IOC Report
https://www.phsinc.com/?bwfan-track-action=click&bwfan-track-id=0ecdd1bdf2276cad3fa2d27ffa918e84&bwfan-uid=e2dffed46dd69d19d18bc527d6255bd5&bwfan-link=%68%74%74%70%73%3A%2F%2F%6D%61%69%6C%2E%72%69%67%6F%74%69%6C%65%73%2E%63%6F%6D%2F%6A%50%73%51%57%55%63%42

loading gif

Files

File Path
Type
Category
Malicious
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 31 19:54:47 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 31 19:54:47 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 31 19:54:47 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 31 19:54:47 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Thu Oct 31 19:54:47 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
dropped
Chrome Cache Entry: 100
ASCII text, with very long lines (65450), with CRLF line terminators
dropped
Chrome Cache Entry: 101
JSON data
dropped
Chrome Cache Entry: 102
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
downloaded
Chrome Cache Entry: 103
GIF image data, version 89a, 352 x 3
downloaded
Chrome Cache Entry: 104
Unicode text, UTF-8 text, with very long lines (65533), with no line terminators
downloaded
Chrome Cache Entry: 105
ASCII text, with very long lines (64616)
downloaded
Chrome Cache Entry: 106
ASCII text, with very long lines (61174)
downloaded
Chrome Cache Entry: 107
ASCII text, with very long lines (64616)
dropped
Chrome Cache Entry: 108
ASCII text, with very long lines (512)
dropped
Chrome Cache Entry: 109
Unicode text, UTF-8 text, with very long lines (65533), with no line terminators
dropped
Chrome Cache Entry: 110
Unicode text, UTF-8 text, with very long lines (32009)
dropped
Chrome Cache Entry: 111
PNG image data, 92 x 92, 8-bit colormap, non-interlaced
dropped
Chrome Cache Entry: 112
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 113
PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
dropped
Chrome Cache Entry: 114
Unicode text, UTF-8 text, with very long lines (32009)
downloaded
Chrome Cache Entry: 115
PNG image data, 91 x 6, 8-bit/color RGB, non-interlaced
dropped
Chrome Cache Entry: 116
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 117
PNG image data, 2 x 2, 8-bit/color RGB, non-interlaced
downloaded
Chrome Cache Entry: 118
ASCII text, with very long lines (14782)
dropped
Chrome Cache Entry: 119
ASCII text, with very long lines (2054)
dropped
Chrome Cache Entry: 120
HTML document, Unicode text, UTF-8 text, with very long lines (39933)
downloaded
Chrome Cache Entry: 121
ASCII text, with no line terminators
downloaded
Chrome Cache Entry: 122
ASCII text, with very long lines (512)
downloaded
Chrome Cache Entry: 123
ASCII text, with very long lines (46591)
dropped
Chrome Cache Entry: 124
Unicode text, UTF-8 text, with very long lines (41625)
downloaded
Chrome Cache Entry: 125
ASCII text, with very long lines (45797)
downloaded
Chrome Cache Entry: 84
MS Windows icon resource - 6 icons, -128x-128, 16 colors, 72x72, 16 colors
dropped
Chrome Cache Entry: 85
ASCII text, with very long lines (47671)
downloaded
Chrome Cache Entry: 86
PNG image data, 92 x 92, 8-bit colormap, non-interlaced
downloaded
Chrome Cache Entry: 87
GIF image data, version 89a, 352 x 3
dropped
Chrome Cache Entry: 88
ASCII text, with very long lines (47671)
dropped
Chrome Cache Entry: 89
ASCII text, with very long lines (45797)
dropped
Chrome Cache Entry: 90
Unicode text, UTF-8 text, with very long lines (41625)
dropped
Chrome Cache Entry: 91
ASCII text, with very long lines (14782)
downloaded
Chrome Cache Entry: 92
ASCII text, with very long lines (65450), with CRLF line terminators
downloaded
Chrome Cache Entry: 93
ASCII text, with very long lines (2054)
downloaded
Chrome Cache Entry: 94
SVG Scalable Vector Graphics image
dropped
Chrome Cache Entry: 95
GIF image data, version 89a, 352 x 3
downloaded
Chrome Cache Entry: 96
SVG Scalable Vector Graphics image
downloaded
Chrome Cache Entry: 97
ASCII text, with very long lines (46591)
downloaded
Chrome Cache Entry: 98
GIF image data, version 89a, 352 x 3
dropped
Chrome Cache Entry: 99
PNG image data, 91 x 6, 8-bit/color RGB, non-interlaced
downloaded
There are 39 hidden files, click here to show them.

