www.microsoft.com Open in urlscan Pro
2a02:26f0:1700:1ab::356e Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-window...
Submission: On February 08 via api (February 8th 2021, 9:02:58 am UTC) from DE

Summary HTTP 56 Redirects Links 58 Behaviour Indicators

Summary

This website contacted 12 IPs in 3 countries across 7 domains to perform 56 HTTP transactions. The main IP is 2a02:26f0:1700:1ab::356e, located in Ascension Island and belongs to AKAMAI-ASN1, NL. The main domain is www.microsoft.com.
TLS certificate: Issued by Microsoft RSA TLS CA 01 on August 28th 2020. Valid for: a year.

This is the only time www.microsoft.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
24	2a02:26f0:170... 2a02:26f0:1700:1ab::356e	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	2a02:26f0:10c... 2a02:26f0:10c:5a9::2957	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2620:1ec:bdf::13 2620:1ec:bdf::13	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	152.199.19.160 152.199.19.160	15133 (EDGECAST) (EDGECAST)
1	2.16.186.32 2.16.186.32	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a02:26f0:6c0... 2a02:26f0:6c00::210:ba28	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
12	107.154.114.97 107.154.114.97	19551 (INCAPSULA) (INCAPSULA)
3	2a02:26f0:170... 2a02:26f0:1700:181::37	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	40.77.226.250 40.77.226.250	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
5	2a02:26f0:10c... 2a02:26f0:10c:5a0::356e	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	40.126.31.143 40.126.31.143	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
56	12

24 2a02:26f0:1700:1ab::356e (Ascension Island)

ASN20940 (AKAMAI-ASN1, NL)

www.microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a02:26f0:10c:5a9::2957 (Ascension Island)

ASN20940 (AKAMAI-ASN1, NL)

assets.onestore.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:bdf::13 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

wcpstatic.microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 152.199.19.160 (United States)

ASN15133 (EDGECAST, US)

az725175.vo.msecnd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.16.186.32 (Ascension Island)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-16-186-32.deploy.static.akamaitechnologies.com

statics-marketingsites-wcus-ms-com.akamaized.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6c00::210:ba28 (Ascension Island)

ASN20940 (AKAMAI-ASN1, NL)

img-prod-cms-rt-microsoft-com.akamaized.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 107.154.114.97 (United States)

ASN19551 (INCAPSULA, US)
PTR: 107.154.114.97.ip.incapdns.net

cloudblogs.microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a02:26f0:1700:181::37 (Ascension Island)

ASN20940 (AKAMAI-ASN1, NL)

mem.gfx.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 40.77.226.250 (Dublin, Ireland)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

web.vortex.data.microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a02:26f0:10c:5a0::356e (Ascension Island)

ASN20940 (AKAMAI-ASN1, NL)

c.s-microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 40.126.31.143 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

login.live.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
41	microsoft.com www.microsoft.com wcpstatic.microsoft.com cloudblogs.microsoft.com web.vortex.data.microsoft.com	2 MB
5	s-microsoft.com c.s-microsoft.com	147 KB
3	gfx.ms mem.gfx.ms	57 KB
3	onestore.ms assets.onestore.ms	211 KB
2	akamaized.net statics-marketingsites-wcus-ms-com.akamaized.net img-prod-cms-rt-microsoft-com.akamaized.net	5 KB
1	live.com login.live.com
1	msecnd.net az725175.vo.msecnd.net	18 KB
56	7

	Domain	Requested by
24	www.microsoft.com	www.microsoft.com
12	cloudblogs.microsoft.com	www.microsoft.com
5	c.s-microsoft.com	assets.onestore.ms
4	web.vortex.data.microsoft.com	az725175.vo.msecnd.net
3	mem.gfx.ms	www.microsoft.com mem.gfx.ms
3	assets.onestore.ms	www.microsoft.com
1	login.live.com	mem.gfx.ms
1	img-prod-cms-rt-microsoft-com.akamaized.net	www.microsoft.com
1	statics-marketingsites-wcus-ms-com.akamaized.net	www.microsoft.com
1	az725175.vo.msecnd.net	www.microsoft.com
1	wcpstatic.microsoft.com	www.microsoft.com
56	11

This site contains links to these domains. Also see Links.

Domain
go.microsoft.com
azure.microsoft.com
servicetrust.microsoft.com
products.office.com
dynamics.microsoft.com
powerplatform.microsoft.com
powerbi.microsoft.com
visualstudio.microsoft.com
docs.microsoft.com
developer.microsoft.com
fasttrack.microsoft.com
partner.microsoft.com
partnercenter.microsoft.com
appsource.microsoft.com
azuremarketplace.microsoft.com
events.microsoft.com
twitter.com
www.linkedin.com
facebook.com
blogs.windows.com
blogs.technet.microsoft.com
answers.microsoft.com
www.facebook.com
account.microsoft.com
channel9.msdn.com
careers.microsoft.com
news.microsoft.com
privacy.microsoft.com
support.microsoft.com
choice.microsoft.com

Subject Issuer	Validity	Valid
www.microsoft.com Microsoft RSA TLS CA 01	`2020-08-28` - `2021-08-28`	a year	crt.sh
wildcard.onestore.ms Microsoft RSA TLS CA 01	`2021-01-19` - `2022-01-19`	a year	crt.sh
wcpstatic.microsoft.com DigiCert SHA2 Secure Server CA	`2020-09-15` - `2021-09-15`	a year	crt.sh
*.vo.msecnd.net DigiCert SHA2 Secure Server CA	`2020-11-16` - `2021-11-10`	a year	crt.sh
a248.e.akamai.net DigiCert Secure Site ECC CA-1	`2020-07-15` - `2021-09-13`	a year	crt.sh
cloudblogs.microsoft.com Microsoft RSA TLS CA 02	`2020-11-20` - `2021-11-20`	a year	crt.sh
mem.gfx.ms Microsoft RSA TLS CA 02	`2020-11-11` - `2021-11-11`	a year	crt.sh
*.vortex.data.microsoft.com Microsoft RSA TLS CA 02	`2020-10-05` - `2021-10-05`	a year	crt.sh
graph.windows.net DigiCert SHA2 Secure Server CA	`2020-10-22` - `2021-10-21`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
Frame ID: 55F738E765CDB5A7BA13BABF92CE6BDC
Requests: 58 HTTP requests in this frame

Frame: https://login.live.com/me.srf?wa=wsignin1.0&wreply=https%3A%2F%2Fwww.microsoft.com&uaid=9022b6a2-f9b4-44ae-71e9-cb6401a6dccd&partnerId=mssecurity
Frame ID: 6A6F063D7C967905ECBDBA30A3A1C9AA
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i

Page Statistics

56
Requests

100 %
HTTPS

55 %
IPv6

7
Domains

11
Subdomains

12
IPs

3
Countries

2090 kB
Transfer

4086 kB
Size

7
Cookies

58 Outgoing links

These are links going to different origins than the main page.

URL: https://go.microsoft.com/fwlink/?LinkId=521839
Title: Privacy Statement

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en-us/services/key-vault/
Title: Azure Key Vault

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en-us/services/azure-dedicated-hsm/
Title: Azure Dedicated HSM

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en-us/services/iot-central/
Title: Azure IoT Central

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en-us/services/azure-sphere/
Title: Azure Sphere

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en-us/services/active-directory/
Title: Azure Active Directory

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en-us/services/application-gateway/
Title: Azure Application Gateway

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en-us/services/vpn-gateway/
Title: Azure VPN Gateway

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en-us/services/ddos-protection/
Title: Azure DDoS Protection

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en-us/services/firewall-manager/
Title: Azure Firewall manager

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en-us/services/frontdoor/
Title: Azure Front-door

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en-us/services/web-application-firewall/
Title: Azure Web Application Firewall

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en-us/services/security-center/
Title: Azure Security Center

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en-us/services/azure-sentinel/
Title: Azure Sentinel

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en-us/services/azure-defender/
Title: Azure Defender

Search URL Search Domain Scan URL

URL: https://servicetrust.microsoft.com/ViewPage/HomePage
Title: Service Trust Portal

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/
Title: Azure

Search URL Search Domain Scan URL

URL: https://products.office.com/en-us/business/office
Title: Office 365

Search URL Search Domain Scan URL

URL: https://dynamics.microsoft.com/en-us/
Title: Dynamics 365

Search URL Search Domain Scan URL

URL: https://powerplatform.microsoft.com/en-us
Title: Power Platform

Search URL Search Domain Scan URL

URL: https://powerbi.microsoft.com/en-us/
Title: Power BI

Search URL Search Domain Scan URL

URL: https://visualstudio.microsoft.com/
Title: Visual Studio

Search URL Search Domain Scan URL

URL: https://go.microsoft.com/fwlink/?linkid=2026462
Title: Microsoft Advertising

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/services/cognitive-services/
Title: Azure Cognitive Services

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/
Title: Docs

Search URL Search Domain Scan URL

URL: https://developer.microsoft.com/
Title: Developer Center

Search URL Search Domain Scan URL

URL: https://developer.microsoft.com/en-us/windows
Title: Windows Dev Center

Search URL Search Domain Scan URL

URL: https://fasttrack.microsoft.com/office
Title: FastTrack

Search URL Search Domain Scan URL

URL: https://partner.microsoft.com/
Title: Partner Network

Search URL Search Domain Scan URL

URL: https://partnercenter.microsoft.com/partner/home
Title: Partner Center

Search URL Search Domain Scan URL

URL: https://appsource.microsoft.com/
Title: AppSource

Search URL Search Domain Scan URL

URL: https://azuremarketplace.microsoft.com/marketplace/
Title: Azure Marketplace

Search URL Search Domain Scan URL

URL: https://events.microsoft.com/
Title: Events

Search URL Search Domain Scan URL

URL: https://twitter.com/intent/tweet/?text=Detecting%20threat%20actors%20in%20recent%20German%20industrial%20attacks%20with%20Windows%20Defender%20ATP&url=https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fblog%2F2017%2F01%2F25%2Fdetecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp%2F
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fblog%2F2017%2F01%2F25%2Fdetecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp%2F&title=Detecting%20threat%20actors%20in%20recent%20German%20industrial%20attacks%20with%20Windows%20Defender%20ATP&source=https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fblog%2F2017%2F01%2F25%2Fdetecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp%2F
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://facebook.com/sharer/sharer.php?u=https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fblog%2F2017%2F01%2F25%2Fdetecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp%2F
Title: Facebook

