![](/screenshots/88a16901-bfff-4464-8aa9-b9f3aa64795a.png)
onedrive.live.com
Open in
urlscan Pro
13.107.139.11
Public Scan
Effective URL: https://onedrive.live.com/edit?id=68B0DD122CDA7A7D!s8d39735105dd4bdaa574bb0d696102e0&resid=68B0DD122CDA7A7D!s8d39735105dd4...
Submission Tags: shiny c290acadafe6362a fc6b18fd85158e2b bfst honeypoter@gmail.com Search All
Submission: On January 22 via api from JP — Scanned from JP
Summary
TLS certificate: Issued by Microsoft Azure TLS Issuing CA 02 on August 6th 2023. Valid for: a year.
This is the only time onedrive.live.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2606:4700:303... 2606:4700:3033::ac43:88cc | 13335 (CLOUDFLAR...) (CLOUDFLARENET) | |
1 1 | 52.206.24.170 52.206.24.170 | 14618 (AMAZON-AES) (AMAZON-AES) | |
1 1 | 13.107.42.12 13.107.42.12 | 8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 4 | 13.107.139.11 13.107.139.11 | 8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
10 | 2600:140b:1a0... 2600:140b:1a00:b::17c8:372d | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
2 | 2600:140b:1a0... 2600:140b:1a00:16::6007:27a3 | 20940 (AKAMAI-ASN1) (AKAMAI-ASN1) | |
2 | 2620:1ec:8fa::10 2620:1ec:8fa::10 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
1 | 2603:1063:200... 2603:1063:2000::12 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
2 | 52.182.141.63 52.182.141.63 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
20 | 6 |
ASN14618 (AMAZON-AES, US)
PTR: ec2-52-206-24-170.compute-1.amazonaws.com
rb.gy |
ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
onedrive.live.com | |
my.microsoftpersonalcontent.com |
ASN20940 (AKAMAI-ASN1, NL)
wise-m.public.cdn.office.net | |
wise.public.cdn.office.net |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
excel.officeapps.live.com |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
browser.events.data.microsoft.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
12 |
office.net
res-1.cdn.office.net — Cisco Umbrella Rank: 317 wise-m.public.cdn.office.net — Cisco Umbrella Rank: 5108 wise.public.cdn.office.net — Cisco Umbrella Rank: 2777 |
425 KB |
3 |
live.com
1 redirects
onedrive.live.com — Cisco Umbrella Rank: 1479 excel.officeapps.live.com — Cisco Umbrella Rank: 2225 |
18 KB |
2 |
microsoft.com
browser.events.data.microsoft.com — Cisco Umbrella Rank: 123 |
761 B |
2 |
microsoftpersonalcontent.com
my.microsoftpersonalcontent.com — Cisco Umbrella Rank: 6220 |
4 KB |
2 |
svc.ms
api-badgerp.svc.ms — Cisco Umbrella Rank: 511499 |
1 KB |
1 |
1drv.ms
1 redirects
1drv.ms — Cisco Umbrella Rank: 31380 |
471 B |
1 |
rb.gy
1 redirects
rb.gy — Cisco Umbrella Rank: 118875 |
211 B |
1 |
swaydefinancial.com
1 redirects
swaydefinancial.com |
646 B |
20 | 8 |
Domain | Requested by | |
---|---|---|
10 | res-1.cdn.office.net |
onedrive.live.com
res-1.cdn.office.net |
2 | browser.events.data.microsoft.com |
res-1.cdn.office.net
|
2 | my.microsoftpersonalcontent.com |
res-1.cdn.office.net
|
2 | api-badgerp.svc.ms |
res-1.cdn.office.net
|
2 | onedrive.live.com | 1 redirects |
1 | excel.officeapps.live.com | |
1 | wise.public.cdn.office.net |
wise-m.public.cdn.office.net
|
1 | wise-m.public.cdn.office.net |
res-1.cdn.office.net
|
1 | 1drv.ms | 1 redirects |
1 | rb.gy | 1 redirects |
1 | swaydefinancial.com | 1 redirects |
20 | 11 |
This site contains no links.
