urlscan.io logo urlscan.io
SecurityTrails logo

www.microsoft.com Open in urlscan Pro
2a02:26f0:6c00:2a8::356e  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: https://cda.ms/3qR
Effective URL: https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-d...
Submission: On December 11 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 10 IPs in 4 countries across 9 domains to perform 53 HTTP transactions. The main IP is 2a02:26f0:6c00:2a8::356e, located in Frankfurt am Main, Germany and belongs to AKAMAI-ASN1, NL. The main domain is www.microsoft.com.
TLS certificate: Issued by Microsoft RSA TLS CA 01 on July 28th 2021. Valid for: a year.
This is the only time www.microsoft.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 2606:4700:303... 13335 (CLOUDFLAR...)
31 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
3 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
5 2620:1ec:bdf::60 8068 (MICROSOFT...)
1 2.16.186.9 20940 (AKAMAI-ASN1)
2 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
5 40.77.226.250 8075 (MICROSOFT...)
1 20.190.160.132 8075 (MICROSOFT...)
1 192.229.221.185 15133 (EDGECAST)
4 20.42.65.85 8075 (MICROSOFT...)
53 10
1    2606:4700:3035::6815:26ca (United States)

ASN13335 (CLOUDFLARENET, US)
cda.ms
31    2a02:26f0:6c00:2a8::356e (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
www.microsoft.com
c.s-microsoft.com
3    2a02:26f0:6c00:281::2957 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
assets.onestore.ms
5    2620:1ec:bdf::60 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
wcpstatic.microsoft.com
js.monitor.azure.com
mem.gfx.ms
1    2.16.186.9 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-16-186-9.deploy.static.akamaitechnologies.com
statics-marketingsites-eus-ms-com.akamaized.net
2    2a02:26f0:6c00::210:ba1b (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
img-prod-cms-rt-microsoft-com.akamaized.net
5    40.77.226.250 (Dublin, Ireland)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
web.vortex.data.microsoft.com
1    20.190.160.132 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
login.live.com
1    192.229.221.185 (United States)

ASN15133 (EDGECAST, US)
logincdn.msauth.net
4    20.42.65.85 (Tappahannock, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
browser.events.data.microsoft.com
Domain Requested by
26 www.microsoft.com www.microsoft.com
5 web.vortex.data.microsoft.com mem.gfx.ms
5 c.s-microsoft.com assets.onestore.ms
4 browser.events.data.microsoft.com js.monitor.azure.com
3 mem.gfx.ms www.microsoft.com
mem.gfx.ms
3 assets.onestore.ms www.microsoft.com
2 img-prod-cms-rt-microsoft-com.akamaized.net www.microsoft.com
1 logincdn.msauth.net login.live.com
1 login.live.com mem.gfx.ms
1 statics-marketingsites-eus-ms-com.akamaized.net www.microsoft.com
1 js.monitor.azure.com www.microsoft.com
1 wcpstatic.microsoft.com www.microsoft.com
1 cda.ms 1 redirects
53 13
Subject Issuer Validity Valid
www.microsoft.com
Microsoft RSA TLS CA 01		 2021-07-28 -
2022-07-28		 a year crt.sh
wildcard.onestore.ms
Microsoft RSA TLS CA 01		 2021-01-19 -
2022-01-19		 a year crt.sh
wcpstatic.microsoft.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-06-12 -
2022-06-12		 a year crt.sh
js.monitor.azure.com
Microsoft Azure TLS Issuing CA 01		 2021-09-28 -
2022-09-23		 a year crt.sh
a248.e.akamai.net
DigiCert SHA2 Secure Server CA		 2021-07-15 -
2022-07-20		 a year crt.sh
identitycdn.msauth.net
Microsoft Azure TLS Issuing CA 06		 2021-11-22 -
2022-11-17		 a year crt.sh
*.vortex.data.microsoft.com
Microsoft RSA TLS CA 01		 2021-10-25 -
2022-10-25		 a year crt.sh
graph.windows.net
DigiCert SHA2 Secure Server CA		 2021-11-16 -
2022-11-16		 a year crt.sh
*.events.data.microsoft.com
Microsoft Azure TLS Issuing CA 05		 2021-09-23 -
2022-09-18		 a year crt.sh

This page contains 2 frames:

Primary Page: https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
Frame ID: 3B54E4834BA8DFB0975E22830021F25C
Requests: 52 HTTP requests in this frame

Frame: https://login.live.com/me.srf?wa=wsignin1.0&wreply=https%3A%2F%2Fwww.microsoft.com&uaid=908b012a-0f03-4ad8-6184-e8445ccc192a&partnerId=mssecurity
Frame ID: 86166C87DAB72A31351D7970C1BD9227
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

A closer look at Qakbot’s latest building blocks (and how to knock them down) - Microsoft Security Blogtwitter

Page URL History Show full URLs

  1. https://cda.ms/3qR HTTP 302
    https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and... Page URL

Page Statistics

53
Requests

100 %
HTTPS

50 %
IPv6

9
Domains

13
Subdomains

10
IPs

4
Countries

1010 kB
Transfer

3147 kB
Size

8
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://cda.ms/3qR HTTP 302
    https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

53 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/
Redirect Chain
  • https://cda.ms/3qR
  • https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
182 KB
38 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:2a8::356e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
f486a12dd7b2ca407e24b8ebd35c4889a4a97d41d08c20b90495144375ff1ece
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language
de-DE,de;q=0.9

Response headers

content-type
text/html; charset=UTF-8
x-frame-options
SAMEORIGIN
link
<https://www.microsoft.com/security/blog/wp-json/>; rel="https://api.w.org/" <https://www.microsoft.com/security/blog/wp-json/wp/v2/posts/102663>; rel="alternate"; type="application/json" <https://www.microsoft.com/security/blog/?p=102663>; rel=shortlink
last-modified
Sat, 11 Dec 2021 13:17:37 GMT
cache-control
max-age=300, must-revalidate
x-ten-cache
MISS
content-encoding
gzip
content-length
37785
x-edgeconnect-midmile-rtt
96
x-edgeconnect-origin-mex-latency
227
date
Sat, 11 Dec 2021 13:17:37 GMT
vary
Accept-Encoding
tls_version
tls1.3
strict-transport-security
max-age=31536000
x-rtag
RT

Redirect headers

date
Sat, 11 Dec 2021 13:17:37 GMT
content-length
0
location
https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
request-context
appId=cid-v1:8f4d3b74-3a37-48e0-ac27-5ca6bbb27093
cf-cache-status
DYNAMIC
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GHCDszYFxIOUTdkQJjVctGET%2BtlORPm%2F87Ox4%2Fq6S%2B2ZAwpZGhO5M5hS3ckvbEYNt12XZLhgngsZ3MxmLdM8tB%2B8zSfVHUCUCXWAMaQsYt8HXWX%2FEfV5bwLGiWF1SeIGoJ88RWQ%3D"}],"group":"cf-nel","max_age":604800}
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server
cloudflare
cf-ray
6bbefe80c9436927-FRA
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400, h3-28=":443"; ma=86400, h3-27=":443"; ma=86400
style.min.css
www.microsoft.com/security/blog/wp-includes/css/dist/block-library/ 		79 KB
11 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.microsoft.com/security/blog/wp-includes/css/dist/block-library/style.min.css?ver=5.8.2
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:2a8::356e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma
public
date
Sat, 11 Dec 2021 13:17:38 GMT
content-encoding
gzip
last-modified
Mon, 02 Aug 2021 16:30:54 GMT
x-rtag
RT
x-edgeconnect-midmile-rtt
96
etag
W/"61081dbe-13abe"
vary
Accept-Encoding
content-type
text/css
x-edgeconnect-origin-mex-latency
17
tls_version
tls1.3
cache-control
max-age=2592000, public
strict-transport-security
max-age=31536000
content-length
10523
expires
Mon, 10 Jan 2022 13:17:37 GMT
styles.css
www.microsoft.com/security/blog/wp-content/plugins/wds-ms-inline-interruption-styles-officeblogs/css/ 		10 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.microsoft.com/security/blog/wp-content/plugins/wds-ms-inline-interruption-styles-officeblogs/css/styles.css?ver=1639228657
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:2a8::356e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
b201ab52de2c92539f7a276b6cf170b1bdf0f3705f1b6ab9597517d030afefe4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma
public
date
Sat, 11 Dec 2021 13:17:38 GMT
content-encoding
gzip
last-modified
Fri, 18 Jun 2021 19:28:25 GMT
x-rtag
RT
x-edgeconnect-midmile-rtt
101
etag
W/"60ccf3d9-29a7"
vary
Accept-Encoding
content-type
text/css
x-edgeconnect-origin-mex-latency
10
tls_version
tls1.3
cache-control
max-age=2592000, public
strict-transport-security
max-age=31536000
content-length
3910
expires
Mon, 10 Jan 2022 13:17:37 GMT
uhf-search-ui.css
www.microsoft.com/security/blog/wp-content/plugins/wds-ms-searchwp/features/uhf-search-ui/ 		160 B
428 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.microsoft.com/security/blog/wp-content/plugins/wds-ms-searchwp/features/uhf-search-ui/uhf-search-ui.css?ver=1.0.1
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:2a8::356e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
f258c099e2bb029f6c9d5e9900a78f53347a16b43aa1e37a9f9c1a1539e0748d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma
public
date
Sat, 11 Dec 2021 13:17:38 GMT
content-encoding
gzip
last-modified
Fri, 18 Jun 2021 19:28:25 GMT
x-rtag
RT
x-edgeconnect-midmile-rtt
96
etag
W/"60ccf3d9-a0"
vary
Accept-Encoding
content-type
text/css
x-edgeconnect-origin-mex-latency
12
tls_version
tls1.3
cache-control
max-age=2592000, public
strict-transport-security
max-age=31536000
content-length
145
expires
Mon, 10 Jan 2022 13:17:37 GMT
mwf-west-european-default.min.css
assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/css/ 		581 KB
71 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/css/mwf-west-european-default.min.css?ver=5.8.2
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:281::2957 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
4919e80f038d2b93f1184d1733ac35009643481735c7bc7aa31d8b56e118fc04
Security Headers
Name Value
X-Content-Type-Options nosniff, nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Sat, 11 Dec 2021 13:17:37 GMT
content-encoding
gzip
x-content-type-options
nosniff, nosniff
last-modified
Thu, 01 Feb 2018 02:22:19 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
content-md5
QshXRY8/Osc4oVEHlL0Pbw==
etag
"0x8D5691A9EA468B4"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-lease-state,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control
max-age=900
accept-ranges
bytes
content-length
71704
x-ms-lease-state
available
style.css
www.microsoft.com/security/blog/wp-content/themes/ms_s/ 		342 B
522 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.microsoft.com/security/blog/wp-content/themes/ms_s/style.css?ver=1.0.0
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:2a8::356e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
f174b3ce00dc0ef25fe0867dae1da92a595c50f730dbe2cd1fd7f29546034e81
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma
public
date
Sat, 11 Dec 2021 13:17:38 GMT
content-encoding
gzip
last-modified
Fri, 18 Jun 2021 19:28:20 GMT
x-rtag
RT
x-edgeconnect-midmile-rtt
97
etag
W/"60ccf3d4-156"
vary
Accept-Encoding
content-type
text/css
x-edgeconnect-origin-mex-latency
17
tls_version
tls1.3
cache-control
max-age=2592000, public
strict-transport-security
max-age=31536000
content-length
238
expires
Mon, 10 Jan 2022 13:17:37 GMT
style.min.css
www.microsoft.com/security/blog/wp-content/themes/ms-security/ 		69 KB
14 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.microsoft.com/security/blog/wp-content/themes/ms-security/style.min.css?ver=2.4.2
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:2a8::356e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
fd47060008f59c6245fbce0876ff3b0149daff5e9d3f17fcc0c4d2cb40e45914
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma
public
date
Sat, 11 Dec 2021 13:17:38 GMT
content-encoding
gzip
last-modified
Fri, 18 Jun 2021 19:28:25 GMT
x-rtag
RT
x-edgeconnect-midmile-rtt
96
etag
W/"60ccf3d9-11377"
vary
Accept-Encoding
content-type
text/css
x-edgeconnect-origin-mex-latency
14
tls_version
tls1.3
cache-control
max-age=2592000, public
strict-transport-security
max-age=31536000
content-length
13533
expires
Mon, 10 Jan 2022 13:17:37 GMT
wcp-consent.js
wcpstatic.microsoft.com/mscc/lib/v2/ 		249 KB
74 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:bdf::60 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
208edbed32b2adac9446df83caa4a093a261492ba6b8b3bcfe6a75efb8b70294

