urlscan.io logo urlscan.io
SecurityTrails logo

docs.microsoft.com Open in urlscan Pro
2a02:26f0:eb:389::353e  Public Scan

Go To Rescan Add Verdict Report
URL: https://docs.microsoft.com/en-us/advanced-threat-analytics/suspicious-activity-guide
Submission: On November 09 via api from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 11 IPs in 5 countries across 9 domains to perform 25 HTTP transactions. The main IP is 2a02:26f0:eb:389::353e, located in Ascension Island and belongs to AKAMAI-ASN1, EU. The main domain is docs.microsoft.com.
TLS certificate: Issued by Microsoft RSA TLS CA 01 on October 8th 2020. Valid for: a year.
This is the only time docs.microsoft.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
10 2a02:26f0:eb:... 20940 (AKAMAI-ASN1)
1 152.199.19.160 15133 (EDGECAST)
1 2620:1ec:bdf::10 8068 (MICROSOFT...)
2 2a00:1450:400... 15169 (GOOGLE)
1 151.101.114.217 54113 (FASTLY)
5 5 140.82.121.4 36459 (GITHUB)
5 151.101.112.133 54113 (FASTLY)
2 40.77.226.250 8075 (MICROSOFT...)
1 99.80.110.198 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
1 2 52.142.114.2 8075 (MICROSOFT...)
1 1 2620:1ec:c11:... 8068 (MICROSOFT...)
25 11
10    2a02:26f0:eb:389::353e (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)
docs.microsoft.com
1    152.199.19.160 (United States)

ASN15133 (EDGECAST, US)
az725175.vo.msecnd.net
1    2620:1ec:bdf::10 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
wcpstatic.microsoft.com
2    2a00:1450:4001:81a::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    151.101.114.217 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
cdn.speedcurve.com
5    140.82.121.4 (United States)

ASN36459 (GITHUB, US)
PTR: lb-140-82-121-4-fra.github.com
github.com
5    151.101.112.133 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
avatars0.githubusercontent.com
avatars1.githubusercontent.com
avatars3.githubusercontent.com
2    40.77.226.250 (Dublin, Ireland)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
web.vortex.data.microsoft.com
1    99.80.110.198 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-99-80-110-198.eu-west-1.compute.amazonaws.com
w.usabilla.com
1    2a00:1450:400c:c00::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
2    52.142.114.2 (Dublin, Ireland)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
c1.microsoft.com
1    2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
c.bing.com
Domain Requested by
10 docs.microsoft.com docs.microsoft.com
5 github.com 5 redirects
3 avatars1.githubusercontent.com docs.microsoft.com
2 c1.microsoft.com 1 redirects
2 web.vortex.data.microsoft.com az725175.vo.msecnd.net
2 www.google-analytics.com docs.microsoft.com
www.google-analytics.com
1 c.bing.com 1 redirects
1 stats.g.doubleclick.net www.google-analytics.com
1 w.usabilla.com docs.microsoft.com
1 avatars3.githubusercontent.com docs.microsoft.com
1 avatars0.githubusercontent.com docs.microsoft.com
1 cdn.speedcurve.com docs.microsoft.com
1 wcpstatic.microsoft.com docs.microsoft.com
1 az725175.vo.msecnd.net docs.microsoft.com
25 14
Subject Issuer Validity Valid
docs.microsoft.com
Microsoft RSA TLS CA 01		 2020-10-08 -
2021-10-08		 a year crt.sh
*.vo.msecnd.net
Microsoft IT TLS CA 2		 2020-03-18 -
2022-03-18		 2 years crt.sh
wcpstatic.microsoft.com
DigiCert SHA2 Secure Server CA		 2020-09-15 -
2021-09-15		 a year crt.sh
*.google-analytics.com
GTS CA 1O1		 2020-10-20 -
2021-01-12		 3 months crt.sh
a3.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3		 2020-10-20 -
2021-05-05		 6 months crt.sh
www.github.com
DigiCert SHA2 High Assurance Server CA		 2020-05-06 -
2022-04-14		 2 years crt.sh
*.vortex.data.microsoft.com
Microsoft RSA TLS CA 02		 2020-10-05 -
2021-10-05		 a year crt.sh
w.usabilla.com
Amazon		 2020-04-10 -
2021-05-10		 a year crt.sh
*.g.doubleclick.net
GTS CA 1O1		 2020-10-20 -
2021-01-12		 3 months crt.sh
c.msn.com
Microsoft RSA TLS CA 01		 2020-10-07 -
2021-10-07		 a year crt.sh

This page contains 2 frames:

Primary Page: https://docs.microsoft.com/en-us/advanced-threat-analytics/suspicious-activity-guide
Frame ID: B2715BC0F415F21D2BCD1B3D7C8086CA
Requests: 25 HTTP requests in this frame

Frame: https://w.usabilla.com/cd99660205c0.js?lv=1
Frame ID: 84AF35D3CDA719064912EF350B3044C1
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Page Statistics

25
Requests

100 %
HTTPS

42 %
IPv6

9
Domains

14
Subdomains

11
IPs

5
Countries

636 kB
Transfer

2182 kB
Size

8
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 14
  • https://github.com/shsagir.png?size=32 HTTP 302
  • https://avatars0.githubusercontent.com/u/51323195?s=32&v=4
Request Chain 15
  • https://github.com/msmbaldwin.png?size=32 HTTP 302
  • https://avatars1.githubusercontent.com/u/5092332?s=32&v=4
Request Chain 16
  • https://github.com/DCtheGeek.png?size=32 HTTP 302
  • https://avatars1.githubusercontent.com/u/11442954?s=32&v=4
Request Chain 17
  • https://github.com/mlottner.png?size=32 HTTP 302
  • https://avatars1.githubusercontent.com/u/41567042?s=32&v=4
Request Chain 18
  • https://github.com/rkarlin.png?size=32 HTTP 302
  • https://avatars3.githubusercontent.com/u/7419039?s=32&v=4
Request Chain 24
  • https://c1.microsoft.com/c.gif?DI=4050&did=1&t= HTTP 302
  • https://c.bing.com/c.gif?DI=4050&did=1&t=&CtsSyncId=A681F00D97124F588E7F680C2597D3DA&RedC=c1.microsoft.com&MXFR=1E73925CBDA362921F0D9D21B9A3647A HTTP 302
  • https://c1.microsoft.com/c.gif?DI=4050&did=1&t=&CtsSyncId=A681F00D97124F588E7F680C2597D3DA&MUID=1E73925CBDA362921F0D9D21B9A3647A

25 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request suspicious-activity-guide
docs.microsoft.com/en-us/advanced-threat-analytics/ 		82 KB
27 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://docs.microsoft.com/en-us/advanced-threat-analytics/suspicious-activity-guide
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:eb:389::353e , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software
/
Resource Hash
24ea91e3f0d47b4f4c82c5e249a862ae06861d683237decb724730880131793b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

