Mark of the Web

The "Mark of the Web" is an Internet Explorer compatibility feature inserted into HTML by browsers when using their "Save webpage" feature.

The comment includes the original URL that the HTML was cloned from.

References

IOK Rule (edit)

title: Mark of the Web
description: |
  The "Mark of the Web" is an Internet Explorer compatibility feature inserted into HTML by browsers when using their "Save webpage" feature.

  The comment includes the original URL that the HTML was cloned from.
references:
  - https://docs.microsoft.com/en-us/previous-versions/windows/internet-explorer/ie-developer/compatibility/ms537628(v=vs.85)?redirectedfrom=MSDN#what-is-the-mark-of-the-web

detection:
  motw:
    html|contains: "<!-- saved from url=("
  condition: motw

tags:
  - cloning