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Sat, 11 Dec 2021 13:17:36 GMT
content-encoding
gzip
vary
Accept-Encoding
content-md5
OLdpUi3Q5MKZjJA0pU4XTg==
age
14355
x-cache
HIT, CONFIG_NOCACHE
content-length
75124
x-ms-lease-status
unlocked
last-modified
Wed, 14 Oct 2020 22:31:12 GMT
etag
0x8D87090DB39FE9E
x-azure-ref
08aS0YQAAAAAzgFyfGNJEQ4at5iDck3HXRlJBRURHRTEwMjAAMzliNDYxNTctY2I5ZS00OWI3LWE2NWEtODcyMmEzZjgyNGU0
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
914a827b-901e-0086-6b70-ee9a2a000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
max-age=43200
x-ms-version
2009-09-19
jquery.min.js
www.microsoft.com/security/blog/wp-includes/js/jquery/ 		87 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.microsoft.com/security/blog/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:2a8::356e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma
public
date
Sat, 11 Dec 2021 13:17:38 GMT
content-encoding
gzip
last-modified
Mon, 02 Aug 2021 16:30:54 GMT
x-rtag
RT
x-edgeconnect-midmile-rtt
95
etag
W/"61081dbe-15db1"
vary
Accept-Encoding
content-type
application/javascript
x-edgeconnect-origin-mex-latency
19
tls_version
tls1.3
cache-control
max-age=2592000, public
strict-transport-security
max-age=31536000
content-length
30953
expires
Mon, 10 Jan 2022 13:17:38 GMT
jquery-migrate.min.js
www.microsoft.com/security/blog/wp-includes/js/jquery/ 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.microsoft.com/security/blog/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:2a8::356e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma
public
date
Sat, 11 Dec 2021 13:17:38 GMT
content-encoding
gzip
last-modified
Fri, 18 Jun 2021 19:16:24 GMT
x-rtag
RT
x-edgeconnect-midmile-rtt
95
etag
W/"60ccf108-2bd8"
vary
Accept-Encoding
content-type
application/javascript
x-edgeconnect-origin-mex-latency
9
tls_version
tls1.3
cache-control
max-age=2592000, public
strict-transport-security
max-age=31536000
content-length
4169
expires
Mon, 10 Jan 2022 13:17:38 GMT
mwf-main.var.min.js
assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/scripts/ 		302 KB
70 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/scripts/mwf-main.var.min.js?ver=v1.23.2+5182151
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:281::2957 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
b1d83c2d49c49ea38d578afa752aaec44a86d069d6ce2d54460e2612fc31a102
Security Headers
Name Value
X-Content-Type-Options nosniff, nosniff, nosniff, nosniff, nosniff, nosniff, nosniff, nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Sat, 11 Dec 2021 13:17:37 GMT
content-encoding
gzip
x-content-type-options
nosniff, nosniff, nosniff, nosniff, nosniff, nosniff, nosniff, nosniff
last-modified
Thu, 01 Feb 2018 02:22:29 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
content-md5
FuF99EJdzMvbQQjP24cb+Q==
etag
"0x8D5691AA4A90431"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-lease-state,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control
max-age=900
accept-ranges
bytes
content-length
71185
x-ms-lease-state
available
ms.analytics-web-3.min.js
js.monitor.azure.com/scripts/c/ 		132 KB
43 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.monitor.azure.com/scripts/c/ms.analytics-web-3.min.js
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:bdf::60 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
556d027670db9b0dca02802e45d26811d5d83955bbb911ea7c47213007c25f0b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Sat, 11 Dec 2021 13:17:37 GMT
content-encoding
br
x-azure-ref-originshield
0zKC0YQAAAABH1NVFT7OWR7E5kC603TZSQU1TMDRFREdFMTkwNwBmMWNhNzNkNC04ODgzLTRjYWYtYWJkYy1mZTJkNTY3YWZiOTY=
content-md5
P0N9LlGmH0RzbHHdxYy+ag==
x-cache
TCP_HIT
x-ms-meta-jssdkver
3.1.9
last-modified
Mon, 15 Nov 2021 18:37:07 GMT
x-ms-meta-jssdksrc
[cdn]/scripts/c/ms.analytics-web-3.1.9.min.js
etag
0x8D9A866ED89AD75
x-azure-ref
08aS0YQAAAABsN/OUwgMERocIYVUrrinyRlJBRURHRTEwMTMAZjFjYTczZDQtODg4My00Y2FmLWFiZGMtZmUyZDU2N2FmYjk2
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
x-ms-request-id
1640e46b-c01e-0081-5d8d-ee48af000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,x-ms-meta-lastmodified,x-ms-meta-jssdksrc,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=1800, immutable, no-transform
x-ms-version
2009-09-19
ef-a24652
www.microsoft.com/onerfstatics/marketingsites-eus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/79-4cdd0a/33-ae3d41/a5-4bf7a2/13-8e1ceb/81-32f0c0/5c-b7b685/25-953c9a/ 		166 KB
23 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.microsoft.com/onerfstatics/marketingsites-eus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/79-4cdd0a/33-ae3d41/a5-4bf7a2/13-8e1ceb/81-32f0c0/5c-b7b685/25-953c9a/ef-a24652?ver=2.0&_cf=02242021_3231
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:2a8::356e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
b35e54289651f334c35a573e43a36a4726b34ee94bb4521aacd452cc02314a77
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

ms-operation-id
d9ab0a9fffd358418426e30c80527854
date
Sat, 11 Dec 2021 13:17:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-rtag
RT
x-s2
2021-12-07T22:18:35
p3p
CP="CAO CONi OTR OUR DEM ONL"
x-activity-id
7a56f99a-37dc-4eac-a8ef-bb9b2c04dbb4
tls_version
tls1.3
x-s1
2021-12-07T22:18:35
ms-cv
bNX3HO9vFEK8Zkfa.0
vary
Accept-Encoding
content-length
22536
x-xss-protection
1; mode=block
last-modified
Tue, 07 Dec 2021 22:18:35 GMT
x-az
{did:92e7dc58ca2143cfb2c818b047cc5cd1, rid: OneDeployContainer, sn: marketingsites-prod-odnortheurope, dt: 2018-05-03T20:14:23.4188992Z, bt: 2021-11-05T01:30:40.0000000Z}
strict-transport-security
max-age=31536000
access-control-allow-methods
HEAD,GET,POST,PATCH,PUT,OPTIONS
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31222855
timing-allow-origin
*
x-appversion
1.0.7978.33320
expires
Wed, 07 Dec 2022 22:18:33 GMT
override.css
statics-marketingsites-eus-ms-com.akamaized.net/statics/ 		1 KB
907 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://statics-marketingsites-eus-ms-com.akamaized.net/statics/override.css
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2.16.186.9 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a2-16-186-9.deploy.static.akamaitechnologies.com
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
0bd288d5397a69ead391875b422bf2cbdcc4f795d64aa2f780aff45768d78248