:method
GET
:authority
docs.microsoft.com
:scheme
https
:path
/en-us/advanced-threat-analytics/suspicious-activity-guide
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

status
200
etag
"/rBsbiff7dZ4c8oQolDjiefRpqJpJCzhvZj1zzDmSfE="
request-context
appId=cid-v1:cd765a3e-2aba-43aa-b307-6e4b3b4be342
x-datacenter
eus
x-frame-options
SAMEORIGIN
x-content-type-options
nosniff
x-ua-compatible
IE=edge
x-xss-protection
1; mode=block
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-rendering-stack
Dynamic
content-type
text/html
content-encoding
gzip
vary
Accept-Encoding
content-length
27288
cache-control
public, max-age=567
expires
Mon, 09 Nov 2020 13:23:01 GMT
date
Mon, 09 Nov 2020 13:13:34 GMT
akamai-cache-status
Miss from child, RefreshHit from parent
report-to
{"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://mdec.nelreports.net/api/report?cat=mdocs"}]}
nel
{"report_to":"network-errors","max_age":604800,"success_fraction":0.01,"failure_fraction":1.0}
1c983901.site-ltr.css
docs.microsoft.com/_themes/docs.theme/master/en-us/_themes/styles/ 		406 KB
57 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://docs.microsoft.com/_themes/docs.theme/master/en-us/_themes/styles/1c983901.site-ltr.css
Requested by
Host: docs.microsoft.com
URL: https://docs.microsoft.com/en-us/advanced-threat-analytics/suspicious-activity-guide
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:eb:389::353e , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software
/
Resource Hash
05cca6287b409b63e2d75534098efd2d41e380772cfa1535d5e8d66c101e50dd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://docs.microsoft.com/en-us/advanced-threat-analytics/suspicious-activity-guide
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
nel
{"report_to":"network-errors","max_age":604800,"success_fraction":0.01,"failure_fraction":1.0}
status
200
content-length
57652
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge
last-modified
Fri, 06 Nov 2020 19:27:37 GMT
x-datacenter
wus
x-frame-options
SAMEORIGIN
date
Mon, 09 Nov 2020 13:13:34 GMT
vary
Accept-Encoding
report-to
{"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://mdec.nelreports.net/api/report?cat=mdocs"}]}
content-type
text/css
cache-control
max-age=368118
etag
"0x8D8828A04C7010F"
akamai-cache-status
Hit from child
request-context
appId=cid-v1:21aee9e4-1cf5-4750-b2bd-78b2747f4211
expires
Fri, 13 Nov 2020 19:28:52 GMT
55917fe3.conceptual.css
docs.microsoft.com/_themes/docs.theme/master/en-us/_themes/styles/ 		3 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://docs.microsoft.com/_themes/docs.theme/master/en-us/_themes/styles/55917fe3.conceptual.css
Requested by
Host: docs.microsoft.com
URL: https://docs.microsoft.com/en-us/advanced-threat-analytics/suspicious-activity-guide
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:eb:389::353e , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software
/
Resource Hash
7630344087112a324fee2c996b96bfbd67ed5ac984f883260ba203efd33fc634
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://docs.microsoft.com/en-us/advanced-threat-analytics/suspicious-activity-guide
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
nel
{"report_to":"network-errors","max_age":604800,"success_fraction":0.01,"failure_fraction":1.0}
status
200
content-length
1095
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge
last-modified
Fri, 30 Oct 2020 17:07:16 GMT
x-datacenter
eus
x-frame-options
SAMEORIGIN
date
Mon, 09 Nov 2020 13:13:34 GMT
vary
Accept-Encoding
report-to
{"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://mdec.nelreports.net/api/report?cat=mdocs"}]}
content-type
text/css
cache-control
max-age=155491
etag
"0x8D87CF64113D1BB"
akamai-cache-status
Hit from child
request-context
appId=cid-v1:cd765a3e-2aba-43aa-b307-6e4b3b4be342
expires
Wed, 11 Nov 2020 08:25:05 GMT
298d06f8.index-polyfills.js
docs.microsoft.com/_themes/docs.theme/master/en-us/_themes/scripts/ 		22 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://docs.microsoft.com/_themes/docs.theme/master/en-us/_themes/scripts/298d06f8.index-polyfills.js
Requested by
Host: docs.microsoft.com
URL: https://docs.microsoft.com/en-us/advanced-threat-analytics/suspicious-activity-guide
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:eb:389::353e , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software
/
Resource Hash
b5b0e638f46915286afbf779214118a2d2bfbf6369c4390ea2fd5b652f63e0de
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://docs.microsoft.com/en-us/advanced-threat-analytics/suspicious-activity-guide
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
nel
{"report_to":"network-errors","max_age":604800,"success_fraction":0.01,"failure_fraction":1.0}
status
200
content-length
6125
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge
last-modified
Fri, 06 Nov 2020 19:27:36 GMT
x-datacenter
eus
x-frame-options
SAMEORIGIN
date
Mon, 09 Nov 2020 13:13:34 GMT
vary
Accept-Encoding
report-to
{"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://mdec.nelreports.net/api/report?cat=mdocs"}]}
content-type
application/javascript
cache-control
max-age=477615
etag
"0x8D8828A04A7DA86"
akamai-cache-status
Hit from child
request-context
appId=cid-v1:cd765a3e-2aba-43aa-b307-6e4b3b4be342
expires
Sun, 15 Nov 2020 01:53:49 GMT
7a13b8cc.index-docs.js
docs.microsoft.com/_themes/docs.theme/master/en-us/_themes/scripts/ 		1 MB
305 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://docs.microsoft.com/_themes/docs.theme/master/en-us/_themes/scripts/7a13b8cc.index-docs.js
Requested by
Host: docs.microsoft.com
URL: https://docs.microsoft.com/en-us/advanced-threat-analytics/suspicious-activity-guide
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:eb:389::353e , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software
/
Resource Hash
469bd7a1e957d33714570ddebe7b686ab7f8ea01af9ee6e796424d99c0f99c6b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://docs.microsoft.com/en-us/advanced-threat-analytics/suspicious-activity-guide
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
nel
{"report_to":"network-errors","max_age":604800,"success_fraction":0.01,"failure_fraction":1.0}
status
200
content-length
311181
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge
last-modified
Fri, 06 Nov 2020 19:27:36 GMT
x-datacenter
wus
x-frame-options
SAMEORIGIN
date
Mon, 09 Nov 2020 13:13:34 GMT
vary
Accept-Encoding
report-to
{"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://mdec.nelreports.net/api/report?cat=mdocs"}]}
content-type
application/javascript
cache-control
max-age=368139
etag
"0x8D8828A04C2BA7C"
akamai-cache-status
Hit from child
request-context
appId=cid-v1:21aee9e4-1cf5-4750-b2bd-78b2747f4211
expires
Fri, 13 Nov 2020 19:29:13 GMT
toc.json
docs.microsoft.com/en-us/advanced-threat-analytics/ 		6 KB
2 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://docs.microsoft.com/en-us/advanced-threat-analytics/toc.json
Requested by
Host: docs.microsoft.com
URL: https://docs.microsoft.com/_themes/docs.theme/master/en-us/_themes/scripts/7a13b8cc.index-docs.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:eb:389::353e , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software
/
Resource Hash
68f05972492edc6d795dc28ce09627c1aa812070e137e2cdb3d878dfc7e11f7f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://docs.microsoft.com/en-us/advanced-threat-analytics/suspicious-activity-guide
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
nel
{"report_to":"network-errors","max_age":604800,"success_fraction":0.01,"failure_fraction":1.0}
status
200
content-length
1618
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge
x-rendering-stack
Static
last-modified
Mon, 14 Sep 2020 13:31:23 GMT
x-datacenter
eus
x-frame-options
SAMEORIGIN
date
Mon, 09 Nov 2020 13:13:34 GMT
vary
Accept-Encoding
report-to
{"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://mdec.nelreports.net/api/report?cat=mdocs"}]}
content-type
application/json
cache-control
public, max-age=456
etag
"0x8D858B2798577DE"
akamai-cache-status
Miss from child, Hit from parent
request-context
appId=cid-v1:cd765a3e-2aba-43aa-b307-6e4b3b4be342
expires
Mon, 09 Nov 2020 13:21:10 GMT
toc.json
docs.microsoft.com/en-us/advanced-threat-analytics/bread/ 		767 B
998 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://docs.microsoft.com/en-us/advanced-threat-analytics/bread/toc.json
Requested by
Host: docs.microsoft.com
URL: https://docs.microsoft.com/_themes/docs.theme/master/en-us/_themes/scripts/7a13b8cc.index-docs.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:eb:389::353e , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software
/
Resource Hash
ce4fabd95151b4a79fcc7c58dacbbce5c25ada8ad5be0e6be00a77f871de8e09
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://docs.microsoft.com/en-us/advanced-threat-analytics/suspicious-activity-guide
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
nel
{"report_to":"network-errors","max_age":604800,"success_fraction":0.01,"failure_fraction":1.0}
status
200
content-length
379
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge
x-rendering-stack
Static
last-modified
Tue, 14 Jul 2020 11:58:34 GMT
x-datacenter
wus
x-frame-options
SAMEORIGIN
date
Mon, 09 Nov 2020 13:13:34 GMT
vary
Accept-Encoding
report-to
{"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://mdec.nelreports.net/api/report?cat=mdocs"}]}
content-type
application/json
cache-control
public, max-age=500
etag
"0x8D827ED3C1C5C3D"
akamai-cache-status
Miss from child, Hit from parent
request-context
appId=cid-v1:21aee9e4-1cf5-4750-b2bd-78b2747f4211
expires
Mon, 09 Nov 2020 13:21:54 GMT
jsll-4.js
az725175.vo.msecnd.net/scripts/ 		55 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://az725175.vo.msecnd.net/scripts/jsll-4.js
Requested by
Host: docs.microsoft.com
URL: https://docs.microsoft.com/_themes/docs.theme/master/en-us/_themes/scripts/7a13b8cc.index-docs.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.199.19.160 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (paa/6F47) /
Resource Hash
0cd276ca60dcb0f9d19cdf696f5c75e68ba28ed9115b0171c6138cfdbad5c694

