onedrive.live.com Open in urlscan Pro
13.107.42.13 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://onedrive.live.com/embed?cid=2739D85632D20637&resid=2739D85632D20637%21170&authkey=AO8mJO8H4E-Cr4E&em=2
Submission: On March 31 via manual (March 31st 2020, 1:55:02 pm UTC) from US

Summary HTTP 50 Redirects Behaviour Indicators

Summary

This website contacted 11 IPs in 4 countries across 7 domains to perform 50 HTTP transactions. The main IP is 13.107.42.13, located in United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is onedrive.live.com.
TLS certificate: Issued by Microsoft IT TLS CA 2 on June 25th 2019. Valid for: 2 years.

This is the only time onedrive.live.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
3	13.107.42.13 13.107.42.13	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
8	23.55.161.136 23.55.161.136	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
18	2620:1ec:a92:... 2620:1ec:a92::171	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2a02:26f0:170... 2a02:26f0:1700:1aa::356e	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
8	2a02:26f0:170... 2a02:26f0:1700:19d::1c24	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
6	2a02:26f0:170... 2a02:26f0:1700:184::1c24	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a02:26f0:170... 2a02:26f0:1700:193::2b57	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 2	52.142.114.2 52.142.114.2	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 1	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	104.109.78.246 104.109.78.246	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	52.114.74.44 52.114.74.44	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
50	11

3 13.107.42.13 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

onedrive.live.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 23.55.161.136 (United States)

ASN20940 (AKAMAI-ASN1, US)
PTR: a23-55-161-136.deploy.static.akamaitechnologies.com

spoprod-a.akamaihd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 2620:1ec:a92::171 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

word-view.officeapps.live.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:1700:1aa::356e (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

c.s-microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a02:26f0:1700:19d::1c24 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

c1-word-view-15.cdn.office.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a02:26f0:1700:184::1c24 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

c1-officeapps-15.cdn.office.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:1700:193::2b57 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

uhf.microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.142.114.2 (Dublin, Ireland) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

c.live.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:c11::200 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

c.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.109.78.246 (Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a104-109-78-246.deploy.static.akamaitechnologies.com

js.live.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.114.74.44 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

browser.pipe.aria.microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
23	live.com 1 redirects onedrive.live.com word-view.officeapps.live.com c.live.com	301 KB
14	office.net c1-word-view-15.cdn.office.net c1-officeapps-15.cdn.office.net	546 KB
8	akamaihd.net spoprod-a.akamaihd.net	395 KB
3	microsoft.com uhf.microsoft.com browser.pipe.aria.microsoft.com	875 B
2	s-microsoft.com c.s-microsoft.com	3 KB
1	live.net js.live.net	16 KB
1	bing.com 1 redirects c.bing.com	723 B
50	7

	Domain	Requested by
18	word-view.officeapps.live.com	onedrive.live.com word-view.officeapps.live.com c1-word-view-15.cdn.office.net c1-officeapps-15.cdn.office.net
8	c1-word-view-15.cdn.office.net	word-view.officeapps.live.com c1-word-view-15.cdn.office.net
8	spoprod-a.akamaihd.net	onedrive.live.com
6	c1-officeapps-15.cdn.office.net	word-view.officeapps.live.com c1-word-view-15.cdn.office.net
3	onedrive.live.com	onedrive.live.com
2	browser.pipe.aria.microsoft.com	c1-word-view-15.cdn.office.net
2	c.live.com	1 redirects
2	c.s-microsoft.com	word-view.officeapps.live.com
1	js.live.net	c1-word-view-15.cdn.office.net
1	c.bing.com	1 redirects
1	uhf.microsoft.com	word-view.officeapps.live.com
50	11

This site contains no links.

Subject Issuer	Validity	Valid
onedrive.com Microsoft IT TLS CA 2	`2019-06-25` - `2021-06-25`	2 years	crt.sh
a248.e.akamai.net DigiCert Secure Site ECC CA-1	`2019-08-13` - `2020-08-12`	a year	crt.sh
officeapps.live.com Microsoft IT TLS CA 1	`2020-02-18` - `2022-02-18`	2 years	crt.sh
www.microsoft.com Microsoft IT TLS CA 5	`2019-10-21` - `2021-10-21`	2 years	crt.sh
*.cdn.office.net Microsoft IT TLS CA 1	`2019-10-31` - `2021-10-31`	2 years	crt.sh
unistore.www.microsoft.com Microsoft IT TLS CA 5	`2019-04-30` - `2021-04-30`	2 years	crt.sh
c.msn.com Microsoft IT TLS CA 4	`2020-02-10` - `2022-02-10`	2 years	crt.sh
p.sfx.ms Microsoft IT TLS CA 2	`2020-02-04` - `2022-02-04`	2 years	crt.sh
*.events.data.microsoft.com Microsoft IT TLS CA 4	`2019-10-10` - `2021-10-10`	2 years	crt.sh

This page contains 2 frames:

Primary Page: https://onedrive.live.com/embed?cid=2739D85632D20637&resid=2739D85632D20637%21170&authkey=AO8mJO8H4E-Cr4E&em=2
Frame ID: 94F1A5C40548B6EA1B5E81D24EFD586A
Requests: 13 HTTP requests in this frame

Frame: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=p4VmQpA1O0+JgBBX6AtNdw.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2F2739D85632D20637%21170&sc=host%3D%26qt%3DFolders%26pt%3Dem
Frame ID: E135B8CC7C68D9117CF7E55ED050AB69
Requests: 40 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

50
Requests

100 %
HTTPS

55 %
IPv6

7
Domains

11
Subdomains

11
IPs

4
Countries

1296 kB
Transfer

4069 kB
Size

8
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 33

https://c.live.com/c.gif?DI=15347&wlxid=5eb76443-fad5-44db-a645-60b65cd5bbfd&reqid=001826e6a7b&csiperf=ANON%3D%26NL%3D0%26TP%3D0%26CL%3DRD00155D0320A6%26MA%3Den-US%26B%3D0.0.0%26TR%3DNA%252ANA%252A%253ASDX.Skydrive%252AEmbed.default.F.U.%26PLT%3D2100%26IR%3D1%26EX%3D0%26L.h%3D1061%26L.sjs%3D1238%26L.ttg%3D1061%26C.st%3D1585662882773%26N.domIn%3D1070%26N.dns%3D2%26N.tcp%3D31%26N.req%3D966%26N.resp%3D12%26N.navType%3D0%26N.redirectCount%3D0&r=0.47801105254822684 HTTP 302
https://c.bing.com/c.gif?DI=15347&wlxid=5eb76443-fad5-44db-a645-60b65cd5bbfd&reqid=001826e6a7b&csiperf=ANON%3D%26NL%3D0%26TP%3D0%26CL%3DRD00155D0320A6%26MA%3Den-US%26B%3D0.0.0%26TR%3DNA%252ANA%252A%253ASDX.Skydrive%252AEmbed.default.F.U.%26PLT%3D2100%26IR%3D1%26EX%3D0%26L.h%3D1061%26L.sjs%3D1238%26L.ttg%3D1061%26C.st%3D1585662882773%26N.domIn%3D1070%26N.dns%3D2%26N.tcp%3D31%26N.req%3D966%26N.resp%3D12%26N.navType%3D0%26N.redirectCount%3D0&r=0.47801105254822684&CtsSyncId=9DFF9D7686F342E6BCF0C0ABC0BE64B0&RedC=c.live.com&MXFR=2D7A99FE52A36F4B0C04976056A36B0B HTTP 302
https://c.live.com/c.gif?DI=15347&wlxid=5eb76443-fad5-44db-a645-60b65cd5bbfd&reqid=001826e6a7b&csiperf=ANON%3D%26NL%3D0%26TP%3D0%26CL%3DRD00155D0320A6%26MA%3Den-US%26B%3D0.0.0%26TR%3DNA%252ANA%252A%253ASDX.Skydrive%252AEmbed.default.F.U.%26PLT%3D2100%26IR%3D1%26EX%3D0%26L.h%3D1061%26L.sjs%3D1238%26L.ttg%3D1061%26C.st%3D1585662882773%26N.domIn%3D1070%26N.dns%3D2%26N.tcp%3D31%26N.req%3D966%26N.resp%3D12%26N.navType%3D0%26N.redirectCount%3D0&r=0.47801105254822684&CtsSyncId=9DFF9D7686F342E6BCF0C0ABC0BE64B0&MUID=2AA7BD47DFD767DD2B87B3D9DE62668E

50 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request embed Show response
onedrive.live.com/ 60 KB
21 KB 988ms
954ms Document
text/html 13.107.42.13
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://onedrive.live.com/embed?cid=2739D85632D20637&resid=2739D85632D20637%21170&authkey=AO8mJO8H4E-Cr4E&em=2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

13.107.42.13 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

dbc2fc64931a50273f8bb4aedbb315863756745b2b49ccfd0935aa8fa5a078fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

:method: GET
:authority: onedrive.live.com
:scheme: https
:path: /embed?cid=2739D85632D20637&resid=2739D85632D20637%21170&authkey=AO8mJO8H4E-Cr4E&em=2
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: document
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document

Response headers

status: 200
cache-control: no-cache, no-store
pragma: no-cache
content-type: text/html; charset=utf-8
content-encoding: gzip
expires: -1
vary: Accept-Encoding
set-cookie: E=P:6hpfEHvV14g=:ga1g4qgq/zQiFd2nNHINTw8uFGuuIq7Aqs99DEGBND8=:F; domain=.live.com; path=/ xid=5eb76443-fad5-44db-a645-60b65cd5bbfd&&RD00155D0320A6&127; domain=.live.com; path=/ xidseq=1; domain=.live.com; path=/ LD=; domain=.live.com; expires=Tue, 31-Mar-2020 12:14:42 GMT; path=/ wla42=; domain=live.com; expires=Tue, 07-Apr-2020 13:54:43 GMT; path=/
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
x-msnserver: RD00155D0320A6
x-odwebserver: canadacentral0-odwebpl
x-msedge-ref: Ref A: DEB5C7CD057F40488D3DBA2CB29F2A66 Ref B: ZRHEDGE0514 Ref C: 2020-03-31T13:54:42Z
date: Tue, 31 Mar 2020 13:54:42 GMT

GET
H2 200 filescss1-11eb1969.css
spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001// 85 KB
16 KB 37ms
36ms Stylesheet
text/css 23.55.161.136
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001//filescss1-11eb1969.css
Requested by: Host: onedrive.live.com
URL: https://onedrive.live.com/embed?cid=2739D85632D20637&resid=2739D85632D20637%21170&authkey=AO8mJO8H4E-Cr4E&em=2
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 23.55.161.136 , United States, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a23-55-161-136.deploy.static.akamaitechnologies.com
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: bd88d1e741693ab877b020059b46be7cf4ef62b46017b2489a8cd1bf9ce5b9fc

Request headers

Referer: https://onedrive.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 31 Mar 2020 13:54:43 GMT
content-encoding: gzip
content-md5: EesZadmsnx78d9ZWIKfswQ==
status: 200
content-length: 15784
x-ms-lease-status: unlocked
last-modified: Mon, 14 May 2018 21:54:14 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D5B9E53BE6E430
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: da050427-701e-0036-2c96-fbb080000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=29999239
x-ms-version: 2009-09-19
timing-allow-origin: *

GET
H2 200 filescss2-a303a402.css
spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001// 169 KB
30 KB 37ms
37ms Stylesheet
text/css 23.55.161.136
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001//filescss2-a303a402.css
Requested by: Host: onedrive.live.com
URL: https://onedrive.live.com/embed?cid=2739D85632D20637&resid=2739D85632D20637%21170&authkey=AO8mJO8H4E-Cr4E&em=2
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 23.55.161.136 , United States, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a23-55-161-136.deploy.static.akamaitechnologies.com
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 1394b1c43663fa167060186091800d4cae0696af7b64c14f2848b44124074c7e

Request headers

Referer: https://onedrive.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 31 Mar 2020 13:54:43 GMT
content-encoding: gzip
content-md5: owOkAskXvYo3Ps40fhU7TQ==
status: 200
content-length: 30548
x-ms-lease-status: unlocked
last-modified: Mon, 14 May 2018 21:54:15 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D5B9E53C3A1C6F
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 9eaec477-701e-00b5-1896-fb102d000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=29999239
x-ms-version: 2009-09-19
timing-allow-origin: *

GET
H2 200 wlx_fonts-c7993ded.css
spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001// 123 KB
93 KB 43ms
42ms Stylesheet
text/css 23.55.161.136
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001//wlx_fonts-c7993ded.css
Requested by: Host: onedrive.live.com
URL: https://onedrive.live.com/embed?cid=2739D85632D20637&resid=2739D85632D20637%21170&authkey=AO8mJO8H4E-Cr4E&em=2
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 23.55.161.136 , United States, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a23-55-161-136.deploy.static.akamaitechnologies.com
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 455be57e5ca76be462428c7b127d03d0245952b7e00ca14e8bcb3bfe7584c758

