| login.live.com.office.avaya.myshn.net/ |  52.86.183.60 | 302 Found | 0 B |
URL User Request GET login.live.com.office.avaya.myshn.net/ IP52.86.183.60:80
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft |
GET / HTTP/1.1
Host: login.live.com.office.avaya.myshn.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 302 Found
Server: nginx
Date: Sat, 03 May 2025 16:56:50 GMT
Content-Length: 0
Connection: keep-alive
client-request-id: 107d3f57-0729-4bac-9109-3f005856cf7b
Location: https://login.live.com.office.avaya.myshn.net:443/
X-Robots-Tag: none
X-SkyHigh-Version: BuildNumber=41, BuildDate=2025-04-21 14:39
|
|
| login.live.com.office.avaya.myshn.net/ |  0.0.0.0 | | 0 B |
URL User Request GET login.live.com.office.avaya.myshn.net/ IP0.0.0.0:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft |
GET / HTTP/1.1
Host: login.live.com.office.avaya.myshn.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
|
|
| lgincdnmsftuswe2.azureedge.net.office.avaya.myshn.net/shared/5/js/login_en_RUTS6sZNLehsON_WGLWXBw2.js | 0.0.0.0 | | 0 B |
URL GET lgincdnmsftuswe2.azureedge.net.office.avaya.myshn.net/shared/5/js/login_en_RUTS6sZNLehsON_WGLWXBw2.js IP0.0.0.0:0
Requested byhttps://login.live.com.office.avaya.myshn.net/
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /shared/5/js/login_en_RUTS6sZNLehsON_WGLWXBw2.js HTTP/1.1
Host: lgincdnmsftuswe2.azureedge.net.office.avaya.myshn.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://login.live.com.office.avaya.myshn.net/
Origin: https://login.live.com.office.avaya.myshn.net
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
|
|
| logincdn.msauth.net.office.avaya.myshn.net/shared/5/js/login_en_RUTS6sZNLehsON_WGLWXBw2.js | 0.0.0.0 | | 0 B |
URL GET logincdn.msauth.net.office.avaya.myshn.net/shared/5/js/login_en_RUTS6sZNLehsON_WGLWXBw2.js IP0.0.0.0:0
Requested byhttps://login.live.com.office.avaya.myshn.net/
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /shared/5/js/login_en_RUTS6sZNLehsON_WGLWXBw2.js HTTP/1.1
Host: logincdn.msauth.net.office.avaya.myshn.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://login.live.com.office.avaya.myshn.net/
Origin: https://login.live.com.office.avaya.myshn.net
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
|
|
| browser.events.data.microsoft.com/OneCollector/1.0/?cors=true&content-type=application/x-json-stream&w=0 | 20.189.173.24 | 200 OK | 0 B |
URL OPTIONS browser.events.data.microsoft.com/OneCollector/1.0/?cors=true&content-type=application/x-json-stream&w=0 IP20.189.173.24:443 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttps://login.live.com.office.avaya.myshn.net/ CertificateIssuerMicrosoft Corporation Subject*.events.data.microsoft.com Fingerprint95:81:13:23:8A:6D:8C:EB:A6:60:1D:B3:08:BA:33:84:83:EE:63:7E ValidityThu, 13 Mar 2025 15:52:03 GMT - Tue, 09 Sep 2025 15:52:03 GMT
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
OPTIONS /OneCollector/1.0/?cors=true&content-type=application/x-json-stream&w=0 HTTP/1.1
Host: browser.events.data.microsoft.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: POST
Access-Control-Request-Headers: apikey,cache-control,client-id,client-version,content-type,time-delta-to-apply-millis,upload-time
Referer: https://login.live.com.office.avaya.myshn.net/
Origin: https://login.live.com.office.avaya.myshn.net
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
