onedrive.live.com Open in urlscan Pro
13.107.42.13 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
http://karmajewelryshop.com/2client/2client/client/finish2.php
Effective URL:
https://onedrive.live.com/embed?cid=E650E3B710AD4626&resid=E650E3B710AD4626%21466&authkey=AHgbg3lhtxjkHis&em=2
Submission Tags: @ipnigh
Submission: On April 18 via api (April 18th 2020, 1:50:21 am UTC) from GB

Summary HTTP 53 Redirects Behaviour Indicators

Summary

This website contacted 11 IPs in 4 countries across 8 domains to perform 53 HTTP transactions. The main IP is 13.107.42.13, located in United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is onedrive.live.com.
TLS certificate: Issued by Microsoft IT TLS CA 2 on June 25th 2019. Valid for: 2 years.

This is the only time onedrive.live.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	188.166.85.78 188.166.85.78	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
3	13.107.42.13 13.107.42.13	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
8	23.53.41.227 23.53.41.227	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
21	2620:1ec:a92:... 2620:1ec:a92::171	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2a02:26f0:310... 2a02:26f0:3100:28c::356e	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
8	2a02:26f0:310... 2a02:26f0:3100:2a2::1c24	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
6	2a02:26f0:310... 2a02:26f0:3100:2b4::1c24	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a02:26f0:310... 2a02:26f0:3100:286::2b57	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 2	52.142.114.2 52.142.114.2	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 1	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	104.109.78.246 104.109.78.246	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	52.114.77.33 52.114.77.33	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
53	11

1 188.166.85.78 (Amsterdam, Netherlands) 1 redirects

ASN14061 (DIGITALOCEAN-ASN, US)
PTR: centos-s-2vcpu-4gb-ams3-01.vps

karmajewelryshop.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 13.107.42.13 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

onedrive.live.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 23.53.41.227 (United States)

ASN20940 (AKAMAI-ASN1, EU)
PTR: a23-53-41-227.deploy.static.akamaitechnologies.com

spoprod-a.akamaihd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

21 2620:1ec:a92::171 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

word-view.officeapps.live.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:3100:28c::356e (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

c.s-microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a02:26f0:3100:2a2::1c24 (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

c1-word-view-15.cdn.office.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a02:26f0:3100:2b4::1c24 (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

c1-officeapps-15.cdn.office.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3100:286::2b57 (Ascension Island)

ASN20940 (AKAMAI-ASN1, EU)

uhf.microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.142.114.2 (Dublin, Ireland) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

c.live.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:c11::200 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

c.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.109.78.246 (Netherlands)

ASN20940 (AKAMAI-ASN1, EU)
PTR: a104-109-78-246.deploy.static.akamaitechnologies.com

js.live.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.114.77.33 (Dublin, Ireland)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

browser.pipe.aria.microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
26	live.com 1 redirects onedrive.live.com word-view.officeapps.live.com c.live.com	697 KB
14	office.net c1-word-view-15.cdn.office.net c1-officeapps-15.cdn.office.net	552 KB
8	akamaihd.net spoprod-a.akamaihd.net	395 KB
3	microsoft.com uhf.microsoft.com browser.pipe.aria.microsoft.com	856 B
2	s-microsoft.com c.s-microsoft.com	3 KB
1	live.net js.live.net	16 KB
1	bing.com 1 redirects c.bing.com	748 B
1	karmajewelryshop.com 1 redirects karmajewelryshop.com	324 B
53	8

	Domain	Requested by
21	word-view.officeapps.live.com	onedrive.live.com word-view.officeapps.live.com c1-word-view-15.cdn.office.net c1-officeapps-15.cdn.office.net
8	c1-word-view-15.cdn.office.net	word-view.officeapps.live.com c1-word-view-15.cdn.office.net
8	spoprod-a.akamaihd.net	onedrive.live.com
6	c1-officeapps-15.cdn.office.net	word-view.officeapps.live.com c1-word-view-15.cdn.office.net
3	onedrive.live.com	onedrive.live.com
2	browser.pipe.aria.microsoft.com	c1-word-view-15.cdn.office.net
2	c.live.com	1 redirects
2	c.s-microsoft.com	word-view.officeapps.live.com
1	js.live.net	c1-word-view-15.cdn.office.net
1	c.bing.com	1 redirects
1	uhf.microsoft.com	word-view.officeapps.live.com
1	karmajewelryshop.com	1 redirects
53	12

This site contains no links.

Subject Issuer	Validity	Valid
onedrive.com Microsoft IT TLS CA 2	`2019-06-25` - `2021-06-25`	2 years	crt.sh
a248.e.akamai.net DigiCert Secure Site ECC CA-1	`2019-08-13` - `2020-08-12`	a year	crt.sh
officeapps.live.com Microsoft IT TLS CA 1	`2020-02-18` - `2022-02-18`	2 years	crt.sh
www.microsoft.com Microsoft IT TLS CA 5	`2019-10-21` - `2021-10-21`	2 years	crt.sh
*.cdn.office.net Microsoft IT TLS CA 1	`2019-10-31` - `2021-10-31`	2 years	crt.sh
unistore.www.microsoft.com Microsoft IT TLS CA 5	`2019-04-30` - `2021-04-30`	2 years	crt.sh
c.msn.com Microsoft IT TLS CA 4	`2020-02-10` - `2022-02-10`	2 years	crt.sh
p.sfx.ms Microsoft IT TLS CA 2	`2020-02-04` - `2022-02-04`	2 years	crt.sh
*.events.data.microsoft.com Microsoft IT TLS CA 4	`2019-10-10` - `2021-10-10`	2 years	crt.sh

This page contains 2 frames:

Primary Page: https://onedrive.live.com/embed?cid=E650E3B710AD4626&resid=E650E3B710AD4626%21466&authkey=AHgbg3lhtxjkHis&em=2
Frame ID: 2EE14957233B8278FDF84E813D4789EE
Requests: 13 HTTP requests in this frame

Frame: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=eRkC83TueUq1y7N/IlgqPA.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FE650E3B710AD4626%21466&sc=host%3D%26qt%3DFolders%26pt%3Dem
Frame ID: DB5422B174680ED978A92B01F60F4EBD
Requests: 43 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

http://karmajewelryshop.com/2client/2client/client/finish2.php HTTP 302
https://onedrive.live.com/embed?cid=E650E3B710AD4626&resid=E650E3B710AD4626%21466&authkey=AHgbg3lhtxjk... Page URL

Detected technologies

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

url /\.php(?:$|\?)/i

Page Statistics

53
Requests

100 %
HTTPS

50 %
IPv6

8
Domains

12
Subdomains

11
IPs

4
Countries

1698 kB
Transfer

4477 kB
Size

7
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

http://karmajewelryshop.com/2client/2client/client/finish2.php HTTP 302
https://onedrive.live.com/embed?cid=E650E3B710AD4626&resid=E650E3B710AD4626%21466&authkey=AHgbg3lhtxjkHis&em=2 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 33

https://c.live.com/c.gif?DI=15347&wlxid=ecdcf0af-b336-45bd-b2bf-c9646956a358&reqid=001b74d1c55&csiperf=ANON%3D%26NL%3D0%26TP%3D0%26CL%3DRD0003FFA56CC8%26MA%3Den-US%26B%3D0.0.0%26TR%3DNA%252ANA%252A%253ASDX.Skydrive%252AEmbed.default.F.U.%26PLT%3D3466%26IR%3D1%26EX%3D0%26L.h%3D2344%26L.sjs%3D2461%26L.ttg%3D2344%26C.st%3D1587174587854%26N.domIn%3D2351%26N.dns%3D30%26N.tcp%3D46%26N.req%3D1767%26N.resp%3D13%26N.navType%3D0%26N.redirectCount%3D0&r=0.6188996435386229 HTTP 302
https://c.bing.com/c.gif?DI=15347&wlxid=ecdcf0af-b336-45bd-b2bf-c9646956a358&reqid=001b74d1c55&csiperf=ANON%3D%26NL%3D0%26TP%3D0%26CL%3DRD0003FFA56CC8%26MA%3Den-US%26B%3D0.0.0%26TR%3DNA%252ANA%252A%253ASDX.Skydrive%252AEmbed.default.F.U.%26PLT%3D3466%26IR%3D1%26EX%3D0%26L.h%3D2344%26L.sjs%3D2461%26L.ttg%3D2344%26C.st%3D1587174587854%26N.domIn%3D2351%26N.dns%3D30%26N.tcp%3D46%26N.req%3D1767%26N.resp%3D13%26N.navType%3D0%26N.redirectCount%3D0&r=0.6188996435386229&CtsSyncId=E29BD1C0BEF743898BCE336FB960022A&RedC=c.live.com&MXFR=31DE2F9D355E6FEA0E4D212D315E6BB5 HTTP 302
https://c.live.com/c.gif?DI=15347&wlxid=ecdcf0af-b336-45bd-b2bf-c9646956a358&reqid=001b74d1c55&csiperf=ANON%3D%26NL%3D0%26TP%3D0%26CL%3DRD0003FFA56CC8%26MA%3Den-US%26B%3D0.0.0%26TR%3DNA%252ANA%252A%253ASDX.Skydrive%252AEmbed.default.F.U.%26PLT%3D3466%26IR%3D1%26EX%3D0%26L.h%3D2344%26L.sjs%3D2461%26L.ttg%3D2344%26C.st%3D1587174587854%26N.domIn%3D2351%26N.dns%3D30%26N.tcp%3D46%26N.req%3D1767%26N.resp%3D13%26N.navType%3D0%26N.redirectCount%3D0&r=0.6188996435386229&CtsSyncId=E29BD1C0BEF743898BCE336FB960022A&MUID=23CE0116BC5D6F6003EB0FA6BD2C6E06

53 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request embed Show response
onedrive.live.com/
Redirect Chain

http://karmajewelryshop.com/2client/2client/client/finish2.php
https://onedrive.live.com/embed?cid=E650E3B710AD4626&resid=E650E3B710AD4626%21466&authkey=AHgbg3lhtxjkHis&em=2

60 KB
21 KB

1831ms
1754ms

Document
text/html

13.107.42.13
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://onedrive.live.com/embed?cid=E650E3B710AD4626&resid=E650E3B710AD4626%21466&authkey=AHgbg3lhtxjkHis&em=2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

13.107.42.13 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

51d8fa6fbf875179427eb377c379cce25f6854cffc9d1a7584add5442e0c84ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

:method: GET
:authority: onedrive.live.com
:scheme: https
:path: /embed?cid=E650E3B710AD4626&resid=E650E3B710AD4626%21466&authkey=AHgbg3lhtxjkHis&em=2
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

status: 200
cache-control: no-cache, no-store
pragma: no-cache
content-type: text/html; charset=utf-8
content-encoding: gzip
expires: -1
vary: Accept-Encoding
set-cookie: E=P:L1kQxzrj14g=:wJyzVX8wsTdWfbkxsw98sGKDsNUv+jb0Cb/WThdeqpw=:F; domain=.live.com; path=/ xid=ecdcf0af-b336-45bd-b2bf-c9646956a358&&RD0003FFA56CC8&146; domain=.live.com; path=/ xidseq=1; domain=.live.com; path=/ LD=; domain=.live.com; expires=Sat, 18-Apr-2020 00:09:48 GMT; path=/ wla42=; domain=live.com; expires=Sat, 25-Apr-2020 01:49:49 GMT; path=/
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
x-msnserver: RD0003FFA56CC8
x-odwebserver: centralus0-odwebpl
x-msedge-ref: Ref A: E7CA3F04C508469D8CB4469F94D1729A Ref B: BRU30EDGE0318 Ref C: 2020-04-18T01:49:48Z
date: Sat, 18 Apr 2020 01:49:49 GMT

Redirect headers

Server: nginx/1.16.1
Date: Sat, 18 Apr 2020 01:49:48 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 0
Connection: keep-alive
X-Powered-By: PHP/5.4.16
Location: https://onedrive.live.com/embed?cid=E650E3B710AD4626&resid=E650E3B710AD4626%21466&authkey=AHgbg3lhtxjkHis&em=2

GET
H2 200 filescss1-11eb1969.css
spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001// 85 KB
16 KB 96ms
25ms Stylesheet
text/css 23.53.41.227
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001//filescss1-11eb1969.css
Requested by: Host: onedrive.live.com
URL: https://onedrive.live.com/embed?cid=E650E3B710AD4626&resid=E650E3B710AD4626%21466&authkey=AHgbg3lhtxjkHis&em=2
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 23.53.41.227 , United States, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a23-53-41-227.deploy.static.akamaitechnologies.com
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: bd88d1e741693ab877b020059b46be7cf4ef62b46017b2489a8cd1bf9ce5b9fc

Request headers

Referer: https://onedrive.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 18 Apr 2020 01:49:50 GMT
content-encoding: gzip
content-md5: EesZadmsnx78d9ZWIKfswQ==
status: 200
content-length: 15784
x-ms-lease-status: unlocked
last-modified: Mon, 14 May 2018 21:53:56 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D5B9E5314EB9E3
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 171581a0-301e-00dc-72a7-011523000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=29154635
x-ms-version: 2009-09-19
timing-allow-origin: *

GET
H2 200 filescss2-a303a402.css
spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001// 169 KB
30 KB 109ms
38ms Stylesheet
text/css 23.53.41.227
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001//filescss2-a303a402.css
Requested by: Host: onedrive.live.com
URL: https://onedrive.live.com/embed?cid=E650E3B710AD4626&resid=E650E3B710AD4626%21466&authkey=AHgbg3lhtxjkHis&em=2
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 23.53.41.227 , United States, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a23-53-41-227.deploy.static.akamaitechnologies.com
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 1394b1c43663fa167060186091800d4cae0696af7b64c14f2848b44124074c7e

Request headers

Referer: https://onedrive.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 18 Apr 2020 01:49:50 GMT
content-encoding: gzip
content-md5: owOkAskXvYo3Ps40fhU7TQ==
status: 200
content-length: 30548
x-ms-lease-status: unlocked
last-modified: Mon, 14 May 2018 21:54:02 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D5B9E534F1A182
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 26307166-601e-001b-5ea7-01c821000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=29154635
x-ms-version: 2009-09-19
timing-allow-origin: *

GET
H2 200 wlx_fonts-c7993ded.css
spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001// 123 KB
93 KB 116ms
45ms Stylesheet
text/css 23.53.41.227
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001//wlx_fonts-c7993ded.css
Requested by: Host: onedrive.live.com
URL: https://onedrive.live.com/embed?cid=E650E3B710AD4626&resid=E650E3B710AD4626%21466&authkey=AHgbg3lhtxjkHis&em=2
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 23.53.41.227 , United States, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a23-53-41-227.deploy.static.akamaitechnologies.com
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 455be57e5ca76be462428c7b127d03d0245952b7e00ca14e8bcb3bfe7584c758

