msrc-blog.microsoft.com Open in urlscan Pro
40.122.65.162 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://bc01.care.net.sg/lt.php?tid=eE4ECQcLVl5QVR0GCABeTg0FClMeXA9WCRgFA1pbUAdRV19RXwpIVQpSCFVdAANOW1JeAh5RAARYGA9WCgocU...
Effective URL:
https://msrc-blog.microsoft.com/2021/03/15/one-click-microsoft-exchange-on-premises-mitigation-tool-march-2021/?utm_source=phpLi...
Submission: On May 31 via api (May 31st 2021, 9:02:10 am UTC) from SG

Summary HTTP 11 Redirects Links 9 Behaviour Indicators

Similar DOM Content API

Summary

This website contacted 1 IPs in 2 countries across 2 domains to perform 11 HTTP transactions. The main IP is 40.122.65.162, located in Des Moines, United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is msrc-blog.microsoft.com.
TLS certificate: Issued by Microsoft Azure TLS Issuing CA 01 on May 27th 2021. Valid for: a year.

This is the only time msrc-blog.microsoft.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address		AS Autonomous System
1 1	202.55.81.249 202.55.81.249		18106 (VIEWQWEST...) (VIEWQWEST-SG-AP Viewqwest Pte Ltd)
11	40.122.65.162 40.122.65.162		8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
11	1

1 202.55.81.249 (Singapore, Singapore) 1 redirects

ASN18106 (VIEWQWEST-SG-AP Viewqwest Pte Ltd, SG)
PTR: edm.care.net.sg

bc01.care.net.sg	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 40.122.65.162 (Des Moines, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

msrc-blog.microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
11	microsoft.com msrc-blog.microsoft.com	335 KB
1	care.net.sg 1 redirects bc01.care.net.sg	623 B
11	2

	Domain	Requested by
11	msrc-blog.microsoft.com	msrc-blog.microsoft.com
1	bc01.care.net.sg	1 redirects
11	2

This site contains links to these domains. Also see Links.

Domain
msrc.microsoft.com
portal.msrc.microsoft.com
microsoft.com
www.microsoft.com
aka.ms
docs.microsoft.com
github.com

Subject Issuer	Validity	Valid
blog.msrc.microsoft.com Microsoft Azure TLS Issuing CA 01	`2021-05-27` - `2022-05-22`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://msrc-blog.microsoft.com/2021/03/15/one-click-microsoft-exchange-on-premises-mitigation-tool-march-2021/?utm_source=phpList&utm_medium=email&utm_campaign=MICROSOFT+RECENT+ALERT+OF+EXCHANGE+SERVER+VULNERABILITY&utm_content=HTML
Frame ID: 0D0107D1219A764E4E77AC692F91A1D7
Requests: 11 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://bc01.care.net.sg/lt.php?tid=eE4ECQcLVl5QVR0GCABeTg0FClMeXA9WCRgFA1pbUAdRV19RXwpIVQpSCFVdAANOW... HTTP 303
https://msrc-blog.microsoft.com/2021/03/15/one-click-microsoft-exchange-on-premises-mitigation-tool-march-20... Page URL

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
headers link /rel="https:\/\/api\.w\.org\/"/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i
html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
headers link /rel="https:\/\/api\.w\.org\/"/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
script /\/wp-(?:content|includes)\//i
headers link /rel="https:\/\/api\.w\.org\/"/i

Windows Server (Operating Systems) Expand

Overall confidence: 100%
Detected patterns

headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i

IIS (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /^(?:Microsoft-)?IIS(?:\/([\d.]+))?/i

Page Statistics

11
Requests

100 %
HTTPS

0 %
IPv6

2
Domains

2
Subdomains

1
IPs

2
Countries

335 kB
Transfer

537 kB
Size

2
Cookies

9 Outgoing links

These are links going to different origins than the main page.

