urlscan.io logo urlscan.io
SecurityTrails logo

blogs.technet.microsoft.com Open in urlscan Pro
23.38.58.129  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://aka.ms/O365-compromise
Effective URL: https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Submission: On November 07 via manual from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 13 IPs in 4 countries across 12 domains to perform 48 HTTP transactions. The main IP is 23.38.58.129, located in Amsterdam, Netherlands and belongs to AKAMAI-ASN1, US. The main domain is blogs.technet.microsoft.com.
TLS certificate: Issued by Microsoft IT TLS CA 5 on November 7th 2017. Valid for: 2 years.
This is the only time blogs.technet.microsoft.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 23.66.21.99 16625 (AKAMAI-AS)
22 23.38.58.129 20940 (AKAMAI-ASN1)
6 152.199.19.160 15133 (EDGECAST)
1 104.109.70.191 20940 (AKAMAI-ASN1)
2 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
1 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
7 104.111.241.149 16625 (AKAMAI-AS)
2 2a03:2880:f01... 32934 (FACEBOOK)
1 2620:109:c00c... 14413 (LINKEDIN)
2 40.77.226.250 8075 (MICROSOFT...)
1 2a03:2880:f11... 32934 (FACEBOOK)
48 13
1    23.66.21.99 (Amsterdam, Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a23-66-21-99.deploy.static.akamaitechnologies.com
aka.ms
22    23.38.58.129 (Amsterdam, Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a23-38-58-129.deploy.static.akamaitechnologies.com
blogs.technet.microsoft.com
6    152.199.19.160 (Ashburn, United States)

ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US)
ajax.aspnetcdn.com
az725175.vo.msecnd.net
1    104.109.70.191 (Amsterdam, Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a104-109-70-191.deploy.static.akamaitechnologies.com
i1.social.s-msft.com
2    2a02:26f0:6c00:29d::356e (European Union)

ASN20940 (AKAMAI-ASN1, US)
c.s-microsoft.com
1    2a02:26f0:6c00:299::2b57 (European Union)

ASN20940 (AKAMAI-ASN1, US)
uhf.microsoft.com
1    2a00:1450:4001:814::200e (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
www.google-analytics.com
1    2a00:1450:4001:814::2008 (Ireland)

ASN15169 (GOOGLE - Google LLC, US)
www.googletagmanager.com
7    104.111.241.149 (Amsterdam, Netherlands)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-111-241-149.deploy.static.akamaitechnologies.com
widgets.services.microsoft.com
2    2a03:2880:f01c:216:face:b00c:0:3 (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)
connect.facebook.net
staticxx.facebook.com
1    2620:109:c00c:104::b93f:9001 (United States)

ASN14413 (LINKEDIN - LinkedIn Corporation, US)
www.linkedin.com
2    40.77.226.250 (Dublin, Ireland)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
web.vortex.data.microsoft.com
1    2a03:2880:f11c:8083:face:b00c:0:25de (Ireland)

ASN32934 (FACEBOOK - Facebook, Inc., US)
www.facebook.com
Domain Requested by
22 blogs.technet.microsoft.com blogs.technet.microsoft.com
ajax.aspnetcdn.com
7 widgets.services.microsoft.com blogs.technet.microsoft.com
ajax.aspnetcdn.com
5 ajax.aspnetcdn.com blogs.technet.microsoft.com
2 web.vortex.data.microsoft.com az725175.vo.msecnd.net
2 c.s-microsoft.com blogs.technet.microsoft.com
1 www.facebook.com connect.facebook.net
1 staticxx.facebook.com connect.facebook.net
1 www.linkedin.com ajax.aspnetcdn.com
1 connect.facebook.net blogs.technet.microsoft.com
1 www.googletagmanager.com blogs.technet.microsoft.com
1 az725175.vo.msecnd.net blogs.technet.microsoft.com
1 www.google-analytics.com blogs.technet.microsoft.com
1 uhf.microsoft.com blogs.technet.microsoft.com
1 i1.social.s-msft.com blogs.technet.microsoft.com
1 aka.ms 1 redirects
0 public.newsharecounts.com Failed ajax.aspnetcdn.com
48 16
Subject Issuer Validity Valid
blogs.technet.microsoft.com
Microsoft IT TLS CA 5		 2017-11-07 -
2019-11-07		 2 years crt.sh
*.vo.msecnd.net
Microsoft IT TLS CA 2		 2018-03-30 -
2020-03-30		 2 years crt.sh
i1.social.s-msft.com
Microsoft IT TLS CA 4		 2018-10-03 -
2020-10-03		 2 years crt.sh
www.microsoft.com
Microsoft IT TLS CA 4		 2018-01-16 -
2020-01-16		 2 years crt.sh
unistore.www.microsoft.com
Microsoft IT TLS CA 5		 2018-01-25 -
2020-01-25		 2 years crt.sh
*.google-analytics.com
Google Internet Authority G3		 2018-10-16 -
2019-01-08		 3 months crt.sh
social.msdn.microsoft.com
Microsoft IT TLS CA 5		 2018-08-02 -
2020-08-02		 2 years crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2017-12-15 -
2019-03-22		 a year crt.sh
www.linkedin.com
DigiCert SHA2 Secure Server CA		 2018-05-30 -
2020-09-01		 2 years crt.sh
*.vortex.data.microsoft.com
Microsoft IT TLS CA 5		 2018-01-30 -
2020-01-30		 2 years crt.sh

This page contains 3 frames:

Primary Page: https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Frame ID: 90C402FF5E93D4673C980C746C05B601
Requests: 50 HTTP requests in this frame

Frame: https://staticxx.facebook.com/connect/xd_arbiter/r/__Bz3h5RzMx.js?version=42
Frame ID: 23218884213EA286DC13A8E30ADE83BB
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/v2.8/plugins/share_button.php?app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter%2Fr%2F__Bz3h5RzMx.js%3Fversion%3D42%23cb%3Df326839318d9d7c%26domain%3Dblogs.technet.microsoft.com%26origin%3Dhttps%253A%252F%252Fblogs.technet.microsoft.com%252Ff166fac6b08e38%26relation%3Dparent.parent&container_width=77&href=https%3A%2F%2Fblogs.technet.microsoft.com%2Foffice365security%2Fhow-to-fix-a-compromised-hacked-microsoft-office-365-account%2F&layout=button_count&locale=en_GB&mobile_iframe=true&sdk=joey&size=large
Frame ID: 79AEC01F602B03BAC895DE41687E63E2
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page URL History Show full URLs

  1. https://aka.ms/O365-compromise HTTP 301
    https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/ Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<link rel=["']stylesheet["'] [^>]+wp-(?:content|includes)/i
  • script /\/wp-includes\//i
Overall confidence: 100%
Detected patterns
  • html /<link rel=["']stylesheet["'] [^>]+wp-(?:content|includes)/i
  • script /\/wp-includes\//i
Overall confidence: 100%
Detected patterns
  • script /\/\/connect\.facebook\.net\/[^\/]*\/[a-z]*\.js/i
Overall confidence: 100%
Detected patterns
  • script /google-analytics\.com\/(?:ga|urchin|(analytics))\.js/i
Overall confidence: 100%
Detected patterns
  • env /^google_tag_manager$/i
Overall confidence: 100%
Detected patterns
  • env /^twemoji$/i
Overall confidence: 100%
Detected patterns
  • script /jquery(?:\-|\.)([\d.]*\d)[^\/]*\.js/i
  • script /jquery.*\.js/i
  • env /^jQuery$/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]+?href="[^"]+bootstrap(?:\.min)?\.css/i
  • script /(?:twitter\.github\.com\/bootstrap|bootstrap(?:\.js|\.min\.js))/i

Page Statistics

48
Requests

98 %
HTTPS

54 %
IPv6

12
Domains

16
Subdomains

13
IPs

4
Countries

532 kB
Transfer

1072 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://aka.ms/O365-compromise HTTP 301
    https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

48 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request Cookie set /
blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Redirect Chain
  • https://aka.ms/O365-compromise
  • https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
52 KB
18 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.38.58.129 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-38-58-129.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
d0890b4294bb4e39460d5c5b28aa30ca049d4eb61a3e4e35b7ca9473cdb29f25
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Host
blogs.technet.microsoft.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Content-Length
18154
Content-Type
text/html; charset=UTF-8
Content-Encoding
gzip
Vary
Accept-Encoding
X-Frame-Options
SAMEORIGIN
X-Pingback
https://blogs.technet.microsoft.com/office365security/xmlrpc.php
Link
<https://blogs.technet.microsoft.com/office365security/?p=61>; rel=shortlink
Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Request-Context
appId=cid-v1:6bba0ebe-ac1f-40f1-a5fe-732db974adfb
X-XSS-Protection
1; mode=block
X-Content-Type-Options
nosniff
ARR-Disable-Session-Affinity
true
Date
Wed, 07 Nov 2018 13:46:56 GMT
Connection
keep-alive
Set-Cookie
msdn-blogs-aad-state-parameter=764A90C5-ECF9-9184-90F0-62B7E71D1FAD; path=/; secure; httponly

