docs.microsoft.com
Open in
urlscan Pro
2a02:26f0:6c00:289::353e
Public Scan
Effective URL: https://docs.microsoft.com/en-us/defender-for-identity/compromised-credentials-alerts
Submission: On June 17 via api from US — Scanned from FR
Summary
TLS certificate: Issued by Microsoft RSA TLS CA 02 on May 9th 2022. Valid for: a year.
This is the only time docs.microsoft.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 104.87.239.185 104.87.239.185 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
2 9 | 2a02:26f0:6c0... 2a02:26f0:6c00:289::353e | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
1 | 2620:1ec:bdf::45 2620:1ec:bdf::45 | 8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 | 2620:1ec:49::45 2620:1ec:49::45 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
9 | 4 |
ASN16625 (AKAMAI-AS, US)
PTR: a104-87-239-185.deploy.static.akamaitechnologies.com
aka.ms |
ASN20940 (AKAMAI-ASN1, NL)
docs.microsoft.com |
ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
wcpstatic.microsoft.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
10 |
microsoft.com
2 redirects
docs.microsoft.com — Cisco Umbrella Rank: 10197 wcpstatic.microsoft.com — Cisco Umbrella Rank: 5341 |
782 KB |
1 |
azure.com
js.monitor.azure.com — Cisco Umbrella Rank: 3813 |
58 KB |
1 |
aka.ms
1 redirects
aka.ms — Cisco Umbrella Rank: 5583 |
571 B |
9 | 3 |
Domain | Requested by | |
---|---|---|
9 | docs.microsoft.com |
2 redirects
docs.microsoft.com
|
1 | js.monitor.azure.com |
docs.microsoft.com
|
1 | wcpstatic.microsoft.com |
docs.microsoft.com
|
1 | aka.ms | 1 redirects |
9 | 4 |
This site contains links to these domains. Also see Links.
Domain |
---|
go.microsoft.com |
www.microsoft.com |
github.com |
attack.mitre.org |
blogs.technet.microsoft.com |
portal.msrc.microsoft.com |
support.microsoft.com |
aka.ms |
Subject Issuer | Validity | Valid | |
---|---|---|---|
docs.microsoft.com Microsoft RSA TLS CA 02 |
2022-05-09 - 2023-05-09 |
a year | crt.sh |
wcpstatic.microsoft.com DigiCert TLS RSA SHA256 2020 CA1 |
2022-03-10 - 2023-03-10 |
a year | crt.sh |
js.monitor.azure.com Microsoft Azure TLS Issuing CA 02 |
2022-03-27 - 2023-03-22 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://docs.microsoft.com/en-us/defender-for-identity/compromised-credentials-alerts
Frame ID: AE10ACD63141D7B3F312E3441E27643C
Requests: 10 HTTP requests in this frame
Screenshot
Page Title
Microsoft Defender for Identity compromised credentials phase security alerts | Microsoft DocsPage URL History Show full URLs
-
https://aka.ms/atasaguide-authfail
HTTP 301
https://docs.microsoft.com/en-us/azure-advanced-threat-protection/atp-compromised-credentials-alerts HTTP 301
https://docs.microsoft.com/en-us/defender-for-identity/atp-compromised-credentials-alerts HTTP 301
https://docs.microsoft.com/en-us/defender-for-identity/compromised-credentials-alerts Page URL
Page Statistics
32 Outgoing links
These are links going to different origins than the main page.
Title: Download Microsoft Edge
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: Credential Access (TA0006)
Search URL Search Domain Scan URL
Title: Access Token Manipulation (T1134)
Search URL Search Domain Scan URL
Title: Exploitation for Privilege Escalation (T1068)
Search URL Search Domain Scan URL
Title: Steal or Forge Kerberos Tickets (T1558)
Search URL Search Domain Scan URL
Title: Token Impersonation/Theft (T1134.001)
Search URL Search Domain Scan URL
Title: Discovery
Search URL Search Domain Scan URL
Title: Account Discovery (T1087)
Search URL Search Domain Scan URL
Title: Domain Account (T1087.002)
Search URL Search Domain Scan URL
Title: Brute Force (T1110)
Search URL Search Domain Scan URL
Title: Password Guessing (T1110.001)
Search URL Search Domain Scan URL
Title: Password Spraying (T1110.003)
Search URL Search Domain Scan URL
Title: Lateral Movement (TA0008)
Search URL Search Domain Scan URL
Title: Disable SMBv1
Search URL Search Domain Scan URL
Title: Steal or Forge Kerberos Tickets (T1558)
Search URL Search Domain Scan URL
Title: Kerberoasting (T1558.003)
Search URL Search Domain Scan URL
Title: CVE-2020-1472
Search URL Search Domain Scan URL
Title: Privilege Escalation (TA0004)
Search URL Search Domain Scan URL
Title: our guidance
Search URL Search Domain Scan URL
Title: AS-REP Roasting (T1558.004)
Search URL Search Domain Scan URL
Title: Exploitation of Remote Services (T1210)
Search URL Search Domain Scan URL
Title: Remove WannaCry
Search URL Search Domain Scan URL
Title: WannaCry Ransomware
Search URL Search Domain Scan URL
Title: Defense Evasion (TA0005)
Search URL Search Domain Scan URL
Title: Persistence (TA0003)
Search URL Search Domain Scan URL
Title: External Remote Services (T1133)
Search URL Search Domain Scan URL
Title: Check out the Defender for Identity forum!