URL: https://msrc.microsoft.com/create-report
Title: Report Security Vulnerability

Search URL Search Domain Scan URL

URL: https://portal.msrc.microsoft.com/en-us/engage/cars
Title: Report Abuse

Search URL Search Domain Scan URL

URL: https://portal.msrc.microsoft.com/
Title: Security Update Guide

Search URL Search Domain Scan URL

URL: https://microsoft.com/msrc
Title: About MSRC

Search URL Search Domain Scan URL

URL: https://www.microsoft.com/security/blog/2021/03/12/protecting-on-premises-exchange-servers-against-recent-attacks/
Title: recent Exchange Server on-premises attacks

Search URL Search Domain Scan URL

URL: https://aka.ms/eomt
Title: one-click mitigation tool

Search URL Search Domain Scan URL

URL: https://docs.microsoft.com/en-us/windows/security/threat-protection/intelligence/safety-scanner-download
Title: Microsoft Safety Scanner

Search URL Search Domain Scan URL

URL: https://github.com/microsoft/CSS-Exchange/blob/main/Security/
Title: GitHub

Search URL Search Domain Scan URL

URL: https://aka.ms/exchangevulns
Title: https://aka.ms/exchangevulns

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://bc01.care.net.sg/lt.php?tid=eE4ECQcLVl5QVR0GCABeTg0FClMeXA9WCRgFA1pbUAdRV19RXwpIVQpSCFVdAANOW1JeAh5RAARYGA9WCgocUVMCXlEDDVIDUVwITVlVXlsOVVkBHlwBAgEYA1MPXxwLAQteHQUKAgUFBlFXDVRUUg HTTP 303
https://msrc-blog.microsoft.com/2021/03/15/one-click-microsoft-exchange-on-premises-mitigation-tool-march-2021/?utm_source=phpList&utm_medium=email&utm_campaign=MICROSOFT+RECENT+ALERT+OF+EXCHANGE+SERVER+VULNERABILITY&utm_content=HTML Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