Redirect headers

Location
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Server
Kestrel
Request-Context
appId=cid-v1:26ef1154-5995-4d24-ad78-ef0b04f11587
X-Response-Cache-Status
True
X-Powered-By
ASP.NET
Content-Length
0
Expires
Wed, 07 Nov 2018 13:46:55 GMT
Cache-Control
max-age=0, no-cache, no-store
Pragma
no-cache
Date
Wed, 07 Nov 2018 13:46:55 GMT
Connection
keep-alive
Strict-Transport-Security
max-age=31536000 ; includeSubDomains
bootstrap.min.css
ajax.aspnetcdn.com/ajax/bootstrap/3.3.5/css/ 		120 KB
19 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://ajax.aspnetcdn.com/ajax/bootstrap/3.3.5/css/bootstrap.min.css
Requested by
Host: blogs.technet.microsoft.com
URL: https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
152.199.19.160 Ashburn, United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8F98) /
Resource Hash
31fbd99641c212a6ad3681a2397bde13c148c0ccd98385bce6a7eb7c81417d87
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 07 Nov 2018 13:46:56 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-cache
HIT
status
200
content-length
19759
x-xss-protection
1; mode=block
last-modified
Mon, 31 Oct 2016 23:10:15 GMT
server
ECAcc (frc/8F98)
etag
"80254bf0cb33d21:0"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
cache-control
public,max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
wds-ratings.css
blogs.technet.microsoft.com/office365security/wp-content/plugins/wds-ratings/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blogs.technet.microsoft.com/office365security/wp-content/plugins/wds-ratings/wds-ratings.css?ver=20161014
Requested by
Host: blogs.technet.microsoft.com
URL: https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.38.58.129 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-38-58-129.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
913abadc706c39dd6540adab9ce39e6115515ba0515d1e8fe386add03689a5e7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
blogs.technet.microsoft.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Cookie
msdn-blogs-aad-state-parameter=764A90C5-ECF9-9184-90F0-62B7E71D1FAD
Connection
keep-alive
Cache-Control
no-cache
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Thu, 29 Dec 2016 03:38:41 GMT
ETag
"80362dc8561d21:0"
Vary
Accept-Encoding
Content-Type
text/css
ARR-Disable-Session-Affinity
true
Cache-Control
max-age=1911
Date
Wed, 07 Nov 2018 13:46:56 GMT
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
603
X-XSS-Protection
1; mode=block
Request-Context
appId=cid-v1:1e40abc5-5fc0-4c08-939b-4be4566cca4b
style.css
blogs.technet.microsoft.com/office365security/wp-content/themes/microsoft/ 		18 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blogs.technet.microsoft.com/office365security/wp-content/themes/microsoft/style.css?ver=02092017
Requested by
Host: blogs.technet.microsoft.com
URL: https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.38.58.129 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-38-58-129.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
86f2ad8b0415b48e5c4e6cbfbc3b79f48afa1fbfb4648c4f9acb4b8c7f1d6568
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
blogs.technet.microsoft.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Cookie
msdn-blogs-aad-state-parameter=764A90C5-ECF9-9184-90F0-62B7E71D1FAD
Connection
keep-alive
Cache-Control
no-cache
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Thu, 29 Dec 2016 03:38:46 GMT
ETag
"02728f8561d21:0"
Vary
Accept-Encoding
Content-Type
text/css
ARR-Disable-Session-Affinity
true
Cache-Control
max-age=1909
Date
Wed, 07 Nov 2018 13:46:56 GMT
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4105
X-XSS-Protection
1; mode=block
Request-Context
appId=cid-v1:1e40abc5-5fc0-4c08-939b-4be4566cca4b
style.css
blogs.technet.microsoft.com/office365security/wp-content/themes/microsoft-technet/ 		899 B
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blogs.technet.microsoft.com/office365security/wp-content/themes/microsoft-technet/style.css?ver=04152016
Requested by
Host: blogs.technet.microsoft.com
URL: https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.38.58.129 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-38-58-129.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
753afdb3e8e9024755c0db094a391ae9003a1cdf6d5a10233a20fde900a7b02a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
blogs.technet.microsoft.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Cookie
msdn-blogs-aad-state-parameter=764A90C5-ECF9-9184-90F0-62B7E71D1FAD
Connection
keep-alive
Cache-Control
no-cache
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Thu, 08 Sep 2016 13:03:48 GMT
ETag
"cdd6a470d19d21:0"
Vary
Accept-Encoding
Content-Type
text/css
ARR-Disable-Session-Affinity
true
Cache-Control
max-age=1864
Date
Wed, 07 Nov 2018 13:46:56 GMT
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
699
X-XSS-Protection
1; mode=block
Request-Context
appId=cid-v1:6bba0ebe-ac1f-40f1-a5fe-732db974adfb
jquery-1.12.1.min.js
ajax.aspnetcdn.com/ajax/jQuery/ 		95 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.12.1.min.js
Requested by
Host: blogs.technet.microsoft.com
URL: https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
152.199.19.160 Ashburn, United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8E92) /
Resource Hash
2359d383bf2d4ab65ebf7923bdf74ce40e4093f6e58251b395a64034b3c39772
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 07 Nov 2018 13:46:56 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-cache
HIT
status
200
content-length
33937
x-xss-protection
1; mode=block
last-modified
Mon, 31 Oct 2016 23:10:51 GMT
server
ECAcc (frc/8E92)
etag
"804fc05cc33d21:0"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public,max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
bootstrap.min.js
ajax.aspnetcdn.com/ajax/bootstrap/3.3.5/ 		36 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.aspnetcdn.com/ajax/bootstrap/3.3.5/bootstrap.min.js
Requested by
Host: blogs.technet.microsoft.com
URL: https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
152.199.19.160 Ashburn, United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8FFD) /
Resource Hash
4a4de7903ea62d330e17410ea4db6c22bcbeb350ac6aa402d6b54b4c0cbed327
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 07 Nov 2018 13:46:56 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-cache
HIT
status
200
content-length
9755
x-xss-protection
1; mode=block
last-modified
Mon, 31 Oct 2016 23:09:59 GMT
server
ECAcc (frc/8FFD)
etag
"80bdc1e6cb33d21:0"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public,max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
single.js
blogs.technet.microsoft.com/office365security/wp-content/themes/microsoft/js/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blogs.technet.microsoft.com/office365security/wp-content/themes/microsoft/js/single.js?ver=02092017
Requested by
Host: blogs.technet.microsoft.com
URL: https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.38.58.129 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-38-58-129.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
8a123916a3f0aacb106e0596bbb5ddf2bf45dd2558632e4262ec7742b95778bf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
blogs.technet.microsoft.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Cookie
msdn-blogs-aad-state-parameter=764A90C5-ECF9-9184-90F0-62B7E71D1FAD
Connection
keep-alive
Cache-Control
no-cache
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Thu, 09 Feb 2017 09:01:37 GMT
ETag
"3c5851eb382d21:0"
Vary
Accept-Encoding
Content-Type
application/x-javascript
ARR-Disable-Session-Affinity
true
Cache-Control
max-age=3600
Date
Wed, 07 Nov 2018 13:46:56 GMT
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1347
X-XSS-Protection
1; mode=block
Request-Context
appId=cid-v1:1e40abc5-5fc0-4c08-939b-4be4566cca4b
ms-logo-gray.svg
blogs.technet.microsoft.com/office365security/wp-content/themes/microsoft/images/ 		3 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blogs.technet.microsoft.com/office365security/wp-content/themes/microsoft/images/ms-logo-gray.svg
Requested by
Host: blogs.technet.microsoft.com
URL: https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.38.58.129 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-38-58-129.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
7b792ad810340e788cfd38b7e249f51075445de7741815178e70bdb77f15491f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
blogs.technet.microsoft.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Cookie
msdn-blogs-aad-state-parameter=764A90C5-ECF9-9184-90F0-62B7E71D1FAD
Connection
keep-alive
Cache-Control
no-cache
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Sun, 27 Mar 2016 19:23:37 GMT
ETag
"808233295e88d11:0"
Vary
Accept-Encoding
Content-Type
image/svg+xml
ARR-Disable-Session-Affinity
true
Cache-Control
max-age=1832
Date
Wed, 07 Nov 2018 13:46:56 GMT
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1372
X-XSS-Protection
1; mode=block
Request-Context
appId=cid-v1:1e40abc5-5fc0-4c08-939b-4be4566cca4b
avatar.jpg
i1.social.s-msft.com/profile/u/ 		7 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i1.social.s-msft.com/profile/u/avatar.jpg?displayname=Alexs+Pena&size=extralarge&version=00000000-0000-0000-0000-000000000000
Requested by
Host: blogs.technet.microsoft.com
URL: https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.109.70.191 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a104-109-70-191.deploy.static.akamaitechnologies.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
38f07ce67b62c6903d96f11605ba9a114a981832504f3f32789933f8a525c853
Security Headers
Name Value
Strict-Transport-Security max-age=31536000, max-age=31536000
X-Frame-Options SAMEORIGIN

