Wed, 29 Oct 2025 23:59:59 GMT
File type JavaScript source, ASCII text, with very long lines (52865)
Size 150 kB (150477 bytes)
Hash 59ff7fd9d15429c4b96a4d88cf817eb0
cb6136ce27974d911bcf70c3c5b06d39a6a4bb93
12acb71d9c1b03b2cebc92e723bccde09c28830c8660de8854c92adf2599a27c
GET /shared/1.0/content/js/FetchSessions_Core_Wf9_2dFUKcS5ak2Iz4F-sA2.js HTTP/1.1
Host: aadcdn.msauth.net
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://login.microsoftonline.com/
Origin: https://login.microsoftonline.com
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 17 Jul 2025 17:54:41 GMT
content-type: application/x-javascript
content-length: 52125
cache-control: public, max-age=31536000
content-encoding: gzip
last-modified: Wed, 04 Jun 2025 05:41:46 GMT
etag: 0x8DDA32A7E60797E
x-ms-request-id: 36551f90-201e-000d-3fc3-f2342f000000
x-ms-version: 2009-09-19
x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,ETag,Last-Modified,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref: 20250717T175441Z-156d7cb4cf8r9d4thC1SVGugvs0000000hg0000000004c2k
x-fd-int-roxy-purgeid: 0
x-cache: TCP_HIT
accept-ranges: bytes
X-Firefox-Spdy: h2
GET fonts.googleapis.com/css2?family=Roboto+Mono:wght@400;500&family=Inter:wght@400;600;700&display=swap
142.250.74.10200 OK 12 kB URL GET fonts.googleapis.com/css2?family=Roboto+Mono:wght@400;500&family=Inter:wght@400;600;700&display=swap
IP 142.250.74.10:443
Requested by https://reviewsign-docsharedeco.vercel.app/?error=interaction_required&error_description=Session+information+is+not+sufficient+for+single-sign-on.&state=tim%3atim%40slurpmail.net
Certificate IssuerGoogle Trust Services
Subjectupload.video.google.com
FingerprintDC:40:BF:B1:59:C9:CC:B5:4A:38:2D:D0:16:8D:06:A5:1D:B4:08:8B
ValidityMon, 23 Jun 2025 08:41:28 GMT - Mon, 15 Sep 2025 08:41:27 GMT
Hash ae53d2186651de4e5ee7f325a7e83109
b8888b2a1d4596956c81e5adccca8aaa6ec4dd5b
d16b5fef4416c4f6b6b4b89c9beb2650860673787f876ac0d6bee56cae876dfe
GET /css2?family=Roboto+Mono:wght@400;500&family=Inter:wght@400;600;700&display=swap HTTP/1.1
Host: fonts.googleapis.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://reviewsign-docsharedeco.vercel.app/
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
content-type: text/css; charset=utf-8
vary: Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
access-control-allow-origin: *
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
strict-transport-security: max-age=31536000
expires: Thu, 17 Jul 2025 17:54:42 GMT
date: Thu, 17 Jul 2025 17:54:42 GMT
cache-control: private, max-age=86400
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-resource-policy: cross-origin
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-frame-options: SAMEORIGIN
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET fonts.gstatic.com/s/robotomono/v30/L0x5DF4xlVMF-BfR8bXMIjhLq38.woff2
142.250.74.35200 OK 33 kB URL GET fonts.gstatic.com/s/robotomono/v30/L0x5DF4xlVMF-BfR8bXMIjhLq38.woff2
IP 142.250.74.35:443
Requested by https://reviewsign-docsharedeco.vercel.app/?error=interaction_required&error_description=Session+information+is+not+sufficient+for+single-sign-on.&state=tim%3atim%40slurpmail.net
Certificate IssuerGoogle Trust Services
Subject*.gstatic.com
Fingerprint9A:5E:6D:44:D8:FB:03:E5:9A:13:6D:FF:53:DA:1C:8C:EA:3A:A7:AA
ValidityMon, 23 Jun 2025 08:41:27 GMT - Mon, 15 Sep 2025 08:41:26 GMT
