www.obsidiansecurity.com Open in urlscan Pro
35.202.211.50  Public Scan

11 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 112

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2390244&time=1686190306333&url=https%3A%2F%2Fwww.obsidiansecurity.com%2Fblog%2Fsaas-ransomware-observed-sharepoint-microsoft-365%2F HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2390244&time=1686190306333&url=https%3A%2F%2Fwww.obsidiansecurity.com%2Fblog%2Fsaas-ransomware-observed-sharepoint-microsoft-365%2F&cookiesTest=true HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D2390244%26time%3D1686190306333%26url%3Dhttps%253A%252F%252Fwww.obsidiansecurity.com%252Fblog%252Fsaas-ransomware-observed-sharepoint-microsoft-365%252F%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2390244&time=1686190306333&url=https%3A%2F%2Fwww.obsidiansecurity.com%2Fblog%2Fsaas-ransomware-observed-sharepoint-microsoft-365%2F&cookiesTest=true&liSync=true HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2390244&time=1686190306333&url=https%3A%2F%2Fwww.obsidiansecurity.com%2Fblog%2Fsaas-ransomware-observed-sharepoint-microsoft-365%2F&cookiesTest=true&liSync=true&e_ipv6=AQKIZOwn9CpIaAAAAYiYxjdNJDjgX6orypMUb-pN4Q5OTmVv8cTdweGlFxAG3AAcSmDY5eUjYKvVhvZ1Hx0qr1WR5QDOKA

Request Chain 117

• https://s.adroll.com/j/exp/R4IJVMDLKJFKTCAMPUMTWD/index.js HTTP 302
• https://s.adroll.com/j/exp/index.js

128 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request / Show response www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/	124 KB 25 KB	610ms 178ms	Document text/html	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / WP Engine Resource Hash 22bdb01cdbace9739bb4a98432fd088c0d48506e9b3000ee74f3d3ca43dd7103 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers cache-control max-age=600, must-revalidate content-encoding br content-security-policy upgrade-insecure-requests content-type text/html; charset=UTF-8 date Thu, 08 Jun 2023 02:11:45 GMT link <https://www.obsidiansecurity.com/?p=8185>; rel=shortlink permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=() referrer-policy strict-origin-when-cross-origin server nginx strict-transport-security max-age=63072000; includeSubDomains; preload vary Accept-Encoding Accept-Encoding Accept-Encoding Accept-Encoding,Cookie x-cache HIT: 8 x-cache-group normal x-cacheable SHORT x-content-type-options nosniff x-frame-options DENY x-powered-by WP Engine x-xss-protection “1; mode=block”
GET H2	200	js Show response www.googletagmanager.com/gtag/	264 KB 88 KB	53ms 21ms	Script application/javascript	2a00:1450:4001:811::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-XESBQ81H1M Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash f460a2bc163bc932f916f79ab10aa33fa49781234cd68a60fb0c682121dd523b Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:45 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin access-control-allow-headers Cache-Control content-length 90074 x-xss-protection 0 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 expires Thu, 08 Jun 2023 02:11:45 GMT
GET H2	200	loader.js Show response assets.adoberesources.net/	4 KB 2 KB	94ms 8ms	Script application/x-javascript	2a02:26f0:480:99e::1e80 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://assets.adoberesources.net/loader.js?orgId=A01C1D3E624B03520A495E0F%40AdobeOrg&instanceId=obsidiansecurity&env=prod&geo=va7 Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:480:99e::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AkamaiNetStorage / Resource Hash bf8bf29b001b7f9deec70159cdaa51b4546220b5edf01773b29a8689e6ba7c71 Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:45 GMT content-encoding gzip last-modified Fri, 19 May 2023 16:46:57 GMT server AkamaiNetStorage etag "ab4cae9b2350b7f722cc05eda506fb55:1684514817.741548" vary Accept-Encoding content-type application/x-javascript cache-control max-age=585 server-timing ak_p; desc="1686190305571_388391874_43690273_17_413_6_16_219";dur=1 accept-ranges bytes content-length 1860 expires Thu, 08 Jun 2023 02:21:30 GMT
GET H2	200	style.min.css www.obsidiansecurity.com/wp-includes/css/dist/block-library/	95 KB 13 KB	145ms 138ms	Stylesheet text/css	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-includes/css/dist/block-library/style.min.css Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash aca566587618e75fa291a419c7c430be02e03fc72f6105658c1bc8e7d59a65e4 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:45 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:43 GMT server nginx etag W/"6480806b-17ced" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options DENY content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	style.min.css www.obsidiansecurity.com/wp-includes/css/dist/components/	81 KB 13 KB	161ms 155ms	Stylesheet text/css	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-includes/css/dist/components/style.min.css Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 072799c158a63f494abfbb8c4a0a7f1322029d531192c34092b88ddfdf693b2d Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:45 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:43 GMT server nginx etag W/"6480806b-14573" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options DENY content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	style.min.css www.obsidiansecurity.com/wp-includes/css/dist/block-editor/	106 KB 15 KB	162ms 155ms	Stylesheet text/css	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-includes/css/dist/block-editor/style.min.css Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash c952c87aaaae1786be3071abeadc6091a1f91f6df1381881cc204861cf770686 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:45 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:43 GMT server nginx etag W/"6480806b-1a9c5" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options DENY content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	style.min.css www.obsidiansecurity.com/wp-includes/css/dist/nux/	3 KB 1 KB	138ms 132ms	Stylesheet text/css	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-includes/css/dist/nux/style.min.css Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 05515f88d6473791cc2f54474a737327181ca00c0705ff3fdad4e54d752e2eda Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:45 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:43 GMT server nginx etag W/"6480806b-afb" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options DENY content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	style.min.css www.obsidiansecurity.com/wp-includes/css/dist/reusable-blocks/	525 B 765 B	145ms 138ms	Stylesheet text/css	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-includes/css/dist/reusable-blocks/style.min.css Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 42ba9fce886a47d0d12947516f0f091c73df4f1cc62e2cd443ff2c5a34ee9647 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:45 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:43 GMT server nginx etag W/"6480806b-20d" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options DENY content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	style.min.css www.obsidiansecurity.com/wp-includes/css/dist/editor/	18 KB 4 KB	162ms 156ms	Stylesheet text/css	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-includes/css/dist/editor/style.min.css Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash ed852397438aaf550af851196ec9b93418caf8b12b1acac0c6bb371265f0602c Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:45 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:43 GMT server nginx etag W/"6480806b-463c" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options DENY content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	blocks.style.build.css www.obsidiansecurity.com/wp-content/plugins/advanced-code-block/dist/	56 B 525 B	169ms 163ms	Stylesheet text/css	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-content/plugins/advanced-code-block/dist/blocks.style.build.css Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 22a250275e5b2733922275f94410ffd1603df51cba0d6b430d4b54bb79d8cc23 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:45 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:05:05 GMT server nginx etag W/"64808081-38" vary Accept-Encoding, Accept-Encoding x-frame-options DENY content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	blocks.style.build.css www.obsidiansecurity.com/wp-content/plugins/custom-css-block/dist/	142 B 581 B	140ms 134ms	Stylesheet text/css	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-content/plugins/custom-css-block/dist/blocks.style.build.css Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash e6ad9a7acc36e9b5bca31cc19adff9807ae4da1a07f9d54402fbb3515965bef3 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:45 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:05:03 GMT server nginx etag W/"6480807f-8e" vary Accept-Encoding, Accept-Encoding x-frame-options DENY content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	blocks.style.build.css www.obsidiansecurity.com/wp-content/plugins/bootstrap-blocks/dist/	16 KB 2 KB	162ms 157ms	Stylesheet text/css	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-content/plugins/bootstrap-blocks/dist/blocks.style.build.css Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 67b183e12e64636a0fec6523aa94653dc83d3630dc9a3d5a843b1bd47d16ad2c Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:45 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:05:05 GMT server nginx etag W/"64808081-3ea7" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options DENY content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	style-coblocks-1.css www.obsidiansecurity.com/wp-content/plugins/coblocks/dist/	266 KB 35 KB	374ms 368ms	Stylesheet text/css	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-content/plugins/coblocks/dist/style-coblocks-1.css Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 9e348a28158bf359c0a430a38317a407e417b901a2e492836a8410cfdffc9afd Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:45 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:05:03 GMT server nginx etag W/"6480807f-426cb" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options DENY content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	blocks.style.build.css www.obsidiansecurity.com/wp-content/plugins/gutenberg-section-block-master/dist/	790 B 770 B	374ms 369ms	Stylesheet text/css	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-content/plugins/gutenberg-section-block-master/dist/blocks.style.build.css Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 3aeaa1339a0042bc03e0be5ccebfba7677285791a0f3e4c7285bb3242373499a Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:45 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:05:01 GMT server nginx etag W/"6480807d-316" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options DENY content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	classic-themes.min.css www.obsidiansecurity.com/wp-includes/css/	291 B 691 B	375ms 370ms	Stylesheet text/css	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-includes/css/classic-themes.min.css Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash dcd9f488bd62ba0ee403b07a97e40b9ffd63a0eff61091588c913b16d5153d48 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:45 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:43 GMT server nginx etag W/"6480806b-123" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options DENY content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	admin.css www.obsidiansecurity.com/wp-content/themes/obsidian/assets/css/	1 KB 1 KB	375ms 370ms	Stylesheet text/css	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-content/themes/obsidian/assets/css/admin.css Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 762a7a23e3b686f394d0c16ecf739f66a23dd729b6f7115294fe56168e14c079 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:45 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:57 GMT server nginx etag W/"64808079-574" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options DENY content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	style.css www.obsidiansecurity.com/wp-content/themes/obsidian/assets/css/	562 KB 71 KB	374ms 369ms	Stylesheet text/css	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-content/themes/obsidian/assets/css/style.css Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 87f40a868a9ccc41ae206d44a83aebe58fa65ee939c645973a09f1c86bfffaa6 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:45 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:57 GMT server nginx etag W/"64808079-8c800" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options DENY content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	latest.css www.obsidiansecurity.com/wp-content/plugins/coblocks/includes/Dependencies/GoDaddy/Styles/build/	13 KB 2 KB	375ms 370ms	Stylesheet text/css	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-content/plugins/coblocks/includes/Dependencies/GoDaddy/Styles/build/latest.css Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 470b8fe4451dab1ff2c7edeeb3091a932188b7acaa06d7e7187f9dd90947a553 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:45 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:05:03 GMT server nginx etag W/"6480807f-3256" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options DENY content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	all.css pro.fontawesome.com/releases/v5.15.4/css/	170 KB 32 KB	79ms 24ms	Stylesheet text/css	2606:4700::6812:1734 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://pro.fontawesome.com/releases/v5.15.4/css/all.css Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1734 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 89b2462070a1a639c693794bc1d8d9131e6eb9274fc7fb0fb854943e58940a22 Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:45 GMT content-encoding gzip cf-cache-status HIT last-modified Wed, 04 Aug 2021 20:57:37 GMT server cloudflare x-amz-request-id 47YKB7D0872EWT03 age 1330763 etag W/"21f9f9f41222c9f2acec907529ea35a1" vary Accept-Encoding content-type text/css cache-control max-age=31556926 cf-ray 7d3d9b21bd3a036e-FRA x-amz-id-2 oRJq86dea/KGmbVY8dBK628zmXJ2Gxs3ylC8DnZI4c8R5o2R9Y3AggR5sbNtxtH6RQmMHfGvypx270z+VrHD5g==