Request headers

Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000, max-age=31536000
X-AspNetMvc-Version
4.0
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
X-Frame-Options
SAMEORIGIN
x-STOBuild
ProfileWeb-4.9.0.0
Content-Type
image/jpg
Cache-Control
public, max-age=751162
Date
Wed, 07 Nov 2018 13:46:56 GMT
X-Instance
AZPROF02
Connection
keep-alive
Content-Length
7287
Expires
Fri, 16 Nov 2018 06:26:18 GMT
mscc-0.4.1.min.css
c.s-microsoft.com/mscc/statics/ 		1 KB
935 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://c.s-microsoft.com/mscc/statics/mscc-0.4.1.min.css?ver=4.9.7
Requested by
Host: blogs.technet.microsoft.com
URL: https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:29d::356e , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
35211f76c4c35c17f2649b96868c0d691f1d78b107f7635d22619948d0ee6880

Request headers

Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
date
Wed, 07 Nov 2018 13:46:56 GMT
content-encoding
gzip
last-modified
Mon, 10 Sep 2018 17:42:23 GMT
content-md5
2MKxgMQLzH/8vixotX2Pog==
status
200
etag
0x8D61744C3ED0073
vary
Accept-Encoding
access-control-allow-methods
GET,POST
content-type
text/css;charset=utf-8
access-control-allow-origin
*
x-ms-request-id
41fbeccf-901e-0090-7400-4a86d4000000
x-ms-version
2009-09-19
content-length
627
wp-ajax-response.min.js
blogs.technet.microsoft.com/office365security/wp-includes/js/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blogs.technet.microsoft.com/office365security/wp-includes/js/wp-ajax-response.min.js?ver=4.9.7
Requested by
Host: blogs.technet.microsoft.com
URL: https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.38.58.129 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-38-58-129.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
1e5097986115719df77c0785d6051ccacd78805b51008a82015d6ddc14318ee0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
blogs.technet.microsoft.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Cookie
msdn-blogs-aad-state-parameter=764A90C5-ECF9-9184-90F0-62B7E71D1FAD
Connection
keep-alive
Cache-Control
no-cache
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Mon, 06 Aug 2018 02:30:13 GMT
ETag
"d27576672d2dd41:0"
Vary
Accept-Encoding
Content-Type
application/x-javascript
ARR-Disable-Session-Affinity
true
Cache-Control
max-age=1926
Date
Wed, 07 Nov 2018 13:46:56 GMT
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1208
X-XSS-Protection
1; mode=block
Request-Context
appId=cid-v1:6bba0ebe-ac1f-40f1-a5fe-732db974adfb
msdn-delete-comment-script.js
blogs.technet.microsoft.com/office365security/wp-content/plugins/msdn-delete-comment/ 		587 B
963 B 		Script
General
Check archive.org
Download Go to
Full URL
https://blogs.technet.microsoft.com/office365security/wp-content/plugins/msdn-delete-comment/msdn-delete-comment-script.js?ver=20180311
Requested by
Host: blogs.technet.microsoft.com
URL: https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.38.58.129 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-38-58-129.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
f2806d0eadc9c15132144d7e7644623dcd7d7e783f62d0839fd7ab7d73580b78
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
blogs.technet.microsoft.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Cookie
msdn-blogs-aad-state-parameter=764A90C5-ECF9-9184-90F0-62B7E71D1FAD
Connection
keep-alive
Cache-Control
no-cache
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Wed, 28 Mar 2018 04:58:33 GMT
ETag
"12ab116c51c6d31:0"
Vary
Accept-Encoding
Content-Type
application/x-javascript
ARR-Disable-Session-Affinity
true
Cache-Control
max-age=1812
Date
Wed, 07 Nov 2018 13:46:56 GMT
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
408
X-XSS-Protection
1; mode=block
Request-Context
appId=cid-v1:6bba0ebe-ac1f-40f1-a5fe-732db974adfb
wds-ratings.js
blogs.technet.microsoft.com/office365security/wp-content/plugins/wds-ratings/ 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blogs.technet.microsoft.com/office365security/wp-content/plugins/wds-ratings/wds-ratings.js?ver=20161014
Requested by
Host: blogs.technet.microsoft.com
URL: https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.38.58.129 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-38-58-129.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
f018a202d8f9450d64a5ae50edbcfad11273d082c56ae47ae38d62866fa0ad26
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
blogs.technet.microsoft.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Cookie
msdn-blogs-aad-state-parameter=764A90C5-ECF9-9184-90F0-62B7E71D1FAD
Connection
keep-alive
Cache-Control
no-cache
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Thu, 08 Dec 2016 03:01:12 GMT
ETag
"04cfe54ff50d21:0"
Vary
Accept-Encoding
Content-Type
application/x-javascript
ARR-Disable-Session-Affinity
true
Cache-Control
max-age=1830
Date
Wed, 07 Nov 2018 13:46:56 GMT
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1899
X-XSS-Protection
1; mode=block
Request-Context
appId=cid-v1:1e40abc5-5fc0-4c08-939b-4be4566cca4b
jquery-migrate.min.js
blogs.technet.microsoft.com/office365security/wp-includes/js/jquery/ 		10 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blogs.technet.microsoft.com/office365security/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1
Requested by
Host: blogs.technet.microsoft.com
URL: https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.38.58.129 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-38-58-129.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
ef0968035e387c8b468f4a943a9b5998d159c9e2f1a4994c70aa86bf53a9316d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
blogs.technet.microsoft.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Cookie
msdn-blogs-aad-state-parameter=764A90C5-ECF9-9184-90F0-62B7E71D1FAD
Connection
keep-alive
Cache-Control
no-cache
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Thu, 08 Sep 2016 12:55:21 GMT
ETag
"80c2dc41d09d21:0"
Vary
Accept-Encoding
Content-Type
application/x-javascript
ARR-Disable-Session-Affinity
true
Cache-Control
max-age=1867
Date
Wed, 07 Nov 2018 13:46:56 GMT
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4027
X-XSS-Protection
1; mode=block
Request-Context
appId=cid-v1:6bba0ebe-ac1f-40f1-a5fe-732db974adfb
theme-merged.js
blogs.technet.microsoft.com/office365security/wp-content/themes/microsoft/js/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blogs.technet.microsoft.com/office365security/wp-content/themes/microsoft/js/theme-merged.js?ver=02092017
Requested by
Host: blogs.technet.microsoft.com
URL: https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.38.58.129 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-38-58-129.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
a1cdba769e59384c6667b947dc33981e066fbb9a9f02b2ca7feaa534fdd8de63
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
blogs.technet.microsoft.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Cookie
msdn-blogs-aad-state-parameter=764A90C5-ECF9-9184-90F0-62B7E71D1FAD
Connection
keep-alive
Cache-Control
no-cache
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Thu, 08 Dec 2016 03:01:13 GMT
ETag
"80e29655ff50d21:0"
Vary
Accept-Encoding
Content-Type
application/x-javascript
ARR-Disable-Session-Affinity
true
Cache-Control
max-age=1856
Date
Wed, 07 Nov 2018 13:46:56 GMT
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1064
X-XSS-Protection
1; mode=block
Request-Context
appId=cid-v1:1e40abc5-5fc0-4c08-939b-4be4566cca4b
wp-embed.min.js
blogs.technet.microsoft.com/office365security/wp-includes/js/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blogs.technet.microsoft.com/office365security/wp-includes/js/wp-embed.min.js?ver=4.9.7
Requested by
Host: blogs.technet.microsoft.com
URL: https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.38.58.129 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-38-58-129.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
dcb5e540e62fc85857254a1066afb6a7e8999279c6d4c583eef855d39f9289c0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
blogs.technet.microsoft.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Cookie
msdn-blogs-aad-state-parameter=764A90C5-ECF9-9184-90F0-62B7E71D1FAD
Connection
keep-alive
Cache-Control
no-cache
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Wed, 31 May 2017 03:23:27 GMT
ETag
"18dcbe44bdd9d21:0"
Vary
Accept-Encoding
Content-Type
application/x-javascript
ARR-Disable-Session-Affinity
true
Date
Wed, 07 Nov 2018 13:46:56 GMT
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
958
X-XSS-Protection
1; mode=block
Request-Context
appId=cid-v1:1e40abc5-5fc0-4c08-939b-4be4566cca4b
mscc-0.4.1.min.js
c.s-microsoft.com/mscc/statics/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c.s-microsoft.com/mscc/statics/mscc-0.4.1.min.js?ver=4.9.7
Requested by
Host: blogs.technet.microsoft.com
URL: https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:29d::356e , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
c87516d7dd7077edd467f5b7b085b035cd4803ecf049670ab19de004e270aba8

