URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Submission: On April 27 via api from TR — Scanned from DE

Summary

This website contacted 45 IPs in 4 countries across 38 domains to perform 208 HTTP transactions. The main IP is 151.101.194.165, located in United States and belongs to FASTLY, US. The main domain is www.csoonline.com. The Cisco Umbrella rank of the primary domain is 226611.
TLS certificate: Issued by GlobalSign Atlas R3 DV TLS CA 2023 Q1 on March 1st 2023. Valid for: a year.
This is the only time www.csoonline.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
68 151.101.194.165 54113 (FASTLY)
1 2600:9000:249... 16509 (AMAZON-02)
13 143.204.89.43 16509 (AMAZON-02)
1 18.66.112.88 16509 (AMAZON-02)
1 104.18.11.47 13335 (CLOUDFLAR...)
2 2606:4700:e2:... 13335 (CLOUDFLAR...)
3 2a02:26f0:350... 20940 (AKAMAI-ASN1)
1 23.35.237.64 16625 (AKAMAI-AS)
1 2600:9000:225... 16509 (AMAZON-02)
3 2606:4700:10:... 13335 (CLOUDFLAR...)
2 52.222.236.19 16509 (AMAZON-02)
3 2a00:1450:400... 15169 (GOOGLE)
1 2a02:26f0:350... 20940 (AKAMAI-ASN1)
3 2a00:1450:400... 15169 (GOOGLE)
2 104.19.150.54 13335 (CLOUDFLAR...)
2 2a00:1450:400... 15169 (GOOGLE)
2 34.193.119.244 14618 (AMAZON-AES)
2 13.32.99.105 16509 (AMAZON-02)
1 64.185.227.155 18450 (WEBNX)
1 35.241.9.51 15169 (GOOGLE)
2 3 185.89.210.46 29990 (ASN-APPNEX)
7 34.107.254.252 396982 (GOOGLE-CL...)
8 3.248.88.116 16509 (AMAZON-02)
3 2a00:1450:400... 15169 (GOOGLE)
1 108.138.7.117 16509 (AMAZON-02)
2 2606:4700:20:... 13335 (CLOUDFLAR...)
3 2a00:1450:400... 15169 (GOOGLE)
2 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2001:4860:480... 15169 (GOOGLE)
2 2600:9000:215... 16509 (AMAZON-02)
2 13.32.99.84 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
39 104.244.42.3 13414 (TWITTER)
2 52.223.40.198 16509 (AMAZON-02)
3 12 76.223.111.18 16509 (AMAZON-02)
1 18.159.155.160 16509 (AMAZON-02)
1 34.120.133.55 396982 (GOOGLE-CL...)
5 6 142.250.186.66 15169 (GOOGLE)
1 2620:1ec:21::14 8068 (MICROSOFT...)
3 3 35.158.53.160 16509 (AMAZON-02)
2 2 3.126.89.100 16509 (AMAZON-02)
1 2620:1ec:c11:... 8068 (MICROSOFT...)
1 2a05:d018:d29... 16509 (AMAZON-02)
1 1 64.202.112.191 22075 (AS-OUTBRAIN)
2 2a00:1450:400... 15169 (GOOGLE)
208 45
Apex Domain
Subdomains
Transfer
68 csoonline.com
www.csoonline.com — Cisco Umbrella Rank: 226611
cmpv2.csoonline.com — Cisco Umbrella Rank: 660922
cmp.csoonline.com
486 KB
39 twitter.com
analytics.twitter.com — Cisco Umbrella Rank: 912
8 KB
15 3lift.com
ib.3lift.com — Cisco Umbrella Rank: 2197
eb2.3lift.com — Cisco Umbrella Rank: 535
tlx.3lift.com — Cisco Umbrella Rank: 797
66 KB
9 permutive.com
cdn.permutive.com — Cisco Umbrella Rank: 3232
api.permutive.com — Cisco Umbrella Rank: 2596
185 KB
9 doubleclick.net
securepubads.g.doubleclick.net — Cisco Umbrella Rank: 269
cm.g.doubleclick.net — Cisco Umbrella Rank: 313
150 KB
8 postrelease.com
jadserve.postrelease.com — Cisco Umbrella Rank: 1859
6 KB
8 staticworld.net
idge.staticworld.net — Cisco Umbrella Rank: 299508
pixel.staticworld.net — Cisco Umbrella Rank: 441977
11 KB
7 google.com
cse.google.com — Cisco Umbrella Rank: 4542
www.google.com — Cisco Umbrella Rank: 16
clients1.google.com — Cisco Umbrella Rank: 518
ampcid.google.com — Cisco Umbrella Rank: 2680
171 KB
6 idgesg.net
alt.idgesg.net — Cisco Umbrella Rank: 166365
images.idgesg.net — Cisco Umbrella Rank: 230970
66 KB
4 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 91
region1.google-analytics.com — Cisco Umbrella Rank: 1718
22 KB
4 typekit.net
use.typekit.net — Cisco Umbrella Rank: 920
p.typekit.net — Cisco Umbrella Rank: 1162
48 KB
3 bidswitch.net
x.bidswitch.net — Cisco Umbrella Rank: 427
1 KB
3 adnxs.com
ib.adnxs.com — Cisco Umbrella Rank: 319
3 KB
3 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 114
246 KB
3 subscribers.com
cdn.subscribers.com — Cisco Umbrella Rank: 43453
143 KB
3 sp-prod.net
ccpa.sp-prod.net — Cisco Umbrella Rank: 18372
ccpa-service.sp-prod.net — Cisco Umbrella Rank: 42549
20 KB
2 gstatic.com
fonts.gstatic.com
31 KB
2 creative-serving.com
ads.creative-serving.com — Cisco Umbrella Rank: 5985
1 KB
2 adsrvr.org
match.adsrvr.org — Cisco Umbrella Rank: 451
655 B
2 dwin2.com
www.dwin2.com — Cisco Umbrella Rank: 25567
134 KB
2 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 119
2 KB
2 brandmetrics.com
cdn.brandmetrics.com — Cisco Umbrella Rank: 3954
18 KB
2 scorecardresearch.com
sb.scorecardresearch.com — Cisco Umbrella Rank: 218
3 KB
2 fontawesome.com
use.fontawesome.com — Cisco Umbrella Rank: 1543
90 KB
1 zemanta.com
b1sync.zemanta.com — Cisco Umbrella Rank: 813
301 B
1 yahoo.com
pr-bh.ybp.yahoo.com — Cisco Umbrella Rank: 689
426 B
1 bing.com
c.bing.com — Cisco Umbrella Rank: 413
665 B
1 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 733
669 B
1 rlcdn.com
api.rlcdn.com — Cisco Umbrella Rank: 1060
254 B
1 google.de
ampcid.google.de — Cisco Umbrella Rank: 43848
369 B
1 soundcloud.com
w.soundcloud.com — Cisco Umbrella Rank: 15721
4 KB
1 prmutv.co
f5b3be27-f789-4ef1-8867-37c67da5b361.prmutv.co — Cisco Umbrella Rank: 225072
395 B
1 ipify.org
api.ipify.org — Cisco Umbrella Rank: 2662
143 B
1 techhive.com
images.techhive.com — Cisco Umbrella Rank: 400916
3 KB
1 jwplayer.com
cdn.jwplayer.com — Cisco Umbrella Rank: 2945
44 KB
1 ntv.io
s.ntv.io — Cisco Umbrella Rank: 5386
159 KB
1 indexww.com
js-sec.indexww.com — Cisco Umbrella Rank: 958
39 KB
1 cloudfront.net
d2zv5rkii46miq.cloudfront.net
2 KB
208 38
Domain Requested by
53 www.csoonline.com www.csoonline.com
39 analytics.twitter.com www.csoonline.com
13 cmpv2.csoonline.com www.csoonline.com
cmpv2.csoonline.com
12 eb2.3lift.com 3 redirects ib.3lift.com
eb2.3lift.com
8 jadserve.postrelease.com s.ntv.io
www.csoonline.com
7 api.permutive.com cdn.permutive.com
7 idge.staticworld.net www.csoonline.com
6 cm.g.doubleclick.net 5 redirects eb2.3lift.com
4 alt.idgesg.net www.csoonline.com
3 x.bidswitch.net 3 redirects
3 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
3 www.google.com cse.google.com
3 ib.adnxs.com 2 redirects cdn.permutive.com
3 www.googletagmanager.com www.csoonline.com
www.googletagmanager.com
3 securepubads.g.doubleclick.net www.csoonline.com
securepubads.g.doubleclick.net
3 cdn.subscribers.com www.csoonline.com
cdn.subscribers.com
3 use.typekit.net www.csoonline.com
use.typekit.net
2 fonts.gstatic.com fonts.googleapis.com
2 ads.creative-serving.com 2 redirects
2 match.adsrvr.org js-sec.indexww.com
eb2.3lift.com
2 ib.3lift.com www.csoonline.com
ib.3lift.com
2 www.dwin2.com www.googletagmanager.com
www.dwin2.com
2 fonts.googleapis.com client
2 cdn.brandmetrics.com www.csoonline.com
cdn.brandmetrics.com
2 sb.scorecardresearch.com www.csoonline.com
2 ccpa-service.sp-prod.net ccpa.sp-prod.net
2 cse.google.com www.csoonline.com
www.google.com
2 cdn.permutive.com www.csoonline.com
cdn.permutive.com
2 cmp.csoonline.com ccpa.sp-prod.net
2 images.idgesg.net www.csoonline.com
2 use.fontawesome.com www.csoonline.com
use.fontawesome.com
1 b1sync.zemanta.com 1 redirects
1 pr-bh.ybp.yahoo.com eb2.3lift.com
1 c.bing.com eb2.3lift.com
1 px.ads.linkedin.com eb2.3lift.com
1 api.rlcdn.com js-sec.indexww.com
1 tlx.3lift.com ib.3lift.com
1 ampcid.google.de www.google-analytics.com
1 pixel.staticworld.net www.csoonline.com
1 ampcid.google.com www.google-analytics.com
1 region1.google-analytics.com www.googletagmanager.com
1 clients1.google.com www.csoonline.com
1 w.soundcloud.com www.googletagmanager.com
1 f5b3be27-f789-4ef1-8867-37c67da5b361.prmutv.co cdn.permutive.com
1 api.ipify.org www.csoonline.com
1 p.typekit.net use.typekit.net
1 images.techhive.com www.csoonline.com
1 cdn.jwplayer.com www.csoonline.com
1 s.ntv.io www.csoonline.com
1 js-sec.indexww.com www.csoonline.com
1 ccpa.sp-prod.net www.csoonline.com
1 d2zv5rkii46miq.cloudfront.net www.csoonline.com
208 52
Subject Issuer Validity Valid
*.cfoworld.com
GlobalSign Atlas R3 DV TLS CA 2023 Q1
2023-03-01 -
2024-04-01
a year crt.sh
*.cloudfront.net
Amazon RSA 2048 M01
2022-12-08 -
2023-12-07
a year crt.sh
cmp2.channelpartner.de
R3
2023-04-25 -
2023-07-24
3 months crt.sh
*.sp-prod.net
Amazon RSA 2048 M01
2023-04-26 -
2024-05-24
a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2022-10-06 -
2023-10-05
a year crt.sh
use.typekit.net
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2022-09-14 -
2023-10-15
a year crt.sh
*.ntv.io
DigiCert TLS RSA SHA256 2020 CA1
2022-10-24 -
2023-10-26
a year crt.sh
jwplayer.com
Amazon RSA 2048 M02
2023-03-01 -
2023-12-25
10 months crt.sh
cmp.infoworld.com
R3
2023-04-17 -
2023-07-16
3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3
2023-04-03 -
2023-06-26
3 months crt.sh
*.google-analytics.com
GTS CA 1C3
2023-04-03 -
2023-06-26
3 months crt.sh
permutive.com
Cloudflare Inc ECC CA-3
2023-01-26 -
2024-01-25
a year crt.sh
*.google.com
GTS CA 1C3
2023-04-03 -
2023-06-26
3 months crt.sh
*.scorecardresearch.com
Amazon RSA 2048 M02
2023-03-01 -
2024-01-28
a year crt.sh
*.ipify.org
Sectigo RSA Domain Validation Secure Server CA
2023-02-07 -
2024-02-18
a year crt.sh
*.prmutv.co
R3
2023-03-14 -
2023-06-12
3 months crt.sh
*.adnxs.com
GeoTrust ECC CA 2018
2023-02-13 -
2024-03-15
a year crt.sh
api.permutive.com
R3
2023-04-17 -
2023-07-16
3 months crt.sh
*.postrelease.com
Amazon RSA 2048 M01
2023-02-09 -
2024-02-16
a year crt.sh
www.google.com
GTS CA 1C3
2023-04-03 -
2023-06-26
3 months crt.sh
*.soundcloud.com
GlobalSign GCC R3 DV TLS CA 2020
2023-01-24 -
2024-02-25
a year crt.sh
*.brandmetrics.com
GTS CA 1P5
2023-03-12 -
2023-06-10
3 months crt.sh
upload.video.google.com
GTS CA 1C3
2023-04-03 -
2023-06-26
3 months crt.sh
www.dwin2.com
Amazon RSA 2048 M02
2023-02-28 -
2023-10-11
7 months crt.sh
*.3lift.com
Amazon RSA 2048 M02
2023-04-13 -
2024-05-11
a year crt.sh
*.google.de
GTS CA 1C3
2023-04-03 -
2023-06-26
3 months crt.sh
*.twitter.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2023-02-05 -
2024-02-05
a year crt.sh
*.adsrvr.org
GlobalSign GCC R3 DV TLS CA 2020
2023-04-12 -
2024-05-13
a year crt.sh
*.rlcdn.com
Sectigo RSA Domain Validation Secure Server CA
2023-02-02 -
2024-03-03
a year crt.sh
www.linkedin.com
DigiCert SHA2 Secure Server CA
2023-03-07 -
2023-09-07
6 months crt.sh
www.bing.com
Microsoft RSA TLS CA 02
2023-02-16 -
2023-08-16
6 months crt.sh
*.ybp.yahoo.com
DigiCert SHA2 High Assurance Server CA
2023-04-04 -
2023-09-27
6 months crt.sh
*.gstatic.com
GTS CA 1C3
2023-04-03 -
2023-06-26
3 months crt.sh