Search URL Search Domain Scan URL

URL: https://blogs.windows.com/business/2016/12/06/windows-10-creators-update-advances-security-best-class-modern-tools
Title: Windows 10 Creators Update

Search URL Search Domain Scan URL

URL: https://blogs.technet.microsoft.com/windowsfurunternehmen/2017/01/25/cyber-angriff-auf-deutsche-industrie-mithilfe-von-windows-defender-atp-aufgedeckt/
Title: German

Search URL Search Domain Scan URL

URL: https://answers.microsoft.com/en-us/protect
Title: Microsoft community

Search URL Search Domain Scan URL

URL: https://twitter.com/WDSecurity
Title: @WDSecurity

Search URL Search Domain Scan URL

URL: https://www.facebook.com/MsftWDSI/
Title: Windows Defender Security Intelligence

Search URL Search Domain Scan URL

URL: https://twitter.com/@MSFTSecurity
Title: @MSFTSecurity

Search URL Search Domain Scan URL

URL: https://account.microsoft.com/
Title: Account profile

Search URL Search Domain Scan URL

URL: https://go.microsoft.com/fwlink/?linkid=2139749
Title: Microsoft Store support

Search URL Search Domain Scan URL

URL: https://go.microsoft.com/fwlink/p/?LinkID=824764&clcid=0x409
Title: Returns

Search URL Search Domain Scan URL

URL: https://account.microsoft.com/orders
Title: Order tracking

Search URL Search Domain Scan URL

URL: https://products.office.com/en-us/academic/compare-office-365-education-plans
Title: Office 365 for schools

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en-us/community/education/
Title: Microsoft Azure in education

Search URL Search Domain Scan URL

URL: https://go.microsoft.com/fwlink/?LinkID=808093
Title: AppSource

Search URL Search Domain Scan URL

URL: https://developer.microsoft.com/en-us/store/register
Title: Microsoft developer program

Search URL Search Domain Scan URL

URL: https://channel9.msdn.com/
Title: Channel 9

Search URL Search Domain Scan URL

URL: https://developer.microsoft.com/en-us/office
Title: Office Dev Center

Search URL Search Domain Scan URL

URL: https://careers.microsoft.com/
Title: Careers

Search URL Search Domain Scan URL

URL: https://news.microsoft.com/
Title: Company news

Search URL Search Domain Scan URL

URL: https://privacy.microsoft.com/en-us
Title: Privacy at Microsoft

Search URL Search Domain Scan URL

URL: https://support.microsoft.com/en-us/contactus
Title: Contact Microsoft

Search URL Search Domain Scan URL

URL: https://go.microsoft.com/fwlink/?LinkID=206977
Title: Terms of use

Search URL Search Domain Scan URL

URL: https://choice.microsoft.com/
Title: About our ads

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

56 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/ 142 KB
31 KB 744ms
723ms Document
text/html 2a02:26f0:1700:1ab::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:1ab::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

99e2919bb976d17737c20b5ff82271437d26c15fab363c5b277bdcbb03bcff59

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.microsoft.com
:scheme: https
:path: /security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

content-type: text/html; charset=UTF-8
x-frame-options: SAMEORIGIN
x-pingback
link: <https://mssecurity.wpengine.com/wp-json/>; rel="https://api.w.org/" <https://mssecurity.wpengine.com/?p=75759>; rel=shortlink
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
content-security-policy: upgrade-insecure-requests
x-cacheable: SHORT
cache-control: max-age=600, must-revalidate
x-cache-group: normal
content-encoding: gzip
content-length: 30556
x-edgeconnect-midmile-rtt: 120
x-edgeconnect-origin-mex-latency: 466
date: Mon, 08 Feb 2021 09:02:34 GMT
vary: Accept-Encoding
set-cookie: ak_bmsc=9DD7F54C3B2E5A7BCB39B0BDA569B2295C7B6B6DC71C00002AFE2060DA310F37~plAiNZ8BUsfokAX7LTFQwoi9F7mvd8LNywj2ZhNFW6u2AKOHYrIxHvMIbFVZGeRl5FfH3gjnhv888edF4CFLXoNDvxb/0GoqYe94i//jaXJONIRfJY9fbAzdMmkSQVIB4A3fLE8zkEjCz/zrOluy95TNO8mRKD9faf07GyqsGZU9W5M+qyiVZdqwuKFqMpLM6jIjyTCS+sCj5besSE1w5LSjoxzG99/8+DTCOFa676cfxQgw7Ab6owVfYen8hT5xsI; expires=Mon, 08 Feb 2021 11:02:34 GMT; max-age=7200; path=/; domain=.microsoft.com; HttpOnly
tls_version: tls1.3
strict-transport-security: max-age=31536000
x-rtag: RT

GET
H2 200 style.min.css
www.microsoft.com/security/blog/wp-includes/css/dist/block-library/ 52 KB
8 KB 220ms
216ms Stylesheet
text/css 2a02:26f0:1700:1ab::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-includes/css/dist/block-library/style.min.css?ver=5.4.2

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:1ab::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

bca7af0b45b6fc6a2064e8e7a34f2041f3e77261e63f0257209bcde6bc40545d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency: 5
date: Mon, 08 Feb 2021 09:02:34 GMT
content-encoding: gzip
last-modified: Thu, 14 May 2020 18:36:11 GMT
x-rtag: RT
x-edgeconnect-midmile-rtt: 118
etag: W/"5ebd8f9b-d159"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
tls_version: tls1.3
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 7855

GET
H2 200 styles.css
www.microsoft.com/security/blog/wp-content/plugins/wds-ms-inline-interruption-styles-officeblogs/css/ 10 KB
4 KB 219ms
216ms Stylesheet
text/css 2a02:26f0:1700:1ab::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-content/plugins/wds-ms-inline-interruption-styles-officeblogs/css/styles.css?ver=1612774953

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:1ab::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

b201ab52de2c92539f7a276b6cf170b1bdf0f3705f1b6ab9597517d030afefe4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency: 4
date: Mon, 08 Feb 2021 09:02:34 GMT
content-encoding: gzip
last-modified: Thu, 01 Oct 2020 00:16:06 GMT
x-rtag: RT
x-edgeconnect-midmile-rtt: 117
etag: W/"5f751fc6-29a7"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
tls_version: tls1.3
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 3921

GET
H2 200 uhf-search-ui.css
www.microsoft.com/security/blog/wp-content/plugins/wds-ms-searchwp/features/uhf-search-ui/ 160 B
392 B 217ms
214ms Stylesheet
text/css 2a02:26f0:1700:1ab::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-content/plugins/wds-ms-searchwp/features/uhf-search-ui/uhf-search-ui.css?ver=1.0.1

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:1ab::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

f258c099e2bb029f6c9d5e9900a78f53347a16b43aa1e37a9f9c1a1539e0748d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency: 4
date: Mon, 08 Feb 2021 09:02:34 GMT
last-modified: Thu, 01 Oct 2020 00:16:06 GMT
x-rtag: RT
x-edgeconnect-midmile-rtt: 116
etag: "5f751fc6-a0"
strict-transport-security: max-age=31536000
content-type: text/css
access-control-allow-origin: *
tls_version: tls1.3
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 160

GET
H2 200 mwf-west-european-default.min.css
assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/css/ 581 KB
71 KB 203ms
173ms Stylesheet
text/css 2a02:26f0:10c:5a9::2957
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/css/mwf-west-european-default.min.css?ver=5.4.2

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:10c:5a9::2957 , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /

Resource Hash

4919e80f038d2b93f1184d1733ac35009643481735c7bc7aa31d8b56e118fc04

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 08 Feb 2021 09:02:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Thu, 01 Feb 2018 02:22:19 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
content-md5: QshXRY8/Osc4oVEHlL0Pbw==
etag: "0x8D5691A9EA468B4"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-lease-state,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control: max-age=900
accept-ranges: bytes
content-length: 71704
x-ms-lease-state: available

GET
H2 200 style.css
www.microsoft.com/security/blog/wp-content/themes/ms_s/ 342 B
486 B 221ms
218ms Stylesheet
text/css 2a02:26f0:1700:1ab::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-content/themes/ms_s/style.css?ver=1.0.0

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:1ab::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

f174b3ce00dc0ef25fe0867dae1da92a595c50f730dbe2cd1fd7f29546034e81

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency: 7
date: Mon, 08 Feb 2021 09:02:34 GMT
content-encoding: gzip
last-modified: Thu, 01 Oct 2020 00:16:11 GMT
x-rtag: RT
x-edgeconnect-midmile-rtt: 120
etag: W/"5f751fcb-156"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
tls_version: tls1.3
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 238

GET
H2 200 style.min.css
www.microsoft.com/security/blog/wp-content/themes/ms-security/ 64 KB
12 KB 218ms
215ms Stylesheet
text/css 2a02:26f0:1700:1ab::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-content/themes/ms-security/style.min.css?ver=2.4.3

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:1ab::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

1fd0aad556b3673a3027b1103e86b68798b4e21c63653f5215fac96a9e122da2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency: 8
date: Mon, 08 Feb 2021 09:02:34 GMT
content-encoding: gzip
last-modified: Mon, 01 Feb 2021 20:28:48 GMT
x-rtag: RT
x-edgeconnect-midmile-rtt: 115
etag: W/"60186480-100ac"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
tls_version: tls1.3
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 11990

GET
H2 200 wcp-consent.js Show response
wcpstatic.microsoft.com/mscc/lib/v2/ 249 KB
74 KB 33ms
10ms Script
application/javascript 2620:1ec:bdf::13
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2620:1ec:bdf::13 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: 208edbed32b2adac9446df83caa4a093a261492ba6b8b3bcfe6a75efb8b70294