Request headers

Referer
https://docs.microsoft.com/en-us/advanced-threat-analytics/suspicious-activity-guide
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 09 Nov 2020 13:13:34 GMT
content-encoding
gzip
content-md5
6MuJ0polBYxf+MsUfabf2Q==
age
1050
x-cache
HIT
status
200
content-length
18365
x-ms-lease-status
unlocked
last-modified
Wed, 07 Oct 2020 19:06:44 GMT
server
ECAcc (paa/6F47)
etag
0x8D86AF42210ED79
vary
Accept-Encoding
content-type
text/javascript; charset="utf-8"
x-ms-request-id
99f646bc-001e-000c-3397-b621da000000
cache-control
public, max-age=1800, immutable
x-ms-version
2009-09-19
wcp-consent.js
wcpstatic.microsoft.com/mscc/lib/v2/ 		51 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Requested by
Host: docs.microsoft.com
URL: https://docs.microsoft.com/_themes/docs.theme/master/en-us/_themes/scripts/7a13b8cc.index-docs.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:bdf::10 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
919dca34db91911735f214ed2cff5e08f37459d94a364afb3df187baf1f77aff

Request headers

Referer
https://docs.microsoft.com/en-us/advanced-threat-analytics/suspicious-activity-guide
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Mon, 09 Nov 2020 13:13:34 GMT
content-encoding
gzip
vary
Accept-Encoding
content-md5
1SASGSEzi1FltZlq3xaTHA==
age
31391
x-cache
HIT
status
200
content-length
12802
x-ms-lease-status
unlocked
last-modified
Wed, 14 Oct 2020 22:31:33 GMT
etag
0x8D87090E7569F4F
x-azure-ref
0fkCpXwAAAAD7Ppn1WXDwTrs8x6n6bkMhRlJBMzFFREdFMDMxMwAzOWI0NjE1Ny1jYjllLTQ5YjctYTY1YS04NzIyYTNmODI0ZTQ=
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
da45c09a-001e-006b-2451-b65046000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
max-age=43200
x-ms-version
2009-09-19
truncated
/ 		68 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
7d3e8e9d05c54aff571ff105976c145b27661ce222919bb88555db6e6df88dd7