File type Web Open Font Format (Version 2), TrueType, length 32796, version 1.0
Hash 877722deef76ad28ea1ae5cf5e265a94
ede7afbe887a70f22993d3a7da10b09fd58ff33b
b81cd55177300649be8f95b3b747d721ce607e8ed2856e25bd0c630cfd631faf
GET /s/robotomono/v30/L0x5DF4xlVMF-BfR8bXMIjhLq38.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://reviewsign-docsharedeco.vercel.app
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 32796
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 17 Jul 2025 10:12:07 GMT
expires: Fri, 17 Jul 2026 10:12:07 GMT
cache-control: public, max-age=31536000
age: 27755
last-modified: Mon, 19 May 2025 17:25:14 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET fonts.gstatic.com/s/inter/v19/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2
142.250.74.35200 OK 48 kB URL GET fonts.gstatic.com/s/inter/v19/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2
IP 142.250.74.35:443
Requested by https://reviewsign-docsharedeco.vercel.app/?error=interaction_required&error_description=Session+information+is+not+sufficient+for+single-sign-on.&state=tim%3atim%40slurpmail.net
Certificate IssuerGoogle Trust Services
Subject*.gstatic.com
Fingerprint9A:5E:6D:44:D8:FB:03:E5:9A:13:6D:FF:53:DA:1C:8C:EA:3A:A7:AA
ValidityMon, 23 Jun 2025 08:41:27 GMT - Mon, 15 Sep 2025 08:41:26 GMT
File type Web Open Font Format (Version 2), TrueType, length 48532, version 1.0
Hash 225835e6e0496c54dc2aca9f3d533892
942ef5298bbe74bfe44e445def5f2bfc94027fa8
acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087
GET /s/inter/v19/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://reviewsign-docsharedeco.vercel.app
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 48532
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 17 Jul 2025 10:12:14 GMT
expires: Fri, 17 Jul 2026 10:12:14 GMT
cache-control: public, max-age=31536000
age: 27748
last-modified: Wed, 28 May 2025 18:51:44 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET i.imgur.com/removed.png
199.232.196.193200 OK 503 B IP 199.232.196.193:443
Requested by https://reviewsign-docsharedeco.vercel.app/?error=interaction_required&error_description=Session+information+is+not+sufficient+for+single-sign-on.&state=tim%3atim%40slurpmail.net
Certificate IssuerSectigo Limited
Subject*.imgur.com
FingerprintE4:72:56:8F:0D:0E:0B:E1:47:1E:79:39:7A:0F:AB:05:30:AF:2A:2D
ValidityWed, 29 Jan 2025 00:00:00 GMT - Sat, 14 Feb 2026 23:59:59 GMT
File type PNG image data, 161 x 81, 1-bit colormap, non-interlaced
Hash d835884373f4d6c8f24742ceabe74946
20002faf28adfd94ca98cf6ced46f14334b53684
9b5936f4006146e4e1e9025b474c02863c0b5614132ad40db4b925a10e8bfbb9
GET /removed.png HTTP/1.1
Host: i.imgur.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://reviewsign-docsharedeco.vercel.app/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
last-modified: Wed, 14 May 2014 05:44:36 GMT
etag: "d835884373f4d6c8f24742ceabe74946"
content-type: image/png
cache-control: public, max-age=31536000
accept-ranges: bytes
date: Thu, 17 Jul 2025 17:54:42 GMT
age: 792328
x-served-by: cache-bwi5167-BWI, cache-hel1410024-HEL
x-cache: HIT, HIT
x-cache-hits: 1, 1737
x-timer: S1752774883.716804,VS0,VE0
strict-transport-security: max-age=300
access-control-allow-methods: GET, OPTIONS
access-control-allow-origin: *
server: cat factory 1.0
x-content-type-options: nosniff
content-length: 503
X-Firefox-Spdy: h2
GET reviewsign-docsharedeco.vercel.app/favicon.ico