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 08 Feb 2021 09:02:33 GMT
content-encoding: gzip
vary: Accept-Encoding
content-md5: OLdpUi3Q5MKZjJA0pU4XTg==
age: 34810
x-cache: HIT
content-length: 75124
x-ms-lease-status: unlocked
last-modified: Wed, 14 Oct 2020 22:31:12 GMT
etag: 0x8D87090DB39FE9E
x-azure-ref: 0Kv4gYAAAAADki5+o3z+hQrh6K08QL6fkRlJBRURHRTEwMDcAMzliNDYxNTctY2I5ZS00OWI3LWE2NWEtODcyMmEzZjgyNGU0
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 1e7495e4-701e-0030-5aa8-fd1662000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: max-age=43200
x-ms-version: 2009-09-19

GET
H2 200 jquery.js Show response
www.microsoft.com/security/blog/wp-includes/js/jquery/ 95 KB
34 KB 238ms
236ms Script
application/javascript 2a02:26f0:1700:1ab::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:1ab::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency: 9
date: Mon, 08 Feb 2021 09:02:34 GMT
content-encoding: gzip
last-modified: Tue, 04 Feb 2020 18:25:19 GMT
x-rtag: RT
x-edgeconnect-midmile-rtt: 122
etag: W/"5e39b70f-17a69"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
tls_version: tls1.3
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 34019

GET
H2 200 jquery-migrate.min.js Show response
www.microsoft.com/security/blog/wp-includes/js/jquery/ 10 KB
4 KB 226ms
224ms Script
application/javascript 2a02:26f0:1700:1ab::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:1ab::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency: 4
date: Mon, 08 Feb 2021 09:02:34 GMT
content-encoding: gzip
last-modified: Fri, 20 May 2016 06:11:28 GMT
x-rtag: RT
x-edgeconnect-midmile-rtt: 115
etag: W/"573eaa90-2748"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
tls_version: tls1.3
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 4016

GET
H2 200 mwf-main.var.min.js Show response
assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/scripts/ 302 KB
70 KB 189ms
160ms Script
application/x-javascript 2a02:26f0:10c:5a9::2957
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/scripts/mwf-main.var.min.js?ver=v1.23.2+5182151

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:10c:5a9::2957 , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /

Resource Hash

b1d83c2d49c49ea38d578afa752aaec44a86d069d6ce2d54460e2612fc31a102

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 08 Feb 2021 09:02:34 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
last-modified: Thu, 01 Feb 2018 02:22:29 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
content-md5: FuF99EJdzMvbQQjP24cb+Q==
etag: "0x8D5691AA4A90431"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-lease-state,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control: max-age=900
accept-ranges: bytes
content-length: 71185
x-ms-lease-state: available

GET
H2 200 jsll-4.js Show response
az725175.vo.msecnd.net/scripts/ 55 KB
18 KB 72ms
17ms Script
text/javascript 152.199.19.160
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://az725175.vo.msecnd.net/scripts/jsll-4.js
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.19.160 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (ama/8B30) /
Resource Hash: 196d3e71a396f75f52b94bf617e5f4474b85ca2f358f32cc81d3521731fde20c

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 08 Feb 2021 09:02:34 GMT
content-encoding: gzip
content-md5: rYVFtUp9d7HvDgKvthWhBw==
age: 1477
x-cache: HIT
content-length: 18415
x-ms-lease-status: unlocked
last-modified: Thu, 12 Nov 2020 19:39:26 GMT
server: ECAcc (ama/8B30)
etag: 0x8D88742AA533F08
vary: Accept-Encoding
content-type: text/javascript; charset="utf-8"
x-ms-request-id: e81b290f-d01e-000e-2df5-fd2320000000
cache-control: public, max-age=1800, immutable
x-ms-version: 2009-09-19

GET
H2 200 54-41a2a0
www.microsoft.com/onerfstatics/marketingsites-wcus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/c2-fe9af7/b9-ae4fa3/fe-321a68/42-1cb85f/3e-dcc204/a1-352ee3/fa-ea79ed/ 165 KB
22 KB 150ms
148ms Stylesheet
text/css 2a02:26f0:1700:1ab::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/onerfstatics/marketingsites-wcus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/c2-fe9af7/b9-ae4fa3/fe-321a68/42-1cb85f/3e-dcc204/a1-352ee3/fa-ea79ed/54-41a2a0?ver=2.0

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:1ab::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

ccb734f5ed4702b8e95450889f1a9b5a5fb86b697c2b2b390c608b466d8fadfb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

ms-operation-id: 70f7aca29af3df48b42e60c2ba5d7669
date: Mon, 08 Feb 2021 09:02:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-rtag: RT
x-s2: 2021-02-03T02:42:02
p3p: CP="CAO CONi OTR OUR DEM ONL"
x-activity-id: 94064a41-b9d1-4adb-82dc-6134e4d53aa9
tls_version: tls1.3
x-s1: 2021-02-03T02:42:01
ms-cv: yKnF75LtpEO8XFnJ.0
vary: Accept-Encoding
content-length: 22268
x-xss-protection: 1; mode=block
last-modified: Wed, 03 Feb 2021 02:42:01 GMT
x-az: {did:92e7dc58ca2143cfb2c818b047cc5cd1, rid: OneDeployContainer, sn: marketingsites-prod-odnortheurope, dt: 2018-05-03T20:14:23.4188992Z, bt: 2020-12-24T05:53:06.0000000Z}
strict-transport-security: max-age=31536000
access-control-allow-methods: HEAD,GET,POST,PATCH,PUT,OPTIONS
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31081166
timing-allow-origin: *
x-appversion: 1.0.7662.39393
expires: Thu, 03 Feb 2022 02:42:00 GMT

GET
H/1.1 200
OK override.css
statics-marketingsites-wcus-ms-com.akamaized.net/statics/ 1 KB
907 B 90ms
23ms Stylesheet
text/css 2.16.186.32
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://statics-marketingsites-wcus-ms-com.akamaized.net/statics/override.css?c=7
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server: 2.16.186.32 , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-16-186-32.deploy.static.akamaitechnologies.com
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 0bd288d5397a69ead391875b422bf2cbdcc4f795d64aa2f780aff45768d78248

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Mon, 08 Feb 2021 09:02:34 GMT
Content-Encoding: gzip
Last-Modified: Tue, 11 Jun 2019 23:22:13 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8D6EEC3A2D67C35
Vary: Accept-Encoding
Content-Type: text/css
x-ms-request-id: 5119a162-601e-0039-7661-9c4aae000000
x-ms-version: 2009-09-19
Connection: keep-alive
Content-Length: 473

GET
H2 200 RE1Mu3b
img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/ 4 KB
4 KB 46ms
6ms Image
image/png 2a02:26f0:6c00::210:ba28
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

2a02:26f0:6c00::210:ba28 , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

112fec798b78aa02e102a724b5cb1990c0f909bc1d8b7b1fa256eab41bbc0960

Security Headers

Name	Value
X-Frame-Options	deny

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-cms-cdninvalkey: am:RE1Mu3b
date: Mon, 08 Feb 2021 09:02:34 GMT
last-modified: Sat, 06 Feb 2021 06:58:16 GMT
timing-allow-origin: *
x-datacenter: NorthEU
x-source-length: 4054
x-frame-options: deny
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=251754
x-activityid: a62cd4bd-5a8b-4ac3-bf8d-d0ad35c5965a
x-deployment: a89a5014e89c41b7b60a64d7ee950637
content-location: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31
content-length: 4054
expires: Thu, 11 Feb 2021 06:58:28 GMT

GET
H2 200 wp-emoji-release.min.js Show response
www.microsoft.com/security/blog/wp-includes/js/ 14 KB
5 KB 219ms
215ms Script
application/javascript 2a02:26f0:1700:1ab::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-includes/js/wp-emoji-release.min.js?ver=5.4.2

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:1ab::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

96d33f532112177ede6bf262dcf6d0140dbe29f05a4595d17b0be4743205b5ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency: 4
date: Mon, 08 Feb 2021 09:02:34 GMT
content-encoding: gzip
last-modified: Thu, 14 May 2020 18:36:10 GMT
x-rtag: RT
x-edgeconnect-midmile-rtt: 122
etag: W/"5ebd8f9a-364d"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
tls_version: tls1.3
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 4693

GET
H/1.1 200
OK cyber_banner_new-1024x403.jpg
cloudblogs.microsoft.com/uploads/prod/2018/01/ 64 KB
65 KB 79ms
21ms Image
image/jpeg 107.154.114.97
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cloudblogs.microsoft.com/uploads/prod/2018/01/cyber_banner_new-1024x403.jpg
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 107.154.114.97 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS: 107.154.114.97.ip.incapdns.net
Software: /
Resource Hash: 8f7c0844bd6c6c72a0ded39fb2bfc75fe69d20214d743f8b6a1c86a0c568921c

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 08 Feb 2021 09:02:34 GMT
Last-Modified: Tue, 09 Jan 2018 09:41:17 GMT
X-CDN: Incapsula
Etag: "0x8D5574521E52408"
Content-Type: image/jpeg
X-Iinfo: 5-30164241-0 0CNN RT(1612774954162 22) q(0 -1 -1 -1) r(0 -1)
Cache-Control: max-age=315359881, public
Content-Length: 66024
Expires: Thu, 06 Feb 2031 09:00:35 GMT

GET
H/1.1 200
OK Winnti-encounters-from-July-to-December-20161.png
cloudblogs.microsoft.com/uploads/prod/2018/01/ 71 KB
72 KB 76ms
19ms Image
image/png 107.154.114.97
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cloudblogs.microsoft.com/uploads/prod/2018/01/Winnti-encounters-from-July-to-December-20161.png
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 107.154.114.97 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS: 107.154.114.97.ip.incapdns.net
Software: /
Resource Hash: e6ae3f1b722d6ec4f294ad9d77761a49b8cbe06cd96a35d6664de217484a2d53