GET H2	200	css fonts.googleapis.com/	2 KB 837 B	45ms 20ms	Stylesheet text/css	2a00:1450:4001:829::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css?family=Lato%3A300%2C400%2C700 Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 4ea2880bbb5055eb6493499d243a86911663924955d78ac35d672a5a0e9995ae Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Thu, 08 Jun 2023 02:11:45 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Thu, 08 Jun 2023 01:17:13 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Thu, 08 Jun 2023 02:11:45 GMT
GET H2	200	featherlight.min.css www.obsidiansecurity.com/wp-content/themes/obsidian/assets/css/vendor/	2 KB 1 KB	375ms 371ms	Stylesheet text/css	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-content/themes/obsidian/assets/css/vendor/featherlight.min.css Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash bc462b8920124b34fffa9f466debcfb0e097317ed6b76b73a547ad39c374fe34 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:45 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:57 GMT server nginx etag W/"64808079-74c" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options DENY content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	swiper.min.css www.obsidiansecurity.com/wp-content/themes/obsidian/assets/css/vendor/	14 KB 4 KB	376ms 371ms	Stylesheet text/css	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-content/themes/obsidian/assets/css/vendor/swiper.min.css Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 237babeccd762beff64357fa5e8b830292020d84cd55e74dd85233291ffdb538 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:45 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:57 GMT server nginx etag W/"64808079-366f" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options DENY content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	colorbox.css www.obsidiansecurity.com/wp-content/themes/obsidian/assets/css/vendor/colorbox/	4 KB 2 KB	376ms 372ms	Stylesheet text/css	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-content/themes/obsidian/assets/css/vendor/colorbox/colorbox.css Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash ffb2f2d99b0c239c9f6d40069d5d31aebbe1544fe5e3195b4444236abcaed3a6 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:45 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:57 GMT server nginx etag W/"64808079-117a" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options DENY content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	acf-page-hero-block.css www.obsidiansecurity.com/wp-content/themes/obsidian/assets/css/blocks/	5 KB 2 KB	376ms 372ms	Stylesheet text/css	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-content/themes/obsidian/assets/css/blocks/acf-page-hero-block.css Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 09e998a569c1bc6081a9d74f0c9ebce42f1cd65d0a6c3772138be0134f10e295 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:45 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:57 GMT server nginx etag W/"64808079-12f7" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options DENY content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	default.min.css cdnjs.cloudflare.com/ajax/libs/highlight.js/9.15.8/styles/	775 B 935 B	35ms 15ms	Stylesheet text/css	2606:4700::6811:180e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/highlight.js/9.15.8/styles/default.min.css Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash cdcba7a929f59658000da20f172ceb43c5122235f6569bb11f3530622b0ec28f Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:45 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 10960918 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 271 last-modified Mon, 04 May 2020 16:10:34 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03e7a-307" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=H3NxBpOwMaNEBaLJMTeaDKfTO3ZNkYiI%2BoTAwZpOnWQnqbfcwYAzKT7dYvCUq6l5XviEMpXKLFQU0muGP%2BiqncQjg1%2FWpsVItCyhCSawr7mPzh3UrMGPmqsba0tW8pET4Df19Xzx2Xp2hfsUwVaWa3cY"}],"group":"cf-nel","max_age":604800} content-type text/css; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 7d3d9b218abd190f-FRA expires Tue, 28 May 2024 02:11:45 GMT
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/3.3.1/	85 KB 30 KB	32ms 7ms	Script text/javascript	2a00:1450:4001:812::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Wed, 07 Jun 2023 08:01:23 GMT content-encoding gzip x-content-type-options nosniff age 65422 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 30399 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Thu, 06 Jun 2024 08:01:23 GMT
GET H2	200	lottie.min.js Show response www.obsidiansecurity.com/wp-content/themes/obsidian/assets/js/vendor/	246 KB 64 KB	376ms 372ms	Script application/javascript	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-content/themes/obsidian/assets/js/vendor/lottie.min.js Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash b55a739eaa8aac4c3143890f1d95b81d1fa2fcc466b861c4a339015e6d43312b Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:45 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:57 GMT server nginx etag W/"64808079-3d928" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options DENY content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	lottie_light.min.js Show response www.obsidiansecurity.com/wp-content/themes/obsidian/assets/js/vendor/	149 KB 42 KB	376ms 373ms	Script application/javascript	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-content/themes/obsidian/assets/js/vendor/lottie_light.min.js Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 551f06b30d8a34cc31a0b455d08732f249c0c974233b2b98a2ec8b2d9fda286d Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:45 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:57 GMT server nginx etag W/"64808079-252da" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options DENY content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	front.js Show response www.obsidiansecurity.com/wp-content/plugins/wp-security-hardening/modules/js/	59 B 540 B	377ms 373ms	Script application/javascript	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-content/plugins/wp-security-hardening/modules/js/front.js Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash c33275705e60d7f9f4ed1667e4ca1ad0ba8acf6036d74538670467be8dad7f81 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:45 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:57 GMT server nginx etag W/"64808079-3b" vary Accept-Encoding, Accept-Encoding x-frame-options DENY content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	tags.js Show response tag.clearbitscripts.com/v1/pk_b3e5b8359fbae511329400f112b1c0c6/	3 KB 1 KB	330ms 293ms	Script application/javascript	2600:9000:214f:a400:7:d7d6:3c40:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tag.clearbitscripts.com/v1/pk_b3e5b8359fbae511329400f112b1c0c6/tags.js Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:214f:a400:7:d7d6:3c40:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software envoy / Resource Hash b2e2364863cb636abb4b8fb38ecb0651c57caed16721c52762720726fffd8e90 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:45 GMT content-encoding gzip x-content-type-options nosniff x-envoy-response-flags - via 1.1 660f4277d8fbef27985e8a4a97e362cc.cloudfront.net (CloudFront) server envoy strict-transport-security max-age=63072000; includeSubDomains; preload x-amz-cf-pop FRA53-C1 etag W/"d41cd6dc622c85f163344352e727a65f" vary Accept-Encoding x-cache Miss from cloudfront content-type application/javascript;charset=utf-8 cache-control private, max-age=600 x-amz-cf-id i2a1iTd2wR9OmzjIAlfviyUWGxoKZwQt-aXVkScLW2ms3fSULmdZqw==
GET H2	200	Nav_Posture-1-53x53.png www.obsidiansecurity.com/wp-content/uploads/2023/03/	2 KB 3 KB	277ms 265ms	Image image/png	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://www.obsidiansecurity.com/wp-content/uploads/2023/03/Nav_Posture-1-53x53.png Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash fbdd34f74972d7dc2735aeef7a9f1745409e5d2b92da8a8ce87e8127931ab89d Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload content-length 2482 x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:45 GMT server nginx etag "6480806d-9b2" vary Accept-Encoding x-frame-options DENY content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=() accept-ranges bytes
GET H2	200	Nav_Threat-1-53x53.png www.obsidiansecurity.com/wp-content/uploads/2023/03/	2 KB 3 KB	278ms 266ms	Image image/png	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://www.obsidiansecurity.com/wp-content/uploads/2023/03/Nav_Threat-1-53x53.png Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash a8471bccb0fbf1db67e1d953b39b9d116fada822c4e437fd41bab4dbf6087634 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload content-length 2321 x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:45 GMT server nginx etag "6480806d-911" vary Accept-Encoding x-frame-options DENY content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=() accept-ranges bytes
GET H2	200	Nav_Integration-1-53x53.png www.obsidiansecurity.com/wp-content/uploads/2023/03/	2 KB 3 KB	283ms 271ms	Image image/png	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://www.obsidiansecurity.com/wp-content/uploads/2023/03/Nav_Integration-1-53x53.png Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 3587b24857fd8ecda07ac773720b5f78a0789bc832ba890467cbc213275680b3 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload content-length 2374 x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:45 GMT server nginx etag "6480806d-946" vary Accept-Encoding x-frame-options DENY content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=() accept-ranges bytes
GET H2	200	Automate-53x53.png www.obsidiansecurity.com/wp-content/uploads/2023/03/	1 KB 2 KB	283ms 272ms	Image image/png	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://www.obsidiansecurity.com/wp-content/uploads/2023/03/Automate-53x53.png Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash e93c89e2331b4f659250ec955390d708828e2b75ad31ab594d20786ed3335a9f Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload content-length 1146 x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:45 GMT server nginx etag "6480806d-47a" vary Accept-Encoding x-frame-options DENY content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=() accept-ranges bytes
GET H2	200	Manage-53x53.png www.obsidiansecurity.com/wp-content/uploads/2023/03/	1 KB 1 KB	292ms 280ms	Image image/png	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://www.obsidiansecurity.com/wp-content/uploads/2023/03/Manage-53x53.png Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 8b684315223a03f11944f0b5a7bf0a5c13c71fa8677aa67b6a31a980dec8c4eb Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload content-length 1046 x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:45 GMT server nginx etag "6480806d-416" vary Accept-Encoding x-frame-options DENY content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=() accept-ranges bytes
GET H2	200	Prevent-53x53.png www.obsidiansecurity.com/wp-content/uploads/2023/03/	2 KB 2 KB	296ms 285ms	Image image/png	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://www.obsidiansecurity.com/wp-content/uploads/2023/03/Prevent-53x53.png Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash ad82adea7e2f7d6ea30b1096d11acb1a285aba47031abc3927e8c03a77eba57d Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload content-length 1599 x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:45 GMT server nginx etag "6480806d-63f" vary Accept-Encoding x-frame-options DENY content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=() accept-ranges bytes