This page contains 4 frames:

Primary Page: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Frame ID: 374DD0A816EAA52BBFD5565EB9CECEC6
Requests: 185 HTTP requests in this frame

Frame: https://cmpv2.csoonline.com/index.html?message_id=773117&consentUUID=undefined&preload_message=true&hasCsp=true&version=v1&consent_origin=https%3A%2F%2Fcmpv2.csoonline.com%2Fconsent%2Ftcfv2&mms_origin=https%3A%2F%2Fcmpv2.csoonline.com%2Fmms%2Fv2
Frame ID: 12A00320993CC1A2A722F0C8DBBBBC08
Requests: 7 HTTP requests in this frame

Frame: https://tlx.3lift.com/web/auction?inv_code=tan_CSOOnline_MOAP&referrer=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3694850%2Firanian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html&rev=1ed5450&fe=0&ft=0&cb=6066619794&gdpr=undefined
Frame ID: F314B10B241C466345F24D9F7D3D8B37
Requests: 1 HTTP requests in this frame

Frame: https://eb2.3lift.com/sync?max=10&gdpr=false&cb=65530&ld=1
Frame ID: D37DD2F3606B87D05C3EFA32153BAC9D
Requests: 11 HTTP requests in this frame

Screenshot

Page Title

Iranian cyberspies deploy new malware implant on Microsoft Exchange Servers | CSO Onlinesearch

Detected technologies

Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)

Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js

Overall confidence: 100%
Detected patterns
  • <iframe[^>]* (?:id="comscore"|scr=[^>]+comscore)|\.scorecardresearch\.com/beacon\.js|COMSCORE\.beacon
  • \.scorecardresearch\.com/beacon\.js|COMSCORE\.beacon

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Overall confidence: 100%
Detected patterns
  • jquery-ui.*\.js

Page Statistics

208
Requests

96 %
HTTPS

47 %
IPv6

38
Domains

52
Subdomains

45
IPs

4
Countries

2155 kB
Transfer

6831 kB
Size

53
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 190
  • https://eb2.3lift.com/sync?max=10&gdpr=false&cb=65530 HTTP 302
  • https://eb2.3lift.com/sync?max=10&gdpr=false&cb=65530&ld=1
Request Chain 193
  • https://eb2.3lift.com/ebda?sync=1&gdpr=0&gdpr_consent= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTYzOTY4MjUyODE2Mzg2NTA3ODU0OA%3D%3D HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTYzOTY4MjUyODE2Mzg2NTA3ODU0OA%3D%3D&google_tc= HTTP 302
  • https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
Request Chain 194
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm=&google_sc=&gdpr=0&gdpr_consent=&google_tc= HTTP 302
  • https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEOYLBXd6jdewp-2bUTzzdVI&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
Request Chain 195
  • https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTYzOTY4MjUyODE2Mzg2NTA3ODU0OA%3D%3D HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTYzOTY4MjUyODE2Mzg2NTA3ODU0OA%3D%3D&google_tc=
Request Chain 197
  • https://x.bidswitch.net/sync?ssp=triplelift&user_id=1639682528163865078548&gdpr=0&gdpr_consent= HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?ssp=triplelift&user_id=1639682528163865078548&gdpr=0&gdpr_consent= HTTP 302
  • https://ads.creative-serving.com/bsw_sync?bidswitch_ssp_id=triplelift&bsw_custom_parameter=1525d8c2-a1c4-4db0-8b40-fa8c8ead9811&gdpr=0&gdpr_consent= HTTP 302
  • https://ads.creative-serving.com/ul_cb/bsw_sync?bidswitch_ssp_id=triplelift&bsw_custom_parameter=1525d8c2-a1c4-4db0-8b40-fa8c8ead9811&gdpr=0&gdpr_consent= HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=4&user_id=cff2c08d-8119-47a3-9777-2a8eacd9ce0a&ssp=triplelift&expires=30&user_group=5&bsw_param=1525d8c2-a1c4-4db0-8b40-fa8c8ead9811 HTTP 302
  • https://eb2.3lift.com/xuid?mid=2409&xuid=1525d8c2-a1c4-4db0-8b40-fa8c8ead9811&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
Request Chain 200
  • https://b1sync.zemanta.com/usersync/triplelift?gdpr=0&gdpr_consent= HTTP 302
  • https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=0
Request Chain 201
  • https://ib.adnxs.com/getuid?https%3A%2F%2Feb2.3lift.com%2Fxuid%3Fmid%3D3335%26xuid%3D%24UID%26dongle%3D4d58%26gdpr=0%26gdpr_consent= HTTP 307
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Feb2.3lift.com%252Fxuid%253Fmid%253D3335%2526xuid%253D%2524UID%2526dongle%253D4d58%2526gdpr%3D0%2526gdpr_consent%3D HTTP 302
  • https://eb2.3lift.com/xuid?mid=3335&xuid=3222147745245210378&dongle=4d58&gdpr=0&gdpr_consent=

208 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
www.csoonline.com/article/3694850/
150 KB
42 KB
Document
General
Full URL
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
9ce2035e40ab7ae723a1fbf900ca078b874e6c322569d0fb60570c63e5fedce4
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