Request headers

Referer: https://onedrive.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 31 Mar 2020 13:54:43 GMT
content-encoding: gzip
content-md5: x5k97ZNOTA+fsPCUPRp4Qw==
status: 200
content-length: 94644
x-ms-lease-status: unlocked
last-modified: Mon, 14 May 2018 21:54:23 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D5B9E5410A12E4
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: c2d76c61-f01e-0068-5fd2-fb4383000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=30024992
x-ms-version: 2009-09-19
timing-allow-origin: *

POST
H2 200 wordviewerframe.aspx Show response
word-view.officeapps.live.com/wv/ Frame E135 89 KB
91 KB 363ms
361ms Document
text/html 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=p4VmQpA1O0+JgBBX6AtNdw.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2F2739D85632D20637%21170&sc=host%3D%26qt%3DFolders%26pt%3Dem

Requested by

Host: onedrive.live.com
URL: https://onedrive.live.com/embed?cid=2739D85632D20637&resid=2739D85632D20637%21170&authkey=AO8mJO8H4E-Cr4E&em=2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

eb9d3e2d65ecf668ac450344775045611533883d46fe9eeb7e33b7dc1058bf24

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

:method: POST
:authority: word-view.officeapps.live.com
:scheme: https
:path: /wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=p4VmQpA1O0+JgBBX6AtNdw.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2F2739D85632D20637%21170&sc=host%3D%26qt%3DFolders%26pt%3Dem
content-length: 231
pragma: no-cache
cache-control: no-cache
origin: https://onedrive.live.com
upgrade-insecure-requests: 1
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
referer: https://onedrive.live.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: E=P:6hpfEHvV14g=:ga1g4qgq/zQiFd2nNHINTw8uFGuuIq7Aqs99DEGBND8=:F; xid=5eb76443-fad5-44db-a645-60b65cd5bbfd&&RD00155D0320A6&127; xidseq=1; wla42=
Origin: https://onedrive.live.com
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://onedrive.live.com/

Response headers

status: 200
cache-control: no-cache, no-store
pragma: no-cache
content-type: text/html; charset=utf-8
expires: -1
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
set-cookie: DcLcid=ui=1033&data=1033; expires=Tue, 30-Jun-2020 13:54:44 GMT; path=/; samesite=none; secure; HttpOnly BIGipCookie=000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000; path=/; samesite=none; secure
x-correlationid: f646b254-c0ab-43b3-9d69-665d0cdbf4c3
x-usersessionid: f646b254-c0ab-43b3-9d69-665d0cdbf4c3
strict-transport-security: max-age=31536000
timing-allow-origin: *
origin-trial: Ah7bununCmo22ZxYQz9dBtHY4IRjg+KB847dDtuet18i8kuf3RvELsQ/X0/lwWCDCzDTuRSVKyx3iW6GSPPDsQcAAAB7eyJvcmlnaW4iOiJodHRwczovL29mZmljZWFwcHMubGl2ZS5jb206NDQzIiwiZmVhdHVyZSI6IkFsbG93U3luY1hIUkluUGFnZURpc21pc3NhbCIsImV4cGlyeSI6MTU4NjEwNTA0OCwiaXNTdWJkb21haW4iOnRydWV9
x-ccr: true
x-officefe: BL6PEPF00003432
x-officeversion: 16.0.12728.35950
x-officecluster: US6
x-content-type-options: nosniff
content-security-policy-report-only: font-src data: c1-word-view-15.cdn.office.net *.skype.com *.skypeassets.com *.msocdn.com sway.com *.sway-cdn.com sway-cdn.com *.sharepointonline.com https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' c1-word-view-15.cdn.office.net uci.officeapps.live.com c1-officeapps-15.cdn.office.net *.skype.com *.skypeassets.com *.msocdn.com js.live.net appsforoffice.microsoft.com contentstorage.osi.office.net content.lifecycle.office.net www.microsoft.com c.s-microsoft.com https:; style-src 'self' 'unsafe-inline' 'unsafe-eval' c1-word-view-15.cdn.office.net c1-officeapps-15.cdn.office.net *.skype.com *.skypeassets.com *.msocdn.com js.live.net sway.com *.sway-cdn.com sway-cdn.com c.s-microsoft.com https:; media-src *.skype.com *.skypeassets.com https:; object-src 'self' https:; child-src * https:; img-src * data: blob: https:; report-uri /wv/reportcsp.ashx
x-officefd: BL6PEPF000028A4
x-msedge-ref: Ref A: 34F535A109F84B83A6BEE81888DDD513 Ref B: AMS04EDGE0811 Ref C: 2020-03-31T13:54:43Z
x-msedge-flight: muidflt180=afd_waccluster,qx9=tasmigration015,skb=typeheadertest
x-msedge-features: afd_waccluster,tasmigration015,typeheadertest
date: Tue, 31 Mar 2020 13:54:43 GMT

GET
H2 200 jquery-1.7.2-39eeb07e.js Show response
spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001/ 92 KB
33 KB 37ms
37ms Script
application/javascript 23.55.161.136
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001/jquery-1.7.2-39eeb07e.js
Requested by: Host: onedrive.live.com
URL: https://onedrive.live.com/embed?cid=2739D85632D20637&resid=2739D85632D20637%21170&authkey=AO8mJO8H4E-Cr4E&em=2
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 23.55.161.136 , United States, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a23-55-161-136.deploy.static.akamaitechnologies.com
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: d6c15974b6181a68e9b74e4f38fbac81d640569ef0fbbaa3381cc59683a9763f

Request headers

Referer: https://onedrive.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 31 Mar 2020 13:54:43 GMT
content-encoding: gzip
content-md5: Oe6wfmgC4rV/XhCprZvKJA==
status: 200
content-length: 33335
x-ms-lease-status: unlocked
last-modified: Mon, 14 May 2018 21:54:17 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D5B9E53DB4CCFD
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: da0507c0-701e-0036-0496-fbb080000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=29999240
x-ms-version: 2009-09-19
timing-allow-origin: *

GET
H2 200 embed_s_embed-212fe29f.js Show response
spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001/ 483 KB
133 KB 39ms
39ms Script
application/javascript 23.55.161.136
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001/embed_s_embed-212fe29f.js
Requested by: Host: onedrive.live.com
URL: https://onedrive.live.com/embed?cid=2739D85632D20637&resid=2739D85632D20637%21170&authkey=AO8mJO8H4E-Cr4E&em=2
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 23.55.161.136 , United States, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a23-55-161-136.deploy.static.akamaitechnologies.com
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 5c15c38a2b7554cab332dfb9e87398220fcb9a285e18905a20a50b439cba7ccb

Request headers

Referer: https://onedrive.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 31 Mar 2020 13:54:43 GMT
content-encoding: gzip
content-md5: IS/in/g30QB+g7MVI79lXQ==
status: 200
content-length: 135707
x-ms-lease-status: unlocked
last-modified: Mon, 14 May 2018 21:54:01 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D5B9E533D8DD7F
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: da050859-701e-0036-1496-fbb080000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=29999241
x-ms-version: 2009-09-19
timing-allow-origin: *

GET
H2 200 embed1-0986a9b4.js Show response
spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001/ 47 KB
14 KB 37ms
36ms Script
application/javascript 23.55.161.136
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001/embed1-0986a9b4.js
Requested by: Host: onedrive.live.com
URL: https://onedrive.live.com/embed?cid=2739D85632D20637&resid=2739D85632D20637%21170&authkey=AO8mJO8H4E-Cr4E&em=2
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 23.55.161.136 , United States, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a23-55-161-136.deploy.static.akamaitechnologies.com
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: b7ab99f404e84cb71d274c9dca01c0b4a68b7adb20309c5f04387cb809cc0547

Request headers

Referer: https://onedrive.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 31 Mar 2020 13:54:43 GMT
content-encoding: gzip
content-md5: CYaptDz18cVXSIKt0vWKWA==
status: 200
content-length: 14119
x-ms-lease-status: unlocked
last-modified: Mon, 14 May 2018 21:54:00 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D5B9E5332E9B80
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: da051037-701e-0036-3596-fbb080000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=29999244
x-ms-version: 2009-09-19
timing-allow-origin: *

GET
H2 200 embed2-8c600200.js Show response
spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001/ 203 KB
68 KB 41ms
40ms Script
application/javascript 23.55.161.136
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001/embed2-8c600200.js
Requested by: Host: onedrive.live.com
URL: https://onedrive.live.com/embed?cid=2739D85632D20637&resid=2739D85632D20637%21170&authkey=AO8mJO8H4E-Cr4E&em=2
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 23.55.161.136 , United States, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a23-55-161-136.deploy.static.akamaitechnologies.com
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 4d54a5f9a58647882e3ecda9c1c0ef87af16911d42ad51b4e8b718f84443c553

Request headers

Referer: https://onedrive.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 31 Mar 2020 13:54:43 GMT
content-encoding: gzip
content-md5: jGACACXYYkvx7qKc5FskXg==
status: 200
content-length: 69276
x-ms-lease-status: unlocked
last-modified: Mon, 14 May 2018 21:54:00 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D5B9E5337DDB83
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: da051056-701e-0036-4e96-fbb080000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=29999244
x-ms-version: 2009-09-19
timing-allow-origin: *

GET
H2 200 embed0-54f3ec81.js Show response
spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001/ 15 KB
6 KB 48ms
48ms Script
application/javascript 23.55.161.136
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001/embed0-54f3ec81.js
Requested by: Host: onedrive.live.com
URL: https://onedrive.live.com/embed?cid=2739D85632D20637&resid=2739D85632D20637%21170&authkey=AO8mJO8H4E-Cr4E&em=2
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 23.55.161.136 , United States, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a23-55-161-136.deploy.static.akamaitechnologies.com
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: c0153afba2ee2258329d951763cc14531c98cdecfc22d55be2597cfad0cc6e54

Request headers

Referer: https://onedrive.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 31 Mar 2020 13:54:43 GMT
content-encoding: gzip
content-md5: VPPsgWGZk5RDzVgXZtU7Yg==
status: 200
content-length: 6057
x-ms-lease-status: unlocked
last-modified: Mon, 14 May 2018 21:53:59 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D5B9E532CDCC12
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: da0510b7-701e-0036-1496-fbb080000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=29999244
x-ms-version: 2009-09-19
timing-allow-origin: *

GET
H2 200 mscc-0.4.2.min.css
c.s-microsoft.com/mscc/statics/ Frame E135 1 KB
934 B 8ms
7ms Stylesheet
text/css 2a02:26f0:1700:1aa::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.s-microsoft.com/mscc/statics/mscc-0.4.2.min.css
Requested by: Host: word-view.officeapps.live.com
URL: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=p4VmQpA1O0+JgBBX6AtNdw.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2F2739D85632D20637%21170&sc=host%3D%26qt%3DFolders%26pt%3Dem
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:1700:1aa::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: 66c5d9882a954332c4aebef2386c7713a226fa617ddcd08d22f24e53ba5ec066

Request headers

Referer: https://word-view.officeapps.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
date: Tue, 31 Mar 2020 13:54:44 GMT
content-encoding: gzip
last-modified: Fri, 10 Jan 2020 15:56:23 GMT
content-md5: QLyM0qNPDXd6ayzd1iIoLA==
access-control-allow-origin: *
etag: 0x8D795E5A424E059
vary: Accept-Encoding
access-control-allow-methods: GET,POST
content-type: text/css;charset=utf-8
status: 200
x-ms-request-id: ec0d0b24-501e-008d-4efc-c75f3e000000
x-ms-version: 2009-09-19
content-length: 626

GET
H/1.1 200
OK WordViewer.css
c1-word-view-15.cdn.office.net/wv/s/161272835950_resources/1033/ Frame E135 216 KB
27 KB 27ms
8ms Stylesheet
text/css 2a02:26f0:1700:19d::1c24
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://c1-word-view-15.cdn.office.net/wv/s/161272835950_resources/1033/WordViewer.css

Requested by

Host: word-view.officeapps.live.com
URL: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=p4VmQpA1O0+JgBBX6AtNdw.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2F2739D85632D20637%21170&sc=host%3D%26qt%3DFolders%26pt%3Dem

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:19d::1c24 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

8d518e1a1c70ae6c3bd8892a086e0d172c1b37dd729b0dd0d6952f7710204677

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://word-view.officeapps.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