11 HTTP transactions
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H/1.1	200 OK	Primary Request Cookie set / Show response msrc-blog.microsoft.com/2021/03/15/one-click-microsoft-exchange-on-premises-mitigation-tool-march-2021/ Redirect Chain http://bc01.care.net.sg/lt.php?tid=eE4ECQcLVl5QVR0GCABeTg0FClMeXA9WCRgFA1pbUAdRV19RXwpIVQpSCFVdAANOW1JeAh5RAARYGA9WCgocUVMCXlEDDVIDUVwITVlVXlsOVVkBHlwBAgEYA1MPXxwLAQteHQUKAgUFBlFXDVRUUg https://msrc-blog.microsoft.com/2021/03/15/one-click-microsoft-exchange-on-premises-mitigation-tool-march-2021/?utm_source=phpList&utm_medium=email&utm_campaign=MICROSOFT+RECENT+ALERT+OF+EXCHANGE+S...	85 KB 21 KB	2414ms 1934ms	Document text/html	40.122.65.162 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://msrc-blog.microsoft.com/2021/03/15/one-click-microsoft-exchange-on-premises-mitigation-tool-march-2021/?utm_source=phpList&utm_medium=email&utm_campaign=MICROSOFT+RECENT+ALERT+OF+EXCHANGE+SERVER+VULNERABILITY&utm_content=HTML Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 40.122.65.162 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / PHP/7.4.15 ASP.NET Resource Hash `5869fb41f83294671829a00a6dbbc3e3ab32794655e6d4a56a5261f54e7bb14a` Request headers Host msrc-blog.microsoft.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site none Sec-Fetch-Mode navigate Sec-Fetch-User ?1 Sec-Fetch-Dest document Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Content-Length 20593 Content-Type text/html; charset=UTF-8 Content-Encoding gzip Vary Accept-Encoding Server Microsoft-IIS/10.0 X-Powered-By PHP/7.4.15 ASP.NET Link <https://msrc-blog.microsoft.com/wp-json/>; rel="https://api.w.org/" <https://msrc-blog.microsoft.com/wp-json/wp/v2/posts/12975>; rel="alternate"; type="application/json" <https://msrc-blog.microsoft.com/?p=12975>; rel=shortlink Set-Cookie ARRAffinity=43741afb0eacd9be64969ac3797f5e272f22a23cd8446e29f3ebb3a6bd9797ab;Path=/;HttpOnly;Secure;Domain=msrc-blog.microsoft.com ARRAffinitySameSite=43741afb0eacd9be64969ac3797f5e272f22a23cd8446e29f3ebb3a6bd9797ab;Path=/;HttpOnly;SameSite=None;Secure;Domain=msrc-blog.microsoft.com Date Mon, 31 May 2021 09:01:49 GMT Redirect headers Date Mon, 31 May 2021 09:01:47 GMT Server Apache/2.4.38 (Debian) Set-Cookie PHPSESSID=pevf5g9e92vlll67qjddj927f0; path=/ Expires Thu, 19 Nov 1981 08:52:00 GMT Cache-Control no-store, no-cache, must-revalidate Pragma no-cache Location https://msrc-blog.microsoft.com/2021/03/15/one-click-microsoft-exchange-on-premises-mitigation-tool-march-2021/?utm_source=phpList&utm_medium=email&utm_campaign=MICROSOFT+RECENT+ALERT+OF+EXCHANGE+SERVER+VULNERABILITY&utm_content=HTML Content-Length 0 Keep-Alive timeout=5, max=100 Connection Keep-Alive Content-Type text/html; charset=UTF-8
GET H/1.1	200 OK	style.min.css msrc-blog.microsoft.com/wp-content/themes/astra/assets/css/minified/	77 KB 19 KB	377ms 263ms	Stylesheet text/css	40.122.65.162 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://msrc-blog.microsoft.com/wp-content/themes/astra/assets/css/minified/style.min.css?ver=3.4.2 Requested by Host: msrc-blog.microsoft.com URL: https://msrc-blog.microsoft.com/2021/03/15/one-click-microsoft-exchange-on-premises-mitigation-tool-march-2021/?utm_source=phpList&utm_medium=email&utm_campaign=MICROSOFT+RECENT+ALERT+OF+EXCHANGE+SERVER+VULNERABILITY&utm_content=HTML Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 40.122.65.162 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `97e6b702954a7bb842cdd268a03d16a7847cf1f2b3897269a1dd495526155a3b` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host msrc-blog.microsoft.com Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Sec-Fetch-Mode no-cors Accept text/css,/;q=0.1 Cache-Control no-cache Sec-Fetch-Dest style Referer https://msrc-blog.microsoft.com/2021/03/15/one-click-microsoft-exchange-on-premises-mitigation-tool-march-2021/?utm_source=phpList&utm_medium=email&utm_campaign=MICROSOFT+RECENT+ALERT+OF+EXCHANGE+SERVER+VULNERABILITY&utm_content=HTML Cookie ARRAffinity=43741afb0eacd9be64969ac3797f5e272f22a23cd8446e29f3ebb3a6bd9797ab; ARRAffinitySameSite=43741afb0eacd9be64969ac3797f5e272f22a23cd8446e29f3ebb3a6bd9797ab Connection keep-alive Referer https://msrc-blog.microsoft.com/2021/03/15/one-click-microsoft-exchange-on-premises-mitigation-tool-march-2021/?utm_source=phpList&utm_medium=email&utm_campaign=MICROSOFT+RECENT+ALERT+OF+EXCHANGE+SERVER+VULNERABILITY&utm_content=HTML User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 31 May 2021 09:01:50 GMT Content-Encoding gzip ETag "be9692bd42d71:0" Last-Modified Thu, 06 May 2021 21:20:00 GMT Server Microsoft-IIS/10.0 X-Powered-By ASP.NET Vary Accept-Encoding Content-Type text/css Accept-Ranges bytes Content-Length 18764
