urlscan.io logo urlscan.io
SecurityTrails logo

www.microsoft.com Open in urlscan Pro
2600:140b:400:2a8::356e  Public Scan

Go To Rescan Add Verdict Report
Submitted URL: http://lnkd.in/guca2AAp
Effective URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-a...
Submission: On October 11 via api from JP — Scanned from JP
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 22 IPs in 6 countries across 21 domains to perform 92 HTTP transactions. The main IP is 2600:140b:400:2a8::356e, located in Tokyo, Japan and belongs to AKAMAI-ASN1, NL. The main domain is www.microsoft.com. The Cisco Umbrella rank of the primary domain is 340.
TLS certificate: Issued by Microsoft RSA TLS CA 01 on July 8th 2022. Valid for: a year.
This is the only time www.microsoft.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
3 3 13.107.42.14 8068 (MICROSOFT...)
27 2600:140b:400... 20940 (AKAMAI-ASN1)
3 2600:140b:1a0... 20940 (AKAMAI-ASN1)
11 2620:1ec:40::46 8075 (MICROSOFT...)
1 23.33.33.203 20940 (AKAMAI-ASN1)
2 2600:140b:1a0... 20940 (AKAMAI-ASN1)
5 2600:140b:1a0... 20940 (AKAMAI-ASN1)
1 2600:140b:1a0... 20940 (AKAMAI-ASN1)
1 184.26.252.188 20940 (AKAMAI-ASN1)
5 5 2620:1ec:21::14 8068 (MICROSOFT...)
1 3 104.18.102.194 13335 (CLOUDFLAR...)
11 2600:140b:1a0... 20940 (AKAMAI-ASN1)
9 23.96.225.71 8075 (MICROSOFT...)
1 117.18.232.200 15133 (EDGECAST)
2 20.120.124.64 8075 (MICROSOFT...)
1 35.75.121.70 16509 (AMAZON-02)
2 2 142.250.196.134 15169 (GOOGLE)
1 1 2404:6800:400... 15169 (GOOGLE)
1 2404:6800:400... 15169 (GOOGLE)
6 20.50.73.10 8075 (MICROSOFT...)
2 4 52.231.207.240 8075 (MICROSOFT...)
2 5 2620:1ec:c11:... 8068 (MICROSOFT...)
1 20.190.141.39 8075 (MICROSOFT...)
1 1 2404:6800:400... 15169 (GOOGLE)
1 1 2404:6800:400... 15169 (GOOGLE)
1 2404:6800:400... 15169 (GOOGLE)
1 2a03:2880:f10... 32934 (FACEBOOK)
92 22
3    13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
lnkd.in
px4.ads.linkedin.com
27    2600:140b:400:2a8::356e (Tokyo, Japan)

ASN20940 (AKAMAI-ASN1, NL)
www.microsoft.com
3    2600:140b:1a00:186::2957 (Tokyo, Japan)

ASN20940 (AKAMAI-ASN1, NL)
assets.onestore.ms
11    2620:1ec:40::46 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
wcpstatic.microsoft.com
js.monitor.azure.com
mem.gfx.ms
www.clarity.ms
logincdn.msauth.net
1    23.33.33.203 (Plainsboro, United States)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a23-33-33-203.deploy.static.akamaitechnologies.com
statics-marketingsites-wcus-ms-com.akamaized.net
2    2600:140b:1a00:14::17dc:5488 (Tokyo, Japan)

ASN20940 (AKAMAI-ASN1, NL)
img-prod-cms-rt-microsoft-com.akamaized.net
5    2600:140b:1a00:1a9::356e (Tokyo, Japan)

ASN20940 (AKAMAI-ASN1, NL)
c.s-microsoft.com
1    2600:140b:1a00:14::17dc:5487 (Tokyo, Japan)

ASN20940 (AKAMAI-ASN1, NL)
snap.licdn.com
1    184.26.252.188 (Tokyo, Japan)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a184-26-252-188.deploy.static.akamaitechnologies.com
query.prod.cms.rt.microsoft.com
5    2620:1ec:21::14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
px.ads.linkedin.com
www.linkedin.com
dc.ads.linkedin.com
3    104.18.102.194 (Shahr, Iran, Islamic Republic Of)

ASN13335 (CLOUDFLARENET, US)
p.adsymptotic.com
11    2600:140b:1a00:1b0::1e80 (Tokyo, Japan)

ASN20940 (AKAMAI-ASN1, NL)
assets.adobedtm.com
9    23.96.225.71 (Chicago, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
web.vortex.data.microsoft.com
1    117.18.232.200 (Australia)

ASN15133 (EDGECAST, US)
az725175.vo.msecnd.net
2    20.120.124.64 (Tappahannock, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
m.clarity.ms
1    35.75.121.70 (Tokyo, Japan)

ASN16509 (AMAZON-02, US)
PTR: ec2-35-75-121-70.ap-northeast-1.compute.amazonaws.com
dpm.demdex.net
2    142.250.196.134 (United States)

ASN15169 (GOOGLE, US)
PTR: nrt12s36-in-f6.1e100.net
ad.doubleclick.net
1    2404:6800:4004:827::2002 (Australia)

ASN15169 (GOOGLE, US)
adservice.google.com
1    2404:6800:4004:824::2002 (Australia)

ASN15169 (GOOGLE, US)
adservice.google.co.jp
6    20.50.73.10 (Dublin, Ireland)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
browser.events.data.microsoft.com
4    52.231.207.240 (Busan, Korea, Republic Of)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
c.clarity.ms
c1.microsoft.com
5    2620:1ec:c11::200 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
c.bing.com
bat.bing.com
1    20.190.141.39 (Osaka, Japan)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
login.live.com
1    2404:6800:4004:80b::2002 (Australia)

ASN15169 (GOOGLE, US)
googleads.g.doubleclick.net
1    2404:6800:4004:823::2004 (Australia)

ASN15169 (GOOGLE, US)
www.google.com
1    2404:6800:4004:824::2003 (Australia)

ASN15169 (GOOGLE, US)
www.google.co.jp
1    2a03:2880:f10f:83:face:b00c:0:25de (Tokyo, Japan)

ASN32934 (FACEBOOK, US)
www.facebook.com
Apex Domain
Subdomains		 Transfer
46 microsoft.com
www.microsoft.com — Cisco Umbrella Rank: 340
wcpstatic.microsoft.com — Cisco Umbrella Rank: 8583
query.prod.cms.rt.microsoft.com — Cisco Umbrella Rank: 8877
web.vortex.data.microsoft.com — Cisco Umbrella Rank: 3623
browser.events.data.microsoft.com — Cisco Umbrella Rank: 797
c1.microsoft.com — Cisco Umbrella Rank: 10370
590 KB
11 adobedtm.com
assets.adobedtm.com — Cisco Umbrella Rank: 479
103 KB
7 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 850
www.linkedin.com — Cisco Umbrella Rank: 840
px4.ads.linkedin.com — Cisco Umbrella Rank: 6680
dc.ads.linkedin.com — Cisco Umbrella Rank: 11782
5 KB
7 clarity.ms
www.clarity.ms — Cisco Umbrella Rank: 804
m.clarity.ms — Cisco Umbrella Rank: 6641
c.clarity.ms — Cisco Umbrella Rank: 1219
28 KB
5 bing.com
c.bing.com — Cisco Umbrella Rank: 426
bat.bing.com — Cisco Umbrella Rank: 665
14 KB
5 s-microsoft.com
c.s-microsoft.com — Cisco Umbrella Rank: 16682
147 KB
4 gfx.ms
mem.gfx.ms — Cisco Umbrella Rank: 5451
61 KB
3 doubleclick.net
ad.doubleclick.net — Cisco Umbrella Rank: 219
googleads.g.doubleclick.net — Cisco Umbrella Rank: 68
2 KB
3 adsymptotic.com
p.adsymptotic.com — Cisco Umbrella Rank: 926
584 B
3 akamaized.net
statics-marketingsites-wcus-ms-com.akamaized.net — Cisco Umbrella Rank: 19144
img-prod-cms-rt-microsoft-com.akamaized.net — Cisco Umbrella Rank: 1277
9 KB
3 onestore.ms
assets.onestore.ms — Cisco Umbrella Rank: 20704
211 KB
2 google.co.jp
adservice.google.co.jp — Cisco Umbrella Rank: 55951
www.google.co.jp — Cisco Umbrella Rank: 13296
1 KB
2 google.com
adservice.google.com — Cisco Umbrella Rank: 136
www.google.com — Cisco Umbrella Rank: 19
1 KB
2 azure.com
js.monitor.azure.com — Cisco Umbrella Rank: 4836
84 KB
1 msauth.net
logincdn.msauth.net — Cisco Umbrella Rank: 3454
7 KB
1 facebook.com
www.facebook.com — Cisco Umbrella Rank: 115
204 B
1 live.com
login.live.com — Cisco Umbrella Rank: 65
6 KB
1 demdex.net
dpm.demdex.net — Cisco Umbrella Rank: 293
3 KB
1 msecnd.net
az725175.vo.msecnd.net — Cisco Umbrella Rank: 12817
18 KB
1 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 1571
3 KB
1 lnkd.in
lnkd.in — Cisco Umbrella Rank: 125878
518 B
92 21
Domain Requested by
27 www.microsoft.com www.microsoft.com
11 assets.adobedtm.com query.prod.cms.rt.microsoft.com
assets.adobedtm.com
9 web.vortex.data.microsoft.com www.microsoft.com
az725175.vo.msecnd.net
mem.gfx.ms
6 browser.events.data.microsoft.com js.monitor.azure.com
5 c.s-microsoft.com assets.onestore.ms
4 mem.gfx.ms www.microsoft.com
mem.gfx.ms
3 bat.bing.com www.microsoft.com
bat.bing.com
3 p.adsymptotic.com 1 redirects www.microsoft.com
3 px.ads.linkedin.com 3 redirects
3 www.clarity.ms www.microsoft.com
www.clarity.ms
bat.bing.com
3 assets.onestore.ms www.microsoft.com
2 c1.microsoft.com 1 redirects
2 c.bing.com 2 redirects
2 c.clarity.ms 1 redirects
2 ad.doubleclick.net 2 redirects
2 m.clarity.ms www.clarity.ms
2 px4.ads.linkedin.com 2 redirects
2 img-prod-cms-rt-microsoft-com.akamaized.net www.microsoft.com
2 js.monitor.azure.com www.microsoft.com
mem.gfx.ms
1 logincdn.msauth.net login.live.com
1 www.facebook.com
1 www.google.co.jp
1 www.google.com 1 redirects
1 googleads.g.doubleclick.net 1 redirects
1 dc.ads.linkedin.com 1 redirects
1 login.live.com mem.gfx.ms
1 adservice.google.co.jp www.microsoft.com
1 adservice.google.com 1 redirects
1 dpm.demdex.net az725175.vo.msecnd.net
1 az725175.vo.msecnd.net www.microsoft.com
1 www.linkedin.com 1 redirects
1 query.prod.cms.rt.microsoft.com www.microsoft.com
1 snap.licdn.com www.microsoft.com
1 statics-marketingsites-wcus-ms-com.akamaized.net www.microsoft.com
1 wcpstatic.microsoft.com www.microsoft.com
1 lnkd.in 1 redirects
92 36
Subject Issuer Validity Valid
www.microsoft.com
Microsoft RSA TLS CA 01		 2022-07-08 -
2023-07-08		 a year crt.sh
wildcard.onestore.ms
Microsoft Azure TLS Issuing CA 05		 2022-09-22 -
2023-09-17		 a year crt.sh
wcpstatic.microsoft.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-03-10 -
2023-03-10		 a year crt.sh
js.monitor.azure.com
Microsoft Azure TLS Issuing CA 01		 2022-09-24 -
2023-09-19		 a year crt.sh
a248.e.akamai.net
DigiCert TLS RSA SHA256 2020 CA1		 2022-06-28 -
2023-06-30		 a year crt.sh
identitycdn.msauth.net
Microsoft Azure TLS Issuing CA 06		 2022-08-23 -
2023-08-18		 a year crt.sh
www.clarity.ms
DigiCert TLS RSA SHA256 2020 CA1		 2022-02-27 -
2023-02-27		 a year crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA		 2022-03-01 -
2023-03-01		 a year crt.sh
*.prod.cms.rt.microsoft.com
Microsoft Azure TLS Issuing CA 01		 2022-07-08 -
2023-07-03		 a year crt.sh
assets.adobedtm.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-07-19 -
2023-08-19		 a year crt.sh
*.vortex.data.microsoft.com
Microsoft Azure TLS Issuing CA 02		 2022-09-21 -
2023-09-16		 a year crt.sh
*.vo.msecnd.net
DigiCert SHA2 Secure Server CA		 2022-07-11 -
2023-07-11		 a year crt.sh
a.clarity.ms
Microsoft Azure TLS Issuing CA 02		 2022-06-07 -
2023-06-02		 a year crt.sh
*.demdex.com
DigiCert TLS RSA SHA256 2020 CA1		 2022-09-26 -
2023-10-27		 a year crt.sh
*.events.data.microsoft.com
Microsoft Azure TLS Issuing CA 06		 2022-09-08 -
2023-09-03		 a year crt.sh
graph.windows.net
DigiCert SHA2 Secure Server CA		 2022-06-09 -
2023-06-09		 a year crt.sh
www.bing.com
Microsoft RSA TLS CA 02		 2022-09-03 -
2023-03-03		 6 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA		 2022-07-20 -
2022-10-18		 3 months crt.sh

This page contains 3 frames:

Primary Page: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Frame ID: AE51FD3071E940AF240254B711C731CF
Requests: 89 HTTP requests in this frame

Frame: https://login.live.com/me.srf?wa=wsignin1.0&wreply=https%3A%2F%2Fwww.microsoft.com&uaid=361a6fe9-d580-4354-b9e0-2b832217feea&partnerId=mssecurity
Frame ID: ABFDD57368BB295CC0EF1B0DFB91F97E
Requests: 2 HTTP requests in this frame

Frame: https://mem.gfx.ms/me/mecache?partner=mssecurity&wreply=https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fblog%2F2022%2F03%2F22%2Fdev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction%2F
Frame ID: 634636CC93A50E8D6892FBC6D0EE6B52
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

DEV-0537 criminal actor targeting organizations for data exfiltration and destruction - Microsoft Security Blogtwitter

Page URL History Show full URLs

  1. http://lnkd.in/guca2AAp HTTP 301
    https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • <!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -
Overall confidence: 100%
Detected patterns
Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js
Overall confidence: 100%
Detected patterns
  • ([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

92
Requests

93 %
HTTPS

56 %
IPv6

21
Domains

36
Subdomains

22
IPs

6
Countries

1283 kB
Transfer

3798 kB
Size

38
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://lnkd.in/guca2AAp HTTP 301
    https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 44
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7850&time=1665489900490&url=https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fblog%2F2022%2F03%2F22%2Fdev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction%2F HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7850&time=1665489900490&url=https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fblog%2F2022%2F03%2F22%2Fdev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction%2F&cookiesTest=true HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D7850%26time%3D1665489900490%26url%3Dhttps%253A%252F%252Fwww.microsoft.com%252Fsecurity%252Fblog%252F2022%252F03%252F22%252Fdev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction%252F%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7850&time=1665489900490&url=https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fblog%2F2022%2F03%2F22%2Fdev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction%2F&cookiesTest=true&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7850&time=1665489900490&url=https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fblog%2F2022%2F03%2F22%2Fdev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction%2F&cookiesTest=true&liSync=true&e_ipv6=AQIqwc3wHEe8HgAAAYPG7xZ6RhK_aWj-SGmaGLihTlzeMiPh_3PFjWRPtHFsPrKCxJVCeg HTTP 302
  • https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=22f6ac88-d198-4d0f-b32c-444bb7236849 HTTP 302
  • https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=22f6ac88-d198-4d0f-b32c-444bb7236849&_expected_cookie=efea7cd6c6a4e91ddc15e901ec5472fa
Request Chain 66
  • https://ad.doubleclick.net/ddm/activity/src=6952136;type=store0;cat=jsll;u58=7b7407799c264a3c96ccdaf9881719a9;match_id=7b7407799c264a3c96ccdaf9881719a9;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1 HTTP 302
  • https://ad.doubleclick.net/ddm/activity/src=6952136;dc_pre=CMuaza-R2PoCFVlCwgUdoYUJzw;type=store0;cat=jsll;u58=7b7407799c264a3c96ccdaf9881719a9;match_id=7b7407799c264a3c96ccdaf9881719a9;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1 HTTP 302
  • https://adservice.google.com/ddm/fls/p/src=6952136;dc_pre=CMuaza-R2PoCFVlCwgUdoYUJzw;type=store0;cat=jsll;u58=7b7407799c264a3c96ccdaf9881719a9;match_id=7b7407799c264a3c96ccdaf9881719a9;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;~oref=http://www.microsoft.com/ HTTP 302
  • https://adservice.google.co.jp/ddm/fls/p/src=6952136;dc_pre=CMuaza-R2PoCFVlCwgUdoYUJzw;type=store0;cat=jsll;u58=7b7407799c264a3c96ccdaf9881719a9;match_id=7b7407799c264a3c96ccdaf9881719a9;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;~oref=http://www.microsoft.com/
Request Chain 69
  • https://c.clarity.ms/c.gif HTTP 302
  • https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=58C2C19F729343E5AF5A3C1E8CB0817A&RedC=c.clarity.ms&MXFR=2605FC6ED84A6C7D3429EE54DC4A6241 HTTP 302
  • https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=58C2C19F729343E5AF5A3C1E8CB0817A&MUID=18B30C445C896CD030BE1E7E58896A17
Request Chain 74
  • https://c1.microsoft.com/c.gif?DI=4050&did=1&t= HTTP 302
  • https://c.bing.com/c.gif?DI=4050&did=1&t=&ctsa=mr&CtsSyncId=314BECA3F8C649F2A65108D5839FEB96&RedC=c1.microsoft.com&MXFR=18B30C445C896CD030BE1E7E58896A17 HTTP 302
  • https://c1.microsoft.com/c.gif?DI=4050&did=1&t=&ctsa=mr&CtsSyncId=314BECA3F8C649F2A65108D5839FEB96&MUID=18B30C445C896CD030BE1E7E58896A17
Request Chain 80
  • https://dc.ads.linkedin.com/collect/?pid=7850&fmt=gif HTTP 302
  • https://px4.ads.linkedin.com/collect?pid=7850&fmt=gif&e_ipv6=AQJp-rYZWYbI4wAAAYPG7xnF7u4loXMTXZ5Ges845KEZsTAyYayDpq7fvZVszFDc_8eU5g HTTP 302
  • https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=22f6ac88-d198-4d0f-b32c-444bb7236849
Request Chain 81
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/837109043/?guid=ON&script=0&random=728333 HTTP 302
  • https://www.google.com/pagead/1p-user-list/837109043/?guid=ON&script=0&random=728333&is_vtc=1&random=3268680014 HTTP 302
  • https://www.google.co.jp/pagead/1p-user-list/837109043/?guid=ON&script=0&random=728333&is_vtc=1&random=3268680014&ipr=y