GET H2	200	Stay-on-top-53x53.png www.obsidiansecurity.com/wp-content/uploads/2023/03/	1 KB 2 KB	297ms 286ms	Image image/png	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://www.obsidiansecurity.com/wp-content/uploads/2023/03/Stay-on-top-53x53.png Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 2c5788428f48f98d6d94dc817f61fe292df412ad9726ad70251aa01a5935334f Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload content-length 1498 x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:45 GMT server nginx etag "6480806d-5da" vary Accept-Encoding x-frame-options DENY content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=() accept-ranges bytes
GET H2	200	salesforce-icon-53x53.png www.obsidiansecurity.com/wp-content/uploads/2021/06/	2 KB 2 KB	298ms 286ms	Image image/png	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://www.obsidiansecurity.com/wp-content/uploads/2021/06/salesforce-icon-53x53.png Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash d376ba94705be7c52e6d8f36a99c689a4b9111bf744833ad0f624006cd29accf Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload content-length 1591 x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:53 GMT server nginx etag "64808075-637" vary Accept-Encoding x-frame-options DENY content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=() accept-ranges bytes
GET H2	200	microsoft-365-icon-53x53.png www.obsidiansecurity.com/wp-content/uploads/2021/06/	1 KB 2 KB	298ms 287ms	Image image/png	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://www.obsidiansecurity.com/wp-content/uploads/2021/06/microsoft-365-icon-53x53.png Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 3fe84bd72bc4aada4d58223d3420e3233a0404c2fed3e5882d7d1cddf17d6263 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload content-length 1081 x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:53 GMT server nginx etag "64808075-439" vary Accept-Encoding x-frame-options DENY content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=() accept-ranges bytes
GET H2	200	servicenow-icon-53x53.png www.obsidiansecurity.com/wp-content/uploads/2022/06/	1 KB 2 KB	300ms 289ms	Image image/png	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://www.obsidiansecurity.com/wp-content/uploads/2022/06/servicenow-icon-53x53.png Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 36a0e445d181e0cd36d82d4001401a300393896d3cac975efd12759daa473b79 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload content-length 1213 x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:48 GMT server nginx etag "64808070-4bd" vary Accept-Encoding x-frame-options DENY content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=() accept-ranges bytes
GET H2	200	workday-icon-53x53.png www.obsidiansecurity.com/wp-content/uploads/2021/06/	2 KB 2 KB	274ms 263ms	Image image/png	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://www.obsidiansecurity.com/wp-content/uploads/2021/06/workday-icon-53x53.png Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 6b3ad9a922b88300425d6c9ce9a77d0bde8d792806223f3fea1f474ca0808b27 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload content-length 1898 x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:53 GMT server nginx etag "64808075-76a" vary Accept-Encoding x-frame-options DENY content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=() accept-ranges bytes
GET H2	200	more-icon-53x53.png www.obsidiansecurity.com/wp-content/uploads/2021/06/	718 B 1 KB	275ms 264ms	Image image/png	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://www.obsidiansecurity.com/wp-content/uploads/2021/06/more-icon-53x53.png Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 734b52b4dfb3a0ad2c49c1fb4bcdd169f657aaa08666e04713cf813bfbe1d310 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload content-length 718 x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:53 GMT server nginx etag "64808075-2ce" vary Accept-Encoding x-frame-options DENY content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=() accept-ranges bytes
GET H2	200	shield-cloud-icon-53x53.png www.obsidiansecurity.com/wp-content/uploads/2021/06/	1 KB 2 KB	275ms 264ms	Image image/png	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://www.obsidiansecurity.com/wp-content/uploads/2021/06/shield-cloud-icon-53x53.png Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 01a3526b7a93d12c989425f095caebf15e5b536b66e2d12ad622fabd5f36e348 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload content-length 1435 x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:53 GMT server nginx etag "64808075-59b" vary Accept-Encoding x-frame-options DENY content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=() accept-ranges bytes
GET H2	200	Group-5444@2x-53x53.png www.obsidiansecurity.com/wp-content/uploads/2021/06/	1 KB 2 KB	277ms 267ms	Image image/png	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://www.obsidiansecurity.com/wp-content/uploads/2021/06/Group-5444@2x-53x53.png Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 6f2e8c5692d2a6f34ed9173ee54b2eaef9c8c247c3894e1bc4c34bdd53576ead Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload content-length 1278 x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:52 GMT server nginx etag "64808074-4fe" vary Accept-Encoding x-frame-options DENY content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=() accept-ranges bytes
GET H2	200	Group-5443@2x-53x53.png www.obsidiansecurity.com/wp-content/uploads/2021/06/	1 KB 1 KB	277ms 266ms	Image image/png	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://www.obsidiansecurity.com/wp-content/uploads/2021/06/Group-5443@2x-53x53.png Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash abea14773018dfec490efcecd9f63f362a675fd0b0ed9d5809c452ec05fdec1d Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload content-length 1051 x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:52 GMT server nginx etag "64808074-41b" vary Accept-Encoding x-frame-options DENY content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=() accept-ranges bytes
GET H2	200	Trust_Center-53x53.png www.obsidiansecurity.com/wp-content/uploads/2023/03/	2 KB 2 KB	278ms 267ms	Image image/png	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://www.obsidiansecurity.com/wp-content/uploads/2023/03/Trust_Center-53x53.png Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash dd5dc820bebf545a18e4325fcc75788ae828d78f339db371e3fb6a20345cfd4a Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload content-length 2032 x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:45 GMT server nginx etag "6480806d-7f0" vary Accept-Encoding x-frame-options DENY content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=() accept-ranges bytes
GET H2	200	Asset-14xxxhdpi-53x52.png www.obsidiansecurity.com/wp-content/uploads/2021/06/	1 KB 2 KB	291ms 281ms	Image image/png	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://www.obsidiansecurity.com/wp-content/uploads/2021/06/Asset-14xxxhdpi-53x52.png Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 2ed6631bdabf24cde1774f92df94db8a911c6c491880084377b4fac995081817 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload content-length 1514 x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:52 GMT server nginx etag "64808074-5ea" vary Accept-Encoding x-frame-options DENY content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=() accept-ranges bytes
GET H2	200	Asset-15xxxhdpi-53x54.png www.obsidiansecurity.com/wp-content/uploads/2021/06/	1 KB 2 KB	292ms 282ms	Image image/png	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://www.obsidiansecurity.com/wp-content/uploads/2021/06/Asset-15xxxhdpi-53x54.png Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 3112751acc19eb95fc0bbfe3cfabeea08634ecd481d4c8109957c3bca2248cff Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload content-length 1194 x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:52 GMT server nginx etag "64808074-4aa" vary Accept-Encoding x-frame-options DENY content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=() accept-ranges bytes
GET H2	200	Asset-16xxxhdpi-53x53.png www.obsidiansecurity.com/wp-content/uploads/2021/06/	938 B 1 KB	296ms 285ms	Image image/png	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://www.obsidiansecurity.com/wp-content/uploads/2021/06/Asset-16xxxhdpi-53x53.png Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 4edf4b34f26d3963995ca2c60bc4eaac881615051d447d4be56851c5eaac0c3f Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload content-length 938 x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:52 GMT server nginx etag "64808074-3aa" vary Accept-Encoding x-frame-options DENY content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=() accept-ranges bytes
GET H2	200	Asset-13xxxhdpi-53x53.png www.obsidiansecurity.com/wp-content/uploads/2021/06/	2 KB 2 KB	297ms 287ms	Image image/png	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://www.obsidiansecurity.com/wp-content/uploads/2021/06/Asset-13xxxhdpi-53x53.png Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash c90e74f81fd00cb9291f7517742991e885acc4743141e7100c8ff5c24dc4f2b4 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload content-length 1911 x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:52 GMT server nginx etag "64808074-777" vary Accept-Encoding x-frame-options DENY content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=() accept-ranges bytes
GET H2	200	gtm.js Show response www.googletagmanager.com/	180 KB 67 KB	33ms 23ms	Script application/javascript	2a00:1450:4001:811::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-P5GWZRJ Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash df3c18b8334c6e1041b563f094dbede60dd3e2dce926e23654faa6760a20774e Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-encoding br strict-transport-security max-age=31536000; includeSubDomains cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 68819 x-xss-protection 0 last-modified Thu, 08 Jun 2023 00:00:00 GMT server Google Tag Manager vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Thu, 08 Jun 2023 02:11:46 GMT
GET H2	200	aicpasic-logo.png www.obsidiansecurity.com/wp-content/themes/obsidian/assets/img/	21 KB 21 KB	301ms 291ms	Image image/png	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://www.obsidiansecurity.com/wp-content/themes/obsidian/assets/img/aicpasic-logo.png Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash c50fcec65a89c42d13d04f9188828a293faae514d96cae521ff590aab83002aa Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload content-length 21151 x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:57 GMT server nginx etag "64808079-529f" vary Accept-Encoding x-frame-options DENY content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=() accept-ranges bytes
GET H2	200	footer-Logo-A-LIGN_ISO_27001.png www.obsidiansecurity.com/wp-content/themes/obsidian/assets/img/	55 KB 55 KB	299ms 290ms	Image image/png	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://www.obsidiansecurity.com/wp-content/themes/obsidian/assets/img/footer-Logo-A-LIGN_ISO_27001.png Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash a356860ac8a92d93fb2ce85611d4b9e0216e313241bece1beb336c75c10b3b21 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload content-length 55887 x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:57 GMT server nginx etag "64808079-da4f" vary Accept-Encoding x-frame-options DENY content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=() accept-ranges bytes
GET H2	200	Footer-Logo-A-LIGN_ISO_27701.png www.obsidiansecurity.com/wp-content/themes/obsidian/assets/img/	53 KB 54 KB	299ms 290ms	Image image/png	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://www.obsidiansecurity.com/wp-content/themes/obsidian/assets/img/Footer-Logo-A-LIGN_ISO_27701.png Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 35e6dfa45861f1bc98879fd6b264bf176ed97301f71e29dbd3d5dbef3fd37be0 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload content-length 54425 x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:57 GMT server nginx etag "64808079-d499" vary Accept-Encoding x-frame-options DENY content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=() accept-ranges bytes
GET H2	200	footer-logo-greatplace-certif-outlined.png www.obsidiansecurity.com/wp-content/themes/obsidian/assets/img/	110 KB 111 KB	299ms 290ms	Image image/png	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://www.obsidiansecurity.com/wp-content/themes/obsidian/assets/img/footer-logo-greatplace-certif-outlined.png Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 37c060415826e27c68e5d4ffd43296616b491e40e9e43d4637becc0b6c9843d0 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload content-length 112853 x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:57 GMT server nginx etag "64808079-1b8d5" vary Accept-Encoding x-frame-options DENY content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=() accept-ranges bytes