Request headers

Referer: https://onedrive.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 18 Apr 2020 01:49:50 GMT
content-encoding: gzip
content-md5: x5k97ZNOTA+fsPCUPRp4Qw==
status: 200
content-length: 94644
x-ms-lease-status: unlocked
last-modified: Mon, 14 May 2018 21:53:59 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D5B9E532B000AF
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 069eceef-801e-0046-76b5-0199e6000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=29160545
x-ms-version: 2009-09-19
timing-allow-origin: *

POST
H2 200 wordviewerframe.aspx Show response
word-view.officeapps.live.com/wv/ Frame DB54 93 KB
95 KB 207ms
168ms Document
text/html 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=eRkC83TueUq1y7N/IlgqPA.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FE650E3B710AD4626%21466&sc=host%3D%26qt%3DFolders%26pt%3Dem

Requested by

Host: onedrive.live.com
URL: https://onedrive.live.com/embed?cid=E650E3B710AD4626&resid=E650E3B710AD4626%21466&authkey=AHgbg3lhtxjkHis&em=2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

62ff7ac7015d241ebef7f16c97f538d6890760dbdb623dd4630a9ad76e72c070

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

:method: POST
:authority: word-view.officeapps.live.com
:scheme: https
:path: /wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=eRkC83TueUq1y7N/IlgqPA.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FE650E3B710AD4626%21466&sc=host%3D%26qt%3DFolders%26pt%3Dem
content-length: 231
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
origin: https://onedrive.live.com
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://onedrive.live.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: E=P:L1kQxzrj14g=:wJyzVX8wsTdWfbkxsw98sGKDsNUv+jb0Cb/WThdeqpw=:F; xid=ecdcf0af-b336-45bd-b2bf-c9646956a358&&RD0003FFA56CC8&146; xidseq=1; wla42=
Upgrade-Insecure-Requests: 1
Origin: https://onedrive.live.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://onedrive.live.com/

Response headers

status: 200
cache-control: no-cache, no-store
pragma: no-cache
content-type: text/html; charset=utf-8
expires: -1
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
set-cookie: DcLcid=ui=1033&data=1033; expires=Sat, 18-Jul-2020 01:49:50 GMT; path=/; samesite=none; secure; HttpOnly BIGipCookie=000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000; path=/; samesite=none; secure
x-correlationid: 68e24270-6e61-4ea5-931f-949db34b24d0
x-usersessionid: 68e24270-6e61-4ea5-931f-949db34b24d0
strict-transport-security: max-age=31536000
timing-allow-origin: *
origin-trial: ApjnZzULQW2j+i9/++Pj2WfVVByLoS5iZEVBPKULeFRNzLpMlHgeKsGOK4+MyK1AqsSdMI92vD2CSaa45EOWMQgAAAB7eyJvcmlnaW4iOiJodHRwczovL29mZmljZWFwcHMubGl2ZS5jb206NDQzIiwiZmVhdHVyZSI6IkFsbG93U3luY1hIUkluUGFnZURpc21pc3NhbCIsImV4cGlyeSI6MTU5MzM1NjU4NCwiaXNTdWJkb21haW4iOnRydWV9,AktAaQJK0LkEoh/qQ/vTovjHNk8hAtrepa1AYDtpeGHBdcRht7H0g/YI9EWFOpnXX5F0bdV0tM/mEAdFpD3jUgsAAAB2eyJvcmlnaW4iOiJodHRwczovL29mZmljZWFwcHMubGl2ZS5jb206NDQzIiwiZmVhdHVyZSI6IkV4cGVyaW1lbnRhbEpTUHJvZmlsZXIiLCJleHBpcnkiOjE1ODM4ODQ3OTksImlzU3ViZG9tYWluIjp0cnVlfQ==
x-ccr: true
x-officefe: BL2PEPF0000294A
x-officeversion: 16.0.12815.33700
x-officecluster: US4
x-content-type-options: nosniff
content-security-policy-report-only: font-src data: c1-word-view-15.cdn.office.net *.skype.com *.skypeassets.com *.msocdn.com sway.com *.sway-cdn.com sway-cdn.com *.sharepointonline.com https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' c1-word-view-15.cdn.office.net uci.officeapps.live.com c1-officeapps-15.cdn.office.net *.skype.com *.skypeassets.com *.msocdn.com js.live.net appsforoffice.microsoft.com contentstorage.osi.office.net content.lifecycle.office.net www.microsoft.com c.s-microsoft.com https:; style-src 'self' 'unsafe-inline' 'unsafe-eval' c1-word-view-15.cdn.office.net c1-officeapps-15.cdn.office.net *.skype.com *.skypeassets.com *.msocdn.com js.live.net sway.com *.sway-cdn.com sway-cdn.com c.s-microsoft.com https:; media-src *.skype.com *.skypeassets.com https:; object-src 'self' https:; child-src * https:; img-src * data: blob: https:; report-uri /wv/reportcsp.ashx
x-officefd: BL2PEPF0000117E
x-msedge-ref: Ref A: C4DFCA4212584DFAA5665E8BC9FB18D7 Ref B: AM3EDGE0913 Ref C: 2020-04-18T01:49:50Z
x-msedge-flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115cf,1fxu=afd_waccluster
x-msedge-features: tasmigration015,typeheadertest,multitenanttasmigration_115cf,afd_waccluster
date: Sat, 18 Apr 2020 01:49:49 GMT

GET
H2 200 jquery-1.7.2-39eeb07e.js Show response
spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001/ 92 KB
33 KB 26ms
26ms Script
application/javascript 23.53.41.227
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001/jquery-1.7.2-39eeb07e.js
Requested by: Host: onedrive.live.com
URL: https://onedrive.live.com/embed?cid=E650E3B710AD4626&resid=E650E3B710AD4626%21466&authkey=AHgbg3lhtxjkHis&em=2
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 23.53.41.227 , United States, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a23-53-41-227.deploy.static.akamaitechnologies.com
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: d6c15974b6181a68e9b74e4f38fbac81d640569ef0fbbaa3381cc59683a9763f

Request headers

Referer: https://onedrive.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 18 Apr 2020 01:49:50 GMT
content-encoding: gzip
content-md5: Oe6wfmgC4rV/XhCprZvKJA==
status: 200
content-length: 33335
x-ms-lease-status: unlocked
last-modified: Mon, 14 May 2018 21:54:03 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D5B9E5358D6B64
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: d68f8427-301e-0161-16a7-01e439000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=29154644
x-ms-version: 2009-09-19
timing-allow-origin: *

GET
H2 200 embed_s_embed-212fe29f.js Show response
spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001/ 483 KB
133 KB 28ms
27ms Script
application/javascript 23.53.41.227
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001/embed_s_embed-212fe29f.js
Requested by: Host: onedrive.live.com
URL: https://onedrive.live.com/embed?cid=E650E3B710AD4626&resid=E650E3B710AD4626%21466&authkey=AHgbg3lhtxjkHis&em=2
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 23.53.41.227 , United States, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a23-53-41-227.deploy.static.akamaitechnologies.com
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 5c15c38a2b7554cab332dfb9e87398220fcb9a285e18905a20a50b439cba7ccb

Request headers

Referer: https://onedrive.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 18 Apr 2020 01:49:50 GMT
content-encoding: gzip
content-md5: IS/in/g30QB+g7MVI79lXQ==
status: 200
content-length: 135707
x-ms-lease-status: unlocked
last-modified: Mon, 14 May 2018 21:53:57 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D5B9E531CF2A88
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 26307d23-601e-001b-74a7-01c821000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=29154644
x-ms-version: 2009-09-19
timing-allow-origin: *

GET
H2 200 embed1-0986a9b4.js Show response
spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001/ 47 KB
14 KB 26ms
25ms Script
application/javascript 23.53.41.227
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001/embed1-0986a9b4.js
Requested by: Host: onedrive.live.com
URL: https://onedrive.live.com/embed?cid=E650E3B710AD4626&resid=E650E3B710AD4626%21466&authkey=AHgbg3lhtxjkHis&em=2
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 23.53.41.227 , United States, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a23-53-41-227.deploy.static.akamaitechnologies.com
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: b7ab99f404e84cb71d274c9dca01c0b4a68b7adb20309c5f04387cb809cc0547

Request headers

Referer: https://onedrive.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 18 Apr 2020 01:49:50 GMT
content-encoding: gzip
content-md5: CYaptDz18cVXSIKt0vWKWA==
status: 200
content-length: 14119
x-ms-lease-status: unlocked
last-modified: Mon, 14 May 2018 21:53:54 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D5B9E530269299
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: f5bfdb54-901e-00bc-25b2-015001000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=29159109
x-ms-version: 2009-09-19
timing-allow-origin: *

GET
H2 200 embed2-8c600200.js Show response
spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001/ 203 KB
68 KB 27ms
26ms Script
application/javascript 23.53.41.227
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001/embed2-8c600200.js
Requested by: Host: onedrive.live.com
URL: https://onedrive.live.com/embed?cid=E650E3B710AD4626&resid=E650E3B710AD4626%21466&authkey=AHgbg3lhtxjkHis&em=2
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 23.53.41.227 , United States, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a23-53-41-227.deploy.static.akamaitechnologies.com
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 4d54a5f9a58647882e3ecda9c1c0ef87af16911d42ad51b4e8b718f84443c553

Request headers

Referer: https://onedrive.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 18 Apr 2020 01:49:50 GMT
content-encoding: gzip
content-md5: jGACACXYYkvx7qKc5FskXg==
status: 200
content-length: 69276
x-ms-lease-status: unlocked
last-modified: Mon, 14 May 2018 21:53:57 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D5B9E531AF1786
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 00cee1a0-301e-002a-06b2-0193f6000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=29159109
x-ms-version: 2009-09-19
timing-allow-origin: *

GET
H2 200 embed0-54f3ec81.js Show response
spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001/ 15 KB
6 KB 26ms
26ms Script
application/javascript 23.53.41.227
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001/embed0-54f3ec81.js
Requested by: Host: onedrive.live.com
URL: https://onedrive.live.com/embed?cid=E650E3B710AD4626&resid=E650E3B710AD4626%21466&authkey=AHgbg3lhtxjkHis&em=2
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 23.53.41.227 , United States, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a23-53-41-227.deploy.static.akamaitechnologies.com
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: c0153afba2ee2258329d951763cc14531c98cdecfc22d55be2597cfad0cc6e54

Request headers

Referer: https://onedrive.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Sat, 18 Apr 2020 01:49:50 GMT
content-encoding: gzip
content-md5: VPPsgWGZk5RDzVgXZtU7Yg==
status: 200
content-length: 6057
x-ms-lease-status: unlocked
last-modified: Mon, 14 May 2018 21:53:57 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D5B9E53171D885
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: f91cfeb9-701e-0144-65b2-017c8a000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=29159109
x-ms-version: 2009-09-19
timing-allow-origin: *

GET
H2 200 mscc-0.4.2.min.css
c.s-microsoft.com/mscc/statics/ Frame DB54 1 KB
934 B 33ms
7ms Stylesheet
text/css 2a02:26f0:3100:28c::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.s-microsoft.com/mscc/statics/mscc-0.4.2.min.css
Requested by: Host: word-view.officeapps.live.com
URL: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=eRkC83TueUq1y7N/IlgqPA.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FE650E3B710AD4626%21466&sc=host%3D%26qt%3DFolders%26pt%3Dem
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:3100:28c::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: 66c5d9882a954332c4aebef2386c7713a226fa617ddcd08d22f24e53ba5ec066

Request headers

Referer: https://word-view.officeapps.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
date: Sat, 18 Apr 2020 01:49:50 GMT
content-encoding: gzip
last-modified: Fri, 10 Jan 2020 15:56:23 GMT
content-md5: QLyM0qNPDXd6ayzd1iIoLA==
status: 200
etag: 0x8D795E5A424E059
vary: Accept-Encoding
access-control-allow-methods: GET,POST
content-type: text/css;charset=utf-8
access-control-allow-origin: *
x-ms-request-id: c43cdb5c-301e-00bf-44fd-c707ee000000
x-ms-version: 2009-09-19
content-length: 626

GET
H/1.1 200
OK WordViewer.css
c1-word-view-15.cdn.office.net/wv/s/161281533700_resources/1033/ Frame DB54 217 KB
27 KB 34ms
8ms Stylesheet
text/css 2a02:26f0:3100:2a2::1c24
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://c1-word-view-15.cdn.office.net/wv/s/161281533700_resources/1033/WordViewer.css

Requested by

Host: word-view.officeapps.live.com
URL: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=eRkC83TueUq1y7N/IlgqPA.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FE650E3B710AD4626%21466&sc=host%3D%26qt%3DFolders%26pt%3Dem

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3100:2a2::1c24 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Resource Hash

ef23713f2cb8d1e0dfa5cd6d391f31f715f9c2d91e0894efb571b4053bc3c8e3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://word-view.officeapps.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000
Content-Encoding: br
ETag: W/"d844f73a7813d61:0"
X-OfficeCluster: US6
X-OfficeVersion: 16.0.12813.32650
X-OfficeFE: BL6PEPF00002CEE
P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
Connection: keep-alive
X-MSEdge-Flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115,1fxu=afd_waccluster
Content-Length: 26381
Cache-Control: public,max-age=31536000
X-MSEdge-Features: tasmigration015,typeheadertest,multitenanttasmigration_115,afd_waccluster
Last-Modified: Wed, 15 Apr 2020 22:50:16 GMT
X-OFFICEFD: BL6PEPF00000756
X-MSEdge-Ref: Ref A: 5AAA4BD082C448A3A170ED217BE867F0 Ref B: AMS04EDGE0719 Ref C: 2020-04-15T22:50:15Z
X-UserSessionId: dc36659d-0afd-4756-bf6c-2509bb0df2c4
Date: Sat, 18 Apr 2020 01:49:50 GMT
Content-Type: text/css
Access-Control-Allow-Origin: *
X-CorrelationId: dc36659d-0afd-4756-bf6c-2509bb0df2c4
Accept-Ranges: bytes
Timing-Allow-Origin: *

GET
H/1.1 200
OK MicrosoftAjax.js Show response
c1-officeapps-15.cdn.office.net/wv/s/161281533700_App_Scripts/ Frame DB54 105 KB
24 KB 46ms
7ms Script
application/javascript 2a02:26f0:3100:2b4::1c24
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://c1-officeapps-15.cdn.office.net/wv/s/161281533700_App_Scripts/MicrosoftAjax.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3100:2b4::1c24 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Resource Hash

85115acdc1b70c4a47daa1da31011b67bde417cbb718c5b3c73a914b82781bfd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://word-view.officeapps.live.com/
Origin: https://word-view.officeapps.live.com