X-CorrelationId: f242834a-e69f-4fb1-91db-eeb0a7aabc8c
Strict-Transport-Security: max-age=31536000
Content-Encoding: br
X-OFFICEFD: DB5PEPF00003824
X-OfficeVersion: 16.0.12723.32652
X-OfficeFE: DB5PEPF0000226E
P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
Date: Tue, 31 Mar 2020 13:54:44 GMT
Connection: keep-alive
X-MSEdge-Flight: muidflt180=afd_waccluster,qx9=tasmigration015,skb=typeheadertest
Content-Length: 26165
Accept-Ranges: bytes
X-MSEdge-Features: afd_waccluster,tasmigration015,typeheadertest
Last-Modified: Sun, 29 Mar 2020 00:07:46 GMT
X-OfficeCluster: IE3
X-CCR: true
X-UserSessionId: f242834a-e69f-4fb1-91db-eeb0a7aabc8c
ETag: W/"eda49c135e5d61:0"
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: public,max-age=31536000
X-MSEdge-Ref: Ref A: 8E4723F6705841978D790B37034F89D3 Ref B: AMS04EDGE0820 Ref C: 2020-03-29T00:07:46Z
Timing-Allow-Origin: *

GET
H/1.1 200
OK MicrosoftAjax.js Show response
c1-officeapps-15.cdn.office.net/wv/s/161272835950_App_Scripts/ Frame E135 105 KB
24 KB 10ms
9ms Script
application/javascript 2a02:26f0:1700:184::1c24
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://c1-officeapps-15.cdn.office.net/wv/s/161272835950_App_Scripts/MicrosoftAjax.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:184::1c24 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

85115acdc1b70c4a47daa1da31011b67bde417cbb718c5b3c73a914b82781bfd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://word-view.officeapps.live.com/
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

X-CorrelationId: 8a5a5760-29b8-494e-bdd3-02ac0078d9c5
Strict-Transport-Security: max-age=31536000
Content-Encoding: br
X-OFFICEFD: DB5PEPF00001DF6
X-OfficeVersion: 16.0.12723.32652
X-OfficeFE: DB5PEPF000029AA
P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
Date: Tue, 31 Mar 2020 13:54:44 GMT
Connection: keep-alive
X-MSEdge-Flight: muidflt180=afd_waccluster_control,qx9=tasmigration015,skb=typeheadertest
Content-Length: 23506
X-MSEdge-Features: afd_waccluster_control,tasmigration015,typeheadertest
Last-Modified: Sun, 29 Mar 2020 00:01:33 GMT
X-OfficeCluster: IE3
X-MSEdge-Ref: Ref A: 6073E7C28B9B42578353B9E79F35776F Ref B: AM3EDGE0420 Ref C: 2020-03-29T00:01:33Z
X-UserSessionId: 8a5a5760-29b8-494e-bdd3-02ac0078d9c5
ETag: W/"86740355d5d61:0"
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: public,max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *

GET
H2 200 mscc-0.4.2.min.js Show response
c.s-microsoft.com/mscc/statics/ Frame E135 4 KB
2 KB 8ms
7ms Script
text/javascript 2a02:26f0:1700:1aa::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.s-microsoft.com/mscc/statics/mscc-0.4.2.min.js
Requested by: Host: word-view.officeapps.live.com
URL: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=p4VmQpA1O0+JgBBX6AtNdw.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2F2739D85632D20637%21170&sc=host%3D%26qt%3DFolders%26pt%3Dem
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:1700:1aa::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: a188e6c4c6729c3abbe6a34e45b5c3d7d65ffc659e1baa46632ffb1c876e815c

Request headers

Referer: https://word-view.officeapps.live.com/
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
date: Tue, 31 Mar 2020 13:54:44 GMT
content-encoding: gzip
last-modified: Fri, 10 Jan 2020 15:56:14 GMT
content-md5: AO6kLOW8s6NiicKEPl74tA==
access-control-allow-origin: *
etag: 0x8D795E59EC908A0
vary: Accept-Encoding
access-control-allow-methods: GET,POST
content-type: text/javascript;charset=utf-8
status: 200
x-ms-request-id: 9c049462-901e-00b9-53fc-c7f096000000
x-ms-version: 2009-09-19
content-length: 2017

GET
H/1.1 200
OK cookiecompliance.js Show response
c1-officeapps-15.cdn.office.net/wv/s/161272835950_App_Scripts/ Frame E135 9 KB
3 KB 9ms
7ms Script
application/javascript 2a02:26f0:1700:184::1c24
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://c1-officeapps-15.cdn.office.net/wv/s/161272835950_App_Scripts/cookiecompliance.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:184::1c24 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

910f1f3ce687cfde1a12415fe73a4465e7a2f851177c33ca8e9f3b5c5f93c41c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://word-view.officeapps.live.com/
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

X-CorrelationId: 77fe9ea7-a03b-451f-b740-2c767366bb65
Strict-Transport-Security: max-age=31536000
Content-Encoding: br
X-OFFICEFD: DB5PEPF0000059F
X-OfficeVersion: 16.0.12723.32652
X-OfficeFE: DB5PEPF00003547
P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
Date: Tue, 31 Mar 2020 13:54:44 GMT
Connection: keep-alive
X-MSEdge-Flight: muidflt180=afd_waccluster_control,qx9=tasmigration015,skb=typeheadertest
Content-Length: 1704
Accept-Ranges: bytes
X-MSEdge-Features: afd_waccluster_control,tasmigration015,typeheadertest
Last-Modified: Sun, 29 Mar 2020 00:05:28 GMT
X-OfficeCluster: IE3
X-CCR: true
X-UserSessionId: 77fe9ea7-a03b-451f-b740-2c767366bb65
ETag: W/"935becc05d5d61:0"
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: public,max-age=31536000
X-MSEdge-Ref: Ref A: 2C0BDF62D1304DBBBED9CC2B7C6323AE Ref B: AMS04EDGE0717 Ref C: 2020-03-29T00:05:28Z
Timing-Allow-Origin: *

GET
H/1.1 200
OK CommonIntl.js Show response
c1-officeapps-15.cdn.office.net/wv/s/161272835950_App_Scripts/1033/ Frame E135 77 KB
20 KB 9ms
8ms Script
application/javascript 2a02:26f0:1700:184::1c24
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://c1-officeapps-15.cdn.office.net/wv/s/161272835950_App_Scripts/1033/CommonIntl.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:184::1c24 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

900b6b85fec98a690c0061c93ec99f13bed5f960580ad13ddcca4198089085b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://word-view.officeapps.live.com/
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

X-CorrelationId: 780fb49e-f144-4ba7-b903-05b0c5ed4d60
Strict-Transport-Security: max-age=31536000
Content-Encoding: br
X-OFFICEFD: DB5PEPF000005B5
X-OfficeVersion: 16.0.12728.35950
X-OfficeFE: DB5PEPF00002269
P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
Date: Tue, 31 Mar 2020 13:54:44 GMT
Connection: keep-alive
X-MSEdge-Flight: muidflt180=afd_waccluster,qx9=tasmigration015,skb=typeheadertest
Content-Length: 19051
Accept-Ranges: bytes
X-MSEdge-Features: afd_waccluster,tasmigration015,typeheadertest
Last-Modified: Sun, 29 Mar 2020 00:04:37 GMT
X-OfficeCluster: IE3
X-CCR: true
X-UserSessionId: 780fb49e-f144-4ba7-b903-05b0c5ed4d60
ETag: "edceefa25d5d61:0"
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: public,max-age=31536000
X-MSEdge-Ref: Ref A: 2B6CFD84570D422A872BA7C883FEF104 Ref B: AMS04EDGE0313 Ref C: 2020-03-29T00:07:46Z
Timing-Allow-Origin: *

GET
H/1.1 200
OK Compat.js Show response
c1-word-view-15.cdn.office.net/wv/s/161272835950_App_Scripts/ Frame E135 6 KB
2 KB 31ms
7ms Script
application/javascript 2a02:26f0:1700:19d::1c24
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://c1-word-view-15.cdn.office.net/wv/s/161272835950_App_Scripts/Compat.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:19d::1c24 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

06fe78141d1f3a435441a17ec8f9f46af7000af35aa0133c699c537d663607d0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://word-view.officeapps.live.com/
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

X-CorrelationId: b56e3f67-4bb1-412a-985a-60aa68800ccb
Strict-Transport-Security: max-age=31536000
Content-Encoding: br
X-OFFICEFD: DB5PEPF000005B3
X-OfficeVersion: 16.0.12723.32652
X-OfficeFE: DB5PEPF0000353F
P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
Date: Tue, 31 Mar 2020 13:54:44 GMT
Connection: keep-alive
X-MSEdge-Flight: muidflt180=afd_waccluster,qx9=tasmigration015,skb=typeheadertest
Content-Length: 1365
X-MSEdge-Features: afd_waccluster,tasmigration015,typeheadertest
Last-Modified: Sun, 29 Mar 2020 00:01:34 GMT
X-OfficeCluster: IE3
X-MSEdge-Ref: Ref A: 74913D429C6E4F239936F22D30519DC3 Ref B: AMS04EDGE0610 Ref C: 2020-03-29T00:01:34Z
X-UserSessionId: b56e3f67-4bb1-412a-985a-60aa68800ccb
ETag: W/"30f374355d5d61:0"
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: public,max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *

GET
H/1.1 200
OK WordViewerIntl.js Show response
c1-word-view-15.cdn.office.net/wv/s/161272835950_App_Scripts/1033/ Frame E135 42 KB
6 KB 32ms
8ms Script
application/javascript 2a02:26f0:1700:19d::1c24
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://c1-word-view-15.cdn.office.net/wv/s/161272835950_App_Scripts/1033/WordViewerIntl.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:19d::1c24 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

96c8b7290ca93e5644354a6d1f25ab06128213b92493145a6f122bd458e4a662

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://word-view.officeapps.live.com/
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

X-CorrelationId: 319d4c08-7048-4516-a055-dd3b5a76799a
Strict-Transport-Security: max-age=31536000
Content-Encoding: br
X-OFFICEFD: DB5PEPF0000273E
X-OfficeVersion: 16.0.12723.32652
X-OfficeFE: DB5PEPF0000226E
P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
Date: Tue, 31 Mar 2020 13:54:44 GMT
Connection: keep-alive
X-MSEdge-Flight: muidflt180=afd_waccluster_control,qx9=tasmigration015,skb=typeheadertest
Content-Length: 5524
Accept-Ranges: bytes
X-MSEdge-Features: afd_waccluster_control,tasmigration015,typeheadertest
Last-Modified: Sun, 29 Mar 2020 00:07:46 GMT
X-OfficeCluster: IE3
X-CCR: true
X-UserSessionId: 319d4c08-7048-4516-a055-dd3b5a76799a
ETag: W/"4cf68b135e5d61:0"
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: public,max-age=31536000
X-MSEdge-Ref: Ref A: 7736370A49D043829AE3CC30C05E06D6 Ref B: AM3EDGE0715 Ref C: 2020-03-29T00:07:46Z
Timing-Allow-Origin: *

GET
H/1.1 200
OK WordViewer.js Show response
c1-word-view-15.cdn.office.net/wv/s/161272835950_App_Scripts/ Frame E135 1 MB
259 KB 32ms
8ms Script
application/javascript 2a02:26f0:1700:19d::1c24
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://c1-word-view-15.cdn.office.net/wv/s/161272835950_App_Scripts/WordViewer.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:19d::1c24 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

b44650e095619191450e5ca8cfc16c846c830e338e5cbf0d33b960dae14ffdd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://word-view.officeapps.live.com/
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

X-CorrelationId: c705242e-c08e-4934-9a6f-a50b3fd1ef00
Strict-Transport-Security: max-age=31536000
Content-Encoding: br
X-OFFICEFD: DB5PEPF000035A0
X-OfficeVersion: 16.0.12723.32652
X-OfficeFE: DB5PEPF000037DE
P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
Date: Tue, 31 Mar 2020 13:54:44 GMT
Connection: keep-alive
X-MSEdge-Flight: muidflt180=afd_waccluster,qx9=tasmigration015,skb=typeheadertest
Content-Length: 263882
X-MSEdge-Features: afd_waccluster,tasmigration015,typeheadertest
Last-Modified: Sun, 29 Mar 2020 00:02:25 GMT
X-OfficeCluster: IE3
X-MSEdge-Ref: Ref A: 9E9FC5C8807A4F3CAA45493B02E8FF75 Ref B: AM3EDGE0409 Ref C: 2020-03-29T00:02:24Z
X-UserSessionId: c705242e-c08e-4934-9a6f-a50b3fd1ef00
ETag: W/"f2c1d3535d5d61:0"
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: public,max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *

POST
H2 200 RemoteUls.ashx Show response
word-view.officeapps.live.com/wv/ Frame E135 0
563 B 103ms
102ms XHR
text/plain 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/RemoteUls.ashx?build=16.0.12728.35950&waccluster=US6

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=p4VmQpA1O0+JgBBX6AtNdw.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2F2739D85632D20637%21170&sc=host%3D%26qt%3DFolders%26pt%3Dem
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: empty
X-UserSessionId: f646b254-c0ab-43b3-9d69-665d0cdbf4c3
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
X-BrowserUlsBeacon: [{"Index":0,"MsSinceStart":1,"Value":"SessionStarted","Type":"SessionBoundary"}]