GET H2	200	tw-bs4.css www.obsidiansecurity.com/wp-content/plugins/wp-security-hardening/modules/inc/assets/css/	209 KB 27 KB	147ms 147ms	Stylesheet text/css	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-content/plugins/wp-security-hardening/modules/inc/assets/css/tw-bs4.css Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 653b40ccb6ed560a39d8f3dc1902b946647a9939b955c6c53116454bdfe4c4e9 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:57 GMT server nginx etag W/"64808079-34351" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options DENY content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	font-awesome.min.css www.obsidiansecurity.com/wp-content/plugins/wp-security-hardening/modules/inc/fa/css/	20 KB 5 KB	147ms 147ms	Stylesheet text/css	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-content/plugins/wp-security-hardening/modules/inc/fa/css/font-awesome.min.css Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash b769324e0921f9f649611113e65f528ebae5e140da8a7e63c5d6ea7bc7a33bc0 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:57 GMT server nginx etag W/"64808079-511e" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options DENY content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	front.css www.obsidiansecurity.com/wp-content/plugins/wp-security-hardening/modules/css/	145 B 562 B	144ms 131ms	Stylesheet text/css	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-content/plugins/wp-security-hardening/modules/css/front.css Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash b2de4ae656c0605f0cc9ea54ab32a4508f56fc4f02dcc407d33fd44370afc1cb Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:57 GMT server nginx etag W/"64808079-91" vary Accept-Encoding, Accept-Encoding x-frame-options DENY content-type text/css access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	coblocks-animation.js Show response www.obsidiansecurity.com/wp-content/plugins/coblocks/dist/js/	412 B 760 B	145ms 132ms	Script application/javascript	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-content/plugins/coblocks/dist/js/coblocks-animation.js Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash a2c1967d4bc375b190863aabb8bb22a2da4ec5461f8dfd8add4987e3687a26ed Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:05:03 GMT server nginx etag W/"6480807f-19c" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options DENY content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	coblocks-lightbox.js Show response www.obsidiansecurity.com/wp-content/plugins/coblocks/dist/js/	3 KB 2 KB	148ms 134ms	Script application/javascript	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-content/plugins/coblocks/dist/js/coblocks-lightbox.js Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 073755b43f55a99987aa9f8d6b99239e8cdc9952fe4f1ef0275850610702a80b Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:05:03 GMT server nginx etag W/"6480807f-de5" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options DENY content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	new-tab.js Show response www.obsidiansecurity.com/wp-content/plugins/page-links-to/dist/	24 KB 9 KB	150ms 136ms	Script application/javascript	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-content/plugins/page-links-to/dist/new-tab.js Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash d455ab882af3a742e6c9680578e6a590681bda99e34847f550f1f41a7d167969 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:05:00 GMT server nginx etag W/"6480807c-609e" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options DENY content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	ofi.min.js Show response www.obsidiansecurity.com/wp-content/themes/obsidian/assets/js/vendor/	3 KB 2 KB	149ms 135ms	Script application/javascript	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-content/themes/obsidian/assets/js/vendor/ofi.min.js Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 37217cfedb39356d2a0fd317e4a8ee87d225f4364e3afc7473ab5a8e7d97ec64 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:57 GMT server nginx etag W/"64808079-cdb" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options DENY content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	featherlight.min.js Show response www.obsidiansecurity.com/wp-content/themes/obsidian/assets/js/vendor/	9 KB 4 KB	154ms 140ms	Script application/javascript	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-content/themes/obsidian/assets/js/vendor/featherlight.min.js Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash fd21104dc97db6fc980c0f12ba157f3cc9fddac84dde4367f02f6f9db05c13d6 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:57 GMT server nginx etag W/"64808079-2404" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options DENY content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	swiper.min.js Show response www.obsidiansecurity.com/wp-content/themes/obsidian/assets/js/vendor/	143 KB 39 KB	158ms 145ms	Script application/javascript	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-content/themes/obsidian/assets/js/vendor/swiper.min.js Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 8aaf5b40612e54902b1823aea85f7744989b3a77f50fc4cbf5497886baacd518 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:57 GMT server nginx etag W/"64808079-23bc5" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options DENY content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	jquery.inview.min.js Show response www.obsidiansecurity.com/wp-content/themes/obsidian/assets/js/vendor/	1 KB 1 KB	147ms 133ms	Script application/javascript	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-content/themes/obsidian/assets/js/vendor/jquery.inview.min.js Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash ba732a6d0b4db5e763fcba62ac2f0931e440fc10d1645597de4e3ec9890bcea9 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:57 GMT server nginx etag W/"64808079-59e" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options DENY content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	jquery.colorbox-min.js Show response www.obsidiansecurity.com/wp-content/themes/obsidian/assets/js/vendor/	12 KB 5 KB	275ms 261ms	Script application/javascript	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-content/themes/obsidian/assets/js/vendor/jquery.colorbox-min.js Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 41bc4d4fe88139d6ee89abfcb2abac71e1430d85dbffc0be7c8f6bd36f4ced7e Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:57 GMT server nginx etag W/"64808079-2eb8" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options DENY content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	sticky-kit.min.js Show response www.obsidiansecurity.com/wp-content/themes/obsidian/assets/js/vendor/	3 KB 2 KB	275ms 262ms	Script application/javascript	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-content/themes/obsidian/assets/js/vendor/sticky-kit.min.js Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 7a39f30800c1ef8779686fd48037bb5d95fc6471cefe29e60c61f00ae2a846db Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:57 GMT server nginx etag W/"64808079-cc4" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options DENY content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	lazyload.min.js Show response www.obsidiansecurity.com/wp-content/themes/obsidian/assets/js/vendor/	7 KB 3 KB	276ms 262ms	Script application/javascript	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-content/themes/obsidian/assets/js/vendor/lazyload.min.js Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash e6a23e6a3399b52a5576c28b2236b48953949793fc17f2c733d35b084d7a0085 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:57 GMT server nginx etag W/"64808079-1d61" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options DENY content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	jquery.waypoints.min.js Show response www.obsidiansecurity.com/wp-content/themes/obsidian/assets/js/vendor/	9 KB 3 KB	274ms 260ms	Script application/javascript	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-content/themes/obsidian/assets/js/vendor/jquery.waypoints.min.js Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 368daab67b1a5b2b2802edbbac79a2aa4ba992a2ebf9c67b98ad784d8004018c Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:57 GMT server nginx etag W/"64808079-2344" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options DENY content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	counterUp2.min.js Show response www.obsidiansecurity.com/wp-content/themes/obsidian/assets/js/vendor/	2 KB 1 KB	261ms 247ms	Script application/javascript	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-content/themes/obsidian/assets/js/vendor/counterUp2.min.js Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 896688d966de7f514e72b6c5b156de3fb6dbfcd61436e6db46ce3b0e4f52426a Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:57 GMT server nginx etag W/"64808079-788" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options DENY content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	scripts.js Show response www.obsidiansecurity.com/wp-content/themes/obsidian/assets/js/	45 KB 11 KB	269ms 256ms	Script application/javascript	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-content/themes/obsidian/assets/js/scripts.js Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash d6e8a8f97eaab25699851f1c6d17676d850c018f745ab1dd70a6148419bdff49 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:57 GMT server nginx etag W/"64808079-b5b9" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options DENY content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	highlight.min.js Show response cdnjs.cloudflare.com/ajax/libs/highlight.js/9.15.8/	48 KB 18 KB	24ms 11ms	Script application/javascript	2606:4700::6811:180e CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdnjs.cloudflare.com/ajax/libs/highlight.js/9.15.8/highlight.min.js Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6811:180e , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8ecf88d5f75b91efc326b5b6a97425af0ed5504aa675e15e396dfb502d1b1225 Security Headers Name Value Strict-Transport-Security max-age=15780000 X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-encoding br x-content-type-options nosniff cf-cache-status HIT nel {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800} strict-transport-security max-age=15780000 age 10718474 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400 content-length 17605 last-modified Mon, 04 May 2020 16:10:34 GMT server cloudflare cf-cdnjs-via cfworker/kv etag "5eb03e7a-bfa2" vary Accept-Encoding report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MnwbzSlhPNKWC7SjMX10QNKglWHBz%2FGl3LOV77J4e5KMt4yMtrJR9okhP0V2Lm%2B9bxB56evJVcnCCJnJPy09rw4N5RFcO7Ztg6B0%2BiULowVm4F2WlYj53gTlXxazOK5yTKYCqSWNx6GD4oVszvXyT2Hb"}],"group":"cf-nel","max_age":604800} content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control public, max-age=30672000 accept-ranges bytes timing-allow-origin * cf-ray 7d3d9b253cff190f-FRA expires Tue, 28 May 2024 02:11:46 GMT