Response headers

Strict-Transport-Security: max-age=31536000
Content-Encoding: br
ETag: W/"61b2f3b7813d61:0"
X-OfficeCluster: US6
X-OfficeVersion: 16.0.12813.32650
X-OfficeFE: BL6PEPF00003B87
P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
Connection: keep-alive
X-MSEdge-Flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115cf,1fxu=afd_waccluster
Content-Length: 23506
Cache-Control: public,max-age=31536000
X-MSEdge-Features: tasmigration015,typeheadertest,multitenanttasmigration_115cf,afd_waccluster
Last-Modified: Wed, 15 Apr 2020 22:50:16 GMT
X-OFFICEFD: BL6PEPF00000764
X-MSEdge-Ref: Ref A: ADB6250310154BBAA87EC1AE600C0E2D Ref B: AM3EDGE0811 Ref C: 2020-04-15T22:50:15Z
X-UserSessionId: 1a4e1a07-7066-4af1-849e-4d4da04e33c5
Date: Sat, 18 Apr 2020 01:49:50 GMT
Content-Type: application/javascript
Access-Control-Allow-Origin: *
X-CorrelationId: 1a4e1a07-7066-4af1-849e-4d4da04e33c5
Accept-Ranges: bytes
Timing-Allow-Origin: *

GET
H2 200 mscc-0.4.2.min.js Show response
c.s-microsoft.com/mscc/statics/ Frame DB54 4 KB
2 KB 31ms
7ms Script
text/javascript 2a02:26f0:3100:28c::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.s-microsoft.com/mscc/statics/mscc-0.4.2.min.js
Requested by: Host: word-view.officeapps.live.com
URL: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=eRkC83TueUq1y7N/IlgqPA.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FE650E3B710AD4626%21466&sc=host%3D%26qt%3DFolders%26pt%3Dem
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:3100:28c::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: a188e6c4c6729c3abbe6a34e45b5c3d7d65ffc659e1baa46632ffb1c876e815c

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://word-view.officeapps.live.com/
Origin: https://word-view.officeapps.live.com

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
date: Sat, 18 Apr 2020 01:49:50 GMT
content-encoding: gzip
last-modified: Fri, 10 Jan 2020 15:56:14 GMT
content-md5: AO6kLOW8s6NiicKEPl74tA==
status: 200
etag: 0x8D795E59EC908A0
vary: Accept-Encoding
access-control-allow-methods: GET,POST
content-type: text/javascript;charset=utf-8
access-control-allow-origin: *
x-ms-request-id: 12ac3cb7-b01e-000f-19fd-c7fe6e000000
x-ms-version: 2009-09-19
content-length: 2017

GET
H/1.1 200
OK cookiecompliance.js Show response
c1-officeapps-15.cdn.office.net/wv/s/161281533700_App_Scripts/ Frame DB54 9 KB
3 KB 46ms
7ms Script
application/javascript 2a02:26f0:3100:2b4::1c24
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://c1-officeapps-15.cdn.office.net/wv/s/161281533700_App_Scripts/cookiecompliance.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3100:2b4::1c24 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Resource Hash

910f1f3ce687cfde1a12415fe73a4465e7a2f851177c33ca8e9f3b5c5f93c41c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://word-view.officeapps.live.com/
Origin: https://word-view.officeapps.live.com

Response headers

Strict-Transport-Security: max-age=31536000
Content-Encoding: gzip
ETag: W/"80b578c8213d61:0"
X-OfficeCluster: US6
X-CCR: true
X-OfficeVersion: 16.0.12813.32650
X-OfficeFE: BL6PEPF00002CF9
P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
Connection: keep-alive
X-MSEdge-Flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115,1fxu=afd_waccluster
Content-Length: 1945
Cache-Control: public,max-age=31536000
X-MSEdge-Features: tasmigration015,typeheadertest,multitenanttasmigration_115,afd_waccluster
Last-Modified: Thu, 16 Apr 2020 00:04:07 GMT
X-OFFICEFD: BL6PEPF000028B2
X-MSEdge-Ref: Ref A: D271D68D406E445DAF6AB8F4DD1BF029 Ref B: AM3EDGE0217 Ref C: 2020-04-16T00:04:07Z
X-UserSessionId: 349aa64e-dc06-4255-af73-fb05ee4c64b5
Date: Sat, 18 Apr 2020 01:49:50 GMT
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
X-CorrelationId: 349aa64e-dc06-4255-af73-fb05ee4c64b5
Accept-Ranges: bytes
Timing-Allow-Origin: *

GET
H/1.1 200
OK CommonIntl.js Show response
c1-officeapps-15.cdn.office.net/wv/s/161281533700_App_Scripts/1033/ Frame DB54 77 KB
20 KB 46ms
8ms Script
application/javascript 2a02:26f0:3100:2b4::1c24
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://c1-officeapps-15.cdn.office.net/wv/s/161281533700_App_Scripts/1033/CommonIntl.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3100:2b4::1c24 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Resource Hash

1a6f0c3f4072b078f9c7ce2f4aea48958592da9b0bdb3cf1890301440e34c823

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://word-view.officeapps.live.com/
Origin: https://word-view.officeapps.live.com

Response headers

Strict-Transport-Security: max-age=31536000
Content-Encoding: br
ETag: W/"59c73b7813d61:0"
X-OfficeCluster: US6
X-OfficeVersion: 16.0.12813.32650
X-OfficeFE: BL6PEPF00002D87
P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
Connection: keep-alive
X-MSEdge-Flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115cf,1fxu=afd_waccluster
Content-Length: 19103
Cache-Control: public,max-age=31536000
X-MSEdge-Features: tasmigration015,typeheadertest,multitenanttasmigration_115cf,afd_waccluster
Last-Modified: Wed, 15 Apr 2020 22:50:16 GMT
X-OFFICEFD: BL6PEPF00002BC5
X-MSEdge-Ref: Ref A: A065EBF36549452EBFD5CDF1B7E34C76 Ref B: AM3EDGE0115 Ref C: 2020-04-15T22:50:15Z
X-UserSessionId: dfc0679e-9f10-48b0-a85a-4671f3e01427
Date: Sat, 18 Apr 2020 01:49:50 GMT
Content-Type: application/javascript
Access-Control-Allow-Origin: *
X-CorrelationId: dfc0679e-9f10-48b0-a85a-4671f3e01427
Accept-Ranges: bytes
Timing-Allow-Origin: *

GET
H/1.1 200
OK Compat.js Show response
c1-word-view-15.cdn.office.net/wv/s/161281533700_App_Scripts/ Frame DB54 6 KB
2 KB 31ms
8ms Script
application/javascript 2a02:26f0:3100:2a2::1c24
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://c1-word-view-15.cdn.office.net/wv/s/161281533700_App_Scripts/Compat.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3100:2a2::1c24 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Resource Hash

06fe78141d1f3a435441a17ec8f9f46af7000af35aa0133c699c537d663607d0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://word-view.officeapps.live.com/
Origin: https://word-view.officeapps.live.com

Response headers

Strict-Transport-Security: max-age=31536000
Content-Encoding: br
ETag: W/"5454f93a7813d61:0"
X-OfficeCluster: US4
X-OfficeVersion: 16.0.12813.32650
X-OfficeFE: BL2PEPF00001B78
P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
Connection: keep-alive
X-MSEdge-Flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115cf,1fxu=afd_waccluster,1g3n=afd_wacinfra1_control
Content-Length: 1365
Cache-Control: public,max-age=31536000
X-MSEdge-Features: tasmigration015,typeheadertest,multitenanttasmigration_115cf,afd_waccluster,afd_wacinfra1_control
Last-Modified: Wed, 15 Apr 2020 22:50:16 GMT
X-OFFICEFD: BL2PEPF0000313F
X-MSEdge-Ref: Ref A: EF7E4AA91A60405E9F07CCE54B7A25B0 Ref B: AMS04EDGE0408 Ref C: 2020-04-15T22:50:15Z
X-UserSessionId: ab99d6b0-e292-4f0f-a386-5349e3f6c9ee
Date: Sat, 18 Apr 2020 01:49:50 GMT
Content-Type: application/javascript
Access-Control-Allow-Origin: *
X-CorrelationId: ab99d6b0-e292-4f0f-a386-5349e3f6c9ee
Accept-Ranges: bytes
Timing-Allow-Origin: *

GET
H/1.1 200
OK WordViewerIntl.js Show response
c1-word-view-15.cdn.office.net/wv/s/161281533700_App_Scripts/1033/ Frame DB54 19 KB
5 KB 32ms
8ms Script
application/javascript 2a02:26f0:3100:2a2::1c24
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://c1-word-view-15.cdn.office.net/wv/s/161281533700_App_Scripts/1033/WordViewerIntl.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3100:2a2::1c24 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Resource Hash

c40c45a6858cff9069d12c50dcd44522b8d5e1f7464fbdb216b3246b5aa8c027

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://word-view.officeapps.live.com/
Origin: https://word-view.officeapps.live.com

Response headers

Strict-Transport-Security: max-age=31536000
Content-Encoding: gzip
ETag: W/"80732b857f13d61:0"
X-OfficeCluster: US6
X-OfficeVersion: 16.0.12813.32650
X-OfficeFE: BL6PEPF0000310C
P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
Connection: keep-alive
X-MSEdge-Flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115,1fxu=afd_waccluster
Content-Length: 4096
Cache-Control: public,max-age=31536000
X-MSEdge-Features: tasmigration015,typeheadertest,multitenanttasmigration_115,afd_waccluster
Last-Modified: Wed, 15 Apr 2020 23:42:27 GMT
X-OFFICEFD: BL6PEPF000028B3
X-MSEdge-Ref: Ref A: 0A658D6A9F4E462DB241CFEB5447F051 Ref B: AM3EDGE0812 Ref C: 2020-04-15T23:42:26Z
X-UserSessionId: 91ad4fe0-e810-4e2e-b942-f678451c5a4e
Date: Sat, 18 Apr 2020 01:49:50 GMT
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
X-CorrelationId: 91ad4fe0-e810-4e2e-b942-f678451c5a4e
Accept-Ranges: bytes
Timing-Allow-Origin: *

GET
H/1.1 200
OK WordViewer.js Show response
c1-word-view-15.cdn.office.net/wv/s/161281533700_App_Scripts/ Frame DB54 1 MB
261 KB 32ms
8ms Script
application/javascript 2a02:26f0:3100:2a2::1c24
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://c1-word-view-15.cdn.office.net/wv/s/161281533700_App_Scripts/WordViewer.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3100:2a2::1c24 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Resource Hash

cdafbddf6adf359bcec1c0738ee7c8b48a5eaa374ccf5ef27eecc9f762ebdf7b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://word-view.officeapps.live.com/
Origin: https://word-view.officeapps.live.com

Response headers

Strict-Transport-Security: max-age=31536000
Content-Encoding: br
ETag: W/"a4c3243b7813d61:0"
X-OfficeCluster: US6
X-OfficeVersion: 16.0.12813.32650
X-OfficeFE: BL6PEPF00003182
P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
Connection: keep-alive
X-MSEdge-Flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115cf,1fxu=afd_waccluster
Content-Length: 265790
Cache-Control: public,max-age=31536000
X-MSEdge-Features: tasmigration015,typeheadertest,multitenanttasmigration_115cf,afd_waccluster
Last-Modified: Wed, 15 Apr 2020 22:50:16 GMT
X-OFFICEFD: BL6PEPF00002E04
X-MSEdge-Ref: Ref A: 89E55F152E214A9598362C07CDD370BF Ref B: AM3EDGE0111 Ref C: 2020-04-15T22:50:15Z
X-UserSessionId: 8fdc4134-1af8-4723-b045-187d2119e8dc
Date: Sat, 18 Apr 2020 01:49:50 GMT
Content-Type: application/javascript
Access-Control-Allow-Origin: *
X-CorrelationId: 8fdc4134-1af8-4723-b045-187d2119e8dc
Accept-Ranges: bytes
Timing-Allow-Origin: *

POST
H2 200 RemoteUls.ashx Show response
word-view.officeapps.live.com/wv/ Frame DB54 0
341 B 103ms
102ms XHR
text/plain 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/RemoteUls.ashx?build=16.0.12815.33700&waccluster=US4

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=eRkC83TueUq1y7N/IlgqPA.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FE650E3B710AD4626%21466&sc=host%3D%26qt%3DFolders%26pt%3Dem
X-UserSessionId: 68e24270-6e61-4ea5-931f-949db34b24d0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
X-BrowserUlsBeacon: [{"Index":0,"MsSinceStart":0,"Value":"SessionStarted","Type":"SessionBoundary"}]

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
x-officecluster: US4
x-officeversion: 16.0.12815.33700
x-officefe: BL2PEPF00002954
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115cf,1fxu=afd_waccluster
content-length: 0
x-msedge-features: tasmigration015,typeheadertest,multitenanttasmigration_115cf,afd_waccluster
x-correlationid: bbd7ed27-4cd8-43a3-b6d7-914f830cecb5
x-officefd: BL2PEPF00000BB5
x-ccr: true
x-usersessionid: 68e24270-6e61-4ea5-931f-949db34b24d0
date: Sat, 18 Apr 2020 01:49:49 GMT
x-download-options: noopen
content-type: text/plain
access-control-allow-origin: https://word-view.officeapps.live.com
access-control-expose-headers: X-EndSession, X-CorrelationId, X-OfficeFE, X-NewKey, X-bULS-SuppressionETag, X-bULS-SuppressedTags
cache-control: private
x-msedge-ref: Ref A: 6B09F603A09645D68DC529FF6C00681B Ref B: AM3EDGE0913 Ref C: 2020-04-18T01:49:50Z
timing-allow-origin: *

POST
H2 200 RemoteUls.ashx Show response
word-view.officeapps.live.com/wv/ Frame DB54 0
167 B 104ms
104ms XHR
text/plain 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/RemoteUls.ashx?build=16.0.12815.33700&waccluster=US4

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=eRkC83TueUq1y7N/IlgqPA.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FE650E3B710AD4626%21466&sc=host%3D%26qt%3DFolders%26pt%3Dem
X-UserSessionId: 68e24270-6e61-4ea5-931f-949db34b24d0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
X-BrowserUlsBeacon: [{"Index":1,"MsSinceStart":36,"Value":"https://c.s-microsoft.com/mscc/statics/mscc-0.4.2.min.css","Type":"ResourceDownloadSuccess"}]