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/png
docons.dedb94a4.woff2
docs.microsoft.com/_themes/docs.theme/master/en-us/_themes/styles/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://docs.microsoft.com/_themes/docs.theme/master/en-us/_themes/styles/docons.dedb94a4.woff2
Requested by
Host: docs.microsoft.com
URL: https://docs.microsoft.com/_themes/docs.theme/master/en-us/_themes/styles/1c983901.site-ltr.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:eb:389::353e , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software
/
Resource Hash
a15bc176d07c97d7f4b02ab75fd7429f9cbe207b39494a58c06dc0457e1efda5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Origin
https://docs.microsoft.com
Referer
https://docs.microsoft.com/_themes/docs.theme/master/en-us/_themes/styles/1c983901.site-ltr.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
x-content-type-options
nosniff
nel
{"report_to":"network-errors","max_age":604800,"success_fraction":0.01,"failure_fraction":1.0}
status
200
content-length
11176
x-xss-protection
1; mode=block
x-ua-compatible
IE=edge
last-modified
Fri, 06 Nov 2020 19:27:37 GMT
x-datacenter
wus
date
Mon, 09 Nov 2020 13:13:34 GMT
x-frame-options
SAMEORIGIN
report-to
{"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://mdec.nelreports.net/api/report?cat=mdocs"}]}
content-type
application/font-woff2
cache-control
max-age=368075
etag
"0x8D8828A04E89904"
akamai-cache-status
Hit from child
request-context
appId=cid-v1:21aee9e4-1cf5-4750-b2bd-78b2747f4211
expires
Fri, 13 Nov 2020 19:28:09 GMT
SegoeUI-Roman-VF_web.woff2
docs.microsoft.com/static/third-party/SegoeUIWeb/1.01.206/ 		116 KB
116 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://docs.microsoft.com/static/third-party/SegoeUIWeb/1.01.206/SegoeUI-Roman-VF_web.woff2
Requested by
Host: docs.microsoft.com
URL: https://docs.microsoft.com/_themes/docs.theme/master/en-us/_themes/styles/1c983901.site-ltr.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:eb:389::353e , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
63c12051016796d92bcf4bc20b4881057475e6dfa4937c29c9e16054814ab47d
Security Headers
Name Value
Strict-Transport-Security max-age=15768000 ; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Origin
https://docs.microsoft.com
Referer
https://docs.microsoft.com/_themes/docs.theme/master/en-us/_themes/styles/1c983901.site-ltr.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
strict-transport-security
max-age=15768000 ; includeSubDomains
x-content-type-options
nosniff
nel
{"report_to":"network-errors","max_age":604800,"success_fraction":0.01,"failure_fraction":1.0}
content-md5
vKlyGNyjyxXOAoTLy0UokA==
status
200
content-length
118288
etag
0x8D81ECF728C138C
x-ms-lease-status
unlocked
last-modified
Thu, 02 Jul 2020 21:32:40 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
date
Mon, 09 Nov 2020 13:13:34 GMT
report-to
{"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://mdec.nelreports.net/api/report?cat=mdocs"}]}
content-type
application/octet-stream
access-control-allow-origin
*
x-ms-request-id
68535b71-601e-009e-1925-55b6d5000000
cache-control
max-age=20820385
x-ms-version
2009-09-19
akamai-cache-status
Hit from child
expires
Thu, 08 Jul 2021 12:39:59 GMT
latest.woff2
docs.microsoft.com/static/third-party/SegoeUI/5.32/west-european/italic/ 		27 KB
28 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://docs.microsoft.com/static/third-party/SegoeUI/5.32/west-european/italic/latest.woff2
Requested by
Host: docs.microsoft.com
URL: https://docs.microsoft.com/_themes/docs.theme/master/en-us/_themes/styles/1c983901.site-ltr.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:eb:389::353e , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
e172a02b68f977a57a1690507df809db1e43130f0161961709a36dbd70b4d25f
Security Headers
Name Value
Strict-Transport-Security max-age=15768000 ; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Origin
https://docs.microsoft.com
Referer
https://docs.microsoft.com/_themes/docs.theme/master/en-us/_themes/styles/1c983901.site-ltr.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
strict-transport-security
max-age=15768000 ; includeSubDomains
x-content-type-options
nosniff
nel
{"report_to":"network-errors","max_age":604800,"success_fraction":0.01,"failure_fraction":1.0}
content-md5
KDXuKBsHfKiscoVwIAfIlA==
status
200
content-length
27624
etag
0x8D81ECF72818A4F
x-ms-lease-status
unlocked
last-modified
Thu, 02 Jul 2020 21:32:40 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
date
Mon, 09 Nov 2020 13:13:34 GMT
report-to
{"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://mdec.nelreports.net/api/report?cat=mdocs"}]}
content-type
application/octet-stream
access-control-allow-origin
*
x-ms-request-id
28349933-701e-0009-4578-54d51c000000
cache-control
max-age=20746022
x-ms-version
2009-09-19
akamai-cache-status
Hit from child
expires
Wed, 07 Jul 2021 16:00:36 GMT
analytics.js
www.google-analytics.com/ 		46 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: docs.microsoft.com
URL: https://docs.microsoft.com/_themes/docs.theme/master/en-us/_themes/scripts/7a13b8cc.index-docs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:81a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://docs.microsoft.com/en-us/advanced-threat-analytics/suspicious-activity-guide
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 23 Oct 2020 03:00:57 GMT
server
Golfe2
age
7066
date
Mon, 09 Nov 2020 11:15:48 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18817
expires
Mon, 09 Nov 2020 13:15:48 GMT
lux.js
cdn.speedcurve.com/js/ 		21 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.speedcurve.com/js/lux.js?id=409849828
Requested by
Host: docs.microsoft.com
URL: https://docs.microsoft.com/_themes/docs.theme/master/en-us/_themes/scripts/7a13b8cc.index-docs.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.114.217 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache /
Resource Hash
e0735ac215c8c6f724a54c599f2357d91aac9bffcee01ef069dc27d2feac9777
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Origin
https://docs.microsoft.com
Referer
https://docs.microsoft.com/en-us/advanced-threat-analytics/suspicious-activity-guide
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15768000
content-encoding
gzip
age
1976
x-cache
HIT
status
200
content-length
6862
x-served-by
cache-hhn4067-HHN
access-control-allow-origin
*
last-modified
Mon, 09 Nov 2020 12:40:39 GMT
server
Apache
x-timer
S1604927615.067353,VS0,VE0
date
Mon, 09 Nov 2020 13:13:35 GMT
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
via
1.1 varnish
expires
Mon, 16 Nov 2020 12:40:39 GMT
cache-control
max-age=604800
x-ua-compatible
IE=edge
accept-ranges
bytes
timing-allow-origin
*
x-cache-hits
86
51323195
avatars0.githubusercontent.com/u/
Redirect Chain
  • https://github.com/shsagir.png?size=32
  • https://avatars0.githubusercontent.com/u/51323195?s=32&v=4
995 B
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://avatars0.githubusercontent.com/u/51323195?s=32&v=4
Requested by
Host: docs.microsoft.com
URL: https://docs.microsoft.com/en-us/advanced-threat-analytics/suspicious-activity-guide
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.112.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
b3724bb570b85fcabe6dc497f945cd6eff6c77fea4083e776d1e17b8acd858f1
Security Headers
Name Value
Content-Security-Policy default-src 'none'
Strict-Transport-Security max-age=31557600
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

Referer
https://docs.microsoft.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Fastly-Request-ID
42df68831831dadda14e6a5856bed014e72ecf53
Content-Security-Policy
default-src 'none'
Via
1.1 varnish
X-Content-Type-Options
nosniff
X-Cache
HIT
X-Cache-Hits
2
Connection
keep-alive
Vary
Authorization,Accept-Encoding
Content-Length
995
X-Xss-Protection
1; mode=block
X-Served-By
cache-hhn4083-HHN
Last-Modified
Mon, 03 Jun 2019 11:37:45 GMT
X-GitHub-Request-Id
39C6:E0C5:2F8F056:32063EF:5FA6B9E4
X-Timer
S1604927615.275729,VS0,VE0
X-Frame-Options
deny
Date
Mon, 09 Nov 2020 13:13:35 GMT
Source-Age
165529
Strict-Transport-Security
max-age=31557600
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
max-age=300
Etag
"bd5342d5084d26742c21816a5cbc9a304eb4d875"
Accept-Ranges
bytes
Timing-Allow-Origin
https://github.com
Expires
Mon, 09 Nov 2020 13:18:35 GMT

Redirect headers

date
Mon, 09 Nov 2020 13:13:35 GMT
x-content-type-options
nosniff
status
302 Found
strict-transport-security
max-age=31536000; includeSubdomains; preload
Content-Length
128
x-xss-protection
1; mode=block
referrer-policy
origin-when-cross-origin, strict-origin-when-cross-origin
server
GitHub.com
X-GitHub-Request-Id
7996:93F8:24048E:31ADA1:5FA9407F
x-frame-options
deny
expect-ct
max-age=2592000, report-uri="https://api.github.com/_private/browser/errors"
vary
X-PJAX, Accept-Encoding, Accept, X-Requested-With, Accept-Encoding
content-type
image/png; charset=utf-8
location
https://avatars0.githubusercontent.com/u/51323195?s=32&v=4
cache-control
no-cache
content-security-policy
default-src 'none'; base-uri 'self'; block-all-mixed-content; connect-src 'self' uploads.github.com www.githubstatus.com collector.githubapp.com api.github.com www.google-analytics.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com cdn.optimizely.com logx.optimizely.com/v1/events wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com; frame-ancestors 'none'; frame-src render.githubusercontent.com; img-src 'self' data: github.githubassets.com identicons.github.com collector.githubapp.com github-cloud.s3.amazonaws.com *.githubusercontent.com; manifest-src 'self'; media-src 'none'; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; worker-src github.com/socket-worker.js gist.github.com/socket-worker.js
5092332
avatars1.githubusercontent.com/u/
Redirect Chain
  • https://github.com/msmbaldwin.png?size=32
  • https://avatars1.githubusercontent.com/u/5092332?s=32&v=4
883 B
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://avatars1.githubusercontent.com/u/5092332?s=32&v=4
Requested by
Host: docs.microsoft.com
URL: https://docs.microsoft.com/en-us/advanced-threat-analytics/suspicious-activity-guide
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.112.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
d8b310346be355b8344f3e5bf4cdb209644792c0b9ab06c2cde3020f0d97c3a7
Security Headers
Name Value
Content-Security-Policy default-src 'none'
Strict-Transport-Security max-age=31557600
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