GET H2	200	single-post.js Show response www.obsidiansecurity.com/wp-content/themes/obsidian/assets/js/blocks/	162 B 606 B	281ms 268ms	Script application/javascript	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-content/themes/obsidian/assets/js/blocks/single-post.js Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 234b6a66cf16fc9ca92f296dae36e46e10fd11af946056072f824481c956a903 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:57 GMT server nginx etag W/"64808079-a2" vary Accept-Encoding, Accept-Encoding x-frame-options DENY content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	wp-polyfill-inert.min.js Show response www.obsidiansecurity.com/wp-includes/js/dist/vendor/	8 KB 3 KB	272ms 260ms	Script application/javascript	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-includes/js/dist/vendor/wp-polyfill-inert.min.js Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash c1a9a3e223bad631dff12d33b5499eb145cb08d8621c20d9d73870e78d97afe4 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:43 GMT server nginx etag W/"6480806b-1feb" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options DENY content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	regenerator-runtime.min.js Show response www.obsidiansecurity.com/wp-includes/js/dist/vendor/	6 KB 3 KB	271ms 258ms	Script application/javascript	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-includes/js/dist/vendor/regenerator-runtime.min.js Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 6974bfd8fa06b7831f05cb4b25860c851a5ad3f02a6699ebe688987dd7a6ebe6 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:43 GMT server nginx etag W/"6480806b-19cf" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options DENY content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	wp-polyfill.min.js Show response www.obsidiansecurity.com/wp-includes/js/dist/vendor/	17 KB 7 KB	282ms 269ms	Script application/javascript	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-includes/js/dist/vendor/wp-polyfill.min.js Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 1c1fef6e6b4f9832603850b9b6562e74d9a6a3700ba836efe88facc577121e8b Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:43 GMT server nginx etag W/"6480806b-459f" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options DENY content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	dom-ready.min.js Show response www.obsidiansecurity.com/wp-includes/js/dist/	498 B 823 B	261ms 248ms	Script application/javascript	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-includes/js/dist/dom-ready.min.js Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 166c7c3bb5f76f977a9f2a5490589b3466374eb2b3f064802e56f08bad71fbf0 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:43 GMT server nginx etag W/"6480806b-1f2" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options DENY content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	hooks.min.js Show response www.obsidiansecurity.com/wp-includes/js/dist/	5 KB 2 KB	269ms 257ms	Script application/javascript	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-includes/js/dist/hooks.min.js Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 9bd82960d99b3a76f4af77a88a346bd61f87bac5ff2f385ee28cd669d8f22134 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:43 GMT server nginx etag W/"6480806b-132e" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options DENY content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	i18n.min.js Show response www.obsidiansecurity.com/wp-includes/js/dist/	10 KB 4 KB	263ms 251ms	Script application/javascript	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-includes/js/dist/i18n.min.js Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 01c3955df67a9b9d1367957e2c187729eae46b72e92c2b52bdb217b14a8fc874 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:43 GMT server nginx etag W/"6480806b-27f6" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options DENY content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	a11y.min.js Show response www.obsidiansecurity.com/wp-includes/js/dist/	2 KB 1 KB	272ms 260ms	Script application/javascript	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-includes/js/dist/a11y.min.js Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 5df2942db2352e49e00bcf3393b875a71d0acee986e48fbdcc5879846f5c3689 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:42 GMT server nginx etag W/"6480806a-9cc" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options DENY content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	jquery.json.min.js Show response www.obsidiansecurity.com/wp-content/plugins/gravityforms/js/	2 KB 1 KB	298ms 289ms	Script application/javascript	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-content/plugins/gravityforms/js/jquery.json.min.js Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 998a575c7b376128a98e6d67e29c42e1726aac3489cf2c0b2aaebf6f6ad0b546 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:05:01 GMT server nginx etag W/"6480807d-72c" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options DENY content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	gravityforms.min.js Show response www.obsidiansecurity.com/wp-content/plugins/gravityforms/js/	43 KB 14 KB	299ms 290ms	Script application/javascript	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-content/plugins/gravityforms/js/gravityforms.min.js Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 1c2f01732e091e658e1f7cbcbe07271c0119aeca62c2f43dd7b778cfda04e179 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:05:01 GMT server nginx etag W/"6480807d-ad4d" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options DENY content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
GET H2	200	api.js Show response www.google.com/recaptcha/	850 B 875 B	53ms 16ms	Script text/javascript	2a00:1450:4001:82a::2004 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google.com/recaptcha/api.js?hl=en Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software GSE / Resource Hash 8d407cd28e2db7a40917117ec99a996194878d452f589860cb45083e6d7208f1 Security Headers Name Value Content-Security-Policy frame-ancestors 'self' X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-encoding gzip x-content-type-options nosniff content-security-policy frame-ancestors 'self' server GSE x-frame-options SAMEORIGIN content-type text/javascript; charset=UTF-8 cache-control private, max-age=300 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 555 x-xss-protection 1; mode=block expires Thu, 08 Jun 2023 02:11:46 GMT
GET H2	200	jquery.maskedinput.min.js Show response www.obsidiansecurity.com/wp-content/plugins/gravityforms/js/	4 KB 2 KB	296ms 287ms	Script application/javascript	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-content/plugins/gravityforms/js/jquery.maskedinput.min.js Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 1070e29f1b2053f67a18d3b8f6474e5ad05b375e0a549fe5f08eb7ee30d81c34 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests content-encoding br strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:05:01 GMT server nginx etag W/"6480807d-104c" vary Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding x-frame-options DENY content-type application/javascript access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=()
POST H2	204	collect region1.analytics.google.com/g/	0 260 B	36ms 14ms	Ping text/plain	2001:4860:4802:32::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.analytics.google.com/g/collect?v=2&tid=G-XESBQ81H1M&gtm=45je3650&_p=2047077124&_gaz=1&cid=2122033525.1686190306&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1686190305&sct=1&seg=0&dl=https%3A%2F%2Fwww.obsidiansecurity.com%2Fblog%2Fsaas-ransomware-observed-sharepoint-microsoft-365%2F&dt=&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-XESBQ81H1M Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers pragma no-cache date Thu, 08 Jun 2023 02:11:45 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.obsidiansecurity.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	204	collect stats.g.doubleclick.net/g/	0 260 B	89ms 28ms	Ping text/plain	2a00:1450:400c:c0c::9b GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/g/collect?v=2&tid=G-XESBQ81H1M&cid=2122033525.1686190306&gtm=45je3650&aip=1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-XESBQ81H1M Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c0c::9b Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers pragma no-cache date Thu, 08 Jun 2023 02:11:45 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.obsidiansecurity.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.de/ads/	42 B 408 B	54ms 18ms	Image image/gif	2a00:1450:4001:802::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-XESBQ81H1M&cid=2122033525.1686190306&gtm=45je3650&aip=1&z=1415264160 Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers pragma no-cache date Thu, 08 Jun 2023 02:11:46 GMT x-content-type-options nosniff server cafe content-type image/gif p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin timing-allow-origin * alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	index.js Show response assets.adoberesources.net/builds/4086a475f3fb7634d2b7d2e4103d3797fe9e0498/dist/core/src/	105 KB 27 KB	21ms 12ms	Script application/x-javascript	2a02:26f0:480:99e::1e80 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://assets.adoberesources.net/builds/4086a475f3fb7634d2b7d2e4103d3797fe9e0498/dist/core/src/index.js Requested by Host: assets.adoberesources.net URL: https://assets.adoberesources.net/loader.js?orgId=A01C1D3E624B03520A495E0F%40AdobeOrg&instanceId=obsidiansecurity&env=prod&geo=va7 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:480:99e::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AkamaiNetStorage / Resource Hash 372ff04d76a8367a82618611c32f216cc1dc2ce5348caf358d99ef48a3419b62 Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-encoding gzip last-modified Fri, 19 May 2023 16:44:35 GMT server AkamaiNetStorage etag "a5effffdec493ed1c3162dae0559c789:1684514675.68744" vary Accept-Encoding content-type application/x-javascript cache-control max-age=585 server-timing ak_p; desc="1686190306120_388391874_43690343_25_547_6_0_146";dur=1 accept-ranges bytes content-length 27171 expires Thu, 08 Jun 2023 02:21:31 GMT
GET H2	200	index.js Show response assets.adoberesources.net/builds/4086a475f3fb7634d2b7d2e4103d3797fe9e0498/dist/core-ui/src/	129 KB 35 KB	26ms 18ms	Script application/x-javascript	2a02:26f0:480:99e::1e80 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://assets.adoberesources.net/builds/4086a475f3fb7634d2b7d2e4103d3797fe9e0498/dist/core-ui/src/index.js Requested by Host: assets.adoberesources.net URL: https://assets.adoberesources.net/loader.js?orgId=A01C1D3E624B03520A495E0F%40AdobeOrg&instanceId=obsidiansecurity&env=prod&geo=va7 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:480:99e::1e80 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software AkamaiNetStorage / Resource Hash e9aa9a75eec9ee8f5b32fbf8e7b991140bc9ff6703ced026fd2104dff609eb46 Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-encoding gzip last-modified Fri, 19 May 2023 16:44:35 GMT server AkamaiNetStorage etag "2a1cdc66aaa161a479e0b084a87529ec:1684514675.709116" vary Accept-Encoding content-type application/x-javascript cache-control max-age=585 server-timing ak_p; desc="1686190306120_388391874_43690344_26_535_6_0_146";dur=1 accept-ranges bytes content-length 35934 expires Thu, 08 Jun 2023 02:21:31 GMT
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/	1 KB 2 KB	401ms 7ms	Script application/x-javascript	104.102.38.132 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/munchkin.js Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.102.38.132 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-102-38-132.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 5206536707c84baa892d3c3231b351985ee828cb8b9c0bd8db42cd3363995fc4 Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers Date Thu, 08 Jun 2023 02:11:46 GMT Content-Encoding gzip Last-Modified Fri, 17 Mar 2023 01:24:48 GMT Server AkamaiNetStorage ETag "cb731cc5c2bd9f31d6bfeb19f3c8b1ff:1679016288.730763" Vary Accept-Encoding P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Content-Type application/x-javascript Connection keep-alive Accept-Ranges bytes Content-Length 729
GET H2	200	css2 fonts.googleapis.com/	34 KB 1 KB	18ms 17ms	Stylesheet text/css	2a00:1450:4001:829::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://fonts.googleapis.com/css2?family=Open+Sans:ital,wght@0,300;0,400;0,500;0,600;0,700;0,800;1,300;1,400;1,500;1,600;1,700;1,800&display=swap Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/wp-content/themes/obsidian/assets/css/style.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software ESF / Resource Hash 3b50116c3101a511d2559c79c005b6cf57fd89fd52dac1d3566ebaeaf53f1dec Security Headers Name Value Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers strict-transport-security max-age=31536000 date Thu, 08 Jun 2023 02:11:46 GMT content-encoding gzip x-content-type-options nosniff cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 x-xss-protection 0 last-modified Thu, 08 Jun 2023 01:11:05 GMT server ESF cross-origin-opener-policy same-origin-allow-popups x-frame-options SAMEORIGIN content-type text/css; charset=utf-8 access-control-allow-origin * cache-control private, max-age=86400, stale-while-revalidate=604800 timing-allow-origin * link <https://fonts.gstatic.com>; rel=preconnect; crossorigin expires Thu, 08 Jun 2023 02:11:46 GMT
GET H2	200	destinations.min.js Show response x.clearbitjs.com/v2/pk_b3e5b8359fbae511329400f112b1c0c6/	0 37 B	363ms 296ms	Script application/javascript	3.127.196.46 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://x.clearbitjs.com/v2/pk_b3e5b8359fbae511329400f112b1c0c6/destinations.min.js Requested by Host: tag.clearbitscripts.com URL: https://tag.clearbitscripts.com/v1/pk_b3e5b8359fbae511329400f112b1c0c6/tags.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.127.196.46 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-127-196-46.eu-central-1.compute.amazonaws.com Software envoy / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:45 GMT strict-transport-security max-age=63072000; includeSubDomains; preload x-content-type-options nosniff x-envoy-response-flags - server envoy content-type application/javascript;charset=utf-8 cache-control private, max-age=600 content-length 0