GET H/1.1	200 OK	style.min.css msrc-blog.microsoft.com/wp-includes/css/dist/block-library/	57 KB 12 KB	614ms 231ms	Stylesheet text/css	40.122.65.162 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://msrc-blog.microsoft.com/wp-includes/css/dist/block-library/style.min.css?ver=8c1931a11fb83490d9cc0d1113c452cb Requested by Host: msrc-blog.microsoft.com URL: https://msrc-blog.microsoft.com/2021/03/15/one-click-microsoft-exchange-on-premises-mitigation-tool-march-2021/?utm_source=phpList&utm_medium=email&utm_campaign=MICROSOFT+RECENT+ALERT+OF+EXCHANGE+SERVER+VULNERABILITY&utm_content=HTML Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 40.122.65.162 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `2cd9de3dd26246204749cff259bc34e8e6a47ae5d6e4528b9b28c75d68d50cde` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host msrc-blog.microsoft.com Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Sec-Fetch-Mode no-cors Accept text/css,/;q=0.1 Cache-Control no-cache Sec-Fetch-Dest style Referer https://msrc-blog.microsoft.com/2021/03/15/one-click-microsoft-exchange-on-premises-mitigation-tool-march-2021/?utm_source=phpList&utm_medium=email&utm_campaign=MICROSOFT+RECENT+ALERT+OF+EXCHANGE+SERVER+VULNERABILITY&utm_content=HTML Cookie ARRAffinity=43741afb0eacd9be64969ac3797f5e272f22a23cd8446e29f3ebb3a6bd9797ab; ARRAffinitySameSite=43741afb0eacd9be64969ac3797f5e272f22a23cd8446e29f3ebb3a6bd9797ab Connection keep-alive Referer https://msrc-blog.microsoft.com/2021/03/15/one-click-microsoft-exchange-on-premises-mitigation-tool-march-2021/?utm_source=phpList&utm_medium=email&utm_campaign=MICROSOFT+RECENT+ALERT+OF+EXCHANGE+SERVER+VULNERABILITY&utm_content=HTML User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 31 May 2021 09:01:50 GMT Content-Encoding gzip ETag "55511945ec31d71:0" Last-Modified Thu, 15 Apr 2021 11:41:27 GMT Server Microsoft-IIS/10.0 X-Powered-By ASP.NET Vary Accept-Encoding Content-Type text/css Accept-Ranges bytes Content-Length 11934
GET H/1.1	200 OK	astra-addon-609d8e0480f367-32112150.css msrc-blog.microsoft.com/wp-content/uploads/astra-addon/	23 KB 4 KB	623ms 190ms	Stylesheet text/css	40.122.65.162 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://msrc-blog.microsoft.com/wp-content/uploads/astra-addon/astra-addon-609d8e0480f367-32112150.css?ver=3.4.2 Requested by Host: msrc-blog.microsoft.com URL: https://msrc-blog.microsoft.com/2021/03/15/one-click-microsoft-exchange-on-premises-mitigation-tool-march-2021/?utm_source=phpList&utm_medium=email&utm_campaign=MICROSOFT+RECENT+ALERT+OF+EXCHANGE+SERVER+VULNERABILITY&utm_content=HTML Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 40.122.65.162 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `4a499a94e37f7ec44fd2abd059ce6ac6d4bb99b0b4aa1925764b372abda90c3b` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host msrc-blog.microsoft.com Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Sec-Fetch-Mode no-cors Accept text/css,/;q=0.1 Cache-Control no-cache Sec-Fetch-Dest style Referer https://msrc-blog.microsoft.com/2021/03/15/one-click-microsoft-exchange-on-premises-mitigation-tool-march-2021/?utm_source=phpList&utm_medium=email&utm_campaign=MICROSOFT+RECENT+ALERT+OF+EXCHANGE+SERVER+VULNERABILITY&utm_content=HTML Cookie ARRAffinity=43741afb0eacd9be64969ac3797f5e272f22a23cd8446e29f3ebb3a6bd9797ab; ARRAffinitySameSite=43741afb0eacd9be64969ac3797f5e272f22a23cd8446e29f3ebb3a6bd9797ab Connection keep-alive Referer https://msrc-blog.microsoft.com/2021/03/15/one-click-microsoft-exchange-on-premises-mitigation-tool-march-2021/?utm_source=phpList&utm_medium=email&utm_campaign=MICROSOFT+RECENT+ALERT+OF+EXCHANGE+SERVER+VULNERABILITY&utm_content=HTML User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 31 May 2021 09:01:49 GMT Content-Encoding gzip ETag "1b12eec73748d71:0" Last-Modified Thu, 13 May 2021 20:37:24 GMT Server Microsoft-IIS/10.0 X-Powered-By ASP.NET Vary Accept-Encoding Content-Type text/css Accept-Ranges bytes Content-Length 3789