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
x-officecluster: US6
x-officeversion: 16.0.12728.35950
x-officefe: BL6PEPF00003164
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: muidflt180=afd_waccluster,qx9=tasmigration015,skb=typeheadertest
content-length: 0
x-msedge-features: afd_waccluster,tasmigration015,typeheadertest
x-correlationid: 294c9fe5-ec59-48dc-8d3c-9b24adf7d8c5
x-officefd: BL6PEPF00002BC1
x-ccr: true
x-usersessionid: f646b254-c0ab-43b3-9d69-665d0cdbf4c3
date: Tue, 31 Mar 2020 13:54:43 GMT
x-download-options: noopen
content-type: text/plain
access-control-allow-origin: https://word-view.officeapps.live.com
access-control-expose-headers: X-EndSession, X-CorrelationId, X-OfficeFE, X-NewKey, X-bULS-SuppressionETag, X-bULS-SuppressedTags
cache-control: private
x-msedge-ref: Ref A: 43B8EF1DFA674A7E804952D997ABB96C Ref B: AMS04EDGE0811 Ref C: 2020-03-31T13:54:44Z
timing-allow-origin: *

POST
H2 200 RemoteUls.ashx Show response
word-view.officeapps.live.com/wv/ Frame E135 0
173 B 101ms
101ms XHR
text/plain 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/RemoteUls.ashx?build=16.0.12728.35950&waccluster=US6

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=p4VmQpA1O0+JgBBX6AtNdw.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2F2739D85632D20637%21170&sc=host%3D%26qt%3DFolders%26pt%3Dem
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: empty
X-UserSessionId: f646b254-c0ab-43b3-9d69-665d0cdbf4c3
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
X-BrowserUlsBeacon: [{"Index":1,"MsSinceStart":8,"Value":"https://c.s-microsoft.com/mscc/statics/mscc-0.4.2.min.css","Type":"ResourceDownloadSuccess"}]

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
x-officecluster: US6
x-officeversion: 16.0.12728.35950
x-officefe: BL6PEPF0000318E
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: muidflt180=afd_waccluster,qx9=tasmigration015,skb=typeheadertest
content-length: 0
x-msedge-features: afd_waccluster,tasmigration015,typeheadertest
x-correlationid: 117fef28-7d2b-4aca-8ff8-6582cb42765f
x-officefd: BL6PEPF000028DC
x-ccr: true
x-usersessionid: f646b254-c0ab-43b3-9d69-665d0cdbf4c3
date: Tue, 31 Mar 2020 13:54:43 GMT
x-download-options: noopen
content-type: text/plain
access-control-allow-origin: https://word-view.officeapps.live.com
access-control-expose-headers: X-EndSession, X-CorrelationId, X-OfficeFE, X-NewKey, X-bULS-SuppressionETag, X-bULS-SuppressedTags
cache-control: private
x-msedge-ref: Ref A: F89D6BB867B3416FA9C0EE6B398AAE49 Ref B: AMS04EDGE0811 Ref C: 2020-03-31T13:54:44Z
timing-allow-origin: *

GET
H2 200 ResReader.ashx
word-view.officeapps.live.com/wv/ Frame E135 52 KB
53 KB 345ms
345ms Image
image/jpeg 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://word-view.officeapps.live.com/wv/ResReader.ashx?n=p1.img&WOPIsrc=https%3A%2F%2Fwopi%2Eonedrive%2Ecom%2Fwopi%2Ffiles%2F2739D85632D20637%21170&access_token=4wwMkNr184Dv2DXEo4QaLMX9nI9j3ZFN8XoI5zrVIR3nL5ntuXBuuXqxotDySUbOcPi6yCqco%5FWy7ofy7d05dlDizanJQV%5FqdbS0pGSC8AKwQKMkyzczyRkuz%5Fchtv9reEVHJO2G%2DQv1wtS2ai0eF0CA&access_token_ttl=1587477283664&z=aMjczOUQ4NTYzMkQyMDYzNyExNzAuNA&v=00000000-0000-0000-0000-000000000802&usid=f646b254-c0ab-43b3-9d69-665d0cdbf4c3&splashscreen=1&build=16.0.12728.35950&PdfMode=1&waccluster=US6

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

ec5f43d953c37c2a085644890b2c4a846f4864105e78ed59238de28df67d4d0b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=p4VmQpA1O0+JgBBX6AtNdw.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2F2739D85632D20637%21170&sc=host%3D%26qt%3DFolders%26pt%3Dem
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-officecluster: US6
x-officeversion: 16.0.12728.35950
x-officefe: BL6PEPF00003128
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: muidflt180=afd_waccluster,qx9=tasmigration015,skb=typeheadertest
content-length: 53228
etag: "WOPIsrc=https%3A%2F%2Fwopi%2Eonedrive%2Ecom%2Fwopi%2Ffiles%2F2739D85632D20637%21170&access_token=4wwMkNr184Dv2DXEo4QaLMX9nI9j3ZFN8XoI5zrVIR3nL5ntuXBuuXqxotDySUbOcPi6yCqco%5FWy7ofy7d05dlDizanJQV%5FqdbS0pGSC8AKwQKMkyzczyRkuz%5Fchtv9reEVHJO2G%2DQv1wtS2ai0eF0CA&access_token_ttl=1587477283664&z=aMjczOUQ4NTYzMkQyMDYzNyExNzAuNA00000000-0000-0000-0000-000000000802p1.img"
x-msedge-features: afd_waccluster,tasmigration015,typeheadertest
x-correlationid: 581db127-5040-4ee7-a989-0e11234bf71f
x-officefd: BL6PEPF00002BC6
x-ccr: true
x-usersessionid: f646b254-c0ab-43b3-9d69-665d0cdbf4c3
date: Tue, 31 Mar 2020 13:54:44 GMT
x-download-options: noopen
content-type: image/jpeg
cache-control: private
x-msedge-ref: Ref A: 82FDE5D4E1254264BC271ECE3C002E47 Ref B: AMS04EDGE0811 Ref C: 2020-03-31T13:54:44Z
timing-allow-origin: *
expires: Wed, 31 Mar 2021 13:54:44 GMT

POST
H2 200 RemoteTelemetry.ashx Show response
word-view.officeapps.live.com/wv/ Frame E135 0
195 B 106ms
106ms XHR
text/plain 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/RemoteTelemetry.ashx

Requested by

Host: c1-word-view-15.cdn.office.net
URL: https://c1-word-view-15.cdn.office.net/wv/s/161272835950_App_Scripts/WordViewer.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=p4VmQpA1O0+JgBBX6AtNdw.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2F2739D85632D20637%21170&sc=host%3D%26qt%3DFolders%26pt%3Dem
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-officefd: BL6PEPF00000741
x-officeversion: 16.0.12728.35950
x-officefe: BL6PEPF00003172
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: muidflt180=afd_waccluster,qx9=tasmigration015,skb=typeheadertest
content-length: 0
x-msedge-features: afd_waccluster,tasmigration015,typeheadertest
x-correlationid: b75c69f2-3536-42f4-8fd3-a68628387a85
x-officecluster: US6
x-ccr: true
x-usersessionid: b75c69f2-3536-42f4-8fd3-a68628387a85
date: Tue, 31 Mar 2020 13:54:43 GMT
x-download-options: noopen
access-control-allow-origin: https://word-view.officeapps.live.com
cache-control: private
x-msedge-ref: Ref A: 498F3790F99F418689A37520ED34DF78 Ref B: AMS04EDGE0811 Ref C: 2020-03-31T13:54:44Z
timing-allow-origin: *

POST
H2 200 RemoteTelemetry.ashx Show response
word-view.officeapps.live.com/wv/ Frame E135 0
194 B 106ms
106ms XHR
text/plain 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/RemoteTelemetry.ashx

Requested by

Host: c1-word-view-15.cdn.office.net
URL: https://c1-word-view-15.cdn.office.net/wv/s/161272835950_App_Scripts/WordViewer.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=p4VmQpA1O0+JgBBX6AtNdw.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2F2739D85632D20637%21170&sc=host%3D%26qt%3DFolders%26pt%3Dem
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-officefd: BL6PEPF0000074B
x-officeversion: 16.0.12728.35950
x-officefe: BL6PEPF00002D9D
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: muidflt180=afd_waccluster,qx9=tasmigration015,skb=typeheadertest
content-length: 0
x-msedge-features: afd_waccluster,tasmigration015,typeheadertest
x-correlationid: 975de3eb-2900-42f0-97d6-dd6781f14706
x-officecluster: US6
x-ccr: true
x-usersessionid: 975de3eb-2900-42f0-97d6-dd6781f14706
date: Tue, 31 Mar 2020 13:54:43 GMT
x-download-options: noopen
access-control-allow-origin: https://word-view.officeapps.live.com
cache-control: private
x-msedge-ref: Ref A: C9A4CCB4B9584B76A10DCC693801AC50 Ref B: AMS04EDGE0811 Ref C: 2020-03-31T13:54:44Z
timing-allow-origin: *

POST
H2 200 RemoteTelemetry.ashx Show response
word-view.officeapps.live.com/wv/ Frame E135 0
180 B 109ms
109ms XHR
text/plain 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/RemoteTelemetry.ashx

Requested by

Host: c1-word-view-15.cdn.office.net
URL: https://c1-word-view-15.cdn.office.net/wv/s/161272835950_App_Scripts/WordViewer.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=p4VmQpA1O0+JgBBX6AtNdw.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2F2739D85632D20637%21170&sc=host%3D%26qt%3DFolders%26pt%3Dem
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-officefd: BL6PEPF000028DC
x-officeversion: 16.0.12728.35950
x-officefe: BL6PEPF00003420
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: muidflt180=afd_waccluster,qx9=tasmigration015,skb=typeheadertest
content-length: 0
x-msedge-features: afd_waccluster,tasmigration015,typeheadertest
x-correlationid: 6fb686c4-6f85-4f6c-b453-45decf6ae00e
x-officecluster: US6
x-ccr: true
x-usersessionid: 6fb686c4-6f85-4f6c-b453-45decf6ae00e
date: Tue, 31 Mar 2020 13:54:43 GMT
x-download-options: noopen
access-control-allow-origin: https://word-view.officeapps.live.com
cache-control: private
x-msedge-ref: Ref A: C6D1CAD0DF3C4A1980EFD1FE05ECA4EB Ref B: AMS04EDGE0811 Ref C: 2020-03-31T13:54:44Z
timing-allow-origin: *

POST
H2 200 RemoteTelemetry.ashx Show response
word-view.officeapps.live.com/wv/ Frame E135 0
274 B 108ms
108ms XHR
text/plain 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/RemoteTelemetry.ashx

Requested by

Host: c1-word-view-15.cdn.office.net
URL: https://c1-word-view-15.cdn.office.net/wv/s/161272835950_App_Scripts/WordViewer.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=p4VmQpA1O0+JgBBX6AtNdw.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2F2739D85632D20637%21170&sc=host%3D%26qt%3DFolders%26pt%3Dem
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-officefd: BL6PEPF0000075E
x-officeversion: 16.0.12728.35950
x-officefe: BL6PEPF0000311A
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: muidflt180=afd_waccluster,qx9=tasmigration015,skb=typeheadertest
content-length: 0
x-msedge-features: afd_waccluster,tasmigration015,typeheadertest
x-correlationid: 3f965d1e-9d25-4fef-b422-758e4b4cf1fc
x-officecluster: US6
x-ccr: true
x-usersessionid: 3f965d1e-9d25-4fef-b422-758e4b4cf1fc
date: Tue, 31 Mar 2020 13:54:43 GMT
x-download-options: noopen
access-control-allow-origin: https://word-view.officeapps.live.com
cache-control: private
x-msedge-ref: Ref A: 74604459A6C64AB4B9C0276B7FB2CF06 Ref B: AMS04EDGE0811 Ref C: 2020-03-31T13:54:44Z
timing-allow-origin: *

POST
H2 200 RemoteUls.ashx Show response
word-view.officeapps.live.com/wv/ Frame E135 0
197 B 123ms
122ms XHR
text/plain 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/RemoteUls.ashx?build=16.0.12728.35950&waccluster=US6

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=p4VmQpA1O0+JgBBX6AtNdw.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2F2739D85632D20637%21170&sc=host%3D%26qt%3DFolders%26pt%3Dem
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: empty
X-UserSessionId: f646b254-c0ab-43b3-9d69-665d0cdbf4c3
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
X-BrowserUlsBeacon: [{"Index":2,"MsSinceStart":392,"Value":"SplashScreenShown","Type":"BootPhaseCompleted"}]