GET H2	200	tracking.min.js Show response x.clearbitjs.com/v2/pk_b3e5b8359fbae511329400f112b1c0c6/	168 KB 45 KB	435ms 368ms	Script application/javascript	3.127.196.46 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://x.clearbitjs.com/v2/pk_b3e5b8359fbae511329400f112b1c0c6/tracking.min.js Requested by Host: tag.clearbitscripts.com URL: https://tag.clearbitscripts.com/v1/pk_b3e5b8359fbae511329400f112b1c0c6/tags.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.127.196.46 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-127-196-46.eu-central-1.compute.amazonaws.com Software envoy / Resource Hash 74271eb786358719eb1b8d6834c3ac999b0fed6726f1cdf8e933e5b3d04a76df Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-encoding gzip x-content-type-options nosniff x-envoy-response-flags - server envoy strict-transport-security max-age=63072000; includeSubDomains; preload vary Accept-Encoding content-type application/javascript;charset=utf-8 cache-control private, max-age=600
GET H2	200	forms.js Show response x.clearbitjs.com/v1/pk_b3e5b8359fbae511329400f112b1c0c6/	33 KB 10 KB	257ms 191ms	Script application/javascript	3.127.196.46 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://x.clearbitjs.com/v1/pk_b3e5b8359fbae511329400f112b1c0c6/forms.js?page_path=%2Fblog%2Fsaas-ransomware-observed-sharepoint-microsoft-365%2F Requested by Host: tag.clearbitscripts.com URL: https://tag.clearbitscripts.com/v1/pk_b3e5b8359fbae511329400f112b1c0c6/tags.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 3.127.196.46 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-3-127-196-46.eu-central-1.compute.amazonaws.com Software envoy / Resource Hash 20e7e44c57b6930f6d6c8eb3ebb189a9e1808fa521326c9a95837d92c4941e8a Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:45 GMT content-encoding gzip x-content-type-options nosniff x-envoy-response-flags - server envoy strict-transport-security max-age=63072000; includeSubDomains; preload vary Accept-Encoding content-type application/javascript;charset=utf-8
GET H2	200	inter-medium.woff www.obsidiansecurity.com/wp-content/themes/obsidian/assets/css/fonts/Inter/	22 KB 22 KB	261ms 257ms	Font font/woff	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-content/themes/obsidian/assets/css/fonts/Inter/inter-medium.woff Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/wp-content/themes/obsidian/assets/css/style.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash c8015ce369ccfcf8b3faa48a9346ba957913f7e967532639daadfde7db112ed3 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers Referer https://www.obsidiansecurity.com/wp-content/themes/obsidian/assets/css/style.css Origin https://www.obsidiansecurity.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload content-length 22364 x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:57 GMT server nginx etag "64808079-575c" vary Accept-Encoding x-frame-options DENY content-type font/woff access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=() accept-ranges bytes
GET H2	200	celias-medium-webfont.woff www.obsidiansecurity.com/wp-content/themes/obsidian/assets/css/fonts/Celias/	24 KB 25 KB	269ms 265ms	Font font/woff	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-content/themes/obsidian/assets/css/fonts/Celias/celias-medium-webfont.woff Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/wp-content/themes/obsidian/assets/css/style.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 6ed9c187807fdd2f34b21f0b511eb684e610749af0177025a87957ee2356ba50 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers Referer https://www.obsidiansecurity.com/wp-content/themes/obsidian/assets/css/style.css Origin https://www.obsidiansecurity.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload content-length 24612 x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:57 GMT server nginx etag "64808079-6024" vary Accept-Encoding x-frame-options DENY content-type font/woff access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=() accept-ranges bytes
GET H2	200	inter-bold.woff www.obsidiansecurity.com/wp-content/themes/obsidian/assets/css/fonts/Inter/	22 KB 23 KB	269ms 266ms	Font font/woff	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-content/themes/obsidian/assets/css/fonts/Inter/inter-bold.woff Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/wp-content/themes/obsidian/assets/css/style.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 61d7a719b8fe2463c3eaf980df4bb861f02b8e553b2734545c44d8b2b65fa207 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers Referer https://www.obsidiansecurity.com/wp-content/themes/obsidian/assets/css/style.css Origin https://www.obsidiansecurity.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload content-length 22544 x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:57 GMT server nginx etag "64808079-5810" vary Accept-Encoding x-frame-options DENY content-type font/woff access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=() accept-ranges bytes
GET H2	200	inter-regular.woff www.obsidiansecurity.com/wp-content/themes/obsidian/assets/css/fonts/Inter/	21 KB 21 KB	270ms 267ms	Font font/woff	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-content/themes/obsidian/assets/css/fonts/Inter/inter-regular.woff Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/wp-content/themes/obsidian/assets/css/style.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 9ec803cebad1a1287f35f96747871b72935ba6bd456ae916f09378053b7b5817 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers Referer https://www.obsidiansecurity.com/wp-content/themes/obsidian/assets/css/style.css Origin https://www.obsidiansecurity.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload content-length 21288 x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:57 GMT server nginx etag "64808079-5328" vary Accept-Encoding x-frame-options DENY content-type font/woff access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=() accept-ranges bytes
GET H2	200	fa-regular-400.woff2 pro.fontawesome.com/releases/v5.15.4/webfonts/	165 KB 165 KB	54ms 36ms	Font font/woff2	2606:4700::6812:1734 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://pro.fontawesome.com/releases/v5.15.4/webfonts/fa-regular-400.woff2 Requested by Host: pro.fontawesome.com URL: https://pro.fontawesome.com/releases/v5.15.4/css/all.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1734 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 3bbb0df89b8dbe8001e8c24de4e2d1693f94997b29f007a7bda22a9802832768 Request headers Referer https://pro.fontawesome.com/releases/v5.15.4/css/all.css Origin https://www.obsidiansecurity.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT cf-cache-status HIT x-amz-request-id R0NRG9ARC50S42RX age 2733815 content-length 168824 x-amz-id-2 n5I72VAdSpnMS7fq64SulhLWJtPCyaoQ26wviK4WzB6+9WUa1KXC9ab0l3J5IdFxISXGP3+59MA= last-modified Wed, 04 Aug 2021 20:59:34 GMT server cloudflare etag "a3d7d331957546ae10ad69bb44b83a04" access-control-max-age 3000 access-control-allow-methods GET content-type font/woff2 access-control-allow-origin * vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding cache-control max-age=31556926 accept-ranges bytes cf-ray 7d3d9b257e5f9be8-FRA
GET H2	200	celias-webfont.woff www.obsidiansecurity.com/wp-content/themes/obsidian/assets/css/fonts/Celias/	24 KB 24 KB	269ms 268ms	Font font/woff	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-content/themes/obsidian/assets/css/fonts/Celias/celias-webfont.woff Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/wp-content/themes/obsidian/assets/css/style.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash c90433c3946ddefbd9bbb4c275ce5dd299c3044325f70a810c7cb169077b25c6 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers Referer https://www.obsidiansecurity.com/wp-content/themes/obsidian/assets/css/style.css Origin https://www.obsidiansecurity.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload content-length 24564 x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:57 GMT server nginx etag "64808079-5ff4" vary Accept-Encoding x-frame-options DENY content-type font/woff access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=() accept-ranges bytes
GET H2	200	celias-bold-webfont.woff www.obsidiansecurity.com/wp-content/themes/obsidian/assets/css/fonts/Celias/	25 KB 25 KB	267ms 263ms	Font font/woff	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Full URL https://www.obsidiansecurity.com/wp-content/themes/obsidian/assets/css/fonts/Celias/celias-bold-webfont.woff Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/wp-content/themes/obsidian/assets/css/style.css Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 23eea768836fad6966bb801258318e99da413b48d611f7cbfb5a27da26a7baa2 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers Referer https://www.obsidiansecurity.com/wp-content/themes/obsidian/assets/css/style.css Origin https://www.obsidiansecurity.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload content-length 25204 x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:57 GMT server nginx etag "64808079-6274" vary Accept-Encoding x-frame-options DENY content-type font/woff access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=() accept-ranges bytes
GET H2	200	fa-brands-400.woff2 pro.fontawesome.com/releases/v5.15.4/webfonts/	75 KB 75 KB	16ms 16ms	Font font/woff2	2606:4700::6812:1734 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://pro.fontawesome.com/releases/v5.15.4/webfonts/fa-brands-400.woff2 Requested by Host: pro.fontawesome.com URL: https://pro.fontawesome.com/releases/v5.15.4/css/all.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1734 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 39c658ef377f9ec31442c5343a15bdfc4c4653bcca74bc7d6fe4b3e736a60aa4 Request headers Referer https://pro.fontawesome.com/releases/v5.15.4/css/all.css Origin https://www.obsidiansecurity.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT cf-cache-status HIT x-amz-request-id 6GQWD0PAN93YBJNG age 94913 content-length 76728 x-amz-id-2 PVgUBfSPNgrZgpVMLpBC+ArvjfVgXUQyXFq13t4kWeqMR+8trwY57kv8iezF1zIg8tuJdwI5UvM= last-modified Wed, 04 Aug 2021 20:59:34 GMT server cloudflare etag "f4120760fb40152d1bdb109103063c13" access-control-max-age 3000 access-control-allow-methods GET content-type font/woff2 access-control-allow-origin * vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding cache-control max-age=31556926 accept-ranges bytes cf-ray 7d3d9b257e699be8-FRA
GET H2	200	fa-solid-900.woff2 pro.fontawesome.com/releases/v5.15.4/webfonts/	134 KB 134 KB	31ms 31ms	Font font/woff2	2606:4700::6812:1734 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://pro.fontawesome.com/releases/v5.15.4/webfonts/fa-solid-900.woff2 Requested by Host: pro.fontawesome.com URL: https://pro.fontawesome.com/releases/v5.15.4/css/all.css Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6812:1734 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 8d4d29042c23b5fcbed3af690421776de0f8ad3d308d66e24a9d80bcc8ccb522 Request headers Referer https://pro.fontawesome.com/releases/v5.15.4/css/all.css Origin https://www.obsidiansecurity.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT cf-cache-status HIT x-amz-request-id KA5P0CB5DW7Z1G39 age 81381 content-length 137104 x-amz-id-2 0YYorkZVWN97RXGGyHnzT6uNo47L+oF+h15Zaq+4JTq5+trPR7r+/KiOy1DyNzzVtZASeY+5BGifdqzxbVX1eQ== last-modified Wed, 04 Aug 2021 20:59:35 GMT server cloudflare etag "dbf1fc91f1beec2915123257ea4d58ef" access-control-max-age 3000 access-control-allow-methods GET content-type font/woff2 access-control-allow-origin * vary Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding cache-control max-age=31556926 accept-ranges bytes cf-ray 7d3d9b257e6a9be8-FRA
GET H2	200	Untitled-4-260x260.png www.obsidiansecurity.com/wp-content/uploads/2023/06/	84 KB 85 KB	235ms 233ms	Image image/png	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://www.obsidiansecurity.com/wp-content/uploads/2023/06/Untitled-4-260x260.png Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash a1ccec9f93afc1b363126fdbe61e02fe9469ae7f1df4d2c51a333efe0a860767 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload content-length 86032 x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:43 GMT server nginx etag "6480806b-15010" vary Accept-Encoding x-frame-options DENY content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=() accept-ranges bytes
GET H2	200	Untitled-1024x756.png www.obsidiansecurity.com/wp-content/uploads/2023/06/	325 KB 326 KB	235ms 233ms	Image image/png	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://www.obsidiansecurity.com/wp-content/uploads/2023/06/Untitled-1024x756.png Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 2f9f79eaac1f9c1670999470f5ecf0a4aa1f273a8aa1689571770b627723c908 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload content-length 332595 x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:43 GMT server nginx etag "6480806b-51333" vary Accept-Encoding x-frame-options DENY content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=() accept-ranges bytes
