Scan report · about 2 months agoPublic

microsoft.sharepoint.com

13.107.138.10AS8075 · US
Landed onhttps://login.microsoftonline.com/72f988bf-86f1-41af-91ab-2d7cd011db47/oauth2/authorize?client%5Fid=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&response%5Fmode=form%5Fpost&ear%5Fjwe%5Fcrypto=eyJhbGciOiJFQ0RILUVTIiwiZW5jIjoiQTI1NkdDTSIsImFwdiI6IkFBQUFDVVZoY2tOc2FXVnVkR2dBQUFCRlEwc3pNQUFBQU42UkNUbGJqNzNRSTI1NEorNkVDaUNiUXZLdmVCc1pFQ1BGQUsraXdmbGVoUmY3TVMvbW9yV0U5N0h3elkxS2pVWUpnNGR3UkZFZ0toR3k1M3RtZit5V2pONnBkTGxjNWFPajdvZlpsMU10TU5idXRISlYyekk0SndEMmlpNUNDd0FBQUJnTUI5azdjQzR1bFM5bk5BUGk4eTVkZndZdGdXNWZGTWc9In0%3D&ear%5Fjwk=eyJhbGciOiJFQ0RILUVTIiwiY3J2IjoiUC0zODQiLCJ4IjoiQUFBQU1ONlJDVGxiajczUUkyNTRKKzZFQ2lDYlF2S3ZlQnNaRUNQRkFLK2l3ZmxlaFJmN01TL21vcldFOTdId3pZMUtqUT09IiwieSI6IkFBQUFNRVlKZzRkd1JGRWdLaEd5NTN0bWYreVdqTjZwZExsYzVhT2o3b2ZabDFNdE1OYnV0SEpWMnpJNEp3RDJpaTVDQ3c9PSIsImt0eSI6IkVDIn0%3D&spa%5Fclient%5Fid=08e18876%2D6177%2D487e%2Db8b5%2Dcf950c1e598c&client%5Finfo=1&response%5Ftype=code%20id%5Ftoken%20spa%5Frt&resource=00000003%2D0000%2D0ff1%2Dce00%2D000000000000&scope=openid&nonce=1CE42AC2B1F8099E54ED05917D519277DFBD7A64137F6055%2DDB8F27AF58B418047986BEFC5963F9D1AFC1D010387FA0B7B452C1A7209FD3C7&redirect%5Furi=https%3A%2F%2Fmicrosoft%2Esharepoint%2Ecom%2F%5Fforms%2Fdefault%2Easpx&state=OD0wJjMyPUFBRkNQQUFBQUJRNzI4MlFkU1lLamZBU0pYSiUyRmI4aVo4VzV2aHY3Q1olMkY2TnN4cEF2cnpkYTl0Wmc1WlJiSnVBYlZvMXNvdnVEdWxJd3Z0bTFxTjJhYVJoMzFFYUIxc3BRJTJCSndhaUIlMkJDcWJVVkxxWE44cGJEZHdLTyUyRiUyRnV5VTFvJTJCakRzbDU4ekpSNVh1b0llWHJvZ2tJdnl1bkdEbHVrJTJCRlQlMkJtbWFYSUVBVTk4d3hVWnN6eHhzeTh1M01ZSGhnUXAwQnNHVm5EOTVSd0d6TUVNVm1zZmtqa0pOUXV2ZzdZVW1Dd3Z2ZEVJdzZmZmZFcHJiZmZyZXVZZU5Tc2dzUWhMcVNyNmM4T1JmbHRocXMlMkIlMkIyUlRYQWk3dmR3UzM2ZDNJcXY2bWdMMFd2YWpiS1hienRGWjgyNklkb0RaTXR5MzZqOFlibEp1UGZ4ayUyQmNJMFNiQ0xybjZFTFRlVGZ0MUpDY0Z3RmYzWWNhUzVya0pSckZSNGhZUnQ2cms1ZUFwcg&claims=%7B%22id%5Ftoken%22%3A%7B%22xms%5Fcc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083%2D87e0%2D41b5%2Dbb78%2D0bc43c8a8e8a&client%2Drequest%2Did=bb7132a2%2Df09b%2D1000%2Dafc9%2D027d5c969935&sso_reload=true· 5 redirects
Verdict

Be careful — warning signs found

Automated

It asks you to enter a password. This site shows signs commonly seen in scams or impersonation, but we could not confirm it for certain. It may be a real threat, or it may be a legitimate site that simply looks unusual to our automated checks.

What to do

Avoid entering passwords or payment details until you are sure it is genuine. Open the company directly from its known website or app instead of this link. Check the evidence below and escalate to your analyst if unsure.

"Suspicious" is a caution, not a confirmation — it can be a false alarm. The evidence below explains why it was flagged.

Findings

Strongest first
InfoCross-domain scripts injected at runtime
3 script(s)

The page dynamically injected scripts from other domains. This is extremely common on legitimate sites (CDNs, analytics, asset domains) and is shown for context only.

Analyst noteNoisy by itself — a CDN/asset domain (e.g. a brand's own *.githubassets.com) is normal. Only meaningful if the source domain is unrelated/suspicious.

Infrastructure

IP
13.107.138.10MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US · AS8075US
TLS
CN=Microsoft TLS G2 RSA CA OCSP 16, O=Microsoft Corporation, C=US · expires Jan 18, 2027
Redirects
5 hops · / → /72f988bf-86f1-41af-91ab-2d7…27d5c969935&sso_reload=true

WHOIS

Registrar
Nom-iq Ltd. dba COM LAUDE
Created
Aug 10, 1998
Expires
Aug 9, 2027
Nameservers
ns1-221.azure-dns.comns2-221.azure-dns.netns3-221.azure-dns.orgns4-221.azure-dns.info
2 malicious3 suspicious

Hashes & fingerprints

Page capture

Live

Title “Sign in to your account”

Engines

8 · time to verdict

Page

HTTP
200 · Completed
Title
Sign in to your account
Load
10.23 s · 27 requests
Stack · 1HSTS