Referer
https://docs.microsoft.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Fastly-Request-ID
14fb64a11cadbd2fbe5382cb466a5dbd12a544c4
Content-Security-Policy
default-src 'none'
Via
1.1 varnish
X-Content-Type-Options
nosniff
X-Cache
HIT
X-Cache-Hits
1
Connection
keep-alive
Vary
Authorization,Accept-Encoding
Content-Length
883
X-Xss-Protection
1; mode=block
X-Served-By
cache-hhn4058-HHN
Last-Modified
Wed, 11 Feb 2015 20:10:25 GMT
X-GitHub-Request-Id
5B0C:2A92:2FF520B:3273619:5FA820AA
X-Timer
S1604927615.160041,VS0,VE1
X-Frame-Options
deny
Date
Mon, 09 Nov 2020 13:13:35 GMT
Source-Age
73684
Strict-Transport-Security
max-age=31557600
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
max-age=300
Etag
"7273de13ec0e7b570dfc6110864190da495372db"
Accept-Ranges
bytes
Timing-Allow-Origin
https://github.com
Expires
Mon, 09 Nov 2020 13:18:35 GMT

Redirect headers

date
Mon, 09 Nov 2020 13:13:22 GMT
x-content-type-options
nosniff
status
302 Found
strict-transport-security
max-age=31536000; includeSubdomains; preload
Content-Length
127
x-xss-protection
1; mode=block
referrer-policy
origin-when-cross-origin, strict-origin-when-cross-origin
server
GitHub.com
X-GitHub-Request-Id
7992:8B1A:EDACD:148543:5FA9407F
x-frame-options
deny
expect-ct
max-age=2592000, report-uri="https://api.github.com/_private/browser/errors"
vary
X-PJAX, Accept-Encoding, Accept, X-Requested-With, Accept-Encoding
content-type
image/png; charset=utf-8
location
https://avatars1.githubusercontent.com/u/5092332?s=32&v=4
cache-control
no-cache
content-security-policy
default-src 'none'; base-uri 'self'; block-all-mixed-content; connect-src 'self' uploads.github.com www.githubstatus.com collector.githubapp.com api.github.com www.google-analytics.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com cdn.optimizely.com logx.optimizely.com/v1/events wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com; frame-ancestors 'none'; frame-src render.githubusercontent.com; img-src 'self' data: github.githubassets.com identicons.github.com collector.githubapp.com github-cloud.s3.amazonaws.com *.githubusercontent.com; manifest-src 'self'; media-src 'none'; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; worker-src github.com/socket-worker.js gist.github.com/socket-worker.js
11442954
avatars1.githubusercontent.com/u/
Redirect Chain
  • https://github.com/DCtheGeek.png?size=32
  • https://avatars1.githubusercontent.com/u/11442954?s=32&v=4
1009 B
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://avatars1.githubusercontent.com/u/11442954?s=32&v=4
Requested by
Host: docs.microsoft.com
URL: https://docs.microsoft.com/en-us/advanced-threat-analytics/suspicious-activity-guide
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.112.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
9e22171ee92d512b0cbc341a91a7a3d3de8695a02217bd3d63f7c04096440a94
Security Headers
Name Value
Content-Security-Policy default-src 'none'
Strict-Transport-Security max-age=31557600
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

Referer
https://docs.microsoft.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Fastly-Request-ID
0c9fdfb8d318605405076bd04b3d4aeacd705a2b
Content-Security-Policy
default-src 'none'
Via
1.1 varnish
X-Content-Type-Options
nosniff
X-Cache
HIT
X-Cache-Hits
462
Connection
keep-alive
Vary
Authorization,Accept-Encoding
Content-Length
1009
X-Xss-Protection
1; mode=block
X-Served-By
cache-hhn4079-HHN
Last-Modified
Mon, 12 Feb 2018 16:29:42 GMT
X-GitHub-Request-Id
AFEE:2EE2:2E12D6:3869B8:5F62D6DB
X-Timer
S1604927615.159503,VS0,VE0
X-Frame-Options
deny
Date
Mon, 09 Nov 2020 13:13:35 GMT
Source-Age
4614563
Strict-Transport-Security
max-age=31557600
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
max-age=300
Etag
"ba1a8357753023531c014457fd75c64080ed0cc0"
Accept-Ranges
bytes
Timing-Allow-Origin
https://github.com
Expires
Mon, 09 Nov 2020 13:18:35 GMT

Redirect headers

date
Mon, 09 Nov 2020 13:11:37 GMT
x-content-type-options
nosniff
status
302 Found
strict-transport-security
max-age=31536000; includeSubdomains; preload
Content-Length
128
x-xss-protection
1; mode=block
referrer-policy
origin-when-cross-origin, strict-origin-when-cross-origin
server
GitHub.com
X-GitHub-Request-Id
799A:2CE5:224D51:2EF387:5FA9407F
x-frame-options
deny
expect-ct
max-age=2592000, report-uri="https://api.github.com/_private/browser/errors"
vary
X-PJAX, Accept-Encoding, Accept, X-Requested-With, Accept-Encoding
content-type
image/png; charset=utf-8
location
https://avatars1.githubusercontent.com/u/11442954?s=32&v=4
cache-control
no-cache
content-security-policy
default-src 'none'; base-uri 'self'; block-all-mixed-content; connect-src 'self' uploads.github.com www.githubstatus.com collector.githubapp.com api.github.com www.google-analytics.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com cdn.optimizely.com logx.optimizely.com/v1/events wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com; frame-ancestors 'none'; frame-src render.githubusercontent.com; img-src 'self' data: github.githubassets.com identicons.github.com collector.githubapp.com github-cloud.s3.amazonaws.com *.githubusercontent.com; manifest-src 'self'; media-src 'none'; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; worker-src github.com/socket-worker.js gist.github.com/socket-worker.js
41567042
avatars1.githubusercontent.com/u/
Redirect Chain
  • https://github.com/mlottner.png?size=32
  • https://avatars1.githubusercontent.com/u/41567042?s=32&v=4
918 B
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://avatars1.githubusercontent.com/u/41567042?s=32&v=4
Requested by
Host: docs.microsoft.com
URL: https://docs.microsoft.com/en-us/advanced-threat-analytics/suspicious-activity-guide
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.112.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
762190ee34bfcd24955a3fe5aff6eb3145e5762b0f41242f6349b563421e4340
Security Headers
Name Value
Content-Security-Policy default-src 'none'
Strict-Transport-Security max-age=31557600
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

Referer
https://docs.microsoft.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Fastly-Request-ID
582500cd7d47a0d0984f62261bbf224748b0998b
Content-Security-Policy
default-src 'none'
Via
1.1 varnish
X-Content-Type-Options
nosniff
X-Cache
HIT
X-Cache-Hits
2
Connection
keep-alive
Vary
Authorization,Accept-Encoding
Content-Length
918
X-Xss-Protection
1; mode=block
X-Served-By
cache-hhn4031-HHN
Last-Modified
Mon, 23 Jul 2018 07:36:57 GMT
X-GitHub-Request-Id
755A:BAA4:4F8A89A:5461954:5F755929
X-Timer
S1604927615.160192,VS0,VE0
X-Frame-Options
deny
Date
Mon, 09 Nov 2020 13:13:35 GMT
Source-Age
3401557
Strict-Transport-Security
max-age=31557600
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
max-age=300
Etag
"4ca112a53ba2f05d3f32c2cbb0aa1424db5b09af"
Accept-Ranges
bytes
Timing-Allow-Origin
https://github.com
Expires
Mon, 09 Nov 2020 13:18:35 GMT

