www.microsoft.com Open in urlscan Pro
2a02:26f0:6c00:183::356e Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
Submission: On March 06 via api (March 6th 2020, 7:11:06 pm UTC) from US

Summary HTTP 87 Redirects Links 80 Behaviour Indicators

Summary

This website contacted 18 IPs in 4 countries across 13 domains to perform 87 HTTP transactions. The main IP is 2a02:26f0:6c00:183::356e, located in Ascension Island and belongs to AKAMAI-ASN1, US. The main domain is www.microsoft.com.
TLS certificate: Issued by Microsoft IT TLS CA 5 on October 21st 2019. Valid for: 2 years.

This is the only time www.microsoft.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
33	2a02:26f0:6c0... 2a02:26f0:6c00:183::356e	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	2a02:26f0:10c... 2a02:26f0:10c:396::2957	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	184.30.221.161 184.30.221.161	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2.16.106.48 2.16.106.48	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
7	2a02:26f0:10c... 2a02:26f0:10c:381::356e	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a02:26f0:6c0... 2a02:26f0:6c00::210:ba1b	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
18	107.154.114.97 107.154.114.97	19551 (INCAPSULA) (INCAPSULA)
3	2a02:26f0:6c0... 2a02:26f0:6c00:19d::37	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
6	72.247.225.88 72.247.225.88	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2a02:26f0:10c... 2a02:26f0:10c:383::2b57	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	152.199.19.160 152.199.19.160	15133 (EDGECAST) (EDGECAST)
5	40.77.226.250 40.77.226.250	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	40.90.22.185 40.90.22.185	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2a02:26f0:10c... 2a02:26f0:10c:39e::25ea	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	23.210.248.44 23.210.248.44	16625 (AKAMAI-AS) (AKAMAI-AS)
1 2	2a05:f500:11:... 2a05:f500:11:101::b93f:9005	14413 (LINKEDIN) (LINKEDIN)
1 1	2a05:f500:11:... 2a05:f500:11:101::b93f:9001	14413 (LINKEDIN) (LINKEDIN)
1	23.210.250.213 23.210.250.213	16625 (AKAMAI-AS) (AKAMAI-AS)
87	18

33 2a02:26f0:6c00:183::356e (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

www.microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a02:26f0:10c:396::2957 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

assets.onestore.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 184.30.221.161 (Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a184-30-221-161.deploy.static.akamaitechnologies.com

query.prod.cms.rt.microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.16.106.48 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-16-106-48.deploy.static.akamaitechnologies.com

statics-marketingsites-wcus-ms-com.akamaized.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 2a02:26f0:10c:381::356e (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

c.s-microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6c00::210:ba1b (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

img-prod-cms-rt-microsoft-com.akamaized.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 107.154.114.97 (United States)

ASN19551 (INCAPSULA, US)
PTR: 107.154.114.97.ip.incapdns.net

cloudblogs.microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a02:26f0:6c00:19d::37 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

mem.gfx.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 72.247.225.88 (United States)

ASN16625 (AKAMAI-AS, US)
PTR: a72-247-225-88.deploy.static.akamaitechnologies.com

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:10c:383::2b57 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

uhf.microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 152.199.19.160 (United States)

ASN15133 (EDGECAST, US)

az725175.vo.msecnd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 40.77.226.250 (Dublin, Ireland)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

web.vortex.data.microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 40.90.22.185 (San Jose, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

login.live.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:10c:39e::25ea (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 23.210.248.44 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-248-44.deploy.static.akamaitechnologies.com

s7.addthis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
v1.addthisedge.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a05:f500:11:101::b93f:9005 (Ireland) 1 redirects

ASN14413 (LINKEDIN, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a05:f500:11:101::b93f:9001 (Ireland) 1 redirects

ASN14413 (LINKEDIN, US)

www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.210.250.213 (Netherlands)

ASN16625 (AKAMAI-AS, US)
PTR: a23-210-250-213.deploy.static.akamaitechnologies.com

z.moatads.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
58	microsoft.com www.microsoft.com query.prod.cms.rt.microsoft.com cloudblogs.microsoft.com uhf.microsoft.com web.vortex.data.microsoft.com	2 MB
7	s-microsoft.com c.s-microsoft.com	151 KB
6	adobedtm.com assets.adobedtm.com	49 KB
3	linkedin.com 2 redirects px.ads.linkedin.com www.linkedin.com	3 KB
3	gfx.ms mem.gfx.ms	55 KB
3	onestore.ms assets.onestore.ms	211 KB
2	addthis.com s7.addthis.com	189 KB
2	akamaized.net statics-marketingsites-wcus-ms-com.akamaized.net img-prod-cms-rt-microsoft-com.akamaized.net	5 KB
1	addthisedge.com v1.addthisedge.com	715 B
1	moatads.com z.moatads.com	1 KB
1	licdn.com snap.licdn.com	2 KB
1	live.com login.live.com
1	msecnd.net az725175.vo.msecnd.net	18 KB
87	13

	Domain	Requested by
33	www.microsoft.com	www.microsoft.com
18	cloudblogs.microsoft.com	www.microsoft.com
7	c.s-microsoft.com	www.microsoft.com
6	assets.adobedtm.com	query.prod.cms.rt.microsoft.com assets.adobedtm.com
5	web.vortex.data.microsoft.com	az725175.vo.msecnd.net
3	mem.gfx.ms	www.microsoft.com mem.gfx.ms
3	assets.onestore.ms	www.microsoft.com
2	px.ads.linkedin.com	1 redirects
2	s7.addthis.com	www.microsoft.com s7.addthis.com
1	v1.addthisedge.com	s7.addthis.com
1	z.moatads.com	s7.addthis.com
1	www.linkedin.com	1 redirects
1	snap.licdn.com	www.microsoft.com
1	login.live.com	mem.gfx.ms
1	az725175.vo.msecnd.net	www.microsoft.com
1	uhf.microsoft.com	www.microsoft.com
1	img-prod-cms-rt-microsoft-com.akamaized.net	www.microsoft.com
1	statics-marketingsites-wcus-ms-com.akamaized.net	www.microsoft.com
1	query.prod.cms.rt.microsoft.com	www.microsoft.com
87	19

This site contains links to these domains. Also see Links.

Domain
go.microsoft.com
azure.microsoft.com
products.office.com
servicetrust.microsoft.com
dynamics.microsoft.com
powerbi.microsoft.com
visualstudio.microsoft.com
docs.microsoft.com
technet.microsoft.com
msdn.microsoft.com
developer.microsoft.com
fasttrack.microsoft.com
partner.microsoft.com
partnercenter.microsoft.com
appsource.microsoft.com
azuremarketplace.microsoft.com
events.microsoft.com
cloudblogs.microsoft.com
blogs.technet.microsoft.com
cve.mitre.org
support.microsoft.com
download.windowsupdate.com
answers.microsoft.com
twitter.com
www.facebook.com
store.office.com
account.microsoft.com
channel9.msdn.com
careers.microsoft.com
news.microsoft.com
privacy.microsoft.com
choice.microsoft.com

Subject Issuer	Validity	Valid
www.microsoft.com Microsoft IT TLS CA 5	`2019-10-21` - `2021-10-21`	2 years	crt.sh
wildcard.onestore.ms Microsoft IT TLS CA 4	`2019-11-19` - `2021-11-19`	2 years	crt.sh
*.prod.cms.rt.microsoft.com Microsoft IT TLS CA 2	`2019-10-09` - `2021-10-09`	2 years	crt.sh
a248.e.akamai.net DigiCert Secure Site ECC CA-1	`2019-08-13` - `2020-08-12`	a year	crt.sh
cloudblogs.microsoft.com Microsoft IT TLS CA 5	`2020-01-14` - `2022-01-14`	2 years	crt.sh
mem.gfx.ms Microsoft IT TLS CA 2	`2020-01-06` - `2022-01-06`	2 years	crt.sh
assets.adobedtm.com DigiCert SHA2 High Assurance Server CA	`2019-10-22` - `2021-10-01`	2 years	crt.sh
unistore.www.microsoft.com Microsoft IT TLS CA 5	`2019-04-30` - `2021-04-30`	2 years	crt.sh
*.vo.msecnd.net Microsoft IT TLS CA 2	`2018-03-30` - `2020-03-30`	2 years	crt.sh
*.vortex.data.microsoft.com Microsoft IT TLS CA 4	`2020-01-21` - `2022-01-21`	2 years	crt.sh
login.live.com Microsoft IT TLS CA 1	`2019-11-05` - `2021-11-05`	2 years	crt.sh
*.licdn.com DigiCert SHA2 Secure Server CA	`2019-04-01` - `2021-05-07`	2 years	crt.sh
odc-prod-01.oracle.com DigiCert SHA2 Secure Server CA	`2019-10-10` - `2020-09-04`	a year	crt.sh
px.ads.linkedin.com DigiCert SHA2 Secure Server CA	`2019-05-29` - `2021-06-29`	2 years	crt.sh
moatads.com DigiCert SHA2 Secure Server CA	`2020-01-17` - `2021-03-17`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
Frame ID: EFDD90C8D2962E5EE61071FFE9769B08
Requests: 87 HTTP requests in this frame

Frame: https://login.live.com/me.srf?wa=wsignin1.0&wreply=https%3A%2F%2Fwww.microsoft.com&uaid=da987e05-2a6f-4cb4-11f7-b6a5884eb11b&partnerId=mssecurity
Frame ID: EC507B0D100FE052E5B0AB90F0033E91
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
headers link /rel="https:\/\/api\.w\.org\/"/i
html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
headers link /rel="https:\/\/api\.w\.org\/"/i
html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
headers link /rel="https:\/\/api\.w\.org\/"/i
html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

Yoast SEO (SEO) Expand

Overall confidence: 100%
Detected patterns

html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

Page Statistics

87
Requests

100 %
HTTPS

50 %
IPv6

13
Domains

19
Subdomains

18
IPs

4
Countries

2319 kB
Transfer

4689 kB
Size

3
Cookies

80 Outgoing links

These are links going to different origins than the main page.

URL: https://go.microsoft.com/fwlink/?linkid=845480
Title: Learn more

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en/services/active-directory/
Title: Azure Active Directory

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en/services/iot-central/
Title: Azure IoT Central

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en/services/azure-sphere/
Title: Azure Sphere

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en-us/services/azure-dedicated-hsm/
Title: Azure Dedicated HSM Gateway

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en/services/information-protection/
Title: Azure Information Protection

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en-us/services/key-vault/
Title: Azure Key Vault

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en-us/features/azure-advanced-threat-protection/
Title: Azure Advanced Threat Protection

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en-us/services/azure-sentinel/
Title: Azure Sentinel

Search URL Search Domain Scan URL

URL: https://products.office.com/en/exchange/advance-threat-protection
Title: Office 365 Advanced Threat Protection

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en-us/services/application-gateway/
Title: Azure Application Gateway

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en-us/services/ddos-protection/
Title: Azure DDoS Protection

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en/services/security-center/
Title: Azure Security Center

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en/services/application-gateway/
Title: Azure VPN Gateway

Search URL Search Domain Scan URL

URL: https://servicetrust.microsoft.com/ViewPage/HomePage
Title: Service Trust Portal

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/
Title: Azure

Search URL Search Domain Scan URL

URL: https://products.office.com/en-us/business/office
Title: Office 365

Search URL Search Domain Scan URL

URL: https://dynamics.microsoft.com/en-us/
Title: Dynamics 365

Search URL Search Domain Scan URL

URL: https://powerbi.microsoft.com/en-us/
Title: Power BI

Search URL Search Domain Scan URL

URL: https://products.office.com/en-us/microsoft-teams/group-chat-software
Title: Teams

Search URL Search Domain Scan URL

URL: https://visualstudio.microsoft.com/
Title: Visual Studio

Search URL Search Domain Scan URL

URL: https://go.microsoft.com/fwlink/?linkid=2026462
Title: Microsoft Advertising

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/services/cognitive-services/
Title: Azure Cognitive Services

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/
Title: Docs

Search URL Search Domain Scan URL

URL: https://technet.microsoft.com/en-us/ms376608.aspx
Title: TechNet

Search URL Search Domain Scan URL

URL: https://msdn.microsoft.com/en-us
Title: Developer Network

Search URL Search Domain Scan URL

URL: https://developer.microsoft.com/en-us/windows
Title: Windows Dev Center

Search URL Search Domain Scan URL

URL: https://fasttrack.microsoft.com/office
Title: FastTrack

Search URL Search Domain Scan URL

URL: https://partner.microsoft.com/
Title: Partner Network

Search URL Search Domain Scan URL

URL: https://partnercenter.microsoft.com/partner/home
Title: Partner Center

Search URL Search Domain Scan URL

URL: https://appsource.microsoft.com/
Title: AppSource

Search URL Search Domain Scan URL

URL: https://azuremarketplace.microsoft.com/marketplace/
Title: Azure Marketplace

Search URL Search Domain Scan URL

URL: https://events.microsoft.com/
Title: Events

Search URL Search Domain Scan URL

URL: https://cloudblogs.microsoft.com/microsoftsecure/2018/01/10/a-worthy-upgrade-next-gen-security-on-windows-10-proves-resilient-against-ransomware-outbreaks-in-2017/
Title: A worthy upgrade: Next-gen security on Windows 10 proves resilient against ransomware outbreaks in 2017

Search URL Search Domain Scan URL

URL: https://blogs.technet.microsoft.com/mmpc/2017/06/29/windows-10-platform-resilience-against-the-petya-ransomware-attack/
Title: Windows 10 platform resilience against the Petya ransomware attack

Search URL Search Domain Scan URL

URL: https://technet.microsoft.com/en-us/itpro/windows/keep-secure/windows-defender-in-windows-10
Title: Windows Defender Antivirus

Search URL Search Domain Scan URL

URL: https://blogs.technet.microsoft.com/mmpc/2017/05/04/windows-defender-atp-thwarts-operation-wilysupply-software-supply-chain-cyberattack/
Title: software supply chain attacks

Search URL Search Domain Scan URL

URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0144
Title: CVE-2017-0144

Search URL Search Domain Scan URL

URL: https://technet.microsoft.com/en-us/library/security/ms17-010.aspx
Title: security update MS17-010

Search URL Search Domain Scan URL

URL: https://blogs.technet.microsoft.com/mmpc/2017/05/12/wannacrypt-ransomware-worm-targets-out-of-date-systems/
Title: WannaCrypt