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Date
Sat, 11 Dec 2021 13:17:37 GMT
Content-Encoding
gzip
Last-Modified
Tue, 11 Jun 2019 23:22:13 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag
0x8D6EEC3A2D67C35
Vary
Accept-Encoding
Content-Type
text/css
x-ms-request-id
aa45aa48-101e-0072-1d0d-347b34000000
x-ms-version
2009-09-19
Connection
keep-alive
Content-Length
473
44-5488b2
www.microsoft.com/onerfstatics/marketingsites-eus-prod/shell/_scrf/js/themes=default/8e-e88b64/93-04b71e/dd-2cee44/49-a00ab0/92-02e55d/7c-dcea75/75-fca72d/ed-e77ee7/d5-bf34c0/a9-078595/7a-7ea8cc/2d... 		133 KB
35 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.microsoft.com/onerfstatics/marketingsites-eus-prod/shell/_scrf/js/themes=default/8e-e88b64/93-04b71e/dd-2cee44/49-a00ab0/92-02e55d/7c-dcea75/75-fca72d/ed-e77ee7/d5-bf34c0/a9-078595/7a-7ea8cc/2d-40bdad/31-53ba50/96-eb5423/e6-6b0cce/d1-98d78a/a0-23c4ba/a7-f7a340/48-6ed936/2e-ca165a/fc-169dd8/8e-60935c/87-fecbed/96-6ed6eb/c3-eb62e0/ad-ffd6bf/35-621acc/b0-07f293/1e-9d9d16/52-f0367f/1f-b57352/8d-b89eaf/e1-ed258e/20-0b10e2/6b-0f1117/fb-5e9831/44-5488b2?ver=2.0&_cf=02242021_3231&iife=1
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:2a8::356e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
b2ba90e09a9efd1cda6c16ed4204b5f179546fbc55a501e4780412b492c7aad7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

ms-operation-id
5d18fc5b5241834a83318972f3e16909
date
Sat, 11 Dec 2021 13:17:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
x-rtag
RT
x-s2
2021-12-07T13:23:42
p3p
CP="CAO CONi OTR OUR DEM ONL"
x-activity-id
be69d459-0dcd-4a1e-8258-619310dd1f93
tls_version
tls1.3
x-s1
2021-12-07T13:23:42
ms-cv
p3lEj28GB0SmXTr0.0
vary
Accept-Encoding
content-length
35578
x-xss-protection
1; mode=block
last-modified
Tue, 07 Dec 2021 13:23:42 GMT
x-az
{did:92e7dc58ca2143cfb2c818b047cc5cd1, rid: OneDeployContainer, sn: marketingsites-prod-odnortheurope, dt: 2018-05-03T20:14:23.4188992Z, bt: 2021-11-05T01:30:40.0000000Z}
strict-transport-security
max-age=31536000
access-control-allow-methods
HEAD,GET,POST,PATCH,PUT,OPTIONS
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31190719
timing-allow-origin
*
x-appversion
1.0.7978.33320
expires
Wed, 07 Dec 2022 13:22:57 GMT
meversion
mem.gfx.ms/ 		27 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://mem.gfx.ms/meversion?partner=MSSecurity&market=en-us&uhf=1
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:bdf::60 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
14a4adf73b2321dc93c086220de872f8b4d0f2aaee05d9e59dd9a971b2668590
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
br
x-content-type-options
nosniff
x-azure-ref-originshield
0I6O0YQAAAABhNAs6plz1RIgINDQwRApzQU1TMDRFREdFMTgxNwBlYWM1ZjQ5Zi1lMDJkLTRmNDEtYjBhNi0yZDUwZjlmY2Y4NGE=
date
Sat, 11 Dec 2021 13:17:37 GMT
x-azure-ref
08qS0YQAAAAAOavX3ldCpRa6nJ71jmK7XRlJBRURHRTEwMTUAZWFjNWY0OWYtZTAyZC00ZjQxLWIwYTYtMmQ1MGY5ZmNmODRh
x-cache
TCP_HIT
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, no-transform, max-age=43200
x-ua-compatible
IE=edge
expires
Sat, 11 Dec 2021 15:09:09 GMT
RE1Mu3b
img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a02:26f0:6c00::210:ba1b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
112fec798b78aa02e102a724b5cb1990c0f909bc1d8b7b1fa256eab41bbc0960
Security Headers
Name Value
X-Frame-Options deny