64.29.17.131404 Not Found 79 B URL GET reviewsign-docsharedeco.vercel.app/favicon.ico
IP 64.29.17.131:443
Requested by https://reviewsign-docsharedeco.vercel.app/?error=interaction_required&error_description=Session+information+is+not+sufficient+for+single-sign-on.&state=tim%3atim%40slurpmail.net
Certificate IssuerLet's Encrypt
Subject*.vercel.app
Fingerprint81:D3:FA:22:93:E5:25:70:85:9A:59:F7:5D:92:C4:FE:CF:35:0D:C7
ValidityTue, 24 Jun 2025 04:57:32 GMT - Mon, 22 Sep 2025 04:57:31 GMT
Hash b5c6ae04be9f389536fd3245f76e1b01
d9ed7d453025442ae75f58e550d1dbdc4a7f46b2
6f9bcec3596ea3a9ce33b2cad74279313781f94ef8edc0eb6567a1f8958d3c27
GET /favicon.ico HTTP/1.1
Host: reviewsign-docsharedeco.vercel.app
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://reviewsign-docsharedeco.vercel.app/?error=interaction_required&error_description=Session+information+is+not+sufficient+for+single-sign-on.&state=tim%3atim%40slurpmail.net
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 404 Not Found
cache-control: public, max-age=0, must-revalidate
content-type: text/plain; charset=utf-8
date: Thu, 17 Jul 2025 17:54:42 GMT
server: Vercel
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-vercel-error: NOT_FOUND
x-vercel-id: arn1::6dhgt-1752774882817-bfbb2e190345
content-length: 79
X-Firefox-Spdy: h2
GET 9hcfrxf.63641176768ab8234f981fbe.workers.dev/#Mtim%40slurpmail.net
104.21.64.1200 OK 1.8 kB URL User Request GET 9hcfrxf.63641176768ab8234f981fbe.workers.dev/#Mtim%40slurpmail.net
IP 104.21.64.1:443
Certificate IssuerGoogle Trust Services
Subject63641176768ab8234f981fbe.workers.dev
FingerprintCF:38:B0:8F:15:6C:42:68:0A:06:AD:38:16:EB:E1:94:A3:52:04:26
ValiditySun, 06 Jul 2025 15:31:58 GMT - Sat, 04 Oct 2025 16:29:38 GMT
File type HTML document, Unicode text, UTF-8 text, with very long lines (669), with CRLF line terminators
Hash 9edeaff9005beb31eb1b369262a8541c
039e70400afa08662d121ad49be5441cb3bccdba
b673f9dfa6d44d31d2f1a6418d16be8de080070e64e1e2fa07014ba3df218d79
Analyzer Verdict Alert urlquery phishing Phishing - Rockstar2FA Phishing Kit
GET / HTTP/1.1
Host: 9hcfrxf.63641176768ab8234f981fbe.workers.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://reviewsign-docsharedeco.vercel.app/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 17 Jul 2025 17:54:45 GMT
content-type: text/html
content-encoding: br
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sic6WSAv3IrPVaCGCVzaU%2FVFuPNxv%2BzIAkLiGQsuoKP82StB5rRSASvyb4Inpesn%2Ba6%2BU3l%2Bj%2BwXI4oNuHTGigB8qZVhcSZa3Gzjec317RNRvVNjU5HdWN%2BhrwzFxbYcjHnJJVhYpp3kFEDk4q2CYc6aax3FhPqemjN%2F%2FCjhnw%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 960b9b371eacb4f7-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=566&min_rtt=475&rtt_var=210&sent=8&recv=10&lost=0&retrans=0&sent_bytes=3272&recv_bytes=1187&delivery_rate=7661375&cwnd=254&unsent_bytes=0&cid=db30f8813d6eae44&ts=82&x=0"
X-Firefox-Spdy: h2
GET cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js
104.17.25.14200 OK 90 kB URL GET cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js
IP 104.17.25.14:443
Requested by https://9hcfrxf.63641176768ab8234f981fbe.workers.dev/#Mtim%40slurpmail.net
Certificate IssuerGoogle Trust Services
Subjectcdnjs.cloudflare.com
Fingerprint4B:06:E9:E2:47:47:F5:3C:33:58:F8:2A:95:70:22:5E:23:19:03:77
ValidityThu, 22 May 2025 14:38:44 GMT - Wed, 20 Aug 2025 15:38:38 GMT