Search URL Search Domain Scan URL

URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0145
Title: CVE-2017-0145

Search URL Search Domain Scan URL

URL: https://blogs.technet.microsoft.com/mmpc/2017/06/16/analysis-of-the-shadow-brokers-release-and-mitigation-with-windows-10-virtualization-based-security/
Title: Shadow Brokers

Search URL Search Domain Scan URL

URL: https://support.microsoft.com/kb/2696547
Title: have disabled SMBv1

Search URL Search Domain Scan URL

URL: https://support.microsoft.com/en-us/help/311047/how-to-keep-your-windows-computer-up-to-date
Title: up-to-date

Search URL Search Domain Scan URL

URL: https://blogs.technet.microsoft.com/mmpc/2017/06/08/windows-10-creators-update-hardens-security-with-next-gen-defense/
Title: hardened Windows 10 against ransomware attacks

Search URL Search Domain Scan URL

URL: https://blogs.technet.microsoft.com/filecab/2016/09/16/stop-using-smb1/
Title: recommended previously

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/securing-privileged-access
Title: Secure privileged access

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/windows/access-protection/credential-guard/credential-guard
Title: Credential Guard

Search URL Search Domain Scan URL

URL: https://technet.microsoft.com/itpro/windows/keep-secure/device-guard-deployment-guide
Title: Device Guard

Search URL Search Domain Scan URL

URL: https://blogs.technet.microsoft.com/msrc/2017/06/28/update-on-petya-malware-attacks/
Title: https://blogs.technet.microsoft.com/msrc/2017/06/28/update-on-petya-malware-attacks/

Search URL Search Domain Scan URL

URL: http://download.windowsupdate.com/d/csa/csa/secu/2017/02/windowsserver2003-kb4012598-x64-custom-enu_f24d8723f246145524b9030e4752c96430981211.exe
Title: Windows Server 2003 SP2 x64

Search URL Search Domain Scan URL

URL: http://download.windowsupdate.com/c/csa/csa/secu/2017/02/windowsserver2003-kb4012598-x86-custom-enu_f617caf6e7ee6f43abe4b386cb1d26b3318693cf.exe
Title: Windows Server 2003 SP2 x86,

Search URL Search Domain Scan URL

URL: http://download.windowsupdate.com/d/csa/csa/secu/2017/02/windowsxp-kb4012598-x86-custom-enu_eceb7d5023bbb23c0dc633e46b9c2f14fa6ee9dd.exe
Title: Windows XP SP3 x86

Search URL Search Domain Scan URL

URL: http://download.windowsupdate.com/c/csa/csa/secu/2017/02/windowsxp-kb4012598-x86-embedded-custom-enu_8f2c266f83a7e1b100ddb9acd4a6a3ab5ecd4059.exe
Title: Windows XP Embedded SP3 x86

Search URL Search Domain Scan URL

URL: http://download.windowsupdate.com/c/msdownload/update/software/secu/2017/05/windows8-rt-kb4012598-x86_a0f1c953a24dd042acc540c59b339f55fb18f594.msu
Title: Windows 8 x86,

Search URL Search Domain Scan URL

URL: http://download.windowsupdate.com/c/msdownload/update/software/secu/2017/05/windows8-rt-kb4012598-x64_f05841d2e94197c2dca4457f1b895e8f632b7f8e.msu
Title: Windows 8 x64

Search URL Search Domain Scan URL

URL: https://technet.microsoft.com/en-us/security/default
Title: https://technet.microsoft.com/en-us/security/default

Search URL Search Domain Scan URL

URL: https://answers.microsoft.com/en-us/protect
Title: Microsoft community

Search URL Search Domain Scan URL

URL: https://twitter.com/WDSecurity
Title: @WDSecurity

Search URL Search Domain Scan URL

URL: https://www.facebook.com/MsftWDSI/
Title: Windows Defender Security Intelligence

Search URL Search Domain Scan URL

URL: https://twitter.com/@MSFTSecurity
Title: @MSFTSecurity

Search URL Search Domain Scan URL

URL: https://store.office.com/en-us/appshome.aspx
Title: Office apps

Search URL Search Domain Scan URL

URL: https://account.microsoft.com/
Title: Account profile

Search URL Search Domain Scan URL

URL: https://go.microsoft.com/fwlink/p/?LinkID=824761&clcid=0x409
Title: Microsoft Store support

Search URL Search Domain Scan URL

URL: https://go.microsoft.com/fwlink/p/?LinkID=824764&clcid=0x409
Title: Returns

Search URL Search Domain Scan URL

URL: https://account.microsoft.com/orders
Title: Order tracking

Search URL Search Domain Scan URL

URL: https://products.office.com/en-us/academic/compare-office-365-education-plans
Title: Office 365 for schools

Search URL Search Domain Scan URL

URL: https://azure.microsoft.com/en-us/community/education/
Title: Microsoft Azure in education

Search URL Search Domain Scan URL

URL: https://go.microsoft.com/fwlink/?LinkID=808093
Title: AppSource

Search URL Search Domain Scan URL

URL: https://technet.microsoft.com/en-us
Title: TechNet

Search URL Search Domain Scan URL

URL: https://developer.microsoft.com/en-us/store/register
Title: Microsoft developer program

Search URL Search Domain Scan URL

URL: https://channel9.msdn.com/
Title: Channel 9

Search URL Search Domain Scan URL

URL: https://developer.microsoft.com/en-us/office
Title: Office Dev Center

Search URL Search Domain Scan URL

URL: https://careers.microsoft.com/
Title: Careers

Search URL Search Domain Scan URL

URL: https://news.microsoft.com/
Title: Company news

Search URL Search Domain Scan URL

URL: https://privacy.microsoft.com/en-us
Title: Privacy at Microsoft

Search URL Search Domain Scan URL

URL: https://support.microsoft.com/en-us/contactus
Title: Contact Microsoft

Search URL Search Domain Scan URL

URL: https://go.microsoft.com/fwlink/?LinkId=521839
Title: Privacy & cookies

Search URL Search Domain Scan URL

URL: https://go.microsoft.com/fwlink/?LinkID=206977
Title: Terms of use

Search URL Search Domain Scan URL

URL: https://choice.microsoft.com/
Title: About our ads

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 82

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7850&url=https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fblog%2F2017%2F06%2F27%2Fnew-ransomware-old-techniques-petya-adds-worm-capabilities%2F&time=1583521849981 HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D7850%26url%3Dhttps%253A%252F%252Fwww.microsoft.com%252Fsecurity%252Fblog%252F2017%252F06%252F27%252Fnew-ransomware-old-techniques-petya-adds-worm-capabilities%252F%26time%3D1583521849981%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7850&url=https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fblog%2F2017%2F06%2F27%2Fnew-ransomware-old-techniques-petya-adds-worm-capabilities%2F&time=1583521849981&liSync=true

87 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/ 136 KB
30 KB 1319ms
1307ms Document
text/html 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

5b3f9ebec7af8e1bf9bf69169c48f48ce2808ce2372ef7ca4e16f2da042eb71f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: www.microsoft.com
:scheme: https
:path: /security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: document
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document

Response headers

status: 200
nr-enabled: 1 1
x-cacheable: SHORT
cache-control: max-age=600, must-revalidate
content-type: text/html; charset=UTF-8
x-cache-group: normal
x-wpe-loopback-upstream-addr: 127.0.0.1:6783 127.0.0.1:6783
content-encoding: gzip
content-security-policy: upgrade-insecure-requests
x-pingback
link: <https://mssecurity.wpengine.com/wp-json/>; rel="https://api.w.org/" <https://mssecurity.wpengine.com/?p=75612>; rel=shortlink
x-xss-protection: 1; mode=block
x-content-type-options: nosniff
x-pass-why
x-frame-options: SAMEORIGIN
wpe-backend: apache apache
content-length: 29513
x-edgeconnect-origin-mex-latency: 1140
date: Fri, 06 Mar 2020 19:10:47 GMT
vary: Accept-Encoding
set-cookie: X-Mapping-fjhppofk=A3F7F95479186D2EC6D3CFDA1F49615A; path=/ ak_bmsc=4B0BA93FC3381263A1870AD678AF66CF0210BB0FF062000037A0625E8FA6C917~pl6u52LzT/zRVB/xWnQbg1MNPohdz3KZ1OEeDvn1F4xzlnOh+jkhoM3IioCNW5EwXbnxg34tsWxQe/gQ56Z/4Y4ZShruz20LWqrGF5cKkeEkICl6AkSm1XzoN5a/JSScSFLG0iCGqJnzpidCTf0ZCeKf4/veCwPTImCbCbs82fNwgNNC9soARvAZaRcVceelRZpZxguiTv0vP5pAkHvsb8MVAyrBz1AS6Fo2UykztlaUafsi7PZnHAyaR8x6orWedH; expires=Fri, 06 Mar 2020 21:10:47 GMT; max-age=7200; path=/; domain=.microsoft.com; HttpOnly
tls_version: tls1.2
strict-transport-security: max-age=31536000
x-rtag: RT

GET
H2 200 style.min.css
www.microsoft.com/security/blog/wp-includes/css/dist/block-library/ 40 KB
6 KB 344ms
340ms Stylesheet
text/css 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-includes/css/dist/block-library/style.min.css?ver=5.3.2

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

d9662b4b9ba6c2c3691ce0acd4572e027366eb97d6070550a13429262bb0037f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

x-edgeconnect-origin-mex-latency: 21
date: Fri, 06 Mar 2020 19:10:47 GMT
content-encoding: gzip
last-modified: Tue, 04 Feb 2020 18:25:20 GMT
x-rtag: RT
status: 200
etag: W/"5e39b710-a1fb"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 6320

GET
H2 200 styles.css
www.microsoft.com/security/blog/wp-content/plugins/wds-ms-inline-interruption-styles-officeblogs/css/ 10 KB
4 KB 344ms
341ms Stylesheet
text/css 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-content/plugins/wds-ms-inline-interruption-styles-officeblogs/css/styles.css?ver=1583521847

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

b201ab52de2c92539f7a276b6cf170b1bdf0f3705f1b6ab9597517d030afefe4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

x-edgeconnect-origin-mex-latency: 22
date: Fri, 06 Mar 2020 19:10:47 GMT
content-encoding: gzip
last-modified: Thu, 05 Dec 2019 15:29:15 GMT
x-rtag: RT
status: 200
etag: W/"5de9224b-29a7"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 3921

GET
H2 200 uhf-search-ui.css
www.microsoft.com/security/blog/wp-content/plugins/wds-ms-searchwp/features/uhf-search-ui/ 160 B
369 B 629ms
626ms Stylesheet
text/css 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-content/plugins/wds-ms-searchwp/features/uhf-search-ui/uhf-search-ui.css?ver=1.0.1

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

f258c099e2bb029f6c9d5e9900a78f53347a16b43aa1e37a9f9c1a1539e0748d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

x-edgeconnect-origin-mex-latency: 60
date: Fri, 06 Mar 2020 19:10:48 GMT
last-modified: Tue, 02 Apr 2019 19:51:16 GMT
x-rtag: RT
status: 200
etag: "5ca3bd34-a0"
strict-transport-security: max-age=31536000
content-type: text/css
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 160

GET
H2 200 mwf-west-european-default.min.css
assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/css/ 581 KB
71 KB 77ms
18ms Stylesheet
text/css 2a02:26f0:10c:396::2957
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/css/mwf-west-european-default.min.css?ver=5.3.2

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:10c:396::2957 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /

Resource Hash

4919e80f038d2b93f1184d1733ac35009643481735c7bc7aa31d8b56e118fc04

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

date: Fri, 06 Mar 2020 19:10:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-md5: QshXRY8/Osc4oVEHlL0Pbw==
status: 200
content-length: 71704
x-ms-lease-state: available
last-modified: Thu, 01 Feb 2018 02:22:19 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: "0x8D5691A9EA468B4"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-lease-state,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control: max-age=900
accept-ranges: bytes

GET
H2 200 style.css
www.microsoft.com/security/blog/wp-content/themes/ms_s/ 342 B
464 B 814ms
812ms Stylesheet
text/css 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-content/themes/ms_s/style.css?ver=1.0.0

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

f174b3ce00dc0ef25fe0867dae1da92a595c50f730dbe2cd1fd7f29546034e81

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

x-edgeconnect-origin-mex-latency: 156
date: Fri, 06 Mar 2020 19:10:48 GMT
content-encoding: gzip
last-modified: Fri, 22 Feb 2019 16:32:17 GMT
x-rtag: RT
status: 200
etag: W/"5c702411-156"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 238

GET
H2 200 style.min.css
www.microsoft.com/security/blog/wp-content/themes/ms-security/ 62 KB
12 KB 649ms
647ms Stylesheet
text/css 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-content/themes/ms-security/style.min.css?ver=2.4.2

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

15545c41aa48eb0b7e9c53a83fdf86248e9b8a305c3ce43bfae6c871ddad314e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

x-edgeconnect-origin-mex-latency: 32
date: Fri, 06 Mar 2020 19:10:48 GMT
content-encoding: gzip
last-modified: Fri, 06 Mar 2020 15:29:06 GMT
x-rtag: RT
status: 200
etag: W/"5e626c42-f7b9"
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 11651

GET
H/1.1 200
OK RE1r2ij Show response
query.prod.cms.rt.microsoft.com/cms/api/am/binary/ 4 KB
3 KB 326ms
21ms Script
application/x-javascript 184.30.221.161
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE1r2ij?ver=1.0.0
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 184.30.221.161 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a184-30-221-161.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 /
Resource Hash: c3c027a797b2f7112555a219c0a0c91e8689f97203aeab469382665f74f05016

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

AppEx-Activity-Id: 476a7290-cdc3-475d-b970-c6131c7b39a4
Content-Encoding: gzip
X-CMS-Tenant: am
X-CMS-ServiceLocation: eastus:1
X-CMS-Type: binary
X-CMS-DocumentId: RE1r2ij
X-CMS-Alias: default
Content-Disposition: inline; filename=oa.min.js
Connection: keep-alive
MS-CV: IfUQDiMjKECzag4KeUWQCg.0
Content-Length: 2299
X-Trace-Context: {"ActivityId":"476a7290-cdc3-475d-b970-c6131c7b39a4"}
X-CMS-Version: 45
Last-Modified: Tue, 09 Oct 2018 21:46:16 GMT
Server: Microsoft-IIS/10.0
ETag: W/"133"
Vary: Accept-Encoding
Content-Type: application/x-javascript
X-CMS-ExecutionTimeInMilliseconds: 205
Cache-Control: public, must-revalidate, max-age=7725
Date: Fri, 06 Mar 2020 19:10:47 GMT
X-CMS-State: Published