92 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Redirect Chain
  • http://lnkd.in/guca2AAp
  • https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
197 KB
40 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:400:2a8::356e Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
a189bcbd95d6f3e6374e6c6ce9c01e71fe2e272d5ffb180d90571b572a29c8cd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

cache-control
max-age=300, must-revalidate
content-encoding
gzip
content-length
39418
content-type
text/html; charset=UTF-8
date
Tue, 11 Oct 2022 12:04:59 GMT
last-modified
Tue, 11 Oct 2022 12:04:59 GMT
link
<https://www.microsoft.com/security/blog/wp-json/>; rel="https://api.w.org/" <https://www.microsoft.com/security/blog/wp-json/wp/v2/posts/109467>; rel="alternate"; type="application/json" <https://www.microsoft.com/security/blog/?p=109467>; rel=shortlink
strict-transport-security
max-age=31536000
tls_version
tls1.3
vary
Accept-Encoding
x-edgeconnect-midmile-rtt
128
x-edgeconnect-origin-mex-latency
199
x-frame-options
SAMEORIGIN
x-rtag
RT
x-ten-cache
EXPIRED

Redirect headers

Content-Length
0
Date
Tue, 11 Oct 2022 12:04:58 GMT
Location
https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Server
Apache-Coyote/1.1
Vary
Accept-Encoding
X-Cache
TCP_MISS
X-LI-Proto
http/1.1
X-LI-UUID
AAXqwRXIg/MvDBRoO8la5g==
X-Li-Fabric
prod-lor1
X-Li-Pop
prod-lor1-x
X-MSEdge-Ref
Ref A: C815B16496984B41AA34109AB5F311BD Ref B: TYO01EDGE3107 Ref C: 2022-10-11T12:04:58Z
style.min.css
www.microsoft.com/security/blog/wp-includes/css/dist/block-library/ 		87 KB
12 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.microsoft.com/security/blog/wp-includes/css/dist/block-library/style.min.css?ver=6.0.2
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:400:2a8::356e Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
d7705700d24d5919255576642ad2c28bfc790390b7183a369038ff5c1e814d51
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma
public
date
Tue, 11 Oct 2022 12:04:59 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000
last-modified
Tue, 02 Aug 2022 06:06:13 GMT
x-rtag
RT
etag
W/"62e8bed5-15b64"
vary
Accept-Encoding
content-type
text/css
tls_version
tls1.3
cache-control
max-age=2592000, public
content-length
11683
expires
Thu, 10 Nov 2022 12:04:59 GMT
jsgif.css
www.microsoft.com/security/blog/wp-content/plugins/oembeds/assets/css/gifplayer/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.microsoft.com/security/blog/wp-content/plugins/oembeds/assets/css/gifplayer/jsgif.css?ver=1.3.1
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:400:2a8::356e Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
b3cab87fbbfe2e9a7ba4dd64c621f4255e5d1ece4c6163dde3cbad45251375ba
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma
public
x-edgeconnect-origin-mex-latency
27
content-encoding
gzip
date
Tue, 11 Oct 2022 12:04:59 GMT
last-modified
Tue, 26 Jul 2022 20:40:33 GMT
strict-transport-security
max-age=31536000
x-rtag
RT
x-edgeconnect-midmile-rtt
126
etag
W/"62e05141-c08"
vary
Accept-Encoding
content-type
text/css
tls_version
tls1.3
cache-control
max-age=2592000, public
content-length
899
expires
Thu, 10 Nov 2022 12:04:59 GMT
styles.css
www.microsoft.com/security/blog/wp-content/plugins/wds-ms-inline-interruption-styles-officeblogs/css/ 		10 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.microsoft.com/security/blog/wp-content/plugins/wds-ms-inline-interruption-styles-officeblogs/css/styles.css?ver=1665489899
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:400:2a8::356e Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
b201ab52de2c92539f7a276b6cf170b1bdf0f3705f1b6ab9597517d030afefe4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma
public
x-edgeconnect-origin-mex-latency
36
content-encoding
gzip
date
Tue, 11 Oct 2022 12:04:59 GMT
last-modified
Fri, 18 Jun 2021 19:28:23 GMT
strict-transport-security
max-age=31536000
x-rtag
RT
x-edgeconnect-midmile-rtt
137
etag
W/"60ccf3d7-29a7"
vary
Accept-Encoding
content-type
text/css
tls_version
tls1.3
cache-control
max-age=2592000, public
content-length
3910
expires
Thu, 10 Nov 2022 12:04:59 GMT
uhf-search-ui.css
www.microsoft.com/security/blog/wp-content/plugins/wds-ms-searchwp/features/uhf-search-ui/ 		160 B
377 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.microsoft.com/security/blog/wp-content/plugins/wds-ms-searchwp/features/uhf-search-ui/uhf-search-ui.css?ver=1.0.1
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:400:2a8::356e Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
f258c099e2bb029f6c9d5e9900a78f53347a16b43aa1e37a9f9c1a1539e0748d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma
public
date
Tue, 11 Oct 2022 12:05:00 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000
last-modified
Fri, 18 Jun 2021 19:28:20 GMT
x-rtag
RT
etag
W/"60ccf3d4-a0"
vary
Accept-Encoding
content-type
text/css
tls_version
tls1.3
cache-control
max-age=2592000, public
content-length
145
expires
Thu, 10 Nov 2022 12:05:00 GMT
mwf-west-european-default.min.css
assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/css/ 		581 KB
71 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/css/mwf-west-european-default.min.css?ver=6.0.2
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2600:140b:1a00:186::2957 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
4919e80f038d2b93f1184d1733ac35009643481735c7bc7aa31d8b56e118fc04
Security Headers
Name Value
X-Content-Type-Options nosniff, nosniff, nosniff

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Tue, 11 Oct 2022 12:04:59 GMT
content-encoding
gzip
x-content-type-options
nosniff, nosniff, nosniff
last-modified
Thu, 01 Feb 2018 02:22:19 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
content-md5
QshXRY8/Osc4oVEHlL0Pbw==
etag
"0x8D5691A9EA468B4"
vary
Accept-Encoding
content-type
text/css
access-control-allow-origin
*
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-lease-state,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control
max-age=900
accept-ranges
bytes
content-length
71704
x-ms-lease-state
available
style.css
www.microsoft.com/security/blog/wp-content/themes/ms_s/ 		342 B
522 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.microsoft.com/security/blog/wp-content/themes/ms_s/style.css?ver=1.0.0
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:400:2a8::356e Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
f174b3ce00dc0ef25fe0867dae1da92a595c50f730dbe2cd1fd7f29546034e81
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma
public
x-edgeconnect-origin-mex-latency
28
content-encoding
gzip
date
Tue, 11 Oct 2022 12:04:59 GMT
last-modified
Fri, 18 Jun 2021 19:28:20 GMT
strict-transport-security
max-age=31536000
x-rtag
RT
x-edgeconnect-midmile-rtt
129
etag
W/"60ccf3d4-156"
vary
Accept-Encoding
content-type
text/css
tls_version
tls1.3
cache-control
max-age=2592000, public
content-length
238
expires
Thu, 10 Nov 2022 12:04:59 GMT
style.min.css
www.microsoft.com/security/blog/wp-content/themes/ms-security/ 		69 KB
14 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.microsoft.com/security/blog/wp-content/themes/ms-security/style.min.css?ver=2.4.3
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:400:2a8::356e Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
8dc2a4dee7af0496223005db58d5ceb56bda186226e2e8e0a772d582f4544ef5
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma
public
x-edgeconnect-origin-mex-latency
34
content-encoding
gzip
date
Tue, 11 Oct 2022 12:04:59 GMT
last-modified
Wed, 17 Aug 2022 22:14:36 GMT
strict-transport-security
max-age=31536000
x-rtag
RT
x-edgeconnect-midmile-rtt
130
etag
W/"62fd684c-1139a"
vary
Accept-Encoding
content-type
text/css
tls_version
tls1.3
cache-control
max-age=2592000, public
content-length
13555
expires
Thu, 10 Nov 2022 12:04:59 GMT
wcp-consent.js
wcpstatic.microsoft.com/mscc/lib/v2/ 		51 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://wcpstatic.microsoft.com/mscc/lib/v2/wcp-consent.js
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:40::46 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
daf7759fedd9af6c4d7e374b0d056547ae7cb245ec24a1c4acf02932f30dc536

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 11 Oct 2022 12:04:58 GMT
content-encoding
gzip
content-md5
QT/MdZzBmCG2G2lBgIsptQ==
age
22070
x-cache
CONFIG_NOCACHE
content-length
13055
x-ms-lease-status
unlocked
last-modified
Wed, 24 Aug 2022 17:34:58 GMT
etag
0x8DA85F6F74C6D08
vary
Accept-Encoding
x-azure-ref
061tFYwAAAABgeuRt0MNKS4CBg2TJUePgVFlPMjAxMTAwMTE2MDQ3ADM5YjQ2MTU3LWNiOWUtNDliNy1hNjVhLTg3MjJhM2Y4MjRlNA==
content-type
application/javascript
access-control-allow-origin
*
x-ms-request-id
55c68def-501e-001e-7f36-dd254c000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
max-age=43200
x-ms-version
2009-09-19
jquery.min.js
www.microsoft.com/security/blog/wp-includes/js/jquery/ 		87 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.microsoft.com/security/blog/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:400:2a8::356e Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma
public
date
Tue, 11 Oct 2022 12:05:00 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000
last-modified
Mon, 02 Aug 2021 16:30:55 GMT
x-rtag
RT
etag
W/"61081dbf-15db1"
vary
Accept-Encoding
content-type
application/javascript
tls_version
tls1.3
cache-control
max-age=2592000, public
content-length
30953
expires
Thu, 10 Nov 2022 12:05:00 GMT
jquery-migrate.min.js
www.microsoft.com/security/blog/wp-includes/js/jquery/ 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.microsoft.com/security/blog/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:400:2a8::356e Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma
public
date
Tue, 11 Oct 2022 12:05:00 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000
last-modified
Thu, 03 Jun 2021 09:20:38 GMT
x-rtag
RT
etag
W/"60b89ee6-2bd8"
vary
Accept-Encoding
content-type
application/javascript
tls_version
tls1.3
cache-control
max-age=2592000, public
content-length
4169
expires
Thu, 10 Nov 2022 12:04:59 GMT
mwf-main.var.min.js
assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/scripts/ 		302 KB
70 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/scripts/mwf-main.var.min.js?ver=v1.23.2+5182151
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2600:140b:1a00:186::2957 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
b1d83c2d49c49ea38d578afa752aaec44a86d069d6ce2d54460e2612fc31a102
Security Headers
Name Value
X-Content-Type-Options nosniff, nosniff, nosniff, nosniff

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

unused62
8096267
date
Tue, 11 Oct 2022 12:04:59 GMT
content-encoding
gzip
x-content-type-options
nosniff, nosniff, nosniff, nosniff
content-md5
FuF99EJdzMvbQQjP24cb+Q==
content-length
71185
x-ms-lease-state
available
last-modified
Thu, 01 Feb 2018 02:22:29 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
"0x8D5691AA4A90431"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-lease-state,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control
max-age=900
accept-ranges
bytes
ms.analytics-web-3.min.js
js.monitor.azure.com/scripts/c/ 		136 KB
50 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.monitor.azure.com/scripts/c/ms.analytics-web-3.min.js
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:40::46 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
188bfad1edc39f8c4a0e2ea09ae85d1e478a7505c52556961ed665f18835d081

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Tue, 11 Oct 2022 12:04:58 GMT
content-encoding
br
x-azure-ref-originshield
0yVhFYwAAAACVbN0kWeeqTqzy+R4A6JZ2VFlPMDFFREdFMjQxNwBmMWNhNzNkNC04ODgzLTRjYWYtYWJkYy1mZTJkNTY3YWZiOTY=
content-md5
aTuQ8jbzXW04szHRlDLXiw==
x-cache
TCP_HIT
x-ms-meta-jssdkver
3.2.6
last-modified
Wed, 31 Aug 2022 16:47:26 GMT
x-ms-meta-jssdksrc
[cdn]/scripts/c/ms.analytics-web-3.2.6.min.js
etag
0x8DA8B707C321075
x-azure-ref
061tFYwAAAAAvOgYSAZduTb8t9agI9vStVFlPMjAxMTAwMTE1MDI3AGYxY2E3M2Q0LTg4ODMtNGNhZi1hYmRjLWZlMmQ1NjdhZmI5Ng==
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
x-ms-request-id
e2c93f6e-501e-003a-3e67-ddf20d000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,x-ms-meta-lastmodified,x-ms-meta-jssdksrc,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=1800, immutable, no-transform
x-ms-version
2009-09-19
ef-a24652
www.microsoft.com/onerfstatics/marketingsites-wcus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/79-4cdd0a/33-ae3d41/a5-4bf7a2/13-8e1ceb/81-32f0c0/5c-b7b685/1a-bb39e7/ 		167 KB
23 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.microsoft.com/onerfstatics/marketingsites-wcus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/79-4cdd0a/33-ae3d41/a5-4bf7a2/13-8e1ceb/81-32f0c0/5c-b7b685/1a-bb39e7/ef-a24652?ver=2.0&_cf=02242021_3231
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:400:2a8::356e Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
2eb8bf79bd243bb9b7a18683e32a220a6a078feed519ff75d63c4681bcb31d4d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

ms-operation-id
ba4e1ba20c6d164a804c72ec7307c511
date
Tue, 11 Oct 2022 12:04:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-rtag
RT
x-s2
2022-08-23T20:08:47
p3p
CP="CAO CONi OTR OUR DEM ONL"
x-activity-id
1fe3e48d-063e-4565-8598-744164267b96
tls_version
tls1.3
ms-cv
0eM7Q0rynEuTc2AJ.0
content-length
22578
x-xss-protection
1; mode=block
last-modified
Tue, 23 Aug 2022 20:08:47 GMT
x-az
{did:92e7dc58ca2143cfb2c818b047cc5cd1, rid: OneDeployContainer, sn: marketingsites-prod-odeastasia, dt: 2018-05-03T20:14:23.4188992Z, bt: 2022-08-17T07:25:18.0000000Z}
x-s1
2022-08-23T20:08:47
access-control-allow-methods
HEAD,GET,POST,PATCH,PUT,OPTIONS
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=27331516
vary
Accept-Encoding
timing-allow-origin
*
x-appversion
1.0.8263.42159
expires
Wed, 23 Aug 2023 20:10:15 GMT
override.css
statics-marketingsites-wcus-ms-com.akamaized.net/statics/ 		1 KB
926 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://statics-marketingsites-wcus-ms-com.akamaized.net/statics/override.css
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
23.33.33.203 Plainsboro, United States, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a23-33-33-203.deploy.static.akamaitechnologies.com
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
0bd288d5397a69ead391875b422bf2cbdcc4f795d64aa2f780aff45768d78248

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

x-ms-lease-status
unlocked
x-ms-blob-type
BlockBlob
Unused62
8096267
Content-Encoding
gzip
Date
Tue, 11 Oct 2022 12:04:59 GMT
Last-Modified
Tue, 11 Jun 2019 23:22:13 GMT
Server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
ETag
0x8D6EEC3A2D67C35
Vary
Accept-Encoding
Content-Type
text/css
x-ms-request-id
50552e35-401e-0048-1678-303897000000
x-ms-version
2009-09-19
Connection
keep-alive
Content-Length
473
37-8473b9
www.microsoft.com/onerfstatics/marketingsites-wcus-prod/shell/_scrf/js/themes=default/8e-e88b64/82-2a4f02/49-a00ab0/92-02e55d/7c-dcea75/75-fca72d/ed-e77ee7/d5-bf34c0/a9-078595/7a-7ea8cc/2d-40bdad/2... 		133 KB
35 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.microsoft.com/onerfstatics/marketingsites-wcus-prod/shell/_scrf/js/themes=default/8e-e88b64/82-2a4f02/49-a00ab0/92-02e55d/7c-dcea75/75-fca72d/ed-e77ee7/d5-bf34c0/a9-078595/7a-7ea8cc/2d-40bdad/23-e8cd2b/96-eb5423/e6-6b0cce/d1-98d78a/a0-23c4ba/a7-f7a340/48-6ed936/2e-ca165a/fc-169dd8/8e-60935c/87-fecbed/96-6ed6eb/c3-eb62e0/ad-ffd6bf/35-621acc/b0-07f293/1e-9d9d16/52-f0367f/1f-b57352/bf-517249/e1-ed258e/20-0b10e2/6b-0f1117/fb-5e9831/37-8473b9?ver=2.0&_cf=02242021_3231&iife=1
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:400:2a8::356e Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
1493e4977a83dd53ed66b226e0ff24065931cc3559f895a51f2c0b874acce637
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

ms-operation-id
1723bb3a8b6b6d439ed2efab131106df
date
Tue, 11 Oct 2022 12:04:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
strict-transport-security
max-age=31536000
x-rtag
RT
x-s2
2022-08-23T20:36:31
p3p
CP="CAO CONi OTR OUR DEM ONL"
x-activity-id
b9ac9ee4-ef22-4538-bdaf-f012150a5228
tls_version
tls1.3
ms-cv
rcOSpx1+q0CB0XTd.0
content-length
35578
x-xss-protection
1; mode=block
last-modified
Tue, 23 Aug 2022 20:36:31 GMT
x-az
{did:92e7dc58ca2143cfb2c818b047cc5cd1, rid: OneDeployContainer, sn: marketingsites-prod-odeastasia, dt: 2018-05-03T20:14:23.4188992Z, bt: 2022-08-17T07:25:18.0000000Z}
x-s1
2022-08-23T20:36:31
access-control-allow-methods
HEAD,GET,POST,PATCH,PUT,OPTIONS
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public, max-age=31148003
vary
Accept-Encoding
timing-allow-origin
*
x-appversion
1.0.8263.42159
expires
Sat, 07 Oct 2023 00:18:22 GMT
meversion
mem.gfx.ms/ 		29 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://mem.gfx.ms/meversion?partner=MSSecurity&market=en-us&uhf=1
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:40::46 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
9b94cf99f0a6f90fec13bf171103ced660e8e77dde9abfcbe3e983ebbb6acceb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

x-ua-compatible
IE=edge
strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
br
x-content-type-options
nosniff
date
Tue, 11 Oct 2022 12:04:59 GMT
x-azure-ref-originshield
0LfpEYwAAAACT8JdnRNjaQLQtnAIy4zOCVFlPMDFFREdFMjMxMQBlYWM1ZjQ5Zi1lMDJkLTRmNDEtYjBhNi0yZDUwZjlmY2Y4NGE=
x-azure-ref
07FtFYwAAAAAGAfiuDa4dSLnleYwfB7bkVFlPMjAxMTAwMTE1MDA3AGVhYzVmNDlmLWUwMmQtNGY0MS1iMGE2LTJkNTBmOWZjZjg0YQ==
x-cache
TCP_HIT
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, no-transform, max-age=43200
expires
Tue, 11 Oct 2022 17:07:57 GMT
RE1Mu3b
img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/ 		4 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2600:140b:1a00:14::17dc:5488 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
112fec798b78aa02e102a724b5cb1990c0f909bc1d8b7b1fa256eab41bbc0960
Security Headers
Name Value
X-Frame-Options DENY

