pub-135fdeb3fb354bae9b677743ed175f91.r2.dev Open in urlscan Pro
2606:4700::6812:223 Malicious Activity! Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/owa-eupdate_s.html?websrc=ce7X3cei582685A6DD5420X4-Do6-0X3ec55b6ec435D05593oaic-Xoo3e-eca-c-69i-...
Effective URL:
https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/owa-eupdate_s.html?websrc=ce7X3cei582685A6DD5420X4-Do6-0X3ec55b6ec435D05593oaic-Xoo3e-eca-c-69i-...
Submission: On May 01 via api (May 1st 2024, 11:21:41 pm UTC) from US — Scanned from DE

Summary HTTP 42 Redirects Links 1 Behaviour Indicators

Summary

This website contacted 9 IPs in 4 countries across 8 domains to perform 42 HTTP transactions. The main IP is 2606:4700::6812:223, located in United States and belongs to CLOUDFLARENET, US. The main domain is pub-135fdeb3fb354bae9b677743ed175f91.r2.dev.
TLS certificate: Issued by E1 on April 5th 2024. Valid for: 3 months.

This is the only time pub-135fdeb3fb354bae9b677743ed175f91.r2.dev was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Generic (Online)

Domain & IP information

	IP Address	AS Autonomous System
3	2606:4700::68... 2606:4700::6812:223	13335 (CLOUDFLAR...) (CLOUDFLARENET)
15	104.18.42.234 104.18.42.234	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:81c::200a	15169 (GOOGLE) (GOOGLE)
8	104.17.25.14 104.17.25.14	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	104.16.86.20 104.16.86.20	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:2800:133... 2606:2800:133:206e:1315:22a5:2006:24fd	15133 (EDGECAST) (EDGECAST)
2	2a00:1450:400... 2a00:1450:4001:812::2003	15169 (GOOGLE) (GOOGLE)
2	20.50.88.234 20.50.88.234	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
42	9

3 2606:4700::6812:223 (United States)

ASN13335 (CLOUDFLARENET, US)

pub-135fdeb3fb354bae9b677743ed175f91.r2.dev	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 104.18.42.234 (None, )

ASN13335 (CLOUDFLARENET, US)

controlpanel.msoutlookonline.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:81c::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 104.17.25.14 (None, )

ASN13335 (CLOUDFLARENET, US)

cdnjs.cloudflare.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.16.86.20 (None, )

ASN13335 (CLOUDFLARENET, US)

cdn.jsdelivr.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:2800:133:206e:1315:22a5:2006:24fd (United States)

ASN15133 (EDGECAST, US)

az416426.vo.msecnd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:812::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 20.50.88.234 (Amsterdam, Netherlands)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

dc.services.visualstudio.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
15	msoutlookonline.net controlpanel.msoutlookonline.net — Cisco Umbrella Rank: 573153	103 KB
8	cloudflare.com cdnjs.cloudflare.com — Cisco Umbrella Rank: 231	44 KB
4	jsdelivr.net cdn.jsdelivr.net — Cisco Umbrella Rank: 320	62 KB
3	r2.dev pub-135fdeb3fb354bae9b677743ed175f91.r2.dev	78 KB
2	visualstudio.com dc.services.visualstudio.com — Cisco Umbrella Rank: 730	200 B
2	gstatic.com fonts.gstatic.com	45 KB
2	msecnd.net az416426.vo.msecnd.net — Cisco Umbrella Rank: 2797	22 KB
2	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 33	1 KB
42	8

	Domain	Requested by
15	controlpanel.msoutlookonline.net	pub-135fdeb3fb354bae9b677743ed175f91.r2.dev controlpanel.msoutlookonline.net
8	cdnjs.cloudflare.com	pub-135fdeb3fb354bae9b677743ed175f91.r2.dev
4	cdn.jsdelivr.net	pub-135fdeb3fb354bae9b677743ed175f91.r2.dev
3	pub-135fdeb3fb354bae9b677743ed175f91.r2.dev	pub-135fdeb3fb354bae9b677743ed175f91.r2.dev
2	dc.services.visualstudio.com	az416426.vo.msecnd.net
2	fonts.gstatic.com	fonts.googleapis.com
2	az416426.vo.msecnd.net	controlpanel.msoutlookonline.net
2	fonts.googleapis.com	pub-135fdeb3fb354bae9b677743ed175f91.r2.dev
42	8

This site contains links to these domains. Also see Links.

Domain
outdatedbrowser.com

Subject Issuer	Validity	Valid
*.r2.dev E1	`2024-04-05` - `2024-07-04`	3 months	crt.sh
controlpanel.msoutlookonline.net Cloudflare Inc ECC CA-3	`2023-10-13` - `2024-10-12`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2024-04-16` - `2024-07-09`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-07-03` - `2024-07-02`	a year	crt.sh
*.vo.msecnd.net DigiCert SHA2 Secure Server CA	`2024-01-30` - `2025-01-30`	a year	crt.sh
*.gstatic.com GTS CA 1C3	`2024-04-16` - `2024-07-09`	3 months	crt.sh
prod.ai.ingestion.msftcloudes.com Microsoft Azure RSA TLS Issuing CA 04	`2024-04-10` - `2025-04-05`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/owa-eupdate_s.html?websrc=ce7X3cei582685A6DD5420X4-Do6-0X3ec55b6ec435D05593oaic-Xoo3e-eca-c-69i-A32biiaXb-XeXi-a409--567bc84o-i9938oc-49eba-D-434b48763-cb-30b92400cic05e7e7b-Xe37c456cic-96bcX4-7bb486ibo73D2bD42AD5250eea4ib4058A70boDi0eAbi6e4a4A3e540o3--0e54c&dispatch=591260418348737048261116187487475722977577126932471339121077&websrc=ce7X3cei582685A6DD5420X4-Do6-0X3ec55b6ec435D05593oaic-Xoo3e-eca-c-69i-A32biiaXb-XeXi-a409--567bc84o-i9938oc-49eba-D-434b48763-cb-30b92400cic05e7e7b-Xe37c456cic-96bcX4-7bb486ibo73D2bD42AD5250eea4ib4058A70boDi0eAbi6e4a4A3e540o3--0e54c&dispatch=591260418348737048261116187487475722977577126932471339121077&id=i-438i2559ceab333D9c5iibbi365o-0b459ac4bei540oD9XDe5b538i44460
Frame ID: 9B1E7013BAAAB974131CD564E3A31FC0
Requests: 41 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Outlook Web Access

Page URL History Show full URLs

https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/owa-eupdate_s.html?websrc=ce7X3cei582685A6DD5420X4-Do6-0X3ec55b6ec435D05593o... Page URL
https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/owa-eupdate_s.html?websrc=ce7X3cei582685A6DD5420X4-Do6-0X3ec55b6ec435D05593o... Page URL

Detected technologies

Axios (JavaScript libraries) Expand

Overall confidence: 100%
Detected patterns

/axios(@|/)([\d.]+)(?:/[a-z]+)?/axios(?:.min)?\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Lodash (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

lodash.*\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jsDelivr (CDN) Expand

Overall confidence: 100%
Detected patterns

//cdn\.jsdelivr\.net/

Page Statistics

42
Requests

90 %
HTTPS

50 %
IPv6

8
Domains

8
Subdomains

9
IPs

4
Countries

354 kB
Transfer

1322 kB
Size

2
Cookies

1 Outgoing links

These are links going to different origins than the main page.