GET
H2 200 jquery.js Show response
www.microsoft.com/security/blog/wp-includes/js/jquery/ 95 KB
34 KB 776ms
774ms Script
application/javascript 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-edgeconnect-origin-mex-latency: 44
date: Fri, 06 Mar 2020 19:10:48 GMT
content-encoding: gzip
last-modified: Tue, 04 Feb 2020 18:25:19 GMT
x-rtag: RT
status: 200
etag: W/"5e39b70f-17a69"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 34019

GET
H2 200 jquery-migrate.min.js Show response
www.microsoft.com/security/blog/wp-includes/js/jquery/ 10 KB
4 KB 641ms
639ms Script
application/javascript 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-edgeconnect-origin-mex-latency: 21
date: Fri, 06 Mar 2020 19:10:48 GMT
content-encoding: gzip
last-modified: Fri, 20 May 2016 06:11:28 GMT
x-rtag: RT
status: 200
etag: W/"573eaa90-2748"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 4016

GET
H2 200 mwf-main.var.min.js Show response
assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/scripts/ 302 KB
70 KB 68ms
10ms Script
application/x-javascript 2a02:26f0:10c:396::2957
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/scripts/mwf-main.var.min.js?ver=v1.23.2+5182151

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:10c:396::2957 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /

Resource Hash

b1d83c2d49c49ea38d578afa752aaec44a86d069d6ce2d54460e2612fc31a102

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 06 Mar 2020 19:10:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-md5: FuF99EJdzMvbQQjP24cb+Q==
status: 200
content-length: 71185
x-ms-lease-state: available
last-modified: Thu, 01 Feb 2018 02:22:29 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: "0x8D5691AA4A90431"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-lease-state,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control: max-age=900
accept-ranges: bytes

GET
H2 200 51-40faf7
www.microsoft.com/onerfstatics/marketingsites-wcus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/2b-7ae144/7e-3283eb/69-8122fc/86-016699/72-2b1d8c/80-6461e7/2a-d9be59/ 164 KB
22 KB 282ms
280ms Stylesheet
text/css 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/onerfstatics/marketingsites-wcus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/2b-7ae144/7e-3283eb/69-8122fc/86-016699/72-2b1d8c/80-6461e7/2a-d9be59/51-40faf7?ver=2.0

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

238db52476bf8107e2e851cd3299b071ed5944b570c1603a1ea758a4fadf5f29

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

ms-operation-id: 08b5c10547e59e4389bd4a25bdd7cfc4
date: Fri, 06 Mar 2020 19:10:47 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-rtag: RT
x-s2: 2020-02-25T21:00:52
p3p: CP="CAO CONi OTR OUR DEM ONL"
status: 200
x-activity-id: a9420ad7-325f-4067-830c-2f5c722793c9
tls_version: tls1.2
x-s1: 2020-02-25T21:00:52
ms-cv: 6/oht3tU20ulaz4p.0
vary: Accept-Encoding
content-length: 22188
x-xss-protection: 1; mode=block
last-modified: Tue, 25 Feb 2020 21:00:52 GMT
x-az: {did:92e7dc58ca2143cfb2c818b047cc5cd1, rid: OneDeployContainer, sn: marketingsites-prod-odnortheurope, dt: 2018-05-03T20:14:23.4188992Z, bt: 2020-02-08T02:01:06.0000000Z}
strict-transport-security: max-age=31536000
access-control-allow-methods: HEAD,GET,POST,PATCH,PUT,OPTIONS
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30678566
timing-allow-origin: *
x-appversion: 1.0.7342.32433
expires: Wed, 24 Feb 2021 21:00:13 GMT

GET
H/1.1 200
OK override.css
statics-marketingsites-wcus-ms-com.akamaized.net/statics/ 1 KB
907 B 1120ms
21ms Stylesheet
text/css 2.16.106.48
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://statics-marketingsites-wcus-ms-com.akamaized.net/statics/override.css?c=7
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.16.106.48 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-16-106-48.deploy.static.akamaitechnologies.com
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 0bd288d5397a69ead391875b422bf2cbdcc4f795d64aa2f780aff45768d78248

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
Date: Fri, 06 Mar 2020 19:10:48 GMT
Content-Encoding: gzip
Last-Modified: Tue, 11 Jun 2019 23:22:13 GMT
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag: 0x8D6EEC3A2D67C35
Vary: Accept-Encoding
Content-Type: text/css
x-ms-request-id: 3ec7bff7-b01e-003b-4fb5-404854000000
x-ms-version: 2009-09-19
Connection: keep-alive
Content-Length: 473

GET
H2 200 mscc-0.4.2.min.css
c.s-microsoft.com/mscc/statics/ 1 KB
934 B 55ms
9ms Stylesheet
text/css 2a02:26f0:10c:381::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.s-microsoft.com/mscc/statics/mscc-0.4.2.min.css
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:10c:381::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: 66c5d9882a954332c4aebef2386c7713a226fa617ddcd08d22f24e53ba5ec066

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
date: Fri, 06 Mar 2020 19:10:47 GMT
content-encoding: gzip
last-modified: Fri, 10 Jan 2020 15:56:23 GMT
content-md5: QLyM0qNPDXd6ayzd1iIoLA==
access-control-allow-origin: *
etag: 0x8D795E5A424E059
vary: Accept-Encoding
access-control-allow-methods: GET,POST
content-type: text/css;charset=utf-8
status: 200
x-ms-request-id: c301cf46-701e-00d5-16fc-c75b45000000
x-ms-version: 2009-09-19
content-length: 626

GET
H2 200 RE1Mu3b
img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/ 4 KB
4 KB 37ms
6ms Image
image/png 2a02:26f0:6c00::210:ba1b
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/

Protocol

Security

TLS 1.2, ECDHE_ECDSA, AES_256_GCM

Server

2a02:26f0:6c00::210:ba1b , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

112fec798b78aa02e102a724b5cb1990c0f909bc1d8b7b1fa256eab41bbc0960

Security Headers

Name	Value
X-Frame-Options	deny

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

x-cms-cdninvalkey: am:RE1Mu3b
date: Fri, 06 Mar 2020 19:10:47 GMT
x-source-length: 4054
status: 200
x-activityid: 25f6e135-3d2e-4db2-85bc-7d5ff57ec4f0
x-deployment: a89a5014e89c41b7b60a64d7ee950637
content-length: 4054
timing-allow-origin: *
last-modified: Wed, 04 Mar 2020 03:08:57 GMT
x-datacenter: NorthEU
x-frame-options: deny
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=201438
x-instance: Resizer.Web_IN_3
content-location: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31
expires: Mon, 09 Mar 2020 03:08:05 GMT

GET
H2 200 wp-emoji-release.min.js Show response
www.microsoft.com/security/blog/wp-includes/js/ 14 KB
5 KB 822ms
821ms Script
application/javascript 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-includes/js/wp-emoji-release.min.js?ver=5.3.2

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

1a351abc3f3b435497ddb8a55f09268d3e641dc22455deac06cf0181a4de52ee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-edgeconnect-origin-mex-latency: 22
date: Fri, 06 Mar 2020 19:10:48 GMT
content-encoding: gzip
last-modified: Tue, 04 Feb 2020 18:25:19 GMT
x-rtag: RT
status: 200
etag: W/"5e39b70f-362a"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 4666

GET
H2 200 linkedin-black.png
www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/images/ 424 B
635 B 21ms
15ms Image
image/png 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/images/linkedin-black.png

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

dfc6de0e1501679bd71244faed1d26b977260f78853325c865754d05c238fe22

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

x-edgeconnect-origin-mex-latency: 21
date: Fri, 06 Mar 2020 19:10:48 GMT
last-modified: Fri, 06 Mar 2020 15:29:10 GMT
x-rtag: RT
status: 200
etag: "5e626c46-1a8"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 424

GET
H2 200 facebook-black.png
www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/images/ 231 B
441 B 32ms
26ms Image
image/png 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/images/facebook-black.png

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

875071ac76430f551ed9b36d0827d818157658b2247662db454ffcba6c07bb07

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

x-edgeconnect-origin-mex-latency: 22
date: Fri, 06 Mar 2020 19:10:48 GMT
last-modified: Fri, 06 Mar 2020 15:29:10 GMT
x-rtag: RT
status: 200
etag: "5e626c46-e7"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 231

GET
H2 200 twitter-black.png
www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/images/ 395 B
606 B 42ms
37ms Image
image/png 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/images/twitter-black.png

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

d52a506abeec5c7cb2e6cafe138da0763f555a16c2920683a7eb866453624f39

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

x-edgeconnect-origin-mex-latency: 66
date: Fri, 06 Mar 2020 19:10:48 GMT
last-modified: Fri, 06 Mar 2020 15:29:10 GMT
x-rtag: RT
status: 200
etag: "5e626c46-18b"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 395

GET
H2 200 mail-black.png
www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/images/ 247 B
458 B 55ms
49ms Image
image/png 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/images/mail-black.png

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

9dc88b264cb2061fdeccef48662172bf52cc1cd5c668e242e9e600f3bf39c84b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

x-edgeconnect-origin-mex-latency: 21
date: Fri, 06 Mar 2020 19:10:48 GMT
last-modified: Fri, 06 Mar 2020 15:29:10 GMT
x-rtag: RT
status: 200
etag: "5e626c46-f7"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 247

GET
H2 200 skype-black.png
www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/images/ 557 B
768 B 66ms
60ms Image
image/png 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/images/skype-black.png

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

f25fb12269bb1060790dd528cb700a87c49d8f3531cedaad0d37c617a4d1c5af

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

x-edgeconnect-origin-mex-latency: 83
date: Fri, 06 Mar 2020 19:10:48 GMT
last-modified: Fri, 06 Mar 2020 15:29:10 GMT
x-rtag: RT
status: 200
etag: "5e626c46-22d"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 557

GET
H2 200 messenger-black.png
www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/images/ 448 B
659 B 76ms
71ms Image
image/png 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/images/messenger-black.png

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

cd9f9701c135d4c08a851bc5f634242f03fef8132f8d763cddc9b8ed1d20344a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

x-edgeconnect-origin-mex-latency: 21
date: Fri, 06 Mar 2020 19:10:48 GMT
last-modified: Fri, 06 Mar 2020 15:29:10 GMT
x-rtag: RT
status: 200
etag: "5e626c46-1c0"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 448

GET
H2 200 whatsapp-black.png
www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/images/ 502 B
712 B 88ms
83ms Image
image/png 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/images/whatsapp-black.png

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

4dadc2332aba5151f4b0bd990760d4ea2f3207f9690d0bfeff626bccef8d335f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

x-edgeconnect-origin-mex-latency: 61
date: Fri, 06 Mar 2020 19:10:48 GMT
last-modified: Fri, 06 Mar 2020 15:29:11 GMT
x-rtag: RT
status: 200
etag: "5e626c47-1f6"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 502

GET
H/1.1 200
OK 129-5a55df4770f96.png
cloudblogs.microsoft.com/uploads/prod/2018/01/ 82 KB
83 KB 80ms
21ms Image
image/png 107.154.114.97
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cloudblogs.microsoft.com/uploads/prod/2018/01/129-5a55df4770f96.png
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 107.154.114.97 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS: 107.154.114.97.ip.incapdns.net
Software: /
Resource Hash: 88064771eb12ea2f7ff435a01e79a78212a31f4de4c1e375ef9e951685e762bc

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Fri, 06 Mar 2020 19:10:48 GMT
Last-Modified: Wed, 10 Jan 2018 09:39:24 GMT
X-CDN: Incapsula
Etag: "0x8D5580E08B4EA43"
Content-Type: image/png
X-Iinfo: 7-27181573-27180506 2CNN RT(1583521847895 22) q(0 0 0 0) r(0 0) U18
Cache-Control: max-age=310161321, public
Content-Length: 84098
Expires: Thu, 03 Jan 2030 15:06:09 GMT

GET
H/1.1 200
OK petya-access-admin.png
cloudblogs.microsoft.com/uploads/prod/2018/01/ 11 KB
12 KB 134ms
21ms Image
image/png 107.154.114.97
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cloudblogs.microsoft.com/uploads/prod/2018/01/petya-access-admin.png
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 107.154.114.97 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS: 107.154.114.97.ip.incapdns.net
Software: /
Resource Hash: 4e6957c6899cfe2edc653d53d51680a4af82e09863bf61165b5ae2ed9cdf4a87

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Fri, 06 Mar 2020 19:10:47 GMT
Last-Modified: Wed, 10 Jan 2018 09:39:30 GMT
X-CDN: Incapsula
Etag: "0x8D5580E0C3BF66A"
Content-Type: image/png
X-Iinfo: 7-27181573-27180759 2CNN RT(1583521847895 76) q(0 0 0 0) r(0 0) U18
Cache-Control: max-age=310936521, public
Content-Length: 11016
Expires: Sat, 12 Jan 2030 14:26:08 GMT

GET
H/1.1 200
OK petya-wmic.png
cloudblogs.microsoft.com/uploads/prod/2018/01/ 4 KB
5 KB 154ms
19ms Image
image/png 107.154.114.97
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cloudblogs.microsoft.com/uploads/prod/2018/01/petya-wmic.png
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 107.154.114.97 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS: 107.154.114.97.ip.incapdns.net
Software: /
Resource Hash: 3070f4770f5e6fc62fc0433671ca8ea8b42814bd295e8aafe35aa5e9fd0ab724

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Fri, 06 Mar 2020 19:10:48 GMT
Last-Modified: Wed, 10 Jan 2018 09:41:11 GMT
X-CDN: Incapsula
Etag: "0x8D5580E48D1A7C8"
Content-Type: image/png
X-Iinfo: 7-27181573-27164543 2CNN RT(1583521847895 98) q(0 0 0 0) r(0 0) U18
Cache-Control: max-age=310936520, public
Content-Length: 4530
Expires: Sat, 12 Jan 2030 14:26:08 GMT