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Tue, 11 Oct 2022 12:05:00 GMT
last-modified
Wed, 14 Sep 2022 10:06:30 GMT
x-resizerversion
1.0
x-datacenter
eastap
x-source-length
4054
x-frame-options
DENY
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=427281
x-activityid
987612df-ff0e-4f6b-86d1-93d6d2b8fc0b
content-location
https://image.prod.cms.rt.microsoft.com/cms/api/am/imageFileData/RE1Mu3b?ver=5c31
timing-allow-origin
*
content-length
4054
expires
Sun, 16 Oct 2022 10:46:21 GMT
wp-emoji-release.min.js
www.microsoft.com/security/blog/wp-includes/js/ 		18 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.microsoft.com/security/blog/wp-includes/js/wp-emoji-release.min.js?ver=6.0.2
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:400:2a8::356e Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma
public
x-edgeconnect-origin-mex-latency
30
content-encoding
gzip
date
Tue, 11 Oct 2022 12:05:00 GMT
last-modified
Mon, 13 Jun 2022 08:41:53 GMT
strict-transport-security
max-age=31536000
x-rtag
RT
x-edgeconnect-midmile-rtt
145
etag
W/"62a6f851-48b9"
vary
Accept-Encoding
content-type
application/javascript
tls_version
tls1.3
cache-control
max-age=2592000, public
content-length
5004
expires
Thu, 10 Nov 2022 12:05:00 GMT
Picture1-623a2b2b62574.png
www.microsoft.com/security/blog/uploads/securityprod/2022/03/ 		265 KB
266 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.microsoft.com/security/blog/uploads/securityprod/2022/03/Picture1-623a2b2b62574.png
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:400:2a8::356e Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
02309e8628076f9ab17a1df2a2d227a0ce0ea5102451d6a03854fac386fb28cd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

x-ms-blob-type
AppendBlob
x-edgeconnect-origin-mex-latency
228
date
Tue, 11 Oct 2022 12:05:00 GMT
strict-transport-security
max-age=31536000
x-rtag
RT
x-edgeconnect-midmile-rtt
200
tls_version
tls1.3
content-length
270973
x-ms-lease-status
unlocked
last-modified
Tue, 22 Mar 2022 20:01:54 GMT
x-ms-blob-committed-block-count
1
etag
0x8DA0C3ED00EF680
content-type
image/png
x-ms-request-id
acab69cf-701e-0065-4f69-dd92db000000
cache-control
max-age=600, must-revalidate
x-ms-version
2009-09-19
CLO22_SecOps_016-1-440x268.jpg
www.microsoft.com/security/blog/uploads/securityprod/2022/10/ 		13 KB
13 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.microsoft.com/security/blog/uploads/securityprod/2022/10/CLO22_SecOps_016-1-440x268.jpg
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:400:2a8::356e Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
fc266dd60e8bcd02e3c0cbbc7123e7c43c879d89e18c109112e5a43ad32b4127
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

x-ms-blob-type
AppendBlob
x-edgeconnect-origin-mex-latency
131
date
Tue, 11 Oct 2022 12:05:00 GMT
strict-transport-security
max-age=31536000
x-rtag
RT
x-edgeconnect-midmile-rtt
135
tls_version
tls1.3
content-length
13024
x-ms-lease-status
unlocked
last-modified
Fri, 30 Sep 2022 22:36:15 GMT
x-ms-blob-committed-block-count
1
etag
0x8DAA3342F9A3941
content-type
image/jpeg
x-ms-request-id
65348e30-301e-0080-1869-ddc399000000
cache-control
max-age=600, must-revalidate
x-ms-version
2009-09-19
featured-image-440x268.jpg
www.microsoft.com/security/blog/uploads/securityprod/2022/10/ 		19 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.microsoft.com/security/blog/uploads/securityprod/2022/10/featured-image-440x268.jpg
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:400:2a8::356e Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
0d853b3f72a4345d354f7d652722e038556f400102805ee9739889bd32569a83
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

x-ms-blob-type
AppendBlob
x-edgeconnect-origin-mex-latency
155
date
Tue, 11 Oct 2022 12:05:00 GMT
strict-transport-security
max-age=31536000
x-rtag
RT
x-edgeconnect-midmile-rtt
126
tls_version
tls1.3
content-length
19477
x-ms-lease-status
unlocked
last-modified
Tue, 04 Oct 2022 08:30:28 GMT
x-ms-blob-committed-block-count
1
etag
0x8DAA5E2B1C2EE41
content-type
image/jpeg
x-ms-request-id
c3200cc3-e01e-0083-1869-dd22fd000000
cache-control
max-age=600, must-revalidate
x-ms-version
2009-09-19
MicrosoftTeams-image-1-440x268.jpg
www.microsoft.com/security/blog/uploads/securityprod/2022/10/ 		22 KB
22 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.microsoft.com/security/blog/uploads/securityprod/2022/10/MicrosoftTeams-image-1-440x268.jpg
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:400:2a8::356e Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
6fbbd8c9dd7149412dac3a864f009d87ba77cf4089d2775fdddc43733d9b541c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

x-ms-blob-type
AppendBlob
x-edgeconnect-origin-mex-latency
156
date
Tue, 11 Oct 2022 12:05:00 GMT
strict-transport-security
max-age=31536000
x-rtag
RT
x-edgeconnect-midmile-rtt
129
tls_version
tls1.3
content-length
22563
x-ms-lease-status
unlocked
last-modified
Mon, 03 Oct 2022 22:05:57 GMT
x-ms-blob-committed-block-count
1
etag
0x8DAA58B72E68107
content-type
image/jpeg
x-ms-request-id
654d5d24-101e-0087-0d69-ddaffa000000
cache-control
max-age=600, must-revalidate
x-ms-version
2009-09-19
focus-within.js
www.microsoft.com/security/blog/wp-content/plugins/oembeds/assets/js/vendor/ 		10 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.microsoft.com/security/blog/wp-content/plugins/oembeds/assets/js/vendor/focus-within.js?ver=1.3.1
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:400:2a8::356e Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
c05536c0f0662d15af06f535b7e11931840fa8d5893debb0d69289d3f4b15d6c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma
public
date
Tue, 11 Oct 2022 12:05:00 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000
last-modified
Tue, 26 Jul 2022 20:40:33 GMT
x-rtag
RT
etag
W/"62e05141-289e"
vary
Accept-Encoding
content-type
application/javascript
tls_version
tls1.3
cache-control
max-age=2592000, public
content-length
3288
expires
Thu, 10 Nov 2022 12:05:00 GMT
libgif.js
www.microsoft.com/security/blog/wp-content/plugins/oembeds/assets/js/gifplayer/ 		34 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.microsoft.com/security/blog/wp-content/plugins/oembeds/assets/js/gifplayer/libgif.js?ver=1.3.1
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:400:2a8::356e Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
a96d53bba65b704f76446a222f42383a6099715b915ef05fff32f5be2634a014
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma
public
x-edgeconnect-origin-mex-latency
31
content-encoding
gzip
date
Tue, 11 Oct 2022 12:05:00 GMT
last-modified
Tue, 26 Jul 2022 20:40:33 GMT
strict-transport-security
max-age=31536000
x-rtag
RT
x-edgeconnect-midmile-rtt
126
etag
W/"62e05141-8705"
vary
Accept-Encoding
content-type
application/javascript
tls_version
tls1.3
cache-control
max-age=2592000, public
content-length
9145
expires
Thu, 10 Nov 2022 12:05:00 GMT
index.js
www.microsoft.com/security/blog/wp-content/plugins/oembeds/assets/js/gifplayer/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.microsoft.com/security/blog/wp-content/plugins/oembeds/assets/js/gifplayer/index.js?ver=1.3.1
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:400:2a8::356e Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
50006b9e18a52891c3955d398d3a53c4ef02dfa59d06b98af62d314826c51c36
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma
public
x-edgeconnect-origin-mex-latency
36
content-encoding
gzip
date
Tue, 11 Oct 2022 12:05:00 GMT
last-modified
Tue, 26 Jul 2022 20:40:33 GMT
strict-transport-security
max-age=31536000
x-rtag
RT
x-edgeconnect-midmile-rtt
126
etag
W/"62e05141-1102"
vary
Accept-Encoding
content-type
application/javascript
tls_version
tls1.3
cache-control
max-age=2592000, public
content-length
1510
expires
Thu, 10 Nov 2022 12:04:59 GMT
uhf-search-ui.js
www.microsoft.com/security/blog/wp-content/plugins/wds-ms-searchwp/features/uhf-search-ui/ 		4 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.microsoft.com/security/blog/wp-content/plugins/wds-ms-searchwp/features/uhf-search-ui/uhf-search-ui.js?ver=1.0.1
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:400:2a8::356e Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
16d6e957a9525cb4848051b0efc5aa101d256a3c6838007dc4ac2c41121eaade
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma
public
date
Tue, 11 Oct 2022 12:05:00 GMT
content-encoding
gzip
strict-transport-security
max-age=31536000
last-modified
Fri, 18 Jun 2021 19:28:25 GMT
x-rtag
RT
etag
W/"60ccf3d9-105b"
vary
Accept-Encoding
content-type
application/javascript
tls_version
tls1.3
cache-control
max-age=2592000, public
content-length
1035
expires
Thu, 10 Nov 2022 12:05:00 GMT
modernizr.js
www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/bower_components/modernizer/ 		50 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/bower_components/modernizer/modernizr.js?ver=2.8.2
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:400:2a8::356e Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
b828b15e9b7836b493a8bd6e832a24ee13aa8b6f8b4a1bf307a7af2912014178
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma
public
x-edgeconnect-origin-mex-latency
38
content-encoding
gzip
date
Tue, 11 Oct 2022 12:05:00 GMT
last-modified
Fri, 18 Jun 2021 19:28:25 GMT
strict-transport-security
max-age=31536000
x-rtag
RT
x-edgeconnect-midmile-rtt
129
etag
W/"60ccf3d9-c897"
vary
Accept-Encoding
content-type
application/javascript
tls_version
tls1.3
cache-control
max-age=2592000, public
content-length
15770
expires
Thu, 10 Nov 2022 12:05:00 GMT
mwf-auto-init-main.var.min.js
assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/scripts/ 		303 KB
71 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/scripts/mwf-auto-init-main.var.min.js?ver=v1.23.2+5182151
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2600:140b:1a00:186::2957 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
f2a28cd82e7ec00d2d8158f21fb0507722cd8b09fa4a0a16fadc58f30385cc25
Security Headers
Name Value
X-Content-Type-Options nosniff, nosniff

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Tue, 11 Oct 2022 12:05:00 GMT
content-encoding
gzip
x-content-type-options
nosniff, nosniff
last-modified
Thu, 01 Feb 2018 02:22:29 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
content-md5
12go4t01WZJhAGBag3beKQ==
etag
"0x8D5691AA4A3D407"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
*
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-lease-state,x-ms-blob-type,Accept-Ranges,Content-Length,Date,Transfer-Encoding
cache-control
max-age=900
accept-ranges
bytes
content-length
71611
x-ms-lease-state
available
picturefill.min.js
www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/bower_components/picturefill/dist/ 		12 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/bower_components/picturefill/dist/picturefill.min.js?ver=3.0.3
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:400:2a8::356e Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
893fa7fe8b6e69e2828319c04a7cbb6f129ea820db695d4ced5757d59450b6a8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma
public
x-edgeconnect-origin-mex-latency
32
content-encoding
gzip
date
Tue, 11 Oct 2022 12:05:00 GMT
last-modified
Fri, 18 Jun 2021 19:28:20 GMT
strict-transport-security
max-age=31536000
x-rtag
RT
x-edgeconnect-midmile-rtt
135
etag
W/"60ccf3d4-2e1f"
vary
Accept-Encoding
content-type
application/javascript
tls_version
tls1.3
cache-control
max-age=2592000, public
content-length
5171
expires
Thu, 10 Nov 2022 12:05:00 GMT
imagesloaded.min.js
www.microsoft.com/security/blog/wp-includes/js/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.microsoft.com/security/blog/wp-includes/js/imagesloaded.min.js?ver=4.1.4
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:400:2a8::356e Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
ff4bd34aa98a0214833619d3d751838db015722dfbbec15cd14dadc66cd67869
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma
public
x-edgeconnect-origin-mex-latency
26
content-encoding
gzip
date
Tue, 11 Oct 2022 12:05:00 GMT
last-modified
Fri, 18 Jun 2021 19:16:20 GMT
strict-transport-security
max-age=31536000
x-rtag
RT
x-edgeconnect-midmile-rtt
131
etag
W/"60ccf104-15fd"
vary
Accept-Encoding
content-type
application/javascript
tls_version
tls1.3
cache-control
max-age=2592000, public
content-length
1834
expires
Thu, 10 Nov 2022 12:05:00 GMT
masonry.min.js
www.microsoft.com/security/blog/wp-includes/js/ 		24 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.microsoft.com/security/blog/wp-includes/js/masonry.min.js?ver=4.2.2
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:400:2a8::356e Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
e00add38134eac2fb8e8e9c09cbfff7bbe57952b210322eb2eecb0a21fc055eb
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma
public
x-edgeconnect-origin-mex-latency
32
content-encoding
gzip
date
Tue, 11 Oct 2022 12:05:00 GMT
last-modified
Fri, 18 Jun 2021 19:16:20 GMT
strict-transport-security
max-age=31536000
x-rtag
RT
x-edgeconnect-midmile-rtt
133
etag
W/"60ccf104-5e4a"
vary
Accept-Encoding
content-type
application/javascript
tls_version
tls1.3
cache-control
max-age=2592000, public
content-length
7382
expires
Thu, 10 Nov 2022 12:05:00 GMT
project.min.js
www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/scripts/ 		6 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.microsoft.com/security/blog/wp-content/themes/ms-security/assets/scripts/project.min.js?ver=1.0.1
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:400:2a8::356e Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
a08955386df086739491701afd425accb0e8323dadff2dcbcceffac9ca79c939
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma
public
x-edgeconnect-origin-mex-latency
29
content-encoding
gzip
date
Tue, 11 Oct 2022 12:05:00 GMT
last-modified
Tue, 10 May 2022 16:49:16 GMT
strict-transport-security
max-age=31536000
x-rtag
RT
x-edgeconnect-midmile-rtt
147
etag
W/"627a978c-19d7"
vary
Accept-Encoding
content-type
application/javascript
tls_version
tls1.3
cache-control
max-age=2592000, public
content-length
2004
expires
Thu, 10 Nov 2022 12:05:00 GMT
microsoft-uhf.js
www.microsoft.com/security/blog/wp-content/plugins/microsoft-uhf/assets/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.microsoft.com/security/blog/wp-content/plugins/microsoft-uhf/assets/microsoft-uhf.js?ver=0.4.0
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:400:2a8::356e Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
cffbae450bcad74d65019c0aa2bada046cdcf5f5fa4af699929838f58c7ff8c2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma
public
x-edgeconnect-origin-mex-latency
24
content-encoding
gzip
date
Tue, 11 Oct 2022 12:05:00 GMT
last-modified
Fri, 18 Jun 2021 19:28:20 GMT
strict-transport-security
max-age=31536000
x-rtag
RT
x-edgeconnect-midmile-rtt
135
etag
W/"60ccf3d4-d4e"
vary
Accept-Encoding
content-type
application/javascript
tls_version
tls1.3
cache-control
max-age=2592000, public
content-length
1370
expires
Thu, 10 Nov 2022 12:05:00 GMT
mwfmdl2-v3.54.woff
www.microsoft.com/mwf/_h/v3.54/mwf.app/fonts/ 		26 KB
26 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://www.microsoft.com/mwf/_h/v3.54/mwf.app/fonts/mwfmdl2-v3.54.woff
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/onerfstatics/marketingsites-wcus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/79-4cdd0a/33-ae3d41/a5-4bf7a2/13-8e1ceb/81-32f0c0/5c-b7b685/1a-bb39e7/ef-a24652?ver=2.0&_cf=02242021_3231
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:400:2a8::356e Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
22b4df5c33045b645cafa45b04685f4752e471a2e933bff5bf14324d87deee12
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.microsoft.com/onerfstatics/marketingsites-wcus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/79-4cdd0a/33-ae3d41/a5-4bf7a2/13-8e1ceb/81-32f0c0/5c-b7b685/1a-bb39e7/ef-a24652?ver=2.0&_cf=02242021_3231
Origin
https://www.microsoft.com
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

ms-operation-id
594d3574f5a7b34e86b203009d20b4cc
date
Tue, 11 Oct 2022 12:05:00 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
x-rtag
RT
p3p
CP="CAO CONi OTR OUR DEM ONL"
x-activity-id
9cfeca75-ca8c-4234-bcb3-c6836073cb5b
tls_version
tls1.3
ms-cv
aUbkB4bzXEmIelP7.0
content-length
26288
x-xss-protection
1; mode=block
last-modified
Mon, 11 Apr 2022 21:09:51 GMT
x-az
{did:92e7dc58ca2143cfb2c818b047cc5cd1, rid: OneDeployContainer, sn: marketingsites-prod-odeastasia, dt: 2018-05-03T20:14:23.4188992Z, bt: 2022-04-01T07:52:08.0000000Z}
access-control-allow-methods
HEAD,GET,POST,PATCH,PUT,OPTIONS
content-type
application/font-woff
access-control-allow-origin
*
cache-control
public, max-age=27247463
x-appversion
1.0.8125.42964
expires
Tue, 22 Aug 2023 20:49:23 GMT
latest.woff2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/Semibold/ 		29 KB
29 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/Semibold/latest.woff2
Requested by
Host: assets.onestore.ms
URL: https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/css/mwf-west-european-default.min.css?ver=6.0.2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:1a00:1a9::356e Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
d87d0a7a7fe2c36d1dc093bfe56e9b81b311988789dbd3b65abf811d551ef02f