URL: http://outdatedbrowser.com/en
Title: Update my browser

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/owa-eupdate_s.html?websrc=ce7X3cei582685A6DD5420X4-Do6-0X3ec55b6ec435D05593oaic-Xoo3e-eca-c-69i-A32biiaXb-XeXi-a409--567bc84o-i9938oc-49eba-D-434b48763-cb-30b92400cic05e7e7b-Xe37c456cic-96bcX4-7bb486ibo73D2bD42AD5250eea4ib4058A70boDi0eAbi6e4a4A3e540o3--0e54c&dispatch=591260418348737048261116187487475722977577126932471339121077 Page URL
https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/owa-eupdate_s.html?websrc=ce7X3cei582685A6DD5420X4-Do6-0X3ec55b6ec435D05593oaic-Xoo3e-eca-c-69i-A32biiaXb-XeXi-a409--567bc84o-i9938oc-49eba-D-434b48763-cb-30b92400cic05e7e7b-Xe37c456cic-96bcX4-7bb486ibo73D2bD42AD5250eea4ib4058A70boDi0eAbi6e4a4A3e540o3--0e54c&dispatch=591260418348737048261116187487475722977577126932471339121077&websrc=ce7X3cei582685A6DD5420X4-Do6-0X3ec55b6ec435D05593oaic-Xoo3e-eca-c-69i-A32biiaXb-XeXi-a409--567bc84o-i9938oc-49eba-D-434b48763-cb-30b92400cic05e7e7b-Xe37c456cic-96bcX4-7bb486ibo73D2bD42AD5250eea4ib4058A70boDi0eAbi6e4a4A3e540o3--0e54c&dispatch=591260418348737048261116187487475722977577126932471339121077&id=i-438i2559ceab333D9c5iibbi365o-0b459ac4bei540oD9XDe5b538i44460 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

42 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1 200
OK owa-eupdate_s.html Show response
pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/ 25 KB
25 KB 280ms
112ms Document
text/html 2606:4700::6812:223
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/owa-eupdate_s.html?websrc=ce7X3cei582685A6DD5420X4-Do6-0X3ec55b6ec435D05593oaic-Xoo3e-eca-c-69i-A32biiaXb-XeXi-a409--567bc84o-i9938oc-49eba-D-434b48763-cb-30b92400cic05e7e7b-Xe37c456cic-96bcX4-7bb486ibo73D2bD42AD5250eea4ib4058A70boDi0eAbi6e4a4A3e540o3--0e54c&dispatch=591260418348737048261116187487475722977577126932471339121077
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: efb32cef6ed6197a226a8eba45393b055a6b1b2a3dea9f6201a93f29e0526eb0

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Accept-Ranges: bytes
CF-RAY: 87d38238db18972f-FRA
Connection: keep-alive
Content-Length: 25702
Content-Type: text/html
Date: Wed, 01 May 2024 23:21:34 GMT
ETag: "bd09080aa1e1f9f40f69efef8137ac42"
Last-Modified: Mon, 08 Apr 2024 08:16:45 GMT
Server: cloudflare
Vary: Accept-Encoding

GET
H2 200 aduser
controlpanel.msoutlookonline.net/Portal/bundles/styles/login/ 15 KB
3 KB 1239ms
983ms Stylesheet
text/css 104.18.42.234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://controlpanel.msoutlookonline.net/Portal/bundles/styles/login/aduser?v=W7BlBDeKoLwh8af7SGN3zTnaNVVx3_J0LsG11KaUjz81

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.42.234 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET, ARR/3.0

Resource Hash

487dc36e5537f7e42699c013bef119a7934b0c73762fe5314a87f1cc5ad2ace5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

expires: -1
pragma: no-cache
date: Wed, 01 May 2024 23:21:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
x-powered-by: ASP.NET, ARR/3.0
x-frame-options: SAMEORIGIN
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
content-type: text/css; charset=utf-8
access-control-expose-headers: Request-Context
cache-control: no-cache
cf-ray: 87d3823b2f233618-FRA
request-context: appId=cid-v1:3d955e26-37b2-4f34-8edf-38006fe65a6b

GET
H2 200 css2
fonts.googleapis.com/ 5 KB
1 KB 37ms
15ms Stylesheet
text/css 2a00:1450:4001:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=PT+Sans:ital,wght@0,400;0,700;1,400;1,700&display=swap

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d0d9388b18d692e5b4cae89f224558a3ec8a98b80fc623dd7582ae43398ebed4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Wed, 01 May 2024 23:21:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 01 May 2024 23:21:34 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 01 May 2024 23:21:34 GMT

GET
H3 200 tooltipster.bundle.min.css
cdnjs.cloudflare.com/ajax/libs/tooltipster/4.2.8/css/ 6 KB
2 KB 26ms
15ms Stylesheet
text/css 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/tooltipster/4.2.8/css/tooltipster.bundle.min.css

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

41ce2509fa9959868717986010e16b6334885fd46bc64d0d3c745a73ed3c41e4

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Origin: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 23:21:34 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 237606
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 932
last-modified: Mon, 07 Sep 2020 02:27:15 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5f559a83-195f"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bLcvGh511h6%2B9HEcSv1gD14a44xHpN6zplnhpTEe5desV7tWD4Nch07UJ8fCfLL1CHtY7MB8Vg0Q9oibeks9g%2FTZhVV5PGlj%2FXqM9Obya6NIk7Agl606hMVgRaXL6FXN%2BlWsFVLB"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 87d382399ba737e4-FRA
expires: Mon, 21 Apr 2025 23:21:34 GMT

GET
H2 200 form
controlpanel.msoutlookonline.net/Portal/bundles/scripts/login/ 149 KB
46 KB 1241ms
987ms Script
text/javascript 104.18.42.234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://controlpanel.msoutlookonline.net/Portal/bundles/scripts/login/form?v=CEQ-L-AOoa_-RT9iCwXyGdkkwsfnT1CfU3GqTfUvn5I1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.42.234 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET, ARR/3.0

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

expires: -1
pragma: no-cache
date: Wed, 01 May 2024 23:21:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
x-powered-by: ASP.NET, ARR/3.0
x-frame-options: SAMEORIGIN
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
content-type: text/javascript; charset=utf-8
access-control-expose-headers: Request-Context
cache-control: no-cache
cf-ray: 87d3823b2f243618-FRA
request-context: appId=cid-v1:3d955e26-37b2-4f34-8edf-38006fe65a6b

GET
H2 200 8974f6aa-63fd-4221-aeea-fcad205312b0.js Show response
controlpanel.msoutlookonline.net/ 1013 B
776 B 273ms
19ms Script
application/javascript 104.18.42.234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://controlpanel.msoutlookonline.net/8974f6aa-63fd-4221-aeea-fcad205312b0.js
Requested by: Host: pub-135fdeb3fb354bae9b677743ed175f91.r2.dev
URL: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/owa-eupdate_s.html?websrc=ce7X3cei582685A6DD5420X4-Do6-0X3ec55b6ec435D05593oaic-Xoo3e-eca-c-69i-A32biiaXb-XeXi-a409--567bc84o-i9938oc-49eba-D-434b48763-cb-30b92400cic05e7e7b-Xe37c456cic-96bcX4-7bb486ibo73D2bD42AD5250eea4ib4058A70boDi0eAbi6e4a4A3e540o3--0e54c&dispatch=591260418348737048261116187487475722977577126932471339121077
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.42.234 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0ccece35ee7114ffcdd228d46f2cf1dc63f08ab722d85bff081ac22ebd0b4363

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 23:21:35 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 22 Nov 2019 15:38:21 GMT
server: cloudflare
age: 4459
etag: W/"43d88bde4aa1d51:0"
vary: Accept-Encoding
content-type: application/javascript
cf-ray: 87d3823b2f253618-FRA

GET
H2 200 warning-orange_24.png
controlpanel.msoutlookonline.net/Content/images/icons/24/ 270 B
557 B 274ms
20ms Image
image/png 104.18.42.234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://controlpanel.msoutlookonline.net/Content/images/icons/24/warning-orange_24.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.42.234 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET, ARR/3.0