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 08 Feb 2021 09:02:34 GMT
Last-Modified: Tue, 09 Jan 2018 09:42:06 GMT
X-CDN: Incapsula
Etag: "0x8D557453F0E797F"
Content-Type: image/png
X-Iinfo: 2-9725339-0 0CNN RT(1612774954162 18) q(0 -1 -1 0) r(0 -1)
Cache-Control: max-age=315359882, public
Content-Length: 73073
Expires: Thu, 06 Feb 2031 09:00:36 GMT

GET
H/1.1 200
OK table-01-lead-table.png
cloudblogs.microsoft.com/uploads/prod/2018/01/ 17 KB
18 KB 77ms
19ms Image
image/png 107.154.114.97
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cloudblogs.microsoft.com/uploads/prod/2018/01/table-01-lead-table.png
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 107.154.114.97 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS: 107.154.114.97.ip.incapdns.net
Software: /
Resource Hash: 316b809cfdf3473565dfcc757edc602418cd71442fed870a7a2e422ae8c153ab

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 08 Feb 2021 09:02:34 GMT
Last-Modified: Tue, 09 Jan 2018 09:41:54 GMT
X-CDN: Incapsula
Etag: "0x8D5574538054426"
Content-Type: image/png
X-Iinfo: 14-34530845-0 0CNN RT(1612774954162 19) q(0 -1 -1 -1) r(0 -1)
Cache-Control: max-age=315359882, public
Content-Length: 17528
Expires: Thu, 06 Feb 2031 09:00:36 GMT

GET
H/1.1 200
OK Threat-Intelligence-alert-in-Windows-Defender-ATP.png
cloudblogs.microsoft.com/uploads/prod/2018/01/ 3 KB
3 KB 95ms
26ms Image
image/png 107.154.114.97
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cloudblogs.microsoft.com/uploads/prod/2018/01/Threat-Intelligence-alert-in-Windows-Defender-ATP.png
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 107.154.114.97 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS: 107.154.114.97.ip.incapdns.net
Software: /
Resource Hash: fc21f6638411ea112dcc19fb6b4b8e80a46a97e0a2a572fa6c45e1b8a2cf0dd1

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 08 Feb 2021 09:02:34 GMT
Last-Modified: Tue, 09 Jan 2018 09:42:00 GMT
X-CDN: Incapsula
Etag: "0x8D557453B3371B5"
Content-Type: image/png
X-Iinfo: 5-222160428-0 0CNN RT(1612774954635 27) q(0 -1 -1 0) r(0 -1)
Cache-Control: max-age=315359882, public
Content-Length: 2731
Expires: Thu, 06 Feb 2031 09:00:36 GMT

GET
H/1.1 200
OK Lead-activity-group-summary-and-extensive-documentation1.png
cloudblogs.microsoft.com/uploads/prod/2018/01/ 197 KB
198 KB 93ms
24ms Image
image/png 107.154.114.97
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cloudblogs.microsoft.com/uploads/prod/2018/01/Lead-activity-group-summary-and-extensive-documentation1.png
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 107.154.114.97 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS: 107.154.114.97.ip.incapdns.net
Software: /
Resource Hash: 0c35a9475280fe5d14591e387aa6655201bec91e940d1afa7f9f025c1671215b

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 08 Feb 2021 09:02:34 GMT
Last-Modified: Tue, 09 Jan 2018 09:41:31 GMT
X-CDN: Incapsula
Etag: "0x8D557452A5A60AC"
Content-Type: image/png
X-Iinfo: 2-86674946-0 0CNN RT(1612774954636 24) q(0 -1 -1 0) r(0 -1)
Cache-Control: max-age=314948269, public
Content-Length: 202045
Expires: Sat, 01 Feb 2031 14:40:23 GMT

GET
H/1.1 200
OK Abnormal-service-creation-alert1.png
cloudblogs.microsoft.com/uploads/prod/2018/01/ 2 KB
3 KB 94ms
25ms Image
image/png 107.154.114.97
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cloudblogs.microsoft.com/uploads/prod/2018/01/Abnormal-service-creation-alert1.png
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 107.154.114.97 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS: 107.154.114.97.ip.incapdns.net
Software: /
Resource Hash: 860dfad266fa20598d1dfab12b17132851954579470711a19113b3ced42a4d06

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 08 Feb 2021 09:02:34 GMT
Last-Modified: Tue, 09 Jan 2018 09:41:12 GMT
X-CDN: Incapsula
Etag: "0x8D557451EA76348"
Content-Type: image/png
X-Iinfo: 10-109184427-0 0CNN RT(1612774954635 25) q(0 -1 -1 0) r(0 -1)
Cache-Control: max-age=314948269, public
Content-Length: 2320
Expires: Sat, 01 Feb 2031 14:40:23 GMT

GET
H/1.1 200
OK 5-Winnti-installer-drops-a-DLL.png
cloudblogs.microsoft.com/uploads/prod/2018/01/ 124 KB
125 KB 163ms
162ms Image
image/png 107.154.114.97
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cloudblogs.microsoft.com/uploads/prod/2018/01/5-Winnti-installer-drops-a-DLL.png

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

107.154.114.97 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

107.154.114.97.ip.incapdns.net

Software

nginx /

Resource Hash

07bfeb4f1504dcc863762ce7efbf98b42b5fb9f6e79e84d43c501c227cef815c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; always
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-blob-type: AppendBlob
Date: Mon, 08 Feb 2021 09:02:34 GMT
X-CDN: Incapsula
X-Iinfo: 14-34530845-34530749 2NNN RT(1612774954162 50) q(0 0 0 0) r(1 1) U18
Connection: keep-alive
Content-Length: 126763
x-ms-lease-state: available
x-ms-lease-status: unlocked
X-Frame-Options: SAMEORIGIN
Last-Modified: Tue, 09 Jan 2018 09:41:06 GMT
Server: nginx
x-ms-blob-committed-block-count: 1
ETag: "0x8D557451B68B7F9"
Strict-Transport-Security: max-age=31536000; includeSubDomains; always
Content-Type: image/png
x-ms-request-id: 82c6a817-301e-0015-30f9-fd5082000000
Cache-Control: max-age=315360000
x-ms-version: 2014-02-14
Accept-Ranges: bytes
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK Winnti-installer-loads-DLL-with-rundll32.png
cloudblogs.microsoft.com/uploads/prod/2018/01/ 133 KB
134 KB 25ms
24ms Image
image/png 107.154.114.97
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cloudblogs.microsoft.com/uploads/prod/2018/01/Winnti-installer-loads-DLL-with-rundll32.png
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 107.154.114.97 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS: 107.154.114.97.ip.incapdns.net
Software: /
Resource Hash: 49227788ed30d606e3a0f7b55caf9995f183b42d56a45cb0f446ff03e33c72c1

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 08 Feb 2021 09:02:34 GMT
Last-Modified: Tue, 09 Jan 2018 09:42:14 GMT
X-CDN: Incapsula
Etag: "0x8D5574543E94591"
Content-Type: image/png
X-Iinfo: 5-222160428-0 0CNN RT(1612774954635 52) q(0 -1 -1 -1) r(0 -1)
Cache-Control: max-age=314948269, public
Content-Length: 136584
Expires: Sat, 01 Feb 2031 14:40:23 GMT

GET
H/1.1 200
OK Winnti-sets-itself-as-a-service-for-persistence.png
cloudblogs.microsoft.com/uploads/prod/2018/01/ 113 KB
114 KB 26ms
26ms Image
image/png 107.154.114.97
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cloudblogs.microsoft.com/uploads/prod/2018/01/Winnti-sets-itself-as-a-service-for-persistence.png
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 107.154.114.97 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS: 107.154.114.97.ip.incapdns.net
Software: /
Resource Hash: 8288a3fbfce54a91832c0cfc1e944fcd86eb23dde32fe8dd75ca92996e528735

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 08 Feb 2021 09:02:34 GMT
Last-Modified: Tue, 09 Jan 2018 09:42:23 GMT
X-CDN: Incapsula
Etag: "0x8D5574548F69C8F"
Content-Type: image/png
X-Iinfo: 10-109184427-0 0CNN RT(1612774954635 53) q(0 -1 -1 -1) r(0 -1)
Cache-Control: max-age=309585970, public
Content-Length: 116172
Expires: Sun, 01 Dec 2030 13:08:44 GMT

GET
H/1.1 200
OK Installer-copied-to-Help-folder1.png
cloudblogs.microsoft.com/uploads/prod/2018/01/ 112 KB
113 KB 160ms
159ms Image
image/png 107.154.114.97
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cloudblogs.microsoft.com/uploads/prod/2018/01/Installer-copied-to-Help-folder1.png

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

107.154.114.97 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

107.154.114.97.ip.incapdns.net

Software

nginx /

Resource Hash

70c7aea0149e29eb4a6777094041ff3d4c98be84015b55580b647dff91141d11

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; always
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-blob-type: AppendBlob
Date: Mon, 08 Feb 2021 09:02:34 GMT
X-CDN: Incapsula
X-Iinfo: 2-9725339-9722935 2NNN RT(1612774954162 68) q(0 0 0 -1) r(1 1) U18
Connection: keep-alive
Content-Length: 114248
x-ms-lease-state: available
x-ms-lease-status: unlocked
X-Frame-Options: SAMEORIGIN
Last-Modified: Tue, 09 Jan 2018 09:41:24 GMT
Server: nginx
x-ms-blob-committed-block-count: 1
ETag: "0x8D55745260CFA41"
Strict-Transport-Security: max-age=31536000; includeSubDomains; always
Content-Type: image/png
x-ms-request-id: 0b4df418-501e-0128-13f9-fda3f1000000
Cache-Control: max-age=315360000
x-ms-version: 2014-02-14
Accept-Ranges: bytes
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK Response-options-for-the-compromised-machine.png
cloudblogs.microsoft.com/uploads/prod/2018/01/ 112 KB
113 KB 385ms
385ms Image
image/png 107.154.114.97
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cloudblogs.microsoft.com/uploads/prod/2018/01/Response-options-for-the-compromised-machine.png

