docs.microsoft.com
Open in
urlscan Pro
104.111.246.93
Public Scan
Effective URL: https://docs.microsoft.com/en-us/defender-for-identity/reconnaissance-alerts
Submission: On October 17 via api from US — Scanned from DE
Summary
TLS certificate: Issued by Microsoft RSA TLS CA 01 on July 26th 2021. Valid for: a year.
This is the only time docs.microsoft.com was scanned on urlscan.io!
urlscan.io Verdict: No classification
Domain & IP information
IP Address | AS Autonomous System | ||
---|---|---|---|
1 1 | 2.19.113.71 2.19.113.71 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
3 14 | 104.111.246.93 104.111.246.93 | 16625 (AKAMAI-AS) (AKAMAI-AS) | |
2 | 13.107.213.60 13.107.213.60 | 8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
5 5 | 140.82.113.3 140.82.113.3 | 36459 (GITHUB) (GITHUB) | |
5 | 185.199.109.133 185.199.109.133 | 54113 (FASTLY) (FASTLY) | |
4 | 20.44.10.122 20.44.10.122 | 8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK) | |
22 | 5 |
ASN16625 (AKAMAI-AS, US)
PTR: a2-19-113-71.deploy.static.akamaitechnologies.com
aka.ms |
ASN16625 (AKAMAI-AS, US)
PTR: a104-111-246-93.deploy.static.akamaitechnologies.com
docs.microsoft.com |
ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
wcpstatic.microsoft.com | |
js.monitor.azure.com |
ASN54113 (FASTLY, US)
PTR: cdn-185-199-109-133.github.com
avatars.githubusercontent.com |
ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)
browser.events.data.microsoft.com |
Apex Domain Subdomains |
Transfer | |
---|---|---|
19 |
microsoft.com
3 redirects
docs.microsoft.com wcpstatic.microsoft.com browser.events.data.microsoft.com |
780 KB |
5 |
githubusercontent.com
avatars.githubusercontent.com |
7 KB |
5 |
github.com
5 redirects
github.com |
12 KB |
1 |
azure.com
js.monitor.azure.com |
54 KB |
1 |
aka.ms
1 redirects
aka.ms |
554 B |
22 | 5 |
Domain | Requested by | |
---|---|---|
14 | docs.microsoft.com |
3 redirects
docs.microsoft.com
|
5 | avatars.githubusercontent.com |
docs.microsoft.com
|
5 | github.com | 5 redirects |
4 | browser.events.data.microsoft.com |
js.monitor.azure.com
|
1 | js.monitor.azure.com |
docs.microsoft.com
|
1 | wcpstatic.microsoft.com |
docs.microsoft.com
|
1 | aka.ms | 1 redirects |
22 | 7 |
This site contains links to these domains. Also see Links.
Domain |
---|
go.microsoft.com |
myignite.microsoft.com |
www.microsoft.com |
github.com |
twitter.com |
www.linkedin.com |
www.facebook.com |
attack.mitre.org |
aka.ms |
privacy.microsoft.com |
Subject Issuer | Validity | Valid | |
---|---|---|---|
docs.microsoft.com Microsoft RSA TLS CA 01 |
2021-07-26 - 2022-07-26 |
a year | crt.sh |
wcpstatic.microsoft.com DigiCert TLS RSA SHA256 2020 CA1 |
2021-06-12 - 2022-06-12 |
a year | crt.sh |
js.monitor.azure.com Microsoft Azure TLS Issuing CA 01 |
2021-09-28 - 2022-09-23 |
a year | crt.sh |
www.github.com DigiCert SHA2 High Assurance Server CA |
2020-05-06 - 2022-04-14 |
2 years | crt.sh |
*.events.data.microsoft.com Microsoft Azure TLS Issuing CA 05 |
2021-09-23 - 2022-09-18 |
a year | crt.sh |
This page contains 1 frames:
Primary Page:
https://docs.microsoft.com/en-us/defender-for-identity/reconnaissance-alerts
Frame ID: 6A540E1152B931AE65169E936F3C33B1
Requests: 21 HTTP requests in this frame
Screenshot
Page Title
Microsoft Defender for Identity reconnaissance phase security alerts | Microsoft DocsPage URL History Show full URLs
-
https://aka.ms/atasaguide-recdns
HTTP 301
https://docs.microsoft.com/en-us/azure-advanced-threat-protection/atp-reconnaissance-alerts HTTP 301
https://docs.microsoft.com/en-us/defender-for-identity/atp-reconnaissance-alerts HTTP 301
https://docs.microsoft.com/en-us/defender-for-identity/reconnaissance-alerts Page URL
Page Statistics
29 Outgoing links
These are links going to different origins than the main page.