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin
*
date
Sat, 11 Dec 2021 13:17:38 GMT
last-modified
Fri, 10 Dec 2021 12:30:34 GMT
x-datacenter
northeu
x-source-length
4054
x-frame-options
deny
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=342759
x-activityid
4b1c3790-cf6a-47b2-a5c9-9e08b81f984d
x-resizerversion
1.0
x-deployment
a89a5014e89c41b7b60a64d7ee950637
content-location
https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31
content-length
4054
expires
Wed, 15 Dec 2021 12:30:17 GMT
wp-emoji-release.min.js
www.microsoft.com/security/blog/wp-includes/js/ 		18 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.microsoft.com/security/blog/wp-includes/js/wp-emoji-release.min.js?ver=5.8.2
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:2a8::356e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma
public
date
Sat, 11 Dec 2021 13:17:38 GMT
content-encoding
gzip
last-modified
Mon, 02 Aug 2021 16:30:54 GMT
x-rtag
RT
x-edgeconnect-midmile-rtt
95
etag
W/"61081dbe-4705"
vary
Accept-Encoding
content-type
application/javascript
x-edgeconnect-origin-mex-latency
14
tls_version
tls1.3
cache-control
max-age=2592000, public
strict-transport-security
max-age=31536000
content-length
4926
expires
Mon, 10 Jan 2022 13:17:38 GMT
MSC16_slalom_018-440x268.jpg
www.microsoft.com/security/blog/uploads/securityprod/2021/12/ 		18 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.microsoft.com/security/blog/uploads/securityprod/2021/12/MSC16_slalom_018-440x268.jpg
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:2a8::356e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
ea8699db20b0926cdc14b558972ecf6bbcba843b361ac10a79ff4f274bbaacbf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-ms-blob-type
AppendBlob
date
Sat, 11 Dec 2021 13:17:38 GMT
x-rtag
RT
x-edgeconnect-midmile-rtt
96
tls_version
tls1.3
content-length
18597
x-ms-lease-status
unlocked
last-modified
Wed, 08 Dec 2021 00:12:06 GMT
x-ms-blob-committed-block-count
1
etag
0x8D9B9DF5EAC86D3
strict-transport-security
max-age=31536000
content-type
image/jpeg
x-edgeconnect-origin-mex-latency
123
x-ms-request-id
6250cf1a-101e-0011-1991-eea62b000000
cache-control
max-age=600, must-revalidate
x-ms-version
2009-09-19
CLO17_clothingStore_004-440x268.jpg
www.microsoft.com/security/blog/uploads/securityprod/2021/12/ 		26 KB
26 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.microsoft.com/security/blog/uploads/securityprod/2021/12/CLO17_clothingStore_004-440x268.jpg
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:2a8::356e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
6b3d6fcf9d64c863b85f7387db0153b3bcc6e5d3014d71ebde4ebe56562fdc3a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-ms-blob-type
AppendBlob
date
Sat, 11 Dec 2021 13:17:38 GMT
x-rtag
RT
x-edgeconnect-midmile-rtt
95
tls_version
tls1.3
content-length
26129
x-ms-lease-status
unlocked
last-modified
Mon, 06 Dec 2021 23:00:53 GMT
x-ms-blob-committed-block-count
1
etag
0x8D9B90C411832FF
strict-transport-security
max-age=31536000
content-type
image/jpeg
x-edgeconnect-origin-mex-latency
171
x-ms-request-id
929bd551-301e-0039-6391-eec783000000
cache-control
max-age=600, must-revalidate
x-ms-version
2009-09-19
WIN22_Productivity_024-440x268.jpg
www.microsoft.com/security/blog/uploads/securityprod/2021/12/ 		18 KB
18 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.microsoft.com/security/blog/uploads/securityprod/2021/12/WIN22_Productivity_024-440x268.jpg
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:2a8::356e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
356bc500cf97efc5abf3a664ae484323037e56191650abf721e5e513c16278fc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-ms-blob-type
AppendBlob
date
Sat, 11 Dec 2021 13:17:38 GMT
x-rtag
RT
x-edgeconnect-midmile-rtt
96
tls_version
tls1.3
content-length
18326
x-ms-lease-status
unlocked
last-modified
Tue, 07 Dec 2021 20:29:07 GMT
x-ms-blob-committed-block-count
1
etag
0x8D9B9C038411982
strict-transport-security
max-age=31536000
content-type
image/jpeg
x-edgeconnect-origin-mex-latency
116
x-ms-request-id
a9d361ad-a01e-0014-5791-ee74f0000000
cache-control
max-age=600, must-revalidate
x-ms-version
2009-09-19
uhf-search-ui.js
www.microsoft.com/security/blog/wp-content/plugins/wds-ms-searchwp/features/uhf-search-ui/ 		4 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.microsoft.com/security/blog/wp-content/plugins/wds-ms-searchwp/features/uhf-search-ui/uhf-search-ui.js?ver=1.0.1
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:2a8::356e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
16d6e957a9525cb4848051b0efc5aa101d256a3c6838007dc4ac2c41121eaade
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma
public
date
Sat, 11 Dec 2021 13:17:38 GMT
content-encoding
gzip
last-modified
Fri, 18 Jun 2021 19:28:25 GMT
x-rtag
RT
x-edgeconnect-midmile-rtt
114
etag
W/"60ccf3d9-105b"
vary
Accept-Encoding
content-type
application/javascript
x-edgeconnect-origin-mex-latency
13
tls_version
tls1.3
cache-control
max-age=2592000, public
strict-transport-security
max-age=31536000
content-length
1035
expires
Mon, 10 Jan 2022 13:17:38 GMT
modernizr.js
www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/bower_components/modernizer/ 		50 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/bower_components/modernizer/modernizr.js?ver=2.8.2
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:2a8::356e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
b828b15e9b7836b493a8bd6e832a24ee13aa8b6f8b4a1bf307a7af2912014178
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma
public
date
Sat, 11 Dec 2021 13:17:38 GMT
content-encoding
gzip
last-modified
Fri, 18 Jun 2021 19:28:20 GMT
x-rtag
RT
x-edgeconnect-midmile-rtt
95
etag
W/"60ccf3d4-c897"
vary
Accept-Encoding
content-type
application/javascript
x-edgeconnect-origin-mex-latency
14
tls_version
tls1.3
cache-control
max-age=2592000, public
strict-transport-security
max-age=31536000
content-length
15770
expires
Mon, 10 Jan 2022 13:17:38 GMT
mwf-auto-init-main.var.min.js
assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/scripts/ 		303 KB
71 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/scripts/mwf-auto-init-main.var.min.js?ver=v1.23.2+5182151
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2a02:26f0:6c00:281::2957 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
f2a28cd82e7ec00d2d8158f21fb0507722cd8b09fa4a0a16fadc58f30385cc25
Security Headers
Name Value
X-Content-Type-Options nosniff, nosniff, nosniff, nosniff, nosniff, nosniff, nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Sat, 11 Dec 2021 13:17:38 GMT
content-encoding
gzip
x-content-type-options
nosniff, nosniff, nosniff, nosniff, nosniff, nosniff, nosniff
last-modified
Thu, 01 Feb 2018 02:22:29 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
content-md5
12go4t01WZJhAGBag3beKQ==
etag
"0x8D5691AA4A3D407"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-lease-state,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control
max-age=900
accept-ranges
bytes
content-length
71611
x-ms-lease-state
available
picturefill.min.js
www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/bower_components/picturefill/dist/ 		12 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/bower_components/picturefill/dist/picturefill.min.js?ver=3.0.3
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:2a8::356e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
893fa7fe8b6e69e2828319c04a7cbb6f129ea820db695d4ced5757d59450b6a8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma
public
date
Sat, 11 Dec 2021 13:17:38 GMT
content-encoding
gzip
last-modified
Fri, 18 Jun 2021 19:28:20 GMT
x-rtag
RT
x-edgeconnect-midmile-rtt
114
etag
W/"60ccf3d4-2e1f"
vary
Accept-Encoding
content-type
application/javascript
x-edgeconnect-origin-mex-latency
17
tls_version
tls1.3
cache-control
max-age=2592000, public
strict-transport-security
max-age=31536000
content-length
5171
expires
Mon, 10 Jan 2022 13:17:38 GMT
imagesloaded.min.js
www.microsoft.com/security/blog/wp-includes/js/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.microsoft.com/security/blog/wp-includes/js/imagesloaded.min.js?ver=4.1.4
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:2a8::356e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
ff4bd34aa98a0214833619d3d751838db015722dfbbec15cd14dadc66cd67869
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma
public
date
Sat, 11 Dec 2021 13:17:38 GMT
content-encoding
gzip
last-modified
Fri, 18 Jun 2021 19:16:20 GMT
x-rtag
RT
x-edgeconnect-midmile-rtt
96
etag
W/"60ccf104-15fd"
vary
Accept-Encoding
content-type
application/javascript
x-edgeconnect-origin-mex-latency
15
tls_version
tls1.3
cache-control
max-age=2592000, public
strict-transport-security
max-age=31536000
content-length
1834
expires
Mon, 10 Jan 2022 13:17:38 GMT
masonry.min.js
www.microsoft.com/security/blog/wp-includes/js/ 		24 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.microsoft.com/security/blog/wp-includes/js/masonry.min.js?ver=4.2.2
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:2a8::356e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
e00add38134eac2fb8e8e9c09cbfff7bbe57952b210322eb2eecb0a21fc055eb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma
public
date
Sat, 11 Dec 2021 13:17:38 GMT
content-encoding
gzip
last-modified
Fri, 18 Jun 2021 19:16:20 GMT
x-rtag
RT
x-edgeconnect-midmile-rtt
95
etag
W/"60ccf104-5e4a"
vary
Accept-Encoding
content-type
application/javascript
x-edgeconnect-origin-mex-latency
16
tls_version
tls1.3
cache-control
max-age=2592000, public
strict-transport-security
max-age=31536000
content-length
7382
expires
Mon, 10 Jan 2022 13:17:38 GMT
project.min.js
www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/scripts/ 		7 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/scripts/project.min.js?ver=1.0.1
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:2a8::356e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
4b77438786a8f55a4616725434b1df15692130c6b3ee07b3a4d241ff30f42c62
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma
public
date
Sat, 11 Dec 2021 13:17:38 GMT
content-encoding
gzip
last-modified
Fri, 18 Jun 2021 19:28:25 GMT
x-rtag
RT
x-edgeconnect-midmile-rtt
119
etag
W/"60ccf3d9-1c37"
vary
Accept-Encoding
content-type
application/javascript
x-edgeconnect-origin-mex-latency
13
tls_version
tls1.3
cache-control
max-age=2592000, public
strict-transport-security
max-age=31536000
content-length
2124
expires
Mon, 10 Jan 2022 13:17:38 GMT
microsoft-uhf.js
www.microsoft.com/security/blog/wp-content/plugins/microsoft-uhf/assets/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.microsoft.com/security/blog/wp-content/plugins/microsoft-uhf/assets/microsoft-uhf.js?ver=0.3.9
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:2a8::356e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
cffbae450bcad74d65019c0aa2bada046cdcf5f5fa4af699929838f58c7ff8c2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma
public
date
Sat, 11 Dec 2021 13:17:38 GMT
content-encoding
gzip
last-modified
Fri, 18 Jun 2021 19:28:20 GMT
x-rtag
RT
x-edgeconnect-midmile-rtt
96
etag
W/"60ccf3d4-d4e"
vary
Accept-Encoding
content-type
application/javascript
x-edgeconnect-origin-mex-latency
12
tls_version
tls1.3
cache-control
max-age=2592000, public
strict-transport-security
max-age=31536000
content-length
1370
expires
Mon, 10 Jan 2022 13:17:38 GMT
wp-embed.min.js
www.microsoft.com/security/blog/wp-includes/js/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.microsoft.com/security/blog/wp-includes/js/wp-embed.min.js?ver=5.8.2
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:2a8::356e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

pragma
public
date
Sat, 11 Dec 2021 13:17:38 GMT
content-encoding
gzip
last-modified
Fri, 18 Jun 2021 19:16:24 GMT
x-rtag
RT
x-edgeconnect-midmile-rtt
96
etag
W/"60ccf108-592"
vary
Accept-Encoding
content-type
application/javascript
x-edgeconnect-origin-mex-latency
18
tls_version
tls1.3
cache-control
max-age=2592000, public
strict-transport-security
max-age=31536000
content-length
765
expires
Mon, 10 Jan 2022 13:17:38 GMT
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2bf73ba8c24162c4cfd51b3b508b2bc0f8ee00cab13bec8f32b6fb6359be7d17

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		223 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
707c5b510b5712a82fd8bdf073a6d9860583931ee85f6ee7e2e735e81ae05d18

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type
image/svg+xml
mwfmdl2-v3.54.woff
www.microsoft.com/mwf/_h/v3.54/mwf.app/fonts/ 		26 KB
26 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.microsoft.com/mwf/_h/v3.54/mwf.app/fonts/mwfmdl2-v3.54.woff
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/onerfstatics/marketingsites-eus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/79-4cdd0a/33-ae3d41/a5-4bf7a2/13-8e1ceb/81-32f0c0/5c-b7b685/25-953c9a/ef-a24652?ver=2.0&_cf=02242021_3231
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:2a8::356e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
22b4df5c33045b645cafa45b04685f4752e471a2e933bff5bf14324d87deee12
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.microsoft.com/onerfstatics/marketingsites-eus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/79-4cdd0a/33-ae3d41/a5-4bf7a2/13-8e1ceb/81-32f0c0/5c-b7b685/25-953c9a/ef-a24652?ver=2.0&_cf=02242021_3231
Origin
https://www.microsoft.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

ms-operation-id
ab6cae717d8a8743904e5d95c9d47798
date
Sat, 11 Dec 2021 13:17:38 GMT
x-content-type-options
nosniff
x-rtag
RT
x-edgeconnect-midmile-rtt
0
p3p
CP="CAO CONi OTR OUR DEM ONL"
x-activity-id
f02fe018-a5e3-4e23-8ae3-bbcbe2eb0dd6
tls_version
tls1.3
ms-cv
GXsD5slkPEy6wAzU.0
content-length
26288
x-xss-protection
1; mode=block
access-control-allow-origin
*
last-modified
Mon, 17 May 2021 23:20:05 GMT
x-az
{did:92e7dc58ca2143cfb2c818b047cc5cd1, rid: OneDeployContainer, sn: marketingsites-prod-odnortheurope, dt: 2018-05-03T20:14:23.4188992Z, bt: 2021-05-07T09:29:32.0000000Z}
strict-transport-security
max-age=31536000
access-control-allow-methods
HEAD,GET,POST,PATCH,PUT,OPTIONS
content-type
application/font-woff
x-edgeconnect-origin-mex-latency
109
cache-control
public, max-age=13600996
x-appversion
1.0.7797.2686
expires
Tue, 17 May 2022 23:20:54 GMT
latest.woff2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/Semibold/ 		29 KB
29 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/Semibold/latest.woff2
Requested by
Host: assets.onestore.ms
URL: https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/css/mwf-west-european-default.min.css?ver=5.8.2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:2a8::356e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
d87d0a7a7fe2c36d1dc093bfe56e9b81b311988789dbd3b65abf811d551ef02f