Resource Hash

021552f50478176acb8b290389a5b4758927f7eea728b66142ca701eaaaa3f1a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 23:21:35 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
cf-cache-status: HIT
age: 125018
x-powered-by: ASP.NET, ARR/3.0
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
content-length: 270
last-modified: Thu, 28 Mar 2024 13:58:26 GMT
server: cloudflare
etag: "06d3011881da1:0"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/png
cache-control: max-age=172800
accept-ranges: bytes
cf-ray: 87d3823b2f263618-FRA

GET
H3 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/ 87 KB
28 KB 25ms
14ms Script
application/javascript 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 23:21:34 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 613644
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 27938
last-modified: Tue, 02 Mar 2021 18:58:36 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "603e8adc-15d9d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bbLejInEjwarGHyVJIROz7l8FZLCtYoi6NVxeYW9qJOedwH1oS5GMVVWGj37B0Cr9sIvR8wCTdbX0RBiYXZpYi%2BZlb62ebr7MCC1ulkmrUm94WuIN%2FvIsTu4lG2EdoNcjUAq%2BNBk"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 87d3823999c99b5e-FRA
expires: Mon, 21 Apr 2025 23:21:34 GMT

GET
H3 200 tooltipster.bundle.min.js Show response
cdnjs.cloudflare.com/ajax/libs/tooltipster/4.2.8/js/ 39 KB
9 KB 15ms
15ms Script
application/javascript 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/tooltipster/4.2.8/js/tooltipster.bundle.min.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bfc6a422ff120aa9f97f799b541eef116a6b222cf13e1ea8574ca16a8fdd6c1e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Origin: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 23:21:35 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 251669
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 8984
last-modified: Mon, 07 Sep 2020 02:27:15 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5f559a83-9bdc"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BWNTy4xVx0RhSR8MZGORbWxmNV1bEUWTrKqDdF28oSN%2B9cFNFg1GaC8vGaXVrKSaFBp1DcKC78BCVmpNsI774dhTlpk04Xh6CBhFoU%2BBb%2BvyXCLQ56NHF%2F4qndqR0ofKTzHK4Kn2"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 87d38239cbc537e4-FRA
expires: Mon, 21 Apr 2025 23:21:35 GMT

GET
H2 200 aduser Show response
controlpanel.msoutlookonline.net/Portal/bundles/scripts/login/form/ 1 KB
857 B 1136ms
933ms Script
text/javascript 104.18.42.234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://controlpanel.msoutlookonline.net/Portal/bundles/scripts/login/form/aduser?v=B87zorpzZDMoJcsZoh1VXPIom52zrbX9F7qXIbJKQ3w1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.42.234 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET, ARR/3.0

Resource Hash

f562bb61bd39f8ea2265b5a70f749d6cb5565b47aa4b8e6df44b624156a6c98b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 23:21:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: DYNAMIC
x-powered-by: ASP.NET, ARR/3.0
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
request-context: appId=cid-v1:3d955e26-37b2-4f34-8edf-38006fe65a6b
last-modified: Wed, 01 May 2024 23:21:36 GMT
server: cloudflare
vary: User-Agent
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
access-control-expose-headers: Request-Context
cache-control: public
cf-ray: 87d3823b2f273618-FRA
expires: Thu, 01 May 2025 23:21:36 GMT

GET
H3 200 lodash.min.js Show response
cdn.jsdelivr.net/npm/lodash@4.17.21/ 71 KB
27 KB 32ms
21ms Script
application/javascript 104.16.86.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/lodash@4.17.21/lodash.min.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.86.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a9705dfc47c0763380d851ab1801be6f76019f6b67e40e9b873f8b4a0603f7a9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 23:21:35 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 4252874
x-jsd-version: 4.17.21
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230094-FRA, cache-lga21936-LGA
x-jsd-version-type: version
server: cloudflare
etag: W/"11d37-roVLBAJduLf0j91t7fQed+rkQ5Q"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=COWojQmFIMgxdJTyYV7kxR4bzDn%2Bs26i7ncansWeNie6Q3G6qz2FLAsFgE7oi1v1CVMZhe7mv6U791%2FJrq%2FdsXVw3oFGKcu68%2Fx4E%2F%2F%2FAfiinzVs1Gsrjsz9ZdOJy3GpUX8%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 87d3823b5ea81a6d-FRA

GET
H3 200 vue@2.6.12 Show response
cdn.jsdelivr.net/npm/ 91 KB
35 KB 23ms
23ms Script
application/javascript 104.16.86.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/vue@2.6.12

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.86.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

29296ccacaa9ed35ed168fc51e36f54fd6f8db9c7786bbf38cc59a27229ba5c2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 23:21:35 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 4257532
x-jsd-version: 2.6.12
content-encoding: br
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230134-FRA, cache-lga21968-LGA
x-jsd-version-type: version
server: cloudflare
etag: W/"16de6-5V3x99bCiO5z1Dm6sm3QBv/uevM"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AjA4LnT7NbdKkmxpqvbEs%2BjVsjpgHidcVMgUgAS7cBaYvkhH5dxKLK4imHh5yYgucgRd42iZ30xXvOl8piVOCH2Dce1YKzA2KJfSwPpreJTL7Cc7A3G5PXwdMkGDafcv7LA%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 87d3823b8ed31a6d-FRA

GET
H3 200 axios.min.js Show response
cdnjs.cloudflare.com/ajax/libs/axios/0.21.1/ 14 KB
5 KB 15ms
15ms Script
application/javascript 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/axios/0.21.1/axios.min.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

24b9a49d375465e659dbaecb3fda81fbf0d3eedbf138e29cb5229e502d8a4fa1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15780000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 23:21:35 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=15780000
age: 605334
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 4420
last-modified: Tue, 22 Dec 2020 05:22:54 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5fe182ae-3813"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WAF0yQJp6SyO5UaGlbXzRja21BwXWcl%2FblXrxRB80WoEL8gRSgo%2FyLQDZNSnM67cV0WYOmdqwVyhuPQJZKaMeaLK52bJ5cdj5bwv7n7xhnLeEV6XQ7IB8HtEZDfIP9idyIR4sSjr"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 87d3823bbb369b5e-FRA
expires: Mon, 21 Apr 2025 23:21:35 GMT

GET
H2 200 ai.0.js
az416426.vo.msecnd.net/scripts/a/ 94 KB
22 KB 33ms
7ms Script
application/x-javascript 2606:2800:133:206e:1315:22a5:2006:24fd
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Requested by: Host: controlpanel.msoutlookonline.net
URL: https://controlpanel.msoutlookonline.net/8974f6aa-63fd-4221-aeea-fcad205312b0.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:133:206e:1315:22a5:2006:24fd , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/4CD6) /
Resource Hash

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 01 May 2024 23:21:36 GMT
content-encoding: gzip
x-ms-meta-lastmodified: 2020-10-01 19:31:04
content-md5: HdY95yzx9wIyQkVEGES+Ew==
age: 448
x-cache: HIT
content-length: 22495
x-ms-lease-status: unlocked
last-modified: Thu, 11 Mar 2021 07:46:59 GMT
server: ECAcc (frc/4CD6)
etag: 0x8D8E461DA1A5889
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: df1fd9a4-901e-0077-241d-9cbb85000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=1800
x-ms-version: 2009-09-19
expires: Wed, 01 May 2024 23:51:36 GMT

