urlscan.io logo urlscan.io
SecurityTrails logo

f.c2r.ts.cdn.office.net Open in urlscan Pro
2a02:26f0:3500:2b::17cf:d25f  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://f.c2r.ts.cdn.office.net//pr/wsus/setup.exe
Effective URL: https://f.c2r.ts.cdn.office.net//pr/wsus/setup.exe
Submission: On May 15 via manual from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 1 HTTP transactions. The main IP is 2a02:26f0:3500:2b::17cf:d25f, located in Frankfurt am Main, Germany and belongs to AKAMAI-ASN1, NL. The main domain is f.c2r.ts.cdn.office.net. The Cisco Umbrella rank of the primary domain is 1819.
TLS certificate: Issued by Microsoft Azure RSA TLS Issuing CA 08 on April 18th 2024. Valid for: a year.
This is the only time f.c2r.ts.cdn.office.net was scanned on urlscan.io!

urlscan.io Verdict: No classification

Downloads These files were downloaded by the website

setup.exe 7 MB application/x-dosexec
MIME: PE32 executable (console) Intel 80386, for MS Windows
Size: 7 MB (7730856 bytes, 100% done)
Downloaded from: https://f.c2r.ts.cdn.office.net//pr/wsus/setup.exe

Domain & IP information

IP Address AS Autonomous System
1 2a02:26f0:350... 20940 (AKAMAI-ASN1)
1 1
Apex Domain
Subdomains		 Transfer
1 office.net
f.c2r.ts.cdn.office.net — Cisco Umbrella Rank: 1819
1 1
Domain Requested by
1 f.c2r.ts.cdn.office.net
1 1

This site contains no links.

Subject Issuer Validity Valid
ak.officecdn.microsoft.com
Microsoft Azure RSA TLS Issuing CA 08		 2024-04-18 -
2025-04-13		 a year crt.sh

This page contains 1 frames:

Primary Page: https://f.c2r.ts.cdn.office.net//pr/wsus/setup.exe
Frame ID: 94CE3DBC371B0C588549EC69431FEB43
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

Page Statistics

1
Requests

100 %
HTTPS

100 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

0 kB
Transfer

0 kB
Size

0
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

Redirected requests

There were HTTP redirect chains for the following requests:

1 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request setup.exe
f.c2r.ts.cdn.office.net//pr/wsus/
Redirect Chain
  • http://f.c2r.ts.cdn.office.net//pr/wsus/setup.exe
  • https://f.c2r.ts.cdn.office.net//pr/wsus/setup.exe
0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://f.c2r.ts.cdn.office.net//pr/wsus/setup.exe
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:2b::17cf:d25f Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
ECAcc (frc/4CD7) /
Resource Hash

Request headers

Accept-Language
de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

Accept-Ranges
bytes
Alt-Svc
h3=":443"; ma=93600,h3-29=":443"; ma=93600,h3-Q050=":443"; ma=93600,quic=":443"; ma=93600; v="46,43"
Cache-Control
public, max-age=940
Connection
keep-alive
Content-Disposition
attachment; filename=setup.exe; filename*=UTF-8''setup.exe
Content-Length
7730856
Content-Type
application/octet-stream
Date
Wed, 15 May 2024 18:48:53 GMT
ETag
"0xC42859AB479BFD8F553C5AA559BEF5F3FF8B76F5A82E0D9D1EAFFB4135B02C01"
Last-Modified
Mon, 15 Apr 2024 15:47:00 GMT
Server
ECAcc (frc/4CD7)
X-CCC
DE
X-CID
2
X-Ms-ApiVersion
Distribute 1.2
X-Ms-Region
prod-weu-z1

Redirect headers

Location
https://f.c2r.ts.cdn.office.net//pr/wsus/setup.exe
Non-Authoritative-Reason
HttpsUpgrades

Verdicts & Comments Add Verdict or Comment

0 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

0 Cookies

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

f.c2r.ts.cdn.office.net
2a02:26f0:3500:2b::17cf:d25f