Request headers

Referer
https://assets.onestore.ms/
Origin
https://www.microsoft.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Sat, 11 Dec 2021 13:17:38 GMT
last-modified
Fri, 10 Jan 2020 19:09:43 GMT
etag
"5b68d583e9c7d51:0"
access-control-allow-methods
GET,POST
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=309612
accept-ranges
bytes
content-length
29388
expires
Wed, 15 Dec 2021 03:17:50 GMT
latest.woff2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/ 		33 KB
34 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/latest.woff2
Requested by
Host: assets.onestore.ms
URL: https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/css/mwf-west-european-default.min.css?ver=5.8.2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:2a8::356e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
4f7f4afe26e71fa9ca1dac4a43b557a554a46f53251d849f07ed08a04829d74b

Request headers

Referer
https://assets.onestore.ms/
Origin
https://www.microsoft.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Sat, 11 Dec 2021 13:17:38 GMT
last-modified
Fri, 10 Jan 2020 19:09:43 GMT
etag
"588d483e9c7d51:0"
access-control-allow-methods
GET,POST
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=341428
accept-ranges
bytes
content-length
34052
expires
Wed, 15 Dec 2021 12:08:06 GMT
latest.woff2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/Light/ 		27 KB
27 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/Light/latest.woff2
Requested by
Host: assets.onestore.ms
URL: https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/css/mwf-west-european-default.min.css?ver=5.8.2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:2a8::356e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
fe8a1047376498c80a157d13555e42a92ad480fcb0bcc9de51ad1930fbeb7f91

Request headers

Referer
https://assets.onestore.ms/
Origin
https://www.microsoft.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Sat, 11 Dec 2021 13:17:38 GMT
last-modified
Fri, 10 Jan 2020 19:09:43 GMT
etag
"1282d283e9c7d51:0"
access-control-allow-methods
GET,POST
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=551543
accept-ranges
bytes
content-length
27168
expires
Fri, 17 Dec 2021 22:30:01 GMT
latest.woff2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/Semilight/ 		28 KB
29 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/Semilight/latest.woff2
Requested by
Host: assets.onestore.ms
URL: https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/css/mwf-west-european-default.min.css?ver=5.8.2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:2a8::356e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
6ba0d1a726f1887bd61727b308ed0be0e73edba17d4ad11b91ab19b632e078f6

Request headers

Referer
https://assets.onestore.ms/
Origin
https://www.microsoft.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Sat, 11 Dec 2021 13:17:38 GMT
last-modified
Fri, 10 Jan 2020 19:09:43 GMT
etag
"95edd883e9c7d51:0"
access-control-allow-methods
GET,POST
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=339809
accept-ranges
bytes
content-length
28908
expires
Wed, 15 Dec 2021 11:41:07 GMT
latest.woff2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/Bold/ 		29 KB
30 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/Bold/latest.woff2
Requested by
Host: assets.onestore.ms
URL: https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/css/mwf-west-european-default.min.css?ver=5.8.2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:2a8::356e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
1232bbdbc5d205f3c5a40efa5ed92839c79e7879d5168445cc47645bb93f7d1b

Request headers

Referer
https://assets.onestore.ms/
Origin
https://www.microsoft.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

