technology software

social_media

phishing/scam

English

CAKEPHP

The domain 'core1-iad.ns-cluster-prod.click' uses the .click top-level domain; it also runs on subdomain 'core1-iad'. The core label 'ns-cluster-prod' covers 15 characters split between three vowels and ten consonants; it also includes 2 hyphens. It segments into 3 words: ns, cluster, prod. Expect 4 characters per word on average. No strong language cues emerged from the frequency lists.

_method

data[Login][vendor]

data[Login][id_token]

data[Login][username]

data[Login][password]

default-src 'self' https://*.ns-cluster-prod.click; script-src 'self' 'unsafe-inline' https://accounts.google.com/gsi/ https://alcdn.msauth.net/; style-src 'self' 'unsafe-inline' https://accounts.google.com/gsi/ https://cdn.mongotel.com/connect-extra-css/; font-src 'self' data:; img-src 'self' data: blob: https://*.ns-cluster-prod.click; connect-src 'self' https://login.microsoftonline.com/ https://accounts.google.com https://apis.google.com; media-src 'self' data: blob: https://*.ns-cluster-prod.click; frame-src 'self' https://login.microsoftonline.com/ https://login.live.com/ https://accounts.google.com/ *.prod.us-east-1.mongotel.com; frame-ancestors 'none'; object-src 'none'; base-uri 'self'; form-action 'self'; upgrade-insecure-requests; block-all-mixed-content;

default-src 'self'; script-src 'self' 'unsafe-inline' ; style-src 'self' 'unsafe-inline' ; media-src 'self'; frame-src 'none'; frame-ancestors 'none'

26f9fa42eaf8fb036e838d089da9a2cd5852d9b0fb78538a8458bc7f42952c86

b0c07849686e7264ec87820d69a06e5107cb8ed1fa59e036806d5c7a81871309

26402de51672636d1ee9350b7f7823b19f0f9995f94bc025372df7d992f3fa73

2bd1822a4db3624cfb6efb86cd0b684f46ba4a3f639002ed7a056656aaabc2f3

8f57a2aca8ad3e897d2bd74257a37fcc6902db5e040ce233ac4140827f15c3ec

cbefaf3b99effcb833b143296bd7e6427c65d7ee7b86635986395e2be62ade23

b97ac40b9af4359f027ba6830eb66974a29b4142bb3ea9ab247193e343d4205b

b7a9378ee337db2eef8cf59a519deb4399107d4b6a43f2ad7f817d38db5f7958

9137556c5c879004f8da6791eff459fd03e0b9f40369b42d4b6a39d2f2599359

c6ed98fc4292ea824d88a0bce07bb3fe59d11cc69efada86c6b21cd17646c56b

f39687cbecaa903ca508b42359633cab227a63e5f2b534dd740490ca3c0a891b

8a8b8672feb34b130fe9d94ff75031ba69c14429f1c1f5905d64ca61322c801e

ROBOTS

HSTS header missing - vulnerable to protocol downgrade attacks

CSP header missing - vulnerable to XSS attacks

child-src 'none';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources 'self';trusted-types;frame-ancestors 'none';

child-src https:  chrome-untrusted://new-tab-page/ chrome-untrusted://ntp-microsoft-auth/;connect-src chrome://webui-test chrome://resources chrome://theme 'self';default-src 'self';font-src chrome://resources 'self';img-src chrome://resources chrome://theme chrome://image chrome://favicon2 chrome://app-icon chrome://extension-icon chrome://fileicon blob: data: 'self';media-src blob: data: 'self';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources chrome://webui-test 'self';style-src chrome://resources chrome://theme 'self' 'unsafe-inline';trusted-types parse-html-subset sanitize-inner-html static-types lottie-worker-script-loader webui-test-script webui-test-html polymer-html-literal polymer-template-event-attribute-policy lit-html-desktop;frame-ancestors 'none';

child-src 'none';object-src 'none';require-trusted-types-for 'script';script-src chrome://resources 'self';trusted-types;worker-src blob: 'self';frame-ancestors 'none';

base-uri 'none';child-src https:;form-action https://ogs.google.com https://*.corp.google.com;object-src 'none';script-src 'self' 'unsafe-inline' https:;frame-ancestors chrome://new-tab-page/

GoDaddy.com, LLC

MONGOTEL.COM

MarkMonitor Inc.