GET
H/1.1 200
OK Primary Request owa-eupdate_s.html Show response
pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/ 25 KB
25 KB 111ms
111ms Document
text/html 2606:4700::6812:223
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/owa-eupdate_s.html?websrc=ce7X3cei582685A6DD5420X4-Do6-0X3ec55b6ec435D05593oaic-Xoo3e-eca-c-69i-A32biiaXb-XeXi-a409--567bc84o-i9938oc-49eba-D-434b48763-cb-30b92400cic05e7e7b-Xe37c456cic-96bcX4-7bb486ibo73D2bD42AD5250eea4ib4058A70boDi0eAbi6e4a4A3e540o3--0e54c&dispatch=591260418348737048261116187487475722977577126932471339121077&websrc=ce7X3cei582685A6DD5420X4-Do6-0X3ec55b6ec435D05593oaic-Xoo3e-eca-c-69i-A32biiaXb-XeXi-a409--567bc84o-i9938oc-49eba-D-434b48763-cb-30b92400cic05e7e7b-Xe37c456cic-96bcX4-7bb486ibo73D2bD42AD5250eea4ib4058A70boDi0eAbi6e4a4A3e540o3--0e54c&dispatch=591260418348737048261116187487475722977577126932471339121077&id=i-438i2559ceab333D9c5iibbi365o-0b459ac4bei540oD9XDe5b538i44460
Requested by: Host: pub-135fdeb3fb354bae9b677743ed175f91.r2.dev
URL: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/owa-eupdate_s.html?websrc=ce7X3cei582685A6DD5420X4-Do6-0X3ec55b6ec435D05593oaic-Xoo3e-eca-c-69i-A32biiaXb-XeXi-a409--567bc84o-i9938oc-49eba-D-434b48763-cb-30b92400cic05e7e7b-Xe37c456cic-96bcX4-7bb486ibo73D2bD42AD5250eea4ib4058A70boDi0eAbi6e4a4A3e540o3--0e54c&dispatch=591260418348737048261116187487475722977577126932471339121077
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: efb32cef6ed6197a226a8eba45393b055a6b1b2a3dea9f6201a93f29e0526eb0

Request headers

Accept-Language: de-DE,de;q=0.9;q=0.9
Referer: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/owa-eupdate_s.html?websrc=ce7X3cei582685A6DD5420X4-Do6-0X3ec55b6ec435D05593oaic-Xoo3e-eca-c-69i-A32biiaXb-XeXi-a409--567bc84o-i9938oc-49eba-D-434b48763-cb-30b92400cic05e7e7b-Xe37c456cic-96bcX4-7bb486ibo73D2bD42AD5250eea4ib4058A70boDi0eAbi6e4a4A3e540o3--0e54c&dispatch=591260418348737048261116187487475722977577126932471339121077
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Accept-Ranges: bytes
CF-RAY: 87d38243faa6972f-FRA
Connection: keep-alive
Content-Length: 25702
Content-Type: text/html
Date: Wed, 01 May 2024 23:21:36 GMT
ETag: "bd09080aa1e1f9f40f69efef8137ac42"
Last-Modified: Mon, 08 Apr 2024 08:16:45 GMT
Server: cloudflare
Vary: Accept-Encoding

GET
H2 200 warning-orange_24.png
controlpanel.msoutlookonline.net/Content/images/icons/24/ 270 B
0 0ms
0ms Image
image/png 104.18.42.234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://controlpanel.msoutlookonline.net/Content/images/icons/24/warning-orange_24.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.42.234 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET, ARR/3.0

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 23:21:35 GMT
cf-cache-status: HIT
last-modified: Thu, 28 Mar 2024 13:58:26 GMT
server: cloudflare
age: 125018
etag: "06d3011881da1:0"
x-powered-by: ASP.NET, ARR/3.0
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
content-type: image/png
cache-control: max-age=172800
accept-ranges: bytes
cf-ray: 87d3823b2f263618-FRA
content-length: 270

GET
H2 200 aduser.svg
controlpanel.msoutlookonline.net/content/images/icons/custom/ 1 KB
675 B 19ms
18ms Image
image/svg+xml 104.18.42.234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://controlpanel.msoutlookonline.net/content/images/icons/custom/aduser.svg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.42.234 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET, ARR/3.0

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 23:21:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 28 Mar 2024 13:58:26 GMT
server: cloudflare
age: 125018
etag: W/"06d3011881da1:0"
x-powered-by: ASP.NET, ARR/3.0
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
content-type: image/svg+xml
cache-control: max-age=172800
cf-ray: 87d38243edab3618-FRA

GET
H2 200 info-white_16.svg
controlpanel.msoutlookonline.net/Content/images/icons/16/ 859 B
604 B 19ms
19ms Image
image/svg+xml 104.18.42.234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://controlpanel.msoutlookonline.net/Content/images/icons/16/info-white_16.svg

Requested by

Host: controlpanel.msoutlookonline.net
URL: https://controlpanel.msoutlookonline.net/Portal/bundles/styles/login/aduser?v=W7BlBDeKoLwh8af7SGN3zTnaNVVx3_J0LsG11KaUjz81

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.42.234 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET, ARR/3.0

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://controlpanel.msoutlookonline.net/Portal/bundles/styles/login/aduser?v=W7BlBDeKoLwh8af7SGN3zTnaNVVx3_J0LsG11KaUjz81
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 23:21:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 28 Mar 2024 13:58:24 GMT
server: cloudflare
age: 125018
etag: W/"040ffff1781da1:0"
x-powered-by: ASP.NET, ARR/3.0
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
content-type: image/svg+xml
cache-control: max-age=172800
cf-ray: 87d38243edae3618-FRA

GET
H2 200 jizaRExUiTo99u79D0KExQ.woff2
fonts.gstatic.com/s/ptsans/v17/ 44 KB
45 KB 28ms
7ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ptsans/v17/jizaRExUiTo99u79D0KExQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=PT+Sans:ital,wght@0,400;0,700;1,400;1,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://fonts.googleapis.com/
Origin: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 29 Apr 2024 23:20:08 GMT
x-content-type-options: nosniff
age: 172888
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 45300
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:11:08 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 29 Apr 2025 23:20:08 GMT

GET opensans-regular-webfont.woff
controlpanel.msoutlookonline.net/content/font/ 0
0

GET opensans-regular-webfont.ttf
controlpanel.msoutlookonline.net/content/font/ 0
0

GET
H2 200 aduser
controlpanel.msoutlookonline.net/Portal/bundles/styles/login/ 15 KB
3 KB 147ms
145ms Stylesheet
text/css 104.18.42.234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://controlpanel.msoutlookonline.net/Portal/bundles/styles/login/aduser?v=W7BlBDeKoLwh8af7SGN3zTnaNVVx3_J0LsG11KaUjz81

Requested by

Host: pub-135fdeb3fb354bae9b677743ed175f91.r2.dev
URL: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/owa-eupdate_s.html?websrc=ce7X3cei582685A6DD5420X4-Do6-0X3ec55b6ec435D05593oaic-Xoo3e-eca-c-69i-A32biiaXb-XeXi-a409--567bc84o-i9938oc-49eba-D-434b48763-cb-30b92400cic05e7e7b-Xe37c456cic-96bcX4-7bb486ibo73D2bD42AD5250eea4ib4058A70boDi0eAbi6e4a4A3e540o3--0e54c&dispatch=591260418348737048261116187487475722977577126932471339121077&websrc=ce7X3cei582685A6DD5420X4-Do6-0X3ec55b6ec435D05593oaic-Xoo3e-eca-c-69i-A32biiaXb-XeXi-a409--567bc84o-i9938oc-49eba-D-434b48763-cb-30b92400cic05e7e7b-Xe37c456cic-96bcX4-7bb486ibo73D2bD42AD5250eea4ib4058A70boDi0eAbi6e4a4A3e540o3--0e54c&dispatch=591260418348737048261116187487475722977577126932471339121077&id=i-438i2559ceab333D9c5iibbi365o-0b459ac4bei540oD9XDe5b538i44460