Redirect headers

date
Mon, 09 Nov 2020 13:11:39 GMT
x-content-type-options
nosniff
status
302 Found
strict-transport-security
max-age=31536000; includeSubdomains; preload
Content-Length
128
x-xss-protection
1; mode=block
referrer-policy
origin-when-cross-origin, strict-origin-when-cross-origin
server
GitHub.com
X-GitHub-Request-Id
7998:276C:1E6F7F:29B3B5:5FA9407F
x-frame-options
deny
expect-ct
max-age=2592000, report-uri="https://api.github.com/_private/browser/errors"
vary
X-PJAX, Accept-Encoding, Accept, X-Requested-With, Accept-Encoding
content-type
image/png; charset=utf-8
location
https://avatars1.githubusercontent.com/u/41567042?s=32&v=4
cache-control
no-cache
content-security-policy
default-src 'none'; base-uri 'self'; block-all-mixed-content; connect-src 'self' uploads.github.com www.githubstatus.com collector.githubapp.com api.github.com www.google-analytics.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com cdn.optimizely.com logx.optimizely.com/v1/events wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com; frame-ancestors 'none'; frame-src render.githubusercontent.com; img-src 'self' data: github.githubassets.com identicons.github.com collector.githubapp.com github-cloud.s3.amazonaws.com *.githubusercontent.com; manifest-src 'self'; media-src 'none'; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; worker-src github.com/socket-worker.js gist.github.com/socket-worker.js
7419039
avatars3.githubusercontent.com/u/
Redirect Chain
  • https://github.com/rkarlin.png?size=32
  • https://avatars3.githubusercontent.com/u/7419039?s=32&v=4
946 B
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://avatars3.githubusercontent.com/u/7419039?s=32&v=4
Requested by
Host: docs.microsoft.com
URL: https://docs.microsoft.com/en-us/advanced-threat-analytics/suspicious-activity-guide
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.112.133 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
543788070c771e78653ee3be1fcf6849b5b382becb1ce8f17519c76312e00586
Security Headers
Name Value
Content-Security-Policy default-src 'none'
Strict-Transport-Security max-age=31557600
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

Referer
https://docs.microsoft.com/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Fastly-Request-ID
52229fd6aad6ee76934c3923a0d6fadeb237d0a7
Content-Security-Policy
default-src 'none'
Via
1.1 varnish
X-Content-Type-Options
nosniff
X-Cache
HIT
X-Cache-Hits
2
Connection
keep-alive
Vary
Authorization,Accept-Encoding
Content-Length
946
X-Xss-Protection
1; mode=block
X-Served-By
cache-hhn4035-HHN
Last-Modified
Wed, 09 Sep 2015 08:59:51 GMT
X-GitHub-Request-Id
459E:7AA8:13217E:168166:5E936470
X-Timer
S1604927615.163410,VS0,VE0
X-Frame-Options
deny
Date
Mon, 09 Nov 2020 13:13:35 GMT
Source-Age
18209804
Strict-Transport-Security
max-age=31557600
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
max-age=300
Etag
"42fb906cd1a7d93f482c15ba8ae261e5dd4d038a"
Accept-Ranges
bytes
Timing-Allow-Origin
https://github.com
Expires
Mon, 09 Nov 2020 13:18:35 GMT

Redirect headers

date
Mon, 09 Nov 2020 13:11:55 GMT
x-content-type-options
nosniff
status
302 Found
strict-transport-security
max-age=31536000; includeSubdomains; preload
Content-Length
127
x-xss-protection
1; mode=block
referrer-policy
origin-when-cross-origin, strict-origin-when-cross-origin
server
GitHub.com
X-GitHub-Request-Id
7994:2CE1:927EE:C9845:5FA9407F
x-frame-options
deny
expect-ct
max-age=2592000, report-uri="https://api.github.com/_private/browser/errors"
vary
X-PJAX, Accept-Encoding, Accept, X-Requested-With, Accept-Encoding
content-type
image/png; charset=utf-8
location
https://avatars3.githubusercontent.com/u/7419039?s=32&v=4
cache-control
no-cache
content-security-policy
default-src 'none'; base-uri 'self'; block-all-mixed-content; connect-src 'self' uploads.github.com www.githubstatus.com collector.githubapp.com api.github.com www.google-analytics.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com cdn.optimizely.com logx.optimizely.com/v1/events wss://alive.github.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com; frame-ancestors 'none'; frame-src render.githubusercontent.com; img-src 'self' data: github.githubassets.com identicons.github.com collector.githubapp.com github-cloud.s3.amazonaws.com *.githubusercontent.com; manifest-src 'self'; media-src 'none'; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; worker-src github.com/socket-worker.js gist.github.com/socket-worker.js
t.js
web.vortex.data.microsoft.com/collect/v1/ 		281 B
966 B 		Script
General
Check archive.org
Download Go to
Full URL
https://web.vortex.data.microsoft.com/collect/v1/t.js?ver=%272.1%27&name=%27Ms.Webi.PageView%27&time=%272020-11-09T13%3A13%3A34.993Z%27&os=%27MacOS%27&appId=%27JS%3ADocs%27&-ver=%271.0%27&-impressionGuid=%27a0b8b12a-1210-45e6-95f6-a0b68c1ccd39%27&-pageName=%270300af32-7568-5553-e183-e15e490456a3%27&-uri=%27https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fadvanced-threat-analytics%2Fsuspicious-activity-guide%27&-market=%27en-us%27&-pageType=%27conceptual%27&-resHeight=1200&-resWidth=1600&-pageTags=%27%7B%22author%22%3A%22shsagir%22%2C%22depotname%22%3A%22Azure.ATADocs%22%2C%22document_version_independent_id%22%3A%2247bfec66-9a46-c09e-f8f7-f4b49aed56bb%22%2C%22gitcommit%22%3A%22https%3A%2F%2Fgithub.com%2FMicrosoftDocs%2FATADocs-pr%2Fblob%2Fa017db1ebfed20ec732825cb25107d2714ee46dd%2FATADocs%2Fsuspicious-activity-guide.md%22%2C%22manager%22%3A%22shsagir%22%2C%22asst%22%3A%221fe5fd6f-1b79-4a25-8051-2f94ff6c71c1%22%2C%22pgauth%22%3A%22shsagir%22%2C%22date%22%3A%2204%2F03%2F2019%22%2C%22product%22%3A%22advanced-threat-analytics%22%2C%22reviewer%22%3A%22bennyl%22%2C%22suite%22%3A%22ems%22%2C%22technology%22%3A%22%22%2C%22pgtop%22%3A%22conceptual%22%2C%22giturl%22%3A%22https%3A%2F%2Fgithub.com%2FMicrosoftDocs%2FATADocs-pr%2Fblob%2Flive%2FATADocs%2Fsuspicious-activity-guide.md%22%2C%22publishtime%22%3A%222020-09-22%2003%3A20%20PM%22%2C%22contentlocale%22%3A%22en-us%22%2C%22highContrast%22%3A%22false%22%2C%22metaTags%22%3A%7B%7D%7D%27&-behavior=0&*baseType=%27Ms.Content.PageView%27&*cookieEnabled=true&*isJs=true&*title=%27ATA%20suspicious%20activity%20guide%20%7C%20Microsoft%20Docs%27&*isLoggedIn=false&*flashInstalled=false&ext-javascript-ver=%271.1%27&ext-javascript-libVer=%274.3.3%27&ext-javascript-domain=%27docs.microsoft.com%27&ext-javascript-userConsent=true&$mscomCookies=false
Requested by
Host: az725175.vo.msecnd.net
URL: https://az725175.vo.msecnd.net/scripts/jsll-4.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
40.77.226.250 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
2aaf703796f170360d829730bfbfa6c62f3363c2c3bccfeddfcd3a8b89dde47e
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://docs.microsoft.com/en-us/advanced-threat-analytics/suspicious-activity-guide
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 09 Nov 2020 13:13:34 GMT
X-Content-Type-Options
nosniff
P3P
CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
Cache-Control
no-cache, no-store
MS-CV
ro69g78VO0S1OZWTIVDflQ.0
Content-Type
application/javascript
Content-Length
281
Expires
0
cd99660205c0.js
w.usabilla.com/ Frame 84AF 		49 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://w.usabilla.com/cd99660205c0.js?lv=1
Requested by
Host: docs.microsoft.com
URL: https://docs.microsoft.com/en-us/advanced-threat-analytics/suspicious-activity-guide
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
99.80.110.198 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-99-80-110-198.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
a74f1354b1cbace790d99ea88b7e1059f2a07396bf4f39d9998c9f22c7aa273f