Subject Issuer | Validity | Valid | |
---|---|---|---|
onedrive.com Microsoft Azure TLS Issuing CA 02 |
2023-08-06 - 2024-06-27 |
a year | crt.sh |
*.res.outlook.com DigiCert SHA2 Secure Server CA |
2023-04-17 - 2024-04-17 |
a year | crt.sh |
svc.ms Microsoft Azure RSA TLS Issuing CA 04 |
2023-09-27 - 2024-09-21 |
a year | crt.sh |
microsoftpersonalcontent.com DigiCert SHA2 Secure Server CA |
2023-12-29 - 2024-12-29 |
a year | crt.sh |
officeapps.live.com Microsoft Azure RSA TLS Issuing CA 04 |
2023-11-27 - 2024-11-21 |
a year | crt.sh |
*.events.data.microsoft.com Microsoft Azure RSA TLS Issuing CA 03 |
2023-10-02 - 2024-09-26 |
a year | crt.sh |
This page contains 2 frames:
Primary Page:
https://onedrive.live.com/edit?id=68B0DD122CDA7A7D!s8d39735105dd4bdaa574bb0d696102e0&resid=68B0DD122CDA7A7D!s8d39735105dd4bdaa574bb0d696102e0&cid=68b0dd122cda7a7d&ithint=file%2cxlsx&redeem=aHR0cHM6Ly8xZHJ2Lm1zL3gvYy82OGIwZGQxMjJjZGE3YTdkL0VWRnpPWTNkQmRwTHBYUzdEV2xoQXVBQk1VeFZkc09weTdsbERhMDNzSXRkTUE_c2hpbnk9&migratedtospo=true&wdo=2
Frame ID: F3C15FEC5A6AB5219C2D2C906C7B3A26
Requests: 16 HTTP requests in this frame
Frame:
https://excel.officeapps.live.com/x/_layouts/xlviewerinternal.aspx?ui=ja-JP&rs=ja-JP&WOPISrc=https%3A%2F%2Fmy.microsoftpersonalcontent.com%2Fpersonal%2F68b0dd122cda7a7d%2F_vti_bin%2Fwopi.ashx%2Ffiles%2F8d39735105dd4bdaa574bb0d696102e0&wdEnableRoaming=1&mscc=0&wdODB=1&hid=4d5b04a1-80f3-4000-b942-e25f5d4a21fd&sc=%7B%22pmo%22%3A%22https%3A%2F%2Fonedrive.live.com%22%2C%22redeem%22%3A%22aHR0cHM6Ly8xZHJ2Lm1zL3gvYy82OGIwZGQxMjJjZGE3YTdkL0VWRnpPWTNkQmRwTHBYUzdEV2xoQXVBQk1VeFZkc09weTdsbERhMDNzSXRkTUE_c2hpbnk9%22%7D&wdo=2
Frame ID: 2DEAA1E379CE273059396E99E3598551
Requests: 1 HTTP requests in this frame
Screenshot
![](/screenshots/88a16901-bfff-4464-8aa9-b9f3aa64795a.png)
Page Title
MOM - LENDING.xlsx - Microsoft Excel OnlinePage URL History Show full URLs
-
http://swaydefinancial.com/?shiny
HTTP 301
https://rb.gy/0bk9k4?shiny HTTP 301
https://1drv.ms/x/c/68b0dd122cda7a7d/EVFzOY3dBdpLpXS7DWlhAuABMUxVdsOpy7llDa03sItdMA?shiny= HTTP 301
https://onedrive.live.com/redir?cid=68b0dd122cda7a7d&resid=68B0DD122CDA7A7D!s8d39735105dd4bdaa574bb0d6... HTTP 302
https://onedrive.live.com/edit?id=68B0DD122CDA7A7D!s8d39735105dd4bdaa574bb0d696102e0&resid=68B0DD122CD... Page URL
Page Statistics
0 Outgoing links
These are links going to different origins than the main page.