Request headers

Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
date
Wed, 07 Nov 2018 13:46:56 GMT
content-encoding
gzip
last-modified
Mon, 10 Sep 2018 17:42:12 GMT
content-md5
XpofSqMdSqYPb4maLkXO+A==
status
200
etag
0x8D61744BD6EA9B6
vary
Accept-Encoding
access-control-allow-methods
GET,POST
content-type
text/javascript;charset=utf-8
access-control-allow-origin
*
x-ms-request-id
071f608d-d01e-00d8-7c00-4ab449000000
x-ms-version
2009-09-19
content-length
1588
eucookielaw-searchbox-script.js
blogs.technet.microsoft.com/office365security/wp-content/plugins/eu-cookie-law/ 		150 B
772 B 		Script
General
Check archive.org
Download Go to
Full URL
https://blogs.technet.microsoft.com/office365security/wp-content/plugins/eu-cookie-law/eucookielaw-searchbox-script.js?ver=4.9.7
Requested by
Host: blogs.technet.microsoft.com
URL: https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.38.58.129 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-38-58-129.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
948885fd3be45fdb44b12f9e067f7d4a63ca93346323114ddbeed1b351f18a17
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
blogs.technet.microsoft.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Cookie
msdn-blogs-aad-state-parameter=764A90C5-ECF9-9184-90F0-62B7E71D1FAD
Connection
keep-alive
Cache-Control
no-cache
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Wed, 27 Sep 2017 10:36:31 GMT
ETag
"c667e07b7c37d31:0"
Vary
Accept-Encoding
Content-Type
application/x-javascript
ARR-Disable-Session-Affinity
true
Cache-Control
max-age=3600
Date
Wed, 07 Nov 2018 13:46:56 GMT
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
217
X-XSS-Protection
1; mode=block
Request-Context
appId=cid-v1:1e40abc5-5fc0-4c08-939b-4be4566cca4b
jquery.cookie.js
blogs.technet.microsoft.com/office365security/wp-content/themes/microsoft/js/vendor/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blogs.technet.microsoft.com/office365security/wp-content/themes/microsoft/js/vendor/jquery.cookie.js?ver=11092015
Requested by
Host: blogs.technet.microsoft.com
URL: https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.38.58.129 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-38-58-129.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
afd6a5f6de40e9e67b55ff6afec66fff4827e775c996ab80c9e964a872a92523
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
blogs.technet.microsoft.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Cookie
msdn-blogs-aad-state-parameter=764A90C5-ECF9-9184-90F0-62B7E71D1FAD
Connection
keep-alive
Cache-Control
no-cache
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Thu, 08 Sep 2016 13:03:49 GMT
ETag
"8068a770d19d21:0"
Vary
Accept-Encoding
Content-Type
application/x-javascript
ARR-Disable-Session-Affinity
true
Cache-Control
max-age=1822
Date
Wed, 07 Nov 2018 13:46:56 GMT
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1378
X-XSS-Protection
1; mode=block
Request-Context
appId=cid-v1:6bba0ebe-ac1f-40f1-a5fe-732db974adfb
wp-emoji-release.min.js
blogs.technet.microsoft.com/office365security/wp-includes/js/ 		11 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blogs.technet.microsoft.com/office365security/wp-includes/js/wp-emoji-release.min.js?ver=4.9.7
Requested by
Host: blogs.technet.microsoft.com
URL: https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.38.58.129 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-38-58-129.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
eeef2d5701f6af83f9d05441dee48e36e40ba7c814bd89658f6b4d79bf411b51
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
blogs.technet.microsoft.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Cookie
msdn-blogs-aad-state-parameter=764A90C5-ECF9-9184-90F0-62B7E71D1FAD
Connection
keep-alive
Cache-Control
no-cache
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Mon, 06 Aug 2018 02:30:13 GMT
ETag
"80e845672d2dd41:0"
Vary
Accept-Encoding
Content-Type
application/x-javascript
ARR-Disable-Session-Affinity
true
Cache-Control
max-age=1923
Date
Wed, 07 Nov 2018 13:46:56 GMT
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
4208
X-XSS-Protection
1; mode=block
Request-Context
appId=cid-v1:6bba0ebe-ac1f-40f1-a5fe-732db974adfb
icon-linkedin-single.png
blogs.technet.microsoft.com/office365security/wp-content/themes/microsoft/images/ 		684 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blogs.technet.microsoft.com/office365security/wp-content/themes/microsoft/images/icon-linkedin-single.png
Requested by
Host: blogs.technet.microsoft.com
URL: https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.38.58.129 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-38-58-129.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
f52b52d42747c49bc421748e9092ee83f5bef1566aaeb58391cf3b61b8c9425d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
blogs.technet.microsoft.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://blogs.technet.microsoft.com/office365security/wp-content/themes/microsoft/style.css?ver=02092017
Cookie
msdn-blogs-aad-state-parameter=764A90C5-ECF9-9184-90F0-62B7E71D1FAD
Connection
keep-alive
Cache-Control
no-cache
Referer
https://blogs.technet.microsoft.com/office365security/wp-content/themes/microsoft/style.css?ver=02092017
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Sun, 27 Mar 2016 19:23:37 GMT
ETag
"593b8f295e88d11:0"
Content-Type
image/png
ARR-Disable-Session-Affinity
true
Cache-Control
max-age=3571
Date
Wed, 07 Nov 2018 13:46:56 GMT
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
684
X-XSS-Protection
1; mode=block
Request-Context
appId=cid-v1:1e40abc5-5fc0-4c08-939b-4be4566cca4b
icon-twitter-single.png
blogs.technet.microsoft.com/office365security/wp-content/themes/microsoft/images/ 		1013 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://blogs.technet.microsoft.com/office365security/wp-content/themes/microsoft/images/icon-twitter-single.png
Requested by
Host: blogs.technet.microsoft.com
URL: https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.38.58.129 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-38-58-129.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
bbd79bb1ece7335a4b3cc8a59abe0d7792e449422a850e314992794da63c6b5e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
blogs.technet.microsoft.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://blogs.technet.microsoft.com/office365security/wp-content/themes/microsoft/style.css?ver=02092017
Cookie
msdn-blogs-aad-state-parameter=764A90C5-ECF9-9184-90F0-62B7E71D1FAD
Connection
keep-alive
Cache-Control
no-cache
Referer
https://blogs.technet.microsoft.com/office365security/wp-content/themes/microsoft/style.css?ver=02092017
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Content-Type-Options
nosniff
Last-Modified
Tue, 12 Jul 2016 03:45:15 GMT
ETag
"e59ad3ccefdbd11:0"
Content-Type
image/png
ARR-Disable-Session-Affinity
true
Cache-Control
max-age=3578
Date
Wed, 07 Nov 2018 13:46:57 GMT
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1013
X-XSS-Protection
1; mode=block
Request-Context
appId=cid-v1:1e40abc5-5fc0-4c08-939b-4be4566cca4b
glyphicons-halflings-regular.woff2
ajax.aspnetcdn.com/ajax/bootstrap/3.3.5/fonts/ 		18 KB
18 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://ajax.aspnetcdn.com/ajax/bootstrap/3.3.5/fonts/glyphicons-halflings-regular.woff2
Requested by
Host: blogs.technet.microsoft.com
URL: https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
152.199.19.160 Ashburn, United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8FDE) /
Resource Hash
fe185d11a49676890d47bb783312a0cda5a44c4039214094e7957b4c040ef11c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://ajax.aspnetcdn.com/ajax/bootstrap/3.3.5/css/bootstrap.min.css
Origin
https://blogs.technet.microsoft.com

Response headers

date
Wed, 07 Nov 2018 13:46:56 GMT
x-content-type-options
nosniff
last-modified
Mon, 31 Oct 2016 23:10:15 GMT
server
ECAcc (frc/8FDE)
etag
"14dbe1f0cb33d21:0"
status
200
x-cache
HIT
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public,max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
content-length
18028
x-xss-protection
1; mode=block
_log
uhf.microsoft.com/ 		0
130 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://uhf.microsoft.com/_log?o=mscc&s=uhf-TechNetBlogs&m=show&nv=aspnet-3.1.3&sv=0.1.2
Requested by
Host: blogs.technet.microsoft.com
URL: https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:299::2b57 , European Union, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