accept-ranges
bytes
age
15127
content-encoding
gzip
content-length
42688
content-type
text/html;charset=UTF-8
date
Thu, 27 Apr 2023 02:10:33 GMT
server
Apache-Coyote/1.1
strict-transport-security
max-age=300
vary
Accept-Encoding,Cookie
via
1.1 varnish, 1.1 varnish
x-cache
HIT, HIT, HIT, HIT
x-cache-hits
196, 196, 1, 1
x-frame-options
deny
x-served-by
cache-sjc10076-SJC, cache-sjc10076-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
x-timer
S1682561434.758559,VS0,VE1
x-vcl-version
86
x-via-fastly
Verdad
jquery-1.10.2.min.js
www.csoonline.com/www/js/jquery/
91 KB
32 KB
Script
General
Full URL
https://www.csoonline.com/www/js/jquery/jquery-1.10.2.min.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
b52e06f854795718703ef9723b47a9a23edcbe2ae53ff261926d8d6059056cfe
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-cache-hits
188, 188, 2, 2
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:33 GMT
age
161095
x-cache
HIT, HIT, HIT, HIT
content-length
32845
x-via-fastly
Verdad
x-served-by
cache-sjc10068-SJC, cache-sjc10068-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
last-modified
Wed, 12 Apr 2023 18:51:12 GMT
server
Apache-Coyote/1.1
x-timer
S1682561434.776197,VS0,VE0
etag
W/"93639-1681325472000-gzip"
x-frame-options
deny
vary
Accept-Encoding,Cookie
content-type
application/javascript
cache-control
max-age=604800
x-vcl-version
86
accept-ranges
bytes
expires
Tue, 25 Apr 2023 05:17:43 GMT
jquery_cookie.js
www.csoonline.com/www/js/jquery/
2 KB
1 KB
Script
General
Full URL
https://www.csoonline.com/www/js/jquery/jquery_cookie.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
02d2940a00290f3a9e4955de7821626688c0cacde8c97c762838e6b40ab22926
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-cache-hits
299, 299, 2, 2
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:33 GMT
age
162271
x-cache
HIT, HIT, HIT, HIT
content-length
908
x-via-fastly
Verdad
x-served-by
cache-sjc10044-SJC, cache-sjc10044-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
last-modified
Wed, 12 Apr 2023 18:51:16 GMT
server
Apache-Coyote/1.1
x-timer
S1682561434.779593,VS0,VE0
etag
W/"1946-1681325476000-gzip"
x-frame-options
deny
vary
Accept-Encoding,Cookie
content-type
application/javascript
cache-control
max-age=604800
x-vcl-version
86
accept-ranges
bytes
expires
Mon, 01 May 2023 15:05:42 GMT
apollo-locales.js
www.csoonline.com/www/js/
5 KB
2 KB
Script
General
Full URL
https://www.csoonline.com/www/js/apollo-locales.js?v=20230412115149
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
6467b42b646c644d356adf8dc595da52488b944fb5a0b2a7cb14aee4ad66ef19
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-cache-hits
208, 208, 2, 2
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:33 GMT
age
72735
x-cache
HIT, HIT, HIT, HIT
content-length
1686
x-via-fastly
Verdad
x-served-by
cache-sjc10068-SJC, cache-sjc10068-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
last-modified
Wed, 12 Apr 2023 18:51:06 GMT
server
Apache-Coyote/1.1
x-timer
S1682561434.779559,VS0,VE0
etag
W/"4845-1681325466000-gzip"
x-frame-options
deny
vary
Accept-Encoding,Cookie
content-type
application/javascript
cache-control
max-age=604800
x-vcl-version
86
accept-ranges
bytes
expires
Wed, 19 Apr 2023 19:38:29 GMT
cmp_shim.js
d2zv5rkii46miq.cloudfront.net/0/latest/
4 KB
2 KB
Script
General
Full URL
https://d2zv5rkii46miq.cloudfront.net/0/latest/cmp_shim.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2490:de00:17:5578:e080:21 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
120fb2279d5061dd4a428f935fdf10c09e95c1f2ec0346f7aaf6c8b7f382cf49

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 27 Apr 2023 01:11:15 GMT
content-encoding
gzip
via
1.1 e96aebc8d7c9ec82b88c3160a18fed96.cloudfront.net (CloudFront)
last-modified
Tue, 08 Jun 2021 21:38:53 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P6
age
3559
etag
"1de86d90311bcd5ee000f2f732b294a9"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
accept-ranges
bytes
content-length
1698
x-amz-cf-id
LtDoMBQS-75oVdy6KJu-VdOYX9QVOWkNeNB1Q4oNY2Ktrix0Zvv3cQ==
wrapperMessagingWithoutDetection.js
cmpv2.csoonline.com/
165 KB
47 KB
Script
General
Full URL
https://cmpv2.csoonline.com/wrapperMessagingWithoutDetection.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-43.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4db7d12ede1471d2a955366edf3913a77a0f12d495dedad879b064a7009416eb

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-amz-version-id
null
content-encoding
gzip
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aaa.cloudfront.net (CloudFront)
date
Thu, 27 Apr 2023 01:17:11 GMT
last-modified
Thu, 30 Mar 2023 18:25:32 GMT
server
AmazonS3
x-amz-cf-pop
FRA50-C1
age
3204
x-amz-server-side-encryption
AES256
etag
W/"ed2d1aeeb74b57f50cab6ae77bd9d186"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/javascript
cache-control
max-age=3600
x-amz-cf-id
DdEQzYRFuYhmxcB78CnqPi3l4p11CvgJQfDUfo4Sl-Z1nANQthS3jA==
ccpa.js
ccpa.sp-prod.net/
55 KB
19 KB
Script
General
Full URL
https://ccpa.sp-prod.net/ccpa.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.88 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-88.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
fc630eae66d14c714e935e9686b763aab14adc301890a57262408ee4bd401978

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 27 Apr 2023 01:32:00 GMT
content-encoding
gzip
via
1.1 63505de36d604e79a77328b302a7d4a2.cloudfront.net (CloudFront)
last-modified
Tue, 19 Jul 2022 16:12:40 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P5
age
3410
etag
W/"03d1c1f6642064c8fc51daa6d457d3dc"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=3600
x-amz-cf-id
lwJ4Yr1YTEgqoOWzyImWnJ24ujRXcAyUbAfYin9SNxLIWr-h2PJRHw==
init_device.js
www.csoonline.com/www/js/
585 B
702 B
Script
General
Full URL
https://www.csoonline.com/www/js/init_device.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
4f4ed0e81c2f0016d06ae816dd872edc04e97612c9d36f2f3f4475f2954e7fcc
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-cache-hits
174, 174, 2, 2
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:33 GMT
age
592823
x-cache
HIT, HIT, HIT, HIT
content-length
304
x-via-fastly
Verdad
x-served-by
cache-sjc10073-SJC, cache-sjc10073-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
last-modified
Wed, 12 Apr 2023 18:51:08 GMT
server
Apache-Coyote/1.1
x-timer
S1682561434.779589,VS0,VE0
etag
W/"585-1681325468000-gzip"
x-frame-options
deny
vary
Accept-Encoding,Cookie
content-type
application/javascript
cache-control
max-age=604800
x-vcl-version
86
accept-ranges
bytes
expires
Thu, 20 Apr 2023 05:12:59 GMT
183980-47728333013839.js
js-sec.indexww.com/ht/p/
136 KB
39 KB
Script
General
Full URL
https://js-sec.indexww.com/ht/p/183980-47728333013839.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.18.11.47 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c383325844c6616d85a4a44e0a85429ba586eecf8c807bfc06368ceb30ef09e2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 27 Apr 2023 02:10:35 GMT
content-encoding
gzip
cf-cache-status
EXPIRED
last-modified
Thu, 27 Apr 2023 02:05:57 GMT
server
cloudflare
etag
W/"76171d-220f6-5fa47cc198a86"
vary
Accept-Encoding
content-type
text/javascript
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
edge-control
cache-maxage=1h
cache-control
public, max-age=14400
cf-ray
7be387a39801040c-FRA
expires
Thu, 27 Apr 2023 06:10:34 GMT
gpt_includes.js
www.csoonline.com/www/js/ads/
19 KB
6 KB
Script
General
Full URL
https://www.csoonline.com/www/js/ads/gpt_includes.js?v=20230412115149
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
dcb3e51a64f948ed5302183e2a8e5ecf9e84f8e86e8cd40fc5d18485fbb2c074
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-cache-hits
206, 206, 2, 2
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:33 GMT
age
71737
x-cache
HIT, HIT, HIT, HIT
content-length
5262
x-via-fastly
Verdad
x-served-by
cache-sjc10076-SJC, cache-sjc10076-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
last-modified
Wed, 12 Apr 2023 18:50:54 GMT
server
Apache-Coyote/1.1
x-timer
S1682561434.783216,VS0,VE0
etag
W/"19501-1681325454000-gzip"
x-frame-options
deny
vary
Accept-Encoding,Cookie
content-type
application/javascript
cache-control
max-age=604800
x-vcl-version
86
accept-ranges
bytes
expires
Wed, 19 Apr 2023 19:38:34 GMT
thm_pre.js
www.csoonline.com/www.idge/js/
24 KB
5 KB
Script
General
Full URL
https://www.csoonline.com/www.idge/js/thm_pre.js?v=20230412115149
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
71a9f7971618b14dc4014c55de13c36da054db21b986c50a6d112eaf9e366418
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-cache-hits
214, 214, 2, 2
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:33 GMT
age
122499
x-cache
HIT, HIT, HIT, HIT
content-length
5246
x-via-fastly
Verdad
x-served-by
cache-sjc10069-SJC, cache-sjc10069-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
last-modified
Wed, 12 Apr 2023 18:46:00 GMT
server
Apache-Coyote/1.1
x-timer
S1682561434.782717,VS0,VE0
etag
W/"24746-1681325160000-gzip"
x-frame-options
deny
vary
Accept-Encoding,Cookie
content-type
application/javascript
cache-control
max-age=604800
x-vcl-version
86
accept-ranges
bytes
expires
Tue, 02 May 2023 02:08:32 GMT
gpt_starter.js
www.csoonline.com/www/js/ads/
330 B
449 B
Script
General
Full URL
https://www.csoonline.com/www/js/ads/gpt_starter.js?1234
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
ad20d2d42fcbd58ad9c50a6e53db21bf4425be6f8237a41f109c2717c30b4067
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-cache-hits
105, 105, 2, 2
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:33 GMT
age
182638
x-cache
HIT, HIT, HIT, HIT
content-length
238
x-via-fastly
Verdad
x-served-by
cache-sjc10033-SJC, cache-sjc10033-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
last-modified
Wed, 12 Apr 2023 18:50:54 GMT
server
Apache-Coyote/1.1
x-timer
S1682561434.782713,VS0,VE0
etag
W/"330-1681325454000-gzip"
x-frame-options
deny
vary
Accept-Encoding,Cookie
content-type
application/javascript
cache-control
max-age=604800
x-vcl-version
86
accept-ranges
bytes
expires
Mon, 24 Apr 2023 23:10:28 GMT
gpt_launcher.js
www.csoonline.com/www/js/ads/
593 B
704 B
Script
General
Full URL
https://www.csoonline.com/www/js/ads/gpt_launcher.js?v=20230412115149
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
06c72ef9353a39000f14acb8c982d9241484108af590496e9594f217c6802bc2
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-cache-hits
248, 248, 2, 2
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:33 GMT
age
525971
x-cache
HIT, HIT, HIT, HIT
content-length
306
x-via-fastly
Verdad
x-served-by
cache-sjc10041-SJC, cache-sjc10041-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
last-modified
Wed, 12 Apr 2023 18:50:54 GMT
server
Apache-Coyote/1.1
x-timer
S1682561434.782676,VS0,VE0
etag
W/"593-1681325454000-gzip"
x-frame-options
deny
vary
Accept-Encoding,Cookie
content-type
application/javascript
cache-control
max-age=604800
x-vcl-version
86
accept-ranges
bytes
expires
Thu, 20 Apr 2023 23:42:17 GMT
article.css
www.csoonline.com/www/css/
235 KB
34 KB
Stylesheet
General
Full URL
https://www.csoonline.com/www/css/article.css?v=20230412115149
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
11cee06f13221dea8fa5ddb99d54510eb7831fd51aa6f8610820c5a471af58a2
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-cache-hits
382, 382, 2, 2
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:33 GMT
age
485043
x-cache
HIT, HIT, HIT, HIT
content-length
34961
x-via-fastly
Verdad
x-served-by
cache-sjc10039-SJC, cache-sjc10039-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
last-modified
Wed, 12 Apr 2023 18:48:42 GMT
server
Apache-Coyote/1.1
x-timer
S1682561434.778549,VS0,VE0
etag
W/"240590-1681325322000-gzip"
x-frame-options
deny
vary
Accept-Encoding,Cookie
content-type
text/css
cache-control
max-age=604800
x-vcl-version
86
accept-ranges
bytes
expires
Thu, 20 Apr 2023 23:39:09 GMT
article.css
www.csoonline.com/www.idge.cso/css/
44 KB
7 KB
Stylesheet
General
Full URL
https://www.csoonline.com/www.idge.cso/css/article.css?v=20230412115149
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
20aae1e27cc1b9df4f61555525643b743c88437d0cf1e9eab67b1608cde7357f
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-cache-hits
199, 199, 2, 2
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:33 GMT
age
70323
x-cache
HIT, HIT, HIT, HIT
content-length
7054
x-via-fastly
Verdad
x-served-by
cache-sjc10057-SJC, cache-sjc10057-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
last-modified
Wed, 12 Apr 2023 18:46:48 GMT
server
Apache-Coyote/1.1
x-timer
S1682561434.779370,VS0,VE0
etag
W/"45297-1681325208000-gzip"
x-frame-options
deny
vary
Accept-Encoding,Cookie
content-type
text/css
cache-control
max-age=604800
x-vcl-version
86
accept-ranges
bytes
expires
Wed, 19 Apr 2023 19:41:06 GMT
ss-social.css
www.csoonline.com/www.idge/css/webfonts/
3 KB
1 KB
Stylesheet
General
Full URL
https://www.csoonline.com/www.idge/css/webfonts/ss-social.css
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
c2787f84ac525e6b202f56eb25ef03f40017d11100280dd6f3866cadb4d1f50c
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-cache-hits
144, 144, 2, 2
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:33 GMT
age
111834
x-cache
HIT, HIT, HIT, HIT
content-length
885
x-via-fastly
Verdad
x-served-by
cache-sjc10035-SJC, cache-sjc10035-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
last-modified
Wed, 12 Apr 2023 18:48:16 GMT
server
Apache-Coyote/1.1
x-timer
S1682561434.779038,VS0,VE0
etag
W/"3417-1681325296000-gzip"
x-frame-options
deny
vary
Accept-Encoding,Cookie
content-type
text/css
cache-control
max-age=604800
x-vcl-version
86
accept-ranges
bytes
expires
Tue, 25 Apr 2023 18:55:42 GMT
ss-standard.css
www.csoonline.com/www.idge/css/webfonts/
11 KB
3 KB
Stylesheet
General
Full URL
https://www.csoonline.com/www.idge/css/webfonts/ss-standard.css
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
b59054e128a42511aa22399d02cd8365ac1c66a6efe6f4f11cfe1ae16284db0c
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-cache-hits
63, 63, 2, 2
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:33 GMT
age
112266
x-cache
HIT, HIT, HIT, HIT
content-length
2472
x-via-fastly
Verdad
x-served-by
cache-sjc10079-SJC, cache-sjc10079-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
last-modified
Wed, 12 Apr 2023 18:48:18 GMT
server
Apache-Coyote/1.1
x-timer
S1682561434.779022,VS0,VE0
etag
W/"11639-1681325298000-gzip"
x-frame-options
deny
vary
Accept-Encoding,Cookie
content-type
text/css
cache-control
max-age=604800
x-vcl-version
86
accept-ranges
bytes
expires
Tue, 25 Apr 2023 06:42:52 GMT
all.css
use.fontawesome.com/releases/v5.6.1/css/
52 KB
12 KB
Stylesheet
General
Full URL
https://use.fontawesome.com/releases/v5.6.1/css/all.css
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e2::ac40:840f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
453893f7daa3d8fe9716f8c6d0f36f8ade8cacfc0093e164f4f998b46427959e