cache-control: public, 3600
content-length: 0
server: Microsoft-HTTPAPI/2.0
strict-transport-security: max-age=31536000
access-control-allow-credentials: true
access-control-allow-headers: AuthMsaDeviceTicket,AuthXToken,Content-Encoding,Content-Type,Cache-Control,Client-Id,SDK-Name,sdk-version,apikey,x-apikey,client-version,upload-time,time-delta-to-apply-millis,client-time-epoch-millis,persistence-mode,reliability-mode,NoResponseBody
access-control-max-age: 3600
access-control-allow-origin: https://login.live.com.office.avaya.myshn.net
date: Sat, 03 May 2025 16:56:56 GMT
X-Firefox-Spdy: h2
|
|
| browser.events.data.microsoft.com/OneCollector/1.0/?cors=true&content-type=application/x-json-stream&w=0 | 20.189.173.24 | 200 OK | 153 B |
URL POST browser.events.data.microsoft.com/OneCollector/1.0/?cors=true&content-type=application/x-json-stream&w=0 IP20.189.173.24:443 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttps://login.live.com.office.avaya.myshn.net/ CertificateIssuerMicrosoft Corporation Subject*.events.data.microsoft.com Fingerprint95:81:13:23:8A:6D:8C:EB:A6:60:1D:B3:08:BA:33:84:83:EE:63:7E ValidityThu, 13 Mar 2025 15:52:03 GMT - Tue, 09 Sep 2025 15:52:03 GMT
Hash534b18c77259d15a61a1b9ec4e6aec80 6b69d02afdeb199794c475c0464cb997cd81a375 932d7b83e945b1518d17e482e3900aba31a5f30f4b7a43614719438efa1be0ef
POST /OneCollector/1.0/?cors=true&content-type=application/x-json-stream&w=0 HTTP/1.1
Host: browser.events.data.microsoft.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://login.live.com.office.avaya.myshn.net/
Client-Id: NO_AUTH
client-version: 1DS-Web-JS-4.3.6
apikey: 69adc3c768bd4dc08c19416121249fcc-66f1668a-797b-4249-95e3-6c6651768c28-7293
upload-time: 1746291416360
time-delta-to-apply-millis: use-collector-delta
cache-control: no-cache, no-store
content-type: application/x-json-stream
Content-Length: 883
Origin: https://login.live.com.office.avaya.myshn.net
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
HTTP/2 200 OK
content-length: 153
content-type: application/json
server: Microsoft-HTTPAPI/2.0
strict-transport-security: max-age=31536000
p3p: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
set-cookie: MC1=GUID=9bde0091385249b69ecffd2834baa690&HASH=9bde&LV=202505&V=4&LU=1746291419216; Domain=.microsoft.com; Expires=Sun, 03 May 2026 16:56:59 GMT; Path=/;Secure; SameSite=None
MS0=f46bae395f6742b8be1e8a3c32eab06a; Domain=.microsoft.com; Expires=Sat, 03 May 2025 17:26:59 GMT; Path=/;Secure; SameSite=None
time-delta-millis: 2856
access-control-allow-headers: P3P,Set-Cookie,time-delta-millis
access-control-allow-methods: POST
access-control-allow-credentials: true
access-control-allow-origin: https://login.live.com.office.avaya.myshn.net
access-control-expose-headers: time-delta-millis
date: Sat, 03 May 2025 16:56:58 GMT
X-Firefox-Spdy: h2
|
|
| login.live.com.office.avaya.myshn.net/ | 0.0.0.0 | | 0 B |
URL User Request GET login.live.com.office.avaya.myshn.net/ IP0.0.0.0:0
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft |
GET / HTTP/1.1
Host: login.live.com.office.avaya.myshn.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Upgrade-Insecure-Requests: 1
Connection: keep-alive
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
|
|
| login.live.com.office.avaya.myshn.net/ | 54.236.104.241 | 200 OK | 29 kB |
URL User Request GET login.live.com.office.avaya.myshn.net/ IP54.236.104.241:443