GET H/1.1	200 OK	wp-emoji-release.min.js Show response msrc-blog.microsoft.com/wp-includes/js/	14 KB 6 KB	681ms 174ms	Script application/x-javascript	40.122.65.162 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://msrc-blog.microsoft.com/wp-includes/js/wp-emoji-release.min.js?ver=8c1931a11fb83490d9cc0d1113c452cb Requested by Host: msrc-blog.microsoft.com URL: https://msrc-blog.microsoft.com/2021/03/15/one-click-microsoft-exchange-on-premises-mitigation-tool-march-2021/?utm_source=phpList&utm_medium=email&utm_campaign=MICROSOFT+RECENT+ALERT+OF+EXCHANGE+SERVER+VULNERABILITY&utm_content=HTML Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 40.122.65.162 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `0c5f584d1ea2c3313dc8c55824c2a572d3cf2eae87c5ca62a58e598aec9ddb5c` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host msrc-blog.microsoft.com Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Sec-Fetch-Mode no-cors Accept / Cache-Control no-cache Sec-Fetch-Dest script Referer https://msrc-blog.microsoft.com/2021/03/15/one-click-microsoft-exchange-on-premises-mitigation-tool-march-2021/?utm_source=phpList&utm_medium=email&utm_campaign=MICROSOFT+RECENT+ALERT+OF+EXCHANGE+SERVER+VULNERABILITY&utm_content=HTML Cookie ARRAffinity=43741afb0eacd9be64969ac3797f5e272f22a23cd8446e29f3ebb3a6bd9797ab; ARRAffinitySameSite=43741afb0eacd9be64969ac3797f5e272f22a23cd8446e29f3ebb3a6bd9797ab Connection keep-alive Referer https://msrc-blog.microsoft.com/2021/03/15/one-click-microsoft-exchange-on-premises-mitigation-tool-march-2021/?utm_source=phpList&utm_medium=email&utm_campaign=MICROSOFT+RECENT+ALERT+OF+EXCHANGE+SERVER+VULNERABILITY&utm_content=HTML User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 31 May 2021 09:01:50 GMT Content-Encoding gzip ETag "bac3de718cfad61:0" Last-Modified Thu, 04 Feb 2021 00:26:56 GMT Server Microsoft-IIS/10.0 X-Powered-By ASP.NET Vary Accept-Encoding Content-Type application/x-javascript Accept-Ranges bytes Content-Length 5993
GET H/1.1	200 OK	style.min.js Show response msrc-blog.microsoft.com/wp-content/themes/astra/assets/js/minified/	10 KB 4 KB	486ms 163ms	Script application/x-javascript	40.122.65.162 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://msrc-blog.microsoft.com/wp-content/themes/astra/assets/js/minified/style.min.js?ver=3.4.2 Requested by Host: msrc-blog.microsoft.com URL: https://msrc-blog.microsoft.com/2021/03/15/one-click-microsoft-exchange-on-premises-mitigation-tool-march-2021/?utm_source=phpList&utm_medium=email&utm_campaign=MICROSOFT+RECENT+ALERT+OF+EXCHANGE+SERVER+VULNERABILITY&utm_content=HTML Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 40.122.65.162 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `1ef0899dadf11eccd489e8aca5ef79eaf9c1caa00f9f1d4d8ad45ff1ed375ccf` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host msrc-blog.microsoft.com Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Sec-Fetch-Mode no-cors Accept / Cache-Control no-cache Sec-Fetch-Dest script Referer https://msrc-blog.microsoft.com/2021/03/15/one-click-microsoft-exchange-on-premises-mitigation-tool-march-2021/?utm_source=phpList&utm_medium=email&utm_campaign=MICROSOFT+RECENT+ALERT+OF+EXCHANGE+SERVER+VULNERABILITY&utm_content=HTML Cookie ARRAffinity=43741afb0eacd9be64969ac3797f5e272f22a23cd8446e29f3ebb3a6bd9797ab; ARRAffinitySameSite=43741afb0eacd9be64969ac3797f5e272f22a23cd8446e29f3ebb3a6bd9797ab Connection keep-alive Referer https://msrc-blog.microsoft.com/2021/03/15/one-click-microsoft-exchange-on-premises-mitigation-tool-march-2021/?utm_source=phpList&utm_medium=email&utm_campaign=MICROSOFT+RECENT+ALERT+OF+EXCHANGE+SERVER+VULNERABILITY&utm_content=HTML User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 31 May 2021 09:01:50 GMT Content-Encoding gzip ETag "631a5893bd42d71:0" Last-Modified Thu, 06 May 2021 21:20:01 GMT Server Microsoft-IIS/10.0 X-Powered-By ASP.NET Vary Accept-Encoding Content-Type application/x-javascript Accept-Ranges bytes Content-Length 3407
GET H/1.1	200 OK	astra-addon-609d8e0487a8a1-15661087.js Show response msrc-blog.microsoft.com/wp-content/uploads/astra-addon/	3 KB 2 KB	519ms 163ms	Script application/x-javascript	40.122.65.162 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://msrc-blog.microsoft.com/wp-content/uploads/astra-addon/astra-addon-609d8e0487a8a1-15661087.js?ver=3.4.2 Requested by Host: msrc-blog.microsoft.com URL: https://msrc-blog.microsoft.com/2021/03/15/one-click-microsoft-exchange-on-premises-mitigation-tool-march-2021/?utm_source=phpList&utm_medium=email&utm_campaign=MICROSOFT+RECENT+ALERT+OF+EXCHANGE+SERVER+VULNERABILITY&utm_content=HTML Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 40.122.65.162 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `4c8eb350131819e5d4670f063bd56fe028ea97e5febcca94a069981f7333a1ad` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host msrc-blog.microsoft.com Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Sec-Fetch-Mode