Processes

Path
Cmdline
Malicious
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=1952,i,4673534725158447727,11309025112400644165,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://www.phsinc.com/?bwfan-track-action=click&bwfan-track-id=0ecdd1bdf2276cad3fa2d27ffa918e84&bwfan-uid=e2dffed46dd69d19d18bc527d6255bd5&bwfan-link=%68%74%74%70%73%3A%2F%2F%6D%61%69%6C%2E%72%69%67%6F%74%69%6C%65%73%2E%63%6F%6D%2F%6A%50%73%51%57%55%63%42"

URLs

Name
IP
Malicious
https://www.phsinc.com/?bwfan-track-action=click&bwfan-track-id=0ecdd1bdf2276cad3fa2d27ffa918e84&bwfan-uid=e2dffed46dd69d19d18bc527d6255bd5&bwfan-link=%68%74%74%70%73%3A%2F%2F%6D%61%69%6C%2E%72%69%67%6F%74%69%6C%65%73%2E%63%6F%6D%2F%6A%50%73%51%57%55%63%42
malicious
https://www.phsinc.com/?bwfan-track-action=click&bwfan-track-id=0ecdd1bdf2276cad3fa2d27ffa918e84&bwfan-uid=e2dffed46dd69d19d18bc527d6255bd5&bwfan-link=%68%74%74%70%73%3A%2F%2F%6D%61%69%6C%2E%72%69%67%6F%74%69%6C%65%73%2E%63%6F%6D%2F%6A%50%73%51%57%55%63%42
3.132.253.175
 malicious
https://mail.rigotiles.com/jPsQWUcB
malicious
https://mail.rigotiles.com/jPsQWUcB?y=IUmJJik
188.114.97.3
 malicious
https://mail.rigotiles.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638660049050246663.ODc3ZjU4ZjQtODc2Zi00ODIzLWE0ZWYtZTkwNDU1YWI0OTFiM2NlOWFhNzEtMjU2Ny00ZjYwLTgzNzEtODIzYmIwYzA4ODM0&ui_locales=en-US&mkt=en-US&client-request-id=38bb8568-fea6-41ed-ae3e-ed6af3504c2b&state=x4Aec5a0t6Chw2Cmg3oyOPc-mwB2u0ch0KBYfu6mFO5Ma9nmM_3GwZPFX412dON63puN8EmddEU_qbWoXhATmOc0tMJNkQgq5JBQxfDDFQOnDaAULmUWlGDanz3aCy4nYqKb7pQIfefqVH19cqYbRn5LhF6TdIjTRmTo2w8AteES04W1enQACj8zsPIvZTVP2q0Ivk-tgunlyCULGc3oUQHLKsH_aN5xgAMMDXqLt9ycip-0aqZMys4sowroO7trqWt3x56-Y1VnFgP7VP530Q&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true
malicious
https://mail.rigotiles.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638660049050246663.ODc3ZjU4ZjQtODc2Zi00ODIzLWE0ZWYtZTkwNDU1YWI0OTFiM2NlOWFhNzEtMjU2Ny00ZjYwLTgzNzEtODIzYmIwYzA4ODM0&ui_locales=en-US&mkt=en-US&client-request-id=38bb8568-fea6-41ed-ae3e-ed6af3504c2b&state=x4Aec5a0t6Chw2Cmg3oyOPc-mwB2u0ch0KBYfu6mFO5Ma9nmM_3GwZPFX412dON63puN8EmddEU_qbWoXhATmOc0tMJNkQgq5JBQxfDDFQOnDaAULmUWlGDanz3aCy4nYqKb7pQIfefqVH19cqYbRn5LhF6TdIjTRmTo2w8AteES04W1enQACj8zsPIvZTVP2q0Ivk-tgunlyCULGc3oUQHLKsH_aN5xgAMMDXqLt9ycip-0aqZMys4sowroO7trqWt3x56-Y1VnFgP7VP530Q&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0
malicious
https://newassets.hcaptcha.com/captcha/v1/05c78a4/static/hcaptcha.html
104.19.230.21
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/frameworksupport.min_oadrnc13magb009k4d20lg2.js
152.199.21.175
https://a.nel.cloudflare.com/report/v4?s=ctuXg0CF%2FmAcRHMKXW664gMZvvIPm5eQQ5smhIGrVczEx2QIzScsyeEM4XNiU12AjL0Ag42dHxzewCZurKVysJlYEq0FxJa159Sxh48%2BC0v7eor7oo0SGEtlLDbxdQUclbv791sN
35.190.80.1
https://mail.rigotiles.com/
188.114.97.3
https://vn3hg.rigotiles.com/shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_117b650bccea354984d8.js
188.114.97.3
https://vn3hg.rigotiles.com/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js
188.114.96.3
https://mail.rigotiles.com/common/handlers/watson
188.114.96.3
https://vn3hg.rigotiles.com/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
188.114.97.3
https://vn3hg.rigotiles.com/shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg
188.114.97.3
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv0/0/qh7j5/0x4AAAAAAAyr4qst3s0poVsP/auto/fbE/normal/auto/
104.18.94.41
https://react.rigotiles.com/login
188.114.96.3
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/cmg/1
104.18.94.41