Request headers

Referer
https://www.csoonline.com/
Origin
https://www.csoonline.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 27 Apr 2023 02:10:33 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id
Y0HGR97PNQFEM50H
age
1982298
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
x-amz-id-2
0YuX/isqgZhx1IvcgAPI3FBf+op8KE6HSNgPl1SeuLBD9f6WJ4yO3PwpB8qwMacLkSlDJZYpWfM=
last-modified
Wed, 30 Jun 2021 15:44:12 GMT
server
cloudflare
etag
W/"b8085bf2c839791244bd95f56fb93c01"
access-control-max-age
3000
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
access-control-allow-methods
GET
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VZNsJAq9swHixL80FgxbVkipUfWK7dX4DqBxcZFASycGEi%2FAOSXsyF2cfLdKyLjZM%2FLQeuUY5xnROniCyx6losOwnYaeqK9%2BNBS2urz9SzYb7xvkxGEPhxaWOQQ4Kk2ctH82EmF0DxTIIqUe%2FbNGniJZ"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cache-control
max-age=31556926
cf-ray
7be387a1382d3a4a-FRA
vjj6ndp.css
use.typekit.net/
3 KB
960 B
Stylesheet
General
Full URL
https://use.typekit.net/vjj6ndp.css
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:148f Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
7b04d6ce2f17eeb96bf52a53711114a4bfef440bcb40927f77d395d549fe53d1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains;

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains;
content-encoding
gzip
date
Thu, 27 Apr 2023 02:10:33 GMT
server
nginx
vary
Accept-Encoding
content-type
text/css;charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=600, stale-while-revalidate=604800
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
728
ad.js
www.csoonline.com/www/js/ads/
19 B
274 B
Script
General
Full URL
https://www.csoonline.com/www/js/ads/ad.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
6a0f6cf6b4648c192d81b5fc7b70cb2f6819ef4a799e421e8626cae9697aa85a
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-cache-hits
521, 521, 2, 2
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:33 GMT
age
102477
x-cache
HIT, HIT, HIT, HIT
content-length
39
x-via-fastly
Verdad
x-served-by
cache-sjc10082-SJC, cache-sjc10082-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
last-modified
Wed, 12 Apr 2023 18:50:52 GMT
server
Apache-Coyote/1.1
x-timer
S1682561434.782794,VS0,VE0
etag
W/"19-1681325452000"
x-frame-options
deny
vary
Accept-Encoding,Cookie
content-type
application/javascript
cache-control
max-age=604800
x-vcl-version
86
accept-ranges
bytes
expires
Tue, 25 Apr 2023 22:57:41 GMT
load.js
s.ntv.io/serve/
578 KB
159 KB
Script
General
Full URL
https://s.ntv.io/serve/load.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.35.237.64 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-35-237-64.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
75878e20516aab7c1d8b3db8af6b7c27fdde3b62e41c44f30295a54a5f8cc124

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Date
Thu, 27 Apr 2023 02:10:34 GMT
Content-Encoding
gzip
x-amz-request-id
FVQSBWC1TAGX9KWJ
x-amz-server-side-encryption
AES256
Transfer-Encoding
chunked
Connection
keep-alive, Transfer-Encoding
x-amz-id-2
3+Vq4mP6mjUaodeWlkOw64VYuySZYmRtp3CZqHILaUdzLrH4JAAdKdsmxXKlZCnZimSlQV44UEQ=
Last-Modified
Wed, 26 Apr 2023 19:21:47 GMT
Server
AmazonS3
ETag
"e644b256b057091360be3a58b5856d3a"
Vary
Accept-Encoding
Access-Control-Allow-Methods
GET
Content-Type
application/x-javascript
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=3600
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
8yHZorDV.js
cdn.jwplayer.com/libraries/
117 KB
44 KB
Script
General
Full URL
https://cdn.jwplayer.com/libraries/8yHZorDV.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:225e:0:1:a3fa:7cc0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
openresty /
Resource Hash
95c331d662f93db24707a76978d1e803e57609516019afcdab497443b3ca11df

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 27 Apr 2023 02:09:22 GMT
content-encoding
gzip
via
1.1 dd4531988f4862a3b186f9d3356a6a74.cloudfront.net (CloudFront)
server
openresty
x-amz-cf-pop
FRA60-P4
age
70
x-cache
Hit from cloudfront
content-type
text/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=180
x-robots-tag
noindex, indexifembedded
content-length
44147
x-amz-cf-id
6gmyT-z5TKi4VEYYCVPjNYqLWxrZnii_dyI5EgXah2akownqekXqYg==
oc-header.css
www.csoonline.com/www/css/
37 KB
8 KB
Stylesheet
General
Full URL
https://www.csoonline.com/www/css/oc-header.css?v=20230412115149
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
db29aa88ea3a11062a7dc45fcc65be9b8dc3fff9c849078dd6809d35974e86ec
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-cache-hits
205, 205, 2, 2
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:33 GMT
age
46946
x-cache
HIT, HIT, HIT, HIT
content-length
7373
x-via-fastly
Verdad
x-served-by
cache-sjc10070-SJC, cache-sjc10070-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
last-modified
Wed, 12 Apr 2023 18:48:46 GMT
server
Apache-Coyote/1.1
x-timer
S1682561434.779015,VS0,VE0
etag
W/"38076-1681325326000-gzip"
x-frame-options
deny
vary
Accept-Encoding,Cookie
content-type
text/css
cache-control
max-age=604800
x-vcl-version
86
accept-ranges
bytes
expires
Wed, 19 Apr 2023 19:40:34 GMT
oc-header.css
www.csoonline.com/www.idge.cso/css/
6 KB
2 KB
Stylesheet
General
Full URL
https://www.csoonline.com/www.idge.cso/css/oc-header.css?v=20230412115149
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
fbbbac05b654e9de243f6e42f41efa36522598661a05b5d84b7614d7effba3d6
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-cache-hits
510, 510, 2682, 2682
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:33 GMT
age
172961
x-cache
HIT, HIT, HIT, HIT
content-length
1810
x-via-fastly
Verdad
x-served-by
cache-sjc10020-SJC, cache-sjc10020-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
last-modified
Wed, 12 Apr 2023 18:46:52 GMT
server
Apache-Coyote/1.1
x-timer
S1682561434.778998,VS0,VE0
etag
W/"6391-1681325212000-gzip"
x-frame-options
deny
vary
Accept-Encoding,Cookie
content-type
text/css
cache-control
max-age=604800
x-vcl-version
86
accept-ranges
bytes
expires
Mon, 01 May 2023 12:07:26 GMT
cso-white-logo.svg
alt.idgesg.net/images/furniture/cso/
2 KB
2 KB
Image
General
Full URL
https://alt.idgesg.net/images/furniture/cso/cso-white-logo.svg
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
66ea0c6fa4034dbeae9784e34b02aeb748608ba8c2576e1b08fabd965712ad99