Request headers

Referer
https://assets.onestore.ms/
Origin
https://www.microsoft.com
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Tue, 11 Oct 2022 12:05:00 GMT
last-modified
Fri, 10 Jan 2020 19:09:43 GMT
etag
"5b68d583e9c7d51:0"
access-control-allow-methods
GET,POST
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=217916
accept-ranges
bytes
content-length
29388
expires
Fri, 14 Oct 2022 00:36:56 GMT
latest.woff2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/ 		33 KB
34 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/latest.woff2
Requested by
Host: assets.onestore.ms
URL: https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/css/mwf-west-european-default.min.css?ver=6.0.2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:1a00:1a9::356e Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
4f7f4afe26e71fa9ca1dac4a43b557a554a46f53251d849f07ed08a04829d74b

Request headers

Referer
https://assets.onestore.ms/
Origin
https://www.microsoft.com
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Tue, 11 Oct 2022 12:05:00 GMT
last-modified
Fri, 10 Jan 2020 19:09:43 GMT
etag
"588d483e9c7d51:0"
access-control-allow-methods
GET,POST
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=134566
accept-ranges
bytes
content-length
34052
expires
Thu, 13 Oct 2022 01:27:46 GMT
coq1z7el3n
www.clarity.ms/tag/ 		1 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.clarity.ms/tag/coq1z7el3n
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:40::46 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
a36fb7512cbc7a08e5ae9f6c9fe4369ff954616c37da0e79ceaaf67c721fd49f

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

request-context
appId=cid-v1:3d284f99-f285-495c-ac33-dedd7ecf1ac8
date
Tue, 11 Oct 2022 12:05:00 GMT
x-azure-ref
07FtFYwAAAADEik3UkmCpR7wiRqE6qgj1VFlPMjAxMTAwMTE2MDA3ADZjZmJlZWUwLTUwMjctNDg0Yi04OTY3LTRhMjlhZjc3ZjFlMQ==
x-cache
CONFIG_NOCACHE
content-type
application/x-javascript
cache-control
no-cache, no-store
content-length
1318
expires
-1
insight.min.js
snap.licdn.com/li.lms-analytics/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:1a00:14::17dc:5487 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
b57839788686bf37d29f47bbe45ad8258085e3aebf54650ab389c0b515b977e1

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Tue, 11 Oct 2022 12:05:00 GMT
content-encoding
gzip
last-modified
Fri, 12 Aug 2022 20:23:36 GMT
x-cdn
AKAM
vary
Accept-Encoding
content-type
application/x-javascript;charset=utf-8
cache-control
max-age=79341
accept-ranges
bytes
content-length
3063
RE1r2ij
query.prod.cms.rt.microsoft.com/cms/api/am/binary/ 		7 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE1r2ij
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
184.26.252.188 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
a184-26-252-188.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
4ce067ee7b11add8ffefd6f327a6e4ee01dca104506689e39f3450d6d596dfa5
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.microsoft.com/
X-Frame-Options deny

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

AppEx-Activity-Id
c6716968-57a6-4191-b2d7-6b33792d4b05
Content-Encoding
gzip
Content-Security-Policy
frame-ancestors 'self' https://www.microsoft.com/
Date
Tue, 11 Oct 2022 12:05:00 GMT
X-CMS-Tenant
am
X-CMS-ServiceLocation
eastap:4
X-CMS-Type
binary
X-CMS-DocumentId
RE1r2ij
X-CMS-Alias
default
Content-Disposition
inline; filename=oa.min.js
Connection
keep-alive
MS-CV
1WFmW0QlZUiRcHNoyKJjaw.0
Content-Length
3129
X-Trace-Context
{"ActivityId":"c6716968-57a6-4191-b2d7-6b33792d4b05"}
X-CMS-Version
72
Last-Modified
Mon, 26 Apr 2021 16:08:54 GMT
ETag
W/"171"
Vary
Accept-Encoding
X-Frame-Options
deny
Content-Type
application/javascript
X-CMS-ExecutionTimeInMilliseconds
23
Cache-Control
public, must-revalidate, max-age=6338
X-CMS-State
Published
truncated
/ 		2 KB
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2bf73ba8c24162c4cfd51b3b508b2bc0f8ee00cab13bec8f32b6fb6359be7d17

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		223 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
707c5b510b5712a82fd8bdf073a6d9860583931ee85f6ee7e2e735e81ae05d18

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Type
image/svg+xml
latest.woff2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/Bold/ 		29 KB
30 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/Bold/latest.woff2
Requested by
Host: assets.onestore.ms
URL: https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/css/mwf-west-european-default.min.css?ver=6.0.2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:1a00:1a9::356e Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
1232bbdbc5d205f3c5a40efa5ed92839c79e7879d5168445cc47645bb93f7d1b

Request headers

Referer
https://assets.onestore.ms/
Origin
https://www.microsoft.com
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Tue, 11 Oct 2022 12:05:00 GMT
last-modified
Fri, 10 Jan 2020 19:09:42 GMT
etag
"83cce83e9c7d51:0"
access-control-allow-methods
GET,POST
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=389688
accept-ranges
bytes
content-length
30132
expires
Sun, 16 Oct 2022 00:19:48 GMT
latest.woff2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/Light/ 		27 KB
27 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/Light/latest.woff2
Requested by
Host: assets.onestore.ms
URL: https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/css/mwf-west-european-default.min.css?ver=6.0.2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:1a00:1a9::356e Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
fe8a1047376498c80a157d13555e42a92ad480fcb0bcc9de51ad1930fbeb7f91

Request headers

Referer
https://assets.onestore.ms/
Origin
https://www.microsoft.com
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Tue, 11 Oct 2022 12:05:00 GMT
last-modified
Fri, 10 Jan 2020 19:09:43 GMT
etag
"1282d283e9c7d51:0"
access-control-allow-methods
GET,POST
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=75481
accept-ranges
bytes
content-length
27168
expires
Wed, 12 Oct 2022 09:03:01 GMT
latest.woff2
c.s-microsoft.com/static/fonts/segoe-ui/west-european/Semilight/ 		28 KB
28 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/Semilight/latest.woff2
Requested by
Host: assets.onestore.ms
URL: https://assets.onestore.ms/cdnfiles/external/mwf/short/v1/latest/css/mwf-west-european-default.min.css?ver=6.0.2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:1a00:1a9::356e Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
6ba0d1a726f1887bd61727b308ed0be0e73edba17d4ad11b91ab19b632e078f6

Request headers

Referer
https://assets.onestore.ms/
Origin
https://www.microsoft.com
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Tue, 11 Oct 2022 12:05:00 GMT
last-modified
Fri, 10 Jan 2020 19:09:43 GMT
etag
"95edd883e9c7d51:0"
access-control-allow-methods
GET,POST
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=177264
accept-ranges
bytes
content-length
28908
expires
Thu, 13 Oct 2022 13:19:24 GMT
/
p.adsymptotic.com/d/px/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7850&time=1665489900490&url=https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fblog%2F2022%2F03%2F22%2Fdev-0537-criminal-actor-targeting-organizations-f...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7850&time=1665489900490&url=https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fblog%2F2022%2F03%2F22%2Fdev-0537-criminal-actor-targeting-organizations-f...
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D7850%26time%3D1665489900490%26url%3Dhttps%253A%252F%252Fwww.microsoft.com%252Fsec...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7850&time=1665489900490&url=https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fblog%2F2022%2F03%2F22%2Fdev-0537-criminal-actor-targeting-organizations-f...
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7850&time=1665489900490&url=https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fblog%2F2022%2F03%2F22%2Fdev-0537-criminal-actor-targeting-organizations-...
  • https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=22f6ac88-d198-4d0f-b32c-444bb7236849
  • https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=22f6ac88-d198-4d0f-b32c-444bb7236849&_expected_cookie=efea7cd6c6a4e91ddc15e901...
43 B
141 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=22f6ac88-d198-4d0f-b32c-444bb7236849&_expected_cookie=efea7cd6c6a4e91ddc15e901ec5472fa
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
H2
Server
104.18.102.194 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

p3p
CP='NON DSP COR CONi OUR BUS CNT'
date
Tue, 11 Oct 2022 12:05:01 GMT
cf-cache-status
DYNAMIC
server
cloudflare
cf-ray
7587762cfcd9f6d1-NRT
content-length
43
content-type
image/gif

Redirect headers

location
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=22f6ac88-d198-4d0f-b32c-444bb7236849&_expected_cookie=efea7cd6c6a4e91ddc15e901ec5472fa
date
Tue, 11 Oct 2022 12:05:01 GMT
cf-cache-status
DYNAMIC
server
cloudflare
cf-ray
7587762c6b90f6d1-NRT
content-length
0
launch-41185cd0b005.min.js
assets.adobedtm.com/5ef092d1efb5/d6d76b37b476/ 		63 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/5ef092d1efb5/d6d76b37b476/launch-41185cd0b005.min.js
Requested by
Host: query.prod.cms.rt.microsoft.com
URL: https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE1r2ij
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:1a00:1b0::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
8e673d59965134cf831a38a2bdfa3578e332afc766bb3efb377624631cbde8f2

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Tue, 11 Oct 2022 12:05:00 GMT
content-encoding
gzip
last-modified
Wed, 08 Dec 2021 21:39:55 GMT
server
AkamaiNetStorage
etag
"2ff66f47957052cad7dcc1ed409f7cff:1638999595.762542"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.microsoft.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
18602
expires
Tue, 11 Oct 2022 13:05:00 GMT
meBoot.min.js
mem.gfx.ms/scripts/me/MeControl/10.22228.4/en-US/ 		177 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://mem.gfx.ms/scripts/me/MeControl/10.22228.4/en-US/meBoot.min.js
Requested by
Host: mem.gfx.ms
URL: https://mem.gfx.ms/meversion?partner=MSSecurity&market=en-us&uhf=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:40::46 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
716a6777b928b70ff02141994cc4821244d4acb4e969c8d58b3c83d59c96cc51
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Referer
https://www.microsoft.com/
Origin
https://www.microsoft.com
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
br
x-content-type-options
nosniff
date
Tue, 11 Oct 2022 12:05:00 GMT
last-modified
Mon, 03 Oct 2022 21:47:08 GMT
x-azure-ref-originshield
05xpFYwAAAAC0iStHaf5aQIhnHyLSAjRkVFlPMDFFREdFMjQxMQBlYWM1ZjQ5Zi1lMDJkLTRmNDEtYjBhNi0yZDUwZjlmY2Y4NGE=
etag
"1d8d7ac5badac75"
x-azure-ref
07FtFYwAAAADmZIBaCYhdRKrEGGvuEaQQVFlPMjAxMTAwMTE3MDMxAGVhYzVmNDlmLWUwMmQtNGY0MS1iMGE2LTJkNTBmOWZjZjg0YQ==
x-cache
TCP_HIT
content-type
application/javascript
access-control-allow-origin
*
x-ua-compatible
IE=edge
t.gif
web.vortex.data.microsoft.com/collect/v1/ 		43 B
714 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://web.vortex.data.microsoft.com/collect/v1/t.gif?ver=%272.1%27&name=%27Ms.Webi.OutgoingRequest%27&time=%272022-10-11T12%3A05%3A00.556Z%27&appId=%27JS%3AMeControl%27&cV=%27hPHT73ztBGTHtq3Q.1%27&flags=2097152&ext-javascript-ver=%271.1%27&ext-javascript-libVer=%274.2.3%27&ext-javascript-domain=%27www.microsoft.com%27&ext-javascript-userConsent=false&ext-app-env=%27Prod%27&-operationName=%27meversion%27&-dependencyOperationName=%27LoadResource%27&-dependencyName=%27MeControl%27&-latencyMs=1142&-succeeded=true&-targetUri=%27https%3A%2F%2Fmem.gfx.ms%2Fmeversion%3Fpartner%3D**%26market%3D**%26uhf%3D**%27&*baseType=%27Ms.Qos.OutgoingServiceRequest%27&*pageName=%27None%27&*impressionGuid=%279e0d34cd-7e6a-4242-fbaa-ea4b66a1c81d%27&*market=%27en-US%27&*customData=%27%7B%22computedDuration%22%3A1193.0999999046326%2C%22perfDuration%22%3A1141.7000000476837%2C%22metaTags%22%3A%7B%22pgpart%22%3A%22mssecurity%22%7D%2C%22config%22%3A%7B%22ver%22%3A%2210.22228.4%22%2C%22mkt%22%3A%22en-US%22%2C%22ptn%22%3A%22mssecurity%22%2C%22gfx%22%3A%22https%3A%2F%2Famcdn.msftauth.net%22%2C%22dbg%22%3Afalse%2C%22aad%22%3Atrue%2C%22int%22%3Afalse%2C%22pxy%22%3Atrue%2C%22msTxt%22%3Afalse%2C%22rwd%22%3Atrue%2C%22telEvs%22%3A%22PageAction%2C%20PageView%2C%20ContentUpdate%2C%20OutgoingRequest%2C%20ClientError%2C%20PartnerApiCall%2C%20TrackedScenario%22%2C%22instKey%22%3A%22b8ffe739c47a401190627519795ca4d2-044a8309-9d4b-430b-9d47-6e87775cbab6-6888%22%2C%22oneDSUrl%22%3A%22https%3A%2F%2Fjs.monitor.azure.com%2Fscripts%2Fc%2Fms.shared.analytics.mectrl-3.2.6.gbl.min.js%22%2C%22remAcc%22%3Atrue%2C%22main%22%3A%22meBoot%22%2C%22wrapperId%22%3A%22uhf%22%2C%22cdnRegex%22%3A%22%5E(%3F%3Ahttps%3F%3A%5C%5C%2F%5C%5C%2F)%3F(mem%5C%5C.gfx%5C%5C.ms(%3F!%5C%5C.)%7Ccontrols%5C%5C.account.microsoft%3F(%3F%3A-int%7C-dev)%3F(%5C%5C.com)%3F(%3A%5B0-9%5D%7B1%2C6%7D)%7Camcdn%5C%5C.ms(%3F%3Aft)%3Fauth%5C%5C.net(%3F!%5C%5C.))%22%2C%22timeoutMs%22%3A30000%2C%22graphv2%22%3Atrue%2C%22graphinfo%22%3A%7B%22graphclientid%22%3A%227eadcef8-456d-4611-9480-4fff72b8b9e2%22%2C%22graphscope%22%3A%22user.read%22%2C%22graphcodeurl%22%3A%22https%3A%2F%2Flogin.microsoftonline.com%2Fcommon%2Foauth2%2Fv2.0%2Fauthorize%22%2C%22graphredirecturi%22%3A%22https%3A%2F%2Famcdn.msftauth.net%2Fme%2Fcallgraph%22%2C%22graphphotourl%22%3A%22https%3A%2F%2Fgraph.microsoft.com%2Fv1.0%2Fme%2Fphotos%2F96x96%2F%24value%22%7D%2C%22aadUrl%22%3A%22https%3A%2F%2Fmyaccount.microsoft.com%22%2C%22msaUrl%22%3A%22https%3A%2F%2Faccount.microsoft.com%2F%22%2C%22authAppUpsellUrl%22%3A%22%22%2C%22cache%22%3Atrue%2C%22cacheRetention%22%3A%7B%22picRetention%22%3A604800000%2C%22authAppRetention%22%3A94670856000%7D%7D%2C%22url%22%3A%22https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fblog%2F2022%2F03%2F22%2Fdev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction%2F%22%2C%22accts%22%3A%220-0%22%7D%27
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.96.225.71 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 11 Oct 2022 12:05:00 GMT
X-Content-Type-Options
nosniff
P3P
CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
Content-Type
image/gif
Cache-Control
no-cache, no-store
MS-CV
UzFKZuhqfUSeRko/jGIMMw.0
Content-Length
43
Expires
0
RCbec314109be34962999dbad4041375a8-source.min.js
assets.adobedtm.com/5ef092d1efb5/d6d76b37b476/cc63921ab1f0/ 		1 KB
780 B 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/5ef092d1efb5/d6d76b37b476/cc63921ab1f0/RCbec314109be34962999dbad4041375a8-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/5ef092d1efb5/d6d76b37b476/launch-41185cd0b005.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:1a00:1b0::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
08349a70b033f56eb076549f7092120abb5a40f017bd92ee24aef58d8b10f05b

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Tue, 11 Oct 2022 12:05:00 GMT
content-encoding
gzip
last-modified
Wed, 08 Dec 2021 21:39:56 GMT
server
AkamaiNetStorage
etag
"d8b4a532e9559d18d4118fb4a3525c9b:1638999596.382245"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.microsoft.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
513
expires
Tue, 11 Oct 2022 13:05:00 GMT
RC93d606b4095e41c2a39459edcaf4be13-source.min.js
assets.adobedtm.com/5ef092d1efb5/d6d76b37b476/cc63921ab1f0/ 		1 KB
851 B 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/5ef092d1efb5/d6d76b37b476/cc63921ab1f0/RC93d606b4095e41c2a39459edcaf4be13-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/5ef092d1efb5/d6d76b37b476/launch-41185cd0b005.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:1a00:1b0::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
22013d424a8c0d83c00689569238609bbf6ad3616bc51dac5b8e2c7e6775f174

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Tue, 11 Oct 2022 12:05:00 GMT
content-encoding
gzip
last-modified
Wed, 08 Dec 2021 21:39:56 GMT
server
AkamaiNetStorage
etag
"d8b4a532e9559d18d4118fb4a3525c9b:1638999596.382245"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.microsoft.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
584
expires
Tue, 11 Oct 2022 13:05:00 GMT
clarity.js
www.clarity.ms/eus-f/s/0.6.42/ 		53 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.clarity.ms/eus-f/s/0.6.42/clarity.js
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/tag/coq1z7el3n
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:40::46 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
d97ca913935c9897ac4e255d17e14c8a3f0d8513681fe5b6736c4921fc5dd078