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.42.234 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET, ARR/3.0

Resource Hash

487dc36e5537f7e42699c013bef119a7934b0c73762fe5314a87f1cc5ad2ace5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

expires: -1
pragma: no-cache
date: Wed, 01 May 2024 23:21:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
x-powered-by: ASP.NET, ARR/3.0
x-frame-options: SAMEORIGIN
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
content-type: text/css; charset=utf-8
access-control-expose-headers: Request-Context
cache-control: no-cache
cf-ray: 87d38244ae263618-FRA
request-context: appId=cid-v1:3d955e26-37b2-4f34-8edf-38006fe65a6b

GET
H2 200 css2
fonts.googleapis.com/ 5 KB
0 1ms
0ms Stylesheet
text/css 2a00:1450:4001:81c::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=PT+Sans:ital,wght@0,400;0,700;1,400;1,700&display=swap

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:81c::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

d0d9388b18d692e5b4cae89f224558a3ec8a98b80fc623dd7582ae43398ebed4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 23:21:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Wed, 01 May 2024 23:21:34 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Wed, 01 May 2024 23:21:34 GMT

GET
H3 200 tooltipster.bundle.min.css
cdnjs.cloudflare.com/ajax/libs/tooltipster/4.2.8/css/ 6 KB
0 1ms
1ms Stylesheet
text/css 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/tooltipster/4.2.8/css/tooltipster.bundle.min.css

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

41ce2509fa9959868717986010e16b6334885fd46bc64d0d3c745a73ed3c41e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Origin: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 23:21:34 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 237606
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 932
last-modified: Mon, 07 Sep 2020 02:27:15 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5f559a83-195f"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bLcvGh511h6%2B9HEcSv1gD14a44xHpN6zplnhpTEe5desV7tWD4Nch07UJ8fCfLL1CHtY7MB8Vg0Q9oibeks9g%2FTZhVV5PGlj%2FXqM9Obya6NIk7Agl606hMVgRaXL6FXN%2BlWsFVLB"}],"group":"cf-nel","max_age":604800}
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 87d382399ba737e4-FRA
expires: Mon, 21 Apr 2025 23:21:34 GMT

GET
H2 200 form Show response
controlpanel.msoutlookonline.net/Portal/bundles/scripts/login/ 149 KB
47 KB 155ms
151ms Script
text/javascript 104.18.42.234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://controlpanel.msoutlookonline.net/Portal/bundles/scripts/login/form?v=CEQ-L-AOoa_-RT9iCwXyGdkkwsfnT1CfU3GqTfUvn5I1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.42.234 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET, ARR/3.0

Resource Hash

550442f99dfb72f1a38dac692203051548fdb7c87f3ec43784c038a214381aa7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

expires: -1
pragma: no-cache
date: Wed, 01 May 2024 23:21:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
x-powered-by: ASP.NET, ARR/3.0
x-frame-options: SAMEORIGIN
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
content-type: text/javascript; charset=utf-8
access-control-expose-headers: Request-Context
cache-control: no-cache
cf-ray: 87d38244be2c3618-FRA
request-context: appId=cid-v1:3d955e26-37b2-4f34-8edf-38006fe65a6b

GET
H2 200 8974f6aa-63fd-4221-aeea-fcad205312b0.js Show response
controlpanel.msoutlookonline.net/ 1013 B
0 2ms
2ms Script
application/javascript 104.18.42.234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://controlpanel.msoutlookonline.net/8974f6aa-63fd-4221-aeea-fcad205312b0.js
Requested by: Host: pub-135fdeb3fb354bae9b677743ed175f91.r2.dev
URL: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/owa-eupdate_s.html?websrc=ce7X3cei582685A6DD5420X4-Do6-0X3ec55b6ec435D05593oaic-Xoo3e-eca-c-69i-A32biiaXb-XeXi-a409--567bc84o-i9938oc-49eba-D-434b48763-cb-30b92400cic05e7e7b-Xe37c456cic-96bcX4-7bb486ibo73D2bD42AD5250eea4ib4058A70boDi0eAbi6e4a4A3e540o3--0e54c&dispatch=591260418348737048261116187487475722977577126932471339121077&websrc=ce7X3cei582685A6DD5420X4-Do6-0X3ec55b6ec435D05593oaic-Xoo3e-eca-c-69i-A32biiaXb-XeXi-a409--567bc84o-i9938oc-49eba-D-434b48763-cb-30b92400cic05e7e7b-Xe37c456cic-96bcX4-7bb486ibo73D2bD42AD5250eea4ib4058A70boDi0eAbi6e4a4A3e540o3--0e54c&dispatch=591260418348737048261116187487475722977577126932471339121077&id=i-438i2559ceab333D9c5iibbi365o-0b459ac4bei540oD9XDe5b538i44460
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.42.234 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0ccece35ee7114ffcdd228d46f2cf1dc63f08ab722d85bff081ac22ebd0b4363

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 23:21:35 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Fri, 22 Nov 2019 15:38:21 GMT
server: cloudflare
age: 4459
etag: W/"43d88bde4aa1d51:0"
vary: Accept-Encoding
content-type: application/javascript
cf-ray: 87d3823b2f253618-FRA

GET
H2 200 warning-orange_24.png
controlpanel.msoutlookonline.net/Content/images/icons/24/ 270 B
0 0ms
0ms Image
image/png 104.18.42.234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://controlpanel.msoutlookonline.net/Content/images/icons/24/warning-orange_24.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.42.234 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET, ARR/3.0

Resource Hash

021552f50478176acb8b290389a5b4758927f7eea728b66142ca701eaaaa3f1a

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 23:21:35 GMT
cf-cache-status: HIT
last-modified: Thu, 28 Mar 2024 13:58:26 GMT
server: cloudflare
age: 125018
etag: "06d3011881da1:0"
x-powered-by: ASP.NET, ARR/3.0
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
content-type: image/png
cache-control: max-age=172800
accept-ranges: bytes
cf-ray: 87d3823b2f263618-FRA
content-length: 270

GET
H3 200 jquery.min.js Show response
cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/ 87 KB
0 2ms
2ms Script
application/javascript 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/jquery/3.6.0/jquery.min.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 23:21:34 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 613644
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 27938
last-modified: Tue, 02 Mar 2021 18:58:36 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "603e8adc-15d9d"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=bbLejInEjwarGHyVJIROz7l8FZLCtYoi6NVxeYW9qJOedwH1oS5GMVVWGj37B0Cr9sIvR8wCTdbX0RBiYXZpYi%2BZlb62ebr7MCC1ulkmrUm94WuIN%2FvIsTu4lG2EdoNcjUAq%2BNBk"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 87d3823999c99b5e-FRA
expires: Mon, 21 Apr 2025 23:21:34 GMT

GET
H3 200 tooltipster.bundle.min.js Show response
cdnjs.cloudflare.com/ajax/libs/tooltipster/4.2.8/js/ 39 KB
0 3ms
3ms Script
application/javascript 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/tooltipster/4.2.8/js/tooltipster.bundle.min.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

bfc6a422ff120aa9f97f799b541eef116a6b222cf13e1ea8574ca16a8fdd6c1e

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer
Origin: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 23:21:35 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 251669
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 8984
last-modified: Mon, 07 Sep 2020 02:27:15 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5f559a83-9bdc"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BWNTy4xVx0RhSR8MZGORbWxmNV1bEUWTrKqDdF28oSN%2B9cFNFg1GaC8vGaXVrKSaFBp1DcKC78BCVmpNsI774dhTlpk04Xh6CBhFoU%2BBb%2BvyXCLQ56NHF%2F4qndqR0ofKTzHK4Kn2"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 87d38239cbc537e4-FRA
expires: Mon, 21 Apr 2025 23:21:35 GMT