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

107.154.114.97 , United States, ASN19551 (INCAPSULA, US),

Reverse DNS

107.154.114.97.ip.incapdns.net

Software

nginx /

Resource Hash

af95eb407a52531853c4aaa5a991f8a139e026031f04cc9e1a39f70643eb23e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; always
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-blob-type: AppendBlob
Date: Mon, 08 Feb 2021 09:02:35 GMT
X-CDN: Incapsula
X-Iinfo: 5-30164241-30164253 2NNN RT(1612774954162 69) q(0 0 0 -1) r(0 4) U18
Connection: keep-alive
Content-Length: 114302
x-ms-lease-state: available
x-ms-lease-status: unlocked
X-Frame-Options: SAMEORIGIN
Last-Modified: Tue, 09 Jan 2018 09:41:39 GMT
Server: nginx
x-ms-blob-committed-block-count: 1
ETag: "0x8D557452ECDF3C5"
Strict-Transport-Security: max-age=31536000; includeSubDomains; always
Content-Type: image/png
x-ms-request-id: 2f7acf46-201e-000a-2af9-fd8b92000000
Cache-Control: max-age=315360000
x-ms-version: 2014-02-14
Accept-Ranges: bytes
Expires: Thu, 31 Dec 2037 23:55:55 GMT

GET
H/1.1 200
OK Response-options-for-the-Winnti-implant-file2.png
cloudblogs.microsoft.com/uploads/prod/2018/01/ 147 KB
147 KB 25ms
24ms Image
image/png 107.154.114.97
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cloudblogs.microsoft.com/uploads/prod/2018/01/Response-options-for-the-Winnti-implant-file2.png
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 107.154.114.97 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS: 107.154.114.97.ip.incapdns.net
Software: /
Resource Hash: 81889aabd655316edbb18eedef6f4ff2004d03b7bc45a74d6bd85f5c63bc4422

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date: Mon, 08 Feb 2021 09:02:34 GMT
Last-Modified: Tue, 09 Jan 2018 09:41:47 GMT
X-CDN: Incapsula
Etag: "0x8D5574533D492B1"
Content-Type: image/png
X-Iinfo: 2-86674946-0 0CNN RT(1612774954636 100) q(0 -1 -1 -1) r(0 -1)
Cache-Control: max-age=315359882, public
Content-Length: 150580
Expires: Thu, 06 Feb 2031 09:00:36 GMT

GET
H2 200 Win17_15021_00_N12-440x268.jpg
www.microsoft.com/security/blog/wp-content/uploads/2021/02/ 51 KB
51 KB 88ms
86ms Image
image/jpeg 2a02:26f0:1700:1ab::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.microsoft.com/security/blog/wp-content/uploads/2021/02/Win17_15021_00_N12-440x268.jpg

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:1ab::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

73f547c75c6f6574b281470ee6a1c6c3cebe30a3a23317d293411974e575f35e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency: 3
date: Mon, 08 Feb 2021 09:02:34 GMT
last-modified: Thu, 04 Feb 2021 18:30:58 GMT
x-rtag: RT
x-edgeconnect-midmile-rtt: 130
etag: "601c3d62-cb33"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
tls_version: tls1.3
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 52019

GET
H2 200 WIN20_PRO_RemoteWorking_031-440x268.jpg
www.microsoft.com/security/blog/wp-content/uploads/2021/02/ 20 KB
20 KB 98ms
96ms Image
image/jpeg 2a02:26f0:1700:1ab::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.microsoft.com/security/blog/wp-content/uploads/2021/02/WIN20_PRO_RemoteWorking_031-440x268.jpg

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:1ab::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

8abcaad96a14142a4fabfe794b98192cf30c21eb6038b8264bc6d8b5f8bb83ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency: 6
date: Mon, 08 Feb 2021 09:02:34 GMT
last-modified: Wed, 03 Feb 2021 14:06:35 GMT
x-rtag: RT
x-edgeconnect-midmile-rtt: 117
etag: "601aadeb-4fc9"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
tls_version: tls1.3
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 20425

GET
H2 200 WIN20_PRO-EDU_RemoteWorking_Learning_037-440x268.jpg
www.microsoft.com/security/blog/wp-content/uploads/2021/02/ 15 KB
15 KB 107ms
105ms Image
image/jpeg 2a02:26f0:1700:1ab::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.microsoft.com/security/blog/wp-content/uploads/2021/02/WIN20_PRO-EDU_RemoteWorking_Learning_037-440x268.jpg

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:1ab::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

263c838778f4fd75cca524a50211b5c8e652c1bd86ccfabcc689a23fe655fd15

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency: 6
date: Mon, 08 Feb 2021 09:02:34 GMT
last-modified: Wed, 03 Feb 2021 12:49:55 GMT
x-rtag: RT
x-edgeconnect-midmile-rtt: 130
etag: "601a9bf3-3bd2"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
tls_version: tls1.3
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 15314

GET
H2 200 CTA-feature-1024x729.jpg
www.microsoft.com/security/blog/wp-content/uploads/2019/02/ 161 KB
162 KB 116ms
114ms Image
image/jpeg 2a02:26f0:1700:1ab::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.microsoft.com/security/blog/wp-content/uploads/2019/02/CTA-feature-1024x729.jpg

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:1ab::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

a58941524adf31d97c86f42995772c3a250918e696d00afc4c78d149f2adc43f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency: 4
date: Mon, 08 Feb 2021 09:02:34 GMT
last-modified: Tue, 26 Feb 2019 00:33:13 GMT
x-rtag: RT
x-edgeconnect-midmile-rtt: 122
etag: "5c748949-28405"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
tls_version: tls1.3
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 164869

GET
H2 200 microsoft-uhf.js Show response
www.microsoft.com/security/blog/wp-content/plugins/microsoft-uhf/assets/ 3 KB
2 KB 78ms
78ms Script
application/javascript 2a02:26f0:1700:1ab::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-content/plugins/microsoft-uhf/assets/microsoft-uhf.js?ver=0.2.0

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:1ab::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

aa163f4777f0ee19e5f23ac0f332c22f06cd621696c62f527067c32a8c6c3a98

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency: 3
date: Mon, 08 Feb 2021 09:02:34 GMT
content-encoding: gzip
last-modified: Thu, 01 Oct 2020 00:16:03 GMT
x-rtag: RT
x-edgeconnect-midmile-rtt: 123
etag: W/"5f751fc3-b8a"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
tls_version: tls1.3
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 1303

GET
H2 200 uhf-search-ui.js Show response
www.microsoft.com/security/blog/wp-content/plugins/wds-ms-searchwp/features/uhf-search-ui/ 4 KB
1 KB 15ms
15ms Script
application/javascript 2a02:26f0:1700:1ab::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-content/plugins/wds-ms-searchwp/features/uhf-search-ui/uhf-search-ui.js?ver=1.0.1

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:1ab::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

16d6e957a9525cb4848051b0efc5aa101d256a3c6838007dc4ac2c41121eaade

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency: 4
date: Mon, 08 Feb 2021 09:02:34 GMT
content-encoding: gzip
last-modified: Thu, 01 Oct 2020 00:16:06 GMT
x-rtag: RT
x-edgeconnect-midmile-rtt: 116
etag: W/"5f751fc6-105b"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
tls_version: tls1.3
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 1039

GET
H2 200 modernizr.js Show response
www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/bower_components/modernizer/ 50 KB
16 KB 14ms
13ms Script
application/javascript 2a02:26f0:1700:1ab::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/bower_components/modernizer/modernizr.js?ver=2.8.2

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:1ab::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

b828b15e9b7836b493a8bd6e832a24ee13aa8b6f8b4a1bf307a7af2912014178

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency: 7
date: Mon, 08 Feb 2021 09:02:34 GMT
content-encoding: gzip
last-modified: Thu, 01 Oct 2020 00:16:10 GMT
x-rtag: RT
x-edgeconnect-midmile-rtt: 119
etag: W/"5f751fca-c897"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
tls_version: tls1.3
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 15897

GET
H2 200 mwf-auto-init-main.var.min.js Show response
assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/scripts/ 303 KB
71 KB 9ms
9ms Script
application/x-javascript 2a02:26f0:10c:5a9::2957
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/scripts/mwf-auto-init-main.var.min.js?ver=v1.23.2+5182151

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:10c:5a9::2957 , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /

Resource Hash

f2a28cd82e7ec00d2d8158f21fb0507722cd8b09fa4a0a16fadc58f30385cc25

Security Headers

Name	Value
X-Content-Type-Options	nosniff, nosniff

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 08 Feb 2021 09:02:34 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
last-modified: Thu, 01 Feb 2018 02:22:29 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
content-md5: 12go4t01WZJhAGBag3beKQ==
etag: "0x8D5691AA4A3D407"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-lease-state,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control: max-age=900
accept-ranges: bytes
content-length: 71611
x-ms-lease-state: available

GET
H2 200 picturefill.min.js Show response
www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/bower_components/picturefill/dist/ 12 KB
5 KB 14ms
14ms Script
application/javascript 2a02:26f0:1700:1ab::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/bower_components/picturefill/dist/picturefill.min.js?ver=3.0.3

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:1ab::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

893fa7fe8b6e69e2828319c04a7cbb6f129ea820db695d4ced5757d59450b6a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency: 4
date: Mon, 08 Feb 2021 09:02:34 GMT
content-encoding: gzip
last-modified: Thu, 01 Oct 2020 00:16:10 GMT
x-rtag: RT
x-edgeconnect-midmile-rtt: 125
etag: W/"5f751fca-2e1f"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
tls_version: tls1.3
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 5181

GET
H2 200 imagesloaded.min.js Show response
www.microsoft.com/security/blog/wp-includes/js/ 8 KB
3 KB 24ms
19ms Script
application/javascript 2a02:26f0:1700:1ab::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-includes/js/imagesloaded.min.js?ver=3.2.0

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:1ab::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

afbd6d3dbf677900ec3d80e8057a7b9f93f72e5971494ed7ce7a4be1cb7c9ae8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency: 12
date: Mon, 08 Feb 2021 09:02:34 GMT
content-encoding: gzip
last-modified: Thu, 14 May 2020 18:36:10 GMT
x-rtag: RT
x-edgeconnect-midmile-rtt: 118
etag: W/"5ebd8f9a-1fd4"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
tls_version: tls1.3
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 2587