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Tue, 11 Oct 2022 12:05:00 GMT
content-encoding
br
last-modified
Wed, 01 Jun 2022 12:22:22 GMT
etag
"1d8da7270bdf0d4"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript;charset=utf-8
x-azure-ref
07FtFYwAAAAC6yGaG47dbSLGJPtlk4ESUVFlPMjAxMTAwMTE2MDA3ADZjZmJlZWUwLTUwMjctNDg0Yi04OTY3LTRhMjlhZjc3ZjFlMQ==
cache-control
public,max-age=86400
accept-ranges
bytes
content-length
23382
request-context
appId=cid-v1:dfa4d45a-f309-4181-9ede-77e6e6c0ecf0
t.gif
web.vortex.data.microsoft.com/collect/v1/ 		43 B
714 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://web.vortex.data.microsoft.com/collect/v1/t.gif?ver=%272.1%27&name=%27Ms.Webi.OutgoingRequest%27&time=%272022-10-11T12%3A05%3A00.584Z%27&appId=%27JS%3AMeControl%27&cV=%27hPHT73ztBGTHtq3Q.3%27&flags=2097152&ext-javascript-ver=%271.1%27&ext-javascript-libVer=%274.2.3%27&ext-javascript-domain=%27www.microsoft.com%27&ext-javascript-userConsent=false&ext-app-env=%27Prod%27&-operationName=%27meBoot.min.js%27&-dependencyOperationName=%27DownloadScript%27&-dependencyName=%27MeControl%27&-latencyMs=17&-succeeded=true&-targetUri=%27https%3A%2F%2Fmem.gfx.ms%2Fscripts%2Fme%2FMeControl%2F10.22228.4%2Fen-US%2FmeBoot.min.js%27&*baseType=%27Ms.Qos.OutgoingServiceRequest%27&*pageName=%27None%27&*impressionGuid=%279e0d34cd-7e6a-4242-fbaa-ea4b66a1c81d%27&*market=%27en-US%27&*customData=%27%7B%22computedDuration%22%3A25.59999990463257%2C%22perfDuration%22%3A16.90000009536743%2C%22metaTags%22%3A%7B%22pgpart%22%3A%22mssecurity%22%7D%2C%22config%22%3A%7B%22ver%22%3A%2210.22228.4%22%2C%22mkt%22%3A%22en-US%22%2C%22ptn%22%3A%22mssecurity%22%2C%22gfx%22%3A%22https%3A%2F%2Famcdn.msftauth.net%22%2C%22dbg%22%3Afalse%2C%22aad%22%3Atrue%2C%22int%22%3Afalse%2C%22pxy%22%3Atrue%2C%22msTxt%22%3Afalse%2C%22rwd%22%3Atrue%2C%22telEvs%22%3A%22PageAction%2C%20PageView%2C%20ContentUpdate%2C%20OutgoingRequest%2C%20ClientError%2C%20PartnerApiCall%2C%20TrackedScenario%22%2C%22instKey%22%3A%22b8ffe739c47a401190627519795ca4d2-044a8309-9d4b-430b-9d47-6e87775cbab6-6888%22%2C%22oneDSUrl%22%3A%22https%3A%2F%2Fjs.monitor.azure.com%2Fscripts%2Fc%2Fms.shared.analytics.mectrl-3.2.6.gbl.min.js%22%2C%22remAcc%22%3Atrue%2C%22main%22%3A%22meBoot%22%2C%22wrapperId%22%3A%22uhf%22%2C%22cdnRegex%22%3A%22%5E(%3F%3Ahttps%3F%3A%5C%5C%2F%5C%5C%2F)%3F(mem%5C%5C.gfx%5C%5C.ms(%3F!%5C%5C.)%7Ccontrols%5C%5C.account.microsoft%3F(%3F%3A-int%7C-dev)%3F(%5C%5C.com)%3F(%3A%5B0-9%5D%7B1%2C6%7D)%7Camcdn%5C%5C.ms(%3F%3Aft)%3Fauth%5C%5C.net(%3F!%5C%5C.))%22%2C%22timeoutMs%22%3A30000%2C%22graphv2%22%3Atrue%2C%22graphinfo%22%3A%7B%22graphclientid%22%3A%227eadcef8-456d-4611-9480-4fff72b8b9e2%22%2C%22graphscope%22%3A%22user.read%22%2C%22graphcodeurl%22%3A%22https%3A%2F%2Flogin.microsoftonline.com%2Fcommon%2Foauth2%2Fv2.0%2Fauthorize%22%2C%22graphredirecturi%22%3A%22https%3A%2F%2Famcdn.msftauth.net%2Fme%2Fcallgraph%22%2C%22graphphotourl%22%3A%22https%3A%2F%2Fgraph.microsoft.com%2Fv1.0%2Fme%2Fphotos%2F96x96%2F%24value%22%7D%2C%22aadUrl%22%3A%22https%3A%2F%2Fmyaccount.microsoft.com%22%2C%22msaUrl%22%3A%22https%3A%2F%2Faccount.microsoft.com%2F%22%2C%22authAppUpsellUrl%22%3A%22%22%2C%22cache%22%3Atrue%2C%22cacheRetention%22%3A%7B%22picRetention%22%3A604800000%2C%22authAppRetention%22%3A94670856000%7D%7D%2C%22url%22%3A%22https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fblog%2F2022%2F03%2F22%2Fdev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction%2F%22%2C%22accts%22%3A%220-0%22%7D%27
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.96.225.71 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 11 Oct 2022 12:05:00 GMT
X-Content-Type-Options
nosniff
P3P
CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
Content-Type
image/gif
Cache-Control
no-cache, no-store
MS-CV
VxaUwom2MEOrr1Ydy55JEg.0
Content-Length
43
Expires
0
t.gif
web.vortex.data.microsoft.com/collect/v1/ 		43 B
714 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://web.vortex.data.microsoft.com/collect/v1/t.gif?ver=%272.1%27&name=%27Ms.Webi.MeControl.TrackedScenario%27&time=%272022-10-11T12%3A05%3A00.589Z%27&appId=%27JS%3AMeControl%27&cV=%27hPHT73ztBGTHtq3Q.5%27&flags=2097152&ext-javascript-ver=%271.1%27&ext-javascript-libVer=%274.2.3%27&ext-javascript-domain=%27www.microsoft.com%27&ext-javascript-userConsent=false&ext-app-env=%27Prod%27&*partner=%27mssecurity%27&*controlVersion=%2710.22228.4%27&*market=%27en-US%27&*scenario=%27Load%27&*action=%27END%27&*previousAction=%27START%27&*success=true&*durationMs=32.39999985694885&*details=%27loadV1%27
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.96.225.71 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 11 Oct 2022 12:05:00 GMT
X-Content-Type-Options
nosniff
P3P
CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
Content-Type
image/gif
Cache-Control
no-cache, no-store
MS-CV
542RpBKyUkeSxkgIywSjYQ.0
Content-Length
43
Expires
0
truncated
/ 		358 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ee2b841529e5d06aeae7f65b413b40bbfef5161c9fad9a8a1755dac03806291b

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
jsll-4.js
az725175.vo.msecnd.net/scripts/ 		55 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://az725175.vo.msecnd.net/scripts/jsll-4.js
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
117.18.232.200 , Australia, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (tka/8914) /
Resource Hash
e246eff2f6ae3e255a06eb561e6fc93ae3bef2cce22c5e0124d713c15f80567c

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 11 Oct 2022 12:05:00 GMT
content-encoding
gzip
content-md5
yvXHFTB8uAvUsw4tqOlcNw==
age
1566
x-cache
HIT
content-length
18421
x-ms-lease-status
unlocked
last-modified
Mon, 22 Feb 2021 22:33:25 GMT
server
ECAcc (tka/8914)
etag
0x8D8D781DE4DEC32
vary
Accept-Encoding
content-type
text/javascript; charset="utf-8"
access-control-allow-origin
*
x-ms-request-id
02b7ef2a-d01e-0005-1c66-dd3b54000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=1800, immutable
x-ms-version
2009-09-19
RCb827b2d874d8436fa48a7c19baf01bf1-source.min.js
assets.adobedtm.com/5ef092d1efb5/d6d76b37b476/cc63921ab1f0/ 		66 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/5ef092d1efb5/d6d76b37b476/cc63921ab1f0/RCb827b2d874d8436fa48a7c19baf01bf1-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/5ef092d1efb5/d6d76b37b476/launch-41185cd0b005.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:1a00:1b0::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
bc96efefbf007ccc620b6188a1af63aa9cf933add7629bb6285ffc7253422bb0

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Tue, 11 Oct 2022 12:05:00 GMT
content-encoding
gzip
last-modified
Wed, 08 Dec 2021 21:39:56 GMT
server
AkamaiNetStorage
etag
"d8b4a532e9559d18d4118fb4a3525c9b:1638999596.382245"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.microsoft.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
16898
expires
Tue, 11 Oct 2022 13:05:00 GMT
t.gif
web.vortex.data.microsoft.com/collect/v1/ 		43 B
714 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://web.vortex.data.microsoft.com/collect/v1/t.gif?ver=%272.1%27&name=%27Ms.Webi.MeControl.TrackedScenario%27&time=%272022-10-11T12%3A05%3A00.607Z%27&appId=%27JS%3AMeControl%27&cV=%27hPHT73ztBGTHtq3Q.6%27&flags=2097152&ext-javascript-ver=%271.1%27&ext-javascript-libVer=%274.2.3%27&ext-javascript-domain=%27www.microsoft.com%27&ext-javascript-userConsent=false&ext-app-env=%27Prod%27&*partner=%27mssecurity%27&*controlVersion=%2710.22228.4%27&*market=%27en-US%27&*scenario=%27Interactive%27&*action=%27END%27&*previousAction=%27START%27&*success=true&*durationMs=49.89999985694885&*details=%27Web%20header%27
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.96.225.71 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 11 Oct 2022 12:05:00 GMT
X-Content-Type-Options
nosniff
P3P
CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
Content-Type
image/gif
Cache-Control
no-cache, no-store
MS-CV
qO8CKIrZhEuYrsDuwFyoNg.0
Content-Length
43
Expires
0
t.js
web.vortex.data.microsoft.com/collect/v1/ 		281 B
966 B 		Script
General
Check archive.org
Download Go to
Full URL
https://web.vortex.data.microsoft.com/collect/v1/t.js?ver=%272.1%27&name=%27Ms.Webi.PageView%27&time=%272022-10-11T12%3A05%3A00.624Z%27&os=%27Windows%27&appId=%27JS%3AMicrosoft-365%27&-ver=%271.0%27&-impressionGuid=%274a2340f4-e243-4595-a657-1f1ac8b9dbb6%27&-pageName=%27Undefined%27&-uri=%27https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fblog%2F2022%2F03%2F22%2Fdev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction%2F%27&-market=%27en-us%27&-pageType=%27Post%27&-resHeight=1200&-resWidth=1600&-pageTags=%27%7B%22metaTags%22%3A%7B%7D%7D%27&-behavior=0&*baseType=%27Ms.Content.PageView%27&*cookieEnabled=true&*isJs=true&*title=%27DEV-0537%20criminal%20actor%20targeting%20organizations%20for%20data%20exfiltration%20and%20destruction%20-%20Microsoft%20Security%20Blog%27&*isLoggedIn=false&*flashInstalled=false&ext-app-env=%27Production%27&ext-javascript-ver=%271.1%27&ext-javascript-libVer=%274.3.5%27&ext-javascript-domain=%27www.microsoft.com%27&ext-javascript-userConsent=true&$mscomCookies=false
Requested by
Host: az725175.vo.msecnd.net
URL: https://az725175.vo.msecnd.net/scripts/jsll-4.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.96.225.71 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
ec8741a1f25c6d2c51f6e8a533071085158e0f2c4255b687e499219613a06b5d
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 11 Oct 2022 12:05:00 GMT
X-Content-Type-Options
nosniff
P3P
CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
Content-Type
application/javascript
Cache-Control
no-cache, no-store
MS-CV
eHkNZAJVpEyHANKS65txvQ.0
Content-Length
281
Expires
0
launch-ENc0cbffaf0f8248c3a934a56818d7737e.min.js
assets.adobedtm.com/ 		184 KB
44 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/launch-ENc0cbffaf0f8248c3a934a56818d7737e.min.js
Requested by
Host: query.prod.cms.rt.microsoft.com
URL: https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RE1r2ij
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:1a00:1b0::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
fad1a2651e0d514c59c4be3801f2601e0e61592424e2c6f4a44578ceecc2a136

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Tue, 11 Oct 2022 12:05:00 GMT
content-encoding
gzip
last-modified
Mon, 10 Oct 2022 17:56:17 GMT
server
AkamaiNetStorage
etag
"2af5d04dd57006c3bd6dd6b67594acce:1665424577.364869"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.microsoft.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
45029
expires
Tue, 11 Oct 2022 13:05:00 GMT
RCe273b42c34d5427cb02b2d6cd022cac2-source.min.js
assets.adobedtm.com/5ef092d1efb5/2537c33769cb/b7ad6c928896/ 		1 KB
778 B 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/5ef092d1efb5/2537c33769cb/b7ad6c928896/RCe273b42c34d5427cb02b2d6cd022cac2-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENc0cbffaf0f8248c3a934a56818d7737e.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:1a00:1b0::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
27712fa9c80a7749f0ec1fb2cb8e61be7db1a8375459ff3d1510aa3eeba42f03

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Tue, 11 Oct 2022 12:05:00 GMT
content-encoding
gzip
last-modified
Mon, 10 Oct 2022 17:56:19 GMT
server
AkamaiNetStorage
etag
"a1a290c74d31047d11269b09cc94eaac:1665424579.45414"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.microsoft.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
513
expires
Tue, 11 Oct 2022 13:05:00 GMT
RC86580b4b76fc4faca2bf443d92c6b256-source.min.js
assets.adobedtm.com/5ef092d1efb5/2537c33769cb/b7ad6c928896/ 		2 KB
969 B 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/5ef092d1efb5/2537c33769cb/b7ad6c928896/RC86580b4b76fc4faca2bf443d92c6b256-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENc0cbffaf0f8248c3a934a56818d7737e.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:1a00:1b0::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
ed13952a9169ae992d5d834c116b76593e1425e69e377352bc833826386ca84c

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Tue, 11 Oct 2022 12:05:00 GMT
content-encoding
gzip
last-modified
Mon, 10 Oct 2022 17:56:19 GMT
server
AkamaiNetStorage
etag
"a1a290c74d31047d11269b09cc94eaac:1665424579.45414"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.microsoft.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
704
expires
Tue, 11 Oct 2022 13:05:00 GMT
RCe86a4eb0fcba478dbcc7216ce8374629-source.min.js
assets.adobedtm.com/5ef092d1efb5/2537c33769cb/b7ad6c928896/ 		893 B
766 B 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/5ef092d1efb5/2537c33769cb/b7ad6c928896/RCe86a4eb0fcba478dbcc7216ce8374629-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENc0cbffaf0f8248c3a934a56818d7737e.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:1a00:1b0::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
2e96e36fb96f23605c089af5fd6dc83089e1c98ba0a081aa556a2dab4a146f2e

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Tue, 11 Oct 2022 12:05:00 GMT
content-encoding
gzip
last-modified
Mon, 10 Oct 2022 17:56:19 GMT
server
AkamaiNetStorage
etag
"a1a290c74d31047d11269b09cc94eaac:1665424579.45414"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.microsoft.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
502
expires
Tue, 11 Oct 2022 13:05:00 GMT
RC6e3e8b1d782343b1bb26a19a4cb6309f-source.min.js
assets.adobedtm.com/5ef092d1efb5/2537c33769cb/b7ad6c928896/ 		66 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/5ef092d1efb5/2537c33769cb/b7ad6c928896/RC6e3e8b1d782343b1bb26a19a4cb6309f-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENc0cbffaf0f8248c3a934a56818d7737e.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:1a00:1b0::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
24e751d510aa867074cc79272f9d6a4b0b486f0ec7b3e85f4c41d8e59fb29b40

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Tue, 11 Oct 2022 12:05:00 GMT
content-encoding
gzip
last-modified
Mon, 10 Oct 2022 17:56:19 GMT
server
AkamaiNetStorage
etag
"a1a290c74d31047d11269b09cc94eaac:1665424579.45414"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.microsoft.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
16898
expires
Tue, 11 Oct 2022 13:05:00 GMT
RCa0059efdf53d4c19be7d008a0a7abf0a-source.min.js
assets.adobedtm.com/5ef092d1efb5/2537c33769cb/b7ad6c928896/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/5ef092d1efb5/2537c33769cb/b7ad6c928896/RCa0059efdf53d4c19be7d008a0a7abf0a-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENc0cbffaf0f8248c3a934a56818d7737e.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:1a00:1b0::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
a3fb32948b4e0409bb1600418982cf1011e2717b8351899ed2d2ee958241f4b6

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Tue, 11 Oct 2022 12:05:00 GMT
content-encoding
gzip
last-modified
Mon, 10 Oct 2022 17:56:19 GMT
server
AkamaiNetStorage
etag
"a1a290c74d31047d11269b09cc94eaac:1665424579.45414"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.microsoft.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
1391
expires
Tue, 11 Oct 2022 13:05:00 GMT
collect
m.clarity.ms/ 		0
159 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://m.clarity.ms/collect
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/eus-f/s/0.6.42/clarity.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
20.120.124.64 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
application/x-clarity-gzip
Referer
https://www.microsoft.com/
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

access-control-allow-origin
https://www.microsoft.com
date
Tue, 11 Oct 2022 12:05:01 GMT
access-control-allow-credentials
true
server
Microsoft-IIS/10.0
request-context
appId=cid-v1:dfa4d45a-f309-4181-9ede-77e6e6c0ecf0
id
dpm.demdex.net/ 		7 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://dpm.demdex.net/id?d_orgid=EA76ADE95776D2EC7F000101@AdobeOrg&d_cid=88170%017b7407799c264a3c96ccdaf9881719a9%010&d_ver=2
Requested by
Host: az725175.vo.msecnd.net
URL: https://az725175.vo.msecnd.net/scripts/jsll-4.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.75.121.70 Tokyo, Japan, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-75-121-70.ap-northeast-1.compute.amazonaws.com
Software
/
Resource Hash
456e0e0d7f4400a926cbb958f21ae5e9454cd3eee097e0201eb2d0bd55457995
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
application/json; charset=utf-8
Referer
https://www.microsoft.com/
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