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
x-officecluster: US4
x-officeversion: 16.0.12815.33700
x-officefe: BL2PEPF00002FDA
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115cf,1fxu=afd_waccluster
content-length: 0
x-msedge-features: tasmigration015,typeheadertest,multitenanttasmigration_115cf,afd_waccluster
x-correlationid: 48df6ac9-f62c-4cd8-bb00-99f255e5a4f6
x-officefd: BL2PEPF000018C0
x-ccr: true
x-usersessionid: 68e24270-6e61-4ea5-931f-949db34b24d0
date: Sat, 18 Apr 2020 01:49:49 GMT
x-download-options: noopen
content-type: text/plain
access-control-allow-origin: https://word-view.officeapps.live.com
access-control-expose-headers: X-EndSession, X-CorrelationId, X-OfficeFE, X-NewKey, X-bULS-SuppressionETag, X-bULS-SuppressedTags
cache-control: private
x-msedge-ref: Ref A: EC6F28447A1A44DE8AC2C4AEAE78A354 Ref B: AM3EDGE0913 Ref C: 2020-04-18T01:49:50Z
timing-allow-origin: *

GET
H2 200 ResReader.ashx
word-view.officeapps.live.com/wv/ Frame DB54 62 KB
62 KB 313ms
313ms Image
image/png 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://word-view.officeapps.live.com/wv/ResReader.ashx?n=p1.img&WOPIsrc=https%3A%2F%2Fwopi%2Eonedrive%2Ecom%2Fwopi%2Ffiles%2FE650E3B710AD4626%21466&access_token=4wpZjDPWGgwSjKhMGiZoY1rNR9bjTSa61BK14GzJMToc5%2D%5FJMY%5FLld7Q00g%5FdvcgcTtAayKaDxOuoRgpQWW8iZcthKgJHHUxIpi8mNlaTdX8SmmlEzAzrwjSUSYZZxICtI6goFuwnH4%2DpeSk6nQNJZgA&access_token_ttl=1588988989932&z=aRTY1MEUzQjcxMEFENDYyNiE0NjYuMTQ4&v=00000000-0000-0000-0000-000000000802&usid=68e24270-6e61-4ea5-931f-949db34b24d0&splashscreen=1&build=16.0.12815.33700&PdfMode=1&waccluster=US4

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

0247cb24f99cd9a0114f0a3373f8854ace8c8111119453c06c61cc4b115e1efe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=eRkC83TueUq1y7N/IlgqPA.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FE650E3B710AD4626%21466&sc=host%3D%26qt%3DFolders%26pt%3Dem
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-officecluster: US4
x-officeversion: 16.0.12815.33700
x-officefe: BL2PEPF00002945
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115,1fxu=afd_waccluster
content-length: 63232
etag: "WOPIsrc=https%3A%2F%2Fwopi%2Eonedrive%2Ecom%2Fwopi%2Ffiles%2FE650E3B710AD4626%21466&access_token=4wpZjDPWGgwSjKhMGiZoY1rNR9bjTSa61BK14GzJMToc5%2D%5FJMY%5FLld7Q00g%5FdvcgcTtAayKaDxOuoRgpQWW8iZcthKgJHHUxIpi8mNlaTdX8SmmlEzAzrwjSUSYZZxICtI6goFuwnH4%2DpeSk6nQNJZgA&access_token_ttl=1588988989932&z=aRTY1MEUzQjcxMEFENDYyNiE0NjYuMTQ400000000-0000-0000-0000-000000000802p1.img"
x-msedge-features: tasmigration015,typeheadertest,multitenanttasmigration_115,afd_waccluster
x-correlationid: a8cd8fce-51bb-44a3-ba1c-088aeafb53fb
x-officefd: BL2PEPF00003146
x-ccr: true
x-usersessionid: 68e24270-6e61-4ea5-931f-949db34b24d0
date: Sat, 18 Apr 2020 01:49:50 GMT
x-download-options: noopen
content-type: image/png
cache-control: private
x-msedge-ref: Ref A: B7AD737EBCD04425BC68FFC993866257 Ref B: AM3EDGE0913 Ref C: 2020-04-18T01:49:51Z
timing-allow-origin: *
expires: Sun, 18 Apr 2021 01:49:51 GMT

POST
H2 200 RemoteTelemetry.ashx Show response
word-view.officeapps.live.com/wv/ Frame DB54 0
238 B 105ms
104ms XHR
text/plain 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/RemoteTelemetry.ashx

Requested by

Host: c1-word-view-15.cdn.office.net
URL: https://c1-word-view-15.cdn.office.net/wv/s/161281533700_App_Scripts/WordViewer.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=eRkC83TueUq1y7N/IlgqPA.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FE650E3B710AD4626%21466&sc=host%3D%26qt%3DFolders%26pt%3Dem
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-officefd: BL6PEPF0000073E
x-officeversion: 16.0.12815.33700
x-officefe: BL6PEPF0000315C
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115cf,1fxu=afd_waccluster
content-length: 0
x-msedge-features: tasmigration015,typeheadertest,multitenanttasmigration_115cf,afd_waccluster
x-correlationid: 6b64a239-33ff-47c9-994c-67b7e465efa1
x-officecluster: US6
x-ccr: true
x-usersessionid: 6b64a239-33ff-47c9-994c-67b7e465efa1
date: Sat, 18 Apr 2020 01:49:50 GMT
x-download-options: noopen
access-control-allow-origin: https://word-view.officeapps.live.com
cache-control: private
x-msedge-ref: Ref A: 5E8E3E6850D944D8B5DF54D5371FB9A2 Ref B: AM3EDGE0913 Ref C: 2020-04-18T01:49:51Z
timing-allow-origin: *

POST
H2 200 RemoteTelemetry.ashx Show response
word-view.officeapps.live.com/wv/ Frame DB54 0
197 B 112ms
112ms XHR
text/plain 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/RemoteTelemetry.ashx

Requested by

Host: c1-word-view-15.cdn.office.net
URL: https://c1-word-view-15.cdn.office.net/wv/s/161281533700_App_Scripts/WordViewer.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=eRkC83TueUq1y7N/IlgqPA.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FE650E3B710AD4626%21466&sc=host%3D%26qt%3DFolders%26pt%3Dem
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-officefd: BL2PEPF00001BCF
x-officeversion: 16.0.12815.33700
x-officefe: BL2PEPF00003F08
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115,1fxu=afd_waccluster
content-length: 0
x-msedge-features: tasmigration015,typeheadertest,multitenanttasmigration_115,afd_waccluster
x-correlationid: 8611ac9b-8146-44fb-abcd-3ab197d61ac9
x-officecluster: US4
x-ccr: true
x-usersessionid: 8611ac9b-8146-44fb-abcd-3ab197d61ac9
date: Sat, 18 Apr 2020 01:49:50 GMT
x-download-options: noopen
access-control-allow-origin: https://word-view.officeapps.live.com
cache-control: private
x-msedge-ref: Ref A: FBF513F2F64C4A37B72B7865391BB79F Ref B: AM3EDGE0913 Ref C: 2020-04-18T01:49:51Z
timing-allow-origin: *

POST
H2 200 RemoteTelemetry.ashx Show response
word-view.officeapps.live.com/wv/ Frame DB54 0
314 B 152ms
152ms XHR
text/plain 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/RemoteTelemetry.ashx

Requested by

Host: c1-word-view-15.cdn.office.net
URL: https://c1-word-view-15.cdn.office.net/wv/s/161281533700_App_Scripts/WordViewer.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=eRkC83TueUq1y7N/IlgqPA.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FE650E3B710AD4626%21466&sc=host%3D%26qt%3DFolders%26pt%3Dem
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-officefd: BL2PEPF0000161B
x-officeversion: 16.0.12815.33700
x-officefe: BL2PEPF00001B77
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115cf,1fxu=afd_waccluster
content-length: 0
x-msedge-features: tasmigration015,typeheadertest,multitenanttasmigration_115cf,afd_waccluster
x-correlationid: 5a47cf9c-5143-44ef-89f3-63d41441d1d5
x-officecluster: US4
x-ccr: true
x-usersessionid: 5a47cf9c-5143-44ef-89f3-63d41441d1d5
date: Sat, 18 Apr 2020 01:49:50 GMT
x-download-options: noopen
access-control-allow-origin: https://word-view.officeapps.live.com
cache-control: private
x-msedge-ref: Ref A: 709453C88C0C49FD84E4509B961B85D8 Ref B: AM3EDGE0913 Ref C: 2020-04-18T01:49:51Z
timing-allow-origin: *

POST
H2 200 RemoteTelemetry.ashx Show response
word-view.officeapps.live.com/wv/ Frame DB54 0
249 B 105ms
105ms XHR
text/plain 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/RemoteTelemetry.ashx

Requested by

Host: c1-word-view-15.cdn.office.net
URL: https://c1-word-view-15.cdn.office.net/wv/s/161281533700_App_Scripts/WordViewer.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=eRkC83TueUq1y7N/IlgqPA.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FE650E3B710AD4626%21466&sc=host%3D%26qt%3DFolders%26pt%3Dem
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-officefd: BL6PEPF0000076E
x-officeversion: 16.0.12815.33700
x-officefe: BL6PEPF0000310A
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115,1fxu=afd_waccluster
content-length: 0
x-msedge-features: tasmigration015,typeheadertest,multitenanttasmigration_115,afd_waccluster
x-correlationid: 1d4e133c-e509-4d07-be68-996a90d5eafd
x-officecluster: US6
x-ccr: true
x-usersessionid: 1d4e133c-e509-4d07-be68-996a90d5eafd
date: Sat, 18 Apr 2020 01:49:50 GMT
x-download-options: noopen
access-control-allow-origin: https://word-view.officeapps.live.com
cache-control: private
x-msedge-ref: Ref A: 008B44A5BD864CE197E3CC5101D7893C Ref B: AM3EDGE0913 Ref C: 2020-04-18T01:49:51Z
timing-allow-origin: *

POST
H2 200 RemoteUls.ashx Show response
word-view.officeapps.live.com/wv/ Frame DB54 0
406 B 102ms
102ms XHR
text/plain 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/RemoteUls.ashx?build=16.0.12815.33700&waccluster=US4

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=eRkC83TueUq1y7N/IlgqPA.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FE650E3B710AD4626%21466&sc=host%3D%26qt%3DFolders%26pt%3Dem
X-UserSessionId: 68e24270-6e61-4ea5-931f-949db34b24d0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
X-BrowserUlsBeacon: [{"Index":2,"MsSinceStart":688,"Value":"SplashScreenShown","Type":"BootPhaseCompleted"}]

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
x-officecluster: US4
x-officeversion: 16.0.12815.33700
x-officefe: BL2PEPF0000296C
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115,1fxu=afd_waccluster
content-length: 0
x-msedge-features: tasmigration015,typeheadertest,multitenanttasmigration_115,afd_waccluster
x-correlationid: 4c079882-2722-4d6b-b8e3-bd1020b862ea
x-officefd: BL2PEPF00002390
x-ccr: true
x-usersessionid: 68e24270-6e61-4ea5-931f-949db34b24d0
date: Sat, 18 Apr 2020 01:49:50 GMT
x-download-options: noopen
content-type: text/plain
access-control-allow-origin: https://word-view.officeapps.live.com
access-control-expose-headers: X-EndSession, X-CorrelationId, X-OfficeFE, X-NewKey, X-bULS-SuppressionETag, X-bULS-SuppressedTags
cache-control: private
x-msedge-ref: Ref A: 0869836B11CD48C6B678C97264BDF068 Ref B: AM3EDGE0913 Ref C: 2020-04-18T01:49:51Z
timing-allow-origin: *

GET
H/1.1 200
OK segoeui.woff
c1-word-view-15.cdn.office.net/wv/s/161281533700_resources/1033/ Frame DB54 22 KB
23 KB 7ms
7ms Font
font/x-woff 2a02:26f0:3100:2a2::1c24
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://c1-word-view-15.cdn.office.net/wv/s/161281533700_resources/1033/segoeui.woff

Requested by

Host: c1-word-view-15.cdn.office.net
URL: https://c1-word-view-15.cdn.office.net/wv/s/161281533700_App_Scripts/WordViewer.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3100:2a2::1c24 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Resource Hash

3d785eb0a0168e5c79e66aa0085a932d5fe2ad04f3577547e2267fa589df677d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://c1-word-view-15.cdn.office.net/wv/s/161281533700_resources/1033/WordViewer.css
Origin: https://word-view.officeapps.live.com

Response headers

Strict-Transport-Security: max-age=31536000
ETag: W/"fb76146a8213d61:0"
X-OFFICEFD: BL6PEPF00000741
X-OfficeVersion: 16.0.12813.32650
X-OfficeFE: BL6PEPF00002CB0
P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
Connection: keep-alive
X-MSEdge-Flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115,1fxu=afd_waccluster
Content-Length: 22720
Cache-Control: public,max-age=31536000
X-MSEdge-Features: tasmigration015,typeheadertest,multitenanttasmigration_115,afd_waccluster
Last-Modified: Thu, 16 Apr 2020 00:03:10 GMT
X-OfficeCluster: US6
X-MSEdge-Ref: Ref A: 8596767903DC4F3C9076F338BB74358F Ref B: AM3EDGE0909 Ref C: 2020-04-16T00:03:09Z
X-UserSessionId: fc8f4b59-33dc-468b-9f0a-1c2a9ce3edbb
Date: Sat, 18 Apr 2020 01:49:51 GMT
Content-Type: font/x-woff
Access-Control-Allow-Origin: *
X-CorrelationId: fc8f4b59-33dc-468b-9f0a-1c2a9ce3edbb
Accept-Ranges: bytes
Timing-Allow-Origin: *

GET
H2 200 docdatahandler.ashx Show response
word-view.officeapps.live.com/wv/ Frame DB54 356 B
688 B 319ms
319ms XHR
text/xml 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/docdatahandler.ashx?WOPIsrc=https%3A%2F%2Fwopi%2Eonedrive%2Ecom%2Fwopi%2Ffiles%2FE650E3B710AD4626%21466&access_token=4wpZjDPWGgwSjKhMGiZoY1rNR9bjTSa61BK14GzJMToc5%2D%5FJMY%5FLld7Q00g%5FdvcgcTtAayKaDxOuoRgpQWW8iZcthKgJHHUxIpi8mNlaTdX8SmmlEzAzrwjSUSYZZxICtI6goFuwnH4%2DpeSk6nQNJZgA&access_token_ttl=1588988989932&z=aRTY1MEUzQjcxMEFENDYyNiE0NjYuMTQ4&type=png&o15=1&ui=en-US&PdfMode=1

Requested by

Host: c1-officeapps-15.cdn.office.net
URL: https://c1-officeapps-15.cdn.office.net/wv/s/161281533700_App_Scripts/MicrosoftAjax.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3fd34e9b16dff848787a7ea71cd75c639a45d8a65942cfce44290c7363b9ae5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

X-UserSessionId: 68e24270-6e61-4ea5-931f-949db34b24d0
X-OfficeVersion: 16.0.12815.33700
X-Key: 4oebK4Y9CJBaGkcU4+JJD1atj15rp2sXiTSPSu1aC+s=,637227713903435673
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=eRkC83TueUq1y7N/IlgqPA.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FE650E3B710AD4626%21466&sc=host%3D%26qt%3DFolders%26pt%3Dem
X-Requested-With: XMLHttpRequest
X-UserType: WOPI
X-xhr: 1
X-WacCluster: US4