CertificateIssuerGlobalSign nv-sa Subjectoffice.avaya.myshn.net FingerprintD7:55:9E:C2:2E:B6:3A:BB:A6:52:CB:65:E1:32:71:C3:FB:7E:72:81 ValidityThu, 05 Jan 2023 02:43:22 GMT - Tue, 06 Feb 2024 02:43:21 GMT
File typeJavaScript source, Unicode text, UTF-8 text, with very long lines (27257) Hash8540389f21d8223ee1bbae4d6762ba6c a9b0a4075418411a5d59cb0654ca937d8f0b5f75 2b4f8e0a6ab2136482352c8887bea2d8a5755a88826377a7201ce6bc9abcd390
| Analyzer | Verdict | Alert |
|---|
| urlquery | phishing | Phishing - Microsoft |
GET / HTTP/1.1
Host: login.live.com.office.avaya.myshn.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Date: Sat, 03 May 2025 16:56:52 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 11467
Connection: keep-alive
Cache-Control: no-store, no-cache
Content-Encoding: gzip
Content-Security-Policy: object-src 'none'; base-uri 'self'; script-src 'self' 'nonce-O1wpMVgWmoYGkjm4/AB85/5Mi4dGJJUPgf/bsVQsgig=' https://js.monitor.azure.com https://logincdn.msauth.net.office.avaya.myshn.net https://logincdn.msftauth.net.office.avaya.myshn.net https://lgincdnvzeuno.azureedge.net.office.avaya.myshn.net https://lgincdnmsftuswe2.azureedge.net.office.avaya.myshn.net https://*.live.com.office.avaya.myshn.net https://*.microsoft.com.office.avaya.myshn.net https://*.office.net.office.avaya.myshn.net https://*.bing.com.office.avaya.myshn.net https://*.sharepointonline.com.office.avaya.myshn.net 'report-sample'; img-src 'self' https://js.monitor.azure.com https://logincdn.msauth.net.office.avaya.myshn.net https://logincdn.msftauth.net.office.avaya.myshn.net https://lgincdnvzeuno.azureedge.net.office.avaya.myshn.net https://lgincdnmsftuswe2.azureedge.net.office.avaya.myshn.net https://*.live.com.office.avaya.myshn.net https://*.microsoft.com.office.avaya.myshn.net https://*.office.net.office.avaya.myshn.net https://*.bing.com.office.avaya.myshn.net https://*.sharepointonline.com.office.avaya.myshn.net; report-uri https://csp.microsoft.com.office.avaya.myshn.net/report/MSA-UX-All
Expires: Sat, 03 May 2025 16:55:52 GMT
Link: <https://logincdn.msftauth.net>; rel=preconnect; crossorigin, <https://acctcdn.msauth.net>; rel=preconnect; crossorigin, <https://acctcdn.msftauth.net>; rel=preconnect; crossorigin, <https://acctcdn.msauth.net/>; rel=dns-prefetch, <https://acctcdn.msftauth.net/>; rel=dns-prefetch, <https://acctcdnmsftuswe2.azureedge.net/>; rel=dns-prefetch, <https://logincdn.msauth.net/>; rel=dns-prefetch, <https://logincdn.msftauth.net/>; rel=dns-prefetch, <https://lgincdnmsftuswe2.azureedge.net/>; rel=dns-prefetch
P3P: CP="DSP CUR OTPi IND OTRi ONL FIN"
PPServer: PPV: 30 H: SN1PEPF0002FA4E V: 0
Pragma: no-cache
Referrer-Policy: strict-origin-when-cross-origin
Set-Cookie: uaid=267c3a98ac714467af13762a8e327ec3; Path=/; Domain=login.live.com.office.avaya.myshn.net; Secure; SameSite=None; HTTPOnly
MSPRequ=id=N<=1746291412&co=1; Path=/; Domain=login.live.com.office.avaya.myshn.net; Secure; SameSite=None; HTTPOnly
MSCC=3.231.181.5-US; Expires=Thu, 28-May-2026 16:56:52 GMT; Path=/; Domain=login.live.com.office.avaya.myshn.net; Secure; SameSite=None; HTTPOnly
MSPOK=$uuid-a0770445-3711-4336-8e60-3ef808f9bcc4; Path=/; Domain=login.live.com.office.avaya.myshn.net; Secure; SameSite=None; HTTPOnly
OParams=11O.DsL15PVBoKxDTGhzjLR9p19rSrlYAtyEtR8VuokVsOAEk2ExULsbllHnJMJK0dJU3KaodRHyRrfBnb7dtqScW!YGFyt0ZcJc!3GOTS59V9CDR!24pIRP2N4FI8XgoJj27pHSv8MoAulHRJyLlka21WI$; Path=/; Domain=login.live.com.office.avaya.myshn.net; Secure; SameSite=None; HTTPOnly