https://i.ibb.co/SJ5tdZc/download.png[/img
162.19.58.157
https://js.hcaptcha.com/1/api.js
104.19.230.21
https://vn3hg.rigotiles.com/shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_d0a803279e7397bef834.js
188.114.97.3
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_1yb3e7oii5t28dgo4xrtow2.js
152.199.21.175
https://vn3hg.rigotiles.com/shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif
188.114.97.3
https://mail.rigotiles.com/s/07f1e878a6a4099a22d191aa8620db246a4d51250183c5b6fa76fa586131f157/e912187ff14fbe0e087fdd0242e0ac50ec5f2e3b1729e3fe0d8b2bf4a69d8ad8.js
188.114.97.3
https://newassets.hcaptcha.com/c/0d69d1a359119bd0e2c5ca7f11f300ac050517fd19b612f86c0c75a2b0b39cbe/hsw.js
104.19.230.21
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js
152.199.21.175
https://vn3hg.rigotiles.com/ests/2.1/content/cdnbundles/converged.v2.login.min_nin8k2ycrbzww8zl5vxkaq2.css
188.114.96.3
https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_IzDt-l0Cuie0gYRUoEk15w2.js
152.199.21.175
https://challenges.cloudflare.com/turnstile/v0/b/22755d9a86c9/api.js
104.18.94.41
https://hcaptcha.com/license
unknown
https://i.ibb.co/SJ5tdZc/download.png
162.19.58.157
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/watson.min_q5ptmu8aniymd4ftuqdkda2.js
152.199.21.175
https://mail.rigotiles.com/s/07f1e878a6a4099a22d191aa8620db246a4d51250183c5b6fa76fa586131f157.js
188.114.97.3
http://knockoutjs.com/
unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/i/8db68aefa9dee71a/1730408094291/1DUK2cFFx0Ov71K
104.18.94.41
https://github.com/douglascrockford/JSON-js
unknown
https://ywnjb.rigotiles.com/Me.htm?v=3
188.114.96.3
https://challenges.cloudflare.com/turnstile/v0/api.js?onload=onloadTurnstileCallback
104.18.94.41
https://vn3hg.rigotiles.com/ests/2.1/content/cdnbundles/frameworksupport.min_oadrnc13magb009k4d20lg2.js
188.114.96.3
https://vn3hg.rigotiles.com/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_1yb3e7oii5t28dgo4xrtow2.js
188.114.96.3
http://gsgd.co.uk/sandbox/jquery/easing/
unknown
https://vn3hg.rigotiles.com/shared/1.0/content/js/ConvergedLogin_PCore_IzDt-l0Cuie0gYRUoEk15w2.js
188.114.96.3
http://www.opensource.org/licenses/mit-license.php)
unknown
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=8db68aefa9dee71a&lang=auto
104.18.94.41
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/flow/ov1/1827530087:1730405642:ltd0wnhF-wNUZPhVAbzH59KppvuK_FKCeFGLBlDqCYQ/8db68aefa9dee71a/7cykXcorcTo1NInY40PyAW.pmxtDKZjwQymE_8quY0M-1730408092-1.1.1.1-Ke.D64bIfKYJPApeFdyVZtu8wbDtjaUMDXBNn45ZRomcSu7xIPnksyDPYrWEyyBv
104.18.94.41
https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_nin8k2ycrbzww8zl5vxkaq2.css
152.199.21.175
https://vn3hg.rigotiles.com/ests/2.1/content/cdnbundles/watson.min_q5ptmu8aniymd4ftuqdkda2.js
188.114.97.3
https://mail.rigotiles.com/favicon.ico
188.114.97.3
https://api2.hcaptcha.com/checksiteconfig?v=05c78a4&host=mail.rigotiles.com&sitekey=234adb2f-52ba-4697-82fa-abecbb14b173&sc=1&swa=1&spst=1
104.19.230.21
https://vn3hg.rigotiles.com/shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif
188.114.97.3
http://feross.org
unknown
https://aadcdn.msftauth.net/shared/1.0/content/js/BssoInterrupt_Core_zKox_QMcTIVut7mG_Z9Eew2.js
152.199.21.175
https://vn3hg.rigotiles.com/shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg
188.114.97.3
https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/pat/8db68aefa9dee71a/1730408094294/bfc9350757dc2b54cda47f1ce8f7cb0fee63827b7d6473a6f9e3352166586cbd/I6Sy_RrFs8HulFz
104.18.94.41
There are 43 hidden URLs, click here to show them.