Request headers

Referer
https://docs.microsoft.com/en-us/advanced-threat-analytics/suspicious-activity-guide
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 09 Nov 2020 13:13:35 GMT
content-encoding
gzip
x-widget-server
2.1
etag
"f43bf9a335ece547fb2ebdc6e99c362c"
content-type
text/javascript
status
200
cache-control
public,max-age=0
content-length
12444
collect
www.google-analytics.com/j/ 		4 B
69 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j87&aip=1&a=2045544212&t=pageview&_s=1&dl=https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fadvanced-threat-analytics%2Fsuspicious-activity-guide&ul=en-us&de=UTF-8&dt=ATA%20suspicious%20activity%20guide%20%7C%20Microsoft%20Docs&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAAC~&jid=1785779928&gjid=1731148521&cid=8120383.1604927615&tid=UA-62780441-21&_gid=1944050106.1604927615&_r=1&_slc=1&cd2=off&cd3=Conceptual&z=1880994700
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:81a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://docs.microsoft.com/en-us/advanced-threat-analytics/suspicious-activity-guide
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Mon, 09 Nov 2020 13:13:35 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
status
200
content-type
text/plain
access-control-allow-origin
https://docs.microsoft.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/ 		1 B
88 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j87&tid=UA-62780441-21&cid=8120383.1604927615&jid=1785779928&gjid=1731148521&_gid=1944050106.1604927615&_u=YEBAAEAAAAAAAC~&z=1292779392
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c00::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://docs.microsoft.com/en-us/advanced-threat-analytics/suspicious-activity-guide
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Mon, 09 Nov 2020 13:13:35 GMT
status
200
content-type
text/plain
access-control-allow-origin
https://docs.microsoft.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-Q050=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
t.js
web.vortex.data.microsoft.com/collect/v1/ 		45 B
407 B 		Script
General
Check archive.org
Download Go to
Full URL
https://web.vortex.data.microsoft.com/collect/v1/t.js?ver=%272.1%27&name=%27Ms.Webi.ContentUpdate%27&time=%272020-11-09T13%3A13%3A35.310Z%27&os=%27MacOS%27&appId=%27JS%3ADocs%27&-ver=%271.0%27&-impressionGuid=%27a0b8b12a-1210-45e6-95f6-a0b68c1ccd39%27&-pageName=%270300af32-7568-5553-e183-e15e490456a3%27&-uri=%27https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fadvanced-threat-analytics%2Fsuspicious-activity-guide%27&-market=%27en-us%27&-pageTags=%27%7B%22author%22%3A%22shsagir%22%2C%22depotname%22%3A%22Azure.ATADocs%22%2C%22document_version_independent_id%22%3A%2247bfec66-9a46-c09e-f8f7-f4b49aed56bb%22%2C%22gitcommit%22%3A%22https%3A%2F%2Fgithub.com%2FMicrosoftDocs%2FATADocs-pr%2Fblob%2Fa017db1ebfed20ec732825cb25107d2714ee46dd%2FATADocs%2Fsuspicious-activity-guide.md%22%2C%22manager%22%3A%22shsagir%22%2C%22asst%22%3A%221fe5fd6f-1b79-4a25-8051-2f94ff6c71c1%22%2C%22pgauth%22%3A%22shsagir%22%2C%22date%22%3A%2204%2F03%2F2019%22%2C%22product%22%3A%22advanced-threat-analytics%22%2C%22reviewer%22%3A%22bennyl%22%2C%22suite%22%3A%22ems%22%2C%22technology%22%3A%22%22%2C%22pgtop%22%3A%22conceptual%22%2C%22giturl%22%3A%22https%3A%2F%2Fgithub.com%2FMicrosoftDocs%2FATADocs-pr%2Fblob%2Flive%2FATADocs%2Fsuspicious-activity-guide.md%22%2C%22publishtime%22%3A%222020-09-22%2003%3A20%20PM%22%2C%22contentlocale%22%3A%22en-us%22%2C%22highContrast%22%3A%22false%22%2C%22metaTags%22%3A%7B%7D%2C%22timing%22%3A%22%7B%5C%22first-paint%5C%22%3A604.6999990940094%2C%5C%22first-contentful-paint%5C%22%3A604.6999990940094%2C%5C%22navigationStart%5C%22%3A1604927614299%2C%5C%22unloadEventStart%5C%22%3A0%2C%5C%22unloadEventEnd%5C%22%3A0%2C%5C%22redirectStart%5C%22%3A0%2C%5C%22redirectEnd%5C%22%3A0%2C%5C%22fetchStart%5C%22%3A1604927614300%2C%5C%22domainLookupStart%5C%22%3A1604927614300%2C%5C%22domainLookupEnd%5C%22%3A1604927614302%2C%5C%22connectStart%5C%22%3A1604927614302%2C%5C%22connectEnd%5C%22%3A1604927614319%2C%5C%22secureConnectionStart%5C%22%3A1604927614307%2C%5C%22requestStart%5C%22%3A1604927614319%2C%5C%22responseStart%5C%22%3A1604927614518%2C%5C%22responseEnd%5C%22%3A1604927614524%2C%5C%22domLoading%5C%22%3A1604927614522%2C%5C%22domInteractive%5C%22%3A1604927614656%2C%5C%22domContentLoadedEventStart%5C%22%3A1604927614656%2C%5C%22domContentLoadedEventEnd%5C%22%3A1604927614877%2C%5C%22domComplete%5C%22%3A1604927615289%2C%5C%22loadEventStart%5C%22%3A1604927615289%2C%5C%22loadEventEnd%5C%22%3A1604927615301%7D%22%7D%27&-pageHeight=17297&-vpHeight=1200&-vpWidth=1600&-behavior=0&-vScrollOffset=0&-hScrollOffset=0&-contentVer=%272.0%27&-content=%27%5B%5D%27&*baseType=%27Ms.Content.ContentUpdate%27&*title=%27ATA%20suspicious%20activity%20guide%20%7C%20Microsoft%20Docs%27&*cookieEnabled=true&*isJs=true&*isDomComplete=true&*isLoggedIn=false&*pageLoadTime=990&ext-javascript-ver=%271.1%27&ext-javascript-libVer=%274.3.3%27&ext-javascript-domain=%27docs.microsoft.com%27&ext-javascript-msfpc=%27GUID%3Df0b1a927eb25414fa27e35d5532ff812%26HASH%3Df0b1%26LV%3D202011%26V%3D4%26LU%3D1604927615214%27&ext-javascript-userConsent=true&$mscomCookies=false
Requested by
Host: az725175.vo.msecnd.net
URL: https://az725175.vo.msecnd.net/scripts/jsll-4.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
40.77.226.250 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
c9a4dd7b50eeb82a90457cb58ab085c427494828b3c8c8b5649c6c51b3c65175
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://docs.microsoft.com/en-us/advanced-threat-analytics/suspicious-activity-guide
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Mon, 09 Nov 2020 13:13:34 GMT
X-Content-Type-Options
nosniff
P3P
CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
Cache-Control
no-cache, no-store
MS-CV
0BVrvWqSU06TO0tDa+d/Kg.0
Content-Type
application/javascript
Content-Length
45
Expires
0
c.gif
c1.microsoft.com/
Redirect Chain
  • https://c1.microsoft.com/c.gif?DI=4050&did=1&t=
  • https://c.bing.com/c.gif?DI=4050&did=1&t=&CtsSyncId=A681F00D97124F588E7F680C2597D3DA&RedC=c1.microsoft.com&MXFR=1E73925CBDA362921F0D9D21B9A3647A
  • https://c1.microsoft.com/c.gif?DI=4050&did=1&t=&CtsSyncId=A681F00D97124F588E7F680C2597D3DA&MUID=1E73925CBDA362921F0D9D21B9A3647A
42 B
252 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c1.microsoft.com/c.gif?DI=4050&did=1&t=&CtsSyncId=A681F00D97124F588E7F680C2597D3DA&MUID=1E73925CBDA362921F0D9D21B9A3647A
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.142.114.2 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Referer
https://docs.microsoft.com/en-us/advanced-threat-analytics/suspicious-activity-guide
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Mon, 09 Nov 2020 13:13:35 GMT
etag
"4ac1f9bd94acd61:0"
last-modified
Tue, 27 Oct 2020 19:09:49 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
status
200
cache-control
private, no-cache, proxy-revalidate, no-store
accept-ranges
bytes
content-type
image/gif
content-length
42