Search URL Search Domain Scan URL
Title: View all page feedback
Search URL Search Domain Scan URL
Title: Privacy & Cookies
Search URL Search Domain Scan URL
Title: Trademarks
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://aka.ms/atasaguide-authfail
HTTP 301
https://docs.microsoft.com/en-us/azure-advanced-threat-protection/atp-compromised-credentials-alerts HTTP 301
https://docs.microsoft.com/en-us/defender-for-identity/atp-compromised-credentials-alerts HTTP 301
https://docs.microsoft.com/en-us/defender-for-identity/compromised-credentials-alerts Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
9 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
compromised-credentials-alerts
docs.microsoft.com/en-us/defender-for-identity/ Redirect Chain
|
81 KB 21 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
be4a8746.site-ltr.css
docs.microsoft.com/_themes/docs.theme/master/en-us/_themes/styles/ |
479 KB 68 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wcp-consent.js
wcpstatic.microsoft.com/mscc/lib/v2/ |
273 KB 80 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ms.jsll-3.min.js
js.monitor.azure.com/scripts/c/ |
179 KB 58 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
67a45209.deprecation.js
docs.microsoft.com/_themes/docs.theme/master/en-us/_themes/global/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
e4517ff6.index-docs.js
docs.microsoft.com/_themes/docs.theme/master/en-us/_themes/scripts/ |
2 MB 452 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
docons.1cd52822.woff2
docs.microsoft.com/_themes/docs.theme/master/en-us/_themes/styles/ |
13 KB 14 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
SegoeUI-Roman-VF_web.woff2
docs.microsoft.com/static/third-party/SegoeUIWeb/1.01.206/ |
116 KB 116 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
193 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
latest.woff2
docs.microsoft.com/static/third-party/SegoeUI/5.32/west-european/italic/ |
27 KB 28 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
16 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails object| navigation object| msDocs function| WcpConsent function| mscc object| e function| t object| oneDS object| awa function| applyFocusVisiblePolyfill object| litHtmlVersions3 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
docs.microsoft.com/en-us/defender-for-identity | Name: original_req_url Value: https://docs.microsoft.com/en-us/defender-for-identity/atp-compromised-credentials-alerts |
|
.docs.microsoft.com/ | Name: ARRAffinity Value: e45921bc9b8fe577c04829290d10e061bbbfa7a6f7edc37466eb189c52a3d061 |
|
.docs.microsoft.com/ | Name: ARRAffinitySameSite Value: e45921bc9b8fe577c04829290d10e061bbbfa7a6f7edc37466eb189c52a3d061 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000; includeSubDomains; preload |
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
aka.ms
docs.microsoft.com
js.monitor.azure.com
wcpstatic.microsoft.com
104.87.239.185
2620:1ec:49::45
2620:1ec:bdf::45
2a02:26f0:6c00:289::353e
2fb59b19860d20c40569c44f5cca62c7d101017ac2509997ed0c6f96ced1164c
505d3664b4318563b0e7e5096e930a98debdad10c637be2df5fea2f005e8ca10
5cba58fd84cc012dcfe3f37e4afc337cce639518309eded0b18ae9e39f879ca4
63c12051016796d92bcf4bc20b4881057475e6dfa4937c29c9e16054814ab47d
768304ececf64109acb1144a4a5fb1ea56ccadf675c60b65956dfad07a8d5ceb
8bd4e928a7d7335db3fe8bd9dcae8fdf1d178afb8616786d073454f109e9347f
8ca1ede57db61bfb38d7eb52fa4ca63d6399af78edd5e24318a47953c9a1f02d
da862f7ce2b326256d25a7e03626142cb544c2061613ab36dc1ac7fe60c1f8b2
e172a02b68f977a57a1690507df809db1e43130f0161961709a36dbd70b4d25f
f8ae8a1dc7ce7877b9fb9299183d2ebb3befad0b6489ae785d99047ec2eb92d1