GET
H2 200 masonry.min.js Show response
www.microsoft.com/security/blog/wp-includes/js/ 28 KB
9 KB 25ms
20ms Script
application/javascript 2a02:26f0:1700:1ab::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-includes/js/masonry.min.js?ver=3.3.2

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:1ab::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

047ff7cfd5956ecf06bd9fc9fd123772f2c5825cce3d124418ba418d540a5b98

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency: 13
date: Mon, 08 Feb 2021 09:02:34 GMT
content-encoding: gzip
last-modified: Thu, 14 May 2020 18:36:10 GMT
x-rtag: RT
x-edgeconnect-midmile-rtt: 120
etag: W/"5ebd8f9a-713c"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
tls_version: tls1.3
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 8609

GET
H2 200 project.min.js Show response
www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/scripts/ 6 KB
2 KB 54ms
50ms Script
application/javascript 2a02:26f0:1700:1ab::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/scripts/project.min.js?ver=1.0.1

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:1ab::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

8e87a6bb0e676ce4318c66fd6927939010aac33d4586f75fe1fed85c9a4b30f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency: 3
date: Mon, 08 Feb 2021 09:02:34 GMT
content-encoding: gzip
last-modified: Thu, 01 Oct 2020 00:16:10 GMT
x-rtag: RT
x-edgeconnect-midmile-rtt: 114
etag: W/"5f751fca-192f"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
tls_version: tls1.3
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 1869

GET
H2 200 wp-embed.min.js Show response
www.microsoft.com/security/blog/wp-includes/js/ 1 KB
1 KB 55ms
50ms Script
application/javascript 2a02:26f0:1700:1ab::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-includes/js/wp-embed.min.js?ver=5.4.2

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:1ab::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

6ebcda7a3a41ef97f0b4071160ceb1020e540fdc0f790079a5c2ef01ab654fe0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-edgeconnect-origin-mex-latency: 12
date: Mon, 08 Feb 2021 09:02:34 GMT
content-encoding: gzip
last-modified: Thu, 14 May 2020 18:36:11 GMT
x-rtag: RT
x-edgeconnect-midmile-rtt: 117
etag: W/"5ebd8f9b-59a"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
tls_version: tls1.3
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 769

GET
H2 200 17-f90ef1 Show response
www.microsoft.com/onerfstatics/marketingsites-wcus-prod/shell/_scrf/js/themes=default/54-af9f9f/c0-247156/de-099401/e1-a50eee/e7-954872/d8-97d509/f0-251fe2/46-be1318/77-04a268/11-240c7b/63-077520/a... 130 KB
35 KB 69ms
65ms Script
text/javascript 2a02:26f0:1700:1ab::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/onerfstatics/marketingsites-wcus-prod/shell/_scrf/js/themes=default/54-af9f9f/c0-247156/de-099401/e1-a50eee/e7-954872/d8-97d509/f0-251fe2/46-be1318/77-04a268/11-240c7b/63-077520/a4-34de62/bb-d7480b/db-bc0148/dc-7e9864/6d-c07ea1/29-1ec5a9/23-c64e70/cd-23d3b0/6d-1e7ed0/b7-cadaa7/c4-898cf2/ca-40b7b0/4e-ee3a55/3e-f5c39b/c3-6454d7/f9-7592d3/92-10345d/79-499886/7e-cda2d3/b2-7087f0/e5-08f1c0/e0-3c9860/91-97a04f/1f-100dea/33-abe4df/17-f90ef1?ver=2.0&iife=1

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:1ab::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

06b2e0143ca1583c507056d1bc66a4024530340ba5582682180d3e2dce56d163

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

ms-operation-id: 1c93915db98dd64eaf0d7fcbf646888e
date: Mon, 08 Feb 2021 09:02:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-rtag: RT
x-s2: 2021-02-03T02:41:35
p3p: CP="CAO CONi OTR OUR DEM ONL"
x-activity-id: ed08b51c-f17a-4267-9150-258442a28363
tls_version: tls1.3
x-s1: 2021-02-03T02:41:35
ms-cv: 6Ldbs13NkUelvpWm.0
vary: Accept-Encoding
content-length: 35013
x-xss-protection: 1; mode=block
last-modified: Wed, 03 Feb 2021 02:41:35 GMT
x-az: {did:92e7dc58ca2143cfb2c818b047cc5cd1, rid: OneDeployContainer, sn: marketingsites-prod-odnortheurope, dt: 2018-05-03T20:14:23.4188992Z, bt: 2020-12-24T05:53:06.0000000Z}
strict-transport-security: max-age=31536000
access-control-allow-methods: HEAD,GET,POST,PATCH,PUT,OPTIONS
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=31081140
timing-allow-origin: *
x-appversion: 1.0.7662.39393
expires: Thu, 03 Feb 2022 02:41:34 GMT

GET
H/1.1 200
OK meversion Show response
mem.gfx.ms/ 27 KB
10 KB 35ms
7ms Script
application/javascript 2a02:26f0:1700:181::37
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://mem.gfx.ms/meversion?partner=MSSecurity&market=en-us&uhf=1

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:1700:181::37 , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

fc8369e0dab606147e7787c7848a1233604c9e847003d4da6fa137ed5a39f601

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Date: Mon, 08 Feb 2021 09:02:34 GMT
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: public, no-transform, max-age=43200
X-UA-Compatible: IE=edge
Connection: keep-alive
Content-Length: 9534
Expires: Mon, 08 Feb 2021 12:09:08 GMT

GET
H/1.1 200
OK t.js Show response
web.vortex.data.microsoft.com/collect/v1/ 281 B
966 B 141ms
34ms Script
application/javascript 40.77.226.250
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://web.vortex.data.microsoft.com/collect/v1/t.js?ver=%272.1%27&name=%27Ms.Webi.PageView%27&time=%272021-02-08T09%3A02%3A34.589Z%27&os=%27MacOS%27&appId=%27JS%3AsecurityBlog%27&-ver=%271.0%27&-impressionGuid=%276e889ec7-ce7d-40b6-a1b7-c66ec184d3a6%27&-pageName=%27Detecting%20threat%20actors%20in%20recent%20German%20industrial%20attacks%20with%20Windows%20Defender%20ATP%27&-uri=%27https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fblog%2F2017%2F01%2F25%2Fdetecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp%2F%27&-market=%27en-us%27&-pageType=%27Post%27&-resHeight=1200&-resWidth=1600&-pageTags=%27%7B%22metaTags%22%3A%7B%22pageType%22%3A%22Post%22%7D%7D%27&-behavior=0&*baseType=%27Ms.Content.PageView%27&*cookieEnabled=true&*isJs=true&*title=%27Detecting%20threat%20actors%20in%20recent%20German%20industrial%20attacks%20with%20Windows%20Defender%20ATP%20-%20Microsoft%20Security%27&*isLoggedIn=false&*flashInstalled=false&ext-app-env=%27Production%27&ext-javascript-ver=%271.1%27&ext-javascript-libVer=%274.3.4%27&ext-javascript-domain=%27www.microsoft.com%27&ext-javascript-userConsent=false&$mscomCookies=false

Requested by

Host: az725175.vo.msecnd.net
URL: https://az725175.vo.msecnd.net/scripts/jsll-4.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

40.77.226.250 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

6a93c2fe5cc182962663343edc3d48d8956b6b83593c6c4831374b23e0738006

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 08 Feb 2021 09:02:33 GMT
X-Content-Type-Options: nosniff
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
Cache-Control: no-cache, no-store
MS-CV: 5YSDL7iY+Ead8Cy2d19a4g.0
Content-Type: application/javascript
Content-Length: 281
Expires: 0

GET
DATA 200
OK truncated
/ 2 KB
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4b61b59b5f8f21097b7db7ab003365c16630820c2c1952ac8915d366338976a5

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 223 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 707c5b510b5712a82fd8bdf073a6d9860583931ee85f6ee7e2e735e81ae05d18

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 mwfmdl2-v3.54.woff
www.microsoft.com/mwf/_h/v3.54/mwf.app/fonts/ 26 KB
26 KB 111ms
110ms Font
application/font-woff 2a02:26f0:1700:1ab::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/mwf/_h/v3.54/mwf.app/fonts/mwfmdl2-v3.54.woff

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/onerfstatics/marketingsites-wcus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/c2-fe9af7/b9-ae4fa3/fe-321a68/42-1cb85f/3e-dcc204/a1-352ee3/fa-ea79ed/54-41a2a0?ver=2.0

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:1700:1ab::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

22b4df5c33045b645cafa45b04685f4752e471a2e933bff5bf14324d87deee12

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Origin: https://www.microsoft.com
Referer: https://www.microsoft.com/onerfstatics/marketingsites-wcus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/c2-fe9af7/b9-ae4fa3/fe-321a68/42-1cb85f/3e-dcc204/a1-352ee3/fa-ea79ed/54-41a2a0?ver=2.0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

ms-operation-id: a77154839f75be4791e6b41585080c4b
date: Mon, 08 Feb 2021 09:02:34 GMT
x-content-type-options: nosniff
x-rtag: RT
p3p: CP="CAO CONi OTR OUR DEM ONL"
x-activity-id: 00a83b1e-7f08-48b9-9042-6a9af259b9c6
tls_version: tls1.3
ms-cv: mp/PAhYqbkOxM32e.0
content-length: 26288
x-xss-protection: 1; mode=block
last-modified: Sun, 29 Nov 2020 08:12:06 GMT
x-az: {did:92e7dc58ca2143cfb2c818b047cc5cd1, rid: OneDeployContainer, sn: marketingsites-prod-odnortheurope, dt: 2018-05-03T20:14:23.4188992Z, bt: 2020-11-13T05:58:08.0000000Z}
strict-transport-security: max-age=31536000
access-control-allow-methods: HEAD,GET,POST,PATCH,PUT,OPTIONS
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=25398572
x-appversion: 1.0.7621.39544
expires: Mon, 29 Nov 2021 08:12:06 GMT