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
http://swaydefinancial.com/?shiny
HTTP 301
https://rb.gy/0bk9k4?shiny HTTP 301
https://1drv.ms/x/c/68b0dd122cda7a7d/EVFzOY3dBdpLpXS7DWlhAuABMUxVdsOpy7llDa03sItdMA?shiny= HTTP 301
https://onedrive.live.com/redir?cid=68b0dd122cda7a7d&resid=68B0DD122CDA7A7D!s8d39735105dd4bdaa574bb0d696102e0&ithint=file%2cxlsx&shiny=&migratedtospo=true&redeem=aHR0cHM6Ly8xZHJ2Lm1zL3gvYy82OGIwZGQxMjJjZGE3YTdkL0VWRnpPWTNkQmRwTHBYUzdEV2xoQXVBQk1VeFZkc09weTdsbERhMDNzSXRkTUE_c2hpbnk9 HTTP 302
https://onedrive.live.com/edit?id=68B0DD122CDA7A7D!s8d39735105dd4bdaa574bb0d696102e0&resid=68B0DD122CDA7A7D!s8d39735105dd4bdaa574bb0d696102e0&cid=68b0dd122cda7a7d&ithint=file%2cxlsx&redeem=aHR0cHM6Ly8xZHJ2Lm1zL3gvYy82OGIwZGQxMjJjZGE3YTdkL0VWRnpPWTNkQmRwTHBYUzdEV2xoQXVBQk1VeFZkc09weTdsbERhMDNzSXRkTUE_c2hpbnk9&migratedtospo=true&wdo=2 Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
20 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
edit
onedrive.live.com/ Redirect Chain
|
50 KB 17 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
plt.resx-plt.js
res-1.cdn.office.net/files/odsp-web-prod_2023-12-08.003/wacodcowlhostwebpack.manifest/ja/ |
4 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
plt.react.js
res-1.cdn.office.net/files/odsp-web-prod_2023-12-08.003/wacodcowlhostwebpack.manifest/ |
121 KB 35 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
plt.office-ui-fabric-react.js
res-1.cdn.office.net/files/odsp-web-prod_2023-12-08.003/wacodcowlhostwebpack.manifest/ |
42 KB 13 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
plt.odsp-common.js
res-1.cdn.office.net/files/odsp-web-prod_2023-12-08.003/wacodcowlhostwebpack.manifest/ |
219 KB 54 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
plt.items-view.js
res-1.cdn.office.net/files/odsp-web-prod_2023-12-08.003/wacodcowlhostwebpack.manifest/ |
3 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wacodcowlhostwebpack.js
res-1.cdn.office.net/files/odsp-web-prod_2023-12-08.003/wacodcowlhostwebpack.manifest/ |
528 KB 133 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
manifest.js
wise-m.public.cdn.office.net/wise-m/owl/5mttl/production/50/ |
4 KB 3 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
39.js
res-1.cdn.office.net/files/odsp-web-prod_2023-12-08.003/wacodcowlhostwebpack.manifest/ |
58 KB 18 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
token
api-badgerp.svc.ms/v1.0/ |
849 B 1 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
token
api-badgerp.svc.ms/v1.0/ Frame |
0 0 |
Preflight
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
driveItem
my.microsoftpersonalcontent.com/_api/v2.0/shares/u!aHR0cHM6Ly8xZHJ2Lm1zL3gvYy82OGIwZGQxMjJjZGE3YTdkL0VWRnpPWTNkQmRwTHBYUzdEV2xoQXVBQk1VeFZkc09weTdsbERhMDNzSXRkTUE_c2hpbnk9/ |
7 KB 4 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
driveItem
my.microsoftpersonalcontent.com/_api/v2.0/shares/u!aHR0cHM6Ly8xZHJ2Lm1zL3gvYy82OGIwZGQxMjJjZGE3YTdkL0VWRnpPWTNkQmRwTHBYUzdEV2xoQXVBQk1VeFZkc09weTdsbERhMDNzSXRkTUE_c2hpbnk9/ Frame |
0 0 |
Preflight
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
owl.46085c276a858d50b267.js
wise.public.cdn.office.net/wise/owl/ |
326 KB 80 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
4.js
res-1.cdn.office.net/files/odsp-web-prod_2023-12-08.003/wacodcowlhostwebpack.manifest/ |
222 KB 53 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
ondemand.resx-ondemand.js
res-1.cdn.office.net/files/odsp-web-prod_2023-12-08.003/wacodcowlhostwebpack.manifest/ja/ |
10 KB 2 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H3 |
29.js
res-1.cdn.office.net/files/odsp-web-prod_2023-12-08.003/wacodcowlhostwebpack.manifest/ |
120 KB 30 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
xlviewerinternal.aspx