date
Sat, 11 Dec 2021 13:17:38 GMT
last-modified
Fri, 10 Jan 2020 19:09:42 GMT
etag
"83cce83e9c7d51:0"
access-control-allow-methods
GET,POST
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=309792
accept-ranges
bytes
content-length
30132
expires
Wed, 15 Dec 2021 03:20:50 GMT
Fig1d-Qakbot-attack-chain-building-blocks.png
www.microsoft.com/security/blog/uploads/securityprod/2021/12/ 		43 KB
44 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.microsoft.com/security/blog/uploads/securityprod/2021/12/Fig1d-Qakbot-attack-chain-building-blocks.png
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:2a8::356e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
c3fec6d55e15d4b4a35dfd597dd6041a3b743e97cdf8bdbdac5c930094cfd983
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-ms-blob-type
AppendBlob
date
Sat, 11 Dec 2021 13:17:38 GMT
x-rtag
RT
x-edgeconnect-midmile-rtt
96
tls_version
tls1.3
content-length
44454
x-ms-lease-status
unlocked
last-modified
Thu, 09 Dec 2021 17:32:07 GMT
x-ms-blob-committed-block-count
1
etag
0x8D9BB39D2AC2D6A
strict-transport-security
max-age=31536000
content-type
image/png
x-edgeconnect-origin-mex-latency
139
x-ms-request-id
add7bec3-e01e-0058-1091-eee4c0000000
cache-control
max-age=600, must-revalidate
x-ms-version
2009-09-19
Fig2b-Sample-differences-among-devices.png
www.microsoft.com/security/blog/uploads/securityprod/2021/12/ 		76 KB
76 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.microsoft.com/security/blog/uploads/securityprod/2021/12/Fig2b-Sample-differences-among-devices.png
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:2a8::356e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
baf5b7bc8f3aef81ede4515609975538bdb8e9505840777e7f18cef47e0cc0f9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-ms-blob-type
AppendBlob
date
Sat, 11 Dec 2021 13:17:38 GMT
x-rtag
RT
x-edgeconnect-midmile-rtt
97
tls_version
tls1.3
content-length
77334
x-ms-lease-status
unlocked
last-modified
Wed, 08 Dec 2021 21:52:03 GMT
x-ms-blob-committed-block-count
1
etag
0x8D9BA94F83D6EBF
strict-transport-security
max-age=31536000
content-type
image/png
x-edgeconnect-origin-mex-latency
182
x-ms-request-id
70ba6303-801e-0071-0d91-eedab4000000
cache-control
max-age=600, must-revalidate
x-ms-version
2009-09-19
Fig3-URL-Email-2.png
www.microsoft.com/security/blog/uploads/securityprod/2021/12/ 		43 KB
43 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.microsoft.com/security/blog/uploads/securityprod/2021/12/Fig3-URL-Email-2.png
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:2a8::356e Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
77c3a9bdc2f36d0bdf004aa310b9c9a2f3f167abe0d9cb54c7258da50a9ba65d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.microsoft.com/security/blog/2021/12/09/a-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down/?WT.mc_id=m365-0000-rotrent
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-ms-blob-type
AppendBlob
date
Sat, 11 Dec 2021 13:17:38 GMT
x-rtag
RT
x-edgeconnect-midmile-rtt
96
tls_version
tls1.3
content-length
43677
x-ms-lease-status
unlocked
last-modified
Fri, 10 Dec 2021 00:48:50 GMT
x-ms-blob-committed-block-count
1
etag
0x8D9BB76D50A752F
strict-transport-security
max-age=31536000
content-type
image/png
x-edgeconnect-origin-mex-latency
140
x-ms-request-id
add7bec0-e01e-0058-0d91-eee4c0000000
cache-control
max-age=600, must-revalidate
x-ms-version
2009-09-19
meBoot.min.js
mem.gfx.ms/scripts/me/MeControl/10.21162.3/en-US/ 		155 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://mem.gfx.ms/scripts/me/MeControl/10.21162.3/en-US/meBoot.min.js
Requested by
Host: mem.gfx.ms
URL: https://mem.gfx.ms/meversion?partner=MSSecurity&market=en-us&uhf=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:bdf::60 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
3b75085f340c1918b5255509378c0a49baf27c6bab1563819637803ca119d7d1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Referer
https://www.microsoft.com/
Origin
https://www.microsoft.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
br
x-content-type-options
nosniff
last-modified
Fri, 11 Jun 2021 23:27:58 GMT
x-azure-ref-originshield
0RXm0YQAAAAC5m4e2SkcEQoXpyYXfSSbrQU1TMDRFREdFMTkxNABlYWM1ZjQ5Zi1lMDJkLTRmNDEtYjBhNi0yZDUwZjlmY2Y4NGE=
etag
"1d75f5415e787b6"
x-azure-ref
08qS0YQAAAAA33gkEKfDYQL+PGUZ+Uw0JRlJBRURHRTEwMDgAZWFjNWY0OWYtZTAyZC00ZjQxLWIwYTYtMmQ1MGY5ZmNmODRh
x-cache
TCP_HIT
content-type
application/javascript
access-control-allow-origin
*
date
Sat, 11 Dec 2021 13:17:38 GMT
x-ua-compatible
IE=edge
t.gif
web.vortex.data.microsoft.com/collect/v1/ 		43 B
714 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://web.vortex.data.microsoft.com/collect/v1/t.gif?ver=%272.1%27&name=%27Ms.Webi.OutgoingRequest%27&time=%272021-12-11T13%3A17%3A38.824Z%27&appId=%27JS%3AMeControl%27&cV=%27mWYAvsz%2BvGijUHgc.1%27&flags=2097152&ext-javascript-ver=%271.1%27&ext-javascript-libVer=%274.2.3%27&ext-javascript-domain=%27www.microsoft.com%27&ext-javascript-userConsent=false&ext-app-env=%27Prod%27&-operationName=%27meversion%27&-dependencyOperationName=%27LoadResource%27&-dependencyName=%27MeControl%27&-latencyMs=796&-succeeded=true&-targetUri=%27https%3A%2F%2Fmem.gfx.ms%2Fmeversion%3Fpartner%3D**%26market%3D**%26uhf%3D**%27&*baseType=%27Ms.Qos.OutgoingServiceRequest%27&*pageName=%27None%27&*impressionGuid=%27755e8415-4e98-4496-e6a0-b6cb42a3fa6f%27&*market=%27en-US%27&*customData=%27%7B%22computedDuration%22%3A1019.5%2C%22perfDuration%22%3A796.0999994277954%2C%22metaTags%22%3A%7B%22pgpart%22%3A%22mssecurity%22%7D%2C%22config%22%3A%7B%22ver%22%3A%2210.21162.3%22%2C%22mkt%22%3A%22en-US%22%2C%22ptn%22%3A%22mssecurity%22%2C%22gfx%22%3A%22https%3A%2F%2Fmem.gfx.ms%22%2C%22dbg%22%3Afalse%2C%22aad%22%3Atrue%2C%22int%22%3Afalse%2C%22pxy%22%3Atrue%2C%22msTxt%22%3Afalse%2C%22rwd%22%3Atrue%2C%22telEvs%22%3A%22PageAction%2C%20PageView%2C%20ContentUpdate%2C%20OutgoingRequest%2C%20ClientError%2C%20PartnerApiCall%2C%20TrackedScenario%22%2C%22remAcc%22%3Atrue%2C%22main%22%3A%22meBoot%22%2C%22wrapperId%22%3A%22uhf%22%2C%22cdnRegex%22%3A%22%5E(%3F%3Ahttps%3F%3A%5C%5C%2F%5C%5C%2F)%3F(mem%5C%5C.gfx%5C%5C.ms(%3F!%5C%5C.)%7Ccontrols%5C%5C.account.microsoft%3F(%3F%3A-int%7C-dev)%3F(%5C%5C.com)%3F(%3A%5B0-9%5D%7B1%2C6%7D)%7Camcdn%5C%5C.ms(%3F%3Aft)%3Fauth%5C%5C.net(%3F!%5C%5C.))%22%2C%22timeoutMs%22%3A30000%2C%22graph%22%3Afalse%2C%22aadUrl%22%3A%22https%3A%2F%2Fmyaccount.microsoft.com%22%2C%22msaUrl%22%3A%22https%3A%2F%2Faccount.microsoft.com%2F%22%7D%2C%22url%22%3A%22https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fblog%2F2021%2F12%2F09%2Fa-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down%2F%3FWT.mc_id%3D**%22%2C%22accts%22%3A%220-0%22%7D%27
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
40.77.226.250 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma
no-cache
Date
Sat, 11 Dec 2021 13:17:38 GMT
X-Content-Type-Options
nosniff
P3P
CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
Cache-Control
no-cache, no-store
MS-CV
tTb7/plM60K1AanTXS9c6Q.0
Content-Type
image/gif
Content-Length
43
Expires
0
t.gif
web.vortex.data.microsoft.com/collect/v1/ 		43 B
714 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://web.vortex.data.microsoft.com/collect/v1/t.gif?ver=%272.1%27&name=%27Ms.Webi.OutgoingRequest%27&time=%272021-12-11T13%3A17%3A38.869Z%27&appId=%27JS%3AMeControl%27&cV=%27mWYAvsz%2BvGijUHgc.3%27&flags=2097152&ext-javascript-ver=%271.1%27&ext-javascript-libVer=%274.2.3%27&ext-javascript-domain=%27www.microsoft.com%27&ext-javascript-userConsent=false&ext-app-env=%27Prod%27&-operationName=%27meBoot.min.js%27&-dependencyOperationName=%27DownloadScript%27&-dependencyName=%27MeControl%27&-latencyMs=35&-succeeded=true&-targetUri=%27https%3A%2F%2Fmem.gfx.ms%2Fscripts%2Fme%2FMeControl%2F10.21162.3%2Fen-US%2FmeBoot.min.js%27&*baseType=%27Ms.Qos.OutgoingServiceRequest%27&*pageName=%27None%27&*impressionGuid=%27755e8415-4e98-4496-e6a0-b6cb42a3fa6f%27&*market=%27en-US%27&*customData=%27%7B%22computedDuration%22%3A43%2C%22perfDuration%22%3A34.59999942779541%2C%22metaTags%22%3A%7B%22pgpart%22%3A%22mssecurity%22%7D%2C%22config%22%3A%7B%22ver%22%3A%2210.21162.3%22%2C%22mkt%22%3A%22en-US%22%2C%22ptn%22%3A%22mssecurity%22%2C%22gfx%22%3A%22https%3A%2F%2Fmem.gfx.ms%22%2C%22dbg%22%3Afalse%2C%22aad%22%3Atrue%2C%22int%22%3Afalse%2C%22pxy%22%3Atrue%2C%22msTxt%22%3Afalse%2C%22rwd%22%3Atrue%2C%22telEvs%22%3A%22PageAction%2C%20PageView%2C%20ContentUpdate%2C%20OutgoingRequest%2C%20ClientError%2C%20PartnerApiCall%2C%20TrackedScenario%22%2C%22remAcc%22%3Atrue%2C%22main%22%3A%22meBoot%22%2C%22wrapperId%22%3A%22uhf%22%2C%22cdnRegex%22%3A%22%5E(%3F%3Ahttps%3F%3A%5C%5C%2F%5C%5C%2F)%3F(mem%5C%5C.gfx%5C%5C.ms(%3F!%5C%5C.)%7Ccontrols%5C%5C.account.microsoft%3F(%3F%3A-int%7C-dev)%3F(%5C%5C.com)%3F(%3A%5B0-9%5D%7B1%2C6%7D)%7Camcdn%5C%5C.ms(%3F%3Aft)%3Fauth%5C%5C.net(%3F!%5C%5C.))%22%2C%22timeoutMs%22%3A30000%2C%22graph%22%3Afalse%2C%22aadUrl%22%3A%22https%3A%2F%2Fmyaccount.microsoft.com%22%2C%22msaUrl%22%3A%22https%3A%2F%2Faccount.microsoft.com%2F%22%7D%2C%22url%22%3A%22https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fblog%2F2021%2F12%2F09%2Fa-closer-look-at-qakbots-latest-building-blocks-and-how-to-knock-them-down%2F%3FWT.mc_id%3D**%22%2C%22accts%22%3A%220-0%22%7D%27
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
40.77.226.250 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma
no-cache
Date
Sat, 11 Dec 2021 13:17:38 GMT
X-Content-Type-Options
nosniff
P3P
CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
Cache-Control
no-cache, no-store
MS-CV
/zCsQdCbUkSkW8rJQVZrkw.0
Content-Type
image/gif
Content-Length
43
Expires
0
t.gif
web.vortex.data.microsoft.com/collect/v1/ 		43 B
714 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://web.vortex.data.microsoft.com/collect/v1/t.gif?ver=%272.1%27&name=%27Ms.Webi.MeControl.TrackedScenario%27&time=%272021-12-11T13%3A17%3A38.873Z%27&appId=%27JS%3AMeControl%27&cV=%27mWYAvsz%2BvGijUHgc.5%27&flags=2097152&ext-javascript-ver=%271.1%27&ext-javascript-libVer=%274.2.3%27&ext-javascript-domain=%27www.microsoft.com%27&ext-javascript-userConsent=false&ext-app-env=%27Prod%27&*partner=%27mssecurity%27&*controlVersion=%2710.21162.3%27&*market=%27en-US%27&*scenario=%27Load%27&*action=%27END%27&*previousAction=%27START%27&*success=true&*durationMs=48.69999980926514&*details=%27loadV1%27
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
40.77.226.250 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma
no-cache
Date
Sat, 11 Dec 2021 13:17:38 GMT
X-Content-Type-Options
nosniff
P3P
CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
Cache-Control
no-cache, no-store
MS-CV
8zMm8dI7xECKCJ6cuBtDcQ.0
Content-Type
image/gif
Content-Length
43
Expires
0
me.srf
login.live.com/ Frame 8616 		11 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://login.live.com/me.srf?wa=wsignin1.0&wreply=https%3A%2F%2Fwww.microsoft.com&uaid=908b012a-0f03-4ad8-6184-e8445ccc192a&partnerId=mssecurity
Requested by
Host: mem.gfx.ms
URL: https://mem.gfx.ms/scripts/me/MeControl/10.21162.3/en-US/meBoot.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.190.160.132 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
5a235ccc0efe486cbb58628a419f4077827f592a45b38eb6ab0355a2ddfb5b86
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Accept-Language
de-DE,de;q=0.9
Referer
https://www.microsoft.com/