MSAUTH.NET

GOOGLE.COM

Amazon Registrar, Inc.

ns-cluster-prod.click

Amazon Web Services, LLC

Amazon

Amazon.com, Inc.

Amazon Web Services

Amazon Webservices EC2

AMAZO-CF


		//window.addEventListener('load', function(){
		if (i18nJSON) _.setTranslation(i18nJSON);//POTENTIAL ERROR: Removed window onload event listener because it was causing problems with validationEngine translations
		//});
		


		var servertime = '2026-08-30 00:43:24';
		


                $('#ssoSeparator').show();

                var officeIdToken = '';

                var msalConfig = {
                    auth: {
                        clientId: 'd5a3c2c0-5cee-4fd5-962f-3ed66ad65065'
                    },
                    cache: {
                        cacheLocation: 'localStorage'
                    }
                };

                var authenticationParameters = {
                    scopes: ["user.read"], // optional Array<string>
                    prompt: "select_account",
                };

                //This maybe needs to be on a page load callback?
                var msalInstance = new Msal.UserAgentApplication(msalConfig);

                $('#officeSigninBtn').click( function() {
                    var thisPath = window.location.pathname;
                    window.history.pushState('portal', 'Login', '/portal/msal.php?c=d5a3c2c0-5cee-4fd5-962f-3ed66ad65065'); // force base path so url can match allowed redirect urls

                    msalInstance.loginPopup(authenticationParameters)
                    .then(response => {
                        msalInstance.acquireTokenSilent(authenticationParameters)
                        .then(response => {
                            window.history.pushState('portal', 'Login', thisPath); // revert path after msal roundtrip

                            officeIdToken = response.accessToken;

                            $('#LoginUsername').val('');
                            $('#LoginPassword').val('');
                            $('#SsoVendor').val('office');
                            $('#SsoIdToken').val(officeIdToken);

                            onSubmit();
                        })
                        .catch(err => {
                            console.log('acquireTokenSilent fresh err',err)
                        });
                    })
                    .catch(err => {
                        console.log('loginPopup err',err)
                    });
                });
            


  //OMP-1256
  //When auto-logged out, prevent redirect to controller if logging back in as a different user
  loginForm = $('.form-stacked');
  loginURL = loginForm.attr('action');

  if (loginURL.indexOf('page=') !== -1) {
    pageURL = loginURL;
    noPageURL = pageURL.replace(/(&?|\?)page=[a-z]*/g, '');
    usernameInput = $('#LoginUsername');
    origUsername = "@";

    usernameInput.on("input", function () {
      newUsername = usernameInput.val();
      if (newUsername != origUsername) {
        loginForm.attr('action', noPageURL);
        //window.history.pushState({},"", noPageURL);
      } else {
        loginForm.attr('action', pageURL);
        //window.history.pushState({},"", pageURL);
      }
    });
  }

  function enableLogin() {
    $('.submit input').removeAttr("disabled");
  }

  function onSubmit() {
    $('form').submit();
  }


Requests	IP Address	Location	AS Autonomous System
3	65.8.131.33Cloudfront · CDN	United States	AS16509Amazon.com, Inc.
3	13.107.246.44Azure · CLOUD	United States	AS8075Microsoft Corporation
3	193.122.165.84Oracle · CLOUD	Ashburn, Virginia, United States	AS31898Oracle Corporation
3	65.8.131.64Cloudfront · CDN	United States	AS16509Amazon.com, Inc.
3	65.8.131.55Cloudfront · CDN	United States	AS16509Amazon.com, Inc.
3	142.251.127.84Google · CDN	United States	AS15169Google LLC
18	6	-	-

Security Scan Report: core1-iad.ns-cluster-prod.click

Summary

AI Security Verdict

High Risk

Risk Factors

Details

Screenshot

Page Load Overview

Language Analysis

Primary Language

Detection Details

Website Classification

Primary Category

All Detected Categories

Detected Features

Domain & IP Information

Page Statistics

Detected Technologies2

Content Similarity HashesFor malware variant detection

TLSH (Trend Micro Locality Sensitive Hash)

ssdeep (Context Triggered Piecewise Hashing)

sdhash (Similarity Digest Hashing)

Image Hashes

Perceptual Hashes

Other Hashes

Scan History