Title: Privacy Statement
Search URL Search Domain Scan URL
Title: Register now
Search URL Search Domain Scan URL
Title: Download Microsoft Edge
Search URL Search Domain Scan URL
Search URL Search Domain Scan URL
Title: Edit
Search URL Search Domain Scan URL
Title: Twitter
Search URL Search Domain Scan URL
Title: LinkedIn
Search URL Search Domain Scan URL
Title: Facebook
Search URL Search Domain Scan URL
Title: d
Search URL Search Domain Scan URL
Title: r
Search URL Search Domain Scan URL
Title: s
Search URL Search Domain Scan URL
Title: D
Search URL Search Domain Scan URL
Title: m
Search URL Search Domain Scan URL
Title: Discovery (TA0007)
Search URL Search Domain Scan URL
Title: Account Discovery (T1087)
Search URL Search Domain Scan URL
Title: Domain Account (T1087.002)
Search URL Search Domain Scan URL
Title: Indirect Command Execution (T1202)
Search URL Search Domain Scan URL
Title: Permission Groups Discovery (T1069)
Search URL Search Domain Scan URL
Title: Domain Groups (T1069.002)
Search URL Search Domain Scan URL
Title: Discovery (TA0007)
Search URL Search Domain Scan URL
Title: Network Service Scanning (T1046)
Search URL Search Domain Scan URL
Title: Remote System Discovery (T1018)
Search URL Search Domain Scan URL
Title: Credential Access (TA0006)
Search URL Search Domain Scan URL
Title: System Network Connections Discovery (T1049)
Search URL Search Domain Scan URL
Title: Check out the Defender for Identity forum!
Search URL Search Domain Scan URL
Title: Privacy policy.
Search URL Search Domain Scan URL
Title: This page
Search URL Search Domain Scan URL
Title: View all page feedback
Search URL Search Domain Scan URL
Title: Trademarks
Search URL Search Domain Scan URL
Page URL History
This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.
-
https://aka.ms/atasaguide-recdns
HTTP 301
https://docs.microsoft.com/en-us/azure-advanced-threat-protection/atp-reconnaissance-alerts HTTP 301
https://docs.microsoft.com/en-us/defender-for-identity/atp-reconnaissance-alerts HTTP 301
https://docs.microsoft.com/en-us/defender-for-identity/reconnaissance-alerts Page URL
Redirected requests
There were HTTP redirect chains for the following requests:
Request Chain 5- https://github.com/dcurwin.png?size=32 HTTP 302
- https://avatars.githubusercontent.com/u/45630879?s=32&v=4
- https://github.com/rubinatorz.png?size=32 HTTP 302
- https://avatars.githubusercontent.com/u/11735227?s=32&v=4
- https://github.com/shsagir.png?size=32 HTTP 302
- https://avatars.githubusercontent.com/u/51323195?s=32&v=4
- https://github.com/DCtheGeek.png?size=32 HTTP 302
- https://avatars.githubusercontent.com/u/11442954?s=32&v=4
- https://github.com/msmbaldwin.png?size=32 HTTP 302
- https://avatars.githubusercontent.com/u/5092332?s=32&v=4
- https://docs.microsoft.com/en-us/azure-advanced-threat-protection/bread/toc.json HTTP 301
- https://docs.microsoft.com/en-us/defender-for-identity/bread/toc.json
22 HTTP transactions
Method Protocol |
Resource Path |
Size x-fer |
Type MIME-Type |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
GET H2 |
Primary Request
reconnaissance-alerts
docs.microsoft.com/en-us/defender-for-identity/ Redirect Chain
|
68 KB 20 KB |
Document
text/html |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
52d9344d.site-ltr.css
docs.microsoft.com/_themes/docs.theme/master/en-us/_themes/styles/ |
470 KB 68 KB |
Stylesheet
text/css |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
wcp-consent.js
wcpstatic.microsoft.com/mscc/lib/v2/ |