no-cors Accept / Cache-Control no-cache Sec-Fetch-Dest script Referer https://msrc-blog.microsoft.com/2021/03/15/one-click-microsoft-exchange-on-premises-mitigation-tool-march-2021/?utm_source=phpList&utm_medium=email&utm_campaign=MICROSOFT+RECENT+ALERT+OF+EXCHANGE+SERVER+VULNERABILITY&utm_content=HTML Cookie ARRAffinity=43741afb0eacd9be64969ac3797f5e272f22a23cd8446e29f3ebb3a6bd9797ab; ARRAffinitySameSite=43741afb0eacd9be64969ac3797f5e272f22a23cd8446e29f3ebb3a6bd9797ab Connection keep-alive Referer https://msrc-blog.microsoft.com/2021/03/15/one-click-microsoft-exchange-on-premises-mitigation-tool-march-2021/?utm_source=phpList&utm_medium=email&utm_campaign=MICROSOFT+RECENT+ALERT+OF+EXCHANGE+SERVER+VULNERABILITY&utm_content=HTML User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 31 May 2021 09:01:50 GMT Content-Encoding gzip ETag "f8e2f1c73748d71:0" Last-Modified Thu, 13 May 2021 20:37:24 GMT Server Microsoft-IIS/10.0 X-Powered-By ASP.NET Vary Accept-Encoding Content-Type application/x-javascript Accept-Ranges bytes Content-Length 1253
GET H/1.1	200 OK	Cookie set wp-embed.min.js Show response msrc-blog.microsoft.com/wp-includes/js/	1 KB 2 KB	286ms 167ms	Script application/x-javascript	40.122.65.162 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://msrc-blog.microsoft.com/wp-includes/js/wp-embed.min.js?ver=8c1931a11fb83490d9cc0d1113c452cb Requested by Host: msrc-blog.microsoft.com URL: https://msrc-blog.microsoft.com/2021/03/15/one-click-microsoft-exchange-on-premises-mitigation-tool-march-2021/?utm_source=phpList&utm_medium=email&utm_campaign=MICROSOFT+RECENT+ALERT+OF+EXCHANGE+SERVER+VULNERABILITY&utm_content=HTML Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 40.122.65.162 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host msrc-blog.microsoft.com Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Sec-Fetch-Mode no-cors Accept / Cache-Control no-cache Sec-Fetch-Dest script Referer https://msrc-blog.microsoft.com/2021/03/15/one-click-microsoft-exchange-on-premises-mitigation-tool-march-2021/?utm_source=phpList&utm_medium=email&utm_campaign=MICROSOFT+RECENT+ALERT+OF+EXCHANGE+SERVER+VULNERABILITY&utm_content=HTML Connection keep-alive Referer https://msrc-blog.microsoft.com/2021/03/15/one-click-microsoft-exchange-on-premises-mitigation-tool-march-2021/?utm_source=phpList&utm_medium=email&utm_campaign=MICROSOFT+RECENT+ALERT+OF+EXCHANGE+SERVER+VULNERABILITY&utm_content=HTML User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 31 May 2021 09:01:50 GMT Content-Encoding gzip ETag "ca2fda718cfad61:0" Last-Modified Thu, 04 Feb 2021 00:26:56 GMT Server Microsoft-IIS/10.0 X-Powered-By ASP.NET Vary Accept-Encoding Content-Type application/x-javascript Set-Cookie ARRAffinity=dd4ec869249e3d9566ca786d6cbf7afd7f6d9716031ffd176919145cecc852ea;Path=/;HttpOnly;Secure;Domain=msrc-blog.microsoft.com ARRAffinitySameSite=dd4ec869249e3d9566ca786d6cbf7afd7f6d9716031ffd176919145cecc852ea;Path=/;HttpOnly;SameSite=None;Secure;Domain=msrc-blog.microsoft.com Accept-Ranges bytes Content-Length 966
GET H/1.1	404 Not Found	Cookie set astra.woff msrc-blog.microsoft.com/wp-content/themes/astra/assets/fonts/	0 0	157ms 157ms	Font text/html	40.122.65.162 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://msrc-blog.microsoft.com/wp-content/themes/astra/assets/fonts/astra.woff Requested by Host: msrc-blog.microsoft.com URL: https://msrc-blog.microsoft.com/2021/03/15/one-click-microsoft-exchange-on-premises-mitigation-tool-march-2021/?utm_source=phpList&utm_medium=email&utm_campaign=MICROSOFT+RECENT+ALERT+OF+EXCHANGE+SERVER+VULNERABILITY&utm_content=HTML Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 40.122.65.162 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash Request headers Pragma no-cache Sec-Fetch-Site same-origin Origin https://msrc-blog.microsoft.com Accept-Encoding gzip, deflate, br Host msrc-blog.microsoft.com Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Sec-Fetch-Mode cors Accept / Cache-Control no-cache Sec-Fetch-Dest font Referer https://msrc-blog.microsoft.com/2021/03/15/one-click-microsoft-exchange-on-premises-mitigation-tool-march-2021/?utm_source=phpList&utm_medium=email&utm_campaign=MICROSOFT+RECENT+ALERT+OF+EXCHANGE+SERVER+VULNERABILITY&utm_content=HTML Connection keep-alive Origin https://msrc-blog.microsoft.com Referer https://msrc-blog.microsoft.com/2021/03/15/one-click-microsoft-exchange-on-premises-mitigation-tool-march-2021/?utm_source=phpList&utm_medium=email&utm_campaign=MICROSOFT+RECENT+ALERT+OF+EXCHANGE+SERVER+VULNERABILITY&utm_content=HTML User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 31 May 2021 09:01:50 GMT Server Microsoft-IIS/10.0 Set-Cookie ARRAffinity=dd4ec869249e3d9566ca786d6cbf7afd7f6d9716031ffd176919145cecc852ea;Path=/;HttpOnly;Secure;Domain=msrc-blog.microsoft.com ARRAffinitySameSite=dd4ec869249e3d9566ca786d6cbf7afd7f6d9716031ffd176919145cecc852ea;Path=/;HttpOnly;SameSite=None;Secure;Domain=msrc-blog.microsoft.com X-Powered-By ASP.NET Content-Length 103 Content-Type text/html