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
x-officecluster: US6
x-officeversion: 16.0.12728.35950
x-officefe: BL6PEPF00002D05
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: muidflt180=afd_waccluster,qx9=tasmigration015,skb=typeheadertest
content-length: 0
x-msedge-features: afd_waccluster,tasmigration015,typeheadertest
x-correlationid: 5ba0268a-179a-4e24-a191-721cd222c5c0
x-officefd: BL6PEPF00002BC5
x-ccr: true
x-usersessionid: f646b254-c0ab-43b3-9d69-665d0cdbf4c3
date: Tue, 31 Mar 2020 13:54:43 GMT
x-download-options: noopen
content-type: text/plain
access-control-allow-origin: https://word-view.officeapps.live.com
access-control-expose-headers: X-EndSession, X-CorrelationId, X-OfficeFE, X-NewKey, X-bULS-SuppressionETag, X-bULS-SuppressedTags
cache-control: private
x-msedge-ref: Ref A: 712044BAD48541B9B6E1B574CFDC307F Ref B: AMS04EDGE0811 Ref C: 2020-03-31T13:54:44Z
timing-allow-origin: *

GET
H/1.1 200
OK segoeui.woff
c1-word-view-15.cdn.office.net/wv/s/161272835950_resources/1033/ Frame E135 22 KB
23 KB 8ms
8ms Font
font/x-woff 2a02:26f0:1700:19d::1c24
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://c1-word-view-15.cdn.office.net/wv/s/161272835950_resources/1033/segoeui.woff

Requested by

Host: c1-word-view-15.cdn.office.net
URL: https://c1-word-view-15.cdn.office.net/wv/s/161272835950_App_Scripts/WordViewer.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:19d::1c24 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

3d785eb0a0168e5c79e66aa0085a932d5fe2ad04f3577547e2267fa589df677d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://c1-word-view-15.cdn.office.net/wv/s/161272835950_resources/1033/WordViewer.css
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

X-CorrelationId: 8e03a1ca-b8cb-468b-8f78-aee96e76d1b9
Strict-Transport-Security: max-age=31536000
X-OfficeCluster: IE3
X-OfficeVersion: 16.0.12728.35950
X-OfficeFE: DB5PEPF000022A4
P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
Date: Tue, 31 Mar 2020 13:54:44 GMT
Connection: keep-alive
X-MSEdge-Flight: muidflt180=afd_waccluster_control,qx9=tasmigration015,skb=typeheadertest
Content-Length: 22720
X-MSEdge-Features: afd_waccluster_control,tasmigration015,typeheadertest
Last-Modified: Sun, 29 Mar 2020 00:04:41 GMT
X-OFFICEFD: DB5PEPF00001E87
X-MSEdge-Ref: Ref A: 2D5496CE5099484EB2B33E528A6512B1 Ref B: AMS04EDGE1022 Ref C: 2020-03-29T00:13:08Z
X-UserSessionId: 8e03a1ca-b8cb-468b-8f78-aee96e76d1b9
ETag: "f0dcda55d5d61:0"
Content-Type: font/x-woff
Access-Control-Allow-Origin: *
Cache-Control: public,max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *

GET
H2 200 docdatahandler.ashx Show response
word-view.officeapps.live.com/wv/ Frame E135 356 B
574 B 315ms
315ms XHR
text/xml 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/docdatahandler.ashx?WOPIsrc=https%3A%2F%2Fwopi%2Eonedrive%2Ecom%2Fwopi%2Ffiles%2F2739D85632D20637%21170&access_token=4wwMkNr184Dv2DXEo4QaLMX9nI9j3ZFN8XoI5zrVIR3nL5ntuXBuuXqxotDySUbOcPi6yCqco%5FWy7ofy7d05dlDizanJQV%5FqdbS0pGSC8AKwQKMkyzczyRkuz%5Fchtv9reEVHJO2G%2DQv1wtS2ai0eF0CA&access_token_ttl=1587477283664&z=aMjczOUQ4NTYzMkQyMDYzNyExNzAuNA&type=png&o15=1&ui=en-US&PdfMode=1

Requested by

Host: c1-officeapps-15.cdn.office.net
URL: https://c1-officeapps-15.cdn.office.net/wv/s/161272835950_App_Scripts/MicrosoftAjax.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

b8905a54e45aca33fb5d275a635737bf7e287679db6bd782ff167273b79883fc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

X-UserSessionId: f646b254-c0ab-43b3-9d69-665d0cdbf4c3
X-OfficeVersion: 16.0.12728.35950
X-Key: HQiq4q3V3SzAHy48LekgZqpq1XLULmtaiAhAEKEZfck=,637212596841457522
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=p4VmQpA1O0+JgBBX6AtNdw.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2F2739D85632D20637%21170&sc=host%3D%26qt%3DFolders%26pt%3Dem
Sec-Fetch-Dest: empty
X-Requested-With: XMLHttpRequest
X-UserType: WOPI
X-xhr: 1
X-WacCluster: US6

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
x-officecluster: US6
x-officeversion: 16.0.12728.35950
x-officefe: BL6PEPF00003173
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: muidflt180=afd_waccluster,qx9=tasmigration015,skb=typeheadertest
content-length: 352
x-msedge-features: afd_waccluster,tasmigration015,typeheadertest
x-correlationid: 3162e51d-af47-4784-b4aa-543e83c8590c
x-officefd: BL6PEPF0000073E
x-ccr: true
x-usersessionid: f646b254-c0ab-43b3-9d69-665d0cdbf4c3
date: Tue, 31 Mar 2020 13:54:44 GMT
x-download-options: noopen
vary: Accept-Encoding
content-type: text/xml; charset=utf-8
cache-control: private
x-msedge-ref: Ref A: 74A663206C064DACAC0EC4F0F6BAF416 Ref B: AMS04EDGE0811 Ref C: 2020-03-31T13:54:44Z
timing-allow-origin: *
expires: Wed, 31 Mar 2021 13:54:44 GMT

GET
H/1.1 200
OK wacairspaceanimationlibrary.js Show response
c1-officeapps-15.cdn.office.net/wv/s/161272835950_App_Scripts/ Frame E135 40 KB
7 KB 8ms
7ms Script
application/javascript 2a02:26f0:1700:184::1c24
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://c1-officeapps-15.cdn.office.net/wv/s/161272835950_App_Scripts/wacairspaceanimationlibrary.js

Requested by

Host: c1-word-view-15.cdn.office.net
URL: https://c1-word-view-15.cdn.office.net/wv/s/161272835950_App_Scripts/WordViewer.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:184::1c24 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

234cae682920ab63f3184948f1e4103b89201a274977ed31097b844cc323afa1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://word-view.officeapps.live.com/
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

X-CorrelationId: 712f28b2-1d1f-45ca-8fa2-b6c954731712
Strict-Transport-Security: max-age=31536000
Content-Encoding: br
X-OFFICEFD: DB5PEPF000005B3
X-OfficeVersion: 16.0.12723.32652
X-OfficeFE: DB5PEPF00003545
P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
Date: Tue, 31 Mar 2020 13:54:44 GMT
Connection: keep-alive
X-MSEdge-Flight: muidflt180=afd_waccluster,qx9=tasmigration015,skb=typeheadertest
Content-Length: 5997
X-MSEdge-Features: afd_waccluster,tasmigration015,typeheadertest
Last-Modified: Sun, 29 Mar 2020 00:01:37 GMT
X-OfficeCluster: IE3
X-MSEdge-Ref: Ref A: 990EDCAC06D1427BA4484CC9CFE80021 Ref B: AMS04EDGE0917 Ref C: 2020-03-29T00:01:36Z
X-UserSessionId: 712f28b2-1d1f-45ca-8fa2-b6c954731712
ETag: W/"e7f40375d5d61:0"
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: public,max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *

GET
H/1.1 200
OK wapsw.png
c1-officeapps-15.cdn.office.net/wv/s/161272835950_resources/1033/ Frame E135 6 KB
7 KB 9ms
8ms Image
image/png 2a02:26f0:1700:184::1c24
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1-officeapps-15.cdn.office.net/wv/s/161272835950_resources/1033/wapsw.png?b=1601272835950

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:184::1c24 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

390577d35c959ffe7dd2af4519c04410a04fdc4a433b151e27b049fc4a1ab3e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://word-view.officeapps.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

X-CorrelationId: 2a65222a-0bfb-4bba-b9a1-82c9e05eb301
Strict-Transport-Security: max-age=31536000
X-OFFICEFD: DB5PEPF00003823
X-OfficeVersion: 16.0.12723.32652
X-OfficeFE: DB5PEPF00002290
P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
Date: Tue, 31 Mar 2020 13:54:44 GMT
Connection: keep-alive
X-MSEdge-Flight: muidflt180=afd_waccluster_control,qx9=tasmigration015,skb=typeheadertest
Content-Length: 5884
Accept-Ranges: bytes
X-MSEdge-Features: afd_waccluster_control,tasmigration015,typeheadertest
Last-Modified: Sun, 29 Mar 2020 00:20:18 GMT
X-OfficeCluster: IE3
X-CCR: true
X-UserSessionId: 2a65222a-0bfb-4bba-b9a1-82c9e05eb301
ETag: W/"3614e3d35f5d61:0"
Content-Type: image/png
Access-Control-Allow-Origin: *
Cache-Control: public,max-age=31536000
X-MSEdge-Ref: Ref A: C903E3D3B7B34832909F1637B9AABB0A Ref B: AMS04EDGE0712 Ref C: 2020-03-29T00:20:18Z
Timing-Allow-Origin: *

GET
H/1.1 200
OK wv.png
c1-word-view-15.cdn.office.net/wv/s/161272835950_resources/1033/ Frame E135 34 KB
35 KB 9ms
8ms Image
image/png 2a02:26f0:1700:19d::1c24
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1-word-view-15.cdn.office.net/wv/s/161272835950_resources/1033/wv.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:19d::1c24 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

e2bf7da51e85c834d5c051092c444ee3011f518773d51c253090505356ef9f73

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://word-view.officeapps.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

X-CorrelationId: 93d3ff80-996f-44c4-8cfa-444863f20e89
Strict-Transport-Security: max-age=31536000
X-OfficeCluster: IE3
X-OfficeVersion: 16.0.12723.32652
X-OfficeFE: DB5PEPF000037FA
P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
Date: Tue, 31 Mar 2020 13:54:44 GMT
Connection: keep-alive
X-MSEdge-Flight: muidflt180=afd_waccluster_control,qx9=tasmigration015,skb=typeheadertest
Content-Length: 34788
X-MSEdge-Features: afd_waccluster_control,tasmigration015,typeheadertest
Last-Modified: Sun, 29 Mar 2020 00:13:08 GMT
X-OFFICEFD: DB5PEPF00001DFA
X-MSEdge-Ref: Ref A: 4C5C8D37779847B787A89003642D46F8 Ref B: AM3EDGE0609 Ref C: 2020-03-29T00:13:08Z
X-UserSessionId: 93d3ff80-996f-44c4-8cfa-444863f20e89
ETag: W/"a9be7fd35e5d61:0"
Content-Type: image/png
Access-Control-Allow-Origin: *
Cache-Control: public,max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *

GET
H2 204 _log
uhf.microsoft.com/ Frame E135 0
128 B 33ms
7ms Image
text/html 2a02:26f0:1700:193::2b57
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uhf.microsoft.com/_log?o=mscc&s=officeapps.live.com&m=show&nv=aspnet-3.1.4&sv=0.1.2
Requested by: Host: word-view.officeapps.live.com
URL: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=p4VmQpA1O0+JgBBX6AtNdw.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2F2739D85632D20637%21170&sc=host%3D%26qt%3DFolders%26pt%3Dem
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:1700:193::2b57 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://word-view.officeapps.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Tue, 31 Mar 2020 13:54:44 GMT
access-control-allow-origin: *
content-type: text/html
status: 204
cache-control: max-age=0, no-cache, no-store
content-length: 0
expires: Tue, 31 Mar 2020 13:54:44 GMT

GET
DATA 200
OK truncated
/ 34 KB
34 KB Font
font/woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 07ec698b1036cdfbb8892f02d9510f5f671284fca9fa003b883996da040a444b

Request headers

Origin: https://onedrive.live.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: font/woff;charset=utf-8

GET
H2

200

c.gif
c.live.com/
Redirect Chain

https://c.live.com/c.gif?DI=15347&wlxid=5eb76443-fad5-44db-a645-60b65cd5bbfd&reqid=001826e6a7b&csiperf=ANON%3D%26NL%3D0%26TP%3D0%26CL%3DRD00155D0320A6%26MA%3Den-US%26B%3D0.0.0%26TR%3DNA%252ANA%252A...
https://c.bing.com/c.gif?DI=15347&wlxid=5eb76443-fad5-44db-a645-60b65cd5bbfd&reqid=001826e6a7b&csiperf=ANON%3D%26NL%3D0%26TP%3D0%26CL%3DRD00155D0320A6%26MA%3Den-US%26B%3D0.0.0%26TR%3DNA%252ANA%252A...
https://c.live.com/c.gif?DI=15347&wlxid=5eb76443-fad5-44db-a645-60b65cd5bbfd&reqid=001826e6a7b&csiperf=ANON%3D%26NL%3D0%26TP%3D0%26CL%3DRD00155D0320A6%26MA%3Den-US%26B%3D0.0.0%26TR%3DNA%252ANA%252A...