249 KB 74 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ms.jsll-3.min.js
js.monitor.azure.com/scripts/c/ |
175 KB 54 KB |
Script
text/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
5cce29c0.deprecation.js
docs.microsoft.com/_themes/docs.theme/master/en-us/_themes/global/ |
1 KB 1 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
397a9a14.index-docs.js
docs.microsoft.com/_themes/docs.theme/master/en-us/_themes/scripts/ |
1 MB 357 KB |
Script
application/javascript |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
45630879
avatars.githubusercontent.com/u/ Redirect Chain
|
2 KB 2 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
11735227
avatars.githubusercontent.com/u/ Redirect Chain
|
1 KB 1 KB |
Image
image/png |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
51323195
avatars.githubusercontent.com/u/ Redirect Chain
|
995 B 1 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
11442954
avatars.githubusercontent.com/u/ Redirect Chain
|
1009 B 2 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
5092332
avatars.githubusercontent.com/u/ Redirect Chain
|
883 B 1 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
toc.json
docs.microsoft.com/en-us/defender-for-identity/ |
8 KB 3 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
toc.json
docs.microsoft.com/en-us/defender-for-identity/bread/ Redirect Chain
|
883 B 1 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
Redirect headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET DATA |
truncated
/ |
193 B 0 |
Image
image/svg+xml |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
docons.2e4974ff.woff2
docs.microsoft.com/_themes/docs.theme/master/en-us/_themes/styles/ |
12 KB 13 KB |
Font
application/font-woff2 |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
/
docs.microsoft.com/api/recommendations/52af70b6-86d4-5dd4-0c17-d4e0a5f6e0ed/ |
3 KB 1 KB |
Fetch
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
SegoeUI-Roman-VF_web.woff2
docs.microsoft.com/static/third-party/SegoeUIWeb/1.01.206/ |
116 KB 116 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
latest.woff2
docs.microsoft.com/static/third-party/SegoeUI/5.32/west-european/italic/ |
27 KB 28 KB |
Font
application/octet-stream |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
GET H2 |
ignite-2021-09-optimized.jpg
docs.microsoft.com/en-us/media/event-banners/ |
94 KB 95 KB |
Image
image/jpeg |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
/
browser.events.data.microsoft.com/OneCollector/1.0/ |
153 B 962 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H/1.1 |
/
browser.events.data.microsoft.com/OneCollector/1.0/ |
0 0 |
Preflight
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
OPTIONS H/1.1 |
/
browser.events.data.microsoft.com/OneCollector/1.0/ |
0 0 |
Preflight
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
|||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
POST H/1.1 |
/
browser.events.data.microsoft.com/OneCollector/1.0/ |
153 B 499 B |
XHR
application/json |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
General
Request headers
Response headers
|
Verdicts & Comments Add Verdict or Comment
13 JavaScript Global Variables
These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.
object| onbeforexrselect boolean| originAgentCluster object| msDocs function| WcpConsent function| mscc object| e function| t object| oneDS object| awa function| applyFocusVisiblePolyfill object| litHtmlVersions function| LocalTimeElement function| setTheme8 Cookies
Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.