Response headers

Cache-Control
no-store, no-cache
Pragma
no-cache
Content-Type
text/html; charset=utf-8
Content-Encoding
deflate
Expires
Sat, 11 Dec 2021 13:16:39 GMT
Vary
Accept-Encoding
P3P
CP="DSP CUR OTPi IND OTRi ONL FIN"
X-DNS-Prefetch-Control
on
Link
<https://acctcdn.msauth.net>; rel=preconnect; crossorigin <https://logincdn.msauth.net>; rel=preconnect; crossorigin <https://acctcdn.msauth.net/>; rel=dns-prefetch <https://acctcdn.msftauth.net/>; rel=dns-prefetch <https://acctcdnmsftuswe2.azureedge.net/>; rel=dns-prefetch <https://acctcdnvzeuno.azureedge.net/>; rel=dns-prefetch <https://logincdn.msauth.net/>; rel=dns-prefetch <https://lgincdnvzeuno.azureedge.net/>; rel=dns-prefetch <https://lgincdnmsftuswe2.azureedge.net/>; rel=dns-prefetch
Referrer-Policy
strict-origin-when-cross-origin
x-ms-route-info
R3_BL2
x-ms-request-id
4eea1529-c3fe-4d86-862a-261899b95906
PPServer
PPV: 30 H: BL02PF40B61B581 V: 0
X-Content-Type-Options
nosniff
Strict-Transport-Security
max-age=31536000
X-XSS-Protection
1; mode=block
Date
Sat, 11 Dec 2021 13:17:39 GMT
Content-Length
4792
meCore.min.js
mem.gfx.ms/scripts/me/MeControl/10.21162.3/en-US/ 		100 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://mem.gfx.ms/scripts/me/MeControl/10.21162.3/en-US/meCore.min.js
Requested by
Host: mem.gfx.ms
URL: https://mem.gfx.ms/meversion?partner=MSSecurity&market=en-us&uhf=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:bdf::60 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
2cad4e1d97b0c13e50f1a741c96d6fda8e7908afe66eb23ce73059869afe5dbb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Referer
https://www.microsoft.com/
Origin
https://www.microsoft.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
br
x-content-type-options
nosniff
last-modified
Fri, 11 Jun 2021 23:28:02 GMT
x-azure-ref-originshield
0c4u0YQAAAADSlUW1SUTKSZ81mqSZ7/ONQU1TMDRFREdFMTkxOQBlYWM1ZjQ5Zi1lMDJkLTRmNDEtYjBhNi0yZDUwZjlmY2Y4NGE=
etag
"1d75f541849cb40"
x-azure-ref
08qS0YQAAAADA6Ju3vVS0TKUjpD7NcHBnRlJBRURHRTEwMDgAZWFjNWY0OWYtZTAyZC00ZjQxLWIwYTYtMmQ1MGY5ZmNmODRh
x-cache
TCP_HIT
content-type
application/javascript
access-control-allow-origin
*
date
Sat, 11 Dec 2021 13:17:38 GMT
x-ua-compatible
IE=edge
truncated
/ 		358 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ee2b841529e5d06aeae7f65b413b40bbfef5161c9fad9a8a1755dac03806291b

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
RE4xdax
img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4xdax
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2a02:26f0:6c00::210:ba1b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
2176784dfc7c4beeacaecacbbc6b7a1f2f281f17ff0a3c644909c3b3849ed01e
Security Headers
Name Value
X-Frame-Options deny

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

timing-allow-origin
*
date
Sat, 11 Dec 2021 13:17:38 GMT
last-modified
Fri, 10 Dec 2021 06:34:43 GMT
x-datacenter
northeu
x-source-length
3094
x-frame-options
deny
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=321480
x-activityid
9575dfb5-2b77-4f8e-b742-124105d4337a
x-resizerversion
1.0
x-deployment
a89a5014e89c41b7b60a64d7ee950637
content-location
https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4xdax
content-length
3094
expires
Wed, 15 Dec 2021 06:35:38 GMT
t.gif
web.vortex.data.microsoft.com/collect/v1/ 		43 B
714 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://web.vortex.data.microsoft.com/collect/v1/t.gif?ver=%272.1%27&name=%27Ms.Webi.MeControl.TrackedScenario%27&time=%272021-12-11T13%3A17%3A38.920Z%27&appId=%27JS%3AMeControl%27&cV=%27mWYAvsz%2BvGijUHgc.6%27&flags=2097152&ext-javascript-ver=%271.1%27&ext-javascript-libVer=%274.2.3%27&ext-javascript-domain=%27www.microsoft.com%27&ext-javascript-userConsent=false&ext-app-env=%27Prod%27&*partner=%27mssecurity%27&*controlVersion=%2710.21162.3%27&*market=%27en-US%27&*scenario=%27Interactive%27&*action=%27END%27&*previousAction=%27START%27&*success=true&*durationMs=95.30000019073486&*details=%27Web%20header%27
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
40.77.226.250 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept-Language
de-DE,de;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

Pragma
no-cache
Date
Sat, 11 Dec 2021 13:17:38 GMT
X-Content-Type-Options
nosniff
P3P
CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
Cache-Control
no-cache, no-store
MS-CV
lNliDhCWA0Gng6kJMkg30g.0
Content-Type
image/gif
Content-Length
43
Expires
0
v1
web.vortex.data.microsoft.com/collect/ 		0
0 		Ping
General
Check archive.org
Download Go to
Full URL
https://web.vortex.data.microsoft.com/collect/v1
Requested by
Host: mem.gfx.ms
URL: https://mem.gfx.ms/scripts/me/MeControl/10.21162.3/en-US/meCore.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
40.77.226.250 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.microsoft.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers
MeControl_zPp2WpCx9bWbP0Ao4Gk31A2.js
logincdn.msauth.net/16.000/content/js/ Frame 8616 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://logincdn.msauth.net/16.000/content/js/MeControl_zPp2WpCx9bWbP0Ao4Gk31A2.js
Requested by
Host: login.live.com
URL: https://login.live.com/me.srf?wa=wsignin1.0&wreply=https%3A%2F%2Fwww.microsoft.com&uaid=908b012a-0f03-4ad8-6184-e8445ccc192a&partnerId=mssecurity
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
192.229.221.185 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8F68) /
Resource Hash
28e42fcf1b224cb44a7183060141427e48cef4f1c30009f706ddfb27cdcfc9a6

Request headers

Referer
https://login.live.com/
Origin
https://login.live.com
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Sat, 11 Dec 2021 13:17:39 GMT
content-encoding
gzip
content-md5
1otx0KUs5E5nFEFjzdlTOA==
age
1110520
x-cache
HIT
content-length
6041
x-ms-lease-status
unlocked
last-modified
Thu, 25 Nov 2021 06:30:20 GMT
server
ECAcc (frc/8F68)
etag
0x8D9AFDD0E0BCF5A
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
d49272ea-601e-003a-0277-e435be000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
accept-ranges
bytes
/
browser.events.data.microsoft.com/OneCollector/1.0/ 		153 B
548 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://browser.events.data.microsoft.com/OneCollector/1.0/?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.1.9&apikey=cb68b8f590184975aa5eb4ed576fb074-e666ac9b-fa31-4339-8b9c-775f4bae31f3-6978&upload-time=1639228659709&time-delta-to-apply-millis=use-collector-delta&w=0
Requested by
Host: js.monitor.azure.com
URL: https://js.monitor.azure.com/scripts/c/ms.analytics-web-3.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.42.65.85 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-HTTPAPI/2.0 /
Resource Hash
74e155d4f905cb2368b4a2881e8f24db7f055f218014279a8d7406bbb0b7fb68

Request headers

cache-control
no-cache, no-store
Referer
https://www.microsoft.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
content-type
application/x-json-stream

Response headers

Date
Sat, 11 Dec 2021 13:17:39 GMT
Server
Microsoft-HTTPAPI/2.0
time-delta-millis
724
Access-Control-Allow-Methods
POST
Content-Type
application/json
Access-Control-Allow-Origin
https://www.microsoft.com
Access-Control-Expose-Headers
time-delta-millis
Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
time-delta-millis
Content-Length
153
/
browser.events.data.microsoft.com/OneCollector/1.0/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://browser.events.data.microsoft.com/OneCollector/1.0/?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.1.9&apikey=cb68b8f590184975aa5eb4ed576fb074-e666ac9b-fa31-4339-8b9c-775f4bae31f3-6978&upload-time=1639228659709&time-delta-to-apply-millis=use-collector-delta&w=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.42.65.85 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-HTTPAPI/2.0 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
cache-control,content-type
Origin
https://www.microsoft.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

Content-Length
0
Server
Microsoft-HTTPAPI/2.0
Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
AuthMsaDeviceTicket,Content-Encoding,Content-Type,Cache-Control
Access-Control-Max-Age
3600
Access-Control-Allow-Origin
https://www.microsoft.com
Date
Sat, 11 Dec 2021 13:17:39 GMT
/
browser.events.data.microsoft.com/OneCollector/1.0/ 		153 B
548 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://browser.events.data.microsoft.com/OneCollector/1.0/?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.1.9&apikey=cb68b8f590184975aa5eb4ed576fb074-e666ac9b-fa31-4339-8b9c-775f4bae31f3-6978&upload-time=1639228660711&time-delta-to-apply-millis=724&w=0
Requested by
Host: js.monitor.azure.com
URL: https://js.monitor.azure.com/scripts/c/ms.analytics-web-3.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.42.65.85 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-HTTPAPI/2.0 /
Resource Hash
f3a7bfc1f7901f08d5222f152e4c8a2f3d8650e06d8385a9dfc29d155c21f512

Request headers

cache-control
no-cache, no-store
Referer
https://www.microsoft.com/
Accept-Language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
content-type
application/x-json-stream

Response headers

Date
Sat, 11 Dec 2021 13:17:39 GMT
Server
Microsoft-HTTPAPI/2.0
time-delta-millis
144
Access-Control-Allow-Methods
POST
Content-Type
application/json
Access-Control-Allow-Origin
https://www.microsoft.com
Access-Control-Expose-Headers
time-delta-millis
Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
time-delta-millis
Content-Length
153
/
browser.events.data.microsoft.com/OneCollector/1.0/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://browser.events.data.microsoft.com/OneCollector/1.0/?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.1.9&apikey=cb68b8f590184975aa5eb4ed576fb074-e666ac9b-fa31-4339-8b9c-775f4bae31f3-6978&upload-time=1639228660711&time-delta-to-apply-millis=724&w=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.42.65.85 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-HTTPAPI/2.0 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
cache-control,content-type
Origin
https://www.microsoft.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.93 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