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-amz-version-id
GZEJ2MIi53tqEbsMuE.llWrHu..L1aXm
date
Thu, 27 Apr 2023 02:10:34 GMT
via
1.1 varnish
x-amz-request-id
4TTNV67DWT2JMQTE
age
1662
x-amz-meta-origin-date-iso8601
2022-04-05T15:18:30.000Z
x-cache
HIT
content-length
2054
x-amz-id-2
DRFMKI9IX4YilXeiNi+J5uaJuN1muwFFc0pfJEw8DkDdbBIA65nRLXZyxpBThfJNhvmvDW0+QdA=
x-served-by
cache-fra-eddf8230050-FRA
last-modified
Wed, 06 Apr 2022 16:02:41 GMT
server
AmazonS3
x-timer
S1682561434.288949,VS0,VE1
etag
"2bc94f3caad9407062b8845e0c42e913"
content-type
image/svg+xml
accept-ranges
bytes
x-cache-hits
1
content-ribbon.css
www.csoonline.com/www/css/
2 KB
795 B
Stylesheet
General
Full URL
https://www.csoonline.com/www/css/content-ribbon.css?v=20230412115149
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
fd66d8dc41c06a99c3877934b3af8d38de72f3a94db252c0b9474bec35014491
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-cache-hits
91, 91, 2, 2
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:33 GMT
age
71967
x-cache
HIT, HIT, HIT, HIT
content-length
556
x-via-fastly
Verdad
x-served-by
cache-sjc10066-SJC, cache-sjc10066-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
last-modified
Wed, 12 Apr 2023 18:48:42 GMT
server
Apache-Coyote/1.1
x-timer
S1682561434.847285,VS0,VE0
etag
W/"1829-1681325322000-gzip"
x-frame-options
deny
vary
Accept-Encoding,Cookie
content-type
text/css
cache-control
max-age=604800
x-vcl-version
86
accept-ranges
bytes
expires
Wed, 26 Apr 2023 05:58:44 GMT
date-time-moments.js
www.csoonline.com/www/js/
121 KB
32 KB
Script
General
Full URL
https://www.csoonline.com/www/js/date-time-moments.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
5156e9286b87b1e03f6151c2bb29ad54d2b9da4df874a23c742a0693bdc209a1
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-cache-hits
432, 432, 2, 2
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:33 GMT
age
184084
x-cache
HIT, HIT, HIT, HIT
content-length
32323
x-via-fastly
Verdad
x-served-by
cache-sjc10024-SJC, cache-sjc10024-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
last-modified
Wed, 12 Apr 2023 18:51:06 GMT
server
Apache-Coyote/1.1
x-timer
S1682561434.855170,VS0,VE0
etag
W/"123832-1681325466000-gzip"
x-frame-options
deny
vary
Accept-Encoding,Cookie
content-type
application/javascript
cache-control
max-age=604800
x-vcl-version
86
accept-ranges
bytes
expires
Mon, 24 Apr 2023 22:41:23 GMT
facebook.svg
idge.staticworld.net/images/
817 B
1 KB
Image
General
Full URL
https://idge.staticworld.net/images/facebook.svg
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
676aa6d4090a54ea6893484095f55c80659fb8538db100cdb8ce1dc82bab42b8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-amz-version-id
z0fEqr9qBUOYVzkAEhE7W.44xxx.2BcQ
date
Thu, 27 Apr 2023 02:10:34 GMT
via
1.1 varnish
x-amz-request-id
4Y6YVPED9TGEHA62
age
2355
x-cache
HIT
content-length
817
x-amz-id-2
zTIiXPFqn42Q9Aspfc2MxAfy+vpfrTDeLE2d2hHX8VJIbDy8Uy9FKEjezmYvNA1M+tKGp5jCYmU=
x-served-by
cache-fra-eddf8230050-FRA
last-modified
Tue, 27 Mar 2018 00:10:09 GMT
server
AmazonS3
x-timer
S1682561435.527944,VS0,VE1
etag
"e54119fb283fa31d7980c946d19e701f"
content-type
image/svg+xml
accept-ranges
bytes
x-cache-hits
1
twitter.svg
idge.staticworld.net/images/
1 KB
1 KB
Image
General
Full URL
https://idge.staticworld.net/images/twitter.svg
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
464e7cde418a559c5035942d1ab154d5d906f378f256a0dd39848d197df6180d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-amz-version-id
mIV1aQJqOkkgyHLgPXYdWBvfLAAcgw1y
date
Thu, 27 Apr 2023 02:10:34 GMT
via
1.1 varnish
x-amz-request-id
M0BYQP0Y7NGXQGMZ
age
1731
x-cache
HIT
content-length
1128
x-amz-id-2
PbJ3H1ql5hKmmefNev4APCejgqgWez99y4z000nSI/WKwEjt/GDNcxcAQQ0ZQ9Xd+ZUMs+4dUNQ=
x-served-by
cache-fra-eddf8230050-FRA
last-modified
Tue, 27 Mar 2018 00:10:11 GMT
server
AmazonS3
x-timer
S1682561435.528423,VS0,VE1
etag
"5c2cee17abf8296b156fa142e69516df"
content-type
image/svg+xml
accept-ranges
bytes
x-cache-hits
1
linkedin.svg
idge.staticworld.net/images/
786 B
1015 B
Image
General
Full URL
https://idge.staticworld.net/images/linkedin.svg
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
03643efcf63e8fbfe6571cd0f1a4ce49f8575a7bee74f2e9fd7fab344e474e48

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-amz-version-id
dIfJAJb7rR9o.DnrV3iep_mz2NuSUCHZ
date
Thu, 27 Apr 2023 02:10:34 GMT
via
1.1 varnish
x-amz-request-id
A4EYHT0C6TH3MYMJ
age
515
x-cache
HIT
content-length
786
x-amz-id-2
Vs1PZO6z2ZUcqpCJmMCV0kQVXqU4IoU73kHZbwoPJLE8hW/dvzJFf+nusrwU4MrOCMiwc3STmbU=
x-served-by
cache-fra-eddf8230050-FRA
last-modified
Tue, 27 Mar 2018 00:10:10 GMT
server
AmazonS3
x-timer
S1682561435.528786,VS0,VE1
etag
"b828f13d2d6015e831f675f1ca0c1908"
content-type
image/svg+xml
accept-ranges
bytes
x-cache-hits
1
reddit.svg
idge.staticworld.net/images/
2 KB
2 KB
Image
General
Full URL
https://idge.staticworld.net/images/reddit.svg
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
47c749c888c850505d68f2745651928d8aec9a6802d6a8b20869fa114af92277

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-amz-version-id
X1o6g.mfoioyv5Lswf3F9n.2ID0CCWF9
date
Thu, 27 Apr 2023 02:10:34 GMT
via
1.1 varnish
x-amz-request-id
7SV6GYCD196C7BE0
age
515
x-cache
HIT
content-length
1556
x-amz-id-2
cT2VPQasJYGSFC75+1OLtVkg5yjfne0n59biK1/O50z2ByI1xj6aBjAzKUdyeHDiEQKfrP8YeLE=
x-served-by
cache-fra-eddf8230050-FRA
last-modified
Tue, 27 Mar 2018 00:10:10 GMT
server
AmazonS3
x-timer
S1682561435.529167,VS0,VE12
etag
"8159d85ae759a8d251edb65b4dcd285d"
content-type
image/svg+xml
accept-ranges
bytes
x-cache-hits
1
mail.svg
idge.staticworld.net/images/
631 B
847 B
Image
General
Full URL
https://idge.staticworld.net/images/mail.svg
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
83d86c9e7359ed844c0e7682abcd5cdb65222d421c61156f17791ac6c2650274

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-amz-version-id
W1fLolU3CaghgVscFveqAiphPY036Sqp
date
Thu, 27 Apr 2023 02:10:34 GMT
via
1.1 varnish
x-amz-request-id
7PKAXN58070N9S4C
age
2355
x-cache
HIT
content-length
631
x-amz-id-2
ADlQ2ciGT+kGPNWclOUhWvcO/ttWh0tIeRKI+Ua4nhvF1/KzOj4aGPJdAARwB2pKgfXyd42m/Io=
x-served-by
cache-fra-eddf8230050-FRA
last-modified
Tue, 27 Mar 2018 00:10:10 GMT
server
AmazonS3
x-timer
S1682561435.528556,VS0,VE1
etag
"c8fc97e05e008a042825f64ee7d414d1"
content-type
image/svg+xml
accept-ranges
bytes
x-cache-hits
1
print.svg
idge.staticworld.net/images/
782 B
1 KB
Image
General
Full URL
https://idge.staticworld.net/images/print.svg
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1b197985c0bef8bc365381bd16e15dccf184eb33d0abf0afdb4f567da2000fb2

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-amz-version-id
.7Gmo7QCRJqJTxCocIfBynAqOGj25mL.
date
Thu, 27 Apr 2023 02:10:34 GMT
via
1.1 varnish
x-amz-request-id
GX1MYH8VMG16XZM4
age
69
x-cache
HIT
content-length
782
x-amz-id-2
9xVuPVarsaMIzhbNY1a4J7S0lqLc6SInUY7P7a7Q3oUr+4lj03R4Yw3A4++9+UpbpYr1w+O1dZc=
x-served-by
cache-fra-eddf8230050-FRA
last-modified
Tue, 27 Mar 2018 00:10:10 GMT
server
AmazonS3
x-timer
S1682561435.528576,VS0,VE1
etag
"a9f65e3b5eddc5c537118a146a3333c7"
content-type
image/svg+xml
accept-ranges
bytes
x-cache-hits
1
lucian_constantin-100258922-byline.jpg
images.techhive.com/images/article/2014/04/
2 KB
3 KB
Image
General
Full URL
https://images.techhive.com/images/article/2014/04/lucian_constantin-100258922-byline.jpg?auto=webp&quality=85,70
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
c5d492c511f48abbfa3e77559fd35575dbede797bd4777d28acea42e728d569b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-amz-version-id
X8COOW6fHUBzDvpqxwCJGCZv8g_D7Gi8
date
Thu, 27 Apr 2023 02:10:34 GMT
via
1.1 varnish
x-amz-request-id
605QNMYDY2DR2DTG
age
2068
x-cache
HIT
fastly-io-info
ifsz=5516 idim=116x116 ifmt=jpeg ofsz=2206 odim=116x116 ofmt=webp
fastly-stats
io=1
content-length
2206
x-amz-id-2
RE3ns1xvvHW2RoHDrz0zF6xQE7t0EwlRZToIZ8np7YLSGDVCL5uGuiY3mkijQLbFX7N5oZUeGpk=
x-served-by
cache-fra-eddf8230050-FRA
server
AmazonS3
x-timer
S1682561434.406557,VS0,VE7
etag
"IKKIXK/X3BUMW6xHcongSAqIhrJ5Qyr8VgLpvAnVHf8"
vary
Accept
content-type
image/webp
cache-control
public, max-age=2592000
accept-ranges
bytes
x-cache-hits
1
stickyLb.js
www.csoonline.com/www/js/ads/
4 KB
2 KB
Script
General
Full URL
https://www.csoonline.com/www/js/ads/stickyLb.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
f6bbd3540733be952a2921b2e4716d3b5190d5897510efcf9baa09649a1eaedf
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-cache-hits
330, 330, 2, 2
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:33 GMT
age
177503
x-cache
HIT, HIT, HIT, HIT
content-length
1257
x-via-fastly
Verdad
x-served-by
cache-sjc10028-SJC, cache-sjc10028-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
last-modified
Wed, 12 Apr 2023 18:50:56 GMT
server
Apache-Coyote/1.1
x-timer
S1682561434.868807,VS0,VE0
etag
W/"3657-1681325456000-gzip"
x-frame-options
deny
vary
Accept-Encoding,Cookie
content-type
application/javascript
cache-control
max-age=604800
x-vcl-version
86
accept-ranges
bytes
expires
Tue, 25 Apr 2023 00:24:46 GMT
cybercrime-cyber-crime-skull-symbol-project-darknet-dark-web-internet-safety-cyberattack-theft-virus-piracy-100937825-large.jpg
images.idgesg.net/images/article/2023/02/
42 KB
42 KB
Image
General
Full URL
https://images.idgesg.net/images/article/2023/02/cybercrime-cyber-crime-skull-symbol-project-darknet-dark-web-internet-safety-cyberattack-theft-virus-piracy-100937825-large.jpg?auto=webp&quality=85,70
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ab2f09a472db787d4a0b68a059df82e87c154e5f35d115d95d1ee6f35728f947