DCS
dcs-prod-tyo3-2-v041-01d804f44.edge-tyo3.demdex.com 5 ms
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-TID
MWSwyj5+RaQ=
Vary
Origin
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://www.microsoft.com
Content-Type
application/json;charset=utf-8
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
2012
Expires
Thu, 01 Jan 1970 00:00:00 UTC
/
adservice.google.co.jp/ddm/fls/p/src=6952136;dc_pre=CMuaza-R2PoCFVlCwgUdoYUJzw;type=store0;cat=jsll;u58=7b7407799c264a3c96ccdaf9881719a9;match_id=7b7407799c264a3c96ccdaf9881719a9;dc_lat=;dc_rdid=;t...
Redirect Chain
  • https://ad.doubleclick.net/ddm/activity/src=6952136;type=store0;cat=jsll;u58=7b7407799c264a3c96ccdaf9881719a9;match_id=7b7407799c264a3c96ccdaf9881719a9;dc_lat=;dc_rdid=;tag_for_child_directed_treat...
  • https://ad.doubleclick.net/ddm/activity/src=6952136;dc_pre=CMuaza-R2PoCFVlCwgUdoYUJzw;type=store0;cat=jsll;u58=7b7407799c264a3c96ccdaf9881719a9;match_id=7b7407799c264a3c96ccdaf9881719a9;dc_lat=;dc_...
  • https://adservice.google.com/ddm/fls/p/src=6952136;dc_pre=CMuaza-R2PoCFVlCwgUdoYUJzw;type=store0;cat=jsll;u58=7b7407799c264a3c96ccdaf9881719a9;match_id=7b7407799c264a3c96ccdaf9881719a9;dc_lat=;dc_r...
  • https://adservice.google.co.jp/ddm/fls/p/src=6952136;dc_pre=CMuaza-R2PoCFVlCwgUdoYUJzw;type=store0;cat=jsll;u58=7b7407799c264a3c96ccdaf9881719a9;match_id=7b7407799c264a3c96ccdaf9881719a9;dc_lat=;dc...
42 B
737 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://adservice.google.co.jp/ddm/fls/p/src=6952136;dc_pre=CMuaza-R2PoCFVlCwgUdoYUJzw;type=store0;cat=jsll;u58=7b7407799c264a3c96ccdaf9881719a9;match_id=7b7407799c264a3c96ccdaf9881719a9;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;~oref=http://www.microsoft.com/
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
H2
Server
2404:6800:4004:824::2002 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 11 Oct 2022 12:05:01 GMT
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3="googleads.g.doubleclick.net:443"; ma=2592000,h3=":443"; ma=2592000,h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 11 Oct 2022 12:05:01 GMT
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location
https://adservice.google.co.jp/ddm/fls/p/src=6952136;dc_pre=CMuaza-R2PoCFVlCwgUdoYUJzw;type=store0;cat=jsll;u58=7b7407799c264a3c96ccdaf9881719a9;match_id=7b7407799c264a3c96ccdaf9881719a9;dc_lat=;dc_rdid=;tag_for_child_directed_treatment=;ord=1;~oref=http://www.microsoft.com/
content-type
text/html; charset=UTF-8
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
browser.events.data.microsoft.com/OneCollector/1.0/ 		153 B
594 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://browser.events.data.microsoft.com/OneCollector/1.0/?cors=true&content-type=application/x-json-stream&w=0
Requested by
Host: js.monitor.azure.com
URL: https://js.monitor.azure.com/scripts/c/ms.analytics-web-3.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.50.73.10 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-HTTPAPI/2.0 /
Resource Hash
1c47afafeb4ae4b3d90642eb73c22731bb5290b3e870db9c2071066460d1154c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

upload-time
1665489901407
accept-language
jp-JP,jp;q=0.9
client-version
1DS-Web-JS-3.2.6
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
time-delta-to-apply-millis
use-collector-delta
content-type
application/x-json-stream
cache-control
no-cache, no-store
Referer
https://www.microsoft.com/
apikey
cb68b8f590184975aa5eb4ed576fb074-e666ac9b-fa31-4339-8b9c-775f4bae31f3-6978
Client-Id
NO_AUTH

Response headers

Strict-Transport-Security
max-age=31536000
Date
Tue, 11 Oct 2022 12:05:02 GMT
Server
Microsoft-HTTPAPI/2.0
time-delta-millis
1746
Access-Control-Allow-Methods
POST
Content-Type
application/json
Access-Control-Allow-Origin
https://www.microsoft.com
Access-Control-Expose-Headers
time-delta-millis
Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
time-delta-millis
Content-Length
153
/
browser.events.data.microsoft.com/OneCollector/1.0/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://browser.events.data.microsoft.com/OneCollector/1.0/?cors=true&content-type=application/x-json-stream&w=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.50.73.10 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-HTTPAPI/2.0 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept
*/*
Access-Control-Request-Headers
apikey,cache-control,client-id,client-version,content-type,time-delta-to-apply-millis,upload-time
Access-Control-Request-Method
POST
Origin
https://www.microsoft.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
AuthMsaDeviceTicket,AuthXToken,Content-Encoding,Content-Type,Cache-Control,Client-Id,SDK-Name,sdk-version,apikey,x-apikey,client-version,upload-time,time-delta-to-apply-millis,client-time-epoch-millis,persistence-mode,reliability-mode,NoResponseBody
Access-Control-Allow-Origin
https://www.microsoft.com
Access-Control-Max-Age
3600
Cache-Control
public, 3600
Content-Length
0
Date
Tue, 11 Oct 2022 12:05:02 GMT
Server
Microsoft-HTTPAPI/2.0
Strict-Transport-Security
max-age=31536000
c.gif
c.clarity.ms/
Redirect Chain
  • https://c.clarity.ms/c.gif
  • https://c.bing.com/c.gif?ctsa=mr&CtsSyncId=58C2C19F729343E5AF5A3C1E8CB0817A&RedC=c.clarity.ms&MXFR=2605FC6ED84A6C7D3429EE54DC4A6241
  • https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=58C2C19F729343E5AF5A3C1E8CB0817A&MUID=18B30C445C896CD030BE1E7E58896A17
42 B
441 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=58C2C19F729343E5AF5A3C1E8CB0817A&MUID=18B30C445C896CD030BE1E7E58896A17
Protocol
H2
Server
52.231.207.240 Busan, Korea, Republic Of, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 11 Oct 2022 12:05:01 GMT
last-modified
Tue, 13 Sep 2022 03:22:00 GMT
server
Microsoft-IIS/10.0
etag
"8766f3fc1fc7d81:0"
x-powered-by
ASP.NET
content-type
image/gif
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
private, no-cache, proxy-revalidate, no-store
accept-ranges
bytes
content-length
42

Redirect headers

pragma
no-cache
date
Tue, 11 Oct 2022 12:05:01 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: F3C485C2B5364D8883B93F4DC081574B Ref B: TYAEDGE0510 Ref C: 2022-10-11T12:05:01Z
x-powered-by
ASP.NET
x-cache
CONFIG_NOCACHE
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location
https://c.clarity.ms/c.gif?ctsa=mr&CtsSyncId=58C2C19F729343E5AF5A3C1E8CB0817A&MUID=18B30C445C896CD030BE1E7E58896A17
cache-control
private, no-cache, proxy-revalidate, no-store
content-length
0
me.srf
login.live.com/ Frame ABFD 		12 KB
6 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://login.live.com/me.srf?wa=wsignin1.0&wreply=https%3A%2F%2Fwww.microsoft.com&uaid=361a6fe9-d580-4354-b9e0-2b832217feea&partnerId=mssecurity
Requested by
Host: mem.gfx.ms
URL: https://mem.gfx.ms/scripts/me/MeControl/10.22228.4/en-US/meBoot.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.190.141.39 Osaka, Japan, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
08202b157af1abb83cb534896ded483ce8cff87183d1af29077893b311b1de70
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.microsoft.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

Cache-Control
no-store, no-cache
Content-Encoding
gzip
Content-Length
4825
Content-Type
text/html; charset=utf-8
Date
Tue, 11 Oct 2022 12:05:01 GMT
Expires
Tue, 11 Oct 2022 12:04:01 GMT
Link
<https://logincdn.msauth.net>; rel=preconnect; crossorigin <https://acctcdn.msauth.net>; rel=preconnect; crossorigin <https://acctcdn.msftauth.net>; rel=preconnect; crossorigin <https://acctcdn.msauth.net/>; rel=dns-prefetch <https://acctcdn.msftauth.net/>; rel=dns-prefetch <https://acctcdnmsftuswe2.azureedge.net/>; rel=dns-prefetch <https://acctcdnvzeuno.azureedge.net/>; rel=dns-prefetch <https://logincdn.msauth.net/>; rel=dns-prefetch <https://lgincdnvzeuno.azureedge.net/>; rel=dns-prefetch <https://lgincdnmsftuswe2.azureedge.net/>; rel=dns-prefetch
P3P
CP="DSP CUR OTPi IND OTRi ONL FIN"
PPServer
PPV: 30 H: BY1PPF1EE9D368E V: 0
Pragma
no-cache
Referrer-Policy
strict-origin-when-cross-origin
Strict-Transport-Security
max-age=31536000
Vary
Accept-Encoding
X-Content-Type-Options
nosniff
X-DNS-Prefetch-Control
on
X-XSS-Protection
1; mode=block
x-ms-request-id
efe0ad48-b68e-4b4d-a27d-2c989136efd8
x-ms-route-info
R3_BAY
meCore.min.js
mem.gfx.ms/scripts/me/MeControl/10.22228.4/en-US/ 		100 KB
16 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://mem.gfx.ms/scripts/me/MeControl/10.22228.4/en-US/meCore.min.js
Requested by
Host: mem.gfx.ms
URL: https://mem.gfx.ms/meversion?partner=MSSecurity&market=en-us&uhf=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:40::46 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
8a727ef0bf0d95b1313f862599ed70d595b9a70f4f2b1c1dbaa56f2f5f543838
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Referer
https://www.microsoft.com/
Origin
https://www.microsoft.com
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
content-encoding
br
x-content-type-options
nosniff
date
Tue, 11 Oct 2022 12:05:01 GMT
last-modified
Mon, 03 Oct 2022 21:47:14 GMT
x-azure-ref-originshield
02D1FYwAAAAANCy7hOLu8Q72FaC3aSlR0VFlPMDFFREdFMjQwOQBlYWM1ZjQ5Zi1lMDJkLTRmNDEtYjBhNi0yZDUwZjlmY2Y4NGE=
etag
"1d8d7ac5f437b07"
x-azure-ref
07VtFYwAAAAAw/jUN1mEoRJENSUsQZM89VFlPMjAxMTAwMTE3MDMxAGVhYzVmNDlmLWUwMmQtNGY0MS1iMGE2LTJkNTBmOWZjZjg0YQ==
x-cache
TCP_HIT
content-type
application/javascript
access-control-allow-origin
*
x-ua-compatible
IE=edge
RC5eb5e08515914221ad9b4c3856d3596d-source.min.js
assets.adobedtm.com/5ef092d1efb5/2537c33769cb/b7ad6c928896/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/5ef092d1efb5/2537c33769cb/b7ad6c928896/RC5eb5e08515914221ad9b4c3856d3596d-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/launch-ENc0cbffaf0f8248c3a934a56818d7737e.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:140b:1a00:1b0::1e80 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AkamaiNetStorage /
Resource Hash
4a75f8b676f650cc7ea7333d03fb771fcf90ef7cc066cf9f6ada81a6b193bda9

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Tue, 11 Oct 2022 12:05:01 GMT
content-encoding
gzip
last-modified
Mon, 10 Oct 2022 17:56:19 GMT
server
AkamaiNetStorage
etag
"a1a290c74d31047d11269b09cc94eaac:1665424579.45414"
vary
Accept-Encoding
content-type
application/x-javascript
access-control-allow-origin
https://www.microsoft.com
cache-control
max-age=3600
accept-ranges
bytes
timing-allow-origin
*
content-length
868
expires
Tue, 11 Oct 2022 13:05:01 GMT
v1
web.vortex.data.microsoft.com/collect/ 		0
0 		Ping
General
Check archive.org
Download Go to
Full URL
https://web.vortex.data.microsoft.com/collect/v1?$mscomCookies=false&ext-javascript-msfpc=%27GUID%3D7b7407799c264a3c96ccdaf9881719a9%26HASH%3D7b74%26LV%3D202210%26V%3D4%26LU%3D1665489901124%27
Requested by
Host: az725175.vo.msecnd.net
URL: https://az725175.vo.msecnd.net/scripts/jsll-4.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.96.225.71 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.microsoft.com/
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers
c.gif
c1.microsoft.com/
Redirect Chain
  • https://c1.microsoft.com/c.gif?DI=4050&did=1&t=
  • https://c.bing.com/c.gif?DI=4050&did=1&t=&ctsa=mr&CtsSyncId=314BECA3F8C649F2A65108D5839FEB96&RedC=c1.microsoft.com&MXFR=18B30C445C896CD030BE1E7E58896A17
  • https://c1.microsoft.com/c.gif?DI=4050&did=1&t=&ctsa=mr&CtsSyncId=314BECA3F8C649F2A65108D5839FEB96&MUID=18B30C445C896CD030BE1E7E58896A17
42 B
442 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c1.microsoft.com/c.gif?DI=4050&did=1&t=&ctsa=mr&CtsSyncId=314BECA3F8C649F2A65108D5839FEB96&MUID=18B30C445C896CD030BE1E7E58896A17
Protocol
H2
Server
52.231.207.240 Busan, Korea, Republic Of, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 11 Oct 2022 12:05:01 GMT
last-modified
Tue, 13 Sep 2022 03:22:00 GMT
server
Microsoft-IIS/10.0
etag
"8766f3fc1fc7d81:0"
x-powered-by
ASP.NET
content-type
image/gif
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
private, no-cache, proxy-revalidate, no-store
accept-ranges
bytes
content-length
42

Redirect headers

pragma
no-cache
date
Tue, 11 Oct 2022 12:05:01 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: BCD8F60256794929893E8984ED685B41 Ref B: TYAEDGE0510 Ref C: 2022-10-11T12:05:01Z
x-powered-by
ASP.NET
x-cache
CONFIG_NOCACHE
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location
https://c1.microsoft.com/c.gif?DI=4050&did=1&t=&ctsa=mr&CtsSyncId=314BECA3F8C649F2A65108D5839FEB96&MUID=18B30C445C896CD030BE1E7E58896A17
cache-control
private, no-cache, proxy-revalidate, no-store
content-length
0
RE4xdax
img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4xdax
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2600:140b:1a00:14::17dc:5488 Tokyo, Japan, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
2176784dfc7c4beeacaecacbbc6b7a1f2f281f17ff0a3c644909c3b3849ed01e
Security Headers
Name Value
X-Frame-Options DENY

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Tue, 11 Oct 2022 12:05:01 GMT
last-modified
Thu, 06 Oct 2022 14:58:37 GMT
x-resizerversion
1.0
x-source-length
3094
x-datacenter
eastap
x-frame-options
DENY
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=399257
x-activityid
a3c3ba51-5cbc-42b6-89fa-4668de9ddc20
content-location
https://image.prod.cms.rt.microsoft.com/cms/api/am/imageFileData/RE4xdax
timing-allow-origin
*
content-length
3094
expires
Sun, 16 Oct 2022 02:59:18 GMT
t.gif
web.vortex.data.microsoft.com/collect/v1/ 		43 B
392 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://web.vortex.data.microsoft.com/collect/v1/t.gif?ver=%272.1%27&name=%27Ms.Webi.OutgoingRequest%27&time=%272022-10-11T12%3A05%3A01.915Z%27&appId=%27JS%3AMeControl%27&cV=%27hPHT73ztBGTHtq3Q.7%27&flags=2097152&ext-javascript-ver=%271.1%27&ext-javascript-libVer=%274.2.3%27&ext-javascript-domain=%27www.microsoft.com%27&ext-javascript-userConsent=false&ext-app-env=%27Prod%27&-operationName=%27meCore.min.js%27&-dependencyOperationName=%27DownloadScript%27&-dependencyName=%27MeControl%27&-latencyMs=8&-succeeded=true&-targetUri=%27https%3A%2F%2Fmem.gfx.ms%2Fscripts%2Fme%2FMeControl%2F10.22228.4%2Fen-US%2FmeCore.min.js%27&*baseType=%27Ms.Qos.OutgoingServiceRequest%27&*pageName=%27Initial%20Collapsed%27&*impressionGuid=%279e0d34cd-7e6a-4242-fbaa-ea4b66a1c81d%27&*market=%27en-US%27&*customData=%27%7B%22computedDuration%22%3A84.5%2C%22perfDuration%22%3A8.099999904632568%2C%22metaTags%22%3A%7B%22pgpart%22%3A%22mssecurity%22%7D%2C%22config%22%3A%7B%22ver%22%3A%2210.22228.4%22%2C%22mkt%22%3A%22en-US%22%2C%22ptn%22%3A%22mssecurity%22%2C%22gfx%22%3A%22https%3A%2F%2Famcdn.msftauth.net%22%2C%22dbg%22%3Afalse%2C%22aad%22%3Atrue%2C%22int%22%3Afalse%2C%22pxy%22%3Atrue%2C%22msTxt%22%3Afalse%2C%22rwd%22%3Atrue%2C%22telEvs%22%3A%22PageAction%2C%20PageView%2C%20ContentUpdate%2C%20OutgoingRequest%2C%20ClientError%2C%20PartnerApiCall%2C%20TrackedScenario%22%2C%22instKey%22%3A%22b8ffe739c47a401190627519795ca4d2-044a8309-9d4b-430b-9d47-6e87775cbab6-6888%22%2C%22oneDSUrl%22%3A%22https%3A%2F%2Fjs.monitor.azure.com%2Fscripts%2Fc%2Fms.shared.analytics.mectrl-3.2.6.gbl.min.js%22%2C%22remAcc%22%3Atrue%2C%22main%22%3A%22meBoot%22%2C%22wrapperId%22%3A%22uhf%22%2C%22cdnRegex%22%3A%22%5E(%3F%3Ahttps%3F%3A%5C%5C%2F%5C%5C%2F)%3F(mem%5C%5C.gfx%5C%5C.ms(%3F!%5C%5C.)%7Ccontrols%5C%5C.account.microsoft%3F(%3F%3A-int%7C-dev)%3F(%5C%5C.com)%3F(%3A%5B0-9%5D%7B1%2C6%7D)%7Camcdn%5C%5C.ms(%3F%3Aft)%3Fauth%5C%5C.net(%3F!%5C%5C.))%22%2C%22timeoutMs%22%3A30000%2C%22graphv2%22%3Atrue%2C%22graphinfo%22%3A%7B%22graphclientid%22%3A%227eadcef8-456d-4611-9480-4fff72b8b9e2%22%2C%22graphscope%22%3A%22user.read%22%2C%22graphcodeurl%22%3A%22https%3A%2F%2Flogin.microsoftonline.com%2Fcommon%2Foauth2%2Fv2.0%2Fauthorize%22%2C%22graphredirecturi%22%3A%22https%3A%2F%2Famcdn.msftauth.net%2Fme%2Fcallgraph%22%2C%22graphphotourl%22%3A%22https%3A%2F%2Fgraph.microsoft.com%2Fv1.0%2Fme%2Fphotos%2F96x96%2F%24value%22%7D%2C%22aadUrl%22%3A%22https%3A%2F%2Fmyaccount.microsoft.com%22%2C%22msaUrl%22%3A%22https%3A%2F%2Faccount.microsoft.com%2F%22%2C%22authAppUpsellUrl%22%3A%22%22%2C%22cache%22%3Atrue%2C%22cacheRetention%22%3A%7B%22picRetention%22%3A604800000%2C%22authAppRetention%22%3A94670856000%7D%7D%2C%22url%22%3A%22https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fblog%2F2022%2F03%2F22%2Fdev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction%2F%22%2C%22accts%22%3A%220-0%22%7D%27
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.96.225.71 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Pragma
no-cache
Date
Tue, 11 Oct 2022 12:05:01 GMT
X-Content-Type-Options
nosniff
P3P
CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI"
Content-Type
image/gif
Cache-Control
no-cache, no-store
MS-CV
mIAffCX37US3oYuAiBTW5w.0
Content-Length
43
Expires
0
ms.shared.analytics.mectrl-3.2.6.gbl.min.js
js.monitor.azure.com/scripts/c/ 		88 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.monitor.azure.com/scripts/c/ms.shared.analytics.mectrl-3.2.6.gbl.min.js
Requested by
Host: mem.gfx.ms
URL: https://mem.gfx.ms/meversion?partner=MSSecurity&market=en-us&uhf=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:40::46 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
7d145b10d4a03fc22a08b2228f403779414c838430ce718ba52fb23e15837e55