File type JavaScript source, ASCII text, with very long lines (65447)
Hash 8fb8fee4fcc3cc86ff6c724154c49c42
b82d238d4e31fdf618bae8ac11a6c812c03dd0d4
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e
GET /ajax/libs/jquery/3.6.0/jquery.min.js HTTP/1.1
Host: cdnjs.cloudflare.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://9hcfrxf.63641176768ab8234f981fbe.workers.dev/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 17 Jul 2025 17:54:48 GMT
content-type: application/javascript; charset=utf-8
content-length: 27938
cf-ray: 960b9b49fad656a2-OSL
access-control-allow-origin: *
cache-control: public, max-age=30672000
content-encoding: br
etag: "603e8adc-15d9d"
last-modified: Tue, 02 Mar 2021 18:58:36 GMT
cf-cdnjs-via: cfworker/kv
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
x-content-type-options: nosniff
vary: Accept-Encoding
cf-cache-status: HIT
age: 578904
expires: Tue, 07 Jul 2026 17:54:48 GMT
accept-ranges: bytes
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I%2B6Rl7eccx1jqcYQcLeBcJC0bGcakn7Ji87VVg2a2rjgtPQS39NztMSeZrJ%2Fo%2FL82lVLQgoMgw0pMV3k3M0eanuDdw2Vy3RbvmFKmYwsa2RcQhcWH7E3Jlm2zgZUxIMIap4WVRwr"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
server: cloudflare
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2
GET login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=7b284e94-91e1-4ee4-ae5c-45d40252b398&response_type=code&redirect_uri=https://reviewsign-docsharedeco.vercel.app/&scope=openid%20profile%20https://graph.microsoft.com/User.Read&state=tim:tim@slurpmail.net&prompt=none
20.190.147.10200 OK 22 kB URL User Request GET login.microsoftonline.com/common/oauth2/v2.0/authorize?client_id=7b284e94-91e1-4ee4-ae5c-45d40252b398&response_type=code&redirect_uri=https://reviewsign-docsharedeco.vercel.app/&scope=openid%20profile%20https://graph.microsoft.com/User.Read&state=tim:tim@slurpmail.net&prompt=none
IP 20.190.147.10:443
ASN #8075 MICROSOFT-CORP-MSN-AS-BLOCK
Certificate IssuerDigiCert Inc
Subjectstamp2.login.microsoftonline.com
Fingerprint4D:09:56:F1:54:58:A5:82:A9:0A:F1:C1:48:A8:87:B9:CF:15:B6:B6
ValidityMon, 26 May 2025 00:00:00 GMT - Wed, 26 Nov 2025 23:59:59 GMT
File type HTML document, ASCII text, with very long lines (7597), with CRLF, LF line terminators
Hash fd6d3bfa6fdcb9130ce6880a38d5e4fd
b70666853e3233f444749478140fe0d67e149803
1252ce000a0ce7a4331c822c90c76370a0e2994191cbe2245a0535a8578d6611
GET /common/oauth2/v2.0/authorize?client_id=7b284e94-91e1-4ee4-ae5c-45d40252b398&response_type=code&redirect_uri=https://reviewsign-docsharedeco.vercel.app/&scope=openid%20profile%20https://graph.microsoft.com/User.Read&state=tim:tim@slurpmail.net&prompt=none HTTP/1.1
Host: login.microsoftonline.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
cache-control: no-store, no-cache
pragma: no-cache
content-type: text/html; charset=utf-8
content-encoding: gzip
expires: -1
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
link: <https://aadcdn.msauth.net>; rel=preconnect; crossorigin, <https://aadcdn.msauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msauth.net>; rel=dns-prefetch, <https://aadcdn.msauth.net>; rel=preconnect; crossorigin,<https://aadcdn.msauth.net>; rel=dns-prefetch,<https://aadcdn.msftauth.net>; rel=dns-prefetch
x-dns-prefetch-control: on
p3p: CP="DSP CUR OTPi IND OTRi ONL FIN"
x-ms-request-id: 9767b83e-7d49-4cb9-9141-1098d3333100
x-ms-ests-server: 2.1.21415.6 - AUSELR1 ProdSlices