GET
H/1.1 200
OK petya-smb-packet.png
cloudblogs.microsoft.com/uploads/prod/2018/01/ 6 KB
7 KB 175ms
20ms Image
image/png 107.154.114.97
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cloudblogs.microsoft.com/uploads/prod/2018/01/petya-smb-packet.png
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 107.154.114.97 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS: 107.154.114.97.ip.incapdns.net
Software: /
Resource Hash: b340cd52ebd572c3157a373a83bbd37ea269585fb9db490c0902813f120bf77a

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Fri, 06 Mar 2020 19:10:48 GMT
Last-Modified: Wed, 10 Jan 2018 09:40:37 GMT
X-CDN: Incapsula
Etag: "0x8D5580E3481933A"
Content-Type: image/png
X-Iinfo: 7-27181573-27180506 2CNN RT(1583521847895 118) q(0 0 0 0) r(0 0) U18
Cache-Control: max-age=310936521, public
Content-Length: 6236
Expires: Sat, 12 Jan 2030 14:26:09 GMT

GET
H/1.1 200
OK petya-smb-packet-2.png
cloudblogs.microsoft.com/uploads/prod/2018/01/ 20 KB
21 KB 195ms
20ms Image
image/png 107.154.114.97
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cloudblogs.microsoft.com/uploads/prod/2018/01/petya-smb-packet-2.png
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 107.154.114.97 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS: 107.154.114.97.ip.incapdns.net
Software: /
Resource Hash: b79d14c5b6d4c648fbd3c3dacba3666b62a610d1543bfec138f4c3fa39193bd7

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Fri, 06 Mar 2020 19:10:48 GMT
Last-Modified: Wed, 10 Jan 2018 09:40:44 GMT
X-CDN: Incapsula
Etag: "0x8D5580E38A60D58"
Content-Type: image/png
X-Iinfo: 7-27181573-27180506 2CNN RT(1583521847895 139) q(0 0 0 0) r(0 0) U18
Cache-Control: max-age=310936521, public
Content-Length: 20264
Expires: Sat, 12 Jan 2030 14:26:09 GMT

GET
H/1.1 200
OK petya-encryption-1.png
cloudblogs.microsoft.com/uploads/prod/2018/01/ 9 KB
10 KB 218ms
20ms Image
image/png 107.154.114.97
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cloudblogs.microsoft.com/uploads/prod/2018/01/petya-encryption-1.png
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 107.154.114.97 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS: 107.154.114.97.ip.incapdns.net
Software: /
Resource Hash: 4a55a1f7133558d4026d461a8745303e08004e0ea89f2cdf9e398849623996cf

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Fri, 06 Mar 2020 19:10:47 GMT
Last-Modified: Wed, 10 Jan 2018 09:39:42 GMT
X-CDN: Incapsula
Etag: "0x8D5580E13D3F130"
Content-Type: image/png
X-Iinfo: 7-27181573-27180762 2CNN RT(1583521847895 161) q(0 0 0 0) r(0 0) U18
Cache-Control: max-age=310936521, public
Content-Length: 9158
Expires: Sat, 12 Jan 2030 14:26:08 GMT

GET
H/1.1 200
OK petya-smb-exploit-udpate.png
cloudblogs.microsoft.com/uploads/prod/2018/01/ 8 KB
8 KB 131ms
25ms Image
image/png 107.154.114.97
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cloudblogs.microsoft.com/uploads/prod/2018/01/petya-smb-exploit-udpate.png
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 107.154.114.97 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS: 107.154.114.97.ip.incapdns.net
Software: /
Resource Hash: 0700abb9bfba3298430d1a2a17d3b33939d6936568b51ef04a01c39d5ee9829d

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Fri, 06 Mar 2020 19:10:48 GMT
Last-Modified: Wed, 10 Jan 2018 09:40:31 GMT
X-CDN: Incapsula
Etag: "0x8D5580E30C7ADEF"
Content-Type: image/png
X-Iinfo: 7-27181573-27180762 2CNN RT(1583521847895 183) q(0 0 0 -1) r(0 0) U18
Cache-Control: max-age=310936520, public
Content-Length: 7797
Expires: Sat, 12 Jan 2030 14:26:08 GMT

GET
H/1.1 200
OK petya-MBR-overwrite-udpate.png
cloudblogs.microsoft.com/uploads/prod/2018/01/ 1 KB
2 KB 137ms
27ms Image
image/png 107.154.114.97
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cloudblogs.microsoft.com/uploads/prod/2018/01/petya-MBR-overwrite-udpate.png
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 107.154.114.97 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS: 107.154.114.97.ip.incapdns.net
Software: /
Resource Hash: 7cdf088afb8998bfa2a6531b8ccf35577bdca0a7e54528f23ea0075c8e76c7df

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Fri, 06 Mar 2020 19:10:48 GMT
Last-Modified: Wed, 10 Jan 2018 09:40:06 GMT
X-CDN: Incapsula
Etag: "0x8D5580E21B99E6B"
Content-Type: image/png
X-Iinfo: 7-27181573-27180506 2CNN RT(1583521847895 216) q(0 0 0 -1) r(0 0) U18
Cache-Control: max-age=310936521, public
Content-Length: 1491
Expires: Sat, 12 Jan 2030 14:26:09 GMT

GET
H/1.1 200
OK petya-fake-message.png
cloudblogs.microsoft.com/uploads/prod/2018/01/ 3 KB
4 KB 137ms
19ms Image
image/png 107.154.114.97
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cloudblogs.microsoft.com/uploads/prod/2018/01/petya-fake-message.png
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 107.154.114.97 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS: 107.154.114.97.ip.incapdns.net
Software: /
Resource Hash: bf745fef5e21218439a84aeeb659bff23812adbb1b6355bdcb679303f886d74c

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Fri, 06 Mar 2020 19:10:48 GMT
Last-Modified: Wed, 10 Jan 2018 09:39:48 GMT
X-CDN: Incapsula
Etag: "0x8D5580E1730D859"
Content-Type: image/png
X-Iinfo: 7-27181573-27164543 2CNN RT(1583521847895 236) q(0 0 0 -1) r(0 0) U18
Cache-Control: max-age=310936520, public
Content-Length: 3529
Expires: Sat, 12 Jan 2030 14:26:08 GMT

GET
H/1.1 200
OK petya-ransom-note.png
cloudblogs.microsoft.com/uploads/prod/2018/01/ 6 KB
7 KB 138ms
20ms Image
image/png 107.154.114.97
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cloudblogs.microsoft.com/uploads/prod/2018/01/petya-ransom-note.png
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 107.154.114.97 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS: 107.154.114.97.ip.incapdns.net
Software: /
Resource Hash: 308d1cc1ede2b64b0e59f932e90a29c261496da4588a798938d1a333ed78752b

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Fri, 06 Mar 2020 19:10:48 GMT
Last-Modified: Wed, 10 Jan 2018 09:40:11 GMT
X-CDN: Incapsula
Etag: "0x8D5580E251B417A"
Content-Type: image/png
X-Iinfo: 7-27181573-27164543 2CNN RT(1583521847895 256) q(0 0 0 -1) r(0 0) U18
Cache-Control: max-age=310936521, public
Content-Length: 6294
Expires: Sat, 12 Jan 2030 14:26:09 GMT

GET
H/1.1 200
OK petya-file-mapping-API.png
cloudblogs.microsoft.com/uploads/prod/2018/01/ 135 KB
136 KB 141ms
24ms Image
image/png 107.154.114.97
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cloudblogs.microsoft.com/uploads/prod/2018/01/petya-file-mapping-API.png
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 107.154.114.97 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS: 107.154.114.97.ip.incapdns.net
Software: /
Resource Hash: b7d6e7f7f328858b5536603428d9234c7c545c18bdc6d3f9d2f1526ae4b74dd1

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Fri, 06 Mar 2020 19:10:48 GMT
Last-Modified: Wed, 10 Jan 2018 09:39:54 GMT
X-CDN: Incapsula
Etag: "0x8D5580E1AD2EB77"
Content-Type: image/png
X-Iinfo: 7-27181573-27180762 2CNN RT(1583521847895 277) q(0 0 0 -1) r(0 0) U18
Cache-Control: max-age=310936521, public
Content-Length: 138348
Expires: Sat, 12 Jan 2030 14:26:09 GMT

GET
H/1.1 200
OK petya-rsa-public-encryption-key.png
cloudblogs.microsoft.com/uploads/prod/2018/01/ 243 KB
244 KB 156ms
20ms Image
image/png 107.154.114.97
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cloudblogs.microsoft.com/uploads/prod/2018/01/petya-rsa-public-encryption-key.png
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 107.154.114.97 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS: 107.154.114.97.ip.incapdns.net
Software: /
Resource Hash: df8b7b0ba4c722b49ca03f224a6d9c491453f816ec2b103339559fb85341bc3a

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Fri, 06 Mar 2020 19:10:48 GMT
Last-Modified: Wed, 10 Jan 2018 09:40:25 GMT
X-CDN: Incapsula
Etag: "0x8D5580E2D201B99"
Content-Type: image/png
X-Iinfo: 7-27181573-27180506 2CNN RT(1583521847895 317) q(0 0 0 -1) r(0 0) U18
Cache-Control: max-age=310936522, public
Content-Length: 249000
Expires: Sat, 12 Jan 2030 14:26:10 GMT

GET
H/1.1 200
OK petya-aes-128-key.png
cloudblogs.microsoft.com/uploads/prod/2018/01/ 11 KB
12 KB 170ms
20ms Image
image/png 107.154.114.97
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cloudblogs.microsoft.com/uploads/prod/2018/01/petya-aes-128-key.png
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 107.154.114.97 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS: 107.154.114.97.ip.incapdns.net
Software: /
Resource Hash: 95139d4075c7c007f62091a16cf34eb149532b7510c6df1a18b550da09278c7f

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Fri, 06 Mar 2020 19:10:48 GMT
Last-Modified: Wed, 10 Jan 2018 09:39:36 GMT
X-CDN: Incapsula
Etag: "0x8D5580E0FDB22C9"
Content-Type: image/png
X-Iinfo: 7-27181573-27180759 2CNN RT(1583521847895 358) q(0 0 0 -1) r(0 0) U18
Cache-Control: max-age=310936521, public
Content-Length: 11618
Expires: Sat, 12 Jan 2030 14:26:09 GMT

GET
H/1.1 200
OK petya-infect-mbr.png
cloudblogs.microsoft.com/uploads/prod/2018/01/ 12 KB
12 KB 162ms
19ms Image
image/png 107.154.114.97
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cloudblogs.microsoft.com/uploads/prod/2018/01/petya-infect-mbr.png
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 107.154.114.97 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS: 107.154.114.97.ip.incapdns.net
Software: /
Resource Hash: 7cf7935a98e4f100c4c3977f79a1a13b2b273ee66d55fe37bc1b8e5c7187d79e

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Fri, 06 Mar 2020 19:10:48 GMT
Last-Modified: Wed, 10 Jan 2018 09:40:00 GMT
X-CDN: Incapsula
Etag: "0x8D5580E1E950F89"
Content-Type: image/png
X-Iinfo: 7-27181573-27180506 2CNN RT(1583521847895 378) q(0 0 0 -1) r(0 0) U18
Cache-Control: max-age=310936521, public
Content-Length: 12255
Expires: Sat, 12 Jan 2030 14:26:09 GMT

GET
H/1.1 200
OK petya-readme.png
cloudblogs.microsoft.com/uploads/prod/2018/01/ 27 KB
27 KB 161ms
19ms Image
image/png 107.154.114.97
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cloudblogs.microsoft.com/uploads/prod/2018/01/petya-readme.png
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 107.154.114.97 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS: 107.154.114.97.ip.incapdns.net
Software: /
Resource Hash: e38455204599e79fe060d0a297c8bfa1bf06a905a4ac1fc7e028cda3fdd78d06

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Fri, 06 Mar 2020 19:10:48 GMT
Last-Modified: Wed, 10 Jan 2018 09:40:18 GMT
X-CDN: Incapsula
Etag: "0x8D5580E291CC3F2"
Content-Type: image/png
X-Iinfo: 7-27181573-27180506 2CNN RT(1583521847895 398) q(0 0 0 -1) r(0 0) U18
Cache-Control: max-age=310936522, public
Content-Length: 27158
Expires: Sat, 12 Jan 2030 14:26:10 GMT

GET
H/1.1 200
OK petya-windows-defender-ATP1.png
cloudblogs.microsoft.com/uploads/prod/2018/01/ 55 KB
55 KB 166ms
25ms Image
image/png 107.154.114.97
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cloudblogs.microsoft.com/uploads/prod/2018/01/petya-windows-defender-ATP1.png
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 107.154.114.97 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS: 107.154.114.97.ip.incapdns.net
Software: /
Resource Hash: 33cd982a5d8617d4537e22e4ed5fb6a608a2c4857bf62a5ec8bd6cc9d797255a

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Fri, 06 Mar 2020 19:10:48 GMT
Last-Modified: Wed, 10 Jan 2018 09:40:53 GMT
X-CDN: Incapsula
Etag: "0x8D5580E3E3E7F99"
Content-Type: image/png
X-Iinfo: 7-27181573-27180759 2CNN RT(1583521847895 418) q(0 0 0 -1) r(0 0) U18
Cache-Control: max-age=310936521, public
Content-Length: 55997
Expires: Sat, 12 Jan 2030 14:26:09 GMT

GET
H/1.1 200
OK petya-windows-defender-ATP2.png
cloudblogs.microsoft.com/uploads/prod/2018/01/ 85 KB
85 KB 151ms
20ms Image
image/png 107.154.114.97
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cloudblogs.microsoft.com/uploads/prod/2018/01/petya-windows-defender-ATP2.png
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 107.154.114.97 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS: 107.154.114.97.ip.incapdns.net
Software: /
Resource Hash: ba86a86ea50e574b45a1a91f35b32f2b3976ed4b2d75a357d8a17c3badd5f281

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Fri, 06 Mar 2020 19:10:48 GMT
Last-Modified: Wed, 10 Jan 2018 09:41:04 GMT
X-CDN: Incapsula
Etag: "0x8D5580E445F266A"
Content-Type: image/png
X-Iinfo: 7-27181573-27164543 2CNN RT(1583521847895 448) q(0 0 0 -1) r(0 0) U18
Cache-Control: max-age=310936522, public
Content-Length: 86702
Expires: Sat, 12 Jan 2030 14:26:10 GMT