Request headers

Referer
https://www.microsoft.com/
Origin
https://www.microsoft.com
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

date
Tue, 11 Oct 2022 12:05:01 GMT
content-encoding
br
x-ms-meta-jssdkver
3.2.6
last-modified
Thu, 18 Aug 2022 21:40:45 GMT
x-azure-ref-originshield
0XkMyYwAAAADBpcEWQ+JtQpCxmm5c7kwGVFlPMDFFREdFMjQwOQBmMWNhNzNkNC04ODgzLTRjYWYtYWJkYy1mZTJkNTY3YWZiOTY=
content-md5
RlzwH95FOkmm6gksZWAC+w==
etag
0x8DA81624EF9033C
x-azure-ref
07VtFYwAAAAB77XXw8sIhQ74hSzume5G5VFlPMjAxMTAwMTE2MDIxAGYxY2E3M2Q0LTg4ODMtNGNhZi1hYmRjLWZlMmQ1NjdhZmI5Ng==
x-cache
TCP_HIT
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
x-ms-request-id
082c8b7a-301e-002c-3deb-d004da000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,x-ms-meta-jssdkver,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000, immutable, no-transform
x-ms-version
2009-09-19
v1
web.vortex.data.microsoft.com/collect/ 		0
0 		Ping
General
Check archive.org
Download Go to
Full URL
https://web.vortex.data.microsoft.com/collect/v1
Requested by
Host: mem.gfx.ms
URL: https://mem.gfx.ms/scripts/me/MeControl/10.22228.4/en-US/meCore.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.96.225.71 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.microsoft.com/
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers
bat.js
bat.bing.com/ 		38 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bat.bing.com/bat.js
Requested by
Host: www.microsoft.com
URL: https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
30153b15b4cb898c421e657f6de21dc27435cb990e7888367bdee12e06398da7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
date
Tue, 11 Oct 2022 12:05:01 GMT
last-modified
Thu, 28 Jul 2022 17:32:37 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 48496A23C3A64BDBB5440E093F06A237 Ref B: TYO01EDGE0714 Ref C: 2022-10-11T12:05:01Z
etag
"80a8697a8a2d81:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
access-control-allow-origin
*
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
11367
/
p.adsymptotic.com/d/px/
Redirect Chain
  • https://dc.ads.linkedin.com/collect/?pid=7850&fmt=gif
  • https://px4.ads.linkedin.com/collect?pid=7850&fmt=gif&e_ipv6=AQJp-rYZWYbI4wAAAYPG7xnF7u4loXMTXZ5Ges845KEZsTAyYayDpq7fvZVszFDc_8eU5g
  • https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=22f6ac88-d198-4d0f-b32c-444bb7236849
43 B
120 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=22f6ac88-d198-4d0f-b32c-444bb7236849
Protocol
H2
Server
104.18.102.194 Shahr, Iran, Islamic Republic Of, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

p3p
CP='NON DSP COR CONi OUR BUS CNT'
date
Tue, 11 Oct 2022 12:05:02 GMT
cf-cache-status
DYNAMIC
server
cloudflare
cf-ray
758776315b85f6d1-NRT
content-length
43
content-type
image/gif

Redirect headers

date
Tue, 11 Oct 2022 12:05:02 GMT
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: 2691E641BAA840D3849234D843EFB79A Ref B: TYBEDGE0820 Ref C: 2022-10-11T12:05:02Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lva1
location
https://p.adsymptotic.com/d/px/?_pid=16218&_psign=0aa5badf92527f7732e22463d6fa4dbc&coopa=0&gdpr=0&gdpr_consent=&_puuid=22f6ac88-d198-4d0f-b32c-444bb7236849
x-li-proto
http/2
content-length
0
x-li-uuid
AAXqwRX/SP61jwQia+klNw==
/
www.google.co.jp/pagead/1p-user-list/837109043/
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/837109043/?guid=ON&script=0&random=728333
  • https://www.google.com/pagead/1p-user-list/837109043/?guid=ON&script=0&random=728333&is_vtc=1&random=3268680014
  • https://www.google.co.jp/pagead/1p-user-list/837109043/?guid=ON&script=0&random=728333&is_vtc=1&random=3268680014&ipr=y
42 B
548 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.co.jp/pagead/1p-user-list/837109043/?guid=ON&script=0&random=728333&is_vtc=1&random=3268680014&ipr=y
Protocol
H2
Server
2404:6800:4004:824::2003 , Australia, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 11 Oct 2022 12:05:02 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
content-type
image/gif
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Tue, 11 Oct 2022 12:05:02 GMT
content-security-policy
script-src 'none'; object-src 'none'
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
location
https://www.google.co.jp/pagead/1p-user-list/837109043/?guid=ON&script=0&random=728333&is_vtc=1&random=3268680014&ipr=y
content-type
image/gif
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
tr
www.facebook.com/ 		0
204 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr?id=1770559986549030&ev=PageView&dpo=LDU&dpoco=0&dpost=0&noscript=1&random=787283
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f10f:83:face:b00c:0:25de Tokyo, Japan, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
date
Tue, 11 Oct 2022 12:05:01 GMT
server
proxygen-bolt
content-type
text/plain
access-control-allow-origin
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
0
4000034.js
bat.bing.com/p/action/ 		1 KB
842 B 		Script
General
Check archive.org
Download Go to
Full URL
https://bat.bing.com/p/action/4000034.js
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
4657168fd3c24a280c873596813c9aa0ba7940e478d777176112566a9a53012b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
date
Tue, 11 Oct 2022 12:05:01 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 548BEEE8BEF14540A5F6BF6FC1EB042B Ref B: TYO01EDGE0714 Ref C: 2022-10-11T12:05:01Z
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
private,max-age=60
content-length
664
0
bat.bing.com/action/ 		0
176 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bat.bing.com/action/0?ti=4000034&Ver=2&mid=1ec9be55-61cd-4c67-a7eb-02dd9ff2b1fc&sid=ef57b000495c11ed8315a74848f2b5cf&vid=ef57eca0495c11eda387eb8e7a0deed5&vids=1&msclkid=N&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=DEV-0537%20criminal%20actor%20targeting%20organizations%20for%20data%20exfiltration%20and%20destruction%20-%20Microsoft%20Security%20Blog&p=https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fblog%2F2022%2F03%2F22%2Fdev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction%2F&r=&lt=3578&evt=pageLoad&sv=1&rn=114646
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000; includeSubDomains; preload
date
Tue, 11 Oct 2022 12:05:01 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 36DEB7D0FAE64519B50D7F3FA929A506 Ref B: TYO01EDGE0714 Ref C: 2022-10-11T12:05:01Z
x-cache
CONFIG_NOCACHE
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
expires
Fri, 01 Jan 1990 00:00:00 GMT
4000034
www.clarity.ms/tag/uet/ 		2 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.clarity.ms/tag/uet/4000034
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/p/action/4000034.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:40::46 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
7f5cec8d1cd99b1acdc8aee54fcfbe7ee2ced1856f4c8562dbf86759a50f843a

Request headers

accept-language
jp-JP,jp;q=0.9
Referer
https://www.microsoft.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

request-context
appId=cid-v1:e55edbbe-e22b-46b4-8313-9ee2a4e71d12
date
Tue, 11 Oct 2022 12:05:01 GMT
x-azure-ref
07VtFYwAAAAAlHeD0a9gWSb8PHcNdfHcsVFlPMjAxMTAwMTE2MDA3ADZjZmJlZWUwLTUwMjctNDg0Yi04OTY3LTRhMjlhZjc3ZjFlMQ==
x-cache
CONFIG_NOCACHE
content-type
application/x-javascript
cache-control
no-cache, no-store
content-length
1550
expires
-1
MeControl_2MA-JSYZqXISKHDrWUAljg2.js
logincdn.msauth.net/16.000/content/js/ Frame ABFD 		17 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://logincdn.msauth.net/16.000/content/js/MeControl_2MA-JSYZqXISKHDrWUAljg2.js
Requested by
Host: login.live.com
URL: https://login.live.com/me.srf?wa=wsignin1.0&wreply=https%3A%2F%2Fwww.microsoft.com&uaid=361a6fe9-d580-4354-b9e0-2b832217feea&partnerId=mssecurity
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:40::46 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
dbea6dda064b029ef01264afbd1ca5b6347f5f30115ffc0da035c2e21cd6ecb0

Request headers

Referer
https://login.live.com/
Origin
https://login.live.com
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

x-ms-blob-type
BlockBlob
date
Tue, 11 Oct 2022 12:05:01 GMT
content-encoding
gzip
x-azure-ref-originshield
0pQZEYwAAAAB6SjA4pH99Ta2WA2/3ooxlVFlPMDFFREdFMjMyMABkYjY2MmZlMy1mNDM4LTQzYzItYTI5Zi1lNjU5MGM0ZjVlNTE=
content-md5
+FrEFhHXklbZhqAjdI6kkA==
x-cache
TCP_HIT
content-length
6043
x-ms-lease-status
unlocked
last-modified
Wed, 21 Sep 2022 18:22:58 GMT
server
Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag
0x8DA9BFE4FD89ED9
x-azure-ref
07ltFYwAAAABO5jGw7RrsR6ecC7L242KyVFlPMjAxMTAwMTE3MDMxAGRiNjYyZmUzLWY0MzgtNDNjMi1hMjlmLWU2NTkwYzRmNWU1MQ==
content-type
application/x-javascript
access-control-allow-origin
*
x-ms-request-id
a7263878-201e-0001-7d9e-dc1c71000000
access-control-expose-headers
x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control
public, max-age=31536000
x-ms-version
2009-09-19
mecache
mem.gfx.ms/me/ Frame 6346 		3 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://mem.gfx.ms/me/mecache?partner=mssecurity&wreply=https%3A%2F%2Fwww.microsoft.com%2Fsecurity%2Fblog%2F2022%2F03%2F22%2Fdev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction%2F
Requested by
Host: mem.gfx.ms
URL: https://mem.gfx.ms/scripts/me/MeControl/10.22228.4/en-US/meBoot.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:40::46 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
866812a4ee6f87e7af881bec1885d7d170a2f25de27d7d03e07ae82638fe12cb
Security Headers
Name Value
Content-Security-Policy frame-ancestors https://www.microsoft.com;
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Referer
https://www.microsoft.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
accept-language
jp-JP,jp;q=0.9

Response headers

cache-control
public, no-transform, max-age=43200
content-encoding
br
content-security-policy
frame-ancestors https://www.microsoft.com;
content-type
text/html; charset=utf-8
date
Tue, 11 Oct 2022 12:05:01 GMT
expires
Wed, 12 Oct 2022 00:05:02 GMT
strict-transport-security
max-age=31536000; includeSubDomains
x-azure-ref
07ltFYwAAAAA/QpdrhOYoRavZsjXcPPmGVFlPMjAxMTAwMTE1MDA3AGVhYzVmNDlmLWUwMmQtNGY0MS1iMGE2LTJkNTBmOWZjZjg0YQ==
x-azure-ref-originshield
07ltFYwAAAABkRBwL6mfyQIWia5zZoNcPVFlPMDFFREdFMjMwOQBlYWM1ZjQ5Zi1lMDJkLTRmNDEtYjBhNi0yZDUwZjlmY2Y4NGE=
x-cache
TCP_MISS
x-content-type-options
nosniff
x-ua-compatible
IE=edge
v1
web.vortex.data.microsoft.com/collect/ 		0
0 		Ping
General
Check archive.org
Download Go to
Full URL
https://web.vortex.data.microsoft.com/collect/v1
Requested by
Host: mem.gfx.ms
URL: https://mem.gfx.ms/scripts/me/MeControl/10.22228.4/en-US/meCore.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
23.96.225.71 Chicago, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.microsoft.com/
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers
collect
m.clarity.ms/ 		0
48 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://m.clarity.ms/collect
Requested by
Host: www.clarity.ms
URL: https://www.clarity.ms/eus-f/s/0.6.42/clarity.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
20.120.124.64 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
application/x-clarity-gzip
Referer
https://www.microsoft.com/
accept-language
jp-JP,jp;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

access-control-allow-origin
https://www.microsoft.com
date
Tue, 11 Oct 2022 12:05:02 GMT
access-control-allow-credentials
true
server
Microsoft-IIS/10.0
request-context
appId=cid-v1:dfa4d45a-f309-4181-9ede-77e6e6c0ecf0
/
browser.events.data.microsoft.com/OneCollector/1.0/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://browser.events.data.microsoft.com/OneCollector/1.0/?cors=true&content-type=application/x-json-stream&ext.intweb.msfpc=GUID%3D7b7407799c264a3c96ccdaf9881719a9%26HASH%3D7b74%26LV%3D202210%26V%3D4%26LU%3D1665489901124&w=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.50.73.10 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-HTTPAPI/2.0 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept
*/*
Access-Control-Request-Headers
apikey,cache-control,client-id,client-version,content-type,time-delta-to-apply-millis,upload-time
Access-Control-Request-Method
POST
Origin
https://www.microsoft.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
AuthMsaDeviceTicket,AuthXToken,Content-Encoding,Content-Type,Cache-Control,Client-Id,SDK-Name,sdk-version,apikey,x-apikey,client-version,upload-time,time-delta-to-apply-millis,client-time-epoch-millis,persistence-mode,reliability-mode,NoResponseBody
Access-Control-Allow-Origin
https://www.microsoft.com
Access-Control-Max-Age
3600
Cache-Control
public, 3600
Content-Length
0
Date
Tue, 11 Oct 2022 12:05:03 GMT
Server
Microsoft-HTTPAPI/2.0
Strict-Transport-Security
max-age=31536000
/
browser.events.data.microsoft.com/OneCollector/1.0/ 		24 B
463 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://browser.events.data.microsoft.com/OneCollector/1.0/?cors=true&content-type=application/x-json-stream&ext.intweb.msfpc=GUID%3D7b7407799c264a3c96ccdaf9881719a9%26HASH%3D7b74%26LV%3D202210%26V%3D4%26LU%3D1665489901124&w=0
Requested by
Host: js.monitor.azure.com
URL: https://js.monitor.azure.com/scripts/c/ms.analytics-web-3.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.50.73.10 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-HTTPAPI/2.0 /
Resource Hash
4a43245106e0874b95dc5edec8fc630a06f82bf5ce87f245b1b9cd286313ca59
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

upload-time
1665489903278
accept-language
jp-JP,jp;q=0.9
client-version
1DS-Web-JS-3.2.6
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
time-delta-to-apply-millis
1746
content-type
application/x-json-stream
cache-control
no-cache, no-store
Referer
https://www.microsoft.com/
apikey
cb68b8f590184975aa5eb4ed576fb074-e666ac9b-fa31-4339-8b9c-775f4bae31f3-6978
Client-Id
NO_AUTH

Response headers

Strict-Transport-Security
max-age=31536000
Date
Tue, 11 Oct 2022 12:05:02 GMT
Server
Microsoft-HTTPAPI/2.0
time-delta-millis
344
Access-Control-Allow-Methods
POST
Content-Type
application/json
Access-Control-Allow-Origin
https://www.microsoft.com
Access-Control-Expose-Headers
time-delta-millis
Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
time-delta-millis
Content-Length
24
/
browser.events.data.microsoft.com/OneCollector/1.0/ 		153 B
593 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://browser.events.data.microsoft.com/OneCollector/1.0/?cors=true&content-type=application/x-json-stream&w=0
Requested by
Host: js.monitor.azure.com
URL: https://js.monitor.azure.com/scripts/c/ms.analytics-web-3.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.50.73.10 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-HTTPAPI/2.0 /
Resource Hash
62b675f72db6beb0ea9d754b49a90c46695030bdcf0e7408d30b4e708cb12e59
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

upload-time
1665489903948
accept-language
jp-JP,jp;q=0.9
client-version
1DS-Web-JS-3.2.6
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36
time-delta-to-apply-millis
use-collector-delta
content-type
application/x-json-stream
cache-control
no-cache, no-store
Referer
https://www.microsoft.com/
apikey
b8ffe739c47a401190627519795ca4d2-044a8309-9d4b-430b-9d47-6e87775cbab6-6888
Client-Id
NO_AUTH