:path
/_log?o=mscc&s=uhf-TechNetBlogs&m=show&nv=aspnet-3.1.3&sv=0.1.2
pragma
no-cache
accept-encoding
gzip, deflate
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
image/webp,image/apng,image/*,*/*;q=0.8
cache-control
no-cache
:authority
uhf.microsoft.com
referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
:scheme
https
:method
GET
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 07 Nov 2018 13:46:56 GMT
status
204
content-type
text/html
access-control-allow-origin
*
cache-control
max-age=0, no-cache, no-store
content-length
0
expires
Wed, 07 Nov 2018 13:46:56 GMT
analytics.js
www.google-analytics.com/ 		42 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: blogs.technet.microsoft.com
URL: https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:814::200e , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8cb05b675fe6419a9e91eb587c60902c7ed1cb6c42b8cff8ce404ef89f635cde
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Thu, 11 Oct 2018 19:41:26 GMT
server
Golfe2
age
4658
date
Wed, 07 Nov 2018 12:29:19 GMT
vary
Accept-Encoding
content-type
text/javascript
status
200
cache-control
public, max-age=7200
timing-allow-origin
*
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
17301
expires
Wed, 07 Nov 2018 14:29:19 GMT
social-counts.js
blogs.technet.microsoft.com/office365security/wp-content/themes/microsoft/js/ 		2 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://blogs.technet.microsoft.com/office365security/wp-content/themes/microsoft/js/social-counts.js?ver=02092017&_=1541598416349
Requested by
Host: ajax.aspnetcdn.com
URL: https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.12.1.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.38.58.129 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-38-58-129.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
54bca7687d2f7bae08bfc3fb793cb490dcd35972ad3d1f52423879781bb5f495
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
blogs.technet.microsoft.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
X-Requested-With
XMLHttpRequest
Cookie
msdn-blogs-aad-state-parameter=764A90C5-ECF9-9184-90F0-62B7E71D1FAD
Connection
keep-alive
Cache-Control
no-cache
Accept
text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Thu, 18 Oct 2018 10:27:18 GMT
ETag
"d156325cd66d41:0"
Vary
Accept-Encoding
Content-Type
application/x-javascript
ARR-Disable-Session-Affinity
true
Cache-Control
max-age=3549
Date
Wed, 07 Nov 2018 13:46:57 GMT
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
926
X-XSS-Protection
1; mode=block
Request-Context
appId=cid-v1:6bba0ebe-ac1f-40f1-a5fe-732db974adfb
truncated
/ 		43 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/gif
jsll-4.2.1.js
az725175.vo.msecnd.net/scripts/ 		51 KB
51 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://az725175.vo.msecnd.net/scripts/jsll-4.2.1.js
Requested by
Host: blogs.technet.microsoft.com
URL: https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
152.199.19.160 Ashburn, United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
951a3d1ea6a1b8204d22b854bf1742cf2400d5a7497871d16aa4ba48679475f4

Request headers

Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
date
Wed, 07 Nov 2018 13:46:56 GMT
last-modified
Mon, 28 Aug 2017 17:41:46 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
content-md5
+OEHkaQ5bQMFp4RRA9gqzQ==
etag
0x8D4EE3C0DEBA235
content-type
application/javascript
status
200
x-ms-request-id
732b9a93-601e-0053-74a0-76d324000000
cache-control
no-cache, no-store
x-ms-version
2009-09-19
content-length
52096
style.css
blogs.technet.microsoft.com/office365security/wp-content/plugins/simple-follow-me-social-buttons-widget/assets/css/ 		1 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blogs.technet.microsoft.com/office365security/wp-content/plugins/simple-follow-me-social-buttons-widget/assets/css/style.css?ver=3.3.3
Requested by
Host: blogs.technet.microsoft.com
URL: https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.38.58.129 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-38-58-129.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
92b3c670560875788326a1d050b150a712cd8a8cb5a9f5bd5fdc6734f0862159
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
blogs.technet.microsoft.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Cookie
msdn-blogs-aad-state-parameter=764A90C5-ECF9-9184-90F0-62B7E71D1FAD
Connection
keep-alive
Cache-Control
no-cache
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Thu, 08 Sep 2016 13:03:05 GMT
ETag
"6eb4f456d19d21:0"
Vary
Accept-Encoding
Content-Type
text/css
ARR-Disable-Session-Affinity
true
Cache-Control
max-age=3567
Date
Wed, 07 Nov 2018 13:46:57 GMT
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
560
X-XSS-Protection
1; mode=block
Request-Context
appId=cid-v1:6bba0ebe-ac1f-40f1-a5fe-732db974adfb
icons.css
blogs.technet.microsoft.com/office365security/wp-content/plugins/simple-follow-me-social-buttons-widget/assets/css/ 		159 KB
67 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://blogs.technet.microsoft.com/office365security/wp-content/plugins/simple-follow-me-social-buttons-widget/assets/css/icons.css?ver=3.3.3
Requested by
Host: blogs.technet.microsoft.com
URL: https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.38.58.129 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-38-58-129.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
14dd9b95176e30bce293e3b1022d6caa9b4f29df9ad504a120d491929d2f9190
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
blogs.technet.microsoft.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Cookie
msdn-blogs-aad-state-parameter=764A90C5-ECF9-9184-90F0-62B7E71D1FAD
Connection
keep-alive
Cache-Control
no-cache
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Thu, 08 Sep 2016 13:03:05 GMT
ETag
"808a6d56d19d21:0"
Vary
Accept-Encoding
Content-Type
text/css
ARR-Disable-Session-Affinity
true
Cache-Control
max-age=3583
Date
Wed, 07 Nov 2018 13:46:57 GMT
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
68370
X-XSS-Protection
1; mode=block
Request-Context
appId=cid-v1:6bba0ebe-ac1f-40f1-a5fe-732db974adfb
front-widget.js
blogs.technet.microsoft.com/office365security/wp-content/plugins/simple-follow-me-social-buttons-widget/assets/js/ 		747 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://blogs.technet.microsoft.com/office365security/wp-content/plugins/simple-follow-me-social-buttons-widget/assets/js/front-widget.js?ver=3.3.3
Requested by
Host: blogs.technet.microsoft.com
URL: https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.38.58.129 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-38-58-129.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
d5980219c23ab42185467a6a8fc7209f24b7be33c585a06a777ec885c91cbd34
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
blogs.technet.microsoft.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Cookie
msdn-blogs-aad-state-parameter=764A90C5-ECF9-9184-90F0-62B7E71D1FAD
Connection
keep-alive
Cache-Control
no-cache
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Last-Modified
Thu, 08 Sep 2016 13:03:05 GMT
ETag
"f3bf057d19d21:0"
Vary
Accept-Encoding
Content-Type
application/x-javascript
ARR-Disable-Session-Affinity
true
Cache-Control
max-age=3569
Date
Wed, 07 Nov 2018 13:46:57 GMT
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
492
X-XSS-Protection
1; mode=block
Request-Context
appId=cid-v1:6bba0ebe-ac1f-40f1-a5fe-732db974adfb
admin-ajax.php
blogs.technet.microsoft.com/office365security/wp-admin/ 		47 B
586 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://blogs.technet.microsoft.com/office365security/wp-admin/admin-ajax.php?action=track_page_view&track_page_view_post_id=61&track_page_view_blog_id=124252&track_page_view_post_url=https%3A%2F%2Fblogs.technet.microsoft.com%2Foffice365security%2Fhow-to-fix-a-compromised-hacked-microsoft-office-365-account%2F&timestamp=1541598417127
Requested by
Host: ajax.aspnetcdn.com
URL: https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.12.1.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.38.58.129 Amsterdam, Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
a23-38-58-129.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
a2111022ce52c2766e27fb961024696e0518a8b66ca1eaa50eb7ff0c83714327
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff nosniff
X-Xss-Protection 1; mode=block

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
blogs.technet.microsoft.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
X-Requested-With
XMLHttpRequest
Cookie
msdn-blogs-aad-state-parameter=764A90C5-ECF9-9184-90F0-62B7E71D1FAD
Connection
keep-alive
Cache-Control
no-cache
Accept
*/*
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
X-Content-Type-Options
nosniff nosniff
Cache-Control
no-cache, must-revalidate, max-age=0
Date
Wed, 07 Nov 2018 13:46:58 GMT
Content-Type
text/html; charset=UTF-8
Request-Context
appId=cid-v1:1e40abc5-5fc0-4c08-939b-4be4566cca4b
ARR-Disable-Session-Affinity
true
Connection
keep-alive
X-Robots-Tag
noindex
Content-Length
47
X-XSS-Protection
1; mode=block
Expires
Wed, 11 Jan 1984 05:00:00 GMT
gtm.js
www.googletagmanager.com/ 		77 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-PLR87W
Requested by
Host: blogs.technet.microsoft.com
URL: https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a00:1450:4001:814::2008 , Ireland, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Google Tag Manager (scaffolding) /
Resource Hash
7091e4b46a43a6d54a5dd3817a8dbe73ed805e70b8f63099cbd070a92eeef930
Security Headers
Name Value
X-Xss-Protection 1; mode=block