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-amz-version-id
ISt91NVr6diNKz2O2zaxdxu6nPq8PJyh
date
Thu, 27 Apr 2023 02:10:34 GMT
via
1.1 varnish
x-amz-request-id
YNXS0E95ZR5D5X9M
age
4
x-cache
HIT
fastly-io-info
ifsz=134027 idim=1200x800 ifmt=jpeg ofsz=42896 odim=1200x800 ofmt=webp
fastly-stats
io=1
content-length
42896
x-amz-id-2
tvN4N0OtxtRlNrEkYf4rAl7Uge0VnsQ0rC50JU8Qw/ZCMZ+8NGElyiZw8y3r4x2QvW/ZegwpmhU=
x-served-by
cache-fra-eddf8230050-FRA
server
AmazonS3
x-timer
S1682561435.553914,VS0,VE1
etag
"8fdAzVVZpCTzhrPIRcXEHEJ+wocC5jwD46OGuAZYsfY"
vary
Accept
content-type
image/webp
cache-control
public, max-age=2592000
accept-ranges
bytes
x-cache-hits
1
deal-modules.js
www.csoonline.com/www/js/
783 B
578 B
Script
General
Full URL
https://www.csoonline.com/www/js/deal-modules.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
cdf2700459ab474c9e19ccf7a3b9c6044a6cf2f2ff7bb0e1ab7bde2304409c87
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-cache-hits
159, 159, 2, 2
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:33 GMT
age
177063
x-cache
HIT, HIT, HIT, HIT
content-length
345
x-via-fastly
Verdad
x-served-by
cache-sjc10065-SJC, cache-sjc10065-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
last-modified
Wed, 12 Apr 2023 18:51:08 GMT
server
Apache-Coyote/1.1
x-timer
S1682561434.876852,VS0,VE0
etag
W/"783-1681325468000-gzip"
x-frame-options
deny
vary
Accept-Encoding,Cookie
content-type
application/javascript
cache-control
max-age=604800
x-vcl-version
86
accept-ranges
bytes
expires
Tue, 25 Apr 2023 00:40:44 GMT
embedder-jwp.js
www.csoonline.com/www/js/video/
2 KB
880 B
Script
General
Full URL
https://www.csoonline.com/www/js/video/embedder-jwp.js?v=20230412115149
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
f0b97fc49950832323730d508911fa12bd098eca0670ccb3a18ada5af3a34699
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-cache-hits
233, 233, 2, 2
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:33 GMT
age
130540
x-cache
HIT, HIT, HIT, HIT
content-length
640
x-via-fastly
Verdad
x-served-by
cache-sjc10039-SJC, cache-sjc10039-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
last-modified
Wed, 12 Apr 2023 18:51:28 GMT
server
Apache-Coyote/1.1
x-timer
S1682561434.885520,VS0,VE0
etag
W/"1760-1681325488000-gzip"
x-frame-options
deny
vary
Accept-Encoding,Cookie
content-type
application/javascript
cache-control
max-age=604800
x-vcl-version
86
accept-ranges
bytes
expires
Mon, 01 May 2023 23:53:23 GMT
jquery.lazyload-ad.js
www.csoonline.com/www/js/ads/
10 KB
3 KB
Script
General
Full URL
https://www.csoonline.com/www/js/ads/jquery.lazyload-ad.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
4e6b5fc328bac95eec2e30afa8a58224c9accc6d70daf0e864d75c4c6d07fe94
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-cache-hits
165, 165, 2, 2
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:33 GMT
age
139985
x-cache
HIT, HIT, HIT, HIT
content-length
3069
x-via-fastly
Verdad
x-served-by
cache-sjc10074-SJC, cache-sjc10074-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
last-modified
Wed, 12 Apr 2023 18:50:56 GMT
server
Apache-Coyote/1.1
x-timer
S1682561434.893284,VS0,VE0
etag
W/"9912-1681325456000-gzip"
x-frame-options
deny
vary
Accept-Encoding,Cookie
content-type
application/javascript
cache-control
max-age=604800
x-vcl-version
86
accept-ranges
bytes
expires
Tue, 25 Apr 2023 06:38:53 GMT
tso-links.css
www.csoonline.com/www.idgcsmb/css/
991 B
729 B
Stylesheet
General
Full URL
https://www.csoonline.com/www.idgcsmb/css/tso-links.css?v=20230412115149
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
b42412a0e2fd452601f89dc9119e8dc4c563d204e6a54ba2f91e7c046f9de3a4
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-cache-hits
215, 215, 2, 2
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:33 GMT
age
35420
x-cache
HIT, HIT, HIT, HIT
content-length
473
x-via-fastly
Verdad
x-served-by
cache-sjc10026-SJC, cache-sjc10026-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
last-modified
Wed, 12 Apr 2023 18:46:30 GMT
server
Apache-Coyote/1.1
x-timer
S1682561434.917891,VS0,VE0
etag
W/"991-1681325190000-gzip"
x-frame-options
deny
vary
Accept-Encoding,Cookie
content-type
text/css
cache-control
max-age=604800
x-vcl-version
86
accept-ranges
bytes
expires
Wed, 19 Apr 2023 19:38:35 GMT
foot.css
www.csoonline.com/www.idge/css/
9 KB
2 KB
Stylesheet
General
Full URL
https://www.csoonline.com/www.idge/css/foot.css?v=20230412115149
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
a95ff5717cbb58f3acad7822a2413f4fac3d5c0fa1782f877067bb68e850c823
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-cache-hits
515, 515, 2, 2
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:33 GMT
age
213168
x-cache
HIT, HIT, HIT, HIT
content-length
2044
x-via-fastly
Verdad
x-served-by
cache-sjc10063-SJC, cache-sjc10063-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
last-modified
Wed, 12 Apr 2023 18:48:08 GMT
server
Apache-Coyote/1.1
x-timer
S1682561434.927425,VS0,VE0
etag
W/"8884-1681325288000-gzip"
x-frame-options
deny
vary
Accept-Encoding,Cookie
content-type
text/css
cache-control
max-age=604800
x-vcl-version
86
accept-ranges
bytes
expires
Mon, 24 Apr 2023 11:56:26 GMT
foot.css
www.csoonline.com/www.idge.cso/css/
2 KB
1009 B
Stylesheet
General
Full URL
https://www.csoonline.com/www.idge.cso/css/foot.css?v=20230412115149
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
227c7b295dd2359a1a3db3c8458f2081704b18e41be7da8076f04262ba3bcc56
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-cache-hits
0, 0, 2, 2
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:33 GMT
age
70820
x-cache
MISS, MISS, HIT, HIT
content-length
630
x-via-fastly
Verdad
x-served-by
cache-sjc10052-SJC, cache-sjc10052-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
last-modified
Wed, 12 Apr 2023 18:46:50 GMT
server
Apache-Coyote/1.1
x-timer
S1682561434.945030,VS0,VE0
etag
W/"2036-1681325210000-gzip"
x-frame-options
deny
vary
Accept-Encoding,Cookie
content-type
text/css
cache-control
max-age=604800
x-vcl-version
86
accept-ranges
bytes
expires
Wed, 19 Apr 2023 19:41:07 GMT
foundry-logo-white.svg
alt.idgesg.net/images/furniture/foundry/
3 KB
4 KB
Image
General
Full URL
https://alt.idgesg.net/images/furniture/foundry/foundry-logo-white.svg
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4c8d2ebc94fc9fbb0ce45ce5086f3c3cf15f50104ffc4b3fc027a216cf9e237e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-amz-version-id
S3QXKcoGVP4aVsQzzhiotd3C3Yo_AbxD
date
Thu, 27 Apr 2023 02:10:34 GMT
via
1.1 varnish
x-amz-request-id
3KEHD5M4BCDAFMN8
age
2132
x-amz-meta-origin-date-iso8601
2022-03-15T13:15:10.000Z
x-cache
HIT
content-length
3538
x-amz-id-2
8/uNot6RpzNeIUZKg8k4j9459R2vcTbo4wK7AuD4tKl0cm02X6sVVnFZzeVTCbJ/OkSyQ9emkk0=
x-served-by
cache-fra-eddf8230050-FRA
last-modified
Tue, 05 Apr 2022 18:13:11 GMT
server
AmazonS3
x-timer
S1682561434.289267,VS0,VE1
etag
"5828e43a67d1f51b7258fd4c3a749543"
content-type
image/svg+xml
accept-ranges
bytes
x-cache-hits
1
jquery-ui.js
www.csoonline.com/www/js/jquery/
292 KB
70 KB
Script
General
Full URL
https://www.csoonline.com/www/js/jquery/jquery-ui.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
66b5ca68288cc2506f1c5709fe38cebccca428406a7ce96e392718203666d503
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-cache-hits
4, 4, 2, 2
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:33 GMT
age
109609
x-cache
HIT, HIT, HIT, HIT
content-length
71002
x-via-fastly
Verdad
x-served-by
cache-sjc10055-SJC, cache-sjc10055-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
last-modified
Wed, 12 Apr 2023 18:51:14 GMT
server
Apache-Coyote/1.1
x-timer
S1682561434.953693,VS0,VE0
etag
W/"299210-1681325474000-gzip"
x-frame-options
deny
vary
Accept-Encoding,Cookie
content-type
application/javascript
cache-control
max-age=604800
x-vcl-version
86
accept-ranges
bytes
expires
Tue, 02 May 2023 05:40:48 GMT
jquery.dfp.min.js
www.csoonline.com/www/js/jquery/
4 KB
2 KB
Script
General
Full URL
https://www.csoonline.com/www/js/jquery/jquery.dfp.min.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
053d5c873a012d89c7a079d097426cfddb18b28494a55c51eff89e0294540dfd
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-cache-hits
418, 418, 2, 2
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:33 GMT
age
193181
x-cache
HIT, HIT, HIT, HIT
content-length
1722
x-via-fastly
Verdad
x-served-by
cache-sjc10036-SJC, cache-sjc10036-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
last-modified
Wed, 12 Apr 2023 18:51:14 GMT
server
Apache-Coyote/1.1
x-timer
S1682561434.976730,VS0,VE0
etag
W/"4433-1681325474000-gzip"
x-frame-options
deny
vary
Accept-Encoding,Cookie
content-type
application/javascript
cache-control
max-age=604800
x-vcl-version
86
accept-ranges
bytes
expires
Mon, 24 Apr 2023 20:12:47 GMT
shortstack_nav.js
www.csoonline.com/www.idge/js/mule/
2 KB
838 B
Script
General
Full URL
https://www.csoonline.com/www.idge/js/mule/shortstack_nav.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
fb6b1425ff73fe62d725a3981ac08d9f57e16e14d5ae321c617e21e1d7403d1f
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-cache-hits
426, 426, 2, 2
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:33 GMT
age
146706
x-cache
HIT, HIT, HIT, HIT
content-length
480
x-via-fastly
Verdad
x-served-by
cache-sjc10080-SJC, cache-sjc10080-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
last-modified
Wed, 12 Apr 2023 18:50:22 GMT
server
Apache-Coyote/1.1
x-timer
S1682561434.985266,VS0,VE0
etag
W/"2129-1681325422000-gzip"
x-frame-options
deny
vary
Accept-Encoding,Cookie
content-type
application/javascript
cache-control
max-age=604800
x-vcl-version
86
accept-ranges
bytes
expires
Tue, 25 Apr 2023 09:02:38 GMT
tracking.js
www.csoonline.com/www/js/analytics/
1 KB
834 B
Script
General
Full URL
https://www.csoonline.com/www/js/analytics/tracking.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
607bfd152e5c762ba0f0502f653c7bbb546ad7955e792a9840d4ae28a8219423
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-cache-hits
441, 441, 2, 2
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:34 GMT
age
97936
x-cache
HIT, HIT, HIT, HIT
content-length
538
x-via-fastly
Verdad
x-served-by
cache-sjc10053-SJC, cache-sjc10053-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
last-modified
Wed, 12 Apr 2023 18:51:02 GMT
server
Apache-Coyote/1.1
x-timer
S1682561434.013200,VS0,VE0
etag
W/"1075-1681325462000-gzip"
x-frame-options
deny
vary
Accept-Encoding,Cookie
content-type
application/javascript
cache-control
max-age=604800
x-vcl-version
86
accept-ranges
bytes
expires
Tue, 25 Apr 2023 22:33:16 GMT
jquery.colorbox-min.js
www.csoonline.com/www.idge/js/jquery/plugins/
11 KB
5 KB
Script
General
Full URL
https://www.csoonline.com/www.idge/js/jquery/plugins/jquery.colorbox-min.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
f370d6bd05df8e6a5b671f06e038c4d85d95dc5446fdeb8f8762e817882a8322
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-cache-hits
143, 143, 2, 2
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:34 GMT
age
528933
x-cache
HIT, HIT, HIT, HIT
content-length
4634
x-via-fastly
Verdad
x-served-by
cache-sjc10026-SJC, cache-sjc10026-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
last-modified
Wed, 12 Apr 2023 18:50:18 GMT
server
Apache-Coyote/1.1
x-timer
S1682561434.021129,VS0,VE0
etag
W/"11081-1681325418000-gzip"
x-frame-options
deny
vary
Accept-Encoding,Cookie
content-type
application/javascript
cache-control
max-age=604800
x-vcl-version
86
accept-ranges
bytes
expires
Thu, 20 Apr 2023 22:55:43 GMT
article.js
www.csoonline.com/www.idge/js/
2 KB
948 B
Script
General
Full URL
https://www.csoonline.com/www.idge/js/article.js?v=20230412115149
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
0dbf4106e062b56a7d4db32cb448fad76e1aad0bf204b8569091bdcb5abed21e
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-cache-hits
262, 262, 2, 2
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:34 GMT
age
70323
x-cache
HIT, HIT, HIT, HIT
content-length
613
x-via-fastly
Verdad
x-served-by
cache-sjc10076-SJC, cache-sjc10076-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
last-modified
Wed, 12 Apr 2023 18:50:12 GMT
server
Apache-Coyote/1.1
x-timer
S1682561434.034249,VS0,VE0
etag
W/"1707-1681325412000-gzip"
x-frame-options
deny
vary
Accept-Encoding,Cookie
content-type
application/javascript
cache-control
max-age=604800
x-vcl-version
86
accept-ranges
bytes
expires
Tue, 02 May 2023 16:36:37 GMT
responsive-tables.js
www.csoonline.com/www.idge/js/jquery/
1 KB
838 B
Script
General
Full URL
https://www.csoonline.com/www.idge/js/jquery/responsive-tables.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
a739dbffc4a907c1f133b4b26e0daf544ea743218bba5704a910313b0ef3ac10
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-cache-hits
310, 310, 2, 2
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:34 GMT
age
207539
x-cache
HIT, HIT, HIT, HIT
content-length
541
x-via-fastly
Verdad
x-served-by
cache-sjc10037-SJC, cache-sjc10037-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
last-modified
Wed, 12 Apr 2023 18:50:20 GMT
server
Apache-Coyote/1.1
x-timer
S1682561434.044207,VS0,VE0
etag
W/"1363-1681325420000-gzip"
x-frame-options
deny
vary
Accept-Encoding,Cookie
content-type
application/javascript
cache-control
max-age=604800
x-vcl-version
86
accept-ranges
bytes
expires
Mon, 24 Apr 2023 16:04:04 GMT
jquery.tablesorter.min.js
www.csoonline.com/www.idge/js/jquery/
16 KB
5 KB
Script
General
Full URL
https://www.csoonline.com/www.idge/js/jquery/jquery.tablesorter.min.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
55e8d16bb1a291b0524928dd3bd20c191a14d8a947e4b141271f9c595c7bb451
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-cache-hits
58, 58, 2, 2
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:34 GMT
age
89696
x-cache
HIT, HIT, HIT, HIT
content-length
4792
x-via-fastly
Verdad
x-served-by
cache-sjc10021-SJC, cache-sjc10021-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
last-modified
Wed, 12 Apr 2023 18:50:18 GMT
server
Apache-Coyote/1.1
x-timer
S1682561434.091249,VS0,VE0
etag
W/"16373-1681325418000-gzip"
x-frame-options
deny
vary
Accept-Encoding,Cookie
content-type
application/javascript
cache-control
max-age=604800
x-vcl-version
86
accept-ranges
bytes
expires
Wed, 26 Apr 2023 01:07:11 GMT
global.js
www.csoonline.com/www.idge/js/
14 KB
5 KB
Script
General
Full URL
https://www.csoonline.com/www.idge/js/global.js?v=20230412115149
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
e0c629f4ece53000517c7077027971a1dea36ec8c9daac30b7655bcbca84b00a
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-cache-hits
124, 124, 2, 2
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:34 GMT
age
113845
x-cache
HIT, HIT, HIT, HIT
content-length
4284
x-via-fastly
Verdad
x-served-by
cache-sjc10023-SJC, cache-sjc10023-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
last-modified
Wed, 12 Apr 2023 18:46:00 GMT
server
Apache-Coyote/1.1
x-timer
S1682561434.099866,VS0,VE0
etag
W/"14105-1681325160000-gzip"
x-frame-options
deny
vary
Accept-Encoding,Cookie
content-type
application/javascript
cache-control
max-age=604800
x-vcl-version
86
accept-ranges
bytes
expires
Tue, 02 May 2023 04:33:07 GMT
ss-social.js
www.csoonline.com/www/js/webfonts/
4 KB
2 KB
Script
General
Full URL
https://www.csoonline.com/www/js/webfonts/ss-social.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
af34f58ea2fc346a5f7028ad8b721a9bb31405cf283471a37dab53bad10a6a36
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-cache-hits
444, 444, 2, 2
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:34 GMT
age
206241
x-cache
HIT, HIT, HIT, HIT
content-length
1802
x-via-fastly
Verdad
x-served-by
cache-sjc10072-SJC, cache-sjc10072-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
last-modified
Wed, 12 Apr 2023 18:51:34 GMT
server
Apache-Coyote/1.1
x-timer
S1682561434.116738,VS0,VE0
etag
W/"3950-1681325494000-gzip"
x-frame-options
deny
vary
Accept-Encoding,Cookie
content-type
application/javascript
cache-control
max-age=604800
x-vcl-version
86
accept-ranges
bytes
expires
Mon, 24 Apr 2023 16:36:49 GMT
ss-standard.js
www.csoonline.com/www/js/webfonts/
11 KB
4 KB
Script
General
Full URL
https://www.csoonline.com/www/js/webfonts/ss-standard.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
bdfe5b167ff906b96e1f8f028ac8f5e41af7a1892d0cc3a275d28057ba79c0a9
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-cache-hits
297, 297, 2, 2
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:34 GMT
age
136408
x-cache
HIT, HIT, HIT, HIT
content-length
3933
x-via-fastly
Verdad
x-served-by
cache-sjc10026-SJC, cache-sjc10026-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
last-modified
Wed, 12 Apr 2023 18:51:34 GMT
server
Apache-Coyote/1.1
x-timer
S1682561434.124220,VS0,VE0
etag
W/"10818-1681325494000-gzip"
x-frame-options
deny
vary
Accept-Encoding,Cookie
content-type
application/javascript
cache-control
max-age=604800
x-vcl-version
86
accept-ranges
bytes
expires
Tue, 02 May 2023 01:38:41 GMT
brandAnalytics.js
www.csoonline.com/www/js/analytics/
2 KB
796 B
Script
General
Full URL
https://www.csoonline.com/www/js/analytics/brandAnalytics.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
9844fb443bd322af1d908116fa890abdbed6b8b6fe73fba91c9beb8408318aad
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-cache-hits
33, 33, 2, 2
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:34 GMT
age
143118
x-cache
HIT, HIT, HIT, HIT
content-length
461
x-via-fastly
Verdad
x-served-by
cache-sjc10036-SJC, cache-sjc10036-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
last-modified
Wed, 12 Apr 2023 18:51:00 GMT
server
Apache-Coyote/1.1
x-timer
S1682561434.142468,VS0,VE0
etag
W/"2516-1681325460000-gzip"
x-frame-options
deny
vary
Accept-Encoding,Cookie
content-type
application/javascript
cache-control
max-age=604800
x-vcl-version
86
accept-ranges
bytes
expires
Tue, 25 Apr 2023 09:52:31 GMT
locales-editions-slug.js
www.csoonline.com/www/js/
2 KB
833 B
Script
General
Full URL
https://www.csoonline.com/www/js/locales-editions-slug.js?v=20230412115149
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
dc1f34948cbeccb66c1b22633753475c2b3bd39c85c3f4695afba334a7f1fc75
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-cache-hits
4, 4, 2, 2
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:34 GMT
age
65753
x-cache
HIT, HIT, HIT, HIT
content-length
597
x-via-fastly
Verdad
x-served-by
cache-sjc10071-SJC, cache-sjc10071-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
last-modified
Wed, 12 Apr 2023 18:51:16 GMT
server
Apache-Coyote/1.1
x-timer
S1682561434.143335,VS0,VE0
etag
W/"2371-1681325476000-gzip"
x-frame-options
deny
vary
Accept-Encoding,Cookie
content-type
application/javascript
cache-control
max-age=604800
x-vcl-version
86
accept-ranges
bytes
expires
Wed, 19 Apr 2023 19:38:39 GMT
subscribers.js
cdn.subscribers.com/assets/
54 KB
15 KB
Script
General
Full URL
https://cdn.subscribers.com/assets/subscribers.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:3882 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c2facc83585250863ffab013bd876eeada78fcbd090d015c6f3ac418a2501f38

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 27 Apr 2023 02:10:34 GMT
content-encoding
gzip
cf-cache-status
HIT
last-modified
Tue, 11 Apr 2023 09:10:25 GMT
server
cloudflare
x-amz-request-id
3GR7T1Y269ECQ149
age
797
etag
W/"921f989db602e1917e01d821fcb02b44"
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
content-type
text/javascript
cf-ray
7be387a3be192bc7-FRA
x-amz-id-2
IbaAKthrXIPOI5Hp9Eqnda5gP1lPadS9UQCW+75FbJE9mOBemHF5/SgWytzzsVyLFh77uCz7sXU=
get_site_data
cmpv2.csoonline.com/mms/v2/
198 B
613 B
XHR
General
Full URL
https://cmpv2.csoonline.com/mms/v2/get_site_data?hasCsp=true&href=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3694850%2Firanian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html&account_id=146
Requested by
Host: cmpv2.csoonline.com
URL: https://cmpv2.csoonline.com/wrapperMessagingWithoutDetection.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-43.fra50.r.cloudfront.net
Software
/
Resource Hash
5e0784f265f20230748207a0c6311051fc3feb34622c64464a47465a6623119b
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubdomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Wed, 26 Apr 2023 21:55:37 GMT
strict-transport-security
max-age=15552000; includeSubdomains
x-sp-mms-node
ip-10-128-37-244
via
1.1 b912dc97777020eb19579888add26978.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA50-C1
age
15297
access-control-allow-methods
GET
content-type
application/javascript
access-control-allow-origin
*
x-cache
Hit from cloudfront
cache-control
max-age=3600, s-maxage=86400
access-control-allow-credentials
true
x-amz-cf-id
8TLDw8GVF5VUECwDMSHaHzw4HhJcRKqFrYg52a3SosUDAGpBu2Lmcg==
get_site_data
cmp.csoonline.com/mms/
198 B
585 B
XHR
General
Full URL
https://cmp.csoonline.com/mms/get_site_data?requestUUID=b2c51e39-834a-40ae-9df8-a0d9458b31d5&account_id=146&href=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3694850%2Firanian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Requested by
Host: ccpa.sp-prod.net
URL: https://ccpa.sp-prod.net/ccpa.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.222.236.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-222-236-19.fra56.r.cloudfront.net
Software
/
Resource Hash
5e0784f265f20230748207a0c6311051fc3feb34622c64464a47465a6623119b
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubdomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 27 Apr 2023 02:10:34 GMT
strict-transport-security
max-age=15552000; includeSubdomains
x-sp-mms-node
ip-10-128-32-248
via
1.1 a2cac9c5f0e90f8b7fede4ac9aca75ca.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P4
access-control-allow-methods
GET
content-type
text/plain
access-control-allow-origin
*
x-cache
Miss from cloudfront
cache-control
max-age=2592000
access-control-allow-credentials
true
x-amz-cf-id
h_TWaD79qVy0yFCP7pVvTeyeOrJUye8PrykiELBbfaADV4bS-SB6wA==
gpt.js
securepubads.g.doubleclick.net/tag/js/
74 KB
25 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/www/js/ads/gpt_starter.js?1234
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
5f73732b6a7db119255640eb6e05727feb081ee5830baa018beee78269e37df5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 27 Apr 2023 02:10:34 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
24767
x-xss-protection
0
server
cafe
etag
427 / 19474 / 31074156 / config-hash: 18063574894499659646
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
expires
Thu, 27 Apr 2023 02:10:34 GMT
print.css
www.csoonline.com/www.idge/css/
2 KB
1 KB
Stylesheet
General
Full URL
https://www.csoonline.com/www.idge/css/print.css
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
a5e5c781317ce492049cb1f9e1deec67c47bbe5dbd03ec12f688cf7a221a79f2
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-cache-hits
184, 184, 2, 2
strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:34 GMT
age
130592
x-cache
HIT, HIT, HIT, HIT
content-length
764
x-via-fastly
Verdad
x-served-by
cache-sjc10039-SJC, cache-sjc10039-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
last-modified
Wed, 12 Apr 2023 18:48:12 GMT
server
Apache-Coyote/1.1
x-timer
S1682561434.143216,VS0,VE0
etag
W/"1871-1681325292000-gzip"
x-frame-options
deny
vary
Accept-Encoding,Cookie
content-type
text/css
cache-control
max-age=604800
x-vcl-version
86
accept-ranges
bytes
expires
Tue, 25 Apr 2023 13:18:05 GMT
p.css
p.typekit.net/
5 B
181 B
Stylesheet
General
Full URL
https://p.typekit.net/p.css?s=1&k=vjj6ndp&ht=tk&f=25310.25312.25313.25318&a=113850475&app=typekit&e=css
Requested by
Host: use.typekit.net
URL: https://use.typekit.net/vjj6ndp.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:148b Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://use.typekit.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 27 Apr 2023 02:10:34 GMT
last-modified
Sat, 16 Oct 2021 08:18:43 GMT
server
nginx
etag
"616a8ae3-5"
content-type
text/css
access-control-allow-origin
*
cache-control
public, max-age=604800
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
content-length
5
latest-version
cmpv2.csoonline.com/consent/tcfv2/vendor-list/ Frame
0
0
Preflight
General
Full URL
https://cmpv2.csoonline.com/consent/tcfv2/vendor-list/latest-version?siteId=3918&accountId=146&hasCsp=true
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-43.fra50.r.cloudfront.net
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
GET
Origin
https://www.csoonline.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Origin,X-Requested-With,Content-Type,Accept,Authorization
access-control-allow-methods
GET, PUT, POST, DELETE
access-control-allow-origin
*
access-control-max-age
600
cache-control
max-age=0, s-maxage=600
content-length
2
content-type
text/plain; charset=utf-8
date
Thu, 27 Apr 2023 02:10:34 GMT
strict-transport-security
max-age=15552000; includeSubDomains
via
1.1 b912dc97777020eb19579888add26978.cloudfront.net (CloudFront)
x-amz-cf-id
PklAzUKVuDgKAlGUMdN52_9K7Hm1VnC_QBePfa7QQlYByDO6daXBmw==
x-amz-cf-pop
FRA50-C1
x-cache
Miss from cloudfront
latest-version
cmpv2.csoonline.com/consent/tcfv2/vendor-list/
206 B
697 B
XHR
General
Full URL
https://cmpv2.csoonline.com/consent/tcfv2/vendor-list/latest-version?siteId=3918&accountId=146&hasCsp=true
Requested by
Host: cmpv2.csoonline.com
URL: https://cmpv2.csoonline.com/wrapperMessagingWithoutDetection.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-43.fra50.r.cloudfront.net
Software
/
Resource Hash
088c90bc5a9ec59b87adcc61ba4f15e7713e884ada4fd01165d897858c2951e0
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

Referer
https://www.csoonline.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type
application/json

Response headers

date
Thu, 27 Apr 2023 02:10:34 GMT
strict-transport-security
max-age=15552000; includeSubDomains
via
1.1 b912dc97777020eb19579888add26978.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA50-C1
vary
Accept-Encoding
access-control-allow-methods
GET, PUT, POST, DELETE
content-type
application/json; charset=utf-8
access-control-allow-origin
*
x-cache
Miss from cloudfront
cache-control
max-age=0, s-maxage=600
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization
content-length
206
x-amz-cf-id
_dk7e2i3gAekvzabIp8yc0PhG82JYnGx4LzfXrqWrEFd_IUFzblXXw==
gtm.js
www.googletagmanager.com/
296 KB
90 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-WR6LD2P
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
c3d405a4118aebae54f30c61193f2634568e02bcbff030673eef87e064fcbfc3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 27 Apr 2023 02:10:34 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
92073
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Thu, 27 Apr 2023 02:10:34 GMT
f5b3be27-f789-4ef1-8867-37c67da5b361-web.js
cdn.permutive.com/
587 KB
170 KB
Script
General
Full URL
https://cdn.permutive.com/f5b3be27-f789-4ef1-8867-37c67da5b361-web.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/www/js/jquery/jquery-1.10.2.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.19.150.54 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0f6f002861bd83ee77f252a7d0d84f00167a6ebe1392af0814aec41463edfa39

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 27 Apr 2023 02:10:34 GMT
content-encoding
br
cf-cache-status
HIT
x-goog-meta-oid
f5b3be27-f789-4ef1-8867-37c67da5b361
age
0
x-guploader-uploadid
ADPycdtB6POW4LVb5igkLmGh_lLeqqELV1ZA4Nzpk3_uSLNlqxXR8Pv6csF6bn_LUdIrLBhX6Fofcvc2D5FrMoHuuOnAag
x-