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
x-officecluster: US4
x-officeversion: 16.0.12815.33700
x-officefe: BL2PEPF0000291B
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115cf,1fxu=afd_waccluster
content-length: 355
x-msedge-features: tasmigration015,typeheadertest,multitenanttasmigration_115cf,afd_waccluster
x-correlationid: 17e5a1ba-475e-4655-845a-810d82e083c0
x-officefd: BL2PEPF00003137
x-ccr: true
x-usersessionid: 68e24270-6e61-4ea5-931f-949db34b24d0
date: Sat, 18 Apr 2020 01:49:50 GMT
x-download-options: noopen
vary: Accept-Encoding
content-type: text/xml; charset=utf-8
cache-control: private
x-msedge-ref: Ref A: 0441A090749546EA858E80F6C3E72FCB Ref B: AM3EDGE0913 Ref C: 2020-04-18T01:49:51Z
timing-allow-origin: *
expires: Sun, 18 Apr 2021 01:49:51 GMT

GET
H/1.1 200
OK wacairspaceanimationlibrary.js Show response
c1-officeapps-15.cdn.office.net/wv/s/161281533700_App_Scripts/ Frame DB54 40 KB
7 KB 8ms
8ms Script
application/javascript 2a02:26f0:3100:2b4::1c24
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://c1-officeapps-15.cdn.office.net/wv/s/161281533700_App_Scripts/wacairspaceanimationlibrary.js

Requested by

Host: c1-word-view-15.cdn.office.net
URL: https://c1-word-view-15.cdn.office.net/wv/s/161281533700_App_Scripts/WordViewer.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3100:2b4::1c24 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Resource Hash

234cae682920ab63f3184948f1e4103b89201a274977ed31097b844cc323afa1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://word-view.officeapps.live.com/
Origin: https://word-view.officeapps.live.com

Response headers

Strict-Transport-Security: max-age=31536000
Content-Encoding: br
ETag: W/"1bfff73b7813d61:0"
X-OfficeCluster: US6
X-OfficeVersion: 16.0.12813.32650
X-OfficeFE: BL6PEPF00003185
P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
Connection: keep-alive
X-MSEdge-Flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115,1fxu=afd_waccluster
Content-Length: 5997
Cache-Control: public,max-age=31536000
X-MSEdge-Features: tasmigration015,typeheadertest,multitenanttasmigration_115,afd_waccluster
Last-Modified: Wed, 15 Apr 2020 22:50:17 GMT
X-OFFICEFD: BL6PEPF000028B3
X-MSEdge-Ref: Ref A: 523380F20B784314A72C065E8046E309 Ref B: AMS04EDGE0807 Ref C: 2020-04-15T22:50:17Z
X-UserSessionId: ca3417cd-b06f-4a08-809b-5cbc9e179896
Date: Sat, 18 Apr 2020 01:49:51 GMT
Content-Type: application/javascript
Access-Control-Allow-Origin: *
X-CorrelationId: ca3417cd-b06f-4a08-809b-5cbc9e179896
Accept-Ranges: bytes
Timing-Allow-Origin: *

GET
H/1.1 200
OK wapsw.png
c1-officeapps-15.cdn.office.net/wv/s/161281533700_resources/1033/ Frame DB54 6 KB
7 KB 26ms
7ms Image
image/png 2a02:26f0:3100:2b4::1c24
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1-officeapps-15.cdn.office.net/wv/s/161281533700_resources/1033/wapsw.png?b=1601281533700

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3100:2b4::1c24 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Resource Hash

390577d35c959ffe7dd2af4519c04410a04fdc4a433b151e27b049fc4a1ab3e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://word-view.officeapps.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000
ETag: "61f034848113d61:0"
X-OFFICEFD: BL2PEPF00003133
X-OfficeVersion: 16.0.12815.33700
X-OfficeFE: BL2PEPF00003D57
P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
Connection: keep-alive
X-MSEdge-Flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115cf,1fxu=afd_waccluster
Content-Length: 5884
Cache-Control: public,max-age=31536000
X-MSEdge-Features: tasmigration015,typeheadertest,multitenanttasmigration_115cf,afd_waccluster
Last-Modified: Wed, 15 Apr 2020 23:56:44 GMT
X-OfficeCluster: US4
X-MSEdge-Ref: Ref A: 016A0803449F47868516EA69CB151111 Ref B: AM3EDGE0720 Ref C: 2020-04-16T00:12:40Z
X-UserSessionId: a7bb50a2-e15a-45b2-9db5-a4feec5e5dba
Date: Sat, 18 Apr 2020 01:49:51 GMT
Content-Type: image/png
Access-Control-Allow-Origin: *
X-CorrelationId: a7bb50a2-e15a-45b2-9db5-a4feec5e5dba
Accept-Ranges: bytes
Timing-Allow-Origin: *

GET
H/1.1 200
OK wv.png
c1-word-view-15.cdn.office.net/wv/s/161281533700_resources/1033/ Frame DB54 34 KB
35 KB 7ms
7ms Image
image/png 2a02:26f0:3100:2a2::1c24
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1-word-view-15.cdn.office.net/wv/s/161281533700_resources/1033/wv.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3100:2a2::1c24 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Resource Hash

e2bf7da51e85c834d5c051092c444ee3011f518773d51c253090505356ef9f73

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://word-view.officeapps.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000
ETag: W/"f539123c7813d61:0"
X-OFFICEFD: BL6PEPF000028B0
X-OfficeVersion: 16.0.12813.32650
X-OfficeFE: BL6PEPF000030F8
P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
Connection: keep-alive
X-MSEdge-Flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115cf,1fxu=afd_waccluster
Content-Length: 34788
Cache-Control: public,max-age=31536000
X-MSEdge-Features: tasmigration015,typeheadertest,multitenanttasmigration_115cf,afd_waccluster
Last-Modified: Wed, 15 Apr 2020 22:50:17 GMT
X-OfficeCluster: US6
X-MSEdge-Ref: Ref A: 058C5895ECDF4E04B02DD388C3A9A424 Ref B: AM3EDGE0312 Ref C: 2020-04-15T22:50:17Z
X-UserSessionId: d3a4fcd7-b5f4-47dc-81ad-e3de47177fc6
Date: Sat, 18 Apr 2020 01:49:51 GMT
Content-Type: image/png
Access-Control-Allow-Origin: *
X-CorrelationId: d3a4fcd7-b5f4-47dc-81ad-e3de47177fc6
Accept-Ranges: bytes
Timing-Allow-Origin: *

GET
H2 204 _log
uhf.microsoft.com/ Frame DB54 0
128 B 33ms
7ms Image
text/html 2a02:26f0:3100:286::2b57
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uhf.microsoft.com/_log?o=mscc&s=officeapps.live.com&m=show&nv=aspnet-3.1.4&sv=0.1.2
Requested by: Host: word-view.officeapps.live.com
URL: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=eRkC83TueUq1y7N/IlgqPA.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FE650E3B710AD4626%21466&sc=host%3D%26qt%3DFolders%26pt%3Dem
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:3100:286::2b57 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://word-view.officeapps.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Apr 2020 01:49:51 GMT
status: 204
content-type: text/html
access-control-allow-origin: *
cache-control: max-age=0, no-cache, no-store
content-length: 0
expires: Sat, 18 Apr 2020 01:49:51 GMT

GET
DATA 200
OK truncated
/ 34 KB
34 KB Font
font/woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 07ec698b1036cdfbb8892f02d9510f5f671284fca9fa003b883996da040a444b

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer
Origin: https://onedrive.live.com

Response headers

Content-Type: font/woff;charset=utf-8

GET
H2

200

c.gif
c.live.com/
Redirect Chain

https://c.live.com/c.gif?DI=15347&wlxid=ecdcf0af-b336-45bd-b2bf-c9646956a358&reqid=001b74d1c55&csiperf=ANON%3D%26NL%3D0%26TP%3D0%26CL%3DRD0003FFA56CC8%26MA%3Den-US%26B%3D0.0.0%26TR%3DNA%252ANA%252A...
https://c.bing.com/c.gif?DI=15347&wlxid=ecdcf0af-b336-45bd-b2bf-c9646956a358&reqid=001b74d1c55&csiperf=ANON%3D%26NL%3D0%26TP%3D0%26CL%3DRD0003FFA56CC8%26MA%3Den-US%26B%3D0.0.0%26TR%3DNA%252ANA%252A...
https://c.live.com/c.gif?DI=15347&wlxid=ecdcf0af-b336-45bd-b2bf-c9646956a358&reqid=001b74d1c55&csiperf=ANON%3D%26NL%3D0%26TP%3D0%26CL%3DRD0003FFA56CC8%26MA%3Den-US%26B%3D0.0.0%26TR%3DNA%252ANA%252A...

42 B
323 B

36ms
35ms

Image
image/gif

52.142.114.2
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.live.com/c.gif?DI=15347&wlxid=ecdcf0af-b336-45bd-b2bf-c9646956a358&reqid=001b74d1c55&csiperf=ANON%3D%26NL%3D0%26TP%3D0%26CL%3DRD0003FFA56CC8%26MA%3Den-US%26B%3D0.0.0%26TR%3DNA%252ANA%252A%253ASDX.Skydrive%252AEmbed.default.F.U.%26PLT%3D3466%26IR%3D1%26EX%3D0%26L.h%3D2344%26L.sjs%3D2461%26L.ttg%3D2344%26C.st%3D1587174587854%26N.domIn%3D2351%26N.dns%3D30%26N.tcp%3D46%26N.req%3D1767%26N.resp%3D13%26N.navType%3D0%26N.redirectCount%3D0&r=0.6188996435386229&CtsSyncId=E29BD1C0BEF743898BCE336FB960022A&MUID=23CE0116BC5D6F6003EB0FA6BD2C6E06
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.142.114.2 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Referer: https://onedrive.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Sat, 18 Apr 2020 01:49:51 GMT
etag: "34b3153dd9d61:0"
last-modified: Fri, 03 Apr 2020 17:28:44 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
status: 200
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-type: image/gif
content-length: 42

Redirect headers

pragma: no-cache
date: Sat, 18 Apr 2020 01:49:51 GMT
x-msedge-ref: Ref A: 54FD3632FA17482B804DA0135375FD19 Ref B: FRAEDGE0714 Ref C: 2020-04-18T01:49:51Z
x-powered-by: ASP.NET
status: 302
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location: https://c.live.com/c.gif?DI=15347&wlxid=ecdcf0af-b336-45bd-b2bf-c9646956a358&reqid=001b74d1c55&csiperf=ANON%3D%26NL%3D0%26TP%3D0%26CL%3DRD0003FFA56CC8%26MA%3Den-US%26B%3D0.0.0%26TR%3DNA%252ANA%252A%253ASDX.Skydrive%252AEmbed.default.F.U.%26PLT%3D3466%26IR%3D1%26EX%3D0%26L.h%3D2344%26L.sjs%3D2461%26L.ttg%3D2344%26C.st%3D1587174587854%26N.domIn%3D2351%26N.dns%3D30%26N.tcp%3D46%26N.req%3D1767%26N.resp%3D13%26N.navType%3D0%26N.redirectCount%3D0&r=0.6188996435386229&CtsSyncId=E29BD1C0BEF743898BCE336FB960022A&MUID=23CE0116BC5D6F6003EB0FA6BD2C6E06
cache-control: private, no-cache, proxy-revalidate, no-store
content-length: 0

POST
H2 200 RemoteUls.ashx Show response
word-view.officeapps.live.com/wv/ Frame DB54 0
470 B 107ms
107ms XHR
text/plain 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/RemoteUls.ashx?build=16.0.12815.33700&waccluster=US4

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

/ ARR/3.0

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=eRkC83TueUq1y7N/IlgqPA.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FE650E3B710AD4626%21466&sc=host%3D%26qt%3DFolders%26pt%3Dem
X-UserSessionId: 68e24270-6e61-4ea5-931f-949db34b24d0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
X-BrowserUlsBeacon: [{"Index":3,"MsSinceStart":1044,"Value":"RecordAppInteractive","Type":"BootPhaseCompleted"}]

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
x-officecluster: US4
x-officeversion: 16.0.12815.33700
x-officefe: BL2PEPF00002956
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115,1fxu=afd_waccluster
content-length: 0
x-msedge-features: tasmigration015,typeheadertest,multitenanttasmigration_115,afd_waccluster
x-correlationid: ec5a8499-012e-4898-8a78-54b9636e2b51
x-officefd: BL6PEPF00002BC4
x-ccr: true
x-usersessionid: 68e24270-6e61-4ea5-931f-949db34b24d0
x-powered-by: ARR/3.0
date: Sat, 18 Apr 2020 01:49:50 GMT
x-download-options: noopen
content-type: text/plain
access-control-allow-origin: https://word-view.officeapps.live.com
access-control-expose-headers: X-EndSession, X-CorrelationId, X-OfficeFE, X-NewKey, X-bULS-SuppressionETag, X-bULS-SuppressedTags
cache-control: private
x-msedge-ref: Ref A: 7EE317029A5E42CA83B41200CA7F8055 Ref B: AM3EDGE0913 Ref C: 2020-04-18T01:49:51Z
timing-allow-origin: *

GET
H/1.1 200
OK WordViewer.dll1.js Show response
c1-word-view-15.cdn.office.net/wv/s/161281533700_App_Scripts/ Frame DB54 471 KB
99 KB 8ms
7ms Script
application/javascript 2a02:26f0:3100:2a2::1c24
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://c1-word-view-15.cdn.office.net/wv/s/161281533700_App_Scripts/WordViewer.dll1.js

Requested by

Host: c1-word-view-15.cdn.office.net
URL: https://c1-word-view-15.cdn.office.net/wv/s/161281533700_App_Scripts/WordViewer.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3100:2a2::1c24 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Resource Hash

9a93282259017e5f97915d829a742e3d69f6e441298b4c5f451c2ad6f21e3ab4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://word-view.officeapps.live.com/
Origin: https://word-view.officeapps.live.com

Response headers

Strict-Transport-Security: max-age=31536000
Content-Encoding: br
ETag: W/"139e1c3c7813d61:0"
X-OfficeCluster: US4
X-OfficeVersion: 16.0.12813.32650
X-OfficeFE: BL2PEPF00001A15
P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
Connection: keep-alive
X-MSEdge-Flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115cf,1fxu=afd_waccluster
Content-Length: 100627
Cache-Control: public,max-age=31536000
X-MSEdge-Features: tasmigration015,typeheadertest,multitenanttasmigration_115cf,afd_waccluster
Last-Modified: Wed, 15 Apr 2020 22:50:17 GMT
X-OFFICEFD: BL2PEPF00001BCF
X-MSEdge-Ref: Ref A: 473506BC4F3A422693BCDA721F639E53 Ref B: AM3EDGE0613 Ref C: 2020-04-15T22:50:17Z
X-UserSessionId: 086268f8-1021-4af6-964e-0596bf51b200
Date: Sat, 18 Apr 2020 01:49:51 GMT
Content-Type: application/javascript
Access-Control-Allow-Origin: *
X-CorrelationId: 086268f8-1021-4af6-964e-0596bf51b200
Accept-Ranges: bytes
Timing-Allow-Origin: *