Domains

Name
IP
Malicious
mail.rigotiles.com
188.114.97.3
 malicious
www.phsinc.com
unknown
 malicious
aadcdn.msftauth.net
unknown
 malicious
identity.nel.measure.office.net
unknown
 malicious
206.23.85.13.in-addr.arpa
unknown
 malicious
a.nel.cloudflare.com
35.190.80.1
react.rigotiles.com
188.114.96.3
s-part-0039.t-0009.t-msedge.net
13.107.246.67
vn3hg.rigotiles.com
188.114.96.3
i.ibb.co
162.19.58.157
phsinc.com
3.132.253.175
js.hcaptcha.com
104.19.230.21
challenges.cloudflare.com
104.18.94.41
sni1gl.wpc.omegacdn.net
152.199.21.175
www.google.com
216.58.206.68
ywnjb.rigotiles.com
188.114.96.3
api2.hcaptcha.com
104.19.230.21
newassets.hcaptcha.com
104.19.230.21
There are 8 hidden domains, click here to show them.

IPs

IP
Domain
Country
Malicious
188.114.97.3
mail.rigotiles.com
European Union
malicious
216.58.212.164
unknown
United States
13.107.246.67
s-part-0039.t-0009.t-msedge.net
United States
104.18.94.41
challenges.cloudflare.com
United States
192.168.2.16
unknown
unknown
3.132.253.175
phsinc.com
United States
104.19.230.21
js.hcaptcha.com
United States
35.190.80.1
a.nel.cloudflare.com
United States
169.197.85.95
unknown
United States
104.18.95.41
unknown
United States
162.19.58.157
i.ibb.co
United States
216.58.206.68
www.google.com
United States
104.19.229.21
unknown
United States
239.255.255.250
unknown
Reserved
188.114.96.3
react.rigotiles.com
European Union
152.199.21.175
sni1gl.wpc.omegacdn.net
United States
There are 6 hidden IPs, click here to show them.