GET
H/1.1 200
OK windows-defender-atp-8.png
cloudblogs.microsoft.com/uploads/prod/2018/04/ 22 KB
22 KB 137ms
20ms Image
image/png 107.154.114.97
INCAPSULA

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cloudblogs.microsoft.com/uploads/prod/2018/04/windows-defender-atp-8.png
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 107.154.114.97 , United States, ASN19551 (INCAPSULA, US),
Reverse DNS: 107.154.114.97.ip.incapdns.net
Software: /
Resource Hash: 857b665b2ee3c407a22ead2afb97f7fcbb8752431c4829dd266e51ec6daac1de

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

Date: Fri, 06 Mar 2020 19:10:48 GMT
Last-Modified: Wed, 06 Jun 2018 16:04:18 GMT
X-CDN: Incapsula
Etag: "0x8D5CBC728EFAC26"
Content-Type: image/png
X-Iinfo: 7-27181573-0 0CNN RT(1583521847895 475) q(0 -1 -1 -1) r(0 -1)
Cache-Control: max-age=315153296, public
Content-Length: 22032
Expires: Sat, 02 Mar 2030 09:45:44 GMT

GET
H2 200 Leader-in-5-Gartner-Magic-Quadrants-SOCIAL-440x268.png
www.microsoft.com/security/blog/wp-content/uploads/2019/12/ 166 KB
166 KB 99ms
96ms Image
image/png 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.microsoft.com/security/blog/wp-content/uploads/2019/12/Leader-in-5-Gartner-Magic-Quadrants-SOCIAL-440x268.png

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

5842ac661692dc02185a41781976d3987abdcf9f93ee3a8c22b5f479fe44aedb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

x-edgeconnect-origin-mex-latency: 40
date: Fri, 06 Mar 2020 19:10:48 GMT
last-modified: Mon, 02 Dec 2019 18:33:22 GMT
x-rtag: RT
status: 200
etag: "5de558f2-29621"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 169505

GET
H2 200 Cloud-security-solution-card.jpg
www.microsoft.com/security/blog/wp-content/uploads/2019/11/ 108 KB
108 KB 111ms
108ms Image
image/jpeg 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.microsoft.com/security/blog/wp-content/uploads/2019/11/Cloud-security-solution-card.jpg

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

e4fc1c68d3b07be8aba84ed6652e76fd49a7d9658060c243a1a2dcd59dcca6a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

x-edgeconnect-origin-mex-latency: 21
date: Fri, 06 Mar 2020 19:10:48 GMT
last-modified: Tue, 05 Nov 2019 19:38:20 GMT
x-rtag: RT
status: 200
etag: "5dc1cfac-1b01f"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 110623

GET
H2 200 Gartner-names-Microsoft-a-Leader-in-the-2019-Cloud-Access-Security-Broker-Magic-Quadrant-CARD-A.png
www.microsoft.com/security/blog/wp-content/uploads/2019/10/ 220 KB
221 KB 122ms
119ms Image
image/png 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.microsoft.com/security/blog/wp-content/uploads/2019/10/Gartner-names-Microsoft-a-Leader-in-the-2019-Cloud-Access-Security-Broker-Magic-Quadrant-CARD-A.png

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

2e7573bffb651b1dda17e9765eda7679cd8d7f92d0911cbe1863f27a3c1e9337

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

x-edgeconnect-origin-mex-latency: 40
date: Fri, 06 Mar 2020 19:10:48 GMT
last-modified: Mon, 28 Oct 2019 23:52:10 GMT
x-rtag: RT
status: 200
etag: "5db77f2a-36faa"
strict-transport-security: max-age=31536000
content-type: image/png
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 225194

GET
H2 200 CTA-feature-1024x729.jpg
www.microsoft.com/security/blog/wp-content/uploads/2019/02/ 161 KB
162 KB 132ms
130ms Image
image/jpeg 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.microsoft.com/security/blog/wp-content/uploads/2019/02/CTA-feature-1024x729.jpg

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

a58941524adf31d97c86f42995772c3a250918e696d00afc4c78d149f2adc43f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

x-edgeconnect-origin-mex-latency: 80
date: Fri, 06 Mar 2020 19:10:48 GMT
last-modified: Tue, 26 Feb 2019 00:33:13 GMT
x-rtag: RT
status: 200
etag: "5c748949-28405"
strict-transport-security: max-age=31536000
content-type: image/jpeg
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 164869

GET
H2 200 microsoft-uhf.js Show response
www.microsoft.com/security/blog/wp-content/plugins/microsoft-uhf/assets/ 3 KB
2 KB 716ms
716ms Script
application/javascript 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-content/plugins/microsoft-uhf/assets/microsoft-uhf.js?ver=0.2.0

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

aa163f4777f0ee19e5f23ac0f332c22f06cd621696c62f527067c32a8c6c3a98

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-edgeconnect-origin-mex-latency: 58
date: Fri, 06 Mar 2020 19:10:48 GMT
content-encoding: gzip
last-modified: Tue, 04 Feb 2020 18:22:46 GMT
x-rtag: RT
status: 200
etag: W/"5e39b676-b8a"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 1303

GET
H2 200 eucc.js Show response
www.microsoft.com/security/blog/wp-content/plugins/wds-microsoft-eu-cookie-compliance/assets/js/ 9 KB
3 KB 15ms
15ms Script
application/javascript 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-content/plugins/wds-microsoft-eu-cookie-compliance/assets/js/eucc.js?ver=2.3.0

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

c3c6fe97f918fcc40403ff671209d7d042dd4a8a7dc66e974eb1becc2bfe16ed

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-edgeconnect-origin-mex-latency: 21
date: Fri, 06 Mar 2020 19:10:48 GMT
content-encoding: gzip
last-modified: Tue, 04 Feb 2020 18:23:11 GMT
x-rtag: RT
status: 200
etag: W/"5e39b68f-2542"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 2931

GET
H2 200 uhf-search-ui.js Show response
www.microsoft.com/security/blog/wp-content/plugins/wds-ms-searchwp/features/uhf-search-ui/ 4 KB
1 KB 22ms
22ms Script
application/javascript 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-content/plugins/wds-ms-searchwp/features/uhf-search-ui/uhf-search-ui.js?ver=1.0.1

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

16d6e957a9525cb4848051b0efc5aa101d256a3c6838007dc4ac2c41121eaade

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-edgeconnect-origin-mex-latency: 21
date: Fri, 06 Mar 2020 19:10:48 GMT
content-encoding: gzip
last-modified: Tue, 02 Apr 2019 19:51:16 GMT
x-rtag: RT
status: 200
etag: W/"5ca3bd34-105b"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 1039

GET
H2 200 modernizr.js Show response
www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/bower_components/modernizer/ 50 KB
16 KB 21ms
21ms Script
application/javascript 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/bower_components/modernizer/modernizr.js?ver=2.8.2

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

b828b15e9b7836b493a8bd6e832a24ee13aa8b6f8b4a1bf307a7af2912014178

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-edgeconnect-origin-mex-latency: 42
date: Fri, 06 Mar 2020 19:10:48 GMT
content-encoding: gzip
last-modified: Fri, 22 Feb 2019 16:33:49 GMT
x-rtag: RT
status: 200
etag: W/"5c70246d-c897"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 15897

GET
H2 200 mwf-auto-init-main.var.min.js Show response
assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/scripts/ 303 KB
71 KB 12ms
11ms Script
application/x-javascript 2a02:26f0:10c:396::2957
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/scripts/mwf-auto-init-main.var.min.js?ver=v1.23.2+5182151

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:10c:396::2957 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /

Resource Hash

f2a28cd82e7ec00d2d8158f21fb0507722cd8b09fa4a0a16fadc58f30385cc25

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 06 Mar 2020 19:10:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-md5: 12go4t01WZJhAGBag3beKQ==
status: 200
content-length: 71611
x-ms-lease-state: available
last-modified: Thu, 01 Feb 2018 02:22:29 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: "0x8D5691AA4A3D407"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-lease-state,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control: max-age=900
accept-ranges: bytes

GET
H2 200 picturefill.min.js Show response
www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/bower_components/picturefill/dist/ 12 KB
5 KB 18ms
17ms Script
application/javascript 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/bower_components/picturefill/dist/picturefill.min.js?ver=3.0.3

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

893fa7fe8b6e69e2828319c04a7cbb6f129ea820db695d4ced5757d59450b6a8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-edgeconnect-origin-mex-latency: 21
date: Fri, 06 Mar 2020 19:10:48 GMT
content-encoding: gzip
last-modified: Fri, 22 Feb 2019 16:34:16 GMT
x-rtag: RT
status: 200
etag: W/"5c702488-2e1f"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 5181

GET
H2 200 imagesloaded.min.js Show response
www.microsoft.com/security/blog/wp-includes/js/ 8 KB
3 KB 16ms
15ms Script
application/javascript 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-includes/js/imagesloaded.min.js?ver=3.2.0

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

11e15f1d64a63cb498d0d42720a688ed15bf78393d8c460d695a110244c066e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-edgeconnect-origin-mex-latency: 21
date: Fri, 06 Mar 2020 19:10:48 GMT
content-encoding: gzip
last-modified: Tue, 04 Feb 2020 18:25:19 GMT
x-rtag: RT
status: 200
etag: W/"5e39b70f-1fb1"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 2564

GET
H2 200 masonry.min.js Show response
www.microsoft.com/security/blog/wp-includes/js/ 28 KB
9 KB 22ms
21ms Script
application/javascript 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-includes/js/masonry.min.js?ver=3.3.2

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

733d7c26a5fb7240e83e8af2c822218b321b5143e28c2dd65ab2492297ac6bd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-edgeconnect-origin-mex-latency: 21
date: Fri, 06 Mar 2020 19:10:48 GMT
content-encoding: gzip
last-modified: Tue, 04 Feb 2020 18:25:19 GMT
x-rtag: RT
status: 200
etag: W/"5e39b70f-7119"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 8582

GET
H2 200 project.min.js Show response
www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/scripts/ 7 KB
2 KB 46ms
46ms Script
application/javascript 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/scripts/project.min.js?ver=1.0.0

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

ea49a34ae66ff6330e30845980df1589a88990a50391b5b2d53248086c184924

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-edgeconnect-origin-mex-latency: 23
date: Fri, 06 Mar 2020 19:10:48 GMT
content-encoding: gzip
last-modified: Fri, 06 Mar 2020 15:29:11 GMT
x-rtag: RT
status: 200
etag: W/"5e626c47-1b58"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 1988

GET
H2 200 wp-embed.min.js Show response
www.microsoft.com/security/blog/wp-includes/js/ 1 KB
975 B 25ms
24ms Script
application/javascript 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-includes/js/wp-embed.min.js?ver=5.3.2

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

0284cbccebf1682452d62d06efa3665c874d642d4e03f5f5f9bb0f555da9251b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-edgeconnect-origin-mex-latency: 60
date: Fri, 06 Mar 2020 19:10:48 GMT
content-encoding: gzip
last-modified: Tue, 04 Feb 2020 18:25:19 GMT
x-rtag: RT
status: 200
etag: W/"5e39b70f-577"
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
tls_version: tls1.2
cache-control: public, max-age=31536000
strict-transport-security: max-age=31536000
content-length: 740

GET
H2 200 19-c0fae7 Show response
www.microsoft.com/onerfstatics/marketingsites-wcus-prod/shell/_scrf/js/themes=default/54-af9f9f/c0-247156/de-099401/e1-a50eee/e7-954872/d8-97d509/f0-251fe2/46-be1318/77-04a268/11-240c7b/63-077520/a... 128 KB
34 KB 22ms
22ms Script
text/javascript 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/onerfstatics/marketingsites-wcus-prod/shell/_scrf/js/themes=default/54-af9f9f/c0-247156/de-099401/e1-a50eee/e7-954872/d8-97d509/f0-251fe2/46-be1318/77-04a268/11-240c7b/63-077520/a4-34de62/1b-c96630/db-bc0148/dc-7e9864/78-4c7d22/e1-c35781/40-7b7803/cd-23d3b0/6d-1e7ed0/b7-cadaa7/ca-40b7b0/4e-ee3a55/3e-f5c39b/c3-6454d7/f9-7592d3/92-10345d/79-499886/7e-cda2d3/db-f3b1fd/93-283c2d/e0-3c9860/91-97a04f/1f-100dea/33-abe4df/19-c0fae7?ver=2.0&iife=1

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

10733a5d876108f81c5f78eee5c9760a739d89c52fa6180c4290b7f909f24346

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

ms-operation-id: 11eaf5c01a129944935c09775528f11a
date: Fri, 06 Mar 2020 19:10:48 GMT
content-encoding: gzip
x-content-type-options: nosniff
x-rtag: RT
x-s2: 2020-02-25T20:53:15
p3p: CP="CAO CONi OTR OUR DEM ONL"
status: 200
x-activity-id: 7c3711c6-6814-435d-baf9-3834de4f5aac
tls_version: tls1.2
x-s1: 2020-02-25T20:53:14
ms-cv: OVP0QPrTPECETVRO.0
vary: Accept-Encoding
content-length: 34474
x-xss-protection: 1; mode=block
last-modified: Tue, 25 Feb 2020 20:53:14 GMT
x-az: {did:92e7dc58ca2143cfb2c818b047cc5cd1, rid: OneDeployContainer, sn: marketingsites-prod-odnortheurope, dt: 2018-05-03T20:14:23.4188992Z, bt: 2020-02-08T02:01:06.0000000Z}
strict-transport-security: max-age=31536000
access-control-allow-methods: HEAD,GET,POST,PATCH,PUT,OPTIONS
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30678143
timing-allow-origin: *
x-appversion: 1.0.7342.32433
expires: Wed, 24 Feb 2021 20:53:11 GMT

GET
H/1.1 200
OK meversion Show response
mem.gfx.ms/ 26 KB
10 KB 29ms
7ms Script
application/javascript 2a02:26f0:6c00:19d::37
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://mem.gfx.ms/meversion?partner=MSSecurity&market=en-us&uhf=1

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:19d::37 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

c35c2ab6aa2d6ff4c126f4197f075c94e38371f7244267051317b63e607ab306

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Date: Fri, 06 Mar 2020 19:10:48 GMT
Vary: Accept-Encoding
Content-Type: application/javascript
Expires: Fri, 06 Mar 2020 19:43:50 GMT
Cache-Control: public, no-transform, max-age=43200
Connection: keep-alive
Content-Length: 9388
X-UA-Compatible: IE=edge