x-ms-srs: 1.P
referrer-policy: strict-origin-when-cross-origin
content-security-policy-report-only: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-fmuduJdz3Ws4DxDkOuI6Og' 'unsafe-inline' 'unsafe-eval' https://*.msauth.net https://*.msftauth.net https://*.msftauthimages.net https://*.msauthimages.net https://*.msidentity.com https://*.microsoftonline-p.com https://*.microsoftazuread-sso.com https://*.azureedge.net https://*.outlook.com https://*.office.com https://*.office365.com https://*.microsoft.com https://*.bing.com 'report-sample'; report-uri https://csp.microsoft.com/report/ESTS-UX-All
x-xss-protection: 0
set-cookie: buid=1.AUIAYvWey6L6LUCXR6DJTYWzrZROKHvhkeROrlxF1AJSs5hCAABCAA.AQABGgEAAABVrSpeuWamRam2jAF1XRQEp3zoxILSH7Qk18E0nenANqMtltyNuMbs3_1EGExMJctJqztd9wbYzxKBs181VwVwYuHmx_Yi9WddWIExK2jlY-BzFVyZ1JCJnYxFar6NcikgAA; expires=Sat, 16-Aug-2025 17:54:40 GMT; path=/; secure; HttpOnly; SameSite=None
esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQEFjFawlyQZp7KlUEXJwL6PPwExRUsFgwIh0eiYxWjnF2VyQBvPJouJaF9NlVqkiu8cRKaASj9UiywsKdZVPosFOMe7RENo2XVLDKtHylbE0KKiSp0IjO_9S5qVeMOh2eyCGQMuW87Ma9T1rrdr3ad6-JWZpfoIuJJtQNEaNgrQdYgAA; domain=.login.microsoftonline.com; path=/; secure; HttpOnly; SameSite=None
esctx-rvEvTm1i2U=AQABCQEAAABVrSpeuWamRam2jAF1XRQEzLVsMC70meylKixgAxxS9tkmrs1fzuU-tcvY5kMu_NkQc_fCgd6a-uHaduEIVE5qykWqBIoaL-aZCSnVF1pC5iaRHk78qGgz2CcTcWn3p-f_pKVSS6YXDnh6n2zkIOIwRIp2Miq9H-mXME21--LJ3CAA; domain=.login.microsoftonline.com; path=/; secure; HttpOnly; SameSite=None
fpc=AqKX7lGCiDRAi3MKjYb8fWc26dqSAQAAAOAvC-AOAAAA; expires=Sat, 16-Aug-2025 17:54:40 GMT; path=/; secure; HttpOnly; SameSite=None
x-ms-gateway-slice=estsfd; path=/; secure; samesite=none; httponly
stsservicecookie=estsfd; path=/; secure; samesite=none; httponly
date: Thu, 17 Jul 2025 17:54:40 GMT
content-length: 9433
X-Firefox-Spdy: h2
GET fonts.gstatic.com/s/inter/v19/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2
142.250.74.35200 OK 48 kB URL GET fonts.gstatic.com/s/inter/v19/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2
IP 142.250.74.35:443
Requested by https://reviewsign-docsharedeco.vercel.app/?error=interaction_required&error_description=Session+information+is+not+sufficient+for+single-sign-on.&state=tim%3atim%40slurpmail.net
Certificate IssuerGoogle Trust Services
Subject*.gstatic.com
Fingerprint9A:5E:6D:44:D8:FB:03:E5:9A:13:6D:FF:53:DA:1C:8C:EA:3A:A7:AA
ValidityMon, 23 Jun 2025 08:41:27 GMT - Mon, 15 Sep 2025 08:41:26 GMT
File type Web Open Font Format (Version 2), TrueType, length 48532, version 1.0
Hash 225835e6e0496c54dc2aca9f3d533892
942ef5298bbe74bfe44e445def5f2bfc94027fa8
acc60d454f46f2ba233c516aa3299aa60e1f49ffd0f06b8392a7c772a5694087
GET /s/inter/v19/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7W0I5nvwU.woff2 HTTP/1.1
Host: fonts.gstatic.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://reviewsign-docsharedeco.vercel.app
DNT: 1
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 48532
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Thu, 17 Jul 2025 10:12:14 GMT
expires: Fri, 17 Jul 2026 10:12:14 GMT
cache-control: public, max-age=31536000
age: 27748
last-modified: Wed, 28 May 2025 18:51:44 GMT
content-type: font/woff2
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2
GET 9hcfrxf.63641176768ab8234f981fbe.workers.dev/favicon.ico