42 B
303 B

45ms
44ms

Image
image/gif

52.142.114.2
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.live.com/c.gif?DI=15347&wlxid=5eb76443-fad5-44db-a645-60b65cd5bbfd&reqid=001826e6a7b&csiperf=ANON%3D%26NL%3D0%26TP%3D0%26CL%3DRD00155D0320A6%26MA%3Den-US%26B%3D0.0.0%26TR%3DNA%252ANA%252A%253ASDX.Skydrive%252AEmbed.default.F.U.%26PLT%3D2100%26IR%3D1%26EX%3D0%26L.h%3D1061%26L.sjs%3D1238%26L.ttg%3D1061%26C.st%3D1585662882773%26N.domIn%3D1070%26N.dns%3D2%26N.tcp%3D31%26N.req%3D966%26N.resp%3D12%26N.navType%3D0%26N.redirectCount%3D0&r=0.47801105254822684&CtsSyncId=9DFF9D7686F342E6BCF0C0ABC0BE64B0&MUID=2AA7BD47DFD767DD2B87B3D9DE62668E
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.142.114.2 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Referer: https://onedrive.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 31 Mar 2020 13:54:44 GMT
last-modified: Wed, 18 Mar 2020 17:42:13 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
etag: "c639e68e4cfdd51:0"
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
status: 200
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-type: image/gif
content-length: 42

Redirect headers

pragma: no-cache
date: Tue, 31 Mar 2020 13:54:44 GMT
x-msedge-ref: Ref A: 0667F1B2C731450794E41B92ADE9A5B6 Ref B: FRAEDGE0215 Ref C: 2020-03-31T13:54:45Z
x-powered-by: ASP.NET
location: https://c.live.com/c.gif?DI=15347&wlxid=5eb76443-fad5-44db-a645-60b65cd5bbfd&reqid=001826e6a7b&csiperf=ANON%3D%26NL%3D0%26TP%3D0%26CL%3DRD00155D0320A6%26MA%3Den-US%26B%3D0.0.0%26TR%3DNA%252ANA%252A%253ASDX.Skydrive%252AEmbed.default.F.U.%26PLT%3D2100%26IR%3D1%26EX%3D0%26L.h%3D1061%26L.sjs%3D1238%26L.ttg%3D1061%26C.st%3D1585662882773%26N.domIn%3D1070%26N.dns%3D2%26N.tcp%3D31%26N.req%3D966%26N.resp%3D12%26N.navType%3D0%26N.redirectCount%3D0&r=0.47801105254822684&CtsSyncId=9DFF9D7686F342E6BCF0C0ABC0BE64B0&MUID=2AA7BD47DFD767DD2B87B3D9DE62668E
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
status: 302
cache-control: private, no-cache, proxy-revalidate, no-store
content-length: 0

POST
H2 200 RemoteUls.ashx Show response
word-view.officeapps.live.com/wv/ Frame E135 0
304 B 102ms
102ms XHR
text/plain 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/RemoteUls.ashx?build=16.0.12728.35950&waccluster=US6

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=p4VmQpA1O0+JgBBX6AtNdw.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2F2739D85632D20637%21170&sc=host%3D%26qt%3DFolders%26pt%3Dem
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: empty
X-UserSessionId: f646b254-c0ab-43b3-9d69-665d0cdbf4c3
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
X-BrowserUlsBeacon: [{"Index":3,"MsSinceStart":770,"Value":"RecordAppInteractive","Type":"BootPhaseCompleted"}]

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
x-officecluster: US6
x-officeversion: 16.0.12728.35950
x-officefe: BL6PEPF00003439
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: muidflt180=afd_waccluster,qx9=tasmigration015,skb=typeheadertest
content-length: 0
x-msedge-features: afd_waccluster,tasmigration015,typeheadertest
x-correlationid: 67d3768b-a31a-4606-9eed-2db40eddee7b
x-officefd: BL6PEPF0000076E
x-ccr: true
x-usersessionid: f646b254-c0ab-43b3-9d69-665d0cdbf4c3
date: Tue, 31 Mar 2020 13:54:44 GMT
x-download-options: noopen
content-type: text/plain
access-control-allow-origin: https://word-view.officeapps.live.com
access-control-expose-headers: X-EndSession, X-CorrelationId, X-OfficeFE, X-NewKey, X-bULS-SuppressionETag, X-bULS-SuppressedTags
cache-control: private
x-msedge-ref: Ref A: 70791171D4184846A858C66B3852FDD6 Ref B: AMS04EDGE0811 Ref C: 2020-03-31T13:54:44Z
timing-allow-origin: *

GET
H/1.1 200
OK WordViewer.dll1.js Show response
c1-word-view-15.cdn.office.net/wv/s/161272835950_App_Scripts/ Frame E135 469 KB
99 KB 8ms
8ms Script
application/javascript 2a02:26f0:1700:19d::1c24
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://c1-word-view-15.cdn.office.net/wv/s/161272835950_App_Scripts/WordViewer.dll1.js

Requested by

Host: c1-word-view-15.cdn.office.net
URL: https://c1-word-view-15.cdn.office.net/wv/s/161272835950_App_Scripts/WordViewer.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:19d::1c24 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

c14671f66d7d392c4f89814c14edf9dc32d08747332307704f08be20a50fe905

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://word-view.officeapps.live.com/
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

X-CorrelationId: 66a4e28b-a49d-4da6-aa52-468c47ccfce4
Strict-Transport-Security: max-age=31536000
Content-Encoding: br
X-OFFICEFD: DB5PEPF000026C2
X-OfficeVersion: 16.0.12723.32652
X-OfficeFE: DB5PEPF00002AA0
P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
Date: Tue, 31 Mar 2020 13:54:44 GMT
Connection: keep-alive
X-MSEdge-Flight: muidflt180=afd_waccluster_control,qx9=tasmigration015,skb=typeheadertest
Content-Length: 100259
X-MSEdge-Features: afd_waccluster_control,tasmigration015,typeheadertest
Last-Modified: Sun, 29 Mar 2020 00:01:37 GMT
X-OfficeCluster: IE3
X-MSEdge-Ref: Ref A: B83D3EE0DDDB4577957E7A648CF2CFE5 Ref B: AMS04EDGE0807 Ref C: 2020-03-29T00:01:37Z
X-UserSessionId: 66a4e28b-a49d-4da6-aa52-468c47ccfce4
ETag: W/"bcdaa2375d5d61:0"
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: public,max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *

GET
DATA 200
OK truncated
/ Frame E135 183 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 19b132c556e33c005d831e1f6adcf21d7ff16f39ccf9c7fba0d2903099c0afeb

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame E135 185 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d091e132e22954ecf7403cce92be661694c7d32362e4a084d4824bff921e7127

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H/1.1 200
OK progress.gif
c1-officeapps-15.cdn.office.net/wv/s/161272835950_resources/1033/ Frame E135 695 B
2 KB 8ms
7ms Image
image/gif 2a02:26f0:1700:184::1c24
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1-officeapps-15.cdn.office.net/wv/s/161272835950_resources/1033/progress.gif

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:184::1c24 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

a3596c17dad9a003d0bfbe0b7ba6765f51391b5c3943660316f01c8e77b323db

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://word-view.officeapps.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

X-CorrelationId: a9fa68bc-5d5d-4268-a20b-5ee9d83ea16d
Strict-Transport-Security: max-age=31536000
X-OFFICEFD: DB5PEPF00003826
X-OfficeVersion: 16.0.12723.32652
X-OfficeFE: DB5PEPF0000356E
P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
Date: Tue, 31 Mar 2020 13:54:45 GMT
Connection: keep-alive
X-MSEdge-Flight: muidflt180=afd_waccluster_control,qx9=tasmigration015,skb=typeheadertest
Content-Length: 695
Accept-Ranges: bytes
X-MSEdge-Features: afd_waccluster_control,tasmigration015,typeheadertest
Last-Modified: Sun, 29 Mar 2020 00:03:36 GMT
X-OfficeCluster: IE3
X-CCR: true
X-UserSessionId: a9fa68bc-5d5d-4268-a20b-5ee9d83ea16d
ETag: W/"fc7787e5d5d61:0"
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: public,max-age=31536000
X-MSEdge-Ref: Ref A: 22409ECCC17F4A93816598A6398207CE Ref B: AMS04EDGE0912 Ref C: 2020-03-29T00:03:36Z
Timing-Allow-Origin: *

GET
H2 200 ResReader.ashx
word-view.officeapps.live.com/wv/ Frame E135 52 KB
52 KB 263ms
263ms Image
image/jpeg 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://word-view.officeapps.live.com/wv/ResReader.ashx?n=p1.img&v=00000000-0000-0000-0000-000000000802&usid=f646b254-c0ab-43b3-9d69-665d0cdbf4c3&build=16.0.12728.35950&WOPIsrc=https%3A%2F%2Fwopi%2Eonedrive%2Ecom%2Fwopi%2Ffiles%2F2739D85632D20637%21170&access_token=4wwMkNr184Dv2DXEo4QaLMX9nI9j3ZFN8XoI5zrVIR3nL5ntuXBuuXqxotDySUbOcPi6yCqco%5FWy7ofy7d05dlDizanJQV%5FqdbS0pGSC8AKwQKMkyzczyRkuz%5Fchtv9reEVHJO2G%2DQv1wtS2ai0eF0CA&access_token_ttl=1587477283664&z=aMjczOUQ4NTYzMkQyMDYzNyExNzAuNA&waccluster=US6&PdfMode=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

ec5f43d953c37c2a085644890b2c4a846f4864105e78ed59238de28df67d4d0b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=p4VmQpA1O0+JgBBX6AtNdw.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2F2739D85632D20637%21170&sc=host%3D%26qt%3DFolders%26pt%3Dem
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-officecluster: US6
x-officeversion: 16.0.12728.35950
x-officefe: BL6PEPF00002DC4
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: muidflt180=afd_waccluster,qx9=tasmigration015,skb=typeheadertest
content-length: 53228
etag: "WOPIsrc=https%3A%2F%2Fwopi%2Eonedrive%2Ecom%2Fwopi%2Ffiles%2F2739D85632D20637%21170&access_token=4wwMkNr184Dv2DXEo4QaLMX9nI9j3ZFN8XoI5zrVIR3nL5ntuXBuuXqxotDySUbOcPi6yCqco%5FWy7ofy7d05dlDizanJQV%5FqdbS0pGSC8AKwQKMkyzczyRkuz%5Fchtv9reEVHJO2G%2DQv1wtS2ai0eF0CA&access_token_ttl=1587477283664&z=aMjczOUQ4NTYzMkQyMDYzNyExNzAuNA00000000-0000-0000-0000-000000000802p1.img"
x-msedge-features: afd_waccluster,tasmigration015,typeheadertest
x-correlationid: ac147f3e-e485-49f7-9d5b-b2ee8e771a9b
x-officefd: BL6PEPF0000074B
x-ccr: true
x-usersessionid: f646b254-c0ab-43b3-9d69-665d0cdbf4c3
date: Tue, 31 Mar 2020 13:54:44 GMT
x-download-options: noopen
content-type: image/jpeg
cache-control: private
x-msedge-ref: Ref A: 94523F98ECD641ACADF5F2BE8B72ED16 Ref B: AMS04EDGE0811 Ref C: 2020-03-31T13:54:45Z
timing-allow-origin: *
expires: Wed, 31 Mar 2021 13:54:45 GMT

GET
H2 200 ResReader.ashx Show response
word-view.officeapps.live.com/wv/ Frame E135 856 B
1 KB 345ms
344ms XHR
text/xml 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/ResReader.ashx?n=p_1_10.xml&v=00000000-0000-0000-0000-000000000802&usid=f646b254-c0ab-43b3-9d69-665d0cdbf4c3&build=16.0.12728.35950&WOPIsrc=https%3A%2F%2Fwopi%2Eonedrive%2Ecom%2Fwopi%2Ffiles%2F2739D85632D20637%21170&access_token=4wwMkNr184Dv2DXEo4QaLMX9nI9j3ZFN8XoI5zrVIR3nL5ntuXBuuXqxotDySUbOcPi6yCqco%5FWy7ofy7d05dlDizanJQV%5FqdbS0pGSC8AKwQKMkyzczyRkuz%5Fchtv9reEVHJO2G%2DQv1wtS2ai0eF0CA&access_token_ttl=1587477283664&z=aMjczOUQ4NTYzMkQyMDYzNyExNzAuNA&waccluster=US6&PdfMode=1

Requested by

Host: c1-officeapps-15.cdn.office.net
URL: https://c1-officeapps-15.cdn.office.net/wv/s/161272835950_App_Scripts/MicrosoftAjax.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

5ceaac1352e2df6ef57642cda087e1f30faaf8cadb29dcfa0fa1f84251d758ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