GET
H2 200 mscc-0.4.2.min.js Show response
c.s-microsoft.com/mscc/statics/ 4 KB
2 KB 15ms
9ms Script
text/javascript 2a02:26f0:10c:381::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.s-microsoft.com/mscc/statics/mscc-0.4.2.min.js
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:10c:381::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: a188e6c4c6729c3abbe6a34e45b5c3d7d65ffc659e1baa46632ffb1c876e815c

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
date: Fri, 06 Mar 2020 19:10:48 GMT
content-encoding: gzip
last-modified: Fri, 10 Jan 2020 15:56:14 GMT
content-md5: AO6kLOW8s6NiicKEPl74tA==
access-control-allow-origin: *
etag: 0x8D795E59EC908A0
vary: Accept-Encoding
access-control-allow-methods: GET,POST
content-type: text/javascript;charset=utf-8
status: 200
x-ms-request-id: c301cbc5-701e-00d5-7dfc-c75b45000000
x-ms-version: 2009-09-19
content-length: 2017

GET
H2 200 launch-ENc0cbffaf0f8248c3a934a56818d7737e.min.js Show response
assets.adobedtm.com/ 123 KB
26 KB 31ms
28ms Script
application/x-javascript 72.247.225.88
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/launch-ENc0cbffaf0f8248c3a934a56818d7737e.min.js
Requested by: Host: query.prod.cms.rt.microsoft.com
URL: https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE1r2ij?ver=1.0.0
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 72.247.225.88 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-225-88.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: c022d284134bd3ce8c0cc2c18b16a221fe4e8c3d9b5e6745dd4f9e2f45f3c27e

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 06 Mar 2020 19:10:48 GMT
content-encoding: gzip
last-modified: Tue, 03 Mar 2020 22:13:55 GMT
server: AkamaiNetStorage
etag: "fac34a38aa26f9abf9018259dc897ca2:1583273635.325789"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 26585
expires: Fri, 06 Mar 2020 20:10:48 GMT

GET
H2 200 mwfmdl2-v3.54.woff
www.microsoft.com/mwf/_h/v3.54/mwf.app/fonts/ 26 KB
26 KB 61ms
60ms Font
application/font-woff 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/mwf/_h/v3.54/mwf.app/fonts/mwfmdl2-v3.54.woff

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/bower_components/modernizer/modernizr.js?ver=2.8.2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

22b4df5c33045b645cafa45b04685f4752e471a2e933bff5bf14324d87deee12

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.microsoft.com/onerfstatics/marketingsites-wcus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/2b-7ae144/7e-3283eb/69-8122fc/86-016699/72-2b1d8c/80-6461e7/2a-d9be59/51-40faf7?ver=2.0
Origin: https://www.microsoft.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

ms-operation-id: 588b128e7354724d8b7117f3dc123198
date: Fri, 06 Mar 2020 19:10:48 GMT
x-content-type-options: nosniff
x-rtag: RT
p3p: CP="CAO CONi OTR OUR DEM ONL"
status: 200
x-activity-id: cae7e3f7-cff9-4bc5-a8aa-1b308dd93b6c
tls_version: tls1.2
ms-cv: jbPaQc8zYE2JpeqB.0
content-length: 26288
x-xss-protection: 1; mode=block
last-modified: Fri, 01 Nov 2019 08:35:05 GMT
x-az: {did:92e7dc58ca2143cfb2c818b047cc5cd1, rid: OneDeployContainer, sn: marketingsites-prod-odnortheurope, dt: 2018-05-03T20:14:23.4188992Z, bt: 2019-10-26T07:31:04.0000000Z}
strict-transport-security: max-age=31536000
access-control-allow-methods: HEAD,GET,POST,PATCH,PUT,OPTIONS
content-type: application/font-woff
access-control-allow-origin: *
cache-control: public, max-age=20611466
x-appversion: 1.0.7237.42332
expires: Sat, 31 Oct 2020 08:35:14 GMT

GET
H2 200 latest.woff2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/Semibold/ 29 KB
29 KB 27ms
9ms Font
font/woff2 2a02:26f0:10c:381::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/Semibold/latest.woff2
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/bower_components/modernizer/modernizr.js?ver=2.8.2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:10c:381::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: d87d0a7a7fe2c36d1dc093bfe56e9b81b311988789dbd3b65abf811d551ef02f

Request headers

Referer: https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/css/mwf-west-european-default.min.css?ver=5.3.2
Origin: https://www.microsoft.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 06 Mar 2020 19:10:48 GMT
last-modified: Fri, 10 Jan 2020 19:09:43 GMT
access-control-allow-origin: *
etag: "5b68d583e9c7d51:0"
access-control-allow-methods: GET,POST
content-type: font/woff2
status: 200
cache-control: public, max-age=163721
accept-ranges: bytes
content-length: 29388
expires: Sun, 08 Mar 2020 16:39:29 GMT

GET
H2 200 latest.woff2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/ 33 KB
34 KB 33ms
17ms Font
font/woff2 2a02:26f0:10c:381::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/latest.woff2
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/bower_components/modernizer/modernizr.js?ver=2.8.2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:10c:381::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: 4f7f4afe26e71fa9ca1dac4a43b557a554a46f53251d849f07ed08a04829d74b

Request headers

Referer: https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/css/mwf-west-european-default.min.css?ver=5.3.2
Origin: https://www.microsoft.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 06 Mar 2020 19:10:48 GMT
last-modified: Fri, 10 Jan 2020 19:09:43 GMT
access-control-allow-origin: *
etag: "588d483e9c7d51:0"
access-control-allow-methods: GET,POST
content-type: font/woff2
status: 200
cache-control: public, max-age=261397
accept-ranges: bytes
content-length: 34052
expires: Mon, 09 Mar 2020 19:47:25 GMT

GET
H2 200 latest.woff2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/Bold/ 29 KB
30 KB 24ms
24ms Font
font/woff2 2a02:26f0:10c:381::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/Bold/latest.woff2
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/bower_components/modernizer/modernizr.js?ver=2.8.2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:10c:381::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: 1232bbdbc5d205f3c5a40efa5ed92839c79e7879d5168445cc47645bb93f7d1b

Request headers

Referer: https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/css/mwf-west-european-default.min.css?ver=5.3.2
Origin: https://www.microsoft.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 06 Mar 2020 19:10:48 GMT
last-modified: Fri, 10 Jan 2020 19:09:42 GMT
access-control-allow-origin: *
etag: "83cce83e9c7d51:0"
access-control-allow-methods: GET,POST
content-type: font/woff2
status: 200
cache-control: public, max-age=321543
accept-ranges: bytes
content-length: 30132
expires: Tue, 10 Mar 2020 12:29:51 GMT

GET
H2 200 latest.woff2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/Light/ 27 KB
27 KB 19ms
19ms Font
font/woff2 2a02:26f0:10c:381::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/Light/latest.woff2
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/bower_components/modernizer/modernizr.js?ver=2.8.2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:10c:381::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: fe8a1047376498c80a157d13555e42a92ad480fcb0bcc9de51ad1930fbeb7f91

Request headers

Referer: https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/css/mwf-west-european-default.min.css?ver=5.3.2
Origin: https://www.microsoft.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 06 Mar 2020 19:10:48 GMT
last-modified: Fri, 10 Jan 2020 19:09:43 GMT
access-control-allow-origin: *
etag: "1282d283e9c7d51:0"
access-control-allow-methods: GET,POST
content-type: font/woff2
status: 200
cache-control: public, max-age=305025
accept-ranges: bytes
content-length: 27168
expires: Tue, 10 Mar 2020 07:54:33 GMT

GET
H2 200 latest.woff2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/Semilight/ 28 KB
29 KB 10ms
9ms Font
font/woff2 2a02:26f0:10c:381::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/Semilight/latest.woff2
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/bower_components/modernizer/modernizr.js?ver=2.8.2
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:10c:381::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: 6ba0d1a726f1887bd61727b308ed0be0e73edba17d4ad11b91ab19b632e078f6

Request headers

Referer: https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/css/mwf-west-european-default.min.css?ver=5.3.2
Origin: https://www.microsoft.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 06 Mar 2020 19:10:48 GMT
last-modified: Fri, 10 Jan 2020 19:09:43 GMT
access-control-allow-origin: *
etag: "95edd883e9c7d51:0"
access-control-allow-methods: GET,POST
content-type: font/woff2
status: 200
cache-control: public, max-age=299795
accept-ranges: bytes
content-length: 28908
expires: Tue, 10 Mar 2020 06:27:23 GMT

GET
H2 204 _log
uhf.microsoft.com/ 0
128 B 37ms
9ms Image
text/html 2a02:26f0:10c:383::2b57
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uhf.microsoft.com/_log?o=mscc&s=Microsoft.OneRenderFramework.Core&m=show&nv=aspnet-3.1.3&sv=0.1.2
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:10c:383::2b57 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Fri, 06 Mar 2020 19:10:48 GMT
access-control-allow-origin: *
content-type: text/html
status: 204
cache-control: max-age=0, no-cache, no-store
content-length: 0
expires: Fri, 06 Mar 2020 19:10:48 GMT

GET
H2 200 RCe273b42c34d5427cb02b2d6cd022cac2-source.min.js Show response
assets.adobedtm.com/5ef092d1efb5/2537c33769cb/5424adda5320/ 1 KB
756 B 29ms
29ms Script
application/x-javascript 72.247.225.88
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/5ef092d1efb5/2537c33769cb/5424adda5320/RCe273b42c34d5427cb02b2d6cd022cac2-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENc0cbffaf0f8248c3a934a56818d7737e.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 72.247.225.88 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-225-88.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: b954e9deae1dd21ad3db40c79138e411b4165510df603dd6e7e1ad8e7b38971e

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 06 Mar 2020 19:10:48 GMT
content-encoding: gzip
last-modified: Tue, 03 Mar 2020 22:13:56 GMT
server: AkamaiNetStorage
etag: "7b58ab818ddf5cc463a23a28bdf2b909:1583273636.490277"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 511
expires: Fri, 06 Mar 2020 20:10:48 GMT

GET
H2 200 RCf4d5a6b020184421bd20da64431bd00c-source.min.js Show response
assets.adobedtm.com/5ef092d1efb5/2537c33769cb/5424adda5320/ 1 KB
824 B 30ms
30ms Script
application/x-javascript 72.247.225.88
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/5ef092d1efb5/2537c33769cb/5424adda5320/RCf4d5a6b020184421bd20da64431bd00c-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENc0cbffaf0f8248c3a934a56818d7737e.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 72.247.225.88 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-225-88.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: d234c547122d2621d54d94ca01cb714d49f8bd25fea3bdcc3c3c5f24b6e88594

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 06 Mar 2020 19:10:48 GMT
content-encoding: gzip
last-modified: Tue, 03 Mar 2020 22:13:56 GMT
server: AkamaiNetStorage
etag: "7b58ab818ddf5cc463a23a28bdf2b909:1583273636.490277"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 578
expires: Fri, 06 Mar 2020 20:10:48 GMT

GET
H2 200 RCb88241d3e29144c1b886ab5fabb4ef5a-source.min.js Show response
assets.adobedtm.com/5ef092d1efb5/2537c33769cb/5424adda5320/ 3 KB
1 KB 30ms
30ms Script
application/x-javascript 72.247.225.88
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/5ef092d1efb5/2537c33769cb/5424adda5320/RCb88241d3e29144c1b886ab5fabb4ef5a-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENc0cbffaf0f8248c3a934a56818d7737e.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 72.247.225.88 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-225-88.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 8ed9c234ecfa1787fe94a919e7a247a9488bb4ecc256d72f314ff8e11ecde7f2

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 06 Mar 2020 19:10:48 GMT
content-encoding: gzip
last-modified: Tue, 03 Mar 2020 22:13:56 GMT
server: AkamaiNetStorage
etag: "7b58ab818ddf5cc463a23a28bdf2b909:1583273636.490277"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 1010
expires: Fri, 06 Mar 2020 20:10:48 GMT

GET
H2 200 RC609c6a62e6764307915e122757d5274b-source.min.js Show response
assets.adobedtm.com/5ef092d1efb5/2537c33769cb/5424adda5320/ 74 KB
19 KB 30ms
30ms Script
application/x-javascript 72.247.225.88
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/5ef092d1efb5/2537c33769cb/5424adda5320/RC609c6a62e6764307915e122757d5274b-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENc0cbffaf0f8248c3a934a56818d7737e.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 72.247.225.88 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-225-88.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: b149454d4a8486f01d3a5b927d3dfeefa4bb425324b1c187e202d5e5c01d60df

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 06 Mar 2020 19:10:48 GMT
content-encoding: gzip
last-modified: Tue, 03 Mar 2020 22:13:56 GMT
server: AkamaiNetStorage
etag: "7b58ab818ddf5cc463a23a28bdf2b909:1583273636.490277"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 19171
expires: Fri, 06 Mar 2020 20:10:48 GMT

GET
H/1.1 200
OK meBoot.min.js Show response
mem.gfx.ms/scripts/me/MeControl/10.20056.4/en-US/ 132 KB
29 KB 7ms
6ms Script
application/javascript 2a02:26f0:6c00:19d::37
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://mem.gfx.ms/scripts/me/MeControl/10.20056.4/en-US/meBoot.min.js

Requested by

Host: mem.gfx.ms
URL: https://mem.gfx.ms/meversion?partner=MSSecurity&market=en-us&uhf=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:19d::37 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

7ddde9c325e7854bedabf59c04f3b81bf8539701d4c0e7fdc66624fd1580d78b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Wed, 26 Feb 2020 09:21:28 GMT
Date: Fri, 06 Mar 2020 19:10:48 GMT
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=2592000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 28828
X-UA-Compatible: IE=edge

POST
H2 200 admin-ajax.php Show response
www.microsoft.com/security/blog/wp-admin/ 58 B
879 B 1159ms
1158ms XHR
application/json 2a02:26f0:6c00:183::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.microsoft.com/security/blog/wp-admin/admin-ajax.php