excel.officeapps.live.com/x/_layouts/ Frame 2DEA |
0 0 |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H2 |
/
browser.events.data.microsoft.com/OneCollector/1.0/ Frame |
0 0 |
Preflight
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H2 |
/
browser.events.data.microsoft.com/OneCollector/1.0/ |
153 B 761 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
41 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| 0 object| $B object| $CJ object| Flight function| requirejs function| require function| define function| es6-symbol function| ES6Promise object| $Config object| FilesConfig object| WacConfig string| __odsp_culture number| g_responseEnd string| backupBaseUrl object| failOverState object| corsMatch function| processConfigToSupportFailOver object| __cdnFailOverState object| odspNextWebpackJsonp function| __debugSetKillSwitch object| ODSP_TELEMETRY_MANAGER function| __onbeforeunload object| __stylesheet__ object| __globalSettings__ object| __themeState__ object| __packages__ object| __testHooks object| CUSTOMERPROMISE_MANAGER object| _perfMarks object| __dynProto$Gbl object| AbtInteraction object| AbtAuthType object| AbtSignOutSource object| AbtEnvironment object| __events__ function| owlManifestFactory object| Microsoft object| webpackChunkMicrosoft_Office_OWL number| __currentId__ object| __ko8 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
excel.officeapps.live.com/x/_layouts | Name: Excel_CurrentVersion_Artifacts Value: 161731842309 |
|
.live.com/ | Name: xid Value: 72b10da0-304f-4754-8e41-6e67181156eb&&ODSP-ODWEB-ODCF&54 |
|
.live.com/ | Name: E Value: P:mAF56KIb3Ig=:krjdtn+lXZ5mAoHS2zJrAFao3KPoT4fHrdX7VYZ9dss=:F |
|
.live.com/ | Name: xidseq Value: 2 |
|
.live.com/ | Name: wla42 Value: |
|
onedrive.live.com/ | Name: MicrosoftApplicationsTelemetryDeviceId Value: afc44403-37e6-4ff1-b736-b3add5aa7246 |
|
onedrive.live.com/ | Name: ai_session Value: pevGiHm4TE7SWN/ixNhfHU|1705966568603|1705966568603 |
|
excel.officeapps.live.com/ | Name: PJP1-Excel-ARRAffinity Value: dc4c799cebeb719e385f65853c5cb41ba69bc41bf246f7bcc4edeed0c4d214bc |
1 Console Messages
A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.
Source | Level | URL Text |
---|
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000 |
X-Content-Type-Options | nosniff |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
1drv.ms
api-badgerp.svc.ms
browser.events.data.microsoft.com
excel.officeapps.live.com
my.microsoftpersonalcontent.com
onedrive.live.com
rb.gy
res-1.cdn.office.net
swaydefinancial.com
wise-m.public.cdn.office.net
wise.public.cdn.office.net
13.107.139.11
13.107.42.12
2600:140b:1a00:16::6007:27a3
2600:140b:1a00:b::17c8:372d
2603:1063:2000::12
2606:4700:3033::ac43:88cc
2620:1ec:8fa::10
52.182.141.63
52.206.24.170
01681ab1c2816c6fd9b705b2157f142e5c72a5ca262beb1e7814d07deaddf748
2dd16f7e934e3c17a5fe500543ccefcf74abd8f8e5001c29ef814d06c657d3d2
3e26ac8fb2f0d03da9deb7b077f35aba2a023e940d022ecc871394d2a21e5f0c
431d517d86fd0267d18cdc4859d6fe49d29b92a0b4d3e726b2de3e8f90055bc8
545d368402708494fb827e7bc423255565247c1d50223990c4304ca04ace10fe
5b2a793661630d1e5227e54a38277ce9abf89cb43d5454d54d381b5645cffe1f
6d75b656cd1dfb45902418856c34c3355dc075b24aaba3e8f6d6db2d73d0f9af
87d5cbed1cd591880cfdabcc474bd7d5960d7cc2945eef7c39d2a973b1068cf3
ae64f0fc21da276ba52a5f9caeb4707e3fed4a9849b8c24ba40cf865eab8e4e4
bdd29b3a9623690191d64cb1602d810fce6b38b578f810fe3968b01ceee2435b
c1683b6b23456d8f3bdd01f2f8ab559e1185ab172cbab6e43f6cce9d036d11d6
d624040453465bf89513a19bdbcb0fc3eb9ba1e450921dd4d1d7975d89b849f7
e270c5b00f5694562c5c171f50c0cf86a3895d501587545a70555f820a0a83ed
fa59f752d8dab9aa6030faafa6046f22d56844323cd0ad440ee5b93bf3774735
ff00fe83b4a4637326407f140571510aa610de821293925b50a1f1e1bf2dd2af
ffdc54267860b985a5b74cdb610169bad1e772b07afabbb7a3b61963e0e77edc