msrc-blog.microsoft.com
Open in
urlscan Pro
13.107.219.45
Public Scan
URL:
https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/
Submission: On July 06 via api from SE — Scanned from SE
Submission: On July 06 via api from SE — Scanned from SE
Summary
This website contacted 3 IPs
in 2 countries
across 2 domains to perform 14 HTTP transactions.
The main IP is 13.107.219.45, located in
United States and
belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US.
The main domain is msrc-blog.microsoft.com.
The Cisco Umbrella rank of the primary domain is 252604.
TLS certificate: Issued by Microsoft Azure TLS Issuing CA 05 on May 28th 2022. Valid for: a year.
This is the only time msrc-blog.microsoft.com was scanned on urlscan.io!
TLS certificate: Issued by Microsoft Azure TLS Issuing CA 05 on May 28th 2022. Valid for: a year.
This is the only time msrc-blog.microsoft.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
| IP Address | AS Autonomous System | ||
|---|---|---|---|
| 9 | 13.107.219.45 13.107.219.45 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
| 1 | 13.107.227.45 13.107.227.45 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
| 4 | 13.69.239.73 13.69.239.73 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
| 14 | 3 |
4
13.69.239.73
(Dublin, Ireland)
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
| browser.events.data.microsoft.com |
| Apex Domain Subdomains |
Transfer | |
|---|---|---|
| 13 |
microsoft.com
msrc-blog.microsoft.com — Cisco Umbrella Rank: 252604 browser.events.data.microsoft.com — Cisco Umbrella Rank: 226 |
69 KB |
| 1 |
azure.com
js.monitor.azure.com — Cisco Umbrella Rank: 2972 |
49 KB |
| 14 | 2 |
| Domain | Requested by | |
|---|---|---|
| 9 | msrc-blog.microsoft.com |
msrc-blog.microsoft.com
|
| 4 | browser.events.data.microsoft.com |
js.monitor.azure.com
|
| 1 | js.monitor.azure.com |
msrc-blog.microsoft.com
|
| 14 | 3 |
This site contains links to these domains. Also see Links.
| Subject Issuer | Validity | Valid | |
|---|---|---|---|
| msrc-blog.microsoft.com Microsoft Azure TLS Issuing CA 05 |
2022-05-28 - 2023-05-23 |
a year | crt.sh |
| js.monitor.azure.com Microsoft Azure TLS Issuing CA 06 |
2022-06-26 - 2023-06-21 |
a year | crt.sh |
| *.events.data.microsoft.com Microsoft Azure TLS Issuing CA 02 |
2022-05-21 - 2023-05-16 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/
Frame ID: 982CD1B939B2752253FE7508941F59FA
Requests: 12 HTTP requests in this frame
Screenshot
Page Title
Microsoft’s Response to CVE-2021-44228 Apache Log4j 2 – Microsoft Security Response CenterDetected technologies
WordPress
(CMS)
Expand
Overall confidence: 100%
Detected patterns
Detected patterns
- <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
- /wp-(?:content|includes)/
- wp-embed\.min\.js\?ver=([\d.]+)
Page Statistics
34 Outgoing links
These are links going to different origins than the main page.
URL: https://msrc.microsoft.com/create-report
Title: Report Security Vulnerability
Title: Report Security Vulnerability
Search URL Search Domain Scan URL
URL: https://portal.msrc.microsoft.com/en-us/engage/cars
Title: Report Abuse
Title: Report Abuse
Search URL Search Domain Scan URL
URL: https://portal.msrc.microsoft.com/
Title: Security Update Guide
Title: Security Update Guide
Search URL Search Domain Scan URL
URL: https://microsoft.com/msrc
Title: About MSRC
Title: About MSRC
Search URL Search Domain Scan URL
URL: https://help.minecraft.net/hc/en-us/articles/4416199399693-Security-Vulnerability-in-Minecraft-Java-Edition
Title: Minecraft: Java Edition
Title: Minecraft: Java Edition
Search URL Search Domain Scan URL
URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-44228
Title: CVE-2021-44228
Title: CVE-2021-44228
Search URL Search Domain Scan URL
URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-45046
Title: CVE-2021-45046
Title: CVE-2021-45046
Search URL Search Domain Scan URL
URL: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-44228
Title: Security Update Guide – CVE-2021-44228
Title: Security Update Guide – CVE-2021-44228
Search URL Search Domain Scan URL
URL: https://logging.apache.org/log4j/2.x/security.html
Title: Apache Log4j Security Vulnerabilities
Title: Apache Log4j Security Vulnerabilities
Search URL Search Domain Scan URL
URL: https://blogs.apache.org/foundation/entry/apache_logging_services_project_announces
Title: Log4j 1.x End of Life
Title: Log4j 1.x End of Life
Search URL Search Domain Scan URL
URL: https://www.cvedetails.com/cve/CVE-2019-17571/
Title: CVE-2019-17571
Title: CVE-2019-17571
Search URL Search Domain Scan URL
URL: https://logging.apache.org/log4j/2.x/
Title: Log4j 2