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:183::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

c02f7dbcbf49114dec273e763bca1199ed3126242c464c0262893752c1c9281b

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN, SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
Origin: https://www.microsoft.com
X-Requested-With: XMLHttpRequest
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

x-edgeconnect-origin-mex-latency: 1022
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-rtag: RT
status: 200
tls_version: tls1.2
content-length: 58
x-xss-protection: 1; mode=block
nr-enabled: 1, 1
referrer-policy: strict-origin-when-cross-origin
wpe-backend: apache, apache
x-wpe-loopback-upstream-addr: 127.0.0.1:6783, 127.0.0.1:6783
date: Fri, 06 Mar 2020 19:10:49 GMT
x-frame-options: SAMEORIGIN, SAMEORIGIN
content-type: application/json; charset=UTF-8
pragma: no-cache
cache-control: no-cache, must-revalidate, max-age=0, no-store
content-security-policy: upgrade-insecure-requests
x-robots-tag: noindex
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 200 jsll-4.js Show response
az725175.vo.msecnd.net/scripts/ 54 KB
18 KB 343ms
19ms Script
text/javascript 152.199.19.160
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://az725175.vo.msecnd.net/scripts/jsll-4.js
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.199.19.160 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (ama/8B30) /
Resource Hash: e6bbfa4af18fb4f0e9c8a31d6654eac92d0f82dc895c6e5f49b54a8de51e5923

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 06 Mar 2020 19:10:49 GMT
content-encoding: gzip
content-md5: Dy7dMa7nsOSUbofNz/X23A==
age: 1460
x-cache: HIT
status: 200
content-length: 18058
x-ms-lease-status: unlocked
last-modified: Thu, 14 Mar 2019 00:43:49 GMT
server: ECAcc (ama/8B30)
etag: 0x8D6A8161FD3B925
vary: Accept-Encoding
content-type: text/javascript; charset="utf-8"
x-ms-request-id: b1d1004f-601e-0053-05e7-f3d324000000
cache-control: public, max-age=1800, immutable
x-ms-version: 2009-09-19

GET
DATA 200
OK truncated
/ 358 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ee2b841529e5d06aeae7f65b413b40bbfef5161c9fad9a8a1755dac03806291b

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml;charset=utf-8

GET
H/1.1 200
OK t.js Show response
web.vortex.data.microsoft.com/collect/v1/ 281 B
966 B 145ms
32ms Script
application/javascript 40.77.226.250
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://web.vortex.data.microsoft.com/collect/v1/t.js?ver=%272.1%27&name=%27Ms.Webi.PageView%27&time=%272020-03-06T19%3A10%3A49.240Z%27&os=%27MacOS%27&appId=%27JS%3AsecurityBlog%27&-ver=%271.0%27&-impressionGuid=%27e5788c13-c1eb-4a95-9798-940d0f007449%27&-pageName=%27Undefined%27&-uri=%27https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fblog%2F2017%2F06%2F27%2Fnew-ransomware-old-techniques-petya-adds-worm-capabilities%2F%27&-resHeight=1200&-resWidth=1600&-pageTags=%27%7B%22metaTags%22%3A%7B%7D%7D%27&-behavior=0&*baseType=%27Ms.Content.PageView%27&*cookieEnabled=true&*isJs=true&*title=%27New%20ransomware%2C%20old%20techniques%3A%20Petya%20adds%20worm%20capabilities%20-%20Microsoft%20Security%27&*isLoggedIn=false&*flashInstalled=false&ext-javascript-ver=%271.1%27&ext-javascript-libVer=%274.2.14%27&ext-javascript-domain=%27www.microsoft.com%27&ext-javascript-userConsent=false&$mscomCookies=false

Requested by

Host: az725175.vo.msecnd.net
URL: https://az725175.vo.msecnd.net/scripts/jsll-4.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

40.77.226.250 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

644c06af670789f4daca0e6f072549b6ff80e00896859b131f8939478f9ffc36

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Pragma: no-cache
Date: Fri, 06 Mar 2020 19:10:48 GMT
X-Content-Type-Options: nosniff
P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
Cache-Control: no-cache, no-store
MS-CV: t68vvAIWkkGDIz2zNyBrIA.0
Content-Type: application/javascript
Content-Length: 281
Expires: 0

GET
H2 200 RC02a99f79d83643db96d68f21ab6d4c4e-source.min.js Show response
assets.adobedtm.com/5ef092d1efb5/2537c33769cb/5424adda5320/ 2 KB
1 KB 30ms
30ms Script
application/x-javascript 72.247.225.88
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/5ef092d1efb5/2537c33769cb/5424adda5320/RC02a99f79d83643db96d68f21ab6d4c4e-source.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENc0cbffaf0f8248c3a934a56818d7737e.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 72.247.225.88 , United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a72-247-225-88.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: a9ff1d8e5394b324c020747c9556e5c37e096bad5e2332d6cfd08de57497d7b4

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 06 Mar 2020 19:10:49 GMT
content-encoding: gzip
last-modified: Tue, 03 Mar 2020 22:13:56 GMT
server: AkamaiNetStorage
etag: "7b58ab818ddf5cc463a23a28bdf2b909:1583273636.490277"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 810
expires: Fri, 06 Mar 2020 20:10:49 GMT

POST
H/1.1 200
OK v1
web.vortex.data.microsoft.com/collect/ 0
0 32ms
32ms Other
application/json 40.77.226.250
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://web.vortex.data.microsoft.com/collect/v1?$mscomCookies=false&ext-javascript-msfpc=%27GUID%3Dd542676b69ff483aa40ad9a23a0520ff%26HASH%3Dd542%26LV%3D202003%26V%3D4%26LU%3D1583521849359%27
Requested by: Host: az725175.vo.msecnd.net
URL: https://az725175.vo.msecnd.net/scripts/jsll-4.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 40.77.226.250 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
Origin: https://www.microsoft.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Access-Control-Allow-Origin: https://www.microsoft.com
Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Origin, X-Xbl-Contract-Version, X-Xbl-Device-Type, Xbl-Authz-Actor-10, WithCredentials
Access-Control-Allow-Credentials: true

GET
H2 200 me.srf
login.live.com/ Frame EC50 0
0 495ms
166ms Document
text/html 40.90.22.185
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://login.live.com/me.srf?wa=wsignin1.0&wreply=https%3A%2F%2Fwww.microsoft.com&uaid=da987e05-2a6f-4cb4-11f7-b6a5884eb11b&partnerId=mssecurity

Requested by

Host: mem.gfx.ms
URL: https://mem.gfx.ms/scripts/me/MeControl/10.20056.4/en-US/meBoot.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

40.90.22.185 San Jose, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Microsoft-IIS/10.0 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

:method: GET
:authority: login.live.com
:scheme: https
:path: /me.srf?wa=wsignin1.0&wreply=https%3A%2F%2Fwww.microsoft.com&uaid=da987e05-2a6f-4cb4-11f7-b6a5884eb11b&partnerId=mssecurity
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/

Response headers

status: 200
cache-control: no-cache, no-store
pragma: no-cache
content-type: text/html; charset=utf-8
content-encoding: gzip
expires: Fri, 06 Mar 2020 19:09:49 GMT
vary: Accept-Encoding
server: Microsoft-IIS/10.0
p3p: CP="DSP CUR OTPi IND OTRi ONL FIN"
set-cookie: uaid=da987e052a6f4cb411f7b6a5884eb11b; domain=login.live.com; Secure; path=/; HttpOnly MSPRequ=id=N&lt=1583521849&co=1; domain=login.live.com; Secure; path=/; HttpOnly
referrer-policy: strict-origin-when-cross-origin
x-ms-request-id: 86f6acbc-ff24-440a-af96-087d071eec12
ppserver: PPV: 30 H: BY1PPF6A4783EFD V: 0
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
x-xss-protection: 1; mode=block
date: Fri, 06 Mar 2020 19:10:49 GMT
content-length: 4319

GET
H/1.1 200
OK meCore.min.js Show response
mem.gfx.ms/scripts/me/MeControl/10.20056.4/en-US/ 101 KB
17 KB 7ms
7ms Script
application/javascript 2a02:26f0:6c00:19d::37
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://mem.gfx.ms/scripts/me/MeControl/10.20056.4/en-US/meCore.min.js

Requested by

Host: mem.gfx.ms
URL: https://mem.gfx.ms/meversion?partner=MSSecurity&market=en-us&uhf=1

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2a02:26f0:6c00:19d::37 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

aed1e03b227468b53fac24720b477f0eb239b6879ff8cd945d9bb625f670223c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Last-Modified: Wed, 26 Feb 2020 09:21:34 GMT
Date: Fri, 06 Mar 2020 19:10:49 GMT
Vary: Accept-Encoding
Content-Type: application/javascript
Cache-Control: max-age=2592000
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 16987
X-UA-Compatible: IE=edge

POST
H/1.1 200
OK v1
web.vortex.data.microsoft.com/collect/ 0
0 33ms
32ms Other
application/json 40.77.226.250
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://web.vortex.data.microsoft.com/collect/v1?$mscomCookies=false&ext-javascript-msfpc=%27GUID%3Dd542676b69ff483aa40ad9a23a0520ff%26HASH%3Dd542%26LV%3D202003%26V%3D4%26LU%3D1583521849359%27
Requested by: Host: az725175.vo.msecnd.net
URL: https://az725175.vo.msecnd.net/scripts/jsll-4.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 40.77.226.250 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
Origin: https://www.microsoft.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Access-Control-Allow-Origin: https://www.microsoft.com
Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Origin, X-Xbl-Contract-Version, X-Xbl-Device-Type, Xbl-Authz-Actor-10, WithCredentials
Access-Control-Allow-Credentials: true

POST
H/1.1 200
OK v1
web.vortex.data.microsoft.com/collect/ 0
0 66ms
33ms Other
application/json 40.77.226.250
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://web.vortex.data.microsoft.com/collect/v1?$mscomCookies=false&ext-javascript-msfpc=%27GUID%3Dd542676b69ff483aa40ad9a23a0520ff%26HASH%3Dd542%26LV%3D202003%26V%3D4%26LU%3D1583521849359%27
Requested by: Host: az725175.vo.msecnd.net
URL: https://az725175.vo.msecnd.net/scripts/jsll-4.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 40.77.226.250 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
Origin: https://www.microsoft.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Access-Control-Allow-Origin: https://www.microsoft.com
Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Origin, X-Xbl-Contract-Version, X-Xbl-Device-Type, Xbl-Authz-Actor-10, WithCredentials
Access-Control-Allow-Credentials: true

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 3 KB
2 KB 27ms
9ms Script
application/x-javascript 2a02:26f0:10c:39e::25ea
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:10c:39e::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: 41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

Date: Fri, 06 Mar 2020 19:10:49 GMT
Content-Encoding: gzip
Last-Modified: Mon, 07 Oct 2019 16:41:31 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=49941
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1576

GET
H2 200 addthis_widget.js Show response
s7.addthis.com/js/300/ 349 KB
113 KB 133ms
78ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/js/300/addthis_widget.js

Requested by

Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-210-248-44.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

ab8ceea757a634f5ce5a9ed6f6b4bcdd555869b385d315854e16914a2f5a3bc7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Tue, 21 Jan 2020 20:57:37 GMT
server: nginx/1.15.8
etag: W/"5e2765c1-57446"
vary: Accept-Encoding
x-distribution: 99
content-type: application/javascript
status: 200
cache-control: public, max-age=600
date: Fri, 06 Mar 2020 19:10:50 GMT
x-host: s7.addthis.com
content-length: 114924

GET
H2

200

collect
px.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7850&url=https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fblog%2F2017%2F06%2F27%2Fnew-ransomware-old-techniques-petya-adds-worm-capabilities%2F&time=1...
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D7850%26url%3Dhttps%253A%252F%252Fwww.microsoft.com%252Fsecurity%252Fblog%252F2017...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7850&url=https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fblog%2F2017%2F06%2F27%2Fnew-ransomware-old-techniques-petya-adds-worm-capabilities%2F&time=1...

0
58 B

166ms
166ms

Image
application/javascript

2a05:f500:11:101::b93f:9005
LINKEDIN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7850&url=https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fblog%2F2017%2F06%2F27%2Fnew-ransomware-old-techniques-petya-adds-worm-capabilities%2F&time=1583521849981&liSync=true
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2a05:f500:11:101::b93f:9005 , Ireland, ASN14413 (LINKEDIN, US),
Reverse DNS
Software: Play /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

date: Fri, 06 Mar 2020 19:10:50 GMT
server: Play
linkedin-action: 1
x-li-fabric: prod-lor1
status: 200
x-li-proto: http/2
x-li-pop: prod-tln1
content-type: application/javascript
content-length: 0
x-li-uuid: OX6Dq7vM+RWQcgc2tyoAAA==

Redirect headers

date: Fri, 06 Mar 2020 19:10:50 GMT
x-content-type-options: nosniff
nel: {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
linkedin-action: 1
status: 302
strict-transport-security: max-age=2592000
content-length: 0
x-xss-protection: 1; mode=block
server: Play
pragma: no-cache
x-li-pop: prod-tln1
expect-ct: max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
x-frame-options: sameorigin
report-to: {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-uuid: 5a5UobvM+RXQzYrhiCsAAA==
location: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7850&url=https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fblog%2F2017%2F06%2F27%2Fnew-ransomware-old-techniques-petya-adds-worm-capabilities%2F&time=1583521849981&liSync=true
cache-control: no-cache, no-store
content-security-policy: default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob: static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/insight.min.js platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'
x-li-proto: http/2
x-li-fabric: prod-lor1
expires: Thu, 01 Jan 1970 00:00:00 GMT

GET
H2 200 moatframe.js Show response
z.moatads.com/addthismoatframe568911941483/ 2 KB
1 KB 84ms
34ms Script
application/x-javascript 23.210.250.213
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://z.moatads.com/addthismoatframe568911941483/moatframe.js
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.250.213 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-250-213.deploy.static.akamaitechnologies.com
Software: AmazonS3 /
Resource Hash: 05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 06 Mar 2020 19:10:50 GMT
content-encoding: gzip
last-modified: Fri, 08 Nov 2019 20:13:52 GMT
server: AmazonS3
x-amz-request-id: D5503D14AA2F06AA
etag: "f14b4e1f799b14f798a195f43cf58376"
vary: Accept-Encoding
content-type: application/x-javascript
status: 200
cache-control: max-age=42823
accept-ranges: bytes
content-length: 948
x-amz-id-2: JgalEtxvSAtZmM7+naGfrhsdf0JFS0gJW8lypWF8Tp90EkcPp4c3eAnpK+RDOIL1ltWgpx8wc3s=