Response headers

Strict-Transport-Security
max-age=31536000
Date
Tue, 11 Oct 2022 12:05:03 GMT
Server
Microsoft-HTTPAPI/2.0
time-delta-millis
362
Access-Control-Allow-Methods
POST
Content-Type
application/json
Access-Control-Allow-Origin
https://www.microsoft.com
Access-Control-Expose-Headers
time-delta-millis
Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
time-delta-millis
Content-Length
153
/
browser.events.data.microsoft.com/OneCollector/1.0/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://browser.events.data.microsoft.com/OneCollector/1.0/?cors=true&content-type=application/x-json-stream&w=0
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.50.73.10 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-HTTPAPI/2.0 /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept
*/*
Access-Control-Request-Headers
apikey,cache-control,client-id,client-version,content-type,time-delta-to-apply-millis,upload-time
Access-Control-Request-Method
POST
Origin
https://www.microsoft.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.5249.91 Safari/537.36

Response headers

Access-Control-Allow-Credentials
true
Access-Control-Allow-Headers
AuthMsaDeviceTicket,AuthXToken,Content-Encoding,Content-Type,Cache-Control,Client-Id,SDK-Name,sdk-version,apikey,x-apikey,client-version,upload-time,time-delta-to-apply-millis,client-time-epoch-millis,persistence-mode,reliability-mode,NoResponseBody
Access-Control-Allow-Origin
https://www.microsoft.com
Access-Control-Max-Age
3600
Cache-Control
public, 3600
Content-Length
0
Date
Tue, 11 Oct 2022 12:05:04 GMT
Server
Microsoft-HTTPAPI/2.0
Strict-Transport-Security
max-age=31536000

Verdicts & Comments Add Verdict or Comment

109 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| event object| onbeforeinput object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation object| _wpemojiSettings function| WcpConsent function| mscc function| $ function| jQuery object| mwf object| html5 object| Modernizr object| picturefillCFG function| picturefill object| e function| t object| oneDS string| _linkedin_data_partner_id function| linkedinTracking function| gdcTracking function| clarityTracking function| onConsentChanged function| dropAnalyticsCookies function| dropAdvertisingCookies function| dropSocialMediaCookies object| siteConsent function| clarity object| addthis_config object| config function| applyFocusVisiblePolyfill function| SuperGif object| msgifs object| WDSMS_SearchWP function| executeOaCode function| beforeConsent function| shouldLegacyCodeBeSkipped function| onPageLoad function| waitForSattelite function| waitForPromises function| checkForPromiseThenLoad object| WCPConsentBinder string| preConScript object| mwfAutoInit function| EvEmitter function| imagesLoaded function| jQueryBridget function| getSize function| matchesSelector object| fizzyUIUtils function| Outlayer function| Masonry object| wdsWrapBrands object| wdsEmDashFix object| wdsPostFilterToggle object| wdsStickyAudioPlayer object| windowReady object| microsoftUhfSettings function| lintrk boolean| _already_called_lintrk object| onShellReadyToLoad object| MSA object| MeControl function| MeControlDefine function| MeControlImport object| msCommonShell object| _satellite boolean| __satelliteLoaded function| BannerLoadedFunc function| oaLoadRule object| utag_cfg_ovrd function| utf_event function| requireEUCompliance function| waitForUTF function| oaLoadRuleProd object| eventTagging object| oa object| oaTagging object| util object| oaTaggingStore object| oaSetupProvider object| oaQueueProvider object| oaDataStore boolean| utfLoaded object| awa string| behaviorKey object| twemoji object| wp object| _satellite2 object| WebBlendsLoader function| oaLoadRuleDev object| lin number| googleCachebuster object| googleAdsCNE number| fbCachebuster object| fbPixel object| uetq object| oneDsMeControl function| UET function| UET_init function| UET_push object| ueto_5a211730a3 object| dataLayer function| gtag

38 Cookies

Domain/Path Name / Value
.microsoft.com/ Name: ak_bmsc
Value: F0BAA378DD70E741BA36F4868B6D245D~000000000000000000000000000000~YAAQVDMtF0bnZreDAQAASQ/vxhFvB/2LEl/L7q2cnTKGzdZKZG3SPh6AoIeoBg2myRzuToMlHbvNbDsa4kxzyzulBDuSUIWl4d44IroHo/bmJdeeY61dJ5AX2xklo+RmmJek2oniTz9DcVUjmT/1rK+Wa1eiGDEWZORp/s+CtBMhYWXg7ZXU9swhy0LFswcCn0XlWjcFqenM0kr/aewiKIefNmp4PJ4DC3dALYAXLq+WAC5BkvYBda4+/Ja/tp8ZA+hhQhWHDFuTeSh/Whd5SUHsIuWFFibBfkcIAv7IMOUEQDpD5CslBzZuJH1/ufk6hsFokH0UfMQjoN5StYTyq8ADzNlS1cDkDWGMe5esgtyHlRKTIwgHL4uRNJ3Vq5vlsG1104+e332r+rpOexGKPN8=
.microsoft.com/ Name: MSCC
Value: NR
www.microsoft.com/ Name: MicrosoftApplicationsTelemetryDeviceId
Value: d9ca11db-d12a-498a-b869-39f3583a6ce7
www.microsoft.com/ Name: ai_session
Value: klMbpnuJPmuBaMvawCxHkX|1665489900401|1665489900401
www.clarity.ms/ Name: CLID
Value: 1b8aaa180bd1409b9c2f5a6db1293647.20221011.20231011
.linkedin.com/ Name: li_sugr
Value: 22f6ac88-d198-4d0f-b32c-444bb7236849
.ads.linkedin.com/ Name: lang
Value: v=2&lang=en-us
.linkedin.com/ Name: bcookie
Value: "v=2&658fd3c2-91b3-43c7-8024-2fff648ee4be"
.linkedin.com/ Name: lidc
Value: "b=VGST05:s=V:r=V:a=V:p=V:g=2601:u=1:x=1:i=1665489900:t=1665576300:v=2:sig=AQGPbWDK7E57TsIpCNfXpnzY8AkMvyKz"
.microsoft.com/ Name: _clck
Value: 3cosl9|1|f5m|0
.linkedin.com/ Name: UserMatchHistory
Value: AQIMu7uURcD-fwAAAYPG7xT6I7rHAmp4QRwyuHqoHaDoF02_614JtVs0s5x3JJTMsK5_dY4OLMSnqg
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQJ2-2Yvh9GgowAAAYPG7xT6cVnTxOY5Wv01Rg6TLfMiCR2BMCZWVSI4hOAJH7oPdK227HfEjzdCRIMJZy3WVg
.linkedin.com/ Name: lang
Value: v=2&lang=en-us
.www.linkedin.com/ Name: bscookie
Value: "v=1&202210111205000e299797-3c70-44ff-8c22-9410630263e5AQH2WKcZbTeo1b8W2IS1mGrWmA7xdtmc"
.microsoft.com/ Name: MC1
Value: GUID=7b7407799c264a3c96ccdaf9881719a9&HASH=7b74&LV=202210&V=4&LU=1665489901124
.microsoft.com/ Name: MS0
Value: 2079cf8d48ee4edd9e1554ee92dbed5b
www.microsoft.com/ Name: MSFPC
Value: GUID=7b7407799c264a3c96ccdaf9881719a9&HASH=7b74&LV=202210&V=4&LU=1665489901124
.adsymptotic.com/ Name: U
Value: efea7cd6c6a4e91ddc15e901ec5472fa
.microsoft.com/ Name: MUID
Value: 18B30C445C896CD030BE1E7E58896A17
.bat.bing.com/ Name: MR
Value: 0
.bing.com/ Name: MUID
Value: 18B30C445C896CD030BE1E7E58896A17
.c.bing.com/ Name: MR
Value: 0
.c.bing.com/ Name: SRM_B
Value: 18B30C445C896CD030BE1E7E58896A17
.c.bing.com/ Name: SRM_I
Value: 18B30C445C896CD030BE1E7E58896A17
.microsoft.com/ Name: _uetsid
Value: ef57b000495c11ed8315a74848f2b5cf
.microsoft.com/ Name: _uetvid
Value: ef57eca0495c11eda387eb8e7a0deed5
.c1.microsoft.com/ Name: SM
Value: C
.c1.microsoft.com/ Name: SRM_I
Value: 18B30C445C896CD030BE1E7E58896A17
.c1.microsoft.com/ Name: MR
Value: 0
.c1.microsoft.com/ Name: ANONCHK
Value: 0
.doubleclick.net/ Name: IDE
Value: AHWqTUmZ4suQhRuplqVmlJw62z2TKaScsFP52DmGz6v2fgXgaXOQjudZZ7ysour3
.c.clarity.ms/ Name: SM
Value: C
.clarity.ms/ Name: MUID
Value: 18B30C445C896CD030BE1E7E58896A17
.c.clarity.ms/ Name: MR
Value: 0
.c.clarity.ms/ Name: ANONCHK
Value: 0
.microsoft.com/ Name: _clsk
Value: 1s0wpe1|1665489902067|1|1|m.clarity.ms/collect
.login.live.com/ Name: uaid
Value: 361a6fe9d5804354b9e02b832217feea
.login.live.com/ Name: MSPRequ
Value: id=N&lt=1665489902&co=1

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=31536000
X-Frame-Options SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ad.doubleclick.net
adservice.google.co.jp
adservice.google.com
assets.adobedtm.com
assets.onestore.ms
az725175.vo.msecnd.net
bat.bing.com
browser.events.data.microsoft.com
c.bing.com
c.clarity.ms
c.s-microsoft.com
c1.microsoft.com
dc.ads.linkedin.com
dpm.demdex.net
googleads.g.doubleclick.net
img-prod-cms-rt-microsoft-com.akamaized.net
js.monitor.azure.com
lnkd.in
login.live.com
logincdn.msauth.net
m.clarity.ms
mem.gfx.ms
p.adsymptotic.com
px.ads.linkedin.com
px4.ads.linkedin.com
query.prod.cms.rt.microsoft.com
snap.licdn.com
statics-marketingsites-wcus-ms-com.akamaized.net
wcpstatic.microsoft.com
web.vortex.data.microsoft.com
www.clarity.ms
www.facebook.com
www.google.co.jp
www.google.com
www.linkedin.com
www.microsoft.com
104.18.102.194
117.18.232.200
13.107.42.14
142.250.196.134
184.26.252.188
20.120.124.64
20.190.141.39
20.50.73.10
23.33.33.203
23.96.225.71
2404:6800:4004:80b::2002
2404:6800:4004:823::2004
2404:6800:4004:824::2002
2404:6800:4004:824::2003
2404:6800:4004:827::2002
2600:140b:1a00:14::17dc:5487
2600:140b:1a00:14::17dc:5488
2600:140b:1a00:186::2957
2600:140b:1a00:1a9::356e
2600:140b:1a00:1b0::1e80
2600:140b:400:2a8::356e
2620:1ec:21::14
2620:1ec:40::46
2620:1ec:c11::200
2a03:2880:f10f:83:face:b00c:0:25de
35.75.121.70
52.231.207.240
02309e8628076f9ab17a1df2a2d227a0ce0ea5102451d6a03854fac386fb28cd
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
08202b157af1abb83cb534896ded483ce8cff87183d1af29077893b311b1de70
08349a70b033f56eb076549f7092120abb5a40f017bd92ee24aef58d8b10f05b
0bd288d5397a69ead391875b422bf2cbdcc4f795d64aa2f780aff45768d78248
0d853b3f72a4345d354f7d652722e038556f400102805ee9739889bd32569a83
112fec798b78aa02e102a724b5cb1990c0f909bc1d8b7b1fa256eab41bbc0960
1232bbdbc5d205f3c5a40efa5ed92839c79e7879d5168445cc47645bb93f7d1b
1493e4977a83dd53ed66b226e0ff24065931cc3559f895a51f2c0b874acce637
16d6e957a9525cb4848051b0efc5aa101d256a3c6838007dc4ac2c41121eaade
188bfad1edc39f8c4a0e2ea09ae85d1e478a7505c52556961ed665f18835d081
1c47afafeb4ae4b3d90642eb73c22731bb5290b3e870db9c2071066460d1154c
2176784dfc7c4beeacaecacbbc6b7a1f2f281f17ff0a3c644909c3b3849ed01e
22013d424a8c0d83c00689569238609bbf6ad3616bc51dac5b8e2c7e6775f174
22b4df5c33045b645cafa45b04685f4752e471a2e933bff5bf14324d87deee12
24e751d510aa867074cc79272f9d6a4b0b486f0ec7b3e85f4c41d8e59fb29b40
27712fa9c80a7749f0ec1fb2cb8e61be7db1a8375459ff3d1510aa3eeba42f03
2bf73ba8c24162c4cfd51b3b508b2bc0f8ee00cab13bec8f32b6fb6359be7d17
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
2e96e36fb96f23605c089af5fd6dc83089e1c98ba0a081aa556a2dab4a146f2e
2eb8bf79bd243bb9b7a18683e32a220a6a078feed519ff75d63c4681bcb31d4d
30153b15b4cb898c421e657f6de21dc27435cb990e7888367bdee12e06398da7
456e0e0d7f4400a926cbb958f21ae5e9454cd3eee097e0201eb2d0bd55457995
4657168fd3c24a280c873596813c9aa0ba7940e478d777176112566a9a53012b
4919e80f038d2b93f1184d1733ac35009643481735c7bc7aa31d8b56e118fc04
4a43245106e0874b95dc5edec8fc630a06f82bf5ce87f245b1b9cd286313ca59
4a75f8b676f650cc7ea7333d03fb771fcf90ef7cc066cf9f6ada81a6b193bda9
4ce067ee7b11add8ffefd6f327a6e4ee01dca104506689e39f3450d6d596dfa5
4f7f4afe26e71fa9ca1dac4a43b557a554a46f53251d849f07ed08a04829d74b
50006b9e18a52891c3955d398d3a53c4ef02dfa59d06b98af62d314826c51c36
5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782
62b675f72db6beb0ea9d754b49a90c46695030bdcf0e7408d30b4e708cb12e59
6ba0d1a726f1887bd61727b308ed0be0e73edba17d4ad11b91ab19b632e078f6
6fbbd8c9dd7149412dac3a864f009d87ba77cf4089d2775fdddc43733d9b541c
707c5b510b5712a82fd8bdf073a6d9860583931ee85f6ee7e2e735e81ae05d18
716a6777b928b70ff02141994cc4821244d4acb4e969c8d58b3c83d59c96cc51
7d145b10d4a03fc22a08b2228f403779414c838430ce718ba52fb23e15837e55
7f5cec8d1cd99b1acdc8aee54fcfbe7ee2ced1856f4c8562dbf86759a50f843a
866812a4ee6f87e7af881bec1885d7d170a2f25de27d7d03e07ae82638fe12cb
893fa7fe8b6e69e2828319c04a7cbb6f129ea820db695d4ced5757d59450b6a8
8a727ef0bf0d95b1313f862599ed70d595b9a70f4f2b1c1dbaa56f2f5f543838
8dc2a4dee7af0496223005db58d5ceb56bda186226e2e8e0a772d582f4544ef5
8e673d59965134cf831a38a2bdfa3578e332afc766bb3efb377624631cbde8f2
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9b94cf99f0a6f90fec13bf171103ced660e8e77dde9abfcbe3e983ebbb6acceb
a08955386df086739491701afd425accb0e8323dadff2dcbcceffac9ca79c939
a189bcbd95d6f3e6374e6c6ce9c01e71fe2e272d5ffb180d90571b572a29c8cd
a36fb7512cbc7a08e5ae9f6c9fe4369ff954616c37da0e79ceaaf67c721fd49f
a3fb32948b4e0409bb1600418982cf1011e2717b8351899ed2d2ee958241f4b6
a96d53bba65b704f76446a222f42383a6099715b915ef05fff32f5be2634a014
b1d83c2d49c49ea38d578afa752aaec44a86d069d6ce2d54460e2612fc31a102
b201ab52de2c92539f7a276b6cf170b1bdf0f3705f1b6ab9597517d030afefe4
b3cab87fbbfe2e9a7ba4dd64c621f4255e5d1ece4c6163dde3cbad45251375ba
b57839788686bf37d29f47bbe45ad8258085e3aebf54650ab389c0b515b977e1
b828b15e9b7836b493a8bd6e832a24ee13aa8b6f8b4a1bf307a7af2912014178
bc96efefbf007ccc620b6188a1af63aa9cf933add7629bb6285ffc7253422bb0
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
c05536c0f0662d15af06f535b7e11931840fa8d5893debb0d69289d3f4b15d6c
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cffbae450bcad74d65019c0aa2bada046cdcf5f5fa4af699929838f58c7ff8c2
d7705700d24d5919255576642ad2c28bfc790390b7183a369038ff5c1e814d51
d87d0a7a7fe2c36d1dc093bfe56e9b81b311988789dbd3b65abf811d551ef02f
d97ca913935c9897ac4e255d17e14c8a3f0d8513681fe5b6736c4921fc5dd078
daf7759fedd9af6c4d7e374b0d056547ae7cb245ec24a1c4acf02932f30dc536
dbea6dda064b029ef01264afbd1ca5b6347f5f30115ffc0da035c2e21cd6ecb0
e00add38134eac2fb8e8e9c09cbfff7bbe57952b210322eb2eecb0a21fc055eb
e246eff2f6ae3e255a06eb561e6fc93ae3bef2cce22c5e0124d713c15f80567c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
ec8741a1f25c6d2c51f6e8a533071085158e0f2c4255b687e499219613a06b5d
ed13952a9169ae992d5d834c116b76593e1425e69e377352bc833826386ca84c
ee2b841529e5d06aeae7f65b413b40bbfef5161c9fad9a8a1755dac03806291b
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f174b3ce00dc0ef25fe0867dae1da92a595c50f730dbe2cd1fd7f29546034e81
f258c099e2bb029f6c9d5e9900a78f53347a16b43aa1e37a9f9c1a1539e0748d
f2a28cd82e7ec00d2d8158f21fb0507722cd8b09fa4a0a16fadc58f30385cc25
fad1a2651e0d514c59c4be3801f2601e0e61592424e2c6f4a44578ceecc2a136
fc266dd60e8bcd02e3c0cbbc7123e7c43c879d89e18c109112e5a43ad32b4127
fe8a1047376498c80a157d13555e42a92ad480fcb0bcc9de51ad1930fbeb7f91
ff4bd34aa98a0214833619d3d751838db015722dfbbec15cd14dadc66cd67869