GET H/1.1	200 OK	image-28-1024x523.png msrc-blog.microsoft.com/wp-content/uploads/2021/03/	263 KB 263 KB	179ms 179ms	Image image/png	40.122.65.162 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://msrc-blog.microsoft.com/wp-content/uploads/2021/03/image-28-1024x523.png Requested by Host: msrc-blog.microsoft.com URL: https://msrc-blog.microsoft.com/2021/03/15/one-click-microsoft-exchange-on-premises-mitigation-tool-march-2021/?utm_source=phpList&utm_medium=email&utm_campaign=MICROSOFT+RECENT+ALERT+OF+EXCHANGE+SERVER+VULNERABILITY&utm_content=HTML Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 40.122.65.162 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `98a78744939189bce65c693e91f360439e488b0d074c56aa216f1ab9f5d11f9f` Request headers Pragma no-cache Sec-Fetch-Site same-origin Accept-Encoding gzip, deflate, br Host msrc-blog.microsoft.com Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Sec-Fetch-Mode no-cors Accept image/avif,image/webp,image/apng,image/svg+xml,image/,/;q=0.8 Cache-Control* no-cache Sec-Fetch-Dest image Referer https://msrc-blog.microsoft.com/2021/03/15/one-click-microsoft-exchange-on-premises-mitigation-tool-march-2021/?utm_source=phpList&utm_medium=email&utm_campaign=MICROSOFT+RECENT+ALERT+OF+EXCHANGE+SERVER+VULNERABILITY&utm_content=HTML Cookie ARRAffinity=dd4ec869249e3d9566ca786d6cbf7afd7f6d9716031ffd176919145cecc852ea; ARRAffinitySameSite=dd4ec869249e3d9566ca786d6cbf7afd7f6d9716031ffd176919145cecc852ea Connection keep-alive Referer https://msrc-blog.microsoft.com/2021/03/15/one-click-microsoft-exchange-on-premises-mitigation-tool-march-2021/?utm_source=phpList&utm_medium=email&utm_campaign=MICROSOFT+RECENT+ALERT+OF+EXCHANGE+SERVER+VULNERABILITY&utm_content=HTML User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 31 May 2021 09:01:51 GMT Last-Modified Mon, 15 Mar 2021 23:41:02 GMT Server Microsoft-IIS/10.0 X-Powered-By ASP.NET ETag "456c8a8f419d71:0" Content-Type image/png Accept-Ranges bytes Content-Length 269091
GET H/1.1	200 OK	astra.ttf msrc-blog.microsoft.com/wp-content/themes/astra/assets/fonts/	3 KB 3 KB	171ms 171ms	Font application/octet-stream	40.122.65.162 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://msrc-blog.microsoft.com/wp-content/themes/astra/assets/fonts/astra.ttf Requested by Host: msrc-blog.microsoft.com URL: https://msrc-blog.microsoft.com/2021/03/15/one-click-microsoft-exchange-on-premises-mitigation-tool-march-2021/?utm_source=phpList&utm_medium=email&utm_campaign=MICROSOFT+RECENT+ALERT+OF+EXCHANGE+SERVER+VULNERABILITY&utm_content=HTML Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 40.122.65.162 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash `c3326eca3e04119400003592725c6a3c116ea221a7b3c581b8f92f789d71e4e8` Request headers Pragma no-cache Sec-Fetch-Site same-origin Origin https://msrc-blog.microsoft.com Accept-Encoding gzip, deflate, br Host msrc-blog.microsoft.com Accept-Language en-US User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Sec-Fetch-Mode cors Accept / Cache-Control no-cache Sec-Fetch-Dest font Referer https://msrc-blog.microsoft.com/2021/03/15/one-click-microsoft-exchange-on-premises-mitigation-tool-march-2021/?utm_source=phpList&utm_medium=email&utm_campaign=MICROSOFT+RECENT+ALERT+OF+EXCHANGE+SERVER+VULNERABILITY&utm_content=HTML Cookie ARRAffinity=dd4ec869249e3d9566ca786d6cbf7afd7f6d9716031ffd176919145cecc852ea; ARRAffinitySameSite=dd4ec869249e3d9566ca786d6cbf7afd7f6d9716031ffd176919145cecc852ea Connection keep-alive Origin https://msrc-blog.microsoft.com Referer https://msrc-blog.microsoft.com/2021/03/15/one-click-microsoft-exchange-on-premises-mitigation-tool-march-2021/?utm_source=phpList&utm_medium=email&utm_campaign=MICROSOFT+RECENT+ALERT+OF+EXCHANGE+SERVER+VULNERABILITY&utm_content=HTML User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36 Response headers Date Mon, 31 May 2021 09:01:51 GMT Last-Modified Thu, 06 May 2021 21:20:01 GMT Server Microsoft-IIS/10.0 X-Powered-By ASP.NET ETag "ae573393bd42d71:0" Content-Type application/octet-stream Accept-Ranges bytes Content-Length 3228