Content-Length
0
Server
Microsoft-HTTPAPI/2.0
Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
AuthMsaDeviceTicket,Content-Encoding,Content-Type,Cache-Control
Access-Control-Max-Age
3600
Access-Control-Allow-Origin
https://www.microsoft.com
Date
Sat, 11 Dec 2021 13:17:40 GMT

Verdicts & Comments Add Verdict or Comment

51 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect function| reportError boolean| originAgentCluster object| scheduler object| _wpemojiSettings function| WcpConsent function| mscc function| $ function| jQuery object| mwf object| html5 object| Modernizr object| picturefillCFG function| picturefill object| e function| t object| oneDS string| _linkedin_data_partner_id function| linkedinTracking function| onConsentChanged function| dropAnalyticsCookies function| dropAdvertisingCookies function| dropSocialMediaCookies object| siteConsent object| addthis_config object| config object| WDSMS_SearchWP object| mwfAutoInit function| EvEmitter function| imagesLoaded function| jQueryBridget function| getSize function| matchesSelector object| fizzyUIUtils function| Outlayer function| Masonry object| wdsWrapBrands object| wdsEmDashFix object| wdsPostFilterToggle object| WDSSinglePostListMarkupObject object| wdsStickyAudioPlayer object| windowReady object| microsoftUhfSettings object| onShellReadyToLoad object| wp object| MSA object| MeControl function| MeControlDefine function| MeControlImport object| msCommonShell object| twemoji

8 Cookies

Domain/Path Name / Value
.microsoft.com/ Name: ak_bmsc
Value: 8447802740BFF6C5F3A2CDBC0919C383~000000000000000000000000000000~YAAQlboQAmwZBJ59AQAAc1CkqQ4NTAPg+517OfhzPs04NKfSAtRncaB15LtRDKrHGAJ1pR3IORgEODBp68zU18ktY6neYq+2+H70TqPz1XGhZ+C6puNQTQLNhNWd4n8gXS7/94GgRSeC+pJ2J5325iX4MXjckOdMPQ4vjn9X3tF+cXIdnOFESJmkv6/JzR5ZOKvRSrSI16dsGmJAW61vA4Bw2HiVyfJw3GjIwwXwV62J4jTSdFjsqIjAvBR9jEh6RN6MZh8raGIq+S2Pjsd9rxAL4QOGLGVfnY/YjOJiS8gRcv+Klgwksoskg5ySE2lGzE6y5TC6Sr9rgeTn5mvcJgYW6FfA3ioAlSqFgjc+ya/qzQy3N+K43bMrbpgquYxQKWI/qi7qkWG+VGggKIICcNIV+g==
www.microsoft.com/ Name: MicrosoftApplicationsTelemetryDeviceId
Value: 2feea5b7-d2b2-4987-9545-8563184f13e4
www.microsoft.com/ Name: ai_session
Value: 3Fov/aYnJiUA2qUxXI28jA|1639228658705|1639228658705
.microsoft.com/ Name: MC1
Value: GUID=941e2b00d43049b882d3194b0ab7e0ec&HASH=941e&LV=202112&V=4&LU=1639228659022
.microsoft.com/ Name: MS0
Value: 98c49a5dcbe4455888f9e0fef5e44769
.login.live.com/ Name: uaid
Value: 908b012a0f034ad86184e8445ccc192a
.login.live.com/ Name: MSPRequ
Value: id=N&lt=1639228659&co=1
www.microsoft.com/ Name: MSFPC
Value: GUID=941e2b00d43049b882d3194b0ab7e0ec&HASH=941e&LV=202112&V=4&LU=1639228659022

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.onestore.ms
browser.events.data.microsoft.com
c.s-microsoft.com
cda.ms
img-prod-cms-rt-microsoft-com.akamaized.net
js.monitor.azure.com
login.live.com
logincdn.msauth.net
mem.gfx.ms
statics-marketingsites-eus-ms-com.akamaized.net
wcpstatic.microsoft.com
web.vortex.data.microsoft.com
www.microsoft.com
192.229.221.185
2.16.186.9
20.190.160.132
20.42.65.85
2606:4700:3035::6815:26ca
2620:1ec:bdf::60
2a02:26f0:6c00:281::2957
2a02:26f0:6c00:2a8::356e
2a02:26f0:6c00::210:ba1b
40.77.226.250
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
0bd288d5397a69ead391875b422bf2cbdcc4f795d64aa2f780aff45768d78248
112fec798b78aa02e102a724b5cb1990c0f909bc1d8b7b1fa256eab41bbc0960
1232bbdbc5d205f3c5a40efa5ed92839c79e7879d5168445cc47645bb93f7d1b
14a4adf73b2321dc93c086220de872f8b4d0f2aaee05d9e59dd9a971b2668590
16d6e957a9525cb4848051b0efc5aa101d256a3c6838007dc4ac2c41121eaade
208edbed32b2adac9446df83caa4a093a261492ba6b8b3bcfe6a75efb8b70294
2176784dfc7c4beeacaecacbbc6b7a1f2f281f17ff0a3c644909c3b3849ed01e
22b4df5c33045b645cafa45b04685f4752e471a2e933bff5bf14324d87deee12
28e42fcf1b224cb44a7183060141427e48cef4f1c30009f706ddfb27cdcfc9a6
2bf73ba8c24162c4cfd51b3b508b2bc0f8ee00cab13bec8f32b6fb6359be7d17
2cad4e1d97b0c13e50f1a741c96d6fda8e7908afe66eb23ce73059869afe5dbb
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
356bc500cf97efc5abf3a664ae484323037e56191650abf721e5e513c16278fc
3b75085f340c1918b5255509378c0a49baf27c6bab1563819637803ca119d7d1
4919e80f038d2b93f1184d1733ac35009643481735c7bc7aa31d8b56e118fc04
4b77438786a8f55a4616725434b1df15692130c6b3ee07b3a4d241ff30f42c62
4f7f4afe26e71fa9ca1dac4a43b557a554a46f53251d849f07ed08a04829d74b
556d027670db9b0dca02802e45d26811d5d83955bbb911ea7c47213007c25f0b
5a235ccc0efe486cbb58628a419f4077827f592a45b38eb6ab0355a2ddfb5b86
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991
6b3d6fcf9d64c863b85f7387db0153b3bcc6e5d3014d71ebde4ebe56562fdc3a
6ba0d1a726f1887bd61727b308ed0be0e73edba17d4ad11b91ab19b632e078f6
707c5b510b5712a82fd8bdf073a6d9860583931ee85f6ee7e2e735e81ae05d18
74e155d4f905cb2368b4a2881e8f24db7f055f218014279a8d7406bbb0b7fb68
77c3a9bdc2f36d0bdf004aa310b9c9a2f3f167abe0d9cb54c7258da50a9ba65d
893fa7fe8b6e69e2828319c04a7cbb6f129ea820db695d4ced5757d59450b6a8
9110fc122dda3067c424d9b8ff7747e2030b0bd9298f69a3683d399ad3373a6a
b1d83c2d49c49ea38d578afa752aaec44a86d069d6ce2d54460e2612fc31a102
b201ab52de2c92539f7a276b6cf170b1bdf0f3705f1b6ab9597517d030afefe4
b2ba90e09a9efd1cda6c16ed4204b5f179546fbc55a501e4780412b492c7aad7
b35e54289651f334c35a573e43a36a4726b34ee94bb4521aacd452cc02314a77
b828b15e9b7836b493a8bd6e832a24ee13aa8b6f8b4a1bf307a7af2912014178
baf5b7bc8f3aef81ede4515609975538bdb8e9505840777e7f18cef47e0cc0f9
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
c3fec6d55e15d4b4a35dfd597dd6041a3b743e97cdf8bdbdac5c930094cfd983
cffbae450bcad74d65019c0aa2bada046cdcf5f5fa4af699929838f58c7ff8c2
d87d0a7a7fe2c36d1dc093bfe56e9b81b311988789dbd3b65abf811d551ef02f
def5de6254be138b8b35d680d1fdd8b07827d03b8626daebfeeb4157ec330ea7
e00add38134eac2fb8e8e9c09cbfff7bbe57952b210322eb2eecb0a21fc055eb
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ea8699db20b0926cdc14b558972ecf6bbcba843b361ac10a79ff4f274bbaacbf
ee2b841529e5d06aeae7f65b413b40bbfef5161c9fad9a8a1755dac03806291b
f174b3ce00dc0ef25fe0867dae1da92a595c50f730dbe2cd1fd7f29546034e81
f258c099e2bb029f6c9d5e9900a78f53347a16b43aa1e37a9f9c1a1539e0748d
f2a28cd82e7ec00d2d8158f21fb0507722cd8b09fa4a0a16fadc58f30385cc25
f3a7bfc1f7901f08d5222f152e4c8a2f3d8650e06d8385a9dfc29d155c21f512
f486a12dd7b2ca407e24b8ebd35c4889a4a97d41d08c20b90495144375ff1ece
fd47060008f59c6245fbce0876ff3b0149daff5e9d3f17fcc0c4d2cb40e45914
fe8a1047376498c80a157d13555e42a92ad480fcb0bcc9de51ad1930fbeb7f91
ff4bd34aa98a0214833619d3d751838db015722dfbbec15cd14dadc66cd67869