DOM / HTML

URL
Malicious
https://mail.rigotiles.com/jPsQWUcB
 malicious
https://mail.rigotiles.com/jPsQWUcB
 malicious
https://mail.rigotiles.com/jPsQWUcB
 malicious
https://mail.rigotiles.com/jPsQWUcB
 malicious
https://mail.rigotiles.com/jPsQWUcB
 malicious
https://mail.rigotiles.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638660049050246663.ODc3ZjU4ZjQtODc2Zi00ODIzLWE0ZWYtZTkwNDU1YWI0OTFiM2NlOWFhNzEtMjU2Ny00ZjYwLTgzNzEtODIzYmIwYzA4ODM0&ui_locales=en-US&mkt=en-US&client-request-id=38bb8568-fea6-41ed-ae3e-ed6af3504c2b&state=x4Aec5a0t6Chw2Cmg3oyOPc-mwB2u0ch0KBYfu6mFO5Ma9nmM_3GwZPFX412dON63puN8EmddEU_qbWoXhATmOc0tMJNkQgq5JBQxfDDFQOnDaAULmUWlGDanz3aCy4nYqKb7pQIfefqVH19cqYbRn5LhF6TdIjTRmTo2w8AteES04W1enQACj8zsPIvZTVP2q0Ivk-tgunlyCULGc3oUQHLKsH_aN5xgAMMDXqLt9ycip-0aqZMys4sowroO7trqWt3x56-Y1VnFgP7VP530Q&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0
 malicious
https://mail.rigotiles.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638660049050246663.ODc3ZjU4ZjQtODc2Zi00ODIzLWE0ZWYtZTkwNDU1YWI0OTFiM2NlOWFhNzEtMjU2Ny00ZjYwLTgzNzEtODIzYmIwYzA4ODM0&ui_locales=en-US&mkt=en-US&client-request-id=38bb8568-fea6-41ed-ae3e-ed6af3504c2b&state=x4Aec5a0t6Chw2Cmg3oyOPc-mwB2u0ch0KBYfu6mFO5Ma9nmM_3GwZPFX412dON63puN8EmddEU_qbWoXhATmOc0tMJNkQgq5JBQxfDDFQOnDaAULmUWlGDanz3aCy4nYqKb7pQIfefqVH19cqYbRn5LhF6TdIjTRmTo2w8AteES04W1enQACj8zsPIvZTVP2q0Ivk-tgunlyCULGc3oUQHLKsH_aN5xgAMMDXqLt9ycip-0aqZMys4sowroO7trqWt3x56-Y1VnFgP7VP530Q&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true
 malicious
https://mail.rigotiles.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638660049050246663.ODc3ZjU4ZjQtODc2Zi00ODIzLWE0ZWYtZTkwNDU1YWI0OTFiM2NlOWFhNzEtMjU2Ny00ZjYwLTgzNzEtODIzYmIwYzA4ODM0&ui_locales=en-US&mkt=en-US&client-request-id=38bb8568-fea6-41ed-ae3e-ed6af3504c2b&state=x4Aec5a0t6Chw2Cmg3oyOPc-mwB2u0ch0KBYfu6mFO5Ma9nmM_3GwZPFX412dON63puN8EmddEU_qbWoXhATmOc0tMJNkQgq5JBQxfDDFQOnDaAULmUWlGDanz3aCy4nYqKb7pQIfefqVH19cqYbRn5LhF6TdIjTRmTo2w8AteES04W1enQACj8zsPIvZTVP2q0Ivk-tgunlyCULGc3oUQHLKsH_aN5xgAMMDXqLt9ycip-0aqZMys4sowroO7trqWt3x56-Y1VnFgP7VP530Q&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true
 malicious
https://mail.rigotiles.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638660049050246663.ODc3ZjU4ZjQtODc2Zi00ODIzLWE0ZWYtZTkwNDU1YWI0OTFiM2NlOWFhNzEtMjU2Ny00ZjYwLTgzNzEtODIzYmIwYzA4ODM0&ui_locales=en-US&mkt=en-US&client-request-id=38bb8568-fea6-41ed-ae3e-ed6af3504c2b&state=x4Aec5a0t6Chw2Cmg3oyOPc-mwB2u0ch0KBYfu6mFO5Ma9nmM_3GwZPFX412dON63puN8EmddEU_qbWoXhATmOc0tMJNkQgq5JBQxfDDFQOnDaAULmUWlGDanz3aCy4nYqKb7pQIfefqVH19cqYbRn5LhF6TdIjTRmTo2w8AteES04W1enQACj8zsPIvZTVP2q0Ivk-tgunlyCULGc3oUQHLKsH_aN5xgAMMDXqLt9ycip-0aqZMys4sowroO7trqWt3x56-Y1VnFgP7VP530Q&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true
 malicious
https://mail.rigotiles.com/jPsQWUcB
https://mail.rigotiles.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638660049050246663.ODc3ZjU4ZjQtODc2Zi00ODIzLWE0ZWYtZTkwNDU1YWI0OTFiM2NlOWFhNzEtMjU2Ny00ZjYwLTgzNzEtODIzYmIwYzA4ODM0&ui_locales=en-US&mkt=en-US&client-request-id=38bb8568-fea6-41ed-ae3e-ed6af3504c2b&state=x4Aec5a0t6Chw2Cmg3oyOPc-mwB2u0ch0KBYfu6mFO5Ma9nmM_3GwZPFX412dON63puN8EmddEU_qbWoXhATmOc0tMJNkQgq5JBQxfDDFQOnDaAULmUWlGDanz3aCy4nYqKb7pQIfefqVH19cqYbRn5LhF6TdIjTRmTo2w8AteES04W1enQACj8zsPIvZTVP2q0Ivk-tgunlyCULGc3oUQHLKsH_aN5xgAMMDXqLt9ycip-0aqZMys4sowroO7trqWt3x56-Y1VnFgP7VP530Q&x-client-SKU=ID_NET8_0&x-client-ver=7.5.1.0&sso_reload=true
There are 1 hidden doms, click here to show them.