Strict-Transport-Security: max-age=31536000
Vary: Accept-Encoding
X-Content-Type-Options: nosniff
X-DNS-Prefetch-Control: on
x-ms-request-id: 950321f4-820b-4e22-b730-cb3f5a1c4a6f
x-ms-route-info: C555_SN1
X-Robots-Tag: none
X-SkyHigh-Version: BuildNumber=41, BuildDate=2025-04-21 14:39
X-XSS-Protection: 1; mode=block
|
|
| logincdn.msftauth.net.office.avaya.myshn.net/shared/5/js/login_en_RUTS6sZNLehsON_WGLWXBw2.js | 0.0.0.0 | | 0 B |
URL GET logincdn.msftauth.net.office.avaya.myshn.net/shared/5/js/login_en_RUTS6sZNLehsON_WGLWXBw2.js IP0.0.0.0:0
Requested byhttps://login.live.com.office.avaya.myshn.net/
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /shared/5/js/login_en_RUTS6sZNLehsON_WGLWXBw2.js HTTP/1.1
Host: logincdn.msftauth.net.office.avaya.myshn.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://login.live.com.office.avaya.myshn.net/
Origin: https://login.live.com.office.avaya.myshn.net
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
|
|
| logincdn.msftauth.net.office.avaya.myshn.net/16.000.30571.2/images/favicon.ico | 0.0.0.0 | | 0 B |
URL GET logincdn.msftauth.net.office.avaya.myshn.net/16.000.30571.2/images/favicon.ico IP0.0.0.0:0
Requested byhttps://login.live.com.office.avaya.myshn.net/
Hashd41d8cd98f00b204e9800998ecf8427e da39a3ee5e6b4b0d3255bfef95601890afd80709 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /16.000.30571.2/images/favicon.ico HTTP/1.1
Host: logincdn.msftauth.net.office.avaya.myshn.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://login.live.com.office.avaya.myshn.net/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
|
|
| js.monitor.azure.com/scripts/c/ms.analytics-4.min.js | 13.107.246.53 | 200 OK | 100 kB |
URL GET js.monitor.azure.com/scripts/c/ms.analytics-4.min.js IP13.107.246.53:443 ASN#8075 MICROSOFT-CORP-MSN-AS-BLOCK
Requested byhttps://login.live.com.office.avaya.myshn.net/ CertificateIssuerMicrosoft Corporation Subjectjs.monitor.azure.com Fingerprint4B:70:9F:08:D8:2A:73:86:8F:A1:A0:57:1D:EC:C7:3F:73:24:32:97 ValidityFri, 04 Apr 2025 12:05:43 GMT - Wed, 01 Oct 2025 12:05:43 GMT
File typeJavaScript source, ASCII text, with very long lines (65402) Hash11558a13ac7e77f1751cc71325f2eaba 3ccebff14a73c05620c8428d236f7269f34bfc5a d232abee05c7b0d681fcd3ee16ec64027b4053dcade01b0a5b62c38693df2c5e
GET /scripts/c/ms.analytics-4.min.js HTTP/1.1
Host: js.monitor.azure.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://login.live.com.office.avaya.myshn.net/
DNT: 1
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
HTTP/2 200 OK
date: Sat, 03 May 2025 16:56:54 GMT
content-type: text/javascript; charset=utf-8
vary: Accept-Encoding
cache-control: no-transform, public, max-age=1800, immutable
last-modified: Wed, 19 Mar 2025 16:45:08 GMT
x-ms-request-id: bd1dc072-501e-0053-4fe4-b903ae000000
x-ms-version: 2009-09-19
x-ms-meta-jssdkver: 4.3.6
x-ms-meta-jssdksrc: [cdn]/scripts/c/ms.analytics-4.3.6.min.js
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,x-ms-meta-jssdksrc,Content-Type,Cache-Control,Last-Modified,ETag,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
access-control-allow-origin: *
x-azure-ref: 20250503T165654Z-16c476b8794zfkgmhC1SVGsw4c00000001bg000000007ppd
x-fd-int-roxy-purgeid: 0
x-cache: TCP_HIT
content-encoding: br
X-Firefox-Spdy: h2
|
|
0.0.0.0