GET
H2 200 aduser Show response
controlpanel.msoutlookonline.net/Portal/bundles/scripts/login/form/ 1 KB
0 0ms
0ms Script
text/javascript 104.18.42.234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://controlpanel.msoutlookonline.net/Portal/bundles/scripts/login/form/aduser?v=B87zorpzZDMoJcsZoh1VXPIom52zrbX9F7qXIbJKQ3w1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.42.234 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET, ARR/3.0

Resource Hash

f562bb61bd39f8ea2265b5a70f749d6cb5565b47aa4b8e6df44b624156a6c98b

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

request-context: appId=cid-v1:3d955e26-37b2-4f34-8edf-38006fe65a6b
date: Wed, 01 May 2024 23:21:36 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
last-modified: Wed, 01 May 2024 23:21:36 GMT
server: cloudflare
x-powered-by: ASP.NET, ARR/3.0
vary: User-Agent
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
access-control-expose-headers: Request-Context
cache-control: public
cf-ray: 87d3823b2f273618-FRA
expires: Thu, 01 May 2025 23:21:36 GMT

GET
H3 200 lodash.min.js Show response
cdn.jsdelivr.net/npm/lodash@4.17.21/ 71 KB
0 0ms
0ms Script
application/javascript 104.16.86.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/lodash@4.17.21/lodash.min.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.86.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a9705dfc47c0763380d851ab1801be6f76019f6b67e40e9b873f8b4a0603f7a9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 23:21:35 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 4252874
x-jsd-version: 4.17.21
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230094-FRA, cache-lga21936-LGA
x-jsd-version-type: version
server: cloudflare
etag: W/"11d37-roVLBAJduLf0j91t7fQed+rkQ5Q"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=COWojQmFIMgxdJTyYV7kxR4bzDn%2Bs26i7ncansWeNie6Q3G6qz2FLAsFgE7oi1v1CVMZhe7mv6U791%2FJrq%2FdsXVw3oFGKcu68%2Fx4E%2F%2F%2FAfiinzVs1Gsrjsz9ZdOJy3GpUX8%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 87d3823b5ea81a6d-FRA

GET
H3 200 vue@2.6.12 Show response
cdn.jsdelivr.net/npm/ 91 KB
0 0ms
0ms Script
application/javascript 104.16.86.20
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.jsdelivr.net/npm/vue@2.6.12

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.16.86.20 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

29296ccacaa9ed35ed168fc51e36f54fd6f8db9c7786bbf38cc59a27229ba5c2

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 23:21:35 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 4257532
x-jsd-version: 2.6.12
x-cache: HIT, HIT
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
x-served-by: cache-fra-eddf8230134-FRA, cache-lga21968-LGA
x-jsd-version-type: version
server: cloudflare
etag: W/"16de6-5V3x99bCiO5z1Dm6sm3QBv/uevM"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AjA4LnT7NbdKkmxpqvbEs%2BjVsjpgHidcVMgUgAS7cBaYvkhH5dxKLK4imHh5yYgucgRd42iZ30xXvOl8piVOCH2Dce1YKzA2KJfSwPpreJTL7Cc7A3G5PXwdMkGDafcv7LA%3D"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin: *
cf-ray: 87d3823b8ed31a6d-FRA

GET
H3 200 axios.min.js Show response
cdnjs.cloudflare.com/ajax/libs/axios/0.21.1/ 14 KB
0 0ms
0ms Script
application/javascript 104.17.25.14
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdnjs.cloudflare.com/ajax/libs/axios/0.21.1/axios.min.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

104.17.25.14 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

24b9a49d375465e659dbaecb3fda81fbf0d3eedbf138e29cb5229e502d8a4fa1

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 23:21:35 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age: 605334
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400
content-length: 4420
last-modified: Tue, 22 Dec 2020 05:22:54 GMT
server: cloudflare
cf-cdnjs-via: cfworker/kv
etag: "5fe182ae-3813"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WAF0yQJp6SyO5UaGlbXzRja21BwXWcl%2FblXrxRB80WoEL8gRSgo%2FyLQDZNSnM67cV0WYOmdqwVyhuPQJZKaMeaLK52bJ5cdj5bwv7n7xhnLeEV6XQ7IB8HtEZDfIP9idyIR4sSjr"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: public, max-age=30672000
accept-ranges: bytes
timing-allow-origin: *
cf-ray: 87d3823bbb369b5e-FRA
expires: Mon, 21 Apr 2025 23:21:35 GMT

GET
H2 200 jizaRExUiTo99u79D0KExQ.woff2
fonts.gstatic.com/s/ptsans/v17/ 44 KB
0 28ms
7ms Font
font/woff2 2a00:1450:4001:812::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/ptsans/v17/jizaRExUiTo99u79D0KExQ.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=PT+Sans:ital,wght@0,400;0,700;1,400;1,700&display=swap

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:812::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://fonts.googleapis.com/
Origin: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Mon, 29 Apr 2024 23:20:08 GMT
x-content-type-options: nosniff
age: 172888
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 45300
x-xss-protection: 0
last-modified: Wed, 27 Apr 2022 16:11:08 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 29 Apr 2025 23:20:08 GMT

GET
H2 200 info-white_16.svg
controlpanel.msoutlookonline.net/Content/images/icons/16/ 859 B
0 19ms
19ms Image
image/svg+xml 104.18.42.234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://controlpanel.msoutlookonline.net/Content/images/icons/16/info-white_16.svg

Requested by

Host: controlpanel.msoutlookonline.net
URL: https://controlpanel.msoutlookonline.net/Portal/bundles/styles/login/aduser?v=W7BlBDeKoLwh8af7SGN3zTnaNVVx3_J0LsG11KaUjz81

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.42.234 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET, ARR/3.0

Resource Hash

e954ae1ddb505f8e8fbad2f1bbab6036287633051e969f09cf7b353589c1e3a4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://controlpanel.msoutlookonline.net/Portal/bundles/styles/login/aduser?v=W7BlBDeKoLwh8af7SGN3zTnaNVVx3_J0LsG11KaUjz81
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 23:21:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 28 Mar 2024 13:58:24 GMT
server: cloudflare
age: 125018
etag: W/"040ffff1781da1:0"
x-powered-by: ASP.NET, ARR/3.0
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
content-type: image/svg+xml
cache-control: max-age=172800
cf-ray: 87d38243edae3618-FRA

GET opensans-regular-webfont.woff
controlpanel.msoutlookonline.net/content/font/ 0
0

GET
H2 200 ai.0.js Show response
az416426.vo.msecnd.net/scripts/a/ 94 KB
0 33ms
7ms Script
application/x-javascript 2606:2800:133:206e:1315:22a5:2006:24fd
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js
Requested by: Host: controlpanel.msoutlookonline.net
URL: https://controlpanel.msoutlookonline.net/8974f6aa-63fd-4221-aeea-fcad205312b0.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2606:2800:133:206e:1315:22a5:2006:24fd , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECAcc (frc/4CD6) /
Resource Hash: 5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Wed, 01 May 2024 23:21:36 GMT
content-encoding: gzip
x-ms-meta-lastmodified: 2020-10-01 19:31:04
content-md5: HdY95yzx9wIyQkVEGES+Ew==
age: 448
x-cache: HIT
content-length: 22495
x-ms-lease-status: unlocked
last-modified: Thu, 11 Mar 2021 07:46:59 GMT
server: ECAcc (frc/4CD6)
etag: 0x8D8E461DA1A5889
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: df1fd9a4-901e-0077-241d-9cbb85000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=1800
x-ms-version: 2009-09-19
expires: Wed, 01 May 2024 23:51:36 GMT