GET
DATA 200
OK truncated
/ Frame DB54 183 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 19b132c556e33c005d831e1f6adcf21d7ff16f39ccf9c7fba0d2903099c0afeb

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame DB54 185 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d091e132e22954ecf7403cce92be661694c7d32362e4a084d4824bff921e7127

Request headers

Referer
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H/1.1 200
OK progress.gif
c1-officeapps-15.cdn.office.net/wv/s/161281533700_resources/1033/ Frame DB54 695 B
2 KB 8ms
7ms Image
image/gif 2a02:26f0:3100:2b4::1c24
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1-officeapps-15.cdn.office.net/wv/s/161281533700_resources/1033/progress.gif

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3100:2b4::1c24 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Resource Hash

a3596c17dad9a003d0bfbe0b7ba6765f51391b5c3943660316f01c8e77b323db

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://word-view.officeapps.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Strict-Transport-Security: max-age=31536000
ETag: W/"2c54843c7813d61:0"
X-OFFICEFD: BL2PEPF00003144
X-OfficeVersion: 16.0.12813.32650
X-OfficeFE: BL2PEPF00003D2F
P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
Connection: keep-alive
X-MSEdge-Flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115,1fxu=afd_waccluster
Content-Length: 695
Cache-Control: public,max-age=31536000
X-MSEdge-Features: tasmigration015,typeheadertest,multitenanttasmigration_115,afd_waccluster
Last-Modified: Wed, 15 Apr 2020 22:50:18 GMT
X-OfficeCluster: US4
X-MSEdge-Ref: Ref A: 504D80B1B5424A3BBA6F5C13535F0ED5 Ref B: AMS04EDGE0715 Ref C: 2020-04-15T22:50:18Z
X-UserSessionId: 6932041f-15cd-4d89-ba2f-450951cec9ed
Date: Sat, 18 Apr 2020 01:49:51 GMT
Content-Type: image/gif
Access-Control-Allow-Origin: *
X-CorrelationId: 6932041f-15cd-4d89-ba2f-450951cec9ed
Accept-Ranges: bytes
Timing-Allow-Origin: *

GET
H2 200 ResReader.ashx
word-view.officeapps.live.com/wv/ Frame DB54 62 KB
62 KB 331ms
330ms Image
image/png 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://word-view.officeapps.live.com/wv/ResReader.ashx?n=p1.img&v=00000000-0000-0000-0000-000000000802&usid=68e24270-6e61-4ea5-931f-949db34b24d0&build=16.0.12815.33700&WOPIsrc=https%3A%2F%2Fwopi%2Eonedrive%2Ecom%2Fwopi%2Ffiles%2FE650E3B710AD4626%21466&access_token=4wpZjDPWGgwSjKhMGiZoY1rNR9bjTSa61BK14GzJMToc5%2D%5FJMY%5FLld7Q00g%5FdvcgcTtAayKaDxOuoRgpQWW8iZcthKgJHHUxIpi8mNlaTdX8SmmlEzAzrwjSUSYZZxICtI6goFuwnH4%2DpeSk6nQNJZgA&access_token_ttl=1588988989932&z=aRTY1MEUzQjcxMEFENDYyNiE0NjYuMTQ4&waccluster=US4&PdfMode=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

0247cb24f99cd9a0114f0a3373f8854ace8c8111119453c06c61cc4b115e1efe

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=eRkC83TueUq1y7N/IlgqPA.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FE650E3B710AD4626%21466&sc=host%3D%26qt%3DFolders%26pt%3Dem
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-officecluster: US4
x-officeversion: 16.0.12815.33700
x-officefe: BL2PEPF00003D3F
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115cf,1fxu=afd_waccluster
content-length: 63232
etag: "WOPIsrc=https%3A%2F%2Fwopi%2Eonedrive%2Ecom%2Fwopi%2Ffiles%2FE650E3B710AD4626%21466&access_token=4wpZjDPWGgwSjKhMGiZoY1rNR9bjTSa61BK14GzJMToc5%2D%5FJMY%5FLld7Q00g%5FdvcgcTtAayKaDxOuoRgpQWW8iZcthKgJHHUxIpi8mNlaTdX8SmmlEzAzrwjSUSYZZxICtI6goFuwnH4%2DpeSk6nQNJZgA&access_token_ttl=1588988989932&z=aRTY1MEUzQjcxMEFENDYyNiE0NjYuMTQ400000000-0000-0000-0000-000000000802p1.img"
x-msedge-features: tasmigration015,typeheadertest,multitenanttasmigration_115cf,afd_waccluster
x-correlationid: d3519271-cee9-413d-bd2a-8941ba636a65
x-officefd: BL2PEPF00000BE1
x-ccr: true
x-usersessionid: 68e24270-6e61-4ea5-931f-949db34b24d0
date: Sat, 18 Apr 2020 01:49:51 GMT
x-download-options: noopen
content-type: image/png
cache-control: private
x-msedge-ref: Ref A: 9CD170DBB9074932A05F5EEB7EBCD5B9 Ref B: AM3EDGE0913 Ref C: 2020-04-18T01:49:51Z
timing-allow-origin: *
expires: Sun, 18 Apr 2021 01:49:51 GMT

GET
H2 200 ResReader.ashx
word-view.officeapps.live.com/wv/ Frame DB54 144 KB
144 KB 319ms
318ms Image
image/png 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://word-view.officeapps.live.com/wv/ResReader.ashx?n=p2.img&v=00000000-0000-0000-0000-000000000802&usid=68e24270-6e61-4ea5-931f-949db34b24d0&build=16.0.12815.33700&WOPIsrc=https%3A%2F%2Fwopi%2Eonedrive%2Ecom%2Fwopi%2Ffiles%2FE650E3B710AD4626%21466&access_token=4wpZjDPWGgwSjKhMGiZoY1rNR9bjTSa61BK14GzJMToc5%2D%5FJMY%5FLld7Q00g%5FdvcgcTtAayKaDxOuoRgpQWW8iZcthKgJHHUxIpi8mNlaTdX8SmmlEzAzrwjSUSYZZxICtI6goFuwnH4%2DpeSk6nQNJZgA&access_token_ttl=1588988989932&z=aRTY1MEUzQjcxMEFENDYyNiE0NjYuMTQ4&waccluster=US4&PdfMode=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

9496173a762d4a5c91f3aece81cccbdd3279b02502b029f8b8797ab462fa1d40

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=eRkC83TueUq1y7N/IlgqPA.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FE650E3B710AD4626%21466&sc=host%3D%26qt%3DFolders%26pt%3Dem
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-officecluster: US4
x-officeversion: 16.0.12815.33700
x-officefe: BL2PEPF000019F5
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115cf,1fxu=afd_waccluster
content-length: 147108
etag: "WOPIsrc=https%3A%2F%2Fwopi%2Eonedrive%2Ecom%2Fwopi%2Ffiles%2FE650E3B710AD4626%21466&access_token=4wpZjDPWGgwSjKhMGiZoY1rNR9bjTSa61BK14GzJMToc5%2D%5FJMY%5FLld7Q00g%5FdvcgcTtAayKaDxOuoRgpQWW8iZcthKgJHHUxIpi8mNlaTdX8SmmlEzAzrwjSUSYZZxICtI6goFuwnH4%2DpeSk6nQNJZgA&access_token_ttl=1588988989932&z=aRTY1MEUzQjcxMEFENDYyNiE0NjYuMTQ400000000-0000-0000-0000-000000000802p2.img"
x-msedge-features: tasmigration015,typeheadertest,multitenanttasmigration_115cf,afd_waccluster
x-correlationid: c9072d55-4dd4-4ba3-82fa-f351311874b0
x-officefd: BL2PEPF00000BE3
x-ccr: true
x-usersessionid: 68e24270-6e61-4ea5-931f-949db34b24d0
date: Sat, 18 Apr 2020 01:49:51 GMT
x-download-options: noopen
content-type: image/png
cache-control: private
x-msedge-ref: Ref A: 4319D61741E84C14B99322B3C9C79C29 Ref B: AM3EDGE0913 Ref C: 2020-04-18T01:49:51Z
timing-allow-origin: *
expires: Sun, 18 Apr 2021 01:49:51 GMT

GET
H2 200 ResReader.ashx
word-view.officeapps.live.com/wv/ Frame DB54 86 KB
87 KB 345ms
344ms Image
image/png 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://word-view.officeapps.live.com/wv/ResReader.ashx?n=p3.img&v=00000000-0000-0000-0000-000000000802&usid=68e24270-6e61-4ea5-931f-949db34b24d0&build=16.0.12815.33700&WOPIsrc=https%3A%2F%2Fwopi%2Eonedrive%2Ecom%2Fwopi%2Ffiles%2FE650E3B710AD4626%21466&access_token=4wpZjDPWGgwSjKhMGiZoY1rNR9bjTSa61BK14GzJMToc5%2D%5FJMY%5FLld7Q00g%5FdvcgcTtAayKaDxOuoRgpQWW8iZcthKgJHHUxIpi8mNlaTdX8SmmlEzAzrwjSUSYZZxICtI6goFuwnH4%2DpeSk6nQNJZgA&access_token_ttl=1588988989932&z=aRTY1MEUzQjcxMEFENDYyNiE0NjYuMTQ4&waccluster=US4&PdfMode=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

43a55e690e3b6cf0eab573a284acb17282c96a93636ab3f7485b11504014df51

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=eRkC83TueUq1y7N/IlgqPA.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FE650E3B710AD4626%21466&sc=host%3D%26qt%3DFolders%26pt%3Dem
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-officecluster: US4
x-officeversion: 16.0.12815.33700
x-officefe: BL2PEPF0000292C
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115cf,1fxu=afd_waccluster
content-length: 87990
etag: "WOPIsrc=https%3A%2F%2Fwopi%2Eonedrive%2Ecom%2Fwopi%2Ffiles%2FE650E3B710AD4626%21466&access_token=4wpZjDPWGgwSjKhMGiZoY1rNR9bjTSa61BK14GzJMToc5%2D%5FJMY%5FLld7Q00g%5FdvcgcTtAayKaDxOuoRgpQWW8iZcthKgJHHUxIpi8mNlaTdX8SmmlEzAzrwjSUSYZZxICtI6goFuwnH4%2DpeSk6nQNJZgA&access_token_ttl=1588988989932&z=aRTY1MEUzQjcxMEFENDYyNiE0NjYuMTQ400000000-0000-0000-0000-000000000802p3.img"
x-msedge-features: tasmigration015,typeheadertest,multitenanttasmigration_115cf,afd_waccluster
x-correlationid: c27681d9-16af-4cc0-bc88-cdaf9056db96
x-officefd: BL2PEPF0000313A
x-ccr: true
x-usersessionid: 68e24270-6e61-4ea5-931f-949db34b24d0
date: Sat, 18 Apr 2020 01:49:51 GMT
x-download-options: noopen
content-type: image/png
cache-control: private
x-msedge-ref: Ref A: C16B0F45A4684E3881D665D53E7A3A62 Ref B: AM3EDGE0913 Ref C: 2020-04-18T01:49:51Z
timing-allow-origin: *
expires: Sun, 18 Apr 2021 01:49:51 GMT

GET
H2 200 ResReader.ashx
word-view.officeapps.live.com/wv/ Frame DB54 60 KB
61 KB 330ms
329ms Image
image/jpeg 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://word-view.officeapps.live.com/wv/ResReader.ashx?n=p4.img&v=00000000-0000-0000-0000-000000000802&usid=68e24270-6e61-4ea5-931f-949db34b24d0&build=16.0.12815.33700&WOPIsrc=https%3A%2F%2Fwopi%2Eonedrive%2Ecom%2Fwopi%2Ffiles%2FE650E3B710AD4626%21466&access_token=4wpZjDPWGgwSjKhMGiZoY1rNR9bjTSa61BK14GzJMToc5%2D%5FJMY%5FLld7Q00g%5FdvcgcTtAayKaDxOuoRgpQWW8iZcthKgJHHUxIpi8mNlaTdX8SmmlEzAzrwjSUSYZZxICtI6goFuwnH4%2DpeSk6nQNJZgA&access_token_ttl=1588988989932&z=aRTY1MEUzQjcxMEFENDYyNiE0NjYuMTQ4&waccluster=US4&PdfMode=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e4db8904a5bdee150c4aa8636a091b7f1651a43693db0c16cff31dc14c0d7f1c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=eRkC83TueUq1y7N/IlgqPA.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FE650E3B710AD4626%21466&sc=host%3D%26qt%3DFolders%26pt%3Dem
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-officecluster: US4
x-officeversion: 16.0.12815.33700
x-officefe: BL2PEPF00002914
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115cf,1fxu=afd_waccluster
content-length: 61432
etag: "WOPIsrc=https%3A%2F%2Fwopi%2Eonedrive%2Ecom%2Fwopi%2Ffiles%2FE650E3B710AD4626%21466&access_token=4wpZjDPWGgwSjKhMGiZoY1rNR9bjTSa61BK14GzJMToc5%2D%5FJMY%5FLld7Q00g%5FdvcgcTtAayKaDxOuoRgpQWW8iZcthKgJHHUxIpi8mNlaTdX8SmmlEzAzrwjSUSYZZxICtI6goFuwnH4%2DpeSk6nQNJZgA&access_token_ttl=1588988989932&z=aRTY1MEUzQjcxMEFENDYyNiE0NjYuMTQ400000000-0000-0000-0000-000000000802p4.img"
x-msedge-features: tasmigration015,typeheadertest,multitenanttasmigration_115cf,afd_waccluster
x-correlationid: cfced6c0-8aea-48df-a3c8-dbfc7a2d1277
x-officefd: BL2PEPF000023A0
x-ccr: true
x-usersessionid: 68e24270-6e61-4ea5-931f-949db34b24d0
date: Sat, 18 Apr 2020 01:49:51 GMT
x-download-options: noopen
content-type: image/jpeg
cache-control: private
x-msedge-ref: Ref A: 913DC5BA358247179605FACCC40FFFF4 Ref B: AM3EDGE0913 Ref C: 2020-04-18T01:49:51Z
timing-allow-origin: *
expires: Sun, 18 Apr 2021 01:49:51 GMT

GET
H2 200 ResReader.ashx
word-view.officeapps.live.com/wv/ Frame DB54 76 KB
77 KB 327ms
327ms Image
image/jpeg 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://word-view.officeapps.live.com/wv/ResReader.ashx?n=p5.img&v=00000000-0000-0000-0000-000000000802&usid=68e24270-6e61-4ea5-931f-949db34b24d0&build=16.0.12815.33700&WOPIsrc=https%3A%2F%2Fwopi%2Eonedrive%2Ecom%2Fwopi%2Ffiles%2FE650E3B710AD4626%21466&access_token=4wpZjDPWGgwSjKhMGiZoY1rNR9bjTSa61BK14GzJMToc5%2D%5FJMY%5FLld7Q00g%5FdvcgcTtAayKaDxOuoRgpQWW8iZcthKgJHHUxIpi8mNlaTdX8SmmlEzAzrwjSUSYZZxICtI6goFuwnH4%2DpeSk6nQNJZgA&access_token_ttl=1588988989932&z=aRTY1MEUzQjcxMEFENDYyNiE0NjYuMTQ4&waccluster=US4&PdfMode=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

9b27b4d75806886c7905c9e75cd48ddd8d9bf4b0e5f7b2da51fea4df251ea3f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=eRkC83TueUq1y7N/IlgqPA.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FE650E3B710AD4626%21466&sc=host%3D%26qt%3DFolders%26pt%3Dem
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-officecluster: US4
x-officeversion: 16.0.12815.33700
x-officefe: BL2PEPF00003D12
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115cf,1fxu=afd_waccluster
content-length: 78293
etag: "WOPIsrc=https%3A%2F%2Fwopi%2Eonedrive%2Ecom%2Fwopi%2Ffiles%2FE650E3B710AD4626%21466&access_token=4wpZjDPWGgwSjKhMGiZoY1rNR9bjTSa61BK14GzJMToc5%2D%5FJMY%5FLld7Q00g%5FdvcgcTtAayKaDxOuoRgpQWW8iZcthKgJHHUxIpi8mNlaTdX8SmmlEzAzrwjSUSYZZxICtI6goFuwnH4%2DpeSk6nQNJZgA&access_token_ttl=1588988989932&z=aRTY1MEUzQjcxMEFENDYyNiE0NjYuMTQ400000000-0000-0000-0000-000000000802p5.img"
x-msedge-features: tasmigration015,typeheadertest,multitenanttasmigration_115cf,afd_waccluster
x-correlationid: 4d360aa0-3cd6-4174-b811-2dd8c6045ca7
x-officefd: BL2PEPF000023A6
x-ccr: true
x-usersessionid: 68e24270-6e61-4ea5-931f-949db34b24d0
date: Sat, 18 Apr 2020 01:49:51 GMT
x-download-options: noopen
content-type: image/jpeg
cache-control: private
x-msedge-ref: Ref A: 2BE0A087C8E944B9B41C66F324238E02 Ref B: AM3EDGE0913 Ref C: 2020-04-18T01:49:51Z
timing-allow-origin: *
expires: Sun, 18 Apr 2021 01:49:51 GMT

GET
H2 200 ResReader.ashx Show response
word-view.officeapps.live.com/wv/ Frame DB54 13 KB
4 KB 1262ms
1262ms XHR
text/xml 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/ResReader.ashx?n=p_1_10.xml&v=00000000-0000-0000-0000-000000000802&usid=68e24270-6e61-4ea5-931f-949db34b24d0&build=16.0.12815.33700&WOPIsrc=https%3A%2F%2Fwopi%2Eonedrive%2Ecom%2Fwopi%2Ffiles%2FE650E3B710AD4626%21466&access_token=4wpZjDPWGgwSjKhMGiZoY1rNR9bjTSa61BK14GzJMToc5%2D%5FJMY%5FLld7Q00g%5FdvcgcTtAayKaDxOuoRgpQWW8iZcthKgJHHUxIpi8mNlaTdX8SmmlEzAzrwjSUSYZZxICtI6goFuwnH4%2DpeSk6nQNJZgA&access_token_ttl=1588988989932&z=aRTY1MEUzQjcxMEFENDYyNiE0NjYuMTQ4&waccluster=US4&PdfMode=1

Requested by

Host: c1-officeapps-15.cdn.office.net
URL: https://c1-officeapps-15.cdn.office.net/wv/s/161281533700_App_Scripts/MicrosoftAjax.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

d52a73765cc278a9e1a378be09c3245c82971cab354280aa6eb9e7f61a2b5d1e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

X-UserSessionId: 68e24270-6e61-4ea5-931f-949db34b24d0
X-OfficeVersion: 16.0.12815.33700
X-Key: 4oebK4Y9CJBaGkcU4+JJD1atj15rp2sXiTSPSu1aC+s=,637227713903435673
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=eRkC83TueUq1y7N/IlgqPA.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FE650E3B710AD4626%21466&sc=host%3D%26qt%3DFolders%26pt%3Dem
X-Requested-With: XMLHttpRequest
X-UserType: WOPI
X-xhr: 1
X-WacCluster: US4

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
x-officecluster: US4
x-officeversion: 16.0.12815.33700
x-officefe: BL2PEPF00001B82
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115cf,1fxu=afd_waccluster
content-length: 3737
etag: "WOPIsrc=https%3A%2F%2Fwopi%2Eonedrive%2Ecom%2Fwopi%2Ffiles%2FE650E3B710AD4626%21466&access_token=4wpZjDPWGgwSjKhMGiZoY1rNR9bjTSa61BK14GzJMToc5%2D%5FJMY%5FLld7Q00g%5FdvcgcTtAayKaDxOuoRgpQWW8iZcthKgJHHUxIpi8mNlaTdX8SmmlEzAzrwjSUSYZZxICtI6goFuwnH4%2DpeSk6nQNJZgA&access_token_ttl=1588988989932&z=aRTY1MEUzQjcxMEFENDYyNiE0NjYuMTQ400000000-0000-0000-0000-000000000802p_1_10.xml"
x-msedge-features: tasmigration015,typeheadertest,multitenanttasmigration_115cf,afd_waccluster
x-correlationid: c8af805f-8266-4e81-9397-2976907101b9
x-officefd: BL2PEPF0000239D
x-ccr: true
x-usersessionid: 68e24270-6e61-4ea5-931f-949db34b24d0
date: Sat, 18 Apr 2020 01:49:52 GMT
x-download-options: noopen
vary: Accept-Encoding
content-type: text/xml; charset=utf-8
cache-control: private
x-msedge-ref: Ref A: CBF145D258BF4D498DDF19CEAFCD3332 Ref B: AM3EDGE0913 Ref C: 2020-04-18T01:49:51Z
timing-allow-origin: *
expires: Sun, 18 Apr 2021 01:49:52 GMT

GET
H/1.1 200
OK wl.ms.js Show response
js.live.net/v5.0/ Frame DB54 42 KB
16 KB 112ms
29ms Script
application/javascript 104.109.78.246
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://js.live.net/v5.0/wl.ms.js
Requested by: Host: c1-word-view-15.cdn.office.net
URL: https://c1-word-view-15.cdn.office.net/wv/s/161281533700_App_Scripts/WordViewer.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_CBC
Server: 104.109.78.246 , Netherlands, ASN20940 (AKAMAI-ASN1, EU),
Reverse DNS: a104-109-78-246.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 /
Resource Hash: d4c9bd86a5465d8414b7a10438d28110836126b387990d492fe545a5e701904a

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://word-view.officeapps.live.com/
Origin: https://word-view.officeapps.live.com

Response headers

Date: Sat, 18 Apr 2020 01:49:51 GMT
X-MSNServer: RD0003FF1D732A
Last-Modified: Thu, 02 Jan 2020 22:15:34 GMT
Server: Microsoft-IIS/10.0
ETag: "0c7427bac1d51:0"
Vary: Accept-Encoding
Connection: keep-alive
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=72548, public
X-ODWebServer: westeurope0-ODWebp
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 16199

POST
H2 200 RemoteUls.ashx Show response
word-view.officeapps.live.com/wv/ Frame DB54 0
451 B 107ms
107ms XHR
text/plain 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/RemoteUls.ashx?build=16.0.12815.33700&waccluster=US4

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

/ ARR/3.0

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=eRkC83TueUq1y7N/IlgqPA.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FE650E3B710AD4626%21466&sc=host%3D%26qt%3DFolders%26pt%3Dem
X-UserSessionId: 68e24270-6e61-4ea5-931f-949db34b24d0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
X-BrowserUlsBeacon: [{"Index":4,"MsSinceStart":1398,"Value":"RecordContentDisplayed","Type":"BootPhaseCompleted"}]

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
x-officecluster: US4
x-officeversion: 16.0.12815.33700
x-officefe: BL2PEPF00001B4E
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115,1fxu=afd_waccluster
content-length: 0
x-msedge-features: tasmigration015,typeheadertest,multitenanttasmigration_115,afd_waccluster
x-correlationid: 85373786-23cf-4d9c-a3f2-0e55209c16e3
x-officefd: BL6PEPF00000758
x-ccr: true
x-usersessionid: 68e24270-6e61-4ea5-931f-949db34b24d0
x-powered-by: ARR/3.0
date: Sat, 18 Apr 2020 01:49:51 GMT
x-download-options: noopen
content-type: text/plain
access-control-allow-origin: https://word-view.officeapps.live.com
access-control-expose-headers: X-EndSession, X-CorrelationId, X-OfficeFE, X-NewKey, X-bULS-SuppressionETag, X-bULS-SuppressedTags
cache-control: private
x-msedge-ref: Ref A: 2CE2C5E2E3364E148A58F929B0FC8247 Ref B: AM3EDGE0913 Ref C: 2020-04-18T01:49:51Z
timing-allow-origin: *

POST
H2 200 RemoteUls.ashx Show response
word-view.officeapps.live.com/wv/ Frame DB54 0
285 B 105ms
105ms XHR
text/plain 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/RemoteUls.ashx?build=16.0.12815.33700&waccluster=US4

Requested by

Host: c1-officeapps-15.cdn.office.net
URL: https://c1-officeapps-15.cdn.office.net/wv/s/161281533700_App_Scripts/MicrosoftAjax.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

/ ARR/3.0

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

X-AccessToken: 4wpZjDPWGgwSjKhMGiZoY1rNR9bjTSa61BK14GzJMToc5-_JMY_Lld7Q00g_dvcgcTtAayKaDxOuoRgpQWW8iZcthKgJHHUxIpi8mNlaTdX8SmmlEzAzrwjSUSYZZxICtI6goFuwnH4-peSk6nQNJZgA
X-UserSessionId: 68e24270-6e61-4ea5-931f-949db34b24d0
X-OfficeVersion: 16.0.12815.33700
X-Key: 4oebK4Y9CJBaGkcU4+JJD1atj15rp2sXiTSPSu1aC+s=,637227713903435673
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
X-bULS-SuppressionETag: AC038CFEFA5C352C1E2500097D3E64C18C44AF5C
Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=eRkC83TueUq1y7N/IlgqPA.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FE650E3B710AD4626%21466&sc=host%3D%26qt%3DFolders%26pt%3Dem
X-Requested-With: XMLHttpRequest
X-UserType: WOPI
X-xhr: 1
X-AccessTokenTtl: 1588988989932
X-WacCluster: US4

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
x-officecluster: US4
x-officeversion: 16.0.12815.33700
x-officefe: BL2PEPF00003D06
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
x-buls-suppressionetag: AC038CFEFA5C352C1E2500097D3E64C18C44AF5C
content-disposition: attachment
x-msedge-flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115,1fxu=afd_waccluster
content-length: 0
x-msedge-features: tasmigration015,typeheadertest,multitenanttasmigration_115,afd_waccluster
x-correlationid: d0ae0e4d-e1b5-4c4d-a13a-5ef434b92861
x-officefd: BL6PEPF00002BC8
x-ccr: true
x-usersessionid: 68e24270-6e61-4ea5-931f-949db34b24d0
x-powered-by: ARR/3.0
date: Sat, 18 Apr 2020 01:49:51 GMT
x-download-options: noopen
content-type: text/plain
access-control-allow-origin: https://word-view.officeapps.live.com
access-control-expose-headers: X-EndSession, X-CorrelationId, X-OfficeFE, X-NewKey, X-bULS-SuppressionETag, X-bULS-SuppressedTags
cache-control: private
x-msedge-ref: Ref A: 588A187CBA1F49E6B0AA0696519579DF Ref B: AM3EDGE0913 Ref C: 2020-04-18T01:49:51Z
timing-allow-origin: *

GET
H/1.1 200
OK otelFull.min.js Show response
c1-word-view-15.cdn.office.net/wv/s/161281533700_App_Scripts/ Frame DB54 169 KB
38 KB 7ms
7ms Script
application/javascript 2a02:26f0:3100:2a2::1c24
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://c1-word-view-15.cdn.office.net/wv/s/161281533700_App_Scripts/otelFull.min.js

Requested by

Host: c1-word-view-15.cdn.office.net
URL: https://c1-word-view-15.cdn.office.net/wv/s/161281533700_App_Scripts/WordViewer.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3100:2a2::1c24 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU),

Reverse DNS

Software

Resource Hash

b7236b99e4c8caf0258d06005b78ad5c54cb215b138cc09b30ed42ec441a2712

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://word-view.officeapps.live.com/
Origin: https://word-view.officeapps.live.com

Response headers

Strict-Transport-Security: max-age=31536000
Content-Encoding: br
ETag: W/"adc933c7813d61:0"
X-OfficeCluster: US6
X-OfficeVersion: 16.0.12813.32650
X-OfficeFE: BL6PEPF00002D5A
P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
Connection: keep-alive
X-MSEdge-Flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115cf,1fxu=afd_waccluster
Content-Length: 37891
Cache-Control: public,max-age=31536000
X-MSEdge-Features: tasmigration015,typeheadertest,multitenanttasmigration_115cf,afd_waccluster
Last-Modified: Wed, 15 Apr 2020 22:50:18 GMT
X-OFFICEFD: BL6PEPF000028DD
X-MSEdge-Ref: Ref A: 048CF72D54E54E5D9957111B1D68CD01 Ref B: AMS04EDGE0512 Ref C: 2020-04-15T22:50:18Z
X-UserSessionId: e281a54f-701e-436e-9f38-4d6a15192bb8
Date: Sat, 18 Apr 2020 01:49:51 GMT
Content-Type: application/javascript
Access-Control-Allow-Origin: *
X-CorrelationId: e281a54f-701e-436e-9f38-4d6a15192bb8
Accept-Ranges: bytes
Timing-Allow-Origin: *

POST
H2 200 RemoteTelemetry.ashx Show response
word-view.officeapps.live.com/wv/ Frame DB54 0
318 B 114ms
114ms XHR
text/plain 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/RemoteTelemetry.ashx

Requested by

Host: c1-word-view-15.cdn.office.net
URL: https://c1-word-view-15.cdn.office.net/wv/s/161281533700_App_Scripts/WordViewer.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=eRkC83TueUq1y7N/IlgqPA.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FE650E3B710AD4626%21466&sc=host%3D%26qt%3DFolders%26pt%3Dem
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-officefd: BL2PEPF00003134
x-officeversion: 16.0.12815.33700
x-officefe: BL2PEPF000028EF
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115,1fxu=afd_waccluster
content-length: 0
x-msedge-features: tasmigration015,typeheadertest,multitenanttasmigration_115,afd_waccluster
x-correlationid: 41ce8364-ecc1-42dd-b5c5-68d39489d6f9
x-officecluster: US4
x-ccr: true
x-usersessionid: 41ce8364-ecc1-42dd-b5c5-68d39489d6f9
date: Sat, 18 Apr 2020 01:49:51 GMT
x-download-options: noopen
access-control-allow-origin: https://word-view.officeapps.live.com
cache-control: private
x-msedge-ref: Ref A: DF6F076059B0412FBB21DB3F9CCF5C7D Ref B: AM3EDGE0913 Ref C: 2020-04-18T01:49:51Z
timing-allow-origin: *

GET
H/1.1 200
OK ping Show response
browser.pipe.aria.microsoft.com/ Frame DB54 4 B
333 B 147ms
35ms XHR
application/json 52.114.77.33
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://browser.pipe.aria.microsoft.com/ping
Requested by: Host: c1-word-view-15.cdn.office.net
URL: https://c1-word-view-15.cdn.office.net/wv/s/161281533700_App_Scripts/otelFull.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.114.77.33 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-HTTPAPI/2.0 /
Resource Hash: c48b5b1a9776c84602de2306d7903a7241158a5077e7a8519af75c33441b8334

Request headers

Referer: https://word-view.officeapps.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 18 Apr 2020 01:49:51 GMT
Server: Microsoft-HTTPAPI/2.0
Access-Control-Allow-Methods: GET
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://word-view.officeapps.live.com
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: *
Content-Length: 4

GET
H2 200 translation.ashx Show response
word-view.officeapps.live.com/wv/ Frame DB54 1 KB
1 KB 464ms
463ms XHR
text/html 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/translation.ashx?WOPIsrc=https%3A%2F%2Fwopi%2Eonedrive%2Ecom%2Fwopi%2Ffiles%2FE650E3B710AD4626%21466&access_token=4wpZjDPWGgwSjKhMGiZoY1rNR9bjTSa61BK14GzJMToc5%2D%5FJMY%5FLld7Q00g%5FdvcgcTtAayKaDxOuoRgpQWW8iZcthKgJHHUxIpi8mNlaTdX8SmmlEzAzrwjSUSYZZxICtI6goFuwnH4%2DpeSk6nQNJZgA&access_token_ttl=1588988989932&z=aRTY1MEUzQjcxMEFENDYyNiE0NjYuMTQ4&uilang=en-US

Requested by

Host: c1-officeapps-15.cdn.office.net
URL: https://c1-officeapps-15.cdn.office.net/wv/s/161281533700_App_Scripts/MicrosoftAjax.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

7ecc2c0e69302778a8374536bc7539f43b4cb8fb481e77b313be1157ab5900ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

X-UserSessionId: 68e24270-6e61-4ea5-931f-949db34b24d0
X-OfficeVersion: 16.0.12815.33700
X-Key: 4oebK4Y9CJBaGkcU4+JJD1atj15rp2sXiTSPSu1aC+s=,637227713903435673
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=eRkC83TueUq1y7N/IlgqPA.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FE650E3B710AD4626%21466&sc=host%3D%26qt%3DFolders%26pt%3Dem
X-Requested-With: XMLHttpRequest
X-UserType: WOPI
X-xhr: 1
X-WacCluster: US4

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
x-officecluster: US4
x-officeversion: 16.0.12815.33700
x-officefe: BL2PEPF00003D55
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
x-msedge-flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115,1fxu=afd_waccluster
content-length: 996
pragma: no-cache
x-msedge-features: tasmigration015,typeheadertest,multitenanttasmigration_115,afd_waccluster
x-correlationid: 86453a10-d1a8-4c2b-8a1d-17d091d8ecee
x-officefd: BL2PEPF00001182
x-ccr: true
x-usersessionid: 68e24270-6e61-4ea5-931f-949db34b24d0
date: Sat, 18 Apr 2020 01:49:52 GMT
vary: Accept-Encoding
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store
x-msedge-ref: Ref A: 01F3D60C193C46D8868981BC1F5AAF79 Ref B: AM3EDGE0913 Ref C: 2020-04-18T01:49:52Z
timing-allow-origin: *
expires: -1

POST
H/1.1 200
OK / Show response
browser.pipe.aria.microsoft.com/Collector/3.0/ Frame DB54 0
395 B 58ms
58ms XHR
application/json 52.114.77.33
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://browser.pipe.aria.microsoft.com/Collector/3.0/?qsp=true&content-type=application%2Fbond-compact-binary&client-id=NO_AUTH&sdk-version=AWT-Web-JS-1.8.6&x-apikey=e064ef4d9cdb454d9eddb2f7f7a94c83-89a6d9df-7218-4efd-bcd4-16ea059deea2-7672,ff7e2f12a4be407096fc01eeb760eda3-eeeb63cf-35d9-4734-ab45-66a873412359-7045,79b56d2f6f2444f1a3d7f7c7f12bcc0c-f47f5fe6-ed89-42f6-8a43-cea0f5930b17-7407&client-time-epoch-millis=1587174593851&time-delta-to-apply-millis=use-collector-delta
Requested by: Host: c1-word-view-15.cdn.office.net
URL: https://c1-word-view-15.cdn.office.net/wv/s/161281533700_App_Scripts/otelFull.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.114.77.33 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-HTTPAPI/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://word-view.officeapps.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Sat, 18 Apr 2020 01:49:53 GMT
Server: Microsoft-HTTPAPI/2.0
time-delta-millis: 9
Access-Control-Allow-Methods: POST
Content-Type: application/json
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: kill-tokens, kill-duration-seconds, time-delta-millis
Access-Control-Allow-Headers: Accept, Content-Type, Content-Encoding, Client-Id
Content-Length: 0

GET
H2 200 Plt.mvc
onedrive.live.com/Handlers/ 42 B
520 B 142ms
142ms Image
image/gif 13.107.42.13
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onedrive.live.com/Handlers/Plt.mvc?bicild=&v=0.0.0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

13.107.42.13 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://onedrive.live.com/embed?cid=E650E3B710AD4626&resid=E650E3B710AD4626%21466&authkey=AHgbg3lhtxjkHis&em=2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
x-msedge-ref: Ref A: 6C92CF4E97784E25BB67A73ABA52D69C Ref B: BRU30EDGE0318 Ref C: 2020-04-18T01:49:56Z
x-odwebserver: centralus0-odwebpl
vary: Accept-Encoding
content-type: image/gif
status: 200
cache-control: private, max-age=31536000
date: Sat, 18 Apr 2020 01:49:55 GMT
x-msnserver: RD0003FFA5385A
expires: Sun, 18 Apr 2021 01:49:56 GMT

POST
H2 404 log Show response
onedrive.live.com/ 77 KB
77 KB 167ms
167ms XHR
text/html 13.107.42.13
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://onedrive.live.com/log

Requested by

Host: onedrive.live.com
URL: https://onedrive.live.com/embed?cid=E650E3B710AD4626&resid=E650E3B710AD4626%21466&authkey=AHgbg3lhtxjkHis&em=2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

13.107.42.13 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

2f37298faa04f97173ea79167a249026a3afb987d0493ae0bf1da20cbb13f67c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://onedrive.live.com/embed?cid=E650E3B710AD4626&resid=E650E3B710AD4626%21466&authkey=AHgbg3lhtxjkHis&em=2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
x-msnserver: RD0003FFA56CC8
x-content-type-options: nosniff
x-msedge-ref: Ref A: 006741B56C754260AEC3DFD9C17C74DF Ref B: BRU30EDGE0318 Ref C: 2020-04-18T01:50:00Z
x-odwebserver: centralus0-odwebpl
content-type: text/html; charset=utf-8
status: 404
cache-control: no-cache, no-store
date: Sat, 18 Apr 2020 01:49:59 GMT
content-length: 78474
expires: -1

Verdicts & Comments Add Verdict or Comment

153 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

7 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
word-view.officeapps.live.com/	1969-12-31 23:59:59	Name: BIGipCookie Value: 000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000
word-view.officeapps.live.com/	1970-01-19 11:03:56	Name: DcLcid Value: ui=1033&data=1033
.live.com/	1969-12-31 23:59:59	Name: BP Value: l=SDX.Skydrive&FR=&ST=
.live.com/	1970-01-19 09:02:59	Name: wla42 Value:
.live.com/	1969-12-31 23:59:59	Name: xidseq Value: 1
.live.com/	1969-12-31 23:59:59	Name: xid Value: ecdcf0af-b336-45bd-b2bf-c9646956a358&&RD0003FFA56CC8&146
.live.com/	1969-12-31 23:59:59	Name: E Value: P:L1kQxzrj14g=:wJyzVX8wsTdWfbkxsw98sGKDsNUv+jb0Cb/WThdeqpw=:F

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

browser.pipe.aria.microsoft.com
c.bing.com
c.live.com
c.s-microsoft.com
c1-officeapps-15.cdn.office.net
c1-word-view-15.cdn.office.net
js.live.net
karmajewelryshop.com
onedrive.live.com
spoprod-a.akamaihd.net
uhf.microsoft.com
word-view.officeapps.live.com
104.109.78.246
13.107.42.13
188.166.85.78
23.53.41.227
2620:1ec:a92::171
2620:1ec:c11::200
2a02:26f0:3100:286::2b57
2a02:26f0:3100:28c::356e
2a02:26f0:3100:2a2::1c24
2a02:26f0:3100:2b4::1c24
52.114.77.33
52.142.114.2
0247cb24f99cd9a0114f0a3373f8854ace8c8111119453c06c61cc4b115e1efe
06fe78141d1f3a435441a17ec8f9f46af7000af35aa0133c699c537d663607d0
07ec698b1036cdfbb8892f02d9510f5f671284fca9fa003b883996da040a444b
1394b1c43663fa167060186091800d4cae0696af7b64c14f2848b44124074c7e
19b132c556e33c005d831e1f6adcf21d7ff16f39ccf9c7fba0d2903099c0afeb
1a6f0c3f4072b078f9c7ce2f4aea48958592da9b0bdb3cf1890301440e34c823
234cae682920ab63f3184948f1e4103b89201a274977ed31097b844cc323afa1
2f37298faa04f97173ea79167a249026a3afb987d0493ae0bf1da20cbb13f67c
390577d35c959ffe7dd2af4519c04410a04fdc4a433b151e27b049fc4a1ab3e9
3d785eb0a0168e5c79e66aa0085a932d5fe2ad04f3577547e2267fa589df677d
43a55e690e3b6cf0eab573a284acb17282c96a93636ab3f7485b11504014df51
455be57e5ca76be462428c7b127d03d0245952b7e00ca14e8bcb3bfe7584c758
4d54a5f9a58647882e3ecda9c1c0ef87af16911d42ad51b4e8b718f84443c553
51d8fa6fbf875179427eb377c379cce25f6854cffc9d1a7584add5442e0c84ba
5c15c38a2b7554cab332dfb9e87398220fcb9a285e18905a20a50b439cba7ccb
62ff7ac7015d241ebef7f16c97f538d6890760dbdb623dd4630a9ad76e72c070
66c5d9882a954332c4aebef2386c7713a226fa617ddcd08d22f24e53ba5ec066
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
7ecc2c0e69302778a8374536bc7539f43b4cb8fb481e77b313be1157ab5900ff
85115acdc1b70c4a47daa1da31011b67bde417cbb718c5b3c73a914b82781bfd
910f1f3ce687cfde1a12415fe73a4465e7a2f851177c33ca8e9f3b5c5f93c41c
9496173a762d4a5c91f3aece81cccbdd3279b02502b029f8b8797ab462fa1d40
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9a93282259017e5f97915d829a742e3d69f6e441298b4c5f451c2ad6f21e3ab4
9b27b4d75806886c7905c9e75cd48ddd8d9bf4b0e5f7b2da51fea4df251ea3f9
a188e6c4c6729c3abbe6a34e45b5c3d7d65ffc659e1baa46632ffb1c876e815c
a3596c17dad9a003d0bfbe0b7ba6765f51391b5c3943660316f01c8e77b323db
b7236b99e4c8caf0258d06005b78ad5c54cb215b138cc09b30ed42ec441a2712
b7ab99f404e84cb71d274c9dca01c0b4a68b7adb20309c5f04387cb809cc0547
bd88d1e741693ab877b020059b46be7cf4ef62b46017b2489a8cd1bf9ce5b9fc
c0153afba2ee2258329d951763cc14531c98cdecfc22d55be2597cfad0cc6e54
c40c45a6858cff9069d12c50dcd44522b8d5e1f7464fbdb216b3246b5aa8c027
c48b5b1a9776c84602de2306d7903a7241158a5077e7a8519af75c33441b8334
cdafbddf6adf359bcec1c0738ee7c8b48a5eaa374ccf5ef27eecc9f762ebdf7b
d091e132e22954ecf7403cce92be661694c7d32362e4a084d4824bff921e7127
d4c9bd86a5465d8414b7a10438d28110836126b387990d492fe545a5e701904a
d52a73765cc278a9e1a378be09c3245c82971cab354280aa6eb9e7f61a2b5d1e
d6c15974b6181a68e9b74e4f38fbac81d640569ef0fbbaa3381cc59683a9763f
e2bf7da51e85c834d5c051092c444ee3011f518773d51c253090505356ef9f73
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3fd34e9b16dff848787a7ea71cd75c639a45d8a65942cfce44290c7363b9ae5
e4db8904a5bdee150c4aa8636a091b7f1651a43693db0c16cff31dc14c0d7f1c
ef23713f2cb8d1e0dfa5cd6d391f31f715f9c2d91e0894efb571b4053bc3c8e3

onedrive.live.com Open in urlscan Pro 13.107.42.13 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

53 Requests

100 %HTTPS

50 %IPv6

8 Domains

12 Subdomains

11 IPs

4 Countries

1698 kBTransfer

4477 kBSize

7 Cookies

0 Outgoing links

Page URL History

Redirected requests

53 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

onedrive.live.com Open in urlscan Pro
13.107.42.13 Public Scan

Screenshot
Live screenshot

Full Image

53
Requests

100 %
HTTPS

50 %
IPv6

8
Domains

12
Subdomains

11
IPs

4
Countries

1698 kB
Transfer

4477 kB
Size

7
Cookies

53 HTTP transactions
3 data transactions