104.21.64.1200 OK 1.8 kB URL GET 9hcfrxf.63641176768ab8234f981fbe.workers.dev/favicon.ico
IP 104.21.64.1:443
Requested by https://9hcfrxf.63641176768ab8234f981fbe.workers.dev/#Mtim%40slurpmail.net
Certificate IssuerGoogle Trust Services
Subject63641176768ab8234f981fbe.workers.dev
FingerprintCF:38:B0:8F:15:6C:42:68:0A:06:AD:38:16:EB:E1:94:A3:52:04:26
ValiditySun, 06 Jul 2025 15:31:58 GMT - Sat, 04 Oct 2025 16:29:38 GMT
File type HTML document, Unicode text, UTF-8 text, with very long lines (669), with CRLF line terminators
Hash 9edeaff9005beb31eb1b369262a8541c
039e70400afa08662d121ad49be5441cb3bccdba
b673f9dfa6d44d31d2f1a6418d16be8de080070e64e1e2fa07014ba3df218d79
Analyzer Verdict Alert urlquery phishing Phishing - Rockstar2FA Phishing Kit
GET /favicon.ico HTTP/1.1
Host: 9hcfrxf.63641176768ab8234f981fbe.workers.dev
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Referer: https://9hcfrxf.63641176768ab8234f981fbe.workers.dev/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Thu, 17 Jul 2025 17:54:45 GMT
content-type: text/html
content-encoding: br
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4ErmWnEzftewjAKw7IfnhGJKxKTCHYsl7ebCXAnh%2Ft8x0Z2gHRHzPTERUrUQvy%2Bs8JC052BTNQQUVCBJRBON7tL2Wk3RiBHy23I5DMetcTBZdToU8MYdgva1LAfUiVGU5DcedUneHlzxvUeR0kaKPck2v4qIYSrtJwU8g3EBSQ%3D%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary: Accept-Encoding
server: cloudflare
cf-ray: 960b9b38384ab4f7-OSL
alt-svc: h3=":443"; ma=86400
server-timing: cfL4;desc="?proto=TCP&rtt=616&min_rtt=450&rtt_var=194&sent=13&recv=13&lost=0&retrans=0&sent_bytes=4835&recv_bytes=1347&delivery_rate=7661375&cwnd=256&unsent_bytes=0&cid=db30f8813d6eae44&ts=216&x=0"
X-Firefox-Spdy: h2
GET reviewsign-docsharedeco.vercel.app/?error=interaction_required&error_description=Session+information+is+not+sufficient+for+single-sign-on.&state=tim%3atim%40slurpmail.net
64.29.17.131200 OK 8.4 kB URL User Request GET reviewsign-docsharedeco.vercel.app/?error=interaction_required&error_description=Session+information+is+not+sufficient+for+single-sign-on.&state=tim%3atim%40slurpmail.net
IP 64.29.17.131:443
Certificate IssuerLet's Encrypt
Subject*.vercel.app
Fingerprint81:D3:FA:22:93:E5:25:70:85:9A:59:F7:5D:92:C4:FE:CF:35:0D:C7
ValidityTue, 24 Jun 2025 04:57:32 GMT - Mon, 22 Sep 2025 04:57:31 GMT
File type HTML document, ASCII text, with very long lines (831)
Hash b0c9b963c1b8599bd246ff117b729c44
9926c6192da8f56d69357299e75e6a7fafbdd97b
7d87f3fc89fd56b29b29a4264b521b30dd30ed210b51166934905c64c44c5d07
GET /?error=interaction_required&error_description=Session+information+is+not+sufficient+for+single-sign-on.&state=tim%3atim%40slurpmail.net HTTP/1.1
Host: reviewsign-docsharedeco.vercel.app
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Android; rv:134.0) Gecko/20100101 Firefox/134.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://login.microsoftonline.com/
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
accept-ranges: bytes
access-control-allow-origin: *
age: 171261
cache-control: public, max-age=0, must-revalidate
content-disposition: inline
content-encoding: br
content-type: text/html; charset=utf-8
date: Thu, 17 Jul 2025 17:54:42 GMT
etag: "b0c9b963c1b8599bd246ff117b729c44"
last-modified: Tue, 15 Jul 2025 18:20:20 GMT
server: Vercel
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-vercel-cache: HIT
x-vercel-id: arn1::5md2m-1752774881990-137154db1aae
content-length: 2962
X-Firefox-Spdy: h2