Redirect headers

pragma
no-cache
date
Mon, 09 Nov 2020 13:13:34 GMT
x-msedge-ref
Ref A: 607A2F2F95FC4D179C6B2ECC4300061D Ref B: FRAEDGE1314 Ref C: 2020-11-09T13:13:35Z
x-powered-by
ASP.NET
status
302
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location
https://c1.microsoft.com/c.gif?DI=4050&did=1&t=&CtsSyncId=A681F00D97124F588E7F680C2597D3DA&MUID=1E73925CBDA362921F0D9D21B9A3647A
cache-control
private, no-cache, proxy-revalidate, no-store
content-length
0

Verdicts & Comments Add Verdict or Comment

30 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes object| msDocs object| __core-js_shared__ object| core function| applyFocusVisiblePolyfill object| litHtmlVersions function| __assign function| __extends function| setTheme function| WcpConsent function| mscc string| GoogleAnalyticsObject function| ga object| LUX object| LUX_ae object| LUX_al object| awa string| behaviorKey function| lightningjs object| google_tag_data object| gaplugins object| gaGlobal object| gaData number| LUX_t_start number| LUX_t_end

8 Cookies

Domain/Path Name / Value
docs.microsoft.com/ Name: MSFPC
Value: GUID=f0b1a927eb25414fa27e35d5532ff812&HASH=f0b1&LV=202011&V=4&LU=1604927615214
.microsoft.com/ Name: MC1
Value: GUID=f0b1a927eb25414fa27e35d5532ff812&HASH=f0b1&LV=202011&V=4&LU=1604927615214
.microsoft.com/ Name: MSCC
Value: NR
.microsoft.com/ Name: _gid
Value: GA1.2.1944050106.1604927615
.microsoft.com/ Name: MS0
Value: 04106aeaddbc43f0830d532c6b73058c
.microsoft.com/ Name: _gat
Value: 1
.microsoft.com/ Name: _ga
Value: GA1.2.8120383.1604927615
docs.microsoft.com/ Name: lux_uid
Value: 160492761508422771

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

avatars0.githubusercontent.com
avatars1.githubusercontent.com
avatars3.githubusercontent.com
az725175.vo.msecnd.net
c.bing.com
c1.microsoft.com
cdn.speedcurve.com
docs.microsoft.com
github.com
stats.g.doubleclick.net
w.usabilla.com
wcpstatic.microsoft.com
web.vortex.data.microsoft.com
www.google-analytics.com
140.82.121.4
151.101.112.133
151.101.114.217
152.199.19.160
2620:1ec:bdf::10
2620:1ec:c11::200
2a00:1450:4001:81a::200e
2a00:1450:400c:c00::9c
2a02:26f0:eb:389::353e
40.77.226.250
52.142.114.2
99.80.110.198
05cca6287b409b63e2d75534098efd2d41e380772cfa1535d5e8d66c101e50dd
0cd276ca60dcb0f9d19cdf696f5c75e68ba28ed9115b0171c6138cfdbad5c694
24ea91e3f0d47b4f4c82c5e249a862ae06861d683237decb724730880131793b
2aaf703796f170360d829730bfbfa6c62f3363c2c3bccfeddfcd3a8b89dde47e
469bd7a1e957d33714570ddebe7b686ab7f8ea01af9ee6e796424d99c0f99c6b
543788070c771e78653ee3be1fcf6849b5b382becb1ce8f17519c76312e00586
63c12051016796d92bcf4bc20b4881057475e6dfa4937c29c9e16054814ab47d
68f05972492edc6d795dc28ce09627c1aa812070e137e2cdb3d878dfc7e11f7f
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
762190ee34bfcd24955a3fe5aff6eb3145e5762b0f41242f6349b563421e4340
7630344087112a324fee2c996b96bfbd67ed5ac984f883260ba203efd33fc634
7d3e8e9d05c54aff571ff105976c145b27661ce222919bb88555db6e6df88dd7
919dca34db91911735f214ed2cff5e08f37459d94a364afb3df187baf1f77aff
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9e22171ee92d512b0cbc341a91a7a3d3de8695a02217bd3d63f7c04096440a94
a15bc176d07c97d7f4b02ab75fd7429f9cbe207b39494a58c06dc0457e1efda5
a74f1354b1cbace790d99ea88b7e1059f2a07396bf4f39d9998c9f22c7aa273f
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b3724bb570b85fcabe6dc497f945cd6eff6c77fea4083e776d1e17b8acd858f1
b5b0e638f46915286afbf779214118a2d2bfbf6369c4390ea2fd5b652f63e0de
c9a4dd7b50eeb82a90457cb58ab085c427494828b3c8c8b5649c6c51b3c65175
ce4fabd95151b4a79fcc7c58dacbbce5c25ada8ad5be0e6be00a77f871de8e09
d8b310346be355b8344f3e5bf4cdb209644792c0b9ab06c2cde3020f0d97c3a7
e0735ac215c8c6f724a54c599f2357d91aac9bffcee01ef069dc27d2feac9777
e172a02b68f977a57a1690507df809db1e43130f0161961709a36dbd70b4d25f
e441c3e2771625ba05630ab464275136a82c99650ee2145ca5aa9853bedeb01b