X-UserSessionId: f646b254-c0ab-43b3-9d69-665d0cdbf4c3
X-OfficeVersion: 16.0.12728.35950
X-Key: HQiq4q3V3SzAHy48LekgZqpq1XLULmtaiAhAEKEZfck=,637212596841457522
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=p4VmQpA1O0+JgBBX6AtNdw.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2F2739D85632D20637%21170&sc=host%3D%26qt%3DFolders%26pt%3Dem
Sec-Fetch-Dest: empty
X-Requested-With: XMLHttpRequest
X-UserType: WOPI
X-xhr: 1
X-WacCluster: US6

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
x-officecluster: US6
x-officeversion: 16.0.12728.35950
x-officefe: BL6PEPF00002CB4
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: muidflt180=afd_waccluster,qx9=tasmigration015,skb=typeheadertest
content-length: 560
etag: "WOPIsrc=https%3A%2F%2Fwopi%2Eonedrive%2Ecom%2Fwopi%2Ffiles%2F2739D85632D20637%21170&access_token=4wwMkNr184Dv2DXEo4QaLMX9nI9j3ZFN8XoI5zrVIR3nL5ntuXBuuXqxotDySUbOcPi6yCqco%5FWy7ofy7d05dlDizanJQV%5FqdbS0pGSC8AKwQKMkyzczyRkuz%5Fchtv9reEVHJO2G%2DQv1wtS2ai0eF0CA&access_token_ttl=1587477283664&z=aMjczOUQ4NTYzMkQyMDYzNyExNzAuNA00000000-0000-0000-0000-000000000802p_1_10.xml"
x-msedge-features: afd_waccluster,tasmigration015,typeheadertest
x-correlationid: 3457588c-43a4-46ef-8cb4-b313eb2e35e0
x-officefd: BL6PEPF00002BC4
x-ccr: true
x-usersessionid: f646b254-c0ab-43b3-9d69-665d0cdbf4c3
date: Tue, 31 Mar 2020 13:54:44 GMT
x-download-options: noopen
vary: Accept-Encoding
content-type: text/xml; charset=utf-8
cache-control: private
x-msedge-ref: Ref A: E5499BC0407748AFA3222B87748DBAC5 Ref B: AMS04EDGE0811 Ref C: 2020-03-31T13:54:45Z
timing-allow-origin: *
expires: Wed, 31 Mar 2021 13:54:45 GMT

GET
H/1.1 200
OK wl.ms.js Show response
js.live.net/v5.0/ Frame E135 42 KB
16 KB 24ms
23ms Script
application/javascript 104.109.78.246
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://js.live.net/v5.0/wl.ms.js
Requested by: Host: c1-word-view-15.cdn.office.net
URL: https://c1-word-view-15.cdn.office.net/wv/s/161272835950_App_Scripts/WordViewer.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_CBC
Server: 104.109.78.246 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a104-109-78-246.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 /
Resource Hash: d4c9bd86a5465d8414b7a10438d28110836126b387990d492fe545a5e701904a

Request headers

Referer: https://word-view.officeapps.live.com/
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 31 Mar 2020 13:54:45 GMT
X-MSNServer: RD0003FF1D732A
X-ODWebServer: westeurope0-ODWebp
Last-Modified: Thu, 02 Jan 2020 22:15:34 GMT
Server: Microsoft-IIS/10.0
ETag: "0c7427bac1d51:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=60775, public
Connection: keep-alive
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 16199

POST
H2 200 RemoteUls.ashx Show response
word-view.officeapps.live.com/wv/ Frame E135 0
168 B 108ms
108ms XHR
text/plain 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/RemoteUls.ashx?build=16.0.12728.35950&waccluster=US6

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=p4VmQpA1O0+JgBBX6AtNdw.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2F2739D85632D20637%21170&sc=host%3D%26qt%3DFolders%26pt%3Dem
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: empty
X-UserSessionId: f646b254-c0ab-43b3-9d69-665d0cdbf4c3
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
X-BrowserUlsBeacon: [{"Index":4,"MsSinceStart":1068,"Value":"RecordContentDisplayed","Type":"BootPhaseCompleted"}]

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
x-officecluster: US6
x-officeversion: 16.0.12728.35950
x-officefe: BL6PEPF0000312C
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: muidflt180=afd_waccluster,qx9=tasmigration015,skb=typeheadertest
content-length: 0
x-msedge-features: afd_waccluster,tasmigration015,typeheadertest
x-correlationid: d234a370-fd2a-4d17-ac22-f579895c5727
x-officefd: BL6PEPF0000075E
x-ccr: true
x-usersessionid: f646b254-c0ab-43b3-9d69-665d0cdbf4c3
date: Tue, 31 Mar 2020 13:54:44 GMT
x-download-options: noopen
content-type: text/plain
access-control-allow-origin: https://word-view.officeapps.live.com
access-control-expose-headers: X-EndSession, X-CorrelationId, X-OfficeFE, X-NewKey, X-bULS-SuppressionETag, X-bULS-SuppressedTags
cache-control: private
x-msedge-ref: Ref A: 48210E293EF94DB7865D4D05680775CA Ref B: AMS04EDGE0811 Ref C: 2020-03-31T13:54:45Z
timing-allow-origin: *

POST
H2 200 RemoteUls.ashx Show response
word-view.officeapps.live.com/wv/ Frame E135 0
168 B 103ms
103ms XHR
text/plain 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/RemoteUls.ashx?build=16.0.12728.35950&waccluster=US6

Requested by

Host: c1-officeapps-15.cdn.office.net
URL: https://c1-officeapps-15.cdn.office.net/wv/s/161272835950_App_Scripts/MicrosoftAjax.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Origin: https://word-view.officeapps.live.com
X-AccessToken: 4wwMkNr184Dv2DXEo4QaLMX9nI9j3ZFN8XoI5zrVIR3nL5ntuXBuuXqxotDySUbOcPi6yCqco_Wy7ofy7d05dlDizanJQV_qdbS0pGSC8AKwQKMkyzczyRkuz_chtv9reEVHJO2G-Qv1wtS2ai0eF0CA
X-UserSessionId: f646b254-c0ab-43b3-9d69-665d0cdbf4c3
X-OfficeVersion: 16.0.12728.35950
X-Key: HQiq4q3V3SzAHy48LekgZqpq1XLULmtaiAhAEKEZfck=,637212596841457522
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=p4VmQpA1O0+JgBBX6AtNdw.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2F2739D85632D20637%21170&sc=host%3D%26qt%3DFolders%26pt%3Dem
Sec-Fetch-Dest: empty
X-Requested-With: XMLHttpRequest
X-UserType: WOPI
X-xhr: 1
X-AccessTokenTtl: 1587477283664
X-WacCluster: US6

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
x-officecluster: US6
x-officeversion: 16.0.12728.35950
x-officefe: BL6PEPF00003436
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: muidflt180=afd_waccluster,qx9=tasmigration015,skb=typeheadertest
content-length: 0
x-msedge-features: afd_waccluster,tasmigration015,typeheadertest
x-correlationid: 421658da-5322-4f24-ac98-0a618781609c
x-officefd: BL6PEPF000028DC
x-ccr: true
x-usersessionid: f646b254-c0ab-43b3-9d69-665d0cdbf4c3
date: Tue, 31 Mar 2020 13:54:44 GMT
x-download-options: noopen
content-type: text/plain
access-control-allow-origin: https://word-view.officeapps.live.com
access-control-expose-headers: X-EndSession, X-CorrelationId, X-OfficeFE, X-NewKey, X-bULS-SuppressionETag, X-bULS-SuppressedTags
cache-control: private
x-msedge-ref: Ref A: 253FC3FEBA514AEBB7181B7C16889250 Ref B: AMS04EDGE0811 Ref C: 2020-03-31T13:54:45Z
timing-allow-origin: *

GET
H/1.1 200
OK otelFull.min.js Show response
c1-word-view-15.cdn.office.net/wv/s/161272835950_App_Scripts/ Frame E135 154 KB
34 KB 8ms
7ms Script
application/javascript 2a02:26f0:1700:19d::1c24
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://c1-word-view-15.cdn.office.net/wv/s/161272835950_App_Scripts/otelFull.min.js

Requested by

Host: c1-word-view-15.cdn.office.net
URL: https://c1-word-view-15.cdn.office.net/wv/s/161272835950_App_Scripts/WordViewer.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:19d::1c24 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

363f53bb63157e10645cbe08f5c0c87fba34bed7d3391c0273fb7fe9b0b95c0f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://word-view.officeapps.live.com/
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

X-CorrelationId: 1b1a34a7-df3b-4e1b-a803-f4bc1b950bc0
Strict-Transport-Security: max-age=31536000
Content-Encoding: br
X-OFFICEFD: DB5PEPF0000382D
X-OfficeVersion: 16.0.12723.32652
X-OfficeFE: DB5PEPF00003541
P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
Date: Tue, 31 Mar 2020 13:54:45 GMT
Connection: keep-alive
X-MSEdge-Flight: muidflt180=afd_waccluster,qx9=tasmigration015,skb=typeheadertest
Content-Length: 33941
X-MSEdge-Features: afd_waccluster,tasmigration015,typeheadertest
Last-Modified: Sun, 29 Mar 2020 00:01:41 GMT
X-OfficeCluster: IE3
X-MSEdge-Ref: Ref A: 83FAB7EAED2A44B9B344135F2ABA803C Ref B: AMS04EDGE0413 Ref C: 2020-03-29T00:01:40Z
X-UserSessionId: 1b1a34a7-df3b-4e1b-a803-f4bc1b950bc0
ETag: W/"5ef95395d5d61:0"
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: public,max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *

POST
H2 200 RemoteTelemetry.ashx Show response
word-view.officeapps.live.com/wv/ Frame E135 0
470 B 106ms
106ms XHR
text/plain 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/RemoteTelemetry.ashx

Requested by

Host: c1-word-view-15.cdn.office.net
URL: https://c1-word-view-15.cdn.office.net/wv/s/161272835950_App_Scripts/WordViewer.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=p4VmQpA1O0+JgBBX6AtNdw.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2F2739D85632D20637%21170&sc=host%3D%26qt%3DFolders%26pt%3Dem
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-officefd: BL6PEPF00000741
x-officeversion: 16.0.12728.35950
x-officefe: BL6PEPF00003185
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: muidflt180=afd_waccluster,qx9=tasmigration015,skb=typeheadertest
content-length: 0
x-msedge-features: afd_waccluster,tasmigration015,typeheadertest
x-correlationid: 5e4dcb76-72cf-46c1-aa6c-a2798b5a9411
x-officecluster: US6
x-ccr: true
x-usersessionid: 5e4dcb76-72cf-46c1-aa6c-a2798b5a9411
date: Tue, 31 Mar 2020 13:54:44 GMT
x-download-options: noopen
access-control-allow-origin: https://word-view.officeapps.live.com
cache-control: private
x-msedge-ref: Ref A: DCE25CBEE6074CC7BFDC86BF281C1BC4 Ref B: AMS04EDGE0811 Ref C: 2020-03-31T13:54:45Z
timing-allow-origin: *

POST
H2 200 RemoteTelemetry.ashx
word-view.officeapps.live.com/wv/ Frame E135 0
199 B 117ms
117ms Other
text/plain 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/RemoteTelemetry.ashx

Requested by

Host: c1-word-view-15.cdn.office.net
URL: https://c1-word-view-15.cdn.office.net/wv/s/161272835950_App_Scripts/WordViewer.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=p4VmQpA1O0+JgBBX6AtNdw.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2F2739D85632D20637%21170&sc=host%3D%26qt%3DFolders%26pt%3Dem
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-officefd: BL6PEPF0000073A
x-officeversion: 16.0.12728.35950
x-officefe: BL6PEPF000030FC
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: muidflt180=afd_waccluster,qx9=tasmigration015,skb=typeheadertest
content-length: 0
x-msedge-features: afd_waccluster,tasmigration015,typeheadertest
x-correlationid: 0a3102cc-327a-4aff-8724-80557e41cdfe
x-officecluster: US6
x-ccr: true
x-usersessionid: 0a3102cc-327a-4aff-8724-80557e41cdfe
date: Tue, 31 Mar 2020 13:54:44 GMT
x-download-options: noopen
access-control-allow-origin: https://word-view.officeapps.live.com
cache-control: private
x-msedge-ref: Ref A: 3C8ECF5D7969486F8E7DE9B9B431FB0C Ref B: AMS04EDGE0811 Ref C: 2020-03-31T13:54:45Z
timing-allow-origin: *

GET
H/1.1 200
OK ping Show response
browser.pipe.aria.microsoft.com/ Frame E135 4 B
333 B 38ms
38ms XHR
application/json 52.114.74.44
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://browser.pipe.aria.microsoft.com/ping
Requested by: Host: c1-word-view-15.cdn.office.net
URL: https://c1-word-view-15.cdn.office.net/wv/s/161272835950_App_Scripts/otelFull.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.114.74.44 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-HTTPAPI/2.0 /
Resource Hash: c48b5b1a9776c84602de2306d7903a7241158a5077e7a8519af75c33441b8334