GET H2	200	Untitled-1-1024x701.png www.obsidiansecurity.com/wp-content/uploads/2023/06/	384 KB 385 KB	235ms 233ms	Image image/png	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://www.obsidiansecurity.com/wp-content/uploads/2023/06/Untitled-1-1024x701.png Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 001cd0013bf9bd81a8093894ecff1ae7f9306d29af863bf6287432297113634d Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload content-length 393283 x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:43 GMT server nginx etag "6480806b-60043" vary Accept-Encoding x-frame-options DENY content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=() accept-ranges bytes
GET H2	200	code-691x789.png www.obsidiansecurity.com/wp-content/uploads/2023/06/	101 KB 102 KB	235ms 233ms	Image image/png	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://www.obsidiansecurity.com/wp-content/uploads/2023/06/code-691x789.png Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 04e40a6de703318e423d706258e96e3955904fc3df51e9b24a7000e941f705b1 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload content-length 103438 x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:44 GMT server nginx etag "6480806c-1940e" vary Accept-Encoding x-frame-options DENY content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=() accept-ranges bytes
GET H2	200	analytics.js Show response www.google-analytics.com/	51 KB 21 KB	38ms 16ms	Script text/javascript	2a00:1450:4001:811::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-P5GWZRJ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff date Thu, 08 Jun 2023 00:35:27 GMT last-modified Mon, 17 Apr 2023 22:36:01 GMT server Golfe2 age 5779 vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 20737 expires Thu, 08 Jun 2023 02:35:27 GMT
GET H2	200	insight.min.js Show response snap.licdn.com/li.lms-analytics/	13 KB 5 KB	55ms 9ms	Script application/x-javascript	2a02:26f0:480:f::213:7ec6 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:480:f::213:7ec6 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash f56ccb2db87aacedd9415232e40f80bff9939703df2f9c3f9ec8a092e545349f Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-encoding gzip x-content-type-options nosniff last-modified Tue, 10 Jan 2023 17:22:56 GMT x-cdn AKAM vary Accept-Encoding content-type application/x-javascript;charset=utf-8 cache-control max-age=39442 server-timing ak_p; desc="1686190306238_34831750_109220396_12_672_6_25_146";dur=1 accept-ranges bytes content-length 4777
GET H2	200	60ef1ff1e9e012001579985b Show response ws.zoominfo.com/pixel/	3 KB 2 KB	343ms 300ms	Script text/javascript	2606:4700::6810:a852 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://ws.zoominfo.com/pixel/60ef1ff1e9e012001579985b Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700::6810:a852 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Express Resource Hash 30c63aefd07aaa3935bef7f6006908e77a1b11dd43cc856e568291fe6be26692 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-encoding gzip x-content-type-options nosniff cf-cache-status DYNAMIC via 1.1 google server cloudflare x-powered-by Express vary Accept-Encoding content-type text/javascript access-control-allow-origin * access-control-allow-credentials true cf-ray 7d3d9b261f9930fa-FRA access-control-allow-headers Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok alt-svc h3=":443"; ma=86400
GET H2	200	widget.js Show response app.hushly.com/runtime/	32 B 513 B	565ms 176ms	Script text/javascript	52.25.148.210 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://app.hushly.com/runtime/widget.js?aid=81472 Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.25.148.210 Boardman, United States, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-25-148-210.us-west-2.compute.amazonaws.com Software / Resource Hash a7d92992008b46515578762b3e72bbdc96c2f577bf7eeb20e46027eb90ce458e Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-type text/javascript;charset=utf-8
POST H2	200	collect Show response www.google-analytics.com/j/	3 B 214 B	15ms 14ms	XHR text/plain	2a00:1450:4001:811::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j100&a=2047077124&t=pageview&_s=1&dl=https%3A%2F%2Fwww.obsidiansecurity.com%2Fblog%2Fsaas-ransomware-observed-sharepoint-microsoft-365%2F&ul=en-us&de=UTF-8&dt=SaaS%20Ransomware%20Observed%20in%20the%20Wild%20for%20Sharepoint%20in%20Microsoft%20365%20%7C%20Obsidian%20Security&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAEABAAAAACAAI~&jid=1470926347&gjid=821472672&cid=2122033525.1686190306&tid=UA-100320523-1&_gid=1024357507.1686190306&_r=1&_slc=1&gtm=45He3650n81P5GWZRJ&z=1280030099 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://www.obsidiansecurity.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Thu, 08 Jun 2023 02:11:46 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.obsidiansecurity.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 3 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	token Show response cdn.linkedin.oribi.io/partner/2390244/domain/obsidiansecurity.com/	36 B 373 B	25ms 8ms	XHR application/json	2600:9000:20eb:c00:2:53b2:240:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cdn.linkedin.oribi.io/partner/2390244/domain/obsidiansecurity.com/token Requested by Host: snap.licdn.com URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:20eb:c00:2:53b2:240:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash 7b1eaaaf180a13c29b6dddc3b0ae23333b4397e0f3c065b4c86da2f2530a5f89 Request headers Accept * Referer https://www.obsidiansecurity.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:31 GMT content-encoding gzip via 1.1 cb33a7a4640adbb55df3e0d143601558.cloudfront.net (CloudFront) x-amz-cf-pop FRA2-C1 age 15 vary accept-encoding x-cache Hit from cloudfront content-type application/json access-control-allow-origin * cache-control public, max-age=3600 x-amz-cf-id 0dr5GtsflveNtYKLOknXwoQKNhhG2pwkz5E3fl2NqPc8kepGQ5y-0g==
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2390244&time=1686190306333&url=https%3A%2F%2Fwww.obsidiansecurity.com%2Fblog%2Fsaas-ransomware-observed-sharepoint-microsoft-365%2F https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2390244&time=1686190306333&url=https%3A%2F%2Fwww.obsidiansecurity.com%2Fblog%2Fsaas-ransomware-observed-sharepoint-microsoft-365%2F&cookiesTest=true https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D2390244%26time%3D1686190306333%26url%3Dhttps%253A%252F%252Fwww.obsidiansecurity.c... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2390244&time=1686190306333&url=https%3A%2F%2Fwww.obsidiansecurity.com%2Fblog%2Fsaas-ransomware-observed-sharepoint-microsoft-365%2F&cookiesTest=tr... https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2390244&time=1686190306333&url=https%3A%2F%2Fwww.obsidiansecurity.com%2Fblog%2Fsaas-ransomware-observed-sharepoint-microsoft-365%2F&cookiesTest=t...	0 266 B	414ms 149ms	Image application/javascript	13.107.42.14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2390244&time=1686190306333&url=https%3A%2F%2Fwww.obsidiansecurity.com%2Fblog%2Fsaas-ransomware-observed-sharepoint-microsoft-365%2F&cookiesTest=true&liSync=true&e_ipv6=AQKIZOwn9CpIaAAAAYiYxjdNJDjgX6orypMUb-pN4Q5OTmVv8cTdweGlFxAG3AAcSmDY5eUjYKvVhvZ1Hx0qr1WR5QDOKA Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Server 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:47 GMT x-li-pop afd-prod-ltx1-x x-msedge-ref Ref A: A57670AA851A47E68A2D9D48F1EB2BC2 Ref B: DUS30EDGE0714 Ref C: 2023-06-08T02:11:47Z linkedin-action 1 x-cache CONFIG_NOCACHE content-type application/javascript x-li-fabric prod-ltx1 x-li-proto http/2 content-length 0 x-li-uuid AAX9lMZORH9fV62tRLCNbg== Redirect headers date Thu, 08 Jun 2023 02:11:46 GMT x-li-pop afd-prod-ltx1-x x-msedge-ref Ref A: 3006F3F7828A4456BA5E66EAA0BCEF31 Ref B: DUS30EDGE0707 Ref C: 2023-06-08T02:11:47Z linkedin-action 1 x-cache CONFIG_NOCACHE x-li-fabric prod-ltx1 location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=2390244&time=1686190306333&url=https%3A%2F%2Fwww.obsidiansecurity.com%2Fblog%2Fsaas-ransomware-observed-sharepoint-microsoft-365%2F&cookiesTest=true&liSync=true&e_ipv6=AQKIZOwn9CpIaAAAAYiYxjdNJDjgX6orypMUb-pN4Q5OTmVv8cTdweGlFxAG3AAcSmDY5eUjYKvVhvZ1Hx0qr1WR5QDOKA x-li-proto http/2 content-length 0 x-li-uuid AAX9lMZH63yzjbJXNoIvsQ==
GET H2	200	blog-banner.png www.obsidiansecurity.com/wp-content/uploads/2021/06/	6 KB 6 KB	270ms 269ms	Image image/png	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://www.obsidiansecurity.com/wp-content/uploads/2021/06/blog-banner.png Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 0c5c8787617b7022104ec5ee565ca417acc232e6bbe4e1e16e8e318c48361c50 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload content-length 5684 x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:53 GMT server nginx etag "64808075-1634" vary Accept-Encoding x-frame-options DENY content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=() accept-ranges bytes
GET H2	200	pure-storage-saas-security-program_thumbnail-copy-409x230.png www.obsidiansecurity.com/wp-content/uploads/2023/06/	25 KB 26 KB	270ms 269ms	Image image/png	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://www.obsidiansecurity.com/wp-content/uploads/2023/06/pure-storage-saas-security-program_thumbnail-copy-409x230.png Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 73cbcc8863929bce2dd74825eb6a09a90919477f6773a8f70dd233cd8c28617b Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload content-length 25766 x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:44 GMT server nginx etag "6480806c-64a6" vary Accept-Encoding x-frame-options DENY content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=() accept-ranges bytes
GET H2	200	regulatory-amendments-saas_thumbnail-409x230.png www.obsidiansecurity.com/wp-content/uploads/2023/05/	24 KB 24 KB	270ms 269ms	Image image/png	35.202.211.50 GOOGLE-CLOUD-PLAT...
General Check archive.org Show headers Download Go to Show image Full URL https://www.obsidiansecurity.com/wp-content/uploads/2023/05/regulatory-amendments-saas_thumbnail-409x230.png Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol H2 Security TLS 1.3, , AES_256_GCM Server 35.202.211.50 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US), Reverse DNS 50.211.202.35.bc.googleusercontent.com Software nginx / Resource Hash 480a80c3a4b132892a0a1ce11c89b6f6234989578984b19b5c5297a729c6fbe8 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection “1; mode=block” Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT content-security-policy upgrade-insecure-requests x-content-type-options nosniff strict-transport-security max-age=63072000; includeSubDomains; preload content-length 24417 x-xss-protection “1; mode=block” referrer-policy strict-origin-when-cross-origin last-modified Wed, 07 Jun 2023 13:04:44 GMT server nginx etag "6480806c-5f61" vary Accept-Encoding x-frame-options DENY content-type image/png access-control-allow-origin * cache-control public, max-age=31536000 permissions-policy geolocation=(self "https://www.obsidiansecurity.com"), microphone=() accept-ranges bytes
GET H/1.1	200 OK	roundtrip.js Show response s.adroll.com/j/R4IJVMDLKJFKTCAMPUMTWD/	87 KB 27 KB	72ms 7ms	Script text/javascript	2600:9000:225e:c600:6:9280:1080:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s.adroll.com/j/R4IJVMDLKJFKTCAMPUMTWD/roundtrip.js Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225e:c600:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 67c34de8fd07dd3859a66cac64fd0231bf058c3b63bcce3f73a211dfb678b961 Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers X-Amz-Version-Id GPKBhycXBAJe2Uokgu0YK70Rh00HmiUF Content-Encoding gzip Via 1.1 a962efd99fafcdb81ca24e0e8140a67c.cloudfront.net (CloudFront) Date Thu, 08 Jun 2023 02:11:32 GMT Age 15 X-Amz-Cf-Pop FRA60-P4 X-Amz-Server-Side-Encryption AES256 Transfer-Encoding chunked X-Cache Hit from cloudfront Connection keep-alive Last-Modified Tue, 23 May 2023 12:03:21 GMT Server AmazonS3 Etag W/"c1be13dd4af1c9812d79d572ae7272ea" Vary Accept-Encoding Access-Control-Allow-Methods GET Content-Type text/javascript; charset=utf-8 Access-Control-Allow-Origin * Cache-Control max-age=3600, must-revalidate Access-Control-Allow-Credentials false Access-Control-Max-Age 600 Access-Control-Allow-Headers * X-Amz-Cf-Id 928UCp4EBMx77cx94kdoy9rhSBHOVAmlqLJKZOYsczeoMErw5xF22A==