Verdicts & Comments Add Verdict or Comment

26 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| _wpemojiSettings object| astra function| astraGetParents function| getParents function| astraToggleClass function| toggleClass function| astraTriggerEvent function| AstraToggleSubMenu function| AstraNavigationMenu function| AstraToggleMenu function| AstraToggleSetup function| astraNavMenuToggle object| astraAddon object| wp object| twemoji

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.msrc-blog.microsoft.com/	1969-12-31 23:59:59	Name: ARRAffinitySameSite Value: dd4ec869249e3d9566ca786d6cbf7afd7f6d9716031ffd176919145cecc852ea
			.msrc-blog.microsoft.com/	1969-12-31 23:59:59	Name: ARRAffinity Value: dd4ec869249e3d9566ca786d6cbf7afd7f6d9716031ffd176919145cecc852ea

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

bc01.care.net.sg
msrc-blog.microsoft.com
202.55.81.249
40.122.65.162
0c5f584d1ea2c3313dc8c55824c2a572d3cf2eae87c5ca62a58e598aec9ddb5c
1ef0899dadf11eccd489e8aca5ef79eaf9c1caa00f9f1d4d8ad45ff1ed375ccf
2cd9de3dd26246204749cff259bc34e8e6a47ae5d6e4528b9b28c75d68d50cde
4a499a94e37f7ec44fd2abd059ce6ac6d4bb99b0b4aa1925764b372abda90c3b
4c8eb350131819e5d4670f063bd56fe028ea97e5febcca94a069981f7333a1ad
5869fb41f83294671829a00a6dbbc3e3ab32794655e6d4a56a5261f54e7bb14a
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991
97e6b702954a7bb842cdd268a03d16a7847cf1f2b3897269a1dd495526155a3b
98a78744939189bce65c693e91f360439e488b0d074c56aa216f1ab9f5d11f9f
c3326eca3e04119400003592725c6a3c116ea221a7b3c581b8f92f789d71e4e8