Request headers

Referer: https://word-view.officeapps.live.com/
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 31 Mar 2020 13:54:44 GMT
Server: Microsoft-HTTPAPI/2.0
Access-Control-Allow-Methods: GET
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://word-view.officeapps.live.com
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: *
Content-Length: 4

GET
H2 200 translation.ashx Show response
word-view.officeapps.live.com/wv/ Frame E135 1 KB
1 KB 692ms
692ms XHR
text/html 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/translation.ashx?WOPIsrc=https%3A%2F%2Fwopi%2Eonedrive%2Ecom%2Fwopi%2Ffiles%2F2739D85632D20637%21170&access_token=4wwMkNr184Dv2DXEo4QaLMX9nI9j3ZFN8XoI5zrVIR3nL5ntuXBuuXqxotDySUbOcPi6yCqco%5FWy7ofy7d05dlDizanJQV%5FqdbS0pGSC8AKwQKMkyzczyRkuz%5Fchtv9reEVHJO2G%2DQv1wtS2ai0eF0CA&access_token_ttl=1587477283664&z=aMjczOUQ4NTYzMkQyMDYzNyExNzAuNA&uilang=en-US

Requested by

Host: c1-officeapps-15.cdn.office.net
URL: https://c1-officeapps-15.cdn.office.net/wv/s/161272835950_App_Scripts/MicrosoftAjax.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

a719a01cdecb973a3ae5b6b425deef5e6c7432c0850bb86c9d5cc43723eba2de

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

X-UserSessionId: f646b254-c0ab-43b3-9d69-665d0cdbf4c3
X-OfficeVersion: 16.0.12728.35950
X-Key: HQiq4q3V3SzAHy48LekgZqpq1XLULmtaiAhAEKEZfck=,637212596841457522
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=p4VmQpA1O0+JgBBX6AtNdw.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2F2739D85632D20637%21170&sc=host%3D%26qt%3DFolders%26pt%3Dem
Sec-Fetch-Dest: empty
X-Requested-With: XMLHttpRequest
X-UserType: WOPI
X-xhr: 1
X-WacCluster: US6

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
x-officecluster: US6
x-officeversion: 16.0.12728.35950
x-officefe: BL6PEPF0000311A
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
x-msedge-flight: muidflt180=afd_waccluster,qx9=tasmigration015,skb=typeheadertest
content-length: 975
pragma: no-cache
x-msedge-features: afd_waccluster,tasmigration015,typeheadertest
x-correlationid: 2feb06b5-c7a2-4f9f-901a-160e6b5815d2
x-officefd: BL6PEPF00000740
x-ccr: true
x-usersessionid: f646b254-c0ab-43b3-9d69-665d0cdbf4c3
date: Tue, 31 Mar 2020 13:54:45 GMT
vary: Accept-Encoding
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store
x-msedge-ref: Ref A: 92D2FB51BDD34855948E2573115F9990 Ref B: AMS04EDGE0811 Ref C: 2020-03-31T13:54:45Z
timing-allow-origin: *
expires: -1

POST
H/1.1 200
OK / Show response
browser.pipe.aria.microsoft.com/Collector/3.0/ Frame E135 0
414 B 46ms
45ms XHR
application/json 52.114.74.44
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://browser.pipe.aria.microsoft.com/Collector/3.0/?qsp=true&content-type=application%2Fbond-compact-binary&client-id=NO_AUTH&sdk-version=AWT-Web-JS-1.8.6&x-apikey=e064ef4d9cdb454d9eddb2f7f7a94c83-89a6d9df-7218-4efd-bcd4-16ea059deea2-7672,ff7e2f12a4be407096fc01eeb760eda3-eeeb63cf-35d9-4734-ab45-66a873412359-7045,79b56d2f6f2444f1a3d7f7c7f12bcc0c-f47f5fe6-ed89-42f6-8a43-cea0f5930b17-7407&client-time-epoch-millis=1585662887323&time-delta-to-apply-millis=use-collector-delta
Requested by: Host: c1-word-view-15.cdn.office.net
URL: https://c1-word-view-15.cdn.office.net/wv/s/161272835950_App_Scripts/otelFull.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.114.74.44 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-HTTPAPI/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://word-view.officeapps.live.com/
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Tue, 31 Mar 2020 13:54:46 GMT
Server: Microsoft-HTTPAPI/2.0
time-delta-millis: 5
Access-Control-Allow-Methods: POST
Content-Type: application/json
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: kill-tokens, kill-duration-seconds, time-delta-millis
Connection: close
Access-Control-Allow-Headers: Accept, Content-Type, Content-Encoding, Client-Id
Content-Length: 0

GET
H2 200 Plt.mvc
onedrive.live.com/Handlers/ 42 B
520 B 128ms
127ms Image
image/gif 13.107.42.13
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onedrive.live.com/Handlers/Plt.mvc?bicild=&v=0.0.0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

13.107.42.13 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://onedrive.live.com/embed?cid=2739D85632D20637&resid=2739D85632D20637%21170&authkey=AO8mJO8H4E-Cr4E&em=2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
x-msedge-ref: Ref A: DDF180B5C6634BBFB5346E60451121AB Ref B: ZRHEDGE0514 Ref C: 2020-03-31T13:54:49Z
x-odwebserver: canadacentral0-odwebpl
vary: Accept-Encoding
content-type: image/gif
status: 200
cache-control: private, max-age=31536000
date: Tue, 31 Mar 2020 13:54:49 GMT
x-msnserver: RD0003FFC9EE3D
expires: Wed, 31 Mar 2021 13:54:49 GMT

POST
H2 404 log Show response
onedrive.live.com/ 77 KB
77 KB 165ms
164ms XHR
text/html 13.107.42.13
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://onedrive.live.com/log

Requested by

Host: onedrive.live.com
URL: https://onedrive.live.com/embed?cid=2739D85632D20637&resid=2739D85632D20637%21170&authkey=AO8mJO8H4E-Cr4E&em=2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

13.107.42.13 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

f5fa48e6d7d8c4fcaefed3ce1e4deb5b570f6c94a15bf37a19811b9a4a370274

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://onedrive.live.com/embed?cid=2739D85632D20637&resid=2739D85632D20637%21170&authkey=AO8mJO8H4E-Cr4E&em=2
Origin: https://onedrive.live.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
x-msnserver: RD0003FFC9EE3D
x-content-type-options: nosniff
x-msedge-ref: Ref A: 2DD5E2EB9FF645019EB8636BDC14F5F5 Ref B: ZRHEDGE0514 Ref C: 2020-03-31T13:54:53Z
x-odwebserver: canadacentral0-odwebpl
content-type: text/html; charset=utf-8
status: 404
cache-control: no-cache, no-store
date: Tue, 31 Mar 2020 13:54:53 GMT
content-length: 78485
expires: -1

Verdicts & Comments Add Verdict or Comment

153 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

8 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
word-view.officeapps.live.com/	1970-01-19 10:38:45	Name: DcLcid Value: ui=1033&data=1033
word-view.officeapps.live.com/	1969-12-31 23:59:59	Name: BIGipCookie Value: 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
word-view.officeapps.live.com/wv	1969-12-31 23:59:59	Name: Value:
.live.com/	1969-12-31 23:59:59	Name: BP Value: l=SDX.Skydrive&FR=&ST=
.live.com/	1970-01-19 08:37:47	Name: wla42 Value:
.live.com/	1969-12-31 23:59:59	Name: xidseq Value: 1
.live.com/	1969-12-31 23:59:59	Name: xid Value: 5eb76443-fad5-44db-a645-60b65cd5bbfd&&RD00155D0320A6&127
.live.com/	1969-12-31 23:59:59	Name: E Value: P:6hpfEHvV14g=:ga1g4qgq/zQiFd2nNHINTw8uFGuuIq7Aqs99DEGBND8=:F

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

browser.pipe.aria.microsoft.com
c.bing.com
c.live.com
c.s-microsoft.com
c1-officeapps-15.cdn.office.net
c1-word-view-15.cdn.office.net
js.live.net
onedrive.live.com
spoprod-a.akamaihd.net
uhf.microsoft.com
word-view.officeapps.live.com
104.109.78.246
13.107.42.13
23.55.161.136
2620:1ec:a92::171
2620:1ec:c11::200
2a02:26f0:1700:184::1c24
2a02:26f0:1700:193::2b57
2a02:26f0:1700:19d::1c24
2a02:26f0:1700:1aa::356e
52.114.74.44
52.142.114.2
06fe78141d1f3a435441a17ec8f9f46af7000af35aa0133c699c537d663607d0
07ec698b1036cdfbb8892f02d9510f5f671284fca9fa003b883996da040a444b
1394b1c43663fa167060186091800d4cae0696af7b64c14f2848b44124074c7e
19b132c556e33c005d831e1f6adcf21d7ff16f39ccf9c7fba0d2903099c0afeb
234cae682920ab63f3184948f1e4103b89201a274977ed31097b844cc323afa1
363f53bb63157e10645cbe08f5c0c87fba34bed7d3391c0273fb7fe9b0b95c0f
390577d35c959ffe7dd2af4519c04410a04fdc4a433b151e27b049fc4a1ab3e9
3d785eb0a0168e5c79e66aa0085a932d5fe2ad04f3577547e2267fa589df677d
455be57e5ca76be462428c7b127d03d0245952b7e00ca14e8bcb3bfe7584c758
4d54a5f9a58647882e3ecda9c1c0ef87af16911d42ad51b4e8b718f84443c553
5c15c38a2b7554cab332dfb9e87398220fcb9a285e18905a20a50b439cba7ccb
5ceaac1352e2df6ef57642cda087e1f30faaf8cadb29dcfa0fa1f84251d758ea
66c5d9882a954332c4aebef2386c7713a226fa617ddcd08d22f24e53ba5ec066
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
85115acdc1b70c4a47daa1da31011b67bde417cbb718c5b3c73a914b82781bfd
8d518e1a1c70ae6c3bd8892a086e0d172c1b37dd729b0dd0d6952f7710204677
900b6b85fec98a690c0061c93ec99f13bed5f960580ad13ddcca4198089085b1
910f1f3ce687cfde1a12415fe73a4465e7a2f851177c33ca8e9f3b5c5f93c41c
96c8b7290ca93e5644354a6d1f25ab06128213b92493145a6f122bd458e4a662
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
a188e6c4c6729c3abbe6a34e45b5c3d7d65ffc659e1baa46632ffb1c876e815c
a3596c17dad9a003d0bfbe0b7ba6765f51391b5c3943660316f01c8e77b323db
a719a01cdecb973a3ae5b6b425deef5e6c7432c0850bb86c9d5cc43723eba2de
b44650e095619191450e5ca8cfc16c846c830e338e5cbf0d33b960dae14ffdd7
b7ab99f404e84cb71d274c9dca01c0b4a68b7adb20309c5f04387cb809cc0547
b8905a54e45aca33fb5d275a635737bf7e287679db6bd782ff167273b79883fc
bd88d1e741693ab877b020059b46be7cf4ef62b46017b2489a8cd1bf9ce5b9fc
c0153afba2ee2258329d951763cc14531c98cdecfc22d55be2597cfad0cc6e54
c14671f66d7d392c4f89814c14edf9dc32d08747332307704f08be20a50fe905
c48b5b1a9776c84602de2306d7903a7241158a5077e7a8519af75c33441b8334
d091e132e22954ecf7403cce92be661694c7d32362e4a084d4824bff921e7127
d4c9bd86a5465d8414b7a10438d28110836126b387990d492fe545a5e701904a
d6c15974b6181a68e9b74e4f38fbac81d640569ef0fbbaa3381cc59683a9763f
dbc2fc64931a50273f8bb4aedbb315863756745b2b49ccfd0935aa8fa5a078fe
e2bf7da51e85c834d5c051092c444ee3011f518773d51c253090505356ef9f73
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
eb9d3e2d65ecf668ac450344775045611533883d46fe9eeb7e33b7dc1058bf24
ec5f43d953c37c2a085644890b2c4a846f4864105e78ed59238de28df67d4d0b
f5fa48e6d7d8c4fcaefed3ce1e4deb5b570f6c94a15bf37a19811b9a4a370274

onedrive.live.com Open in urlscan Pro 13.107.42.13 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

50 Requests

100 %HTTPS

55 %IPv6

7 Domains

11 Subdomains

11 IPs

4 Countries

1296 kBTransfer

4069 kBSize

8 Cookies

0 Outgoing links

Redirected requests

50 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

onedrive.live.com Open in urlscan Pro
13.107.42.13 Public Scan

Screenshot
Live screenshot

Full Image

50
Requests

100 %
HTTPS

55 %
IPv6

7
Domains

11
Subdomains

11
IPs

4
Countries

1296 kB
Transfer

4069 kB
Size

8
Cookies

50 HTTP transactions
3 data transactions