GET H/1.1	200 OK	index.js Show response s.adroll.com/j/exp/ Redirect Chain https://s.adroll.com/j/exp/R4IJVMDLKJFKTCAMPUMTWD/index.js https://s.adroll.com/j/exp/index.js	28 B 785 B	9ms 9ms	Script application/javascript	2600:9000:225e:c600:6:9280:1080:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s.adroll.com/j/exp/index.js Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol HTTP/1.1 Server 2600:9000:225e:c600:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52 Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers X-Amz-Version-Id KLTaAvzmAP.1_rS.URSLlTS3u46mZQHP Date Wed, 07 Jun 2023 15:02:31 GMT Via 1.1 a962efd99fafcdb81ca24e0e8140a67c.cloudfront.net (CloudFront) Age 40157 X-Amz-Cf-Pop FRA60-P4 X-Amz-Server-Side-Encryption AES256 X-Cache Hit from cloudfront Connection keep-alive Content-Length 28 Last-Modified Tue, 21 Mar 2023 16:39:30 GMT Server AmazonS3 Etag "5816cced8568d223aa09d889f300692b" Vary Accept-Encoding Access-Control-Allow-Methods GET Content-Type application/javascript Access-Control-Allow-Origin * Access-Control-Max-Age 600 Access-Control-Allow-Credentials false Accept-Ranges bytes Access-Control-Allow-Headers * X-Amz-Cf-Id OWhciwGLNClnysE4uEhFjs-XDqJhindmu_1XbGVRW7D9KB633WqgVg== Redirect headers Date Wed, 07 Jun 2023 19:53:58 GMT Via 1.1 a962efd99fafcdb81ca24e0e8140a67c.cloudfront.net (CloudFront) Age 22667 X-Amz-Cf-Pop FRA60-P4 X-Cache Hit from cloudfront Connection keep-alive Content-Length 0 Server AmazonS3 Access-Control-Max-Age 600 Access-Control-Allow-Methods GET Content-Type application/xml Location https://s.adroll.com/j/exp/index.js Access-Control-Allow-Origin * Access-Control-Allow-Credentials false Access-Control-Allow-Headers * X-Amz-Cf-Id c7RM_I-CLg6Y7B9bvIUvNpuE-eZ1kcJ16CffgJCuNPV974KYS8ndBA==
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/163/	11 KB 5 KB	14ms 14ms	Script application/x-javascript	104.102.38.132 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/163/munchkin.js Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/munchkin.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.102.38.132 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-102-38-132.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 68cc280ce370c6f1f51a4fc5950103fc38df80a429552c549add04ebd8bd3a23 Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers Date Thu, 08 Jun 2023 02:11:46 GMT Content-Encoding gzip Last-Modified Fri, 06 Jan 2023 02:26:40 GMT Server AkamaiNetStorage ETag "ea7826f34518d7c2295738f39c7640fa:1672972000.238769" Vary Accept-Encoding P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Content-Type application/x-javascript Cache-Control max-age=8640000 Connection keep-alive Accept-Ranges bytes Content-Length 4741 Expires Sat, 16 Sep 2023 02:11:46 GMT
POST H/1.1	200 OK	visitWebPage 124-div-269.mktoresp.com/webevents/	2 B 318 B	1101ms 98ms	Ping text/plain	192.28.144.124 OMNITURE
General Check archive.org Show headers Download Go to Full URL https://124-div-269.mktoresp.com/webevents/visitWebPage?_mchNc=1686190306576&_mchCn=&_mchId=124-DIV-269&_mchTk=_mch-obsidiansecurity.com-1686190306574-61675&_mchHo=www.obsidiansecurity.com&_mchPo=&_mchRu=%2Fblog%2Fsaas-ransomware-observed-sharepoint-microsoft-365%2F&_mchPc=https%3A&_mchVr=163&_mchEcid=&_mchHa=&_mchRe=&_mchQp= Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/163/munchkin.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 192.28.144.124 , United States, ASN15224 (OMNITURE, US), Reverse DNS Software nginx/1.20.1 / Resource Hash 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3 Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers Date Thu, 08 Jun 2023 02:11:47 GMT Content-Encoding gzip Server nginx/1.20.1 Transfer-Encoding chunked Content-Type text/plain; charset=UTF-8 Access-Control-Allow-Origin * Connection keep-alive X-Request-Id d3cce5f5-791e-4bae-979f-19db9c9ae449
GET H2	200	R4IJVMDLKJFKTCAMPUMTWD Show response d.adroll.com/consent/check/	453 B 546 B	127ms 30ms	Script application/javascript	2a05:d018:cc3:fe05:fc57:13d8:b65e:4717 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://d.adroll.com/consent/check/R4IJVMDLKJFKTCAMPUMTWD?pv=65518215746.60406&arrfrr=https%3A%2F%2Fwww.obsidiansecurity.com%2Fblog%2Fsaas-ransomware-observed-sharepoint-microsoft-365%2F&_s=3f3306dfd17ca70f42a63dcda0462b29&_b=2 Requested by Host: s.adroll.com URL: https://s.adroll.com/j/R4IJVMDLKJFKTCAMPUMTWD/roundtrip.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a05:d018:cc3:fe05:fc57:13d8:b65e:4717 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS Software nginx/1.22.1 / Resource Hash 6cb938e67bae881e2d7240a3c3124b091c7cfde60db448d0de9da9695b29749f Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Thu, 08 Jun 2023 02:11:46 GMT server nginx/1.22.1 content-length 453 content-type application/javascript
GET H2	200	recaptcha__en.js Show response www.gstatic.com/recaptcha/releases/sNQO7xVld1CuA2hfFHvkpVL-/	407 KB 163 KB	804ms 6ms	Script text/javascript	2a00:1450:4001:82b::2003 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.gstatic.com/recaptcha/releases/sNQO7xVld1CuA2hfFHvkpVL-/recaptcha__en.js Requested by Host: www.google.com URL: https://www.google.com/recaptcha/api.js?hl=en Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:82b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash d946e8f3fb4fe90a5ae3027b91a76703106e2c5c1d762fc3fc230895db7b6048 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://www.obsidiansecurity.com/ Origin https://www.obsidiansecurity.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers date Wed, 07 Jun 2023 21:13:59 GMT content-encoding gzip x-content-type-options nosniff age 17868 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 166186 x-xss-protection 0 last-modified Tue, 30 May 2023 00:01:16 GMT server sffe cross-origin-opener-policy same-origin-allow-popups; report-to="recaptcha" vary Accept-Encoding report-to {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} content-type text/javascript access-control-allow-origin * cache-control public, max-age=31536000 accept-ranges bytes expires Thu, 06 Jun 2024 21:13:59 GMT
GET H2	500	activation Show response hummingbirdwebsocket-va7.cloud.adobe.io/	31 B 174 B	897ms 110ms	Fetch application/json	20.186.185.227 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://hummingbirdwebsocket-va7.cloud.adobe.io/activation?contentUrl=https%3A%2F%2Fwww.obsidiansecurity.com%2Fblog%2Fsaas-ransomware-observed-sharepoint-microsoft-365%2F&sessionId=&forceSessionId=&orgId=A01C1D3E624B03520A495E0F%40AdobeOrg&instanceId=obsidiansecurity&ecid=&mkto_trk=_mch-obsidiansecurity.com-1686190306574-61675&timeZone=Etc%2FUnknown Requested by Host: assets.adoberesources.net URL: https://assets.adoberesources.net/builds/4086a475f3fb7634d2b7d2e4103d3797fe9e0498/dist/core/src/index.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 20.186.185.227 Boydton, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software adobe / Express Resource Hash 7f5e79b1f72eee48a9dd68555086202f5959cf5f31e7557ff6c9b6d021ebdb12 Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers access-control-allow-origin * date Thu, 08 Jun 2023 02:11:47 GMT server adobe x-powered-by Express content-length 31 etag W/"1f-li382C00MNjGjNl7uSzWeXZXkuI" content-type application/json; charset=utf-8
POST H2	200	p Show response app.clearbit.com/v1/	16 B 1 KB	913ms 185ms	XHR application/json	18.153.4.44 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://app.clearbit.com/v1/p Requested by Host: x.clearbitjs.com URL: https://x.clearbitjs.com/v2/pk_b3e5b8359fbae511329400f112b1c0c6/tracking.min.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.153.4.44 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US), Reverse DNS ec2-18-153-4-44.eu-central-1.compute.amazonaws.com Software envoy / Resource Hash c955e57777ec0d73639dca6748560d00aa5eb8e12f13ebb2ed9656add3908f97 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://www.obsidiansecurity.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Content-Type text/plain Response headers date Thu, 08 Jun 2023 02:11:47 GMT content-encoding gzip x-content-type-options nosniff x-envoy-response-flags - server envoy strict-transport-security max-age=63072000; includeSubDomains; preload vary Accept-Encoding access-control-allow-methods GET, POST, PUT, DELETE, OPTIONS content-type application/json access-control-allow-origin https://www.obsidiansecurity.com content-security-policy-report-only default-src 'self'; script-src 'unsafe-inline' 'report-sample' 'self' https://browser.sentry-cdn.com https://cdn.amplitude.com/libs/amplitude-5.2.2-min.gz.js https://cdn.clearbit.com https://cdn.segment.com/analytics.js/v1/auzWlbWIBrAsKnGQIiT0X3IjfZyepgW5/analytics.min.js https://connect.facebook.net https://edge.fullstory.com/s/fs.js https://fast.appcues.com https://www.google-analytics.com/analytics.js https://x.clearbitjs.com https://cdn.clearbit.com; style-src 'unsafe-inline' 'report-sample' 'self' https://cdn.clearbit.com https://fast.appcues.com https://fonts.googleapis.com; object-src 'none'; base-uri 'self'; connect-src 'self' https://api.amplitude.com https://api.segment.io https://rs.fullstory.com https://www.google-analytics.com wss://api.appcues.net https://stats.g.doubleclick.net https://sentry.io https://logo.clearbit.com; font-src 'self' https://fonts.gstatic.com; frame-src 'self'; img-src 'self' data: https://cdn.clearbit.com https://images.ctfassets.net https://logo.clearbit.com https://www.facebook.com https://connect.facebook.net https://www.google.com https://unpkg.com/react-flag-kit https://cloudfront.net/v1/avatars https://*.googleusercontent.com; manifest-src 'self'; media-src 'self'; worker-src 'none'; access-control-allow-credentials true access-control-allow-headers Authorization, API-Version, Content-Type
GET H/1.1	200 OK	consent_tcfv2.js Show response s.adroll.com/j/	410 KB 55 KB	8ms 7ms	Script application/javascript	2600:9000:225e:c600:6:9280:1080:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://s.adroll.com/j/consent_tcfv2.js Requested by Host: s.adroll.com URL: https://s.adroll.com/j/R4IJVMDLKJFKTCAMPUMTWD/roundtrip.js Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225e:c600:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 91144fbcc0e3f609b021e362ec29d2a9b58f15e840f229eb99ea2c04d927882b Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers X-Amz-Version-Id 44sIT20LqRj70wQHqyIoOw7etYYdjkbK Content-Encoding gzip Via 1.1 a962efd99fafcdb81ca24e0e8140a67c.cloudfront.net (CloudFront) Date Thu, 08 Jun 2023 02:11:04 GMT Age 63 X-Amz-Cf-Pop FRA60-P4 X-Amz-Server-Side-Encryption AES256 Transfer-Encoding chunked X-Cache Hit from cloudfront Connection keep-alive Last-Modified Wed, 04 May 2022 19:41:48 GMT Server AmazonS3 Etag W/"0a7d0ea8d7d31b07e925fe340acf431b" Vary Accept-Encoding Access-Control-Allow-Methods GET Content-Type application/javascript Access-Control-Allow-Origin * Cache-Control max-age=300, must-revalidate Access-Control-Allow-Credentials false Access-Control-Max-Age 600 Access-Control-Allow-Headers * X-Amz-Cf-Id vpCbMwcpbMrSBG2I6dqeHhMBYH67fa1LLo_2EeBP4aIHmiROovew-Q==
GET H/1.1	200 OK	nextroll-32x32.png s.adroll.com/i/favicon/	2 KB 2 KB	8ms 7ms	Image image/png	2600:9000:225e:c600:6:9280:1080:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://s.adroll.com/i/favicon/nextroll-32x32.png Requested by Host: www.obsidiansecurity.com URL: https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/ Protocol HTTP/1.1 Security TLS 1.3, , AES_128_GCM Server 2600:9000:225e:c600:6:9280:1080:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash bcaf0e3f087296133e0a996ee3d289a8d1a690147c93e0ab62019b505e6f9355 Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers X-Amz-Version-Id eTpwxbAIDHDUN.4tfrROIgU_pzKN9Xh0 Date Wed, 07 Jun 2023 15:03:32 GMT Via 1.1 a962efd99fafcdb81ca24e0e8140a67c.cloudfront.net (CloudFront) Age 40098 X-Amz-Cf-Pop FRA60-P4 X-Amz-Server-Side-Encryption AES256 X-Cache Hit from cloudfront Connection keep-alive Content-Length 1615 Last-Modified Mon, 28 Jun 2021 18:19:21 GMT Server AmazonS3 Etag "403a0a7dcf2d617e7ea852bfb9d11945" Vary Accept-Encoding Access-Control-Allow-Methods GET Content-Type image/png Access-Control-Allow-Origin * Access-Control-Max-Age 600 Access-Control-Allow-Credentials false Accept-Ranges bytes Access-Control-Allow-Headers * X-Amz-Cf-Id 425F-g8qSOKGXtuoXQ081HhidxOoHqq7pXWN77nnrOQdP2Hi00g_lg==
POST H2	204	collect region1.analytics.google.com/g/	0 54 B	14ms 14ms	Ping text/plain	2001:4860:4802:32::36 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://region1.analytics.google.com/g/collect?v=2&tid=G-XESBQ81H1M&gtm=45je3650&_p=2047077124&cid=2122033525.1686190306&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AEA&_s=2&sid=1686190305&sct=1&seg=0&dl=https%3A%2F%2Fwww.obsidiansecurity.com%2Fblog%2Fsaas-ransomware-observed-sharepoint-microsoft-365%2F&dt=&en=scroll&epn.percent_scrolled=90&_et=7 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-XESBQ81H1M Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://www.obsidiansecurity.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.106 Safari/537.36 Response headers pragma no-cache date Thu, 08 Jun 2023 02:11:50 GMT server Golfe2 content-type text/plain access-control-allow-origin https://www.obsidiansecurity.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT