onedrive.live.com Open in urlscan Pro
13.107.42.13 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://onedrive.live.com/embed?cid=C90690F3AEC757E1&resid=C90690F3AEC757E1%212876&authkey=APnzSKXiWm6qzBs&em=2
Submission: On April 03 via manual (April 3rd 2020, 7:20:37 am UTC) from GB

Summary HTTP 50 Redirects Behaviour Indicators

Summary

This website contacted 11 IPs in 4 countries across 7 domains to perform 50 HTTP transactions. The main IP is 13.107.42.13, located in United States and belongs to MICROSOFT-CORP-MSN-AS-BLOCK, US. The main domain is onedrive.live.com.
TLS certificate: Issued by Microsoft IT TLS CA 2 on June 25th 2019. Valid for: 2 years.

This is the only time onedrive.live.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
3	13.107.42.13 13.107.42.13	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
8	2.16.186.33 2.16.186.33	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
18	2620:1ec:a92:... 2620:1ec:a92::171	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2a02:26f0:eb:... 2a02:26f0:eb:390::356e	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
8	2a02:26f0:eb:... 2a02:26f0:eb:381::1c24	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
6	2a02:26f0:eb:... 2a02:26f0:eb:382::1c24	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	2a02:26f0:eb:... 2a02:26f0:eb:3a4::2b57	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 2	52.142.114.2 52.142.114.2	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1 1	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	23.77.209.8 23.77.209.8	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
2	52.114.128.71 52.114.128.71	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
50	11

3 13.107.42.13 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

onedrive.live.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2.16.186.33 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)
PTR: a2-16-186-33.deploy.static.akamaitechnologies.com

spoprod-a.akamaihd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

18 2620:1ec:a92::171 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

word-view.officeapps.live.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:eb:390::356e (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

c.s-microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a02:26f0:eb:381::1c24 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

c1-word-view-15.cdn.office.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2a02:26f0:eb:382::1c24 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

c1-officeapps-15.cdn.office.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:eb:3a4::2b57 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

uhf.microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.142.114.2 (Dublin, Ireland) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

c.live.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:c11::200 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

c.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.77.209.8 (Netherlands)

ASN20940 (AKAMAI-ASN1, US)
PTR: a23-77-209-8.deploy.static.akamaitechnologies.com

js.live.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.114.128.71 (Des Moines, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

browser.pipe.aria.microsoft.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
23	live.com 1 redirects onedrive.live.com word-view.officeapps.live.com c.live.com	270 KB
14	office.net c1-word-view-15.cdn.office.net c1-officeapps-15.cdn.office.net	556 KB
8	akamaihd.net spoprod-a.akamaihd.net	395 KB
3	microsoft.com uhf.microsoft.com browser.pipe.aria.microsoft.com	857 B
2	s-microsoft.com c.s-microsoft.com	3 KB
1	live.net js.live.net	16 KB
1	bing.com 1 redirects c.bing.com	744 B
50	7

	Domain	Requested by
18	word-view.officeapps.live.com	onedrive.live.com word-view.officeapps.live.com c1-word-view-15.cdn.office.net c1-officeapps-15.cdn.office.net
8	c1-word-view-15.cdn.office.net	word-view.officeapps.live.com c1-word-view-15.cdn.office.net
8	spoprod-a.akamaihd.net	onedrive.live.com
6	c1-officeapps-15.cdn.office.net	word-view.officeapps.live.com c1-word-view-15.cdn.office.net
3	onedrive.live.com	onedrive.live.com
2	browser.pipe.aria.microsoft.com	c1-word-view-15.cdn.office.net
2	c.live.com	1 redirects
2	c.s-microsoft.com	word-view.officeapps.live.com
1	js.live.net	c1-word-view-15.cdn.office.net
1	c.bing.com	1 redirects
1	uhf.microsoft.com	word-view.officeapps.live.com
50	11

This site contains no links.

Subject Issuer	Validity	Valid
onedrive.com Microsoft IT TLS CA 2	`2019-06-25` - `2021-06-25`	2 years	crt.sh
a248.e.akamai.net DigiCert Secure Site ECC CA-1	`2019-08-13` - `2020-08-12`	a year	crt.sh
officeapps.live.com Microsoft IT TLS CA 1	`2020-02-18` - `2022-02-18`	2 years	crt.sh
www.microsoft.com Microsoft IT TLS CA 5	`2019-10-21` - `2021-10-21`	2 years	crt.sh
*.cdn.office.net Microsoft IT TLS CA 1	`2019-10-31` - `2021-10-31`	2 years	crt.sh
unistore.www.microsoft.com Microsoft IT TLS CA 5	`2019-04-30` - `2021-04-30`	2 years	crt.sh
c.msn.com Microsoft IT TLS CA 4	`2020-02-10` - `2022-02-10`	2 years	crt.sh
p.sfx.ms Microsoft IT TLS CA 2	`2020-02-04` - `2022-02-04`	2 years	crt.sh
*.events.data.microsoft.com Microsoft IT TLS CA 4	`2019-10-10` - `2021-10-10`	2 years	crt.sh

This page contains 2 frames:

Primary Page: https://onedrive.live.com/embed?cid=C90690F3AEC757E1&resid=C90690F3AEC757E1%212876&authkey=APnzSKXiWm6qzBs&em=2
Frame ID: 847B445099AF1DE09A06B73C71821CB9
Requests: 13 HTTP requests in this frame

Frame: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=1UfIOdYMjE62IthSSCWlyQ.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FC90690F3AEC757E1%212876&sc=host%3D%26qt%3DFolders%26pt%3Dem
Frame ID: 4CCA9AA0C3427F50BC66E9A701427494
Requests: 40 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Statistics

50
Requests

100 %
HTTPS

55 %
IPv6

7
Domains

11
Subdomains

11
IPs

4
Countries

1274 kB
Transfer

4037 kB
Size

2
Cookies

0 Outgoing links

These are links going to different origins than the main page.

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 35

https://c.live.com/c.gif?DI=15347&wlxid=6c538c12-eb44-4636-85ba-682ae29ff638&reqid=00178141ecb&csiperf=ANON%3D%26NL%3D0%26TP%3D0%26CL%3DRD0003FF9AF1B1%26MA%3Den-US%26B%3D0.0.0%26TR%3DNA%252ANA%252A%253ASDX.Skydrive%252AEmbed.default.F.U.%26PLT%3D3692%26IR%3D1%26EX%3D0%26L.h%3D1448%26L.sjs%3D1579%26L.ttg%3D1448%26C.st%3D1585898417769%26N.domIn%3D1456%26N.dns%3D2%26N.tcp%3D43%26N.req%3D1238%26N.resp%3D8%26N.navType%3D0%26N.redirectCount%3D0&r=0.3778343681037799 HTTP 302
https://c.bing.com/c.gif?DI=15347&wlxid=6c538c12-eb44-4636-85ba-682ae29ff638&reqid=00178141ecb&csiperf=ANON%3D%26NL%3D0%26TP%3D0%26CL%3DRD0003FF9AF1B1%26MA%3Den-US%26B%3D0.0.0%26TR%3DNA%252ANA%252A%253ASDX.Skydrive%252AEmbed.default.F.U.%26PLT%3D3692%26IR%3D1%26EX%3D0%26L.h%3D1448%26L.sjs%3D1579%26L.ttg%3D1448%26C.st%3D1585898417769%26N.domIn%3D1456%26N.dns%3D2%26N.tcp%3D43%26N.req%3D1238%26N.resp%3D8%26N.navType%3D0%26N.redirectCount%3D0&r=0.3778343681037799&CtsSyncId=9C0E81060B614B70A1858A8D4C6E918A&RedC=c.live.com&MXFR=0E35B31D0BA46E2119FDBDBC0FA46AC6 HTTP 302
https://c.live.com/c.gif?DI=15347&wlxid=6c538c12-eb44-4636-85ba-682ae29ff638&reqid=00178141ecb&csiperf=ANON%3D%26NL%3D0%26TP%3D0%26CL%3DRD0003FF9AF1B1%26MA%3Den-US%26B%3D0.0.0%26TR%3DNA%252ANA%252A%253ASDX.Skydrive%252AEmbed.default.F.U.%26PLT%3D3692%26IR%3D1%26EX%3D0%26L.h%3D1448%26L.sjs%3D1579%26L.ttg%3D1448%26C.st%3D1585898417769%26N.domIn%3D1456%26N.dns%3D2%26N.tcp%3D43%26N.req%3D1238%26N.resp%3D8%26N.navType%3D0%26N.redirectCount%3D0&r=0.3778343681037799&CtsSyncId=9C0E81060B614B70A1858A8D4C6E918A&MUID=27FF83F3790B657F1A378D52787A6454

50 HTTP transactions
3 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request embed Show response
onedrive.live.com/ 60 KB
21 KB 1275ms
1229ms Document
text/html 13.107.42.13
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://onedrive.live.com/embed?cid=C90690F3AEC757E1&resid=C90690F3AEC757E1%212876&authkey=APnzSKXiWm6qzBs&em=2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

13.107.42.13 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

2b72b6f91a48d89ff19198d9536ed412e0fc65060058452d044dc72316aaa2f0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

:method: GET
:authority: onedrive.live.com
:scheme: https
:path: /embed?cid=C90690F3AEC757E1&resid=C90690F3AEC757E1%212876&authkey=APnzSKXiWm6qzBs&em=2
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: document
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: document

Response headers

status: 200
cache-control: no-cache, no-store
pragma: no-cache
content-type: text/html; charset=utf-8
content-encoding: gzip
expires: -1
vary: Accept-Encoding
set-cookie: E=P:NOEudp/X14g=:ZMeZADCSMi9jV0C6u6DrFpb0Qd6noTFrRL54F8AeYdQ=:F; domain=.live.com; path=/ xid=6c538c12-eb44-4636-85ba-682ae29ff638&&RD0003FF9AF1B1&131; domain=.live.com; path=/ xidseq=1; domain=.live.com; path=/ LD=; domain=.live.com; expires=Fri, 03-Apr-2020 05:40:17 GMT; path=/ wla42=; domain=live.com; expires=Fri, 10-Apr-2020 07:20:18 GMT; path=/
x-content-type-options: nosniff
strict-transport-security: max-age=31536000
x-msnserver: RD0003FF9AF1B1
x-odwebserver: centralus0-odwebpl
x-msedge-ref: Ref A: 2E8188A52A95414F87BFB6B1E7528FF4 Ref B: LON21EDGE1520 Ref C: 2020-04-03T07:20:17Z
date: Fri, 03 Apr 2020 07:20:18 GMT

GET
H2 200 filescss1-11eb1969.css
spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001// 85 KB
16 KB 104ms
31ms Stylesheet
text/css 2.16.186.33
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001//filescss1-11eb1969.css
Requested by: Host: onedrive.live.com
URL: https://onedrive.live.com/embed?cid=C90690F3AEC757E1&resid=C90690F3AEC757E1%212876&authkey=APnzSKXiWm6qzBs&em=2
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.16.186.33 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-16-186-33.deploy.static.akamaitechnologies.com
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: bd88d1e741693ab877b020059b46be7cf4ef62b46017b2489a8cd1bf9ce5b9fc

Request headers

Referer: https://onedrive.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 03 Apr 2020 07:20:19 GMT
content-encoding: gzip
content-md5: EesZadmsnx78d9ZWIKfswQ==
status: 200
content-length: 15784
x-ms-lease-status: unlocked
last-modified: Mon, 14 May 2018 21:54:14 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D5B9E53BE6E430
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 6d2753fc-501e-00e6-0ad5-eb0c22000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type
cache-control: public, max-age=28078080
x-ms-version: 2009-09-19
timing-allow-origin: *

GET
H2 200 filescss2-a303a402.css
spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001// 169 KB
30 KB 121ms
48ms Stylesheet
text/css 2.16.186.33
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001//filescss2-a303a402.css
Requested by: Host: onedrive.live.com
URL: https://onedrive.live.com/embed?cid=C90690F3AEC757E1&resid=C90690F3AEC757E1%212876&authkey=APnzSKXiWm6qzBs&em=2
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.16.186.33 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-16-186-33.deploy.static.akamaitechnologies.com
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 1394b1c43663fa167060186091800d4cae0696af7b64c14f2848b44124074c7e

Request headers

Referer: https://onedrive.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 03 Apr 2020 07:20:19 GMT
content-encoding: gzip
content-md5: owOkAskXvYo3Ps40fhU7TQ==
status: 200
content-length: 30548
x-ms-lease-status: unlocked
last-modified: Mon, 14 May 2018 21:54:15 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D5B9E53C3A1C6F
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 45647edb-101e-00c8-61d5-eb8ce5000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type
cache-control: public, max-age=28078129
x-ms-version: 2009-09-19
timing-allow-origin: *

GET
H2 200 wlx_fonts-c7993ded.css
spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001// 123 KB
93 KB 137ms
64ms Stylesheet
text/css 2.16.186.33
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001//wlx_fonts-c7993ded.css
Requested by: Host: onedrive.live.com
URL: https://onedrive.live.com/embed?cid=C90690F3AEC757E1&resid=C90690F3AEC757E1%212876&authkey=APnzSKXiWm6qzBs&em=2
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.16.186.33 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-16-186-33.deploy.static.akamaitechnologies.com
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 455be57e5ca76be462428c7b127d03d0245952b7e00ca14e8bcb3bfe7584c758

Request headers

Referer: https://onedrive.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 03 Apr 2020 07:20:19 GMT
content-encoding: gzip
content-md5: x5k97ZNOTA+fsPCUPRp4Qw==
status: 200
content-length: 94644
x-ms-lease-status: unlocked
last-modified: Mon, 14 May 2018 21:54:23 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D5B9E5410A12E4
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: f3dbb10f-301e-011c-1ed8-eb8390000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type
cache-control: public, max-age=28088301
x-ms-version: 2009-09-19
timing-allow-origin: *

POST
H2 200 wordviewerframe.aspx Show response
word-view.officeapps.live.com/wv/ Frame 4CCA 91 KB
93 KB 192ms
163ms Document
text/html 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=1UfIOdYMjE62IthSSCWlyQ.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FC90690F3AEC757E1%212876&sc=host%3D%26qt%3DFolders%26pt%3Dem

Requested by

Host: onedrive.live.com
URL: https://onedrive.live.com/embed?cid=C90690F3AEC757E1&resid=C90690F3AEC757E1%212876&authkey=APnzSKXiWm6qzBs&em=2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

725fce62c0a5ad22790d85352cc60bc1725afcce209eeff9363100fe8b73c69b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

:method: POST
:authority: word-view.officeapps.live.com
:scheme: https
:path: /wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=1UfIOdYMjE62IthSSCWlyQ.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FC90690F3AEC757E1%212876&sc=host%3D%26qt%3DFolders%26pt%3Dem
content-length: 231
pragma: no-cache
cache-control: no-cache
origin: https://onedrive.live.com
upgrade-insecure-requests: 1
content-type: application/x-www-form-urlencoded
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
sec-fetch-dest: iframe
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: same-site
sec-fetch-mode: navigate
referer: https://onedrive.live.com/
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: E=P:NOEudp/X14g=:ZMeZADCSMi9jV0C6u6DrFpb0Qd6noTFrRL54F8AeYdQ=:F; xid=6c538c12-eb44-4636-85ba-682ae29ff638&&RD0003FF9AF1B1&131; xidseq=1; wla42=
Origin: https://onedrive.live.com
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: iframe
Referer: https://onedrive.live.com/

Response headers

status: 200
cache-control: no-cache, no-store
pragma: no-cache
content-type: text/html; charset=utf-8
expires: -1
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
set-cookie: DcLcid=ui=1033&data=1033; expires=Fri, 03-Jul-2020 07:20:19 GMT; path=/; samesite=none; secure; HttpOnly BIGipCookie=000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000; path=/; samesite=none; secure
x-correlationid: 39dbdd18-71ca-402d-9588-2047520bee02
x-usersessionid: 39dbdd18-71ca-402d-9588-2047520bee02
strict-transport-security: max-age=31536000
timing-allow-origin: *
origin-trial: ApjnZzULQW2j+i9/++Pj2WfVVByLoS5iZEVBPKULeFRNzLpMlHgeKsGOK4+MyK1AqsSdMI92vD2CSaa45EOWMQgAAAB7eyJvcmlnaW4iOiJodHRwczovL29mZmljZWFwcHMubGl2ZS5jb206NDQzIiwiZmVhdHVyZSI6IkFsbG93U3luY1hIUkluUGFnZURpc21pc3NhbCIsImV4cGlyeSI6MTU5MzM1NjU4NCwiaXNTdWJkb21haW4iOnRydWV9
x-ccr: true
x-officefe: BL2PEPF00001B5B
x-officeversion: 16.0.12802.33700
x-officecluster: US4
x-content-type-options: nosniff
content-security-policy-report-only: font-src data: c1-word-view-15.cdn.office.net *.skype.com *.skypeassets.com *.msocdn.com sway.com *.sway-cdn.com sway-cdn.com *.sharepointonline.com https:; script-src 'self' 'unsafe-inline' 'unsafe-eval' c1-word-view-15.cdn.office.net uci.officeapps.live.com c1-officeapps-15.cdn.office.net *.skype.com *.skypeassets.com *.msocdn.com js.live.net appsforoffice.microsoft.com contentstorage.osi.office.net content.lifecycle.office.net www.microsoft.com c.s-microsoft.com https:; style-src 'self' 'unsafe-inline' 'unsafe-eval' c1-word-view-15.cdn.office.net c1-officeapps-15.cdn.office.net *.skype.com *.skypeassets.com *.msocdn.com js.live.net sway.com *.sway-cdn.com sway-cdn.com c.s-microsoft.com https:; media-src *.skype.com *.skypeassets.com https:; object-src 'self' https:; child-src * https:; img-src * data: blob: https:; report-uri /wv/reportcsp.ashx
x-officefd: BL2PEPF00000BB5
x-msedge-ref: Ref A: 97AE011679F7484FB62027E2C559D83C Ref B: AMS04EDGE0721 Ref C: 2020-04-03T07:20:19Z
x-msedge-flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115
x-msedge-features: tasmigration015,typeheadertest,multitenanttasmigration_115
date: Fri, 03 Apr 2020 07:20:18 GMT

GET
H2 200 jquery-1.7.2-39eeb07e.js Show response
spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001/ 92 KB
33 KB 31ms
30ms Script
application/javascript 2.16.186.33
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001/jquery-1.7.2-39eeb07e.js
Requested by: Host: onedrive.live.com
URL: https://onedrive.live.com/embed?cid=C90690F3AEC757E1&resid=C90690F3AEC757E1%212876&authkey=APnzSKXiWm6qzBs&em=2
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.16.186.33 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-16-186-33.deploy.static.akamaitechnologies.com
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: d6c15974b6181a68e9b74e4f38fbac81d640569ef0fbbaa3381cc59683a9763f

Request headers

Referer: https://onedrive.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 03 Apr 2020 07:20:19 GMT
content-encoding: gzip
content-md5: Oe6wfmgC4rV/XhCprZvKJA==
status: 200
content-length: 33335
x-ms-lease-status: unlocked
last-modified: Mon, 14 May 2018 21:54:17 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D5B9E53DB4CCFD
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 456481ad-101e-00c8-56d5-eb8ce5000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type
cache-control: public, max-age=28078101
x-ms-version: 2009-09-19
timing-allow-origin: *

GET
H2 200 embed_s_embed-212fe29f.js Show response
spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001/ 483 KB
133 KB 37ms
37ms Script
application/javascript 2.16.186.33
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001/embed_s_embed-212fe29f.js
Requested by: Host: onedrive.live.com
URL: https://onedrive.live.com/embed?cid=C90690F3AEC757E1&resid=C90690F3AEC757E1%212876&authkey=APnzSKXiWm6qzBs&em=2
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.16.186.33 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-16-186-33.deploy.static.akamaitechnologies.com
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 5c15c38a2b7554cab332dfb9e87398220fcb9a285e18905a20a50b439cba7ccb

Request headers

Referer: https://onedrive.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 03 Apr 2020 07:20:19 GMT
content-encoding: gzip
content-md5: IS/in/g30QB+g7MVI79lXQ==
status: 200
content-length: 135707
x-ms-lease-status: unlocked
last-modified: Mon, 14 May 2018 21:54:01 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D5B9E533D8DD7F
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 6d2755cd-501e-00e6-20d5-eb0c22000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type
cache-control: public, max-age=28078132
x-ms-version: 2009-09-19
timing-allow-origin: *

GET
H2 200 embed1-0986a9b4.js Show response
spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001/ 47 KB
14 KB 31ms
30ms Script
application/javascript 2.16.186.33
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001/embed1-0986a9b4.js
Requested by: Host: onedrive.live.com
URL: https://onedrive.live.com/embed?cid=C90690F3AEC757E1&resid=C90690F3AEC757E1%212876&authkey=APnzSKXiWm6qzBs&em=2
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.16.186.33 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-16-186-33.deploy.static.akamaitechnologies.com
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: b7ab99f404e84cb71d274c9dca01c0b4a68b7adb20309c5f04387cb809cc0547

Request headers

Referer: https://onedrive.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 03 Apr 2020 07:20:19 GMT
content-encoding: gzip
content-md5: CYaptDz18cVXSIKt0vWKWA==
status: 200
content-length: 14119
x-ms-lease-status: unlocked
last-modified: Mon, 14 May 2018 21:54:00 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D5B9E5332E9B80
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 45648324-101e-00c8-0cd5-eb8ce5000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type
cache-control: public, max-age=28078147
x-ms-version: 2009-09-19
timing-allow-origin: *

GET
H2 200 embed2-8c600200.js Show response
spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001/ 203 KB
68 KB 43ms
42ms Script
application/javascript 2.16.186.33
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001/embed2-8c600200.js
Requested by: Host: onedrive.live.com
URL: https://onedrive.live.com/embed?cid=C90690F3AEC757E1&resid=C90690F3AEC757E1%212876&authkey=APnzSKXiWm6qzBs&em=2
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.16.186.33 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-16-186-33.deploy.static.akamaitechnologies.com
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: 4d54a5f9a58647882e3ecda9c1c0ef87af16911d42ad51b4e8b718f84443c553

Request headers

Referer: https://onedrive.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 03 Apr 2020 07:20:19 GMT
content-encoding: gzip
content-md5: jGACACXYYkvx7qKc5FskXg==
status: 200
content-length: 69276
x-ms-lease-status: unlocked
last-modified: Mon, 14 May 2018 21:54:00 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D5B9E5337DDB83
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 6d2756be-501e-00e6-6fd5-eb0c22000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type
cache-control: public, max-age=28077394
x-ms-version: 2009-09-19
timing-allow-origin: *

GET
H2 200 embed0-54f3ec81.js Show response
spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001/ 15 KB
6 KB 31ms
31ms Script
application/javascript 2.16.186.33
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://spoprod-a.akamaihd.net/files/onedrive-website-release-prod_master_20180514.001/embed0-54f3ec81.js
Requested by: Host: onedrive.live.com
URL: https://onedrive.live.com/embed?cid=C90690F3AEC757E1&resid=C90690F3AEC757E1%212876&authkey=APnzSKXiWm6qzBs&em=2
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 2.16.186.33 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a2-16-186-33.deploy.static.akamaitechnologies.com
Software: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash: c0153afba2ee2258329d951763cc14531c98cdecfc22d55be2597cfad0cc6e54

Request headers

Referer: https://onedrive.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: script

Response headers

x-ms-blob-type: BlockBlob
date: Fri, 03 Apr 2020 07:20:19 GMT
content-encoding: gzip
content-md5: VPPsgWGZk5RDzVgXZtU7Yg==
status: 200
content-length: 6057
x-ms-lease-status: unlocked
last-modified: Mon, 14 May 2018 21:53:59 GMT
server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
etag: 0x8D5B9E532CDCC12
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: b96f33ba-101e-0122-1fd5-eb35b1000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type
cache-control: public, max-age=28077392
x-ms-version: 2009-09-19
timing-allow-origin: *

GET
H2 200 mscc-0.4.2.min.css
c.s-microsoft.com/mscc/statics/ Frame 4CCA 1 KB
934 B 31ms
6ms Stylesheet
text/css 2a02:26f0:eb:390::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.s-microsoft.com/mscc/statics/mscc-0.4.2.min.css
Requested by: Host: word-view.officeapps.live.com
URL: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=1UfIOdYMjE62IthSSCWlyQ.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FC90690F3AEC757E1%212876&sc=host%3D%26qt%3DFolders%26pt%3Dem
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:eb:390::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: 66c5d9882a954332c4aebef2386c7713a226fa617ddcd08d22f24e53ba5ec066

Request headers

Referer: https://word-view.officeapps.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
date: Fri, 03 Apr 2020 07:20:19 GMT
content-encoding: gzip
last-modified: Fri, 10 Jan 2020 15:56:23 GMT
content-md5: QLyM0qNPDXd6ayzd1iIoLA==
access-control-allow-origin: *
etag: 0x8D795E5A424E059
vary: Accept-Encoding
access-control-allow-methods: GET,POST
content-type: text/css;charset=utf-8
status: 200
x-ms-request-id: a3a91312-801e-0025-4efc-c78b2b000000
x-ms-version: 2009-09-19
content-length: 626

GET
H/1.1 200
OK WordViewer.css
c1-word-view-15.cdn.office.net/wv/s/161280233700_resources/1033/ Frame 4CCA 216 KB
27 KB 33ms
7ms Stylesheet
text/css 2a02:26f0:eb:381::1c24
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://c1-word-view-15.cdn.office.net/wv/s/161280233700_resources/1033/WordViewer.css

Requested by

Host: word-view.officeapps.live.com
URL: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=1UfIOdYMjE62IthSSCWlyQ.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FC90690F3AEC757E1%212876&sc=host%3D%26qt%3DFolders%26pt%3Dem

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:eb:381::1c24 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

d9f6ed718316effd97e868acbcc37468fb67bfee276d08a5596ffcbcc7a81c79

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://word-view.officeapps.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: style

Response headers

X-CorrelationId: 4f6b36f0-a28f-4f98-b195-756f381ec1a0
Strict-Transport-Security: max-age=31536000
Content-Encoding: br
X-OFFICEFD: BL2PEPF00000BE4
X-OfficeVersion: 16.0.12730.37776
X-OfficeFE: BL2PEPF000028F8
P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
Date: Fri, 03 Apr 2020 07:20:19 GMT
Connection: keep-alive
X-MSEdge-Flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115cf
Content-Length: 26191
X-MSEdge-Features: tasmigration015,typeheadertest,multitenanttasmigration_115cf
Last-Modified: Thu, 02 Apr 2020 21:56:06 GMT
X-OfficeCluster: US4
X-MSEdge-Ref: Ref A: 7BF93D5871274403A8B8DF2DE6A2D5EB Ref B: AMS04EDGE0913 Ref C: 2020-04-02T21:56:06Z
X-UserSessionId: 4f6b36f0-a28f-4f98-b195-756f381ec1a0
ETag: W/"8868f982399d61:0"
Content-Type: text/css
Access-Control-Allow-Origin: *
Cache-Control: public,max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *

GET
H/1.1 200
OK MicrosoftAjax.js Show response
c1-officeapps-15.cdn.office.net/wv/s/161280233700_App_Scripts/ Frame 4CCA 105 KB
27 KB 34ms
6ms Script
application/javascript 2a02:26f0:eb:382::1c24
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://c1-officeapps-15.cdn.office.net/wv/s/161280233700_App_Scripts/MicrosoftAjax.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:eb:382::1c24 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

85115acdc1b70c4a47daa1da31011b67bde417cbb718c5b3c73a914b82781bfd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://word-view.officeapps.live.com/
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

X-CorrelationId: 4000faca-f396-43fa-ace9-d0fd360a161a
Strict-Transport-Security: max-age=31536000
Content-Encoding: gzip
X-OFFICEFD: BL2PEPF0000313D
X-OfficeVersion: 16.0.12730.37776
X-OfficeFE: BL2PEPF00001F1E
P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
Date: Fri, 03 Apr 2020 07:20:19 GMT
Connection: keep-alive
X-MSEdge-Flight: qx9=tasmigration015,skb=typeheadertest,1fxu=afd_waccluster
Content-Length: 27035
Accept-Ranges: bytes
X-MSEdge-Features: tasmigration015,typeheadertest,afd_waccluster
Last-Modified: Thu, 02 Apr 2020 21:52:26 GMT
X-OfficeCluster: US4
X-CCR: true
X-UserSessionId: 4000faca-f396-43fa-ace9-d0fd360a161a
ETag: W/"094cff389d61:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: public,max-age=31536000
X-MSEdge-Ref: Ref A: 91065B3469FC4374B7764D3880FD6001 Ref B: AM3EDGE1014 Ref C: 2020-04-02T21:52:25Z
Timing-Allow-Origin: *

GET
H2 200 mscc-0.4.2.min.js Show response
c.s-microsoft.com/mscc/statics/ Frame 4CCA 4 KB
2 KB 37ms
13ms Script
text/javascript 2a02:26f0:eb:390::356e
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://c.s-microsoft.com/mscc/statics/mscc-0.4.2.min.js
Requested by: Host: word-view.officeapps.live.com
URL: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=1UfIOdYMjE62IthSSCWlyQ.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FC90690F3AEC757E1%212876&sc=host%3D%26qt%3DFolders%26pt%3Dem
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:eb:390::356e , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: a188e6c4c6729c3abbe6a34e45b5c3d7d65ffc659e1baa46632ffb1c876e815c

Request headers

Referer: https://word-view.officeapps.live.com/
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

x-ms-lease-status: unlocked
x-ms-blob-type: BlockBlob
date: Fri, 03 Apr 2020 07:20:19 GMT
content-encoding: gzip
last-modified: Fri, 10 Jan 2020 15:56:14 GMT
content-md5: AO6kLOW8s6NiicKEPl74tA==
access-control-allow-origin: *
etag: 0x8D795E59EC908A0
vary: Accept-Encoding
access-control-allow-methods: GET,POST
content-type: text/javascript;charset=utf-8
status: 200
x-ms-request-id: 1a05ae20-f01e-0080-7bfc-c7b032000000
x-ms-version: 2009-09-19
content-length: 2017

GET
H/1.1 200
OK cookiecompliance.js Show response
c1-officeapps-15.cdn.office.net/wv/s/161280233700_App_Scripts/ Frame 4CCA 9 KB
3 KB 38ms
9ms Script
application/javascript 2a02:26f0:eb:382::1c24
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://c1-officeapps-15.cdn.office.net/wv/s/161280233700_App_Scripts/cookiecompliance.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:eb:382::1c24 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

910f1f3ce687cfde1a12415fe73a4465e7a2f851177c33ca8e9f3b5c5f93c41c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://word-view.officeapps.live.com/
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

X-CorrelationId: 557308f9-8538-4a18-a2d5-05969d2ca1fe
Strict-Transport-Security: max-age=31536000
Content-Encoding: br
X-OFFICEFD: BL2PEPF000023A7
X-OfficeVersion: 16.0.12730.37776
X-OfficeFE: BL2PEPF00001B80
P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
Date: Fri, 03 Apr 2020 07:20:19 GMT
Connection: keep-alive
X-MSEdge-Flight: qx9=tasmigration015,skb=typeheadertest
Content-Length: 1704
Accept-Ranges: bytes
X-MSEdge-Features: tasmigration015,typeheadertest
Last-Modified: Thu, 02 Apr 2020 21:54:35 GMT
X-OfficeCluster: US4
X-CCR: true
X-UserSessionId: 557308f9-8538-4a18-a2d5-05969d2ca1fe
ETag: W/"7ef43c4c399d61:0"
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: public,max-age=31536000
X-MSEdge-Ref: Ref A: D1496B22E4324340A8EAE885B5FFBADF Ref B: AMS04EDGE0519 Ref C: 2020-04-02T21:55:02Z
Timing-Allow-Origin: *

GET
H/1.1 200
OK CommonIntl.js Show response
c1-officeapps-15.cdn.office.net/wv/s/161280233700_App_Scripts/1033/ Frame 4CCA 77 KB
23 KB 41ms
12ms Script
application/javascript 2a02:26f0:eb:382::1c24
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://c1-officeapps-15.cdn.office.net/wv/s/161280233700_App_Scripts/1033/CommonIntl.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:eb:382::1c24 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

43145c313a1a22d0cbb6299b5ab6cfa103c5f793ae5f2639e5e5330b2c6f6243

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://word-view.officeapps.live.com/
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

X-CorrelationId: 4b2e0c17-cadf-440b-931b-ad053380a555
Strict-Transport-Security: max-age=31536000
Content-Encoding: gzip
X-OFFICEFD: BL6PEPF0000076F
X-OfficeVersion: 16.0.12730.37776
X-OfficeFE: BL6PEPF00002D77
P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
Date: Fri, 03 Apr 2020 07:20:19 GMT
Connection: keep-alive
X-MSEdge-Flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115
Content-Length: 22034
Accept-Ranges: bytes
X-MSEdge-Features: tasmigration015,typeheadertest,multitenanttasmigration_115
Last-Modified: Thu, 02 Apr 2020 21:54:46 GMT
X-OfficeCluster: US6
X-CCR: true
X-UserSessionId: 4b2e0c17-cadf-440b-931b-ad053380a555
ETag: W/"057be52399d61:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: public,max-age=31536000
X-MSEdge-Ref: Ref A: 3480B3EB176347728ECEE5E9F354F6DE Ref B: AM3EDGE0821 Ref C: 2020-04-02T21:54:46Z
Timing-Allow-Origin: *

GET
H/1.1 200
OK Compat.js Show response
c1-word-view-15.cdn.office.net/wv/s/161280233700_App_Scripts/ Frame 4CCA 6 KB
2 KB 34ms
9ms Script
application/javascript 2a02:26f0:eb:381::1c24
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://c1-word-view-15.cdn.office.net/wv/s/161280233700_App_Scripts/Compat.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:eb:381::1c24 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

06fe78141d1f3a435441a17ec8f9f46af7000af35aa0133c699c537d663607d0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://word-view.officeapps.live.com/
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

X-CorrelationId: 9e08bbce-79b5-437d-94d7-a9526697ef90
Strict-Transport-Security: max-age=31536000
Content-Encoding: br
X-OFFICEFD: BL2PEPF0000117F
X-OfficeVersion: 16.0.12730.37776
X-OfficeFE: BL2PEPF00003D25
P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
Date: Fri, 03 Apr 2020 07:20:19 GMT
Connection: keep-alive
X-MSEdge-Flight: qx9=tasmigration015,skb=typeheadertest,1fxu=afd_waccluster_control
Content-Length: 1365
Accept-Ranges: bytes
X-MSEdge-Features: tasmigration015,typeheadertest,afd_waccluster_control
Last-Modified: Thu, 02 Apr 2020 21:53:19 GMT
X-OfficeCluster: US4
X-CCR: true
X-UserSessionId: 9e08bbce-79b5-437d-94d7-a9526697ef90
ETag: W/"5aad431f399d61:0"
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: public,max-age=31536000
X-MSEdge-Ref: Ref A: 92DA490AB5BC41D5A4A89DD9608172EF Ref B: AM3EDGE0610 Ref C: 2020-04-02T21:53:19Z
Timing-Allow-Origin: *

GET
H/1.1 200
OK WordViewerIntl.js Show response
c1-word-view-15.cdn.office.net/wv/s/161280233700_App_Scripts/1033/ Frame 4CCA 19 KB
4 KB 33ms
7ms Script
application/javascript 2a02:26f0:eb:381::1c24
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://c1-word-view-15.cdn.office.net/wv/s/161280233700_App_Scripts/1033/WordViewerIntl.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:eb:381::1c24 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

b190d4155e76a5bf081eb27816e71189fb46dec4d6300b15ab425e1d95b82457

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://word-view.officeapps.live.com/
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

X-CorrelationId: 12777100-134a-4974-b6b1-c5bcffe1989b
Strict-Transport-Security: max-age=31536000
Content-Encoding: br
X-OFFICEFD: BL2PEPF0000161F
X-OfficeVersion: 16.0.12730.37776
X-OfficeFE: BL2PEPF00001F1B
P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
Date: Fri, 03 Apr 2020 07:20:19 GMT
Connection: keep-alive
X-MSEdge-Flight: qx9=tasmigration015,skb=typeheadertest,1fxu=afd_waccluster_control
Content-Length: 3287
X-MSEdge-Features: tasmigration015,typeheadertest,afd_waccluster_control
Last-Modified: Thu, 02 Apr 2020 21:56:05 GMT
X-OfficeCluster: US4
X-MSEdge-Ref: Ref A: CC3C73C3FEAD4A19B19238F0D996E68B Ref B: AMS04EDGE0519 Ref C: 2020-04-02T21:56:05Z
X-UserSessionId: 12777100-134a-4974-b6b1-c5bcffe1989b
ETag: W/"41591882399d61:0"
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: public,max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *

GET
H/1.1 200
OK WordViewer.js Show response
c1-word-view-15.cdn.office.net/wv/s/161280233700_App_Scripts/ Frame 4CCA 1 MB
260 KB 36ms
8ms Script
application/javascript 2a02:26f0:eb:381::1c24
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://c1-word-view-15.cdn.office.net/wv/s/161280233700_App_Scripts/WordViewer.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:eb:381::1c24 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

d315e2c934f0245c6fdffcf1e0d76fac45cfad61c496a9a4b7b37772f99f5f07

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://word-view.officeapps.live.com/
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

X-CorrelationId: 9f0ff261-7053-46bc-b1c5-1143c98994c2
Strict-Transport-Security: max-age=31536000
Content-Encoding: br
X-OFFICEFD: BL2PEPF0000239A
X-OfficeVersion: 16.0.12730.37776
X-OfficeFE: BL2PEPF00001B50
P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
Date: Fri, 03 Apr 2020 07:20:19 GMT
Connection: keep-alive
X-MSEdge-Flight: qx9=tasmigration015,skb=typeheadertest
Content-Length: 265273
Accept-Ranges: bytes
X-MSEdge-Features: tasmigration015,typeheadertest
Last-Modified: Thu, 02 Apr 2020 21:52:16 GMT
X-OfficeCluster: US4
X-CCR: true
X-UserSessionId: 9f0ff261-7053-46bc-b1c5-1143c98994c2
ETag: W/"891d63f9389d61:0"
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: public,max-age=31536000
X-MSEdge-Ref: Ref A: 853FD59131194BEDB5E0409BD804CBE1 Ref B: AMS04EDGE0411 Ref C: 2020-04-02T21:52:15Z
Timing-Allow-Origin: *

POST
H2 200 RemoteUls.ashx Show response
word-view.officeapps.live.com/wv/ Frame 4CCA 0
440 B 101ms
100ms XHR
text/plain 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/RemoteUls.ashx?build=16.0.12802.33700&waccluster=US4

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=1UfIOdYMjE62IthSSCWlyQ.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FC90690F3AEC757E1%212876&sc=host%3D%26qt%3DFolders%26pt%3Dem
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: empty
X-UserSessionId: 39dbdd18-71ca-402d-9588-2047520bee02
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
X-BrowserUlsBeacon: [{"Index":0,"MsSinceStart":0,"Value":"SessionStarted","Type":"SessionBoundary"}]

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
x-officecluster: US4
x-officeversion: 16.0.12802.33700
x-officefe: BL2PEPF00003D29
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115cf
content-length: 0
x-msedge-features: tasmigration015,typeheadertest,multitenanttasmigration_115cf
x-correlationid: e8cc5d7b-fda3-4d7a-8c92-db4d0775fb7d
x-officefd: BL2PEPF000023AC
x-ccr: true
x-usersessionid: 39dbdd18-71ca-402d-9588-2047520bee02
date: Fri, 03 Apr 2020 07:20:18 GMT
x-download-options: noopen
content-type: text/plain
access-control-allow-origin: https://word-view.officeapps.live.com
access-control-expose-headers: X-EndSession, X-CorrelationId, X-OfficeFE, X-NewKey, X-bULS-SuppressionETag, X-bULS-SuppressedTags
cache-control: private
x-msedge-ref: Ref A: A235C49286404D3591B33EB54AA6B68F Ref B: AMS04EDGE0721 Ref C: 2020-04-03T07:20:19Z
timing-allow-origin: *

POST
H2 200 RemoteUls.ashx Show response
word-view.officeapps.live.com/wv/ Frame 4CCA 0
155 B 101ms
101ms XHR
text/plain 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/RemoteUls.ashx?build=16.0.12802.33700&waccluster=US4

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=1UfIOdYMjE62IthSSCWlyQ.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FC90690F3AEC757E1%212876&sc=host%3D%26qt%3DFolders%26pt%3Dem
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: empty
X-UserSessionId: 39dbdd18-71ca-402d-9588-2047520bee02
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
X-BrowserUlsBeacon: [{"Index":1,"MsSinceStart":30,"Value":"https://c.s-microsoft.com/mscc/statics/mscc-0.4.2.min.css","Type":"ResourceDownloadSuccess"}]

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
x-officecluster: US4
x-officeversion: 16.0.12802.33700
x-officefe: BL2PEPF00003D2C
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115
content-length: 0
x-msedge-features: tasmigration015,typeheadertest,multitenanttasmigration_115
x-correlationid: 91848885-7afb-4ad3-8391-e82a3bfbb03a
x-officefd: BL2PEPF000023AC
x-ccr: true
x-usersessionid: 39dbdd18-71ca-402d-9588-2047520bee02
date: Fri, 03 Apr 2020 07:20:18 GMT
x-download-options: noopen
content-type: text/plain
access-control-allow-origin: https://word-view.officeapps.live.com
access-control-expose-headers: X-EndSession, X-CorrelationId, X-OfficeFE, X-NewKey, X-bULS-SuppressionETag, X-bULS-SuppressedTags
cache-control: private
x-msedge-ref: Ref A: AC70FC8977D54F908168E7BDBD3D838D Ref B: AMS04EDGE0721 Ref C: 2020-04-03T07:20:19Z
timing-allow-origin: *

GET
H2 200 ResReader.ashx
word-view.officeapps.live.com/wv/ Frame 4CCA 35 KB
36 KB 320ms
320ms Image
image/png 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://word-view.officeapps.live.com/wv/ResReader.ashx?n=p1.img&WOPIsrc=https%3A%2F%2Fwopi%2Eonedrive%2Ecom%2Fwopi%2Ffiles%2FC90690F3AEC757E1%212876&access_token=4w9UhybyEzcpikzcA9evEgvtxDnRNv7zfCEGYzmE6KgxXTO1gVjtJNEzn8IeI13BwdYwabjpJOTLpuvzFlsPJnSGZS9P5XijTpPE3iOTZNLel17mSRuKkZd%2DPuPZSztURhtoqWHn%5FFRevuHh6SZHocgA&access_token_ttl=1587712818938&z=aQzkwNjkwRjNBRUM3NTdFMSEyODc2LjU&v=00000000-0000-0000-0000-000000000802&usid=39dbdd18-71ca-402d-9588-2047520bee02&splashscreen=1&build=16.0.12802.33700&PdfMode=1&waccluster=US4

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

d0d2c82a1965d5ce450e7ee024382b373aa4643c18871b866657e694ab414c32

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=1UfIOdYMjE62IthSSCWlyQ.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FC90690F3AEC757E1%212876&sc=host%3D%26qt%3DFolders%26pt%3Dem
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-officecluster: US4
x-officeversion: 16.0.12802.33700
x-officefe: BL2PEPF00002FCD
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115
content-length: 35794
etag: "WOPIsrc=https%3A%2F%2Fwopi%2Eonedrive%2Ecom%2Fwopi%2Ffiles%2FC90690F3AEC757E1%212876&access_token=4w9UhybyEzcpikzcA9evEgvtxDnRNv7zfCEGYzmE6KgxXTO1gVjtJNEzn8IeI13BwdYwabjpJOTLpuvzFlsPJnSGZS9P5XijTpPE3iOTZNLel17mSRuKkZd%2DPuPZSztURhtoqWHn%5FFRevuHh6SZHocgA&access_token_ttl=1587712818938&z=aQzkwNjkwRjNBRUM3NTdFMSEyODc2LjU00000000-0000-0000-0000-000000000802p1.img"
x-msedge-features: tasmigration015,typeheadertest,multitenanttasmigration_115
x-correlationid: 9aab8c7b-8c46-4903-bc75-29bbd2336876
x-officefd: BL2PEPF00002391
x-ccr: true
x-usersessionid: 39dbdd18-71ca-402d-9588-2047520bee02
date: Fri, 03 Apr 2020 07:20:20 GMT
x-download-options: noopen
content-type: image/png
cache-control: private
x-msedge-ref: Ref A: 01C422F28869495B950FBF7C357C708F Ref B: AMS04EDGE0721 Ref C: 2020-04-03T07:20:21Z
timing-allow-origin: *
expires: Sat, 03 Apr 2021 07:20:21 GMT

POST
H2 200 RemoteTelemetry.ashx Show response
word-view.officeapps.live.com/wv/ Frame 4CCA 0
295 B 105ms
105ms XHR
text/plain 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/RemoteTelemetry.ashx

Requested by

Host: c1-word-view-15.cdn.office.net
URL: https://c1-word-view-15.cdn.office.net/wv/s/161280233700_App_Scripts/WordViewer.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=1UfIOdYMjE62IthSSCWlyQ.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FC90690F3AEC757E1%212876&sc=host%3D%26qt%3DFolders%26pt%3Dem
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-officefd: BL2PEPF00001184
x-officeversion: 16.0.12802.33700
x-officefe: BL2PEPF000019E4
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115cf
content-length: 0
x-msedge-features: tasmigration015,typeheadertest,multitenanttasmigration_115cf
x-correlationid: 5d0f6020-d12b-4ca2-9988-41ec72d5b2b6
x-officecluster: US4
x-ccr: true
x-usersessionid: 5d0f6020-d12b-4ca2-9988-41ec72d5b2b6
date: Fri, 03 Apr 2020 07:20:20 GMT
x-download-options: noopen
access-control-allow-origin: https://word-view.officeapps.live.com
cache-control: private
x-msedge-ref: Ref A: A3599FDB6FE24478BCE9220053A81F2C Ref B: AMS04EDGE0721 Ref C: 2020-04-03T07:20:21Z
timing-allow-origin: *

POST
H2 200 RemoteTelemetry.ashx Show response
word-view.officeapps.live.com/wv/ Frame 4CCA 0
193 B 107ms
107ms XHR
text/plain 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/RemoteTelemetry.ashx

Requested by

Host: c1-word-view-15.cdn.office.net
URL: https://c1-word-view-15.cdn.office.net/wv/s/161280233700_App_Scripts/WordViewer.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=1UfIOdYMjE62IthSSCWlyQ.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FC90690F3AEC757E1%212876&sc=host%3D%26qt%3DFolders%26pt%3Dem
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-officefd: BL2PEPF0000313E
x-officeversion: 16.0.12802.33700
x-officefe: BL2PEPF000019D0
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115cf
content-length: 0
x-msedge-features: tasmigration015,typeheadertest,multitenanttasmigration_115cf
x-correlationid: cec258c4-c1db-4b48-8b64-cba20ecb8fb3
x-officecluster: US4
x-ccr: true
x-usersessionid: cec258c4-c1db-4b48-8b64-cba20ecb8fb3
date: Fri, 03 Apr 2020 07:20:20 GMT
x-download-options: noopen
access-control-allow-origin: https://word-view.officeapps.live.com
cache-control: private
x-msedge-ref: Ref A: 1675C4DD33ED43899B99023CAD7415DA Ref B: AMS04EDGE0721 Ref C: 2020-04-03T07:20:21Z
timing-allow-origin: *

POST
H2 200 RemoteTelemetry.ashx Show response
word-view.officeapps.live.com/wv/ Frame 4CCA 0
427 B 104ms
104ms XHR
text/plain 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/RemoteTelemetry.ashx

Requested by

Host: c1-word-view-15.cdn.office.net
URL: https://c1-word-view-15.cdn.office.net/wv/s/161280233700_App_Scripts/WordViewer.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=1UfIOdYMjE62IthSSCWlyQ.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FC90690F3AEC757E1%212876&sc=host%3D%26qt%3DFolders%26pt%3Dem
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-officefd: BL2PEPF00000BB5
x-officeversion: 16.0.12802.33700
x-officefe: BL2PEPF00001B6A
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115,1fxu=afd_waccluster_control
content-length: 0
x-msedge-features: tasmigration015,typeheadertest,multitenanttasmigration_115,afd_waccluster_control
x-correlationid: 418184a6-2be4-4c2d-b0d1-47e4a9dcb952
x-officecluster: US4
x-ccr: true
x-usersessionid: 418184a6-2be4-4c2d-b0d1-47e4a9dcb952
date: Fri, 03 Apr 2020 07:20:20 GMT
x-download-options: noopen
access-control-allow-origin: https://word-view.officeapps.live.com
cache-control: private
x-msedge-ref: Ref A: 870604382D774C2588E037727D5A16C2 Ref B: AMS04EDGE0721 Ref C: 2020-04-03T07:20:21Z
timing-allow-origin: *

POST
H2 200 RemoteTelemetry.ashx Show response
word-view.officeapps.live.com/wv/ Frame 4CCA 0
177 B 105ms
105ms XHR
text/plain 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/RemoteTelemetry.ashx

Requested by

Host: c1-word-view-15.cdn.office.net
URL: https://c1-word-view-15.cdn.office.net/wv/s/161280233700_App_Scripts/WordViewer.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=1UfIOdYMjE62IthSSCWlyQ.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FC90690F3AEC757E1%212876&sc=host%3D%26qt%3DFolders%26pt%3Dem
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-officefd: BL2PEPF000023AC
x-officeversion: 16.0.12802.33700
x-officefe: BL2PEPF00003D31
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115cf
content-length: 0
x-msedge-features: tasmigration015,typeheadertest,multitenanttasmigration_115cf
x-correlationid: daf1ce8d-e237-4b2c-bda3-d73ce11c5eeb
x-officecluster: US4
x-ccr: true
x-usersessionid: daf1ce8d-e237-4b2c-bda3-d73ce11c5eeb
date: Fri, 03 Apr 2020 07:20:20 GMT
x-download-options: noopen
access-control-allow-origin: https://word-view.officeapps.live.com
cache-control: private
x-msedge-ref: Ref A: 96BEA71BD79945A6AE919FB845F431F1 Ref B: AMS04EDGE0721 Ref C: 2020-04-03T07:20:21Z
timing-allow-origin: *

POST
H2 200 RemoteUls.ashx Show response
word-view.officeapps.live.com/wv/ Frame 4CCA 0
316 B 103ms
103ms XHR
text/plain 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/RemoteUls.ashx?build=16.0.12802.33700&waccluster=US4

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=1UfIOdYMjE62IthSSCWlyQ.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FC90690F3AEC757E1%212876&sc=host%3D%26qt%3DFolders%26pt%3Dem
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: empty
X-UserSessionId: 39dbdd18-71ca-402d-9588-2047520bee02
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
X-BrowserUlsBeacon: [{"Index":2,"MsSinceStart":1856,"Value":"SplashScreenShown","Type":"BootPhaseCompleted"}]

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
x-officecluster: US4
x-officeversion: 16.0.12802.33700
x-officefe: BL2PEPF00001B80
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115,1fxu=afd_waccluster
content-length: 0
x-msedge-features: tasmigration015,typeheadertest,multitenanttasmigration_115,afd_waccluster
x-correlationid: 349aea74-30df-4d26-b08c-7c027036cf6d
x-officefd: BL2PEPF0000161F
x-ccr: true
x-usersessionid: 39dbdd18-71ca-402d-9588-2047520bee02
date: Fri, 03 Apr 2020 07:20:20 GMT
x-download-options: noopen
content-type: text/plain
access-control-allow-origin: https://word-view.officeapps.live.com
access-control-expose-headers: X-EndSession, X-CorrelationId, X-OfficeFE, X-NewKey, X-bULS-SuppressionETag, X-bULS-SuppressedTags
cache-control: private
x-msedge-ref: Ref A: 294D3BC0F8C24316B58F2372EB9483B3 Ref B: AMS04EDGE0721 Ref C: 2020-04-03T07:20:21Z
timing-allow-origin: *

GET
H/1.1 200
OK segoeui.woff
c1-word-view-15.cdn.office.net/wv/s/161280233700_resources/1033/ Frame 4CCA 22 KB
23 KB 11ms
11ms Font
font/x-woff 2a02:26f0:eb:381::1c24
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://c1-word-view-15.cdn.office.net/wv/s/161280233700_resources/1033/segoeui.woff

Requested by

Host: c1-word-view-15.cdn.office.net
URL: https://c1-word-view-15.cdn.office.net/wv/s/161280233700_App_Scripts/WordViewer.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:eb:381::1c24 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

3d785eb0a0168e5c79e66aa0085a932d5fe2ad04f3577547e2267fa589df677d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://c1-word-view-15.cdn.office.net/wv/s/161280233700_resources/1033/WordViewer.css
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: font
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

X-CorrelationId: ee480cbb-c1bf-470b-acf3-585acb496bfb
Strict-Transport-Security: max-age=31536000
X-OfficeCluster: US4
X-OfficeVersion: 16.0.12730.37776
X-OfficeFE: BL2PEPF00003D3F
P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
Date: Fri, 03 Apr 2020 07:20:21 GMT
Connection: keep-alive
X-MSEdge-Flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115cf,1fxu=afd_waccluster_control
Content-Length: 22720
X-MSEdge-Features: tasmigration015,typeheadertest,multitenanttasmigration_115cf,afd_waccluster_control
Last-Modified: Thu, 02 Apr 2020 22:08:03 GMT
X-OFFICEFD: BL2PEPF000023AE
X-MSEdge-Ref: Ref A: FECA6A5685534AD899E020489ABA50B6 Ref B: AM3EDGE0207 Ref C: 2020-04-02T22:08:03Z
X-UserSessionId: ee480cbb-c1bf-470b-acf3-585acb496bfb
ETag: W/"edf84d2e3b9d61:0"
Content-Type: font/x-woff
Access-Control-Allow-Origin: *
Cache-Control: public,max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *

GET
H2 200 docdatahandler.ashx Show response
word-view.officeapps.live.com/wv/ Frame 4CCA 356 B
783 B 297ms
296ms XHR
text/xml 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/docdatahandler.ashx?WOPIsrc=https%3A%2F%2Fwopi%2Eonedrive%2Ecom%2Fwopi%2Ffiles%2FC90690F3AEC757E1%212876&access_token=4w9UhybyEzcpikzcA9evEgvtxDnRNv7zfCEGYzmE6KgxXTO1gVjtJNEzn8IeI13BwdYwabjpJOTLpuvzFlsPJnSGZS9P5XijTpPE3iOTZNLel17mSRuKkZd%2DPuPZSztURhtoqWHn%5FFRevuHh6SZHocgA&access_token_ttl=1587712818938&z=aQzkwNjkwRjNBRUM3NTdFMSEyODc2LjU&type=png&o15=1&ui=en-US&PdfMode=1

Requested by

Host: c1-officeapps-15.cdn.office.net
URL: https://c1-officeapps-15.cdn.office.net/wv/s/161280233700_App_Scripts/MicrosoftAjax.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

07e466488c33b5d8af43da21b2a677109b2a09db3c093ad9cb03d350aac4974d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

X-UserSessionId: 39dbdd18-71ca-402d-9588-2047520bee02
X-OfficeVersion: 16.0.12802.33700
X-Key: nzn/6PkQgc3VEDH20PSdf1UAa3wwmtAWFbXEOj8D2cE=,637214952193591962
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=1UfIOdYMjE62IthSSCWlyQ.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FC90690F3AEC757E1%212876&sc=host%3D%26qt%3DFolders%26pt%3Dem
Sec-Fetch-Dest: empty
X-Requested-With: XMLHttpRequest
X-UserType: WOPI
X-xhr: 1
X-WacCluster: US4

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
x-officecluster: US4
x-officeversion: 16.0.12802.33700
x-officefe: BL2PEPF00003D1B
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115cf
content-length: 351
x-msedge-features: tasmigration015,typeheadertest,multitenanttasmigration_115cf
x-correlationid: 470da13e-0521-4fd0-9a2e-5268045c9409
x-officefd: BL2PEPF0000161C
x-ccr: true
x-usersessionid: 39dbdd18-71ca-402d-9588-2047520bee02
date: Fri, 03 Apr 2020 07:20:20 GMT
x-download-options: noopen
vary: Accept-Encoding
content-type: text/xml; charset=utf-8
cache-control: private
x-msedge-ref: Ref A: F2C2EBA3876243498E30EFF7F6BD19D5 Ref B: AMS04EDGE0721 Ref C: 2020-04-03T07:20:21Z
timing-allow-origin: *
expires: Sat, 03 Apr 2021 07:20:21 GMT

GET
H/1.1 200
OK wacairspaceanimationlibrary.js Show response
c1-officeapps-15.cdn.office.net/wv/s/161280233700_App_Scripts/ Frame 4CCA 40 KB
7 KB 7ms
7ms Script
application/javascript 2a02:26f0:eb:382::1c24
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://c1-officeapps-15.cdn.office.net/wv/s/161280233700_App_Scripts/wacairspaceanimationlibrary.js

Requested by

Host: c1-word-view-15.cdn.office.net
URL: https://c1-word-view-15.cdn.office.net/wv/s/161280233700_App_Scripts/WordViewer.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:eb:382::1c24 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

234cae682920ab63f3184948f1e4103b89201a274977ed31097b844cc323afa1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://word-view.officeapps.live.com/
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

X-CorrelationId: 6bb3800c-40f0-4d80-9fb6-88048f795e20
Strict-Transport-Security: max-age=31536000
Content-Encoding: br
X-OFFICEFD: BL6PEPF00000743
X-OfficeVersion: 16.0.12730.37776
X-OfficeFE: BL6PEPF00003D34
P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
Date: Fri, 03 Apr 2020 07:20:21 GMT
Connection: keep-alive
X-MSEdge-Flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115cf
Content-Length: 5997
Accept-Ranges: bytes
X-MSEdge-Features: tasmigration015,typeheadertest,multitenanttasmigration_115cf
Last-Modified: Thu, 02 Apr 2020 21:52:17 GMT
X-OfficeCluster: US6
X-CCR: true
X-UserSessionId: 6bb3800c-40f0-4d80-9fb6-88048f795e20
ETag: W/"6c84fff9389d61:0"
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: public,max-age=31536000
X-MSEdge-Ref: Ref A: AAE139D8A71B415BB862F4A6CB83EC6D Ref B: AMS04EDGE1014 Ref C: 2020-04-02T21:52:16Z
Timing-Allow-Origin: *

GET
H/1.1 200
OK wapsw.png
c1-officeapps-15.cdn.office.net/wv/s/161280233700_resources/1033/ Frame 4CCA 6 KB
7 KB 29ms
8ms Image
image/png 2a02:26f0:eb:382::1c24
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1-officeapps-15.cdn.office.net/wv/s/161280233700_resources/1033/wapsw.png?b=1601280233700

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:eb:382::1c24 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

390577d35c959ffe7dd2af4519c04410a04fdc4a433b151e27b049fc4a1ab3e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://word-view.officeapps.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

X-CorrelationId: 131c5312-4ff4-4f2d-b467-c4a65f10c942
Strict-Transport-Security: max-age=31536000
X-OFFICEFD: BL2PEPF0000313E
X-OfficeVersion: 16.0.12730.37776
X-OfficeFE: BL2PEPF00001CEF
P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
Date: Fri, 03 Apr 2020 07:20:21 GMT
Connection: keep-alive
X-MSEdge-Flight: qx9=tasmigration015,skb=typeheadertest,1fxu=afd_waccluster
Content-Length: 5884
Accept-Ranges: bytes
X-MSEdge-Features: tasmigration015,typeheadertest,afd_waccluster
Last-Modified: Thu, 02 Apr 2020 22:07:11 GMT
X-OfficeCluster: US4
X-CCR: true
X-UserSessionId: 131c5312-4ff4-4f2d-b467-c4a65f10c942
ETag: W/"56cf64f3b9d61:0"
Content-Type: image/png
Access-Control-Allow-Origin: *
Cache-Control: public,max-age=31536000
X-MSEdge-Ref: Ref A: 8F80FCEE4CD847E0B4581C4BFA55E1CA Ref B: AM3EDGE0814 Ref C: 2020-04-02T22:07:10Z
Timing-Allow-Origin: *

GET
H/1.1 200
OK wv.png
c1-word-view-15.cdn.office.net/wv/s/161280233700_resources/1033/ Frame 4CCA 34 KB
35 KB 7ms
7ms Image
image/png 2a02:26f0:eb:381::1c24
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1-word-view-15.cdn.office.net/wv/s/161280233700_resources/1033/wv.png

Requested by

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:eb:381::1c24 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

e2bf7da51e85c834d5c051092c444ee3011f518773d51c253090505356ef9f73

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://word-view.officeapps.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

X-CorrelationId: a14c03cb-dfc5-4f36-a3c0-db0a602bc44e
Strict-Transport-Security: max-age=31536000
X-OfficeCluster: US6
X-OfficeVersion: 16.0.12730.37776
X-OfficeFE: BL6PEPF00002CF2
P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
Date: Fri, 03 Apr 2020 07:20:21 GMT
Connection: keep-alive
X-MSEdge-Flight: qx9=tasmigration015,skb=typeheadertest
Content-Length: 34788
X-MSEdge-Features: tasmigration015,typeheadertest
Last-Modified: Thu, 02 Apr 2020 21:56:10 GMT
X-OFFICEFD: BL6PEPF00000766
X-MSEdge-Ref: Ref A: 042D80EE7BC44E84A5B3F1A52EA700FC Ref B: AM3EDGE0520 Ref C: 2020-04-02T21:56:10Z
X-UserSessionId: a14c03cb-dfc5-4f36-a3c0-db0a602bc44e
ETag: W/"e5a1c85399d61:0"
Content-Type: image/png
Access-Control-Allow-Origin: *
Cache-Control: public,max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *

GET
H2 204 _log
uhf.microsoft.com/ Frame 4CCA 0
128 B 32ms
13ms Image
text/html 2a02:26f0:eb:3a4::2b57
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://uhf.microsoft.com/_log?o=mscc&s=officeapps.live.com&m=show&nv=aspnet-3.1.4&sv=0.1.2
Requested by: Host: word-view.officeapps.live.com
URL: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=1UfIOdYMjE62IthSSCWlyQ.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FC90690F3AEC757E1%212876&sc=host%3D%26qt%3DFolders%26pt%3Dem
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 2a02:26f0:eb:3a4::2b57 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://word-view.officeapps.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

pragma: no-cache
date: Fri, 03 Apr 2020 07:20:21 GMT
access-control-allow-origin: *
content-type: text/html
status: 204
cache-control: max-age=0, no-cache, no-store
content-length: 0
expires: Fri, 03 Apr 2020 07:20:21 GMT

GET
DATA 200
OK truncated
/ Frame 4CCA 183 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 19b132c556e33c005d831e1f6adcf21d7ff16f39ccf9c7fba0d2903099c0afeb

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ Frame 4CCA 185 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d091e132e22954ecf7403cce92be661694c7d32362e4a084d4824bff921e7127

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 34 KB
34 KB Font
font/woff

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 07ec698b1036cdfbb8892f02d9510f5f671284fca9fa003b883996da040a444b

Request headers

Origin: https://onedrive.live.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Content-Type: font/woff;charset=utf-8

GET
H2

200

c.gif
c.live.com/
Redirect Chain

https://c.live.com/c.gif?DI=15347&wlxid=6c538c12-eb44-4636-85ba-682ae29ff638&reqid=00178141ecb&csiperf=ANON%3D%26NL%3D0%26TP%3D0%26CL%3DRD0003FF9AF1B1%26MA%3Den-US%26B%3D0.0.0%26TR%3DNA%252ANA%252A...
https://c.bing.com/c.gif?DI=15347&wlxid=6c538c12-eb44-4636-85ba-682ae29ff638&reqid=00178141ecb&csiperf=ANON%3D%26NL%3D0%26TP%3D0%26CL%3DRD0003FF9AF1B1%26MA%3Den-US%26B%3D0.0.0%26TR%3DNA%252ANA%252A...
https://c.live.com/c.gif?DI=15347&wlxid=6c538c12-eb44-4636-85ba-682ae29ff638&reqid=00178141ecb&csiperf=ANON%3D%26NL%3D0%26TP%3D0%26CL%3DRD0003FF9AF1B1%26MA%3Den-US%26B%3D0.0.0%26TR%3DNA%252ANA%252A...

42 B
300 B

28ms
28ms

Image
image/gif

52.142.114.2
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.live.com/c.gif?DI=15347&wlxid=6c538c12-eb44-4636-85ba-682ae29ff638&reqid=00178141ecb&csiperf=ANON%3D%26NL%3D0%26TP%3D0%26CL%3DRD0003FF9AF1B1%26MA%3Den-US%26B%3D0.0.0%26TR%3DNA%252ANA%252A%253ASDX.Skydrive%252AEmbed.default.F.U.%26PLT%3D3692%26IR%3D1%26EX%3D0%26L.h%3D1448%26L.sjs%3D1579%26L.ttg%3D1448%26C.st%3D1585898417769%26N.domIn%3D1456%26N.dns%3D2%26N.tcp%3D43%26N.req%3D1238%26N.resp%3D8%26N.navType%3D0%26N.redirectCount%3D0&r=0.3778343681037799&CtsSyncId=9C0E81060B614B70A1858A8D4C6E918A&MUID=27FF83F3790B657F1A378D52787A6454
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.142.114.2 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

Referer: https://onedrive.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

pragma: no-cache
date: Fri, 03 Apr 2020 07:20:20 GMT
last-modified: Thu, 02 Apr 2020 17:14:08 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
etag: "71b3b81e129d61:0"
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
status: 200
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-type: image/gif
content-length: 42

Redirect headers

pragma: no-cache
date: Fri, 03 Apr 2020 07:20:21 GMT
x-msedge-ref: Ref A: 1C2CD4EA0B214AA4B1CC36D35467177A Ref B: FRAEDGE0815 Ref C: 2020-04-03T07:20:21Z
x-powered-by: ASP.NET
location: https://c.live.com/c.gif?DI=15347&wlxid=6c538c12-eb44-4636-85ba-682ae29ff638&reqid=00178141ecb&csiperf=ANON%3D%26NL%3D0%26TP%3D0%26CL%3DRD0003FF9AF1B1%26MA%3Den-US%26B%3D0.0.0%26TR%3DNA%252ANA%252A%253ASDX.Skydrive%252AEmbed.default.F.U.%26PLT%3D3692%26IR%3D1%26EX%3D0%26L.h%3D1448%26L.sjs%3D1579%26L.ttg%3D1448%26C.st%3D1585898417769%26N.domIn%3D1456%26N.dns%3D2%26N.tcp%3D43%26N.req%3D1238%26N.resp%3D8%26N.navType%3D0%26N.redirectCount%3D0&r=0.3778343681037799&CtsSyncId=9C0E81060B614B70A1858A8D4C6E918A&MUID=27FF83F3790B657F1A378D52787A6454
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
status: 302
cache-control: private, no-cache, proxy-revalidate, no-store
content-length: 0

POST
H2 200 RemoteUls.ashx Show response
word-view.officeapps.live.com/wv/ Frame 4CCA 0
529 B 104ms
103ms XHR
text/plain 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/RemoteUls.ashx?build=16.0.12802.33700&waccluster=US4

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=1UfIOdYMjE62IthSSCWlyQ.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FC90690F3AEC757E1%212876&sc=host%3D%26qt%3DFolders%26pt%3Dem
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: empty
X-UserSessionId: 39dbdd18-71ca-402d-9588-2047520bee02
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
X-BrowserUlsBeacon: [{"Index":3,"MsSinceStart":2193,"Value":"RecordAppInteractive","Type":"BootPhaseCompleted"}]

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
x-officecluster: US4
x-officeversion: 16.0.12802.33700
x-officefe: BL2PEPF00001B82
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115cf,1fxu=afd_waccluster
content-length: 0
x-msedge-features: tasmigration015,typeheadertest,multitenanttasmigration_115cf,afd_waccluster
x-correlationid: 8c8f67ab-bae4-4d8d-91fe-7fa8ccf4385e
x-officefd: BL2PEPF0000161F
x-ccr: true
x-usersessionid: 39dbdd18-71ca-402d-9588-2047520bee02
date: Fri, 03 Apr 2020 07:20:20 GMT
x-download-options: noopen
content-type: text/plain
access-control-allow-origin: https://word-view.officeapps.live.com
access-control-expose-headers: X-EndSession, X-CorrelationId, X-OfficeFE, X-NewKey, X-bULS-SuppressionETag, X-bULS-SuppressedTags
cache-control: private
x-msedge-ref: Ref A: 3CC2E835B76B4C0BA9D9DDC1E7B5B987 Ref B: AMS04EDGE0721 Ref C: 2020-04-03T07:20:21Z
timing-allow-origin: *

GET
H/1.1 200
OK WordViewer.dll1.js Show response
c1-word-view-15.cdn.office.net/wv/s/161280233700_App_Scripts/ Frame 4CCA 469 KB
99 KB 8ms
8ms Script
application/javascript 2a02:26f0:eb:381::1c24
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://c1-word-view-15.cdn.office.net/wv/s/161280233700_App_Scripts/WordViewer.dll1.js

Requested by

Host: c1-word-view-15.cdn.office.net
URL: https://c1-word-view-15.cdn.office.net/wv/s/161280233700_App_Scripts/WordViewer.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:eb:381::1c24 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

6e3375cb982d2d97cdc9421d1d7de7407fbf47b1a28fb76a728a735da57ceff6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://word-view.officeapps.live.com/
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

X-CorrelationId: 5bf5c313-1e73-4e57-aebe-9b533bea7da5
Strict-Transport-Security: max-age=31536000
Content-Encoding: br
X-OFFICEFD: BL2PEPF00001187
X-OfficeVersion: 16.0.12730.37776
X-OfficeFE: BL2PEPF00001B6A
P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
Date: Fri, 03 Apr 2020 07:20:21 GMT
Connection: keep-alive
X-MSEdge-Flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115cf,1fxu=afd_waccluster
Content-Length: 100409
Accept-Ranges: bytes
X-MSEdge-Features: tasmigration015,typeheadertest,multitenanttasmigration_115cf,afd_waccluster
Last-Modified: Thu, 02 Apr 2020 21:53:20 GMT
X-OfficeCluster: US4
X-CCR: true
X-UserSessionId: 5bf5c313-1e73-4e57-aebe-9b533bea7da5
ETag: W/"5c70e11f399d61:0"
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: public,max-age=31536000
X-MSEdge-Ref: Ref A: 358A2CED830F4AAD8ACA05C5040299F9 Ref B: AMS04EDGE0815 Ref C: 2020-04-02T21:53:20Z
Timing-Allow-Origin: *

GET
H/1.1 200
OK progress.gif
c1-officeapps-15.cdn.office.net/wv/s/161280233700_resources/1033/ Frame 4CCA 695 B
2 KB 16ms
14ms Image
image/gif 2a02:26f0:eb:382::1c24
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c1-officeapps-15.cdn.office.net/wv/s/161280233700_resources/1033/progress.gif

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:eb:382::1c24 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

a3596c17dad9a003d0bfbe0b7ba6765f51391b5c3943660316f01c8e77b323db

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://word-view.officeapps.live.com/
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

X-CorrelationId: 2f6c1a51-04bc-4c11-ad70-40e858b39f46
Strict-Transport-Security: max-age=31536000
X-OfficeCluster: US6
X-OfficeVersion: 16.0.12730.37776
X-OfficeFE: BL6PEPF00002D29
P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
Date: Fri, 03 Apr 2020 07:20:21 GMT
Connection: keep-alive
X-MSEdge-Flight: qx9=tasmigration015,skb=typeheadertest
Content-Length: 695
X-MSEdge-Features: tasmigration015,typeheadertest
Last-Modified: Thu, 02 Apr 2020 21:56:12 GMT
X-OFFICEFD: BL6PEPF00000769
X-MSEdge-Ref: Ref A: C370832B8C7C499C97A1D15E742EEB6F Ref B: AM3EDGE0519 Ref C: 2020-04-02T21:56:12Z
X-UserSessionId: 2f6c1a51-04bc-4c11-ad70-40e858b39f46
ETag: W/"ff271186399d61:0"
Content-Type: image/gif
Access-Control-Allow-Origin: *
Cache-Control: public,max-age=31536000
Accept-Ranges: bytes
Timing-Allow-Origin: *

GET
H2 200 ResReader.ashx
word-view.officeapps.live.com/wv/ Frame 4CCA 35 KB
35 KB 314ms
312ms Image
image/png 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://word-view.officeapps.live.com/wv/ResReader.ashx?n=p1.img&v=00000000-0000-0000-0000-000000000802&usid=39dbdd18-71ca-402d-9588-2047520bee02&build=16.0.12802.33700&WOPIsrc=https%3A%2F%2Fwopi%2Eonedrive%2Ecom%2Fwopi%2Ffiles%2FC90690F3AEC757E1%212876&access_token=4w9UhybyEzcpikzcA9evEgvtxDnRNv7zfCEGYzmE6KgxXTO1gVjtJNEzn8IeI13BwdYwabjpJOTLpuvzFlsPJnSGZS9P5XijTpPE3iOTZNLel17mSRuKkZd%2DPuPZSztURhtoqWHn%5FFRevuHh6SZHocgA&access_token_ttl=1587712818938&z=aQzkwNjkwRjNBRUM3NTdFMSEyODc2LjU&waccluster=US4&PdfMode=1

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

d0d2c82a1965d5ce450e7ee024382b373aa4643c18871b866657e694ab414c32

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=1UfIOdYMjE62IthSSCWlyQ.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FC90690F3AEC757E1%212876&sc=host%3D%26qt%3DFolders%26pt%3Dem
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-officecluster: US4
x-officeversion: 16.0.12802.33700
x-officefe: BL2PEPF00003D32
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115
content-length: 35794
etag: "WOPIsrc=https%3A%2F%2Fwopi%2Eonedrive%2Ecom%2Fwopi%2Ffiles%2FC90690F3AEC757E1%212876&access_token=4w9UhybyEzcpikzcA9evEgvtxDnRNv7zfCEGYzmE6KgxXTO1gVjtJNEzn8IeI13BwdYwabjpJOTLpuvzFlsPJnSGZS9P5XijTpPE3iOTZNLel17mSRuKkZd%2DPuPZSztURhtoqWHn%5FFRevuHh6SZHocgA&access_token_ttl=1587712818938&z=aQzkwNjkwRjNBRUM3NTdFMSEyODc2LjU00000000-0000-0000-0000-000000000802p1.img"
x-msedge-features: tasmigration015,typeheadertest,multitenanttasmigration_115
x-correlationid: c2a09231-d2f8-443d-b950-410638d1379a
x-officefd: BL2PEPF000023AC
x-ccr: true
x-usersessionid: 39dbdd18-71ca-402d-9588-2047520bee02
date: Fri, 03 Apr 2020 07:20:20 GMT
x-download-options: noopen
content-type: image/png
cache-control: private
x-msedge-ref: Ref A: 66AC29C19D5B4F01A3424DC11624CC92 Ref B: AMS04EDGE0721 Ref C: 2020-04-03T07:20:21Z
timing-allow-origin: *
expires: Sat, 03 Apr 2021 07:20:21 GMT

GET
H2 200 ResReader.ashx Show response
word-view.officeapps.live.com/wv/ Frame 4CCA 1 KB
1 KB 314ms
313ms XHR
text/xml 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/ResReader.ashx?n=p_1_10.xml&v=00000000-0000-0000-0000-000000000802&usid=39dbdd18-71ca-402d-9588-2047520bee02&build=16.0.12802.33700&WOPIsrc=https%3A%2F%2Fwopi%2Eonedrive%2Ecom%2Fwopi%2Ffiles%2FC90690F3AEC757E1%212876&access_token=4w9UhybyEzcpikzcA9evEgvtxDnRNv7zfCEGYzmE6KgxXTO1gVjtJNEzn8IeI13BwdYwabjpJOTLpuvzFlsPJnSGZS9P5XijTpPE3iOTZNLel17mSRuKkZd%2DPuPZSztURhtoqWHn%5FFRevuHh6SZHocgA&access_token_ttl=1587712818938&z=aQzkwNjkwRjNBRUM3NTdFMSEyODc2LjU&waccluster=US4&PdfMode=1

Requested by

Host: c1-officeapps-15.cdn.office.net
URL: https://c1-officeapps-15.cdn.office.net/wv/s/161280233700_App_Scripts/MicrosoftAjax.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

6f4c1043c1b30d0a50bee11719733c0f72df1fd67afec13e2ca8da750c262786

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

X-UserSessionId: 39dbdd18-71ca-402d-9588-2047520bee02
X-OfficeVersion: 16.0.12802.33700
X-Key: nzn/6PkQgc3VEDH20PSdf1UAa3wwmtAWFbXEOj8D2cE=,637214952193591962
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=1UfIOdYMjE62IthSSCWlyQ.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FC90690F3AEC757E1%212876&sc=host%3D%26qt%3DFolders%26pt%3Dem
Sec-Fetch-Dest: empty
X-Requested-With: XMLHttpRequest
X-UserType: WOPI
X-xhr: 1
X-WacCluster: US4

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
x-officecluster: US4
x-officeversion: 16.0.12802.33700
x-officefe: BL2PEPF00002FCE
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115
content-length: 718
etag: "WOPIsrc=https%3A%2F%2Fwopi%2Eonedrive%2Ecom%2Fwopi%2Ffiles%2FC90690F3AEC757E1%212876&access_token=4w9UhybyEzcpikzcA9evEgvtxDnRNv7zfCEGYzmE6KgxXTO1gVjtJNEzn8IeI13BwdYwabjpJOTLpuvzFlsPJnSGZS9P5XijTpPE3iOTZNLel17mSRuKkZd%2DPuPZSztURhtoqWHn%5FFRevuHh6SZHocgA&access_token_ttl=1587712818938&z=aQzkwNjkwRjNBRUM3NTdFMSEyODc2LjU00000000-0000-0000-0000-000000000802p_1_10.xml"
x-msedge-features: tasmigration015,typeheadertest,multitenanttasmigration_115
x-correlationid: e47b8e3e-a7ed-4ed1-80aa-74994d43912a
x-officefd: BL2PEPF00002391
x-ccr: true
x-usersessionid: 39dbdd18-71ca-402d-9588-2047520bee02
date: Fri, 03 Apr 2020 07:20:20 GMT
x-download-options: noopen
vary: Accept-Encoding
content-type: text/xml; charset=utf-8
cache-control: private
x-msedge-ref: Ref A: F80A03E3513B4F57B0FDB39FDAA841E2 Ref B: AMS04EDGE0721 Ref C: 2020-04-03T07:20:21Z
timing-allow-origin: *
expires: Sat, 03 Apr 2021 07:20:21 GMT

GET
H/1.1 200
OK wl.ms.js Show response
js.live.net/v5.0/ Frame 4CCA 42 KB
16 KB 156ms
36ms Script
application/javascript 23.77.209.8
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://js.live.net/v5.0/wl.ms.js
Requested by: Host: c1-word-view-15.cdn.office.net
URL: https://c1-word-view-15.cdn.office.net/wv/s/161280233700_App_Scripts/WordViewer.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_CBC
Server: 23.77.209.8 , Netherlands, ASN20940 (AKAMAI-ASN1, US),
Reverse DNS: a23-77-209-8.deploy.static.akamaitechnologies.com
Software: Microsoft-IIS/10.0 /
Resource Hash: d4c9bd86a5465d8414b7a10438d28110836126b387990d492fe545a5e701904a

Request headers

Referer: https://word-view.officeapps.live.com/
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 03 Apr 2020 07:20:21 GMT
X-MSNServer: RD0003FF23C812
X-ODWebServer: westeurope1-odwebp
Last-Modified: Thu, 02 Jan 2020 22:15:34 GMT
Server: Microsoft-IIS/10.0
ETag: "0c7427bac1d51:0"
Vary: Accept-Encoding
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: public, max-age=58723, public
Connection: keep-alive
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Length: 16199

POST
H2 200 RemoteUls.ashx Show response
word-view.officeapps.live.com/wv/ Frame 4CCA 0
319 B 102ms
102ms XHR
text/plain 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/RemoteUls.ashx?build=16.0.12802.33700&waccluster=US4

Requested by

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=1UfIOdYMjE62IthSSCWlyQ.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FC90690F3AEC757E1%212876&sc=host%3D%26qt%3DFolders%26pt%3Dem
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: empty
X-UserSessionId: 39dbdd18-71ca-402d-9588-2047520bee02
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
X-BrowserUlsBeacon: [{"Index":4,"MsSinceStart":2528,"Value":"RecordContentDisplayed","Type":"BootPhaseCompleted"}]

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
x-officecluster: US4
x-officeversion: 16.0.12802.33700
x-officefe: BL2PEPF00003D0D
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115
content-length: 0
x-msedge-features: tasmigration015,typeheadertest,multitenanttasmigration_115
x-correlationid: 26de8d9d-5828-49b8-8cdc-bff33f8210fb
x-officefd: BL2PEPF000018C0
x-ccr: true
x-usersessionid: 39dbdd18-71ca-402d-9588-2047520bee02
date: Fri, 03 Apr 2020 07:20:21 GMT
x-download-options: noopen
content-type: text/plain
access-control-allow-origin: https://word-view.officeapps.live.com
access-control-expose-headers: X-EndSession, X-CorrelationId, X-OfficeFE, X-NewKey, X-bULS-SuppressionETag, X-bULS-SuppressedTags
cache-control: private
x-msedge-ref: Ref A: D6B87B76A54349289EA7F75785DA989E Ref B: AMS04EDGE0721 Ref C: 2020-04-03T07:20:21Z
timing-allow-origin: *

POST
H2 200 RemoteUls.ashx Show response
word-view.officeapps.live.com/wv/ Frame 4CCA 0
204 B 103ms
102ms XHR
text/plain 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/RemoteUls.ashx?build=16.0.12802.33700&waccluster=US4

Requested by

Host: c1-officeapps-15.cdn.office.net
URL: https://c1-officeapps-15.cdn.office.net/wv/s/161280233700_App_Scripts/MicrosoftAjax.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Origin: https://word-view.officeapps.live.com
X-AccessToken: 4w9UhybyEzcpikzcA9evEgvtxDnRNv7zfCEGYzmE6KgxXTO1gVjtJNEzn8IeI13BwdYwabjpJOTLpuvzFlsPJnSGZS9P5XijTpPE3iOTZNLel17mSRuKkZd-PuPZSztURhtoqWHn_FRevuHh6SZHocgA
X-UserSessionId: 39dbdd18-71ca-402d-9588-2047520bee02
X-OfficeVersion: 16.0.12802.33700
X-Key: nzn/6PkQgc3VEDH20PSdf1UAa3wwmtAWFbXEOj8D2cE=,637214952193591962
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
X-bULS-SuppressionETag: CB7FB6AB0DDCED672A3B305653956547720DBD13
Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=1UfIOdYMjE62IthSSCWlyQ.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FC90690F3AEC757E1%212876&sc=host%3D%26qt%3DFolders%26pt%3Dem
Sec-Fetch-Dest: empty
X-Requested-With: XMLHttpRequest
X-UserType: WOPI
X-xhr: 1
X-AccessTokenTtl: 1587712818938
X-WacCluster: US4

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
x-officecluster: US4
x-officeversion: 16.0.12802.33700
x-officefe: BL2PEPF00003D1D
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
x-buls-suppressionetag: CB7FB6AB0DDCED672A3B305653956547720DBD13
content-disposition: attachment
x-msedge-flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115
content-length: 0
x-msedge-features: tasmigration015,typeheadertest,multitenanttasmigration_115
x-correlationid: 260246a4-c7d3-4b03-af64-825d5dec4015
x-officefd: BL2PEPF0000161C
x-ccr: true
x-usersessionid: 39dbdd18-71ca-402d-9588-2047520bee02
date: Fri, 03 Apr 2020 07:20:21 GMT
x-download-options: noopen
content-type: text/plain
access-control-allow-origin: https://word-view.officeapps.live.com
access-control-expose-headers: X-EndSession, X-CorrelationId, X-OfficeFE, X-NewKey, X-bULS-SuppressionETag, X-bULS-SuppressedTags
cache-control: private
x-msedge-ref: Ref A: 8FDDB89C201943268984257BE16BE409 Ref B: AMS04EDGE0721 Ref C: 2020-04-03T07:20:21Z
timing-allow-origin: *

GET
H/1.1 200
OK otelFull.min.js Show response
c1-word-view-15.cdn.office.net/wv/s/161280233700_App_Scripts/ Frame 4CCA 169 KB
38 KB 12ms
12ms Script
application/javascript 2a02:26f0:eb:381::1c24
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://c1-word-view-15.cdn.office.net/wv/s/161280233700_App_Scripts/otelFull.min.js

Requested by

Host: c1-word-view-15.cdn.office.net
URL: https://c1-word-view-15.cdn.office.net/wv/s/161280233700_App_Scripts/WordViewer.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:eb:381::1c24 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

Resource Hash

b7236b99e4c8caf0258d06005b78ad5c54cb215b138cc09b30ed42ec441a2712

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Referer: https://word-view.officeapps.live.com/
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: script
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

X-CorrelationId: df4ddd10-b8fc-4270-a3ee-cee575ba27a3
Strict-Transport-Security: max-age=31536000
Content-Encoding: br
X-OFFICEFD: BL6PEPF000028A7
X-OfficeVersion: 16.0.12730.37776
X-OfficeFE: BL6PEPF0000343D
P3P: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
Date: Fri, 03 Apr 2020 07:20:21 GMT
Connection: keep-alive
X-MSEdge-Flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115
Content-Length: 37891
Accept-Ranges: bytes
X-MSEdge-Features: tasmigration015,typeheadertest,multitenanttasmigration_115
Last-Modified: Thu, 02 Apr 2020 21:52:18 GMT
X-OfficeCluster: US6
X-CCR: true
X-UserSessionId: df4ddd10-b8fc-4270-a3ee-cee575ba27a3
ETag: W/"91b9f0fa389d61:0"
Content-Type: application/javascript
Access-Control-Allow-Origin: *
Cache-Control: public,max-age=31536000
X-MSEdge-Ref: Ref A: 8B6DA2D4FE234A80AEAD50736956FCEA Ref B: AMS04EDGE1021 Ref C: 2020-04-02T21:52:18Z
Timing-Allow-Origin: *

POST
H2 200 RemoteTelemetry.ashx Show response
word-view.officeapps.live.com/wv/ Frame 4CCA 0
300 B 108ms
107ms XHR
text/plain 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/RemoteTelemetry.ashx

Requested by

Host: c1-word-view-15.cdn.office.net
URL: https://c1-word-view-15.cdn.office.net/wv/s/161280233700_App_Scripts/WordViewer.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=1UfIOdYMjE62IthSSCWlyQ.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FC90690F3AEC757E1%212876&sc=host%3D%26qt%3DFolders%26pt%3Dem
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-officefd: BL2PEPF00002391
x-officeversion: 16.0.12802.33700
x-officefe: BL2PEPF00002FD1
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115
content-length: 0
x-msedge-features: tasmigration015,typeheadertest,multitenanttasmigration_115
x-correlationid: 33b7a6fa-36fa-4ee3-b481-fe112ef88e19
x-officecluster: US4
x-ccr: true
x-usersessionid: 33b7a6fa-36fa-4ee3-b481-fe112ef88e19
date: Fri, 03 Apr 2020 07:20:21 GMT
x-download-options: noopen
access-control-allow-origin: https://word-view.officeapps.live.com
cache-control: private
x-msedge-ref: Ref A: 633BCC02364F415A9C2D9D8B2114B651 Ref B: AMS04EDGE0721 Ref C: 2020-04-03T07:20:21Z
timing-allow-origin: *

POST
H2 200 RemoteTelemetry.ashx
word-view.officeapps.live.com/wv/ Frame 4CCA 0
275 B 104ms
103ms Other
text/plain 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/RemoteTelemetry.ashx

Requested by

Host: c1-word-view-15.cdn.office.net
URL: https://c1-word-view-15.cdn.office.net/wv/s/161280233700_App_Scripts/WordViewer.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=1UfIOdYMjE62IthSSCWlyQ.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FC90690F3AEC757E1%212876&sc=host%3D%26qt%3DFolders%26pt%3Dem
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

strict-transport-security: max-age=31536000
x-content-type-options: nosniff
x-officefd: BL2PEPF000023AC
x-officeversion: 16.0.12802.33700
x-officefe: BL2PEPF00003D34
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
content-disposition: attachment
x-msedge-flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115
content-length: 0
x-msedge-features: tasmigration015,typeheadertest,multitenanttasmigration_115
x-correlationid: d4240dde-9a76-4fa2-b3ae-59a11781bb68
x-officecluster: US4
x-ccr: true
x-usersessionid: d4240dde-9a76-4fa2-b3ae-59a11781bb68
date: Fri, 03 Apr 2020 07:20:21 GMT
x-download-options: noopen
access-control-allow-origin: https://word-view.officeapps.live.com
cache-control: private
x-msedge-ref: Ref A: D0B50A0A246A495AB3FC7C5F73388429 Ref B: AMS04EDGE0721 Ref C: 2020-04-03T07:20:21Z
timing-allow-origin: *

GET
H/1.1 200
OK ping Show response
browser.pipe.aria.microsoft.com/ Frame 4CCA 4 B
333 B 501ms
123ms XHR
application/json 52.114.128.71
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://browser.pipe.aria.microsoft.com/ping
Requested by: Host: c1-word-view-15.cdn.office.net
URL: https://c1-word-view-15.cdn.office.net/wv/s/161280233700_App_Scripts/otelFull.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.114.128.71 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-HTTPAPI/2.0 /
Resource Hash: c48b5b1a9776c84602de2306d7903a7241158a5077e7a8519af75c33441b8334

Request headers

Referer: https://word-view.officeapps.live.com/
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 03 Apr 2020 07:20:22 GMT
Server: Microsoft-HTTPAPI/2.0
Access-Control-Allow-Methods: GET
Content-Type: application/json; charset=utf-8
Access-Control-Allow-Origin: https://word-view.officeapps.live.com
Access-Control-Allow-Credentials: true
Access-Control-Allow-Headers: *
Content-Length: 4

GET
H2 200 translation.ashx Show response
word-view.officeapps.live.com/wv/ Frame 4CCA 1 KB
1 KB 292ms
291ms XHR
text/html 2620:1ec:a92::171
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://word-view.officeapps.live.com/wv/translation.ashx?WOPIsrc=https%3A%2F%2Fwopi%2Eonedrive%2Ecom%2Fwopi%2Ffiles%2FC90690F3AEC757E1%212876&access_token=4w9UhybyEzcpikzcA9evEgvtxDnRNv7zfCEGYzmE6KgxXTO1gVjtJNEzn8IeI13BwdYwabjpJOTLpuvzFlsPJnSGZS9P5XijTpPE3iOTZNLel17mSRuKkZd%2DPuPZSztURhtoqWHn%5FFRevuHh6SZHocgA&access_token_ttl=1587712818938&z=aQzkwNjkwRjNBRUM3NTdFMSEyODc2LjU&uilang=en-US

Requested by

Host: c1-officeapps-15.cdn.office.net
URL: https://c1-officeapps-15.cdn.office.net/wv/s/161280233700_App_Scripts/MicrosoftAjax.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:a92::171 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

a719a01cdecb973a3ae5b6b425deef5e6c7432c0850bb86c9d5cc43723eba2de

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

X-UserSessionId: 39dbdd18-71ca-402d-9588-2047520bee02
X-OfficeVersion: 16.0.12802.33700
X-Key: nzn/6PkQgc3VEDH20PSdf1UAa3wwmtAWFbXEOj8D2cE=,637214952193591962
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Referer: https://word-view.officeapps.live.com/wv/wordviewerframe.aspx?embed=1&PdfMode=1&ui=en-US&rs=en-US&hid=1UfIOdYMjE62IthSSCWlyQ.0&WOPISrc=https%3A%2F%2Fwopi.onedrive.com%2Fwopi%2Ffiles%2FC90690F3AEC757E1%212876&sc=host%3D%26qt%3DFolders%26pt%3Dem
Sec-Fetch-Dest: empty
X-Requested-With: XMLHttpRequest
X-UserType: WOPI
X-xhr: 1
X-WacCluster: US4

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
x-officecluster: US4
x-officeversion: 16.0.12802.33700
x-officefe: BL2PEPF00003D5A
p3p: CP="CAO DSP COR ADMa DEV CONi TELi CUR PSA PSD TAI IVDi OUR SAMi BUS DEM NAV STA UNI COM INT PHY ONL FIN PUR"
status: 200
x-msedge-flight: qx9=tasmigration015,skb=typeheadertest,1fvv=multitenanttasmigration_115
content-length: 975
pragma: no-cache
x-msedge-features: tasmigration015,typeheadertest,multitenanttasmigration_115
x-correlationid: cd3cfa69-1bfa-4afa-9508-48aacef1546b
x-officefd: BL2PEPF00000BE3
x-ccr: true
x-usersessionid: 39dbdd18-71ca-402d-9588-2047520bee02
date: Fri, 03 Apr 2020 07:20:21 GMT
vary: Accept-Encoding
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store
x-msedge-ref: Ref A: 2EFE90AFC19E474BAF0EA13E6AD7C35E Ref B: AMS04EDGE0721 Ref C: 2020-04-03T07:20:22Z
timing-allow-origin: *
expires: -1

POST
H/1.1 200
OK / Show response
browser.pipe.aria.microsoft.com/Collector/3.0/ Frame 4CCA 0
396 B 231ms
230ms XHR
application/json 52.114.128.71
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://browser.pipe.aria.microsoft.com/Collector/3.0/?qsp=true&content-type=application%2Fbond-compact-binary&client-id=NO_AUTH&sdk-version=AWT-Web-JS-1.8.6&x-apikey=e064ef4d9cdb454d9eddb2f7f7a94c83-89a6d9df-7218-4efd-bcd4-16ea059deea2-7672,ff7e2f12a4be407096fc01eeb760eda3-eeeb63cf-35d9-4734-ab45-66a873412359-7045,79b56d2f6f2444f1a3d7f7c7f12bcc0c-f47f5fe6-ed89-42f6-8a43-cea0f5930b17-7407&client-time-epoch-millis=1585898424028&time-delta-to-apply-millis=use-collector-delta
Requested by: Host: c1-word-view-15.cdn.office.net
URL: https://c1-word-view-15.cdn.office.net/wv/s/161280233700_App_Scripts/otelFull.min.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.114.128.71 Des Moines, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-HTTPAPI/2.0 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://word-view.officeapps.live.com/
Origin: https://word-view.officeapps.live.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Response headers

Date: Fri, 03 Apr 2020 07:20:24 GMT
Server: Microsoft-HTTPAPI/2.0
time-delta-millis: 51
Access-Control-Allow-Methods: POST
Content-Type: application/json
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: kill-tokens, kill-duration-seconds, time-delta-millis
Access-Control-Allow-Headers: Accept, Content-Type, Content-Encoding, Client-Id
Content-Length: 0

GET
H2 200 Plt.mvc
onedrive.live.com/Handlers/ 42 B
520 B 130ms
129ms Image
image/gif 13.107.42.13
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://onedrive.live.com/Handlers/Plt.mvc?bicild=&v=0.0.0

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

13.107.42.13 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://onedrive.live.com/embed?cid=C90690F3AEC757E1&resid=C90690F3AEC757E1%212876&authkey=APnzSKXiWm6qzBs&em=2
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Sec-Fetch-Dest: image

Response headers

strict-transport-security: max-age=31536000
content-encoding: gzip
x-content-type-options: nosniff
x-msedge-ref: Ref A: 82595D7FE1E4453E8FF99F2F721C583B Ref B: LON21EDGE1520 Ref C: 2020-04-03T07:20:26Z
x-odwebserver: centralus0-odwebpl
vary: Accept-Encoding
content-type: image/gif
status: 200
cache-control: private, max-age=31536000
date: Fri, 03 Apr 2020 07:20:26 GMT
x-msnserver: RD0003FFA52EA2
expires: Sat, 03 Apr 2021 07:20:26 GMT

POST
H2 404 log Show response
onedrive.live.com/ 77 KB
77 KB 146ms
145ms XHR
text/html 13.107.42.13
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://onedrive.live.com/log

Requested by

Host: onedrive.live.com
URL: https://onedrive.live.com/embed?cid=C90690F3AEC757E1&resid=C90690F3AEC757E1%212876&authkey=APnzSKXiWm6qzBs&em=2

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

13.107.42.13 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

d0bd9a8b45fb2ed3e0a418fa305010fb3212f0fd5dcae955f95e27e2473ecfc8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Request headers

Referer: https://onedrive.live.com/embed?cid=C90690F3AEC757E1&resid=C90690F3AEC757E1%212876&authkey=APnzSKXiWm6qzBs&em=2
Origin: https://onedrive.live.com
Sec-Fetch-Dest: empty
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000
x-msnserver: RD0003FFA56CC8
x-content-type-options: nosniff
x-msedge-ref: Ref A: 2C2B34ED1A704F0EA1A6505921A9AD7F Ref B: LON21EDGE1520 Ref C: 2020-04-03T07:20:29Z
x-odwebserver: centralus0-odwebpl
content-type: text/html; charset=utf-8
status: 404
cache-control: no-cache, no-store
date: Fri, 03 Apr 2020 07:20:28 GMT
content-length: 78462
expires: -1

Verdicts & Comments Add Verdict or Comment

153 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			word-view.officeapps.live.com/wv	1969-12-31 23:59:59	Name: Value:
			.live.com/	1969-12-31 23:59:59	Name: BP Value: l=SDX.Skydrive&FR=&ST=

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

browser.pipe.aria.microsoft.com
c.bing.com
c.live.com
c.s-microsoft.com
c1-officeapps-15.cdn.office.net
c1-word-view-15.cdn.office.net
js.live.net
onedrive.live.com
spoprod-a.akamaihd.net
uhf.microsoft.com
word-view.officeapps.live.com
13.107.42.13
2.16.186.33
23.77.209.8
2620:1ec:a92::171
2620:1ec:c11::200
2a02:26f0:eb:381::1c24
2a02:26f0:eb:382::1c24
2a02:26f0:eb:390::356e
2a02:26f0:eb:3a4::2b57
52.114.128.71
52.142.114.2
06fe78141d1f3a435441a17ec8f9f46af7000af35aa0133c699c537d663607d0
07e466488c33b5d8af43da21b2a677109b2a09db3c093ad9cb03d350aac4974d
07ec698b1036cdfbb8892f02d9510f5f671284fca9fa003b883996da040a444b
1394b1c43663fa167060186091800d4cae0696af7b64c14f2848b44124074c7e
19b132c556e33c005d831e1f6adcf21d7ff16f39ccf9c7fba0d2903099c0afeb
234cae682920ab63f3184948f1e4103b89201a274977ed31097b844cc323afa1
2b72b6f91a48d89ff19198d9536ed412e0fc65060058452d044dc72316aaa2f0
390577d35c959ffe7dd2af4519c04410a04fdc4a433b151e27b049fc4a1ab3e9
3d785eb0a0168e5c79e66aa0085a932d5fe2ad04f3577547e2267fa589df677d
43145c313a1a22d0cbb6299b5ab6cfa103c5f793ae5f2639e5e5330b2c6f6243
455be57e5ca76be462428c7b127d03d0245952b7e00ca14e8bcb3bfe7584c758
4d54a5f9a58647882e3ecda9c1c0ef87af16911d42ad51b4e8b718f84443c553
5c15c38a2b7554cab332dfb9e87398220fcb9a285e18905a20a50b439cba7ccb
66c5d9882a954332c4aebef2386c7713a226fa617ddcd08d22f24e53ba5ec066
6d8ba81d1b60a18707722a1f2b62dad48a6acced95a1933f49a68b5016620b93
6e3375cb982d2d97cdc9421d1d7de7407fbf47b1a28fb76a728a735da57ceff6
6f4c1043c1b30d0a50bee11719733c0f72df1fd67afec13e2ca8da750c262786
725fce62c0a5ad22790d85352cc60bc1725afcce209eeff9363100fe8b73c69b
85115acdc1b70c4a47daa1da31011b67bde417cbb718c5b3c73a914b82781bfd
910f1f3ce687cfde1a12415fe73a4465e7a2f851177c33ca8e9f3b5c5f93c41c
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
a188e6c4c6729c3abbe6a34e45b5c3d7d65ffc659e1baa46632ffb1c876e815c
a3596c17dad9a003d0bfbe0b7ba6765f51391b5c3943660316f01c8e77b323db
a719a01cdecb973a3ae5b6b425deef5e6c7432c0850bb86c9d5cc43723eba2de
b190d4155e76a5bf081eb27816e71189fb46dec4d6300b15ab425e1d95b82457
b7236b99e4c8caf0258d06005b78ad5c54cb215b138cc09b30ed42ec441a2712
b7ab99f404e84cb71d274c9dca01c0b4a68b7adb20309c5f04387cb809cc0547
bd88d1e741693ab877b020059b46be7cf4ef62b46017b2489a8cd1bf9ce5b9fc
c0153afba2ee2258329d951763cc14531c98cdecfc22d55be2597cfad0cc6e54
c48b5b1a9776c84602de2306d7903a7241158a5077e7a8519af75c33441b8334
d091e132e22954ecf7403cce92be661694c7d32362e4a084d4824bff921e7127
d0bd9a8b45fb2ed3e0a418fa305010fb3212f0fd5dcae955f95e27e2473ecfc8
d0d2c82a1965d5ce450e7ee024382b373aa4643c18871b866657e694ab414c32
d315e2c934f0245c6fdffcf1e0d76fac45cfad61c496a9a4b7b37772f99f5f07
d4c9bd86a5465d8414b7a10438d28110836126b387990d492fe545a5e701904a
d6c15974b6181a68e9b74e4f38fbac81d640569ef0fbbaa3381cc59683a9763f
d9f6ed718316effd97e868acbcc37468fb67bfee276d08a5596ffcbcc7a81c79
e2bf7da51e85c834d5c051092c444ee3011f518773d51c253090505356ef9f73
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

onedrive.live.com Open in urlscan Pro 13.107.42.13 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Statistics

50 Requests

100 %HTTPS

55 %IPv6

7 Domains

11 Subdomains

11 IPs

4 Countries

1274 kBTransfer

4037 kBSize

2 Cookies

0 Outgoing links

Redirected requests

50 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 3 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

onedrive.live.com Open in urlscan Pro
13.107.42.13 Public Scan

Screenshot
Live screenshot

Full Image

50
Requests

100 %
HTTPS

55 %
IPv6

7
Domains

11
Subdomains

11
IPs

4
Countries

1274 kB
Transfer

4037 kB
Size

2
Cookies

50 HTTP transactions
3 data transactions