GET
H2 200 _ate.track.config_resp Show response
v1.addthisedge.com/live/boost/ra-5a733b9bbd7faa84/ 1 KB
715 B 214ms
213ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://v1.addthisedge.com/live/boost/ra-5a733b9bbd7faa84/_ate.track.config_resp
Requested by: Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-210-248-44.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 54d6708cd6dc7015978f4f54e47c6e25e4f6a4056e0d012cbd25ace40436193d

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

date: Fri, 06 Mar 2020 19:10:50 GMT
content-encoding: gzip
etag: -1434393054--gzip
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
status: 200
cache-control: public, max-age=60, s-maxage=86400
content-disposition: attachment; filename=1.txt
content-length: 538

POST
H/1.1 200
OK v1
web.vortex.data.microsoft.com/collect/ 0
0 32ms
32ms Other
application/json 40.77.226.250
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://web.vortex.data.microsoft.com/collect/v1?$mscomCookies=false&ext-javascript-msfpc=%27GUID%3Dd542676b69ff483aa40ad9a23a0520ff%26HASH%3Dd542%26LV%3D202003%26V%3D4%26LU%3D1583521849359%27
Requested by: Host: az725175.vo.msecnd.net
URL: https://az725175.vo.msecnd.net/scripts/jsll-4.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 40.77.226.250 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
Origin: https://www.microsoft.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Access-Control-Allow-Origin: https://www.microsoft.com
Access-Control-Allow-Headers: Accept, Authorization, Content-Type, Origin, X-Xbl-Contract-Version, X-Xbl-Device-Type, Xbl-Authz-Actor-10, WithCredentials
Access-Control-Allow-Credentials: true

GET
H2 200 layers.ab5cd98fe1b9a38a4a9f.js Show response
s7.addthis.com/static/ 263 KB
76 KB 51ms
51ms Script
application/javascript 23.210.248.44
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://s7.addthis.com/static/layers.ab5cd98fe1b9a38a4a9f.js

Requested by

Host: s7.addthis.com
URL: https://s7.addthis.com/js/300/addthis_widget.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.210.248.44 , Netherlands, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-210-248-44.deploy.static.akamaitechnologies.com

Software

nginx/1.15.8 /

Resource Hash

ecc0c4a707efeb061b7de57440221feb21ab08022938aaacee779e98fe809235

Security Headers

Name	Value
Strict-Transport-Security	max-age=15724800; includeSubDomains

Request headers

Referer: https://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Wed, 18 Sep 2019 14:16:17 GMT
server: nginx/1.15.8
etag: W/"5d823c31-41b9f"
vary: Accept-Encoding
content-type: application/javascript
status: 200
cache-control: public, max-age=86313600
date: Fri, 06 Mar 2020 19:10:50 GMT
x-host: s7.addthis.com
timing-allow-origin: *
content-length: 77528

Verdicts & Comments Add Verdict or Comment

97 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

3 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.microsoft.com/	1970-01-19 16:37:37	Name: MSFPC Value: GUID=d542676b69ff483aa40ad9a23a0520ff&HASH=d542&LV=202003&V=4&LU=1583521849359
.microsoft.com/	1970-01-19 07:52:03	Name: MS0 Value: 0900f92b1748460d89d91f274672c5b4
.microsoft.com/	1970-01-19 16:37:37	Name: MC1 Value: GUID=d542676b69ff483aa40ad9a23a0520ff&HASH=d542&LV=202003&V=4&LU=1583521849359

7 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://www.microsoft.com/security/blog/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1(Line 2) Message: JQMIGRATE: Migrate is installed, version 1.4.1
console-api	log	(Line 2) Message: Start KWIF
console-api	log	(Line 2) Message: JSLL starts
console-api	log	(Line 2) Message: ID syncs starts
console-api	log	(Line 2) Message: JSLL ends
console-api	log	(Line 2) Message: webblends match failed forhttps://www.microsoft.com/security/blog/2017/06/27/new-ransomware-old-techniques-petya-adds-worm-capabilities/
console-api	log	(Line 2) Message: ID syncs ends with appid

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.adobedtm.com
assets.onestore.ms
az725175.vo.msecnd.net
c.s-microsoft.com
cloudblogs.microsoft.com
img-prod-cms-rt-microsoft-com.akamaized.net
login.live.com
mem.gfx.ms
px.ads.linkedin.com
query.prod.cms.rt.microsoft.com
s7.addthis.com
snap.licdn.com
statics-marketingsites-wcus-ms-com.akamaized.net
uhf.microsoft.com
v1.addthisedge.com
web.vortex.data.microsoft.com
www.linkedin.com
www.microsoft.com
z.moatads.com
107.154.114.97
152.199.19.160
184.30.221.161
2.16.106.48
23.210.248.44
23.210.250.213
2a02:26f0:10c:381::356e
2a02:26f0:10c:383::2b57
2a02:26f0:10c:396::2957
2a02:26f0:10c:39e::25ea
2a02:26f0:6c00:183::356e
2a02:26f0:6c00:19d::37
2a02:26f0:6c00::210:ba1b
2a05:f500:11:101::b93f:9001
2a05:f500:11:101::b93f:9005
40.77.226.250
40.90.22.185
72.247.225.88
0284cbccebf1682452d62d06efa3665c874d642d4e03f5f5f9bb0f555da9251b
05090f9390f5bc0cd23fe5f432037cc92d7cbce1ced9bfe8faf3d1c9abae85cd
0700abb9bfba3298430d1a2a17d3b33939d6936568b51ef04a01c39d5ee9829d
0bd288d5397a69ead391875b422bf2cbdcc4f795d64aa2f780aff45768d78248
10733a5d876108f81c5f78eee5c9760a739d89c52fa6180c4290b7f909f24346
112fec798b78aa02e102a724b5cb1990c0f909bc1d8b7b1fa256eab41bbc0960
11e15f1d64a63cb498d0d42720a688ed15bf78393d8c460d695a110244c066e3
1232bbdbc5d205f3c5a40efa5ed92839c79e7879d5168445cc47645bb93f7d1b
15545c41aa48eb0b7e9c53a83fdf86248e9b8a305c3ce43bfae6c871ddad314e
16d6e957a9525cb4848051b0efc5aa101d256a3c6838007dc4ac2c41121eaade
1a351abc3f3b435497ddb8a55f09268d3e641dc22455deac06cf0181a4de52ee
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
22b4df5c33045b645cafa45b04685f4752e471a2e933bff5bf14324d87deee12
238db52476bf8107e2e851cd3299b071ed5944b570c1603a1ea758a4fadf5f29
2e7573bffb651b1dda17e9765eda7679cd8d7f92d0911cbe1863f27a3c1e9337
3070f4770f5e6fc62fc0433671ca8ea8b42814bd295e8aafe35aa5e9fd0ab724
308d1cc1ede2b64b0e59f932e90a29c261496da4588a798938d1a333ed78752b
33cd982a5d8617d4537e22e4ed5fb6a608a2c4857bf62a5ec8bd6cc9d797255a
41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
4919e80f038d2b93f1184d1733ac35009643481735c7bc7aa31d8b56e118fc04
4a55a1f7133558d4026d461a8745303e08004e0ea89f2cdf9e398849623996cf
4dadc2332aba5151f4b0bd990760d4ea2f3207f9690d0bfeff626bccef8d335f
4e6957c6899cfe2edc653d53d51680a4af82e09863bf61165b5ae2ed9cdf4a87
4f7f4afe26e71fa9ca1dac4a43b557a554a46f53251d849f07ed08a04829d74b
54d6708cd6dc7015978f4f54e47c6e25e4f6a4056e0d012cbd25ace40436193d
5842ac661692dc02185a41781976d3987abdcf9f93ee3a8c22b5f479fe44aedb
5b3f9ebec7af8e1bf9bf69169c48f48ce2808ce2372ef7ca4e16f2da042eb71f
644c06af670789f4daca0e6f072549b6ff80e00896859b131f8939478f9ffc36
66c5d9882a954332c4aebef2386c7713a226fa617ddcd08d22f24e53ba5ec066
6ba0d1a726f1887bd61727b308ed0be0e73edba17d4ad11b91ab19b632e078f6
733d7c26a5fb7240e83e8af2c822218b321b5143e28c2dd65ab2492297ac6bd7
7cdf088afb8998bfa2a6531b8ccf35577bdca0a7e54528f23ea0075c8e76c7df
7cf7935a98e4f100c4c3977f79a1a13b2b273ee66d55fe37bc1b8e5c7187d79e
7ddde9c325e7854bedabf59c04f3b81bf8539701d4c0e7fdc66624fd1580d78b
857b665b2ee3c407a22ead2afb97f7fcbb8752431c4829dd266e51ec6daac1de
875071ac76430f551ed9b36d0827d818157658b2247662db454ffcba6c07bb07
88064771eb12ea2f7ff435a01e79a78212a31f4de4c1e375ef9e951685e762bc
893fa7fe8b6e69e2828319c04a7cbb6f129ea820db695d4ced5757d59450b6a8
8ed9c234ecfa1787fe94a919e7a247a9488bb4ecc256d72f314ff8e11ecde7f2
95139d4075c7c007f62091a16cf34eb149532b7510c6df1a18b550da09278c7f
9dc88b264cb2061fdeccef48662172bf52cc1cd5c668e242e9e600f3bf39c84b
a188e6c4c6729c3abbe6a34e45b5c3d7d65ffc659e1baa46632ffb1c876e815c
a58941524adf31d97c86f42995772c3a250918e696d00afc4c78d149f2adc43f
a9ff1d8e5394b324c020747c9556e5c37e096bad5e2332d6cfd08de57497d7b4
aa163f4777f0ee19e5f23ac0f332c22f06cd621696c62f527067c32a8c6c3a98
ab8ceea757a634f5ce5a9ed6f6b4bcdd555869b385d315854e16914a2f5a3bc7
aed1e03b227468b53fac24720b477f0eb239b6879ff8cd945d9bb625f670223c
b149454d4a8486f01d3a5b927d3dfeefa4bb425324b1c187e202d5e5c01d60df
b1d83c2d49c49ea38d578afa752aaec44a86d069d6ce2d54460e2612fc31a102
b201ab52de2c92539f7a276b6cf170b1bdf0f3705f1b6ab9597517d030afefe4
b340cd52ebd572c3157a373a83bbd37ea269585fb9db490c0902813f120bf77a
b79d14c5b6d4c648fbd3c3dacba3666b62a610d1543bfec138f4c3fa39193bd7
b7d6e7f7f328858b5536603428d9234c7c545c18bdc6d3f9d2f1526ae4b74dd1
b828b15e9b7836b493a8bd6e832a24ee13aa8b6f8b4a1bf307a7af2912014178
b954e9deae1dd21ad3db40c79138e411b4165510df603dd6e7e1ad8e7b38971e
ba86a86ea50e574b45a1a91f35b32f2b3976ed4b2d75a357d8a17c3badd5f281
bf745fef5e21218439a84aeeb659bff23812adbb1b6355bdcb679303f886d74c
c022d284134bd3ce8c0cc2c18b16a221fe4e8c3d9b5e6745dd4f9e2f45f3c27e
c02f7dbcbf49114dec273e763bca1199ed3126242c464c0262893752c1c9281b
c35c2ab6aa2d6ff4c126f4197f075c94e38371f7244267051317b63e607ab306
c3c027a797b2f7112555a219c0a0c91e8689f97203aeab469382665f74f05016
c3c6fe97f918fcc40403ff671209d7d042dd4a8a7dc66e974eb1becc2bfe16ed
cd9f9701c135d4c08a851bc5f634242f03fef8132f8d763cddc9b8ed1d20344a
d234c547122d2621d54d94ca01cb714d49f8bd25fea3bdcc3c3c5f24b6e88594
d52a506abeec5c7cb2e6cafe138da0763f555a16c2920683a7eb866453624f39
d87d0a7a7fe2c36d1dc093bfe56e9b81b311988789dbd3b65abf811d551ef02f
d9662b4b9ba6c2c3691ce0acd4572e027366eb97d6070550a13429262bb0037f
df8b7b0ba4c722b49ca03f224a6d9c491453f816ec2b103339559fb85341bc3a
dfc6de0e1501679bd71244faed1d26b977260f78853325c865754d05c238fe22
e38455204599e79fe060d0a297c8bfa1bf06a905a4ac1fc7e028cda3fdd78d06
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4fc1c68d3b07be8aba84ed6652e76fd49a7d9658060c243a1a2dcd59dcca6a6
e6bbfa4af18fb4f0e9c8a31d6654eac92d0f82dc895c6e5f49b54a8de51e5923
ea49a34ae66ff6330e30845980df1589a88990a50391b5b2d53248086c184924
ecc0c4a707efeb061b7de57440221feb21ab08022938aaacee779e98fe809235
ee2b841529e5d06aeae7f65b413b40bbfef5161c9fad9a8a1755dac03806291b
f174b3ce00dc0ef25fe0867dae1da92a595c50f730dbe2cd1fd7f29546034e81
f258c099e2bb029f6c9d5e9900a78f53347a16b43aa1e37a9f9c1a1539e0748d
f25fb12269bb1060790dd528cb700a87c49d8f3531cedaad0d37c617a4d1c5af
f2a28cd82e7ec00d2d8158f21fb0507722cd8b09fa4a0a16fadc58f30385cc25
fe8a1047376498c80a157d13555e42a92ad480fcb0bcc9de51ad1930fbeb7f91

www.microsoft.com Open in urlscan Pro 2a02:26f0:6c00:183::356e Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Detected technologies

Page Statistics

87 Requests

100 %HTTPS

50 %IPv6

13 Domains

19 Subdomains

18 IPs

4 Countries

2319 kBTransfer

4689 kBSize

3 Cookies

80 Outgoing links

Redirected requests

87 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.microsoft.com Open in urlscan Pro
2a02:26f0:6c00:183::356e Public Scan

Screenshot
Live screenshot

Full Image

87
Requests

100 %
HTTPS

50 %
IPv6

13
Domains

19
Subdomains

18
IPs

4
Countries

2319 kB
Transfer

4689 kB
Size

3
Cookies

87 HTTP transactions
1 data transactions