Title: Log4j 2
Search URL Search Domain Scan URL
URL: https://docs.microsoft.com/en-us/azure/azure-arc/data/release-notes#december-2021
Title: December 2021 release
Title: December 2021 release
Search URL Search Domain Scan URL
URL: https://discuss.elastic.co/t/apache-log4j2-remote-code-execution-rce-vulnerability-cve-2021-44228-esa-2021-31/291476
Title: Apache Log4j2 Remote Code Execution (RCE) Vulnerability – CVE–2021–44228 – ESA–2021–31 – Announcements / Security Announcements – Discuss the Elastic Stack
Title: Apache Log4j2 Remote Code Execution (RCE) Vulnerability – CVE–2021–44228 – ESA–2021–31 – Announcements / Security Announcements – Discuss the Elastic Stack
Search URL Search Domain Scan URL
URL: https://www.microsoft.com/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/
Title: here
Title: here
Search URL Search Domain Scan URL
URL: https://docs.microsoft.com/en-us/azure/databricks/kb/libraries/verify-log4j-version
Title: Verify the version of Log4j on your cluster
Title: Verify the version of Log4j on your cluster
Search URL Search Domain Scan URL
URL: https://docs.microsoft.com/en-us/azure/hdinsight/hdinsight-40-component-versioning
Title: currently supported components
Title: currently supported components
Search URL Search Domain Scan URL
URL: https://hdiconfigactions.blob.core.windows.net/patch-log4j-cve/patch-log4j-cve-2021-44228-all-rev2.sh
Title: https://hdiconfigactions.blob.core.windows.net/patch-log4j-cve/patch-log4j-cve-2021-44228-all-rev2.sh
Title: https://hdiconfigactions.blob.core.windows.net/patch-log4j-cve/patch-log4j-cve-2021-44228-all-rev2.sh
Search URL Search Domain Scan URL
URL: https://docs.microsoft.com/en-us/azure/hdinsight/hdinsight-hadoop-customize-cluster-linux#script-action-during-cluster-creation
Title: cluster creation process
Title: cluster creation process
Search URL Search Domain Scan URL
URL: https://spring.io/blog/2021/12/10/log4j2-vulnerability-and-spring-boot
Title: Log4j 2 vulnerability and Spring Boot
Title: Log4j 2 vulnerability and Spring Boot
Search URL Search Domain Scan URL
URL: https://discuss.newrelic.com/t/log4j-zero-day-vulnerability-and-the-new-relic-java-agent/170322
Title: New Relic
Title: New Relic
Search URL Search Domain Scan URL
URL: https://docs.appdynamics.com/display/PAA/Security+Advisory%3A+Apache+Log4j+Vulnerability
Title: AppDynamics
Title: AppDynamics
Search URL Search Domain Scan URL
URL: https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-policy-common
Title: Templates and examples
Title: Templates and examples
Search URL Search Domain Scan URL
URL: https://techcommunity.microsoft.com/t5/azure-active-directory-identity/more-control-and-better-insights-for-your-zero-trust-deployments/ba-p/2365684
Title: application tagging capabilities
Title: application tagging capabilities
Search URL Search Domain Scan URL
URL: https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/concept-conditional-access-cloud-apps
Title: target stricter policies to them
Title: target stricter policies to them
Search URL Search Domain Scan URL
URL: https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-all-users-mfa
Title: Enable MFA for all access to these resources
Title: Enable MFA for all access to these resources
Search URL Search Domain Scan URL
URL: https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-risk
Title: enable blocking on risky logins
Title: enable blocking on risky logins
Search URL Search Domain Scan URL
URL: https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-location
Title: restrict access to your resources to known/trusted locations or networks
Title: restrict access to your resources to known/trusted locations or networks
Search URL Search Domain Scan URL
URL: https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/howto-conditional-access-policy-compliant-device
Title: Require Azure AD joined or better, MDM managed devices
Title: Require Azure AD joined or better, MDM managed devices
Search URL Search Domain Scan URL
URL: https://aka.ms/securitysteps
Title: https://aka.ms/securitysteps
Title: https://aka.ms/securitysteps
Search URL Search Domain Scan URL
URL: https://docs.microsoft.com/sql/big-data-cluster/release-notes-cumulative-updates-history#cu9
Title: SQL Server Big Data Clusters cumulative updates history
Title: SQL Server Big Data Clusters cumulative updates history
Search URL Search Domain Scan URL
URL: https://community.riskiq.com/article/505098fc
Title: CVE-2021-44228 Apache Log4j Remote Code Execution Vulnerability
Title: CVE-2021-44228 Apache Log4j Remote Code Execution Vulnerability
Search URL Search Domain Scan URL