GET
H2 200 latest.woff2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/Semibold/ 29 KB
29 KB 37ms
9ms Font
font/woff2 2a02:26f0:10c:5a0::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/Semibold/latest.woff2
Requested by: Host: assets.onestore.ms
URL: https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/css/mwf-west-european-default.min.css?ver=5.4.2
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:5a0::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: d87d0a7a7fe2c36d1dc093bfe56e9b81b311988789dbd3b65abf811d551ef02f

Request headers

Origin: https://www.microsoft.com
Referer: https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/css/mwf-west-european-default.min.css?ver=5.4.2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 08 Feb 2021 09:02:34 GMT
last-modified: Fri, 10 Jan 2020 19:09:43 GMT
etag: "5b68d583e9c7d51:0"
access-control-allow-methods: GET,POST
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=136155
accept-ranges: bytes
content-length: 29388
expires: Tue, 09 Feb 2021 22:51:49 GMT

GET
H2 200 latest.woff2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/ 33 KB
34 KB 36ms
17ms Font
font/woff2 2a02:26f0:10c:5a0::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/latest.woff2
Requested by: Host: assets.onestore.ms
URL: https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/css/mwf-west-european-default.min.css?ver=5.4.2
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:5a0::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 4f7f4afe26e71fa9ca1dac4a43b557a554a46f53251d849f07ed08a04829d74b

Request headers

Origin: https://www.microsoft.com
Referer: https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/css/mwf-west-european-default.min.css?ver=5.4.2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 08 Feb 2021 09:02:34 GMT
last-modified: Fri, 10 Jan 2020 19:09:43 GMT
etag: "588d483e9c7d51:0"
access-control-allow-methods: GET,POST
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=432105
accept-ranges: bytes
content-length: 34052
expires: Sat, 13 Feb 2021 09:04:19 GMT

GET
H2 200 latest.woff2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/Bold/ 29 KB
30 KB 10ms
9ms Font
font/woff2 2a02:26f0:10c:5a0::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/Bold/latest.woff2
Requested by: Host: assets.onestore.ms
URL: https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/css/mwf-west-european-default.min.css?ver=5.4.2
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:5a0::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 1232bbdbc5d205f3c5a40efa5ed92839c79e7879d5168445cc47645bb93f7d1b

Request headers

Origin: https://www.microsoft.com
Referer: https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/css/mwf-west-european-default.min.css?ver=5.4.2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 08 Feb 2021 09:02:34 GMT
last-modified: Fri, 10 Jan 2020 19:09:42 GMT
etag: "83cce83e9c7d51:0"
access-control-allow-methods: GET,POST
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=331485
accept-ranges: bytes
content-length: 30132
expires: Fri, 12 Feb 2021 05:07:19 GMT

GET
H2 200 latest.woff2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/Light/ 27 KB
27 KB 10ms
10ms Font
font/woff2 2a02:26f0:10c:5a0::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/Light/latest.woff2
Requested by: Host: assets.onestore.ms
URL: https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/css/mwf-west-european-default.min.css?ver=5.4.2
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:5a0::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: fe8a1047376498c80a157d13555e42a92ad480fcb0bcc9de51ad1930fbeb7f91

Request headers

Origin: https://www.microsoft.com
Referer: https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/css/mwf-west-european-default.min.css?ver=5.4.2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 08 Feb 2021 09:02:34 GMT
last-modified: Fri, 10 Jan 2020 19:09:43 GMT
etag: "1282d283e9c7d51:0"
access-control-allow-methods: GET,POST
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=349394
accept-ranges: bytes
content-length: 27168
expires: Fri, 12 Feb 2021 10:05:48 GMT

GET
H2 200 latest.woff2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/Semilight/ 28 KB
28 KB 10ms
9ms Font
font/woff2 2a02:26f0:10c:5a0::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/Semilight/latest.woff2
Requested by: Host: assets.onestore.ms
URL: https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/css/mwf-west-european-default.min.css?ver=5.4.2
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:5a0::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 6ba0d1a726f1887bd61727b308ed0be0e73edba17d4ad11b91ab19b632e078f6

Request headers

Origin: https://www.microsoft.com
Referer: https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/css/mwf-west-european-default.min.css?ver=5.4.2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date: Mon, 08 Feb 2021 09:02:34 GMT
last-modified: Fri, 10 Jan 2020 19:09:43 GMT
etag: "95edd883e9c7d51:0"
access-control-allow-methods: GET,POST
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=337227
accept-ranges: bytes
content-length: 28908
expires: Fri, 12 Feb 2021 06:43:01 GMT

GET
H/1.1 200
OK meBoot.min.js Show response
mem.gfx.ms/scripts/me/MeControl/10.20321.2/en-US/ 151 KB
30 KB 25ms
7ms Script
application/javascript 2a02:26f0:1700:181::37
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://mem.gfx.ms/scripts/me/MeControl/10.20321.2/en-US/meBoot.min.js

Requested by

Host: mem.gfx.ms
URL: https://mem.gfx.ms/meversion?partner=MSSecurity&market=en-us&uhf=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:1700:181::37 , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

ca1c3bff15d76e5b5699ac228268a67618ce4b3bc5f83c1ba53be4a66073e9c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.microsoft.com
Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Tue, 17 Nov 2020 20:53:34 GMT
ETag: "1d6bd66c4c9c014"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Date: Mon, 08 Feb 2021 09:02:34 GMT
Connection: keep-alive
Content-Length: 30583
X-UA-Compatible: IE=edge

GET
DATA 200
OK truncated
/ 358 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ee2b841529e5d06aeae7f65b413b40bbfef5161c9fad9a8a1755dac03806291b

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

POST
H/1.1 200
OK v1
web.vortex.data.microsoft.com/collect/ 0
0 35ms
35ms Other
application/json 40.77.226.250
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://web.vortex.data.microsoft.com/collect/v1?$mscomCookies=false&ext-javascript-msfpc=%27GUID%3D3ff44c62b8374b3aa5ed490d01310cab%26HASH%3D3ff4%26LV%3D202102%26V%3D4%26LU%3D1612774954714%27
Requested by: Host: az725175.vo.msecnd.net
URL: https://az725175.vo.msecnd.net/scripts/jsll-4.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 40.77.226.250 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Access-Control-Allow-Origin: https://www.microsoft.com
Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Origin, X-Xbl-Contract-Version, X-Xbl-Device-Type, Xbl-Authz-Actor-10, WithCredentials
Access-Control-Allow-Credentials: true

GET
H/1.1 200
OK Cookie set me.srf
login.live.com/ Frame 6A6F 0
0 172ms
172ms Document
text/html 40.126.31.143
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://login.live.com/me.srf?wa=wsignin1.0&wreply=https%3A%2F%2Fwww.microsoft.com&uaid=9022b6a2-f9b4-44ae-71e9-cb6401a6dccd&partnerId=mssecurity

Requested by

Host: mem.gfx.ms
URL: https://mem.gfx.ms/scripts/me/MeControl/10.20321.2/en-US/meBoot.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

40.126.31.143 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: login.live.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/

Response headers

Cache-Control: no-store, no-cache
Pragma: no-cache
Content-Type: text/html; charset=utf-8
Content-Encoding: gzip
Expires: Mon, 08 Feb 2021 09:01:35 GMT
Vary: Accept-Encoding
P3P: CP="DSP CUR OTPi IND OTRi ONL FIN"
Set-Cookie: uaid=9022b6a2f9b444ae71e9cb6401a6dccd; domain=login.live.com; Secure; path=/; SameSite=None; HttpOnly MSPRequ=id=N&lt=1612774955&co=1; domain=login.live.com; Secure; path=/; SameSite=None; HttpOnly
Referrer-Policy: strict-origin-when-cross-origin
x-ms-request-id: e4a4b608-d218-4908-85ea-1bc964511c34
PPServer: PPV: 30 H: BY1PPF0A5484890 V: 0
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000
X-XSS-Protection: 1; mode=block
Date: Mon, 08 Feb 2021 09:02:35 GMT
Content-Length: 4368

GET
H/1.1 200
OK meCore.min.js Show response
mem.gfx.ms/scripts/me/MeControl/10.20321.2/en-US/ 99 KB
17 KB 7ms
7ms Script
application/javascript 2a02:26f0:1700:181::37
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://mem.gfx.ms/scripts/me/MeControl/10.20321.2/en-US/meCore.min.js

Requested by

Host: mem.gfx.ms
URL: https://mem.gfx.ms/meversion?partner=MSSecurity&market=en-us&uhf=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:1700:181::37 , Ascension Island, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

c965f854e2429f283ac9ca2f8f7641b10e6f43f7ef1f0ad6482f1f7b6b5a21f6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Origin: https://www.microsoft.com
Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Tue, 17 Nov 2020 20:53:40 GMT
ETag: "1d6bd66c85eafea"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Date: Mon, 08 Feb 2021 09:02:35 GMT
Connection: keep-alive
Content-Length: 17045
X-UA-Compatible: IE=edge

POST
H/1.1 200
OK v1
web.vortex.data.microsoft.com/collect/ 0
0 35ms
35ms Other
application/json 40.77.226.250
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://web.vortex.data.microsoft.com/collect/v1?$mscomCookies=false&ext-javascript-msfpc=%27GUID%3D3ff44c62b8374b3aa5ed490d01310cab%26HASH%3D3ff4%26LV%3D202102%26V%3D4%26LU%3D1612774954714%27
Requested by: Host: az725175.vo.msecnd.net
URL: https://az725175.vo.msecnd.net/scripts/jsll-4.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 40.77.226.250 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Access-Control-Allow-Origin: https://www.microsoft.com
Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Origin, X-Xbl-Contract-Version, X-Xbl-Device-Type, Xbl-Authz-Actor-10, WithCredentials
Access-Control-Allow-Credentials: true