Request headers

Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 07 Nov 2018 13:46:57 GMT
content-encoding
gzip
server
Google Tag Manager (scaffolding)
access-control-allow-headers
Cache-Control
status
200
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
http://www.googletagmanager.com
cache-control
private, max-age=900
access-control-allow-credentials
true
alt-svc
quic=":443"; ma=2592000; v="44,43,39,35"
content-length
27406
x-xss-protection
1; mode=block
expires
Wed, 07 Nov 2018 13:46:57 GMT
jquery.tmpl.min.js
ajax.aspnetcdn.com/ajax/jquery.templates/beta1/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ajax.aspnetcdn.com/ajax/jquery.templates/beta1/jquery.tmpl.min.js
Requested by
Host: blogs.technet.microsoft.com
URL: https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
152.199.19.160 Ashburn, United States, ASN15133 (EDGECAST - MCI Communications Services, Inc. d/b/a Verizon Business, US),
Reverse DNS
Software
ECAcc (frc/8FAA) /
Resource Hash
dfee1fe127c3a828a6f88e3ef6e8d1d7f8a3750e6f9d9e24520992a2294696a6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 07 Nov 2018 13:46:57 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-cache
HIT
status
200
content-length
2679
x-xss-protection
1; mode=block
last-modified
Mon, 31 Oct 2016 23:13:49 GMT
server
ECAcc (frc/8FAA)
etag
"80f4d86fcc33d21:0"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
public,max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
UnifiedBaseballCard.css
widgets.services.microsoft.com/v1/ 		18 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://widgets.services.microsoft.com/v1/UnifiedBaseballCard.css?brand=msdn&lang=en&ver=4.9.0.0
Requested by
Host: blogs.technet.microsoft.com
URL: https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.241.149 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-241-149.deploy.static.akamaitechnologies.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
8616a6a802b821ff122632de5c48fe0af6702f9ee3e58915b7fb5a3f564f02a0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000 max-age=31536000

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
widgets.services.microsoft.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000 max-age=31536000
Content-Encoding
gzip
X-AspNetMvc-Version
3.0
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
x-STOBuild
STO-4.9.0.0
Content-Type
text/css; charset=utf-8
Cache-Control
public, max-age=1002535
Date
Wed, 07 Nov 2018 13:46:57 GMT
X-Instance
AZPROF03
Connection
keep-alive
Content-Length
2266
usercard.css
widgets.services.microsoft.com/v1/ 		15 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://widgets.services.microsoft.com/v1/usercard.css?brand=msdn&lang=en&ver=4.9.0.0
Requested by
Host: blogs.technet.microsoft.com
URL: https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.241.149 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-241-149.deploy.static.akamaitechnologies.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
6b8ddede06bdc01cd08aa3e1911ceee93799fec29e950d1e20e8a577980564c3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000 max-age=31536000

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
widgets.services.microsoft.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
text/css,*/*;q=0.1
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000 max-age=31536000
Content-Encoding
gzip
X-AspNetMvc-Version
3.0
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
x-STOBuild
STO-4.9.0.0
Content-Type
text/css; charset=utf-8
Cache-Control
public, max-age=1002637
Date
Wed, 07 Nov 2018 13:46:57 GMT
X-Instance
AZPROF02
Connection
keep-alive
Content-Length
2436
jquery.timeago.js
widgets.services.microsoft.com/v1/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://widgets.services.microsoft.com/v1/jquery.timeago.js?brand=msdn&lang=en&ver=4.9.0.0
Requested by
Host: blogs.technet.microsoft.com
URL: https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.241.149 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-241-149.deploy.static.akamaitechnologies.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
fccf44335a2bf44e7be1ebf6aeaa54f8709b54e74eddd802428246ab1273a7f4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
widgets.services.microsoft.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 07 Nov 2018 13:46:57 GMT
Content-Encoding
gzip
X-AspNetMvc-Version
3.0
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
x-STOBuild
STO-4.9.0.0
Content-Type
application/x-javascript; charset=utf-8
Cache-Control
public, max-age=1002623
X-Instance
AZPROF01
Connection
keep-alive
Strict-Transport-Security
max-age=31536000
Content-Length
1545
jquery.textfill.js
widgets.services.microsoft.com/v1/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://widgets.services.microsoft.com/v1/jquery.textfill.js?brand=msdn&lang=en&ver=4.9.0.0
Requested by
Host: blogs.technet.microsoft.com
URL: https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.241.149 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-241-149.deploy.static.akamaitechnologies.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
ce8acd69ef20108b465e5f75f70161f383c58c0ff341b64e03ab60b20790c682
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
widgets.services.microsoft.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Date
Wed, 07 Nov 2018 13:46:57 GMT
Content-Encoding
gzip
X-AspNetMvc-Version
3.0
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
x-STOBuild
STO-4.9.0.0
Content-Type
application/x-javascript; charset=utf-8
Cache-Control
public, max-age=1002623
X-Instance
AZPROF01
Connection
keep-alive
Strict-Transport-Security
max-age=31536000
Content-Length
792
widgets.js
widgets.services.microsoft.com/v1/ 		41 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://widgets.services.microsoft.com/v1/widgets.js?brand=msdn&lang=en&ver=4.9.0.0
Requested by
Host: blogs.technet.microsoft.com
URL: https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.241.149 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-241-149.deploy.static.akamaitechnologies.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
613b0f55a429e24f6e3c2016cb66ee82e964f6e8a1c0d0b28ada8d5973b64d2b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000 max-age=31536000

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
widgets.services.microsoft.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000 max-age=31536000
Content-Encoding
gzip
X-AspNetMvc-Version
3.0
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
x-STOBuild
STO-4.9.0.0
Content-Type
application/x-javascript; charset=utf-8
Cache-Control
public, max-age=1002809
Date
Wed, 07 Nov 2018 13:46:57 GMT
X-Instance
AZPROF04
Connection
keep-alive
Content-Length
9377
/
widgets.services.microsoft.com/v1/user/usercard/ 		3 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://widgets.services.microsoft.com/v1/user/usercard/?id=7010a2a88c884b99a1c5e0412c7b0c26&lang=en-US&brand=msdn&callback=jsonp_loadUserData0
Requested by
Host: ajax.aspnetcdn.com
URL: https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.12.1.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.241.149 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-241-149.deploy.static.akamaitechnologies.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
c853dc7e8637ab2cccb45e4feee716ea1d945d100eb740c260dea70b6fe8178d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
widgets.services.microsoft.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 07 Nov 2018 13:46:57 GMT
X-AspNetMvc-Version
3.0
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Strict-Transport-Security
max-age=31536000
x-STOBuild
STO-4.9.0.0
Content-Type
application/json; charset=utf-8
x-ms-request-id
bc1cce83-a4d8-48d4-9d61-8cc2f5c74162
Cache-Control
max-age=0, no-cache, no-store
X-Instance
AZPROF02
Connection
keep-alive
Content-Length
2642
Expires
Wed, 07 Nov 2018 13:46:57 GMT
truncated
/ 		43 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
e7939a03248bb3f75e2f12226871e6e304b0c1e1fa506f3871548547cf24f32d

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/gif
widget.png
widgets.services.microsoft.com/v1/resources/ 		995 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://widgets.services.microsoft.com/v1/resources/widget.png?v=4.9.0.0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.241.149 Amsterdam, Netherlands, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-111-241-149.deploy.static.akamaitechnologies.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
c6db06c2bf508c9f782bc6fde4e52790de584dcc08eca9c873de779a9ea51a32
Security Headers
Name Value
Strict-Transport-Security max-age=31536000 max-age=31536000 max-age=31536000

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
widgets.services.microsoft.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
image/webp,image/apng,image/*,*/*;q=0.8
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000 max-age=31536000 max-age=31536000
Last-Modified
Mon, 23 Jan 2017 00:33:38 GMT
Server
Microsoft-IIS/10.0
X-Powered-By
ASP.NET
ETag
"09d99561075d21:0"
Content-Type
image/png
Cache-Control
public, max-age=1002365
Date
Wed, 07 Nov 2018 13:46:57 GMT
X-Instance
AZPROF03
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
995
sdk.js
connect.facebook.net/en_GB/ 		194 KB
195 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_GB/sdk.js
Requested by
Host: blogs.technet.microsoft.com
URL: https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Protocol
SPDY
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a03:2880:f01c:216:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
597345e93b0ede028a1ebe3f5841552da0f71adeb115f0690f886f4529601ad9
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' *.atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* *.atlassolutions.com attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' *.atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* *.atlassolutions.com attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
x-content-type-options
nosniff
content-md5
E1+y8FpLKqU06liflm/drA==
status
200
content-length
198918
x-xss-protection
0
x-fb-debug
IXuTWZQA5VepbCD8T2loDGFOeH2VP/1o1e8QB5hKZw8uP5DR9WhDslCue1dR5xm0HoJf//XALSm+Z4gOLW2yJQ==
x-fb-content-md5
135fb2f05a4b2aa534ea589f966fddac
date
Wed, 07 Nov 2018 13:46:57 GMT
x-frame-options
DENY
content-type
application/x-javascript; charset=utf-8
access-control-expose-headers
X-FB-Content-MD5
cache-control
public,max-age=1200,stale-while-revalidate=3600
etag
"565b8984d49347cb88b14823697b0789"
timing-allow-origin
*
expires
Wed, 07 Nov 2018 13:58:09 GMT
count.json
public.newsharecounts.com/ 		0
0
share
www.linkedin.com/countserv/count/ 		213 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.linkedin.com/countserv/count/share?format=jsonp&url=https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/&callback=jQuery112106268580393161125_1541598416350&_=1541598416351
Requested by
Host: ajax.aspnetcdn.com
URL: https://ajax.aspnetcdn.com/ajax/jQuery/jquery-1.12.1.min.js
Protocol
SPDY
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:109:c00c:104::b93f:9001 , United States, ASN14413 (LINKEDIN - LinkedIn Corporation, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
8e7ae72014c8049890cf8e11ebc7d320c5cc51919c8aeb31fe2a41b42a8f9502
Security Headers
Name Value
Content-Security-Policy default-src *; connect-src 'self' static.licdn.com media.licdn.com static-exp1.licdn.com static-exp2.licdn.com media-exp1.licdn.com media-exp2.licdn.com https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' platform.linkedin.com spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l
Strict-Transport-Security max-age=2592000
X-Content-Type-Options nosniff
X-Frame-Options sameorigin
X-Xss-Protection 1; mode=block