URL: https://sip.security.microsoft.com/threatanalytics3/a41971d4-cf8b-4fcf-946e-bd042229e8fa/overview
Title: CVE-2021-44228 Log4j active exploitation
Title: CVE-2021-44228 Log4j active exploitation
Search URL Search Domain Scan URL
URL: https://wpastra.com/
Title: Astra WordPress Theme
Title: Astra WordPress Theme
Search URL Search Domain Scan URL
Redirected requests
There were HTTP redirect chains for the following requests:
14 HTTP transactions
| Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
GET H2 |
Primary Request
/
msrc-blog.microsoft.com/2021/12/11/microsofts-response-to-cve-2021-44228-apache-log4j2/ |
98 KB 23 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
style.min.css
msrc-blog.microsoft.com/wp-content/themes/astra/assets/css/minified/ |
77 KB 19 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
menu-animation.min.css
msrc-blog.microsoft.com/wp-content/themes/astra/assets/css/minified/ |
3 KB 968 B |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
style.min.css
msrc-blog.microsoft.com/wp-includes/css/dist/block-library/ |
57 KB 12 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
ms.analytics-web-3.min.js
js.monitor.azure.com/scripts/c/ |
138 KB 49 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
wp-emoji-release.min.js
msrc-blog.microsoft.com/wp-includes/js/ |
14 KB 6 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
style.min.js
msrc-blog.microsoft.com/wp-content/themes/astra/assets/js/minified/ |
10 KB 4 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
wp-embed.min.js
msrc-blog.microsoft.com/wp-includes/js/ |
1 KB 1 KB |
Script
application/x-javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
astra.woff
msrc-blog.microsoft.com/wp-content/themes/astra/assets/fonts/ |
0 0 |
Font
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
GET H2 |
astra.ttf
msrc-blog.microsoft.com/wp-content/themes/astra/assets/fonts/ |
3 KB 2 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H/1.1 |
/
browser.events.data.microsoft.com/OneCollector/1.0/ |
153 B 1 KB |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
OPTIONS H/1.1 |
/
browser.events.data.microsoft.com/OneCollector/1.0/ |
0 0 |
Preflight
|
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
POST H/1.1 |
/
browser.events.data.microsoft.com/OneCollector/1.0/ |
153 B 601 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
|
OPTIONS H/1.1 |
/
browser.events.data.microsoft.com/OneCollector/1.0/ |
0 0 |
Preflight
|
||||||||||||||||||||||||||||||||||||||||||||||||||
|
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||
Verdicts & Comments Add Verdict or Comment
26 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| _wpemojiSettings object| twemoji object| wp object| e function| t object| oneDS object| config object| astra function| astraGetParents function| getParents function| astraToggleClass function| toggleClass function| astraTriggerEvent function| AstraToggleSubMenu function| AstraNavigationMenu function| AstraToggleMenu function| AstraToggleSetup function| astraNavMenuToggle5 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
| Domain/Path | Expires | Name / Value |
|---|---|---|
| msrc-blog.microsoft.com/ | Name: MicrosoftApplicationsTelemetryDeviceId Value: 54705faa-ddba-4c56-926a-7105238aeaea |
|
| msrc-blog.microsoft.com/ | Name: ai_session Value: QWWFKk+RXNh9/R4p+3H5SS|1657118529861|1657118529861 |
|
| .microsoft.com/ | Name: MC1 Value: GUID=3e71039ed40941d1b335867a8faeca73&HASH=3e71&LV=202207&V=4&LU=1657118526495 |
|
| .microsoft.com/ | Name: MS0 Value: 15d92fdb6351411fbf605944806721b2 |
|
| msrc-blog.microsoft.com/ | Name: MSFPC Value: GUID=3e71039ed40941d1b335867a8faeca73&HASH=3e71&LV=202207&V=4&LU=1657118526495 |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
| Source | Level | URL Text |
|---|
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
browser.events.data.microsoft.com
js.monitor.azure.com
msrc-blog.microsoft.com
13.107.219.45
13.107.227.45
13.69.239.73
029ae2fbbc5b5b48423dfc77950abad8c1bfef908a674e0947f1da6935220e6f
0c5f584d1ea2c3313dc8c55824c2a572d3cf2eae87c5ca62a58e598aec9ddb5c
1ef0899dadf11eccd489e8aca5ef79eaf9c1caa00f9f1d4d8ad45ff1ed375ccf
2cd9de3dd26246204749cff259bc34e8e6a47ae5d6e4528b9b28c75d68d50cde
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991
87f4ea003c86230c9ac1cf8209f805bbfacac716f093eb1ed709f50a08669b5d
8985377087ddc305ce31aea80ac20f351c2752542926afd9438d164db69caee3
97e6b702954a7bb842cdd268a03d16a7847cf1f2b3897269a1dd495526155a3b
b6e169ac07a49b2c9d2b726bb3c384097badcc093dc6322c9a2ba066ae8e06a8
c29f9463b538a4cec0395afd2a7da158eccaee3b06d2e9eebb9a246e54ce0ed2
c3326eca3e04119400003592725c6a3c116ea221a7b3c581b8f92f789d71e4e8