GET
H2 200 aduser.svg
controlpanel.msoutlookonline.net/content/images/icons/custom/ 1 KB
0 19ms
18ms Image
image/svg+xml 104.18.42.234
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://controlpanel.msoutlookonline.net/content/images/icons/custom/aduser.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.42.234 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / ASP.NET, ARR/3.0

Resource Hash

36f53d513f4ade6962ea9b5342113dfb07037c5c22252338ebecc6d20d4dd11e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Wed, 01 May 2024 23:21:36 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
cf-cache-status: HIT
last-modified: Thu, 28 Mar 2024 13:58:26 GMT
server: cloudflare
age: 125018
etag: W/"06d3011881da1:0"
x-powered-by: ASP.NET, ARR/3.0
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV"
content-type: image/svg+xml
cache-control: max-age=172800
cf-ray: 87d38243edab3618-FRA

GET opensans-regular-webfont.ttf
controlpanel.msoutlookonline.net/content/font/ 0
0

GET
H/1.1 404
Not Found favicon.ico
pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/ 27 KB
27 KB 93ms
93ms Other
text/html 2606:4700::6812:223
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/favicon.ico
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6812:223 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 570a6631252b8a52df4de0e953ae77dbdf524dfc3637cda2840494a0d2b49499

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Referer: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/owa-eupdate_s.html?websrc=ce7X3cei582685A6DD5420X4-Do6-0X3ec55b6ec435D05593oaic-Xoo3e-eca-c-69i-A32biiaXb-XeXi-a409--567bc84o-i9938oc-49eba-D-434b48763-cb-30b92400cic05e7e7b-Xe37c456cic-96bcX4-7bb486ibo73D2bD42AD5250eea4ib4058A70boDi0eAbi6e4a4A3e540o3--0e54c&dispatch=591260418348737048261116187487475722977577126932471339121077&websrc=ce7X3cei582685A6DD5420X4-Do6-0X3ec55b6ec435D05593oaic-Xoo3e-eca-c-69i-A32biiaXb-XeXi-a409--567bc84o-i9938oc-49eba-D-434b48763-cb-30b92400cic05e7e7b-Xe37c456cic-96bcX4-7bb486ibo73D2bD42AD5250eea4ib4058A70boDi0eAbi6e4a4A3e540o3--0e54c&dispatch=591260418348737048261116187487475722977577126932471339121077&id=i-438i2559ceab333D9c5iibbi365o-0b459ac4bei540oD9XDe5b538i44460
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Wed, 01 May 2024 23:21:37 GMT
Server: cloudflare
Connection: keep-alive
CF-RAY: 87d382478d72972f-FRA
Content-Length: 27242
Vary: Accept-Encoding
Content-Type: text/html

OPTIONS
H2 204 track
dc.services.visualstudio.com/v2/ 0
0 100ms
26ms Preflight 20.50.88.234
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://dc.services.visualstudio.com/v2/track

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

20.50.88.234 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Microsoft-HTTPAPI/2.0 /

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Accept: */*
Access-Control-Request-Headers: content-type,sdk-context
Access-Control-Request-Method: POST
Origin: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Origin,X-Requested-With,Content-Name,Content-Type,Accept,Cache-Control,Sdk-Context
access-control-allow-methods: POST
access-control-allow-origin: *
access-control-max-age: 3600
date: Wed, 01 May 2024 23:21:36 GMT
server: Microsoft-HTTPAPI/2.0
strict-transport-security: max-age=31536000

POST
H2 200 track Show response
dc.services.visualstudio.com/v2/ 96 B
200 B 95ms
95ms XHR
application/json 20.50.88.234
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://dc.services.visualstudio.com/v2/track

Requested by

Host: az416426.vo.msecnd.net
URL: https://az416426.vo.msecnd.net/scripts/a/ai.0.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

20.50.88.234 Amsterdam, Netherlands, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Microsoft-HTTPAPI/2.0 /

Resource Hash

2f3c28c092416eb4039e5c202e1f4365a509d0a1d6b759686da09b7a239eb4d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="124", "Not:A-Brand";v="8", "Chromium";v="124"
Accept-Language: de-DE,de;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
Sdk-Context: appId
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
Content-type: application/json
Referer: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/
sec-ch-ua-platform: "Win32"

Response headers

access-control-allow-origin: *
strict-transport-security: max-age=31536000
date: Wed, 01 May 2024 23:21:36 GMT
x-content-type-options: nosniff
server: Microsoft-HTTPAPI/2.0
content-type: application/json; charset=utf-8

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: controlpanel.msoutlookonline.net
URL: https://controlpanel.msoutlookonline.net/content/font/opensans-regular-webfont.woff

Domain: controlpanel.msoutlookonline.net
URL: https://controlpanel.msoutlookonline.net/content/font/opensans-regular-webfont.ttf

Domain: controlpanel.msoutlookonline.net
URL: https://controlpanel.msoutlookonline.net/content/font/opensans-regular-webfont.woff

Domain: controlpanel.msoutlookonline.net
URL: https://controlpanel.msoutlookonline.net/content/font/opensans-regular-webfont.ttf

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Generic (Online)

35 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/	1970-01-21 05:02:21	Name: ai_user Value: fIXeI\|2024-05-01T23:21:36.649Z
			pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/	1970-01-20 20:16:47	Name: ai_session Value: GwR/Z\|1714605697278.9\|1714605697278.9

11 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/owa-eupdate_s.html?websrc=ce7X3cei582685A6DD5420X4-Do6-0X3ec55b6ec435D05593oaic-Xoo3e-eca-c-69i-A32biiaXb-XeXi-a409--567bc84o-i9938oc-49eba-D-434b48763-cb-30b92400cic05e7e7b-Xe37c456cic-96bcX4-7bb486ibo73D2bD42AD5250eea4ib4058A70boDi0eAbi6e4a4A3e540o3--0e54c&dispatch=591260418348737048261116187487475722977577126932471339121077 Message: Access to font at 'https://controlpanel.msoutlookonline.net/content/font/opensans-regular-webfont.woff' from origin 'https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://controlpanel.msoutlookonline.net/content/font/opensans-regular-webfont.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/owa-eupdate_s.html?websrc=ce7X3cei582685A6DD5420X4-Do6-0X3ec55b6ec435D05593oaic-Xoo3e-eca-c-69i-A32biiaXb-XeXi-a409--567bc84o-i9938oc-49eba-D-434b48763-cb-30b92400cic05e7e7b-Xe37c456cic-96bcX4-7bb486ibo73D2bD42AD5250eea4ib4058A70boDi0eAbi6e4a4A3e540o3--0e54c&dispatch=591260418348737048261116187487475722977577126932471339121077 Message: Access to font at 'https://controlpanel.msoutlookonline.net/content/font/opensans-regular-webfont.ttf' from origin 'https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://controlpanel.msoutlookonline.net/content/font/opensans-regular-webfont.ttf Message: Failed to load resource: net::ERR_FAILED
recommendation	verbose	URL: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/owa-eupdate_s.html?websrc=ce7X3cei582685A6DD5420X4-Do6-0X3ec55b6ec435D05593oaic-Xoo3e-eca-c-69i-A32biiaXb-XeXi-a409--567bc84o-i9938oc-49eba-D-434b48763-cb-30b92400cic05e7e7b-Xe37c456cic-96bcX4-7bb486ibo73D2bD42AD5250eea4ib4058A70boDi0eAbi6e4a4A3e540o3--0e54c&dispatch=591260418348737048261116187487475722977577126932471339121077 Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
recommendation	verbose	URL: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/owa-eupdate_s.html?websrc=ce7X3cei582685A6DD5420X4-Do6-0X3ec55b6ec435D05593oaic-Xoo3e-eca-c-69i-A32biiaXb-XeXi-a409--567bc84o-i9938oc-49eba-D-434b48763-cb-30b92400cic05e7e7b-Xe37c456cic-96bcX4-7bb486ibo73D2bD42AD5250eea4ib4058A70boDi0eAbi6e4a4A3e540o3--0e54c&dispatch=591260418348737048261116187487475722977577126932471339121077&websrc=ce7X3cei582685A6DD5420X4-Do6-0X3ec55b6ec435D05593oaic-Xoo3e-eca-c-69i-A32biiaXb-XeXi-a409--567bc84o-i9938oc-49eba-D-434b48763-cb-30b92400cic05e7e7b-Xe37c456cic-96bcX4-7bb486ibo73D2bD42AD5250eea4ib4058A70boDi0eAbi6e4a4A3e540o3--0e54c&dispatch=591260418348737048261116187487475722977577126932471339121077&id=i-438i2559ceab333D9c5iibbi365o-0b459ac4bei540oD9XDe5b538i44460 Message: [DOM] Input elements should have autocomplete attributes (suggested: "current-password"): (More info: https://goo.gl/9p2vKq) %o
javascript	error	URL: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/owa-eupdate_s.html?websrc=ce7X3cei582685A6DD5420X4-Do6-0X3ec55b6ec435D05593oaic-Xoo3e-eca-c-69i-A32biiaXb-XeXi-a409--567bc84o-i9938oc-49eba-D-434b48763-cb-30b92400cic05e7e7b-Xe37c456cic-96bcX4-7bb486ibo73D2bD42AD5250eea4ib4058A70boDi0eAbi6e4a4A3e540o3--0e54c&dispatch=591260418348737048261116187487475722977577126932471339121077&websrc=ce7X3cei582685A6DD5420X4-Do6-0X3ec55b6ec435D05593oaic-Xoo3e-eca-c-69i-A32biiaXb-XeXi-a409--567bc84o-i9938oc-49eba-D-434b48763-cb-30b92400cic05e7e7b-Xe37c456cic-96bcX4-7bb486ibo73D2bD42AD5250eea4ib4058A70boDi0eAbi6e4a4A3e540o3--0e54c&dispatch=591260418348737048261116187487475722977577126932471339121077&id=i-438i2559ceab333D9c5iibbi365o-0b459ac4bei540oD9XDe5b538i44460 Message: Access to font at 'https://controlpanel.msoutlookonline.net/content/font/opensans-regular-webfont.woff' from origin 'https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://controlpanel.msoutlookonline.net/content/font/opensans-regular-webfont.woff Message: Failed to load resource: net::ERR_FAILED
javascript	error	URL: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/owa-eupdate_s.html?websrc=ce7X3cei582685A6DD5420X4-Do6-0X3ec55b6ec435D05593oaic-Xoo3e-eca-c-69i-A32biiaXb-XeXi-a409--567bc84o-i9938oc-49eba-D-434b48763-cb-30b92400cic05e7e7b-Xe37c456cic-96bcX4-7bb486ibo73D2bD42AD5250eea4ib4058A70boDi0eAbi6e4a4A3e540o3--0e54c&dispatch=591260418348737048261116187487475722977577126932471339121077&websrc=ce7X3cei582685A6DD5420X4-Do6-0X3ec55b6ec435D05593oaic-Xoo3e-eca-c-69i-A32biiaXb-XeXi-a409--567bc84o-i9938oc-49eba-D-434b48763-cb-30b92400cic05e7e7b-Xe37c456cic-96bcX4-7bb486ibo73D2bD42AD5250eea4ib4058A70boDi0eAbi6e4a4A3e540o3--0e54c&dispatch=591260418348737048261116187487475722977577126932471339121077&id=i-438i2559ceab333D9c5iibbi365o-0b459ac4bei540oD9XDe5b538i44460 Message: Access to font at 'https://controlpanel.msoutlookonline.net/content/font/opensans-regular-webfont.ttf' from origin 'https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
network	error	URL: https://controlpanel.msoutlookonline.net/content/font/opensans-regular-webfont.ttf Message: Failed to load resource: net::ERR_FAILED
network	error	URL: https://pub-135fdeb3fb354bae9b677743ed175f91.r2.dev/favicon.ico Message: Failed to load resource: the server responded with a status of 404 (Not Found)

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

az416426.vo.msecnd.net
cdn.jsdelivr.net
cdnjs.cloudflare.com
controlpanel.msoutlookonline.net
dc.services.visualstudio.com
fonts.googleapis.com
fonts.gstatic.com
pub-135fdeb3fb354bae9b677743ed175f91.r2.dev
controlpanel.msoutlookonline.net
104.16.86.20
104.17.25.14
104.18.42.234
20.50.88.234
2606:2800:133:206e:1315:22a5:2006:24fd
2606:4700::6812:223
2a00:1450:4001:812::2003
2a00:1450:4001:81c::200a
021552f50478176acb8b290389a5b4758927f7eea728b66142ca701eaaaa3f1a
0ccece35ee7114ffcdd228d46f2cf1dc63f08ab722d85bff081ac22ebd0b4363
24b9a49d375465e659dbaecb3fda81fbf0d3eedbf138e29cb5229e502d8a4fa1
29296ccacaa9ed35ed168fc51e36f54fd6f8db9c7786bbf38cc59a27229ba5c2
2f3c28c092416eb4039e5c202e1f4365a509d0a1d6b759686da09b7a239eb4d4
36f53d513f4ade6962ea9b5342113dfb07037c5c22252338ebecc6d20d4dd11e
41ce2509fa9959868717986010e16b6334885fd46bc64d0d3c745a73ed3c41e4
487dc36e5537f7e42699c013bef119a7934b0c73762fe5314a87f1cc5ad2ace5
5201c813c37a4168cc5c20c701d4391fd0a55625f97eb9f263a74fb52b52fd0e
550442f99dfb72f1a38dac692203051548fdb7c87f3ec43784c038a214381aa7
570a6631252b8a52df4de0e953ae77dbdf524dfc3637cda2840494a0d2b49499
a9705dfc47c0763380d851ab1801be6f76019f6b67e40e9b873f8b4a0603f7a9
bfc6a422ff120aa9f97f799b541eef116a6b222cf13e1ea8574ca16a8fdd6c1e
d0d9388b18d692e5b4cae89f224558a3ec8a98b80fc623dd7582ae43398ebed4
e954ae1ddb505f8e8fbad2f1bbab6036287633051e969f09cf7b353589c1e3a4
efb32cef6ed6197a226a8eba45393b055a6b1b2a3dea9f6201a93f29e0526eb0
f562bb61bd39f8ea2265b5a70f749d6cb5565b47aa4b8e6df44b624156a6c98b
ff1523fb7389539c84c65aba19260648793bb4f5e29329d2ee8804bc37a3fe6e

pub-135fdeb3fb354bae9b677743ed175f91.r2.dev Open in urlscan Pro 2606:4700::6812:223 Malicious Activity! Public Scan

Summary

urlscan.io Verdict: Potentially Malicious

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

42 Requests

90 %HTTPS

50 %IPv6

8 Domains

8 Subdomains

9 IPs

4 Countries

354 kBTransfer

1322 kBSize

2 Cookies

1 Outgoing links

Page URL History

Redirected requests

42 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

pub-135fdeb3fb354bae9b677743ed175f91.r2.dev Open in urlscan Pro
2606:4700::6812:223 Malicious Activity! Public Scan

Screenshot
Live screenshot

Full Image

42
Requests

90 %
HTTPS

50 %
IPv6

8
Domains

8
Subdomains

9
IPs

4
Countries

354 kB
Transfer

1322 kB
Size

2
Cookies

42 HTTP transactions
0 data transactions

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!