Request headers

Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

date
Wed, 07 Nov 2018 13:46:56 GMT
content-encoding
gzip
x-content-type-options
nosniff
status
200
vary
Accept-Encoding
x-li-uuid
Oe/MxpfbZBVg1iJOrCoAAA==
server
Apache-Coyote/1.1
pragma
no-cache
x-li-pop
prod-tln1
x-frame-options
sameorigin
strict-transport-security
max-age=2592000
content-type
text/javascript;charset=UTF-8
x-xss-protection
1; mode=block
cache-control
no-cache, no-store
content-security-policy
default-src *; connect-src 'self' static.licdn.com media.licdn.com static-exp1.licdn.com static-exp2.licdn.com media-exp1.licdn.com media-exp2.licdn.com https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' platform.linkedin.com spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'; report-uri https://www.linkedin.com/platform-telemetry/csp?f=l
x-li-proto
http/2
x-li-fabric
prod-lor1
expires
Thu, 01 Jan 1970 00:00:00 GMT
Cookie set t.js
web.vortex.data.microsoft.com/collect/v1/ 		260 B
909 B 		Script
General
Check archive.org
Download Go to
Full URL
https://web.vortex.data.microsoft.com/collect/v1/t.js?ver=%272.1%27&name=%27Ms.Webi.PageView%27&time=%272018-11-07T13%3A46%3A57.338Z%27&os=%27MacOS%27&appId=%27JS%3Ablogstechnet%27&-ver=%271.0%27&-impressionGuid=%27bc9eba16-0c62-4639-ab10-e0c15138e713%27&-pageName=%27how-to-fix-a-compromised-hacked-microsoft-office-365-account%27&-uri=%27https%3A%2F%2Fblogs.technet.microsoft.com%2Foffice365security%2Fhow-to-fix-a-compromised-hacked-microsoft-office-365-account%2F%27&-resHeight=1200&-resWidth=1600&-pageTags=%27%7B%22metaTags%22%3A%7B%7D%7D%27&-behavior=0&*baseType=%27Ms.Content.PageView%27&*cookieEnabled=true&*isJs=true&*title=%27How%20to%20fix%20a%20compromised%20(hacked)%20Microsoft%20Office%20365%20account%20%E2%80%93%20Securing%20Office%20365%27&*isLoggedIn=false&*flashInstalled=false&ext-javascript-ver=%271.1%27&ext-javascript-libVer=%274.2.1%27&ext-javascript-domain=%27blogs.technet.microsoft.com%27&ext-javascript-userConsent=false&$mscomCookies=false
Requested by
Host: az725175.vo.msecnd.net
URL: https://az725175.vo.msecnd.net/scripts/jsll-4.2.1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
40.77.226.250 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
e5e38918af810f5224da75f5b5bccdd5a6ce9c05bc7bcef6af2a7e09f1ee7b68
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Pragma
no-cache
Accept-Encoding
gzip, deflate
Host
web.vortex.data.microsoft.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Accept
*/*
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Connection
keep-alive
Cache-Control
no-cache
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 07 Nov 2018 13:46:56 GMT
X-Content-Type-Options
nosniff
P3P
CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
Cache-Control
no-cache, no-store
Set-Cookie
MC1=GUID=ed093827e96a4ee0a38209655b50709d&HASH=ed09&LV=201811&V=4&LU=1541598417513; Domain=.microsoft.com; Expires=Thu, 07 Nov 2019 13:46:57 GMT; Path=/ MS0=e4a3fafc45374e2c9a9c20706e3d357c; Domain=.microsoft.com; Expires=Wed, 07 Nov 2018 14:16:57 GMT; Path=/
MS-CV
MK8+0elem0ive5VB+kWWzw.0
Content-Type
application/javascript
Content-Length
260
Expires
0
truncated
/ 		56 KB
0 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
905a631ed546f0ec9b73469fa887519aaf9072e1cda2667f8f1fa03e921ac5ff

Request headers

User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Origin
https://blogs.technet.microsoft.com

Response headers

Access-Control-Allow-Origin
*
Content-Type
application/x-font-ttf;charset=utf-8
__Bz3h5RzMx.js
staticxx.facebook.com/connect/xd_arbiter/r/ Frame 2321 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://staticxx.facebook.com/connect/xd_arbiter/r/__Bz3h5RzMx.js?version=42
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_GB/sdk.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a03:2880:f01c:216:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
staticxx.facebook.com
:scheme
https
:path
/connect/xd_arbiter/r/__Bz3h5RzMx.js?version=42
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
accept-encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/

Response headers

status
200
expires
Tue, 29 Oct 2019 14:02:41 GMT
cache-control
public,max-age=31536000,immutable
x-xss-protection
0
strict-transport-security
max-age=15552000; preload
content-type
text/html; charset=utf-8
x-content-type-options
nosniff
vary
Accept-Encoding
content-encoding
gzip
x-fb-debug
NjAlVRlZnuOgwnYPQ//FolyAj2ihOOPccH13ZhR6hofIkv/riM70hdC1xJJj3I37FQSS1aKOheXHJeXk4ZvxCA==
content-length
12702
date
Wed, 07 Nov 2018 13:46:57 GMT
share_button.php
www.facebook.com/v2.8/plugins/ Frame 79AE 		0
0 		Document
General
Check archive.org
Download Go to
Full URL
https://www.facebook.com/v2.8/plugins/share_button.php?app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter%2Fr%2F__Bz3h5RzMx.js%3Fversion%3D42%23cb%3Df326839318d9d7c%26domain%3Dblogs.technet.microsoft.com%26origin%3Dhttps%253A%252F%252Fblogs.technet.microsoft.com%252Ff166fac6b08e38%26relation%3Dparent.parent&container_width=77&href=https%3A%2F%2Fblogs.technet.microsoft.com%2Foffice365security%2Fhow-to-fix-a-compromised-hacked-microsoft-office-365-account%2F&layout=button_count&locale=en_GB&mobile_iframe=true&sdk=joey&size=large
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_GB/sdk.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a03:2880:f11c:8083:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' *.atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* *.atlassolutions.com attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
www.facebook.com
:scheme
https
:path
/v2.8/plugins/share_button.php?app_id=&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fconnect%2Fxd_arbiter%2Fr%2F__Bz3h5RzMx.js%3Fversion%3D42%23cb%3Df326839318d9d7c%26domain%3Dblogs.technet.microsoft.com%26origin%3Dhttps%253A%252F%252Fblogs.technet.microsoft.com%252Ff166fac6b08e38%26relation%3Dparent.parent&container_width=77&href=https%3A%2F%2Fblogs.technet.microsoft.com%2Foffice365security%2Fhow-to-fix-a-compromised-hacked-microsoft-office-365-account%2F&layout=button_count&locale=en_GB&mobile_iframe=true&sdk=joey&size=large
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
accept-encoding
gzip, deflate
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/

Response headers

status
200
expires
Sat, 01 Jan 2000 00:00:00 GMT
facebook-api-version
v2.8
x-content-type-options
nosniff
strict-transport-security
max-age=15552000; preload
content-encoding
gzip
cache-control
private, no-cache, no-store, must-revalidate
timing-allow-origin
*
content-security-policy
default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' *.atlassolutions.com blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* *.atlassolutions.com attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;
vary
Accept-Encoding
expect-ct
max-age=86400, report-uri="http://reports.fb.com/expectct/"
pragma
no-cache
x-xss-protection
0
content-type
text/html; charset="utf-8"
x-fb-debug
7zYR8Y1j6+sMN6d8yeFIdQ2VCbKns4xEQEgDFpuuF+u4HYK4+Y3zA57/Gr/TWfjzl+KQgYS8qFGUp05r2hh82w==
date
Wed, 07 Nov 2018 13:46:57 GMT
truncated
/ 		1 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
4b62ca74cc743ba6bf548b9342e458c7443141f417a90b944b0c5797c1d10ce5

Request headers

Response headers

Access-Control-Allow-Origin
*
Content-Type
image/jpg
v1
web.vortex.data.microsoft.com/collect/ 		57 B
674 B 		Other
General
Check archive.org
Download Go to
Full URL
https://web.vortex.data.microsoft.com/collect/v1?$mscomCookies=false&ext-javascript-msfpc=%22GUID%3Ded093827e96a4ee0a38209655b50709d%26HASH%3Ded09%26LV%3D201811%26V%3D4%26LU%3D1541598417513%22
Requested by
Host: az725175.vo.msecnd.net
URL: https://az725175.vo.msecnd.net/scripts/jsll-4.2.1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
40.77.226.250 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
8d316e9191d40a4b9cc775c0adce0a999873c1935781d1312a5b12ee717c53d4
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Pragma
no-cache
Origin
https://blogs.technet.microsoft.com
Accept-Encoding
gzip, deflate
Host
web.vortex.data.microsoft.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
text/plain;charset=UTF-8
Accept
*/*
Cache-Control
no-cache
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Cookie
MC1=GUID=ed093827e96a4ee0a38209655b50709d&HASH=ed09&LV=201811&V=4&LU=1541598417513; MS0=e4a3fafc45374e2c9a9c20706e3d357c
Connection
keep-alive
Content-Length
1749
Referer
https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/
Origin
https://blogs.technet.microsoft.com
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

Pragma
no-cache
Date
Wed, 07 Nov 2018 13:46:56 GMT
X-Content-Type-Options
nosniff
P3P
CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
Access-Control-Allow-Origin
https://blogs.technet.microsoft.com
Cache-Control
no-cache, no-store
Access-Control-Allow-Credentials
true
MS-CV
HWriQMhE4EezpRp5v86HEw.0
Content-Type
application/json
Access-Control-Allow-Headers
Accept, Authorization, Content-Type, Origin, X-Xbl-Contract-Version, X-Xbl-Device-Type, Xbl-Authz-Actor-10, WithCredentials
Content-Length
57
Expires
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
public.newsharecounts.com
URL
https://public.newsharecounts.com/count.json?url=https://blogs.technet.microsoft.com/office365security/how-to-fix-a-compromised-hacked-microsoft-office-365-account/

Verdicts & Comments Add Verdict or Comment

31 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| _wpemojiSettings function| $ function| jQuery object| jQuery112106268580393161125 object| dataLayer object| wpAjax function| deleteEvent object| wds_ratings_config object| StarRatings object| wp object| mscc object| twemoji object| $login_link string| GoogleAnalyticsObject function| ga number| varSegmentation number| varClickTracking number| varCustomerTracking number| varAutoFirePV string| Route string| Ctrl object| blogPost object| google_tag_data object| gaplugins object| google_tag_manager object| msdnsocial string| site object| awa string| behaviorKey object| FB function| sfmsb_front

1 Cookies

Domain/Path Name / Value
blogs.technet.microsoft.com/ Name: msdn-blogs-aad-state-parameter
Value: 764A90C5-ECF9-9184-90F0-62B7E71D1FAD

1 Console Messages

Source Level URL
Text
console-api log URL: https://blogs.technet.microsoft.com/office365security/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1(Line 2)
Message:
JQMIGRATE: Migrate is installed, version 1.4.1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ajax.aspnetcdn.com
aka.ms
az725175.vo.msecnd.net
blogs.technet.microsoft.com
c.s-microsoft.com
connect.facebook.net
i1.social.s-msft.com
public.newsharecounts.com
staticxx.facebook.com
uhf.microsoft.com
web.vortex.data.microsoft.com
widgets.services.microsoft.com
www.facebook.com
www.google-analytics.com
www.googletagmanager.com
www.linkedin.com
public.newsharecounts.com
104.109.70.191
104.111.241.149
152.199.19.160
23.38.58.129
23.66.21.99
2620:109:c00c:104::b93f:9001
2a00:1450:4001:814::2008
2a00:1450:4001:814::200e
2a02:26f0:6c00:299::2b57
2a02:26f0:6c00:29d::356e
2a03:2880:f01c:216:face:b00c:0:3
2a03:2880:f11c:8083:face:b00c:0:25de
40.77.226.250
14dd9b95176e30bce293e3b1022d6caa9b4f29df9ad504a120d491929d2f9190
1e5097986115719df77c0785d6051ccacd78805b51008a82015d6ddc14318ee0
2359d383bf2d4ab65ebf7923bdf74ce40e4093f6e58251b395a64034b3c39772
31fbd99641c212a6ad3681a2397bde13c148c0ccd98385bce6a7eb7c81417d87
35211f76c4c35c17f2649b96868c0d691f1d78b107f7635d22619948d0ee6880
38f07ce67b62c6903d96f11605ba9a114a981832504f3f32789933f8a525c853
4a4de7903ea62d330e17410ea4db6c22bcbeb350ac6aa402d6b54b4c0cbed327
4b62ca74cc743ba6bf548b9342e458c7443141f417a90b944b0c5797c1d10ce5
54bca7687d2f7bae08bfc3fb793cb490dcd35972ad3d1f52423879781bb5f495
597345e93b0ede028a1ebe3f5841552da0f71adeb115f0690f886f4529601ad9
613b0f55a429e24f6e3c2016cb66ee82e964f6e8a1c0d0b28ada8d5973b64d2b
6b8ddede06bdc01cd08aa3e1911ceee93799fec29e950d1e20e8a577980564c3
7091e4b46a43a6d54a5dd3817a8dbe73ed805e70b8f63099cbd070a92eeef930
753afdb3e8e9024755c0db094a391ae9003a1cdf6d5a10233a20fde900a7b02a
7b792ad810340e788cfd38b7e249f51075445de7741815178e70bdb77f15491f
8616a6a802b821ff122632de5c48fe0af6702f9ee3e58915b7fb5a3f564f02a0
86f2ad8b0415b48e5c4e6cbfbc3b79f48afa1fbfb4648c4f9acb4b8c7f1d6568
8a123916a3f0aacb106e0596bbb5ddf2bf45dd2558632e4262ec7742b95778bf
8cb05b675fe6419a9e91eb587c60902c7ed1cb6c42b8cff8ce404ef89f635cde
8d316e9191d40a4b9cc775c0adce0a999873c1935781d1312a5b12ee717c53d4
8e7ae72014c8049890cf8e11ebc7d320c5cc51919c8aeb31fe2a41b42a8f9502
905a631ed546f0ec9b73469fa887519aaf9072e1cda2667f8f1fa03e921ac5ff
913abadc706c39dd6540adab9ce39e6115515ba0515d1e8fe386add03689a5e7
92b3c670560875788326a1d050b150a712cd8a8cb5a9f5bd5fdc6734f0862159
948885fd3be45fdb44b12f9e067f7d4a63ca93346323114ddbeed1b351f18a17
951a3d1ea6a1b8204d22b854bf1742cf2400d5a7497871d16aa4ba48679475f4
a1cdba769e59384c6667b947dc33981e066fbb9a9f02b2ca7feaa534fdd8de63
a2111022ce52c2766e27fb961024696e0518a8b66ca1eaa50eb7ff0c83714327
afd6a5f6de40e9e67b55ff6afec66fff4827e775c996ab80c9e964a872a92523
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
bbd79bb1ece7335a4b3cc8a59abe0d7792e449422a850e314992794da63c6b5e
c6db06c2bf508c9f782bc6fde4e52790de584dcc08eca9c873de779a9ea51a32
c853dc7e8637ab2cccb45e4feee716ea1d945d100eb740c260dea70b6fe8178d
c87516d7dd7077edd467f5b7b085b035cd4803ecf049670ab19de004e270aba8
ce8acd69ef20108b465e5f75f70161f383c58c0ff341b64e03ab60b20790c682
d0890b4294bb4e39460d5c5b28aa30ca049d4eb61a3e4e35b7ca9473cdb29f25
d5980219c23ab42185467a6a8fc7209f24b7be33c585a06a777ec885c91cbd34
dcb5e540e62fc85857254a1066afb6a7e8999279c6d4c583eef855d39f9289c0
dfee1fe127c3a828a6f88e3ef6e8d1d7f8a3750e6f9d9e24520992a2294696a6
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5e38918af810f5224da75f5b5bccdd5a6ce9c05bc7bcef6af2a7e09f1ee7b68
e7939a03248bb3f75e2f12226871e6e304b0c1e1fa506f3871548547cf24f32d
eeef2d5701f6af83f9d05441dee48e36e40ba7c814bd89658f6b4d79bf411b51
ef0968035e387c8b468f4a943a9b5998d159c9e2f1a4994c70aa86bf53a9316d
f018a202d8f9450d64a5ae50edbcfad11273d082c56ae47ae38d62866fa0ad26
f2806d0eadc9c15132144d7e7644623dcd7d7e783f62d0839fd7ab7d73580b78
f52b52d42747c49bc421748e9092ee83f5bef1566aaeb58391cf3b61b8c9425d
fccf44335a2bf44e7be1ebf6aeaa54f8709b54e74eddd802428246ab1273a7f4
fe185d11a49676890d47bb783312a0cda5a44c4039214094e7957b4c040ef11c