Domain/Path | Expires | Name / Value |
---|---|---|
docs.microsoft.com/en-us/azure-advanced-threat-protection/bread | Name: original_req_url Value: https://docs.microsoft.com/en-us/azure-advanced-threat-protection/bread/toc.json |
|
.docs.microsoft.com/ | Name: ARRAffinity Value: 45caec5f8b8589139a5811d2f50b167cb1387a209cefe483cc42e670050fbec3 |
|
.docs.microsoft.com/ | Name: ARRAffinitySameSite Value: 45caec5f8b8589139a5811d2f50b167cb1387a209cefe483cc42e670050fbec3 |
|
docs.microsoft.com/ | Name: MicrosoftApplicationsTelemetryDeviceId Value: 6cb692eb-9c62-43fa-b20e-27d9ae943616 |
|
docs.microsoft.com/ | Name: ai_session Value: Xti6btmbXOE3jge2Z+RAYT|1634458454330|1634458454330 |
|
.microsoft.com/ | Name: MC1 Value: GUID=5ffe4c449be54f998f43da4d1704979e&HASH=5ffe&LV=202110&V=4&LU=1634458456504 |
|
.microsoft.com/ | Name: MS0 Value: bca85bff9a8c49ae865edce7e4b95913 |
|
docs.microsoft.com/ | Name: MSFPC Value: GUID=5ffe4c449be54f998f43da4d1704979e&HASH=5ffe&LV=202110&V=4&LU=1634458456504 |
Security Headers
This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page
Header | Value |
---|---|
Strict-Transport-Security | max-age=31536000; includeSubDomains; preload |
X-Content-Type-Options | nosniff |
X-Frame-Options | SAMEORIGIN |
X-Xss-Protection | 1; mode=block |
Indicators
This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.
aka.ms
avatars.githubusercontent.com
browser.events.data.microsoft.com
docs.microsoft.com
github.com
js.monitor.azure.com
wcpstatic.microsoft.com
104.111.246.93
13.107.213.60
140.82.113.3
185.199.109.133
2.19.113.71
20.44.10.122
08d116ae621d0f55cabfabc11cca5f70a2b2b07b9139c93e3ffb5f756c04ad55
097eb9cb063464384794fc13f494a77e5d67fa44591202005f1a835ae874f0bd
0f876ac9aa72877c8b1aa79e27fb767ce0943b6243364ce6e575975aeb36b227
19d065ad4470800df127ab06d2fe32dd9570c099dcfd4664ac9de9b66ce68703
208edbed32b2adac9446df83caa4a093a261492ba6b8b3bcfe6a75efb8b70294
2fb59b19860d20c40569c44f5cca62c7d101017ac2509997ed0c6f96ced1164c
3ceddaf5a1ed02614ec6b4edd5881a3ffb7ec08116154dff8eb9897230bf5e59
4335841bc99ee98945af4e33a9d03177816afab2ba3405380ec2f72bec8fc7e5
63c12051016796d92bcf4bc20b4881057475e6dfa4937c29c9e16054814ab47d
776a878eb60a86e119730139355478408897ae285d142617eb42bf2771c3109e
7a05a878ebad7153b928d6a0e9f5b5e78fb356ffbe6c2f311adf46452ec5a7ea
7e81fa5cd9249b6a9e9573af62441db39aa896b7730095450ee6c547b6b6f0dd
8aa1dc6925eae0e2fe988565c5d516e9c434de842e00651af76f0cf669f887f1
93b2764045f8fa328bf684d4066ae2327d0baa53c13e21f0e696d970aad4af13
9e22171ee92d512b0cbc341a91a7a3d3de8695a02217bd3d63f7c04096440a94
a5728e90fb0299119d2132d124d5b7b61d77d357c19d939384789381306497f3
b3724bb570b85fcabe6dc497f945cd6eff6c77fea4083e776d1e17b8acd858f1
c5d8beca6892f6ee9e890b43ec41186ec0b5c8a50d7108175320ecd4017580e0
d8b310346be355b8344f3e5bf4cdb209644792c0b9ab06c2cde3020f0d97c3a7
e172a02b68f977a57a1690507df809db1e43130f0161961709a36dbd70b4d25f
f85efee13933ddbe0bd574deef1e660afb7efe6227f9f23103defa22f7f457bb