POST
H/1.1 200
OK v1
web.vortex.data.microsoft.com/collect/ 0
0 53ms
34ms Other
application/json 40.77.226.250
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://web.vortex.data.microsoft.com/collect/v1?$mscomCookies=false&ext-javascript-msfpc=%27GUID%3D3ff44c62b8374b3aa5ed490d01310cab%26HASH%3D3ff4%26LV%3D202102%26V%3D4%26LU%3D1612774954714%27
Requested by: Host: az725175.vo.msecnd.net
URL: https://az725175.vo.msecnd.net/scripts/jsll-4.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 40.77.226.250 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.microsoft.com/security/blog/2017/01/25/detecting-threat-actors-in-recent-german-industrial-attacks-with-windows-defender-atp/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Access-Control-Allow-Origin: https://www.microsoft.com
Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Origin, X-Xbl-Contract-Version, X-Xbl-Device-Type, Xbl-Authz-Actor-10, WithCredentials
Access-Control-Allow-Credentials: true

Verdicts & Comments Add Verdict or Comment

59 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

7 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.microsoft.com/	1970-01-20 00:44:09	Name: visid_incap_1204013 Value: AyeSdPEwTiWWnXmtXKX1uSr+IGAAAAAAQUIPAAAAAAAaOofnrqdlcuccTTXLTDaQ
.microsoft.com/	1970-01-20 00:45:10	Name: MC1 Value: GUID=3ff44c62b8374b3aa5ed490d01310cab&HASH=3ff4&LV=202102&V=4&LU=1612774954714
.microsoft.com/	1969-12-31 23:59:59	Name: incap_ses_534_1204013 Value: jcoJYZo1ZRzDjGhEdiZpByr+IGAAAAAA7IawLAva6ZHwA+wMLVdfTg==
.microsoft.com/	1970-01-19 15:59:36	Name: MS0 Value: b48af6d8ef6840ae8158551cb0850b47
www.microsoft.com/	1970-01-20 00:45:10	Name: MSFPC Value: GUID=3ff44c62b8374b3aa5ed490d01310cab&HASH=3ff4&LV=202102&V=4&LU=1612774954714
.microsoft.com/	1969-12-31 23:59:59	Name: incap_ses_769_1204013 Value: 9UrgVth3VU4W6DmFqQmsCir+IGAAAAAAi85iJrxl0XRCOhQSWtaEBA==
.microsoft.com/	1970-01-19 15:59:42	Name: ak_bmsc Value: 9DD7F54C3B2E5A7BCB39B0BDA569B2295C7B6B6DC71C00002AFE2060DA310F37~plAiNZ8BUsfokAX7LTFQwoi9F7mvd8LNywj2ZhNFW6u2AKOHYrIxHvMIbFVZGeRl5FfH3gjnhv888edF4CFLXoNDvxb/0GoqYe94i//jaXJONIRfJY9fbAzdMmkSQVIB4A3fLE8zkEjCz/zrOluy95TNO8mRKD9faf07GyqsGZU9W5M+qyiVZdqwuKFqMpLM6jIjyTCS+sCj5besSE1w5LSjoxzG99/8+DTCOFa676cfxQgw7Ab6owVfYen8hT5xsI

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://www.microsoft.com/security/blog/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1(Line 2) Message: JQMIGRATE: Migrate is installed, version 1.4.1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.onestore.ms
az725175.vo.msecnd.net
c.s-microsoft.com
cloudblogs.microsoft.com
img-prod-cms-rt-microsoft-com.akamaized.net
login.live.com
mem.gfx.ms
statics-marketingsites-wcus-ms-com.akamaized.net
wcpstatic.microsoft.com
web.vortex.data.microsoft.com
www.microsoft.com
107.154.114.97
152.199.19.160
2.16.186.32
2620:1ec:bdf::13
2a02:26f0:10c:5a0::356e
2a02:26f0:10c:5a9::2957
2a02:26f0:1700:181::37
2a02:26f0:1700:1ab::356e
2a02:26f0:6c00::210:ba28
40.126.31.143
40.77.226.250
047ff7cfd5956ecf06bd9fc9fd123772f2c5825cce3d124418ba418d540a5b98
06b2e0143ca1583c507056d1bc66a4024530340ba5582682180d3e2dce56d163
07bfeb4f1504dcc863762ce7efbf98b42b5fb9f6e79e84d43c501c227cef815c
0bd288d5397a69ead391875b422bf2cbdcc4f795d64aa2f780aff45768d78248
0c35a9475280fe5d14591e387aa6655201bec91e940d1afa7f9f025c1671215b
112fec798b78aa02e102a724b5cb1990c0f909bc1d8b7b1fa256eab41bbc0960
1232bbdbc5d205f3c5a40efa5ed92839c79e7879d5168445cc47645bb93f7d1b
16d6e957a9525cb4848051b0efc5aa101d256a3c6838007dc4ac2c41121eaade
196d3e71a396f75f52b94bf617e5f4474b85ca2f358f32cc81d3521731fde20c
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
1fd0aad556b3673a3027b1103e86b68798b4e21c63653f5215fac96a9e122da2
208edbed32b2adac9446df83caa4a093a261492ba6b8b3bcfe6a75efb8b70294
22b4df5c33045b645cafa45b04685f4752e471a2e933bff5bf14324d87deee12
263c838778f4fd75cca524a50211b5c8e652c1bd86ccfabcc689a23fe655fd15
316b809cfdf3473565dfcc757edc602418cd71442fed870a7a2e422ae8c153ab
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
4919e80f038d2b93f1184d1733ac35009643481735c7bc7aa31d8b56e118fc04
49227788ed30d606e3a0f7b55caf9995f183b42d56a45cb0f446ff03e33c72c1
4b61b59b5f8f21097b7db7ab003365c16630820c2c1952ac8915d366338976a5
4f7f4afe26e71fa9ca1dac4a43b557a554a46f53251d849f07ed08a04829d74b
6a93c2fe5cc182962663343edc3d48d8956b6b83593c6c4831374b23e0738006
6ba0d1a726f1887bd61727b308ed0be0e73edba17d4ad11b91ab19b632e078f6
6ebcda7a3a41ef97f0b4071160ceb1020e540fdc0f790079a5c2ef01ab654fe0
707c5b510b5712a82fd8bdf073a6d9860583931ee85f6ee7e2e735e81ae05d18
70c7aea0149e29eb4a6777094041ff3d4c98be84015b55580b647dff91141d11
73f547c75c6f6574b281470ee6a1c6c3cebe30a3a23317d293411974e575f35e
81889aabd655316edbb18eedef6f4ff2004d03b7bc45a74d6bd85f5c63bc4422
8288a3fbfce54a91832c0cfc1e944fcd86eb23dde32fe8dd75ca92996e528735
860dfad266fa20598d1dfab12b17132851954579470711a19113b3ced42a4d06
893fa7fe8b6e69e2828319c04a7cbb6f129ea820db695d4ced5757d59450b6a8
8abcaad96a14142a4fabfe794b98192cf30c21eb6038b8264bc6d8b5f8bb83ed
8e87a6bb0e676ce4318c66fd6927939010aac33d4586f75fe1fed85c9a4b30f6
8f7c0844bd6c6c72a0ded39fb2bfc75fe69d20214d743f8b6a1c86a0c568921c
96d33f532112177ede6bf262dcf6d0140dbe29f05a4595d17b0be4743205b5ea
99e2919bb976d17737c20b5ff82271437d26c15fab363c5b277bdcbb03bcff59
a58941524adf31d97c86f42995772c3a250918e696d00afc4c78d149f2adc43f
aa163f4777f0ee19e5f23ac0f332c22f06cd621696c62f527067c32a8c6c3a98
af95eb407a52531853c4aaa5a991f8a139e026031f04cc9e1a39f70643eb23e9
afbd6d3dbf677900ec3d80e8057a7b9f93f72e5971494ed7ce7a4be1cb7c9ae8
b1d83c2d49c49ea38d578afa752aaec44a86d069d6ce2d54460e2612fc31a102
b201ab52de2c92539f7a276b6cf170b1bdf0f3705f1b6ab9597517d030afefe4
b828b15e9b7836b493a8bd6e832a24ee13aa8b6f8b4a1bf307a7af2912014178
bca7af0b45b6fc6a2064e8e7a34f2041f3e77261e63f0257209bcde6bc40545d
c965f854e2429f283ac9ca2f8f7641b10e6f43f7ef1f0ad6482f1f7b6b5a21f6
ca1c3bff15d76e5b5699ac228268a67618ce4b3bc5f83c1ba53be4a66073e9c3
ccb734f5ed4702b8e95450889f1a9b5a5fb86b697c2b2b390c608b466d8fadfb
d87d0a7a7fe2c36d1dc093bfe56e9b81b311988789dbd3b65abf811d551ef02f
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e6ae3f1b722d6ec4f294ad9d77761a49b8cbe06cd96a35d6664de217484a2d53
ee2b841529e5d06aeae7f65b413b40bbfef5161c9fad9a8a1755dac03806291b
f174b3ce00dc0ef25fe0867dae1da92a595c50f730dbe2cd1fd7f29546034e81
f258c099e2bb029f6c9d5e9900a78f53347a16b43aa1e37a9f9c1a1539e0748d
f2a28cd82e7ec00d2d8158f21fb0507722cd8b09fa4a0a16fadc58f30385cc25
fc21f6638411ea112dcc19fb6b4b8e80a46a97e0a2a572fa6c45e1b8a2cf0dd1
fc8369e0dab606147e7787c7848a1233604c9e847003d4da6fa137ed5a39f601
fe8a1047376498c80a157d13555e42a92ad480fcb0bcc9de51ad1930fbeb7f91

www.microsoft.com Open in urlscan Pro 2a02:26f0:1700:1ab::356e Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

56 Requests

100 %HTTPS

55 %IPv6

7 Domains

11 Subdomains

12 IPs

3 Countries

2090 kBTransfer

4086 kBSize

7 Cookies

58 Outgoing links

Redirected requests

56 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.microsoft.com Open in urlscan Pro
2a02:26f0:1700:1ab::356e Public Scan

Screenshot
Live screenshot

Full Image

56
Requests

100 %
HTTPS

55 %
IPv6

7
Domains

11
Subdomains

12
IPs

3
Countries

2090 kB
Transfer

4086 kB
Size

7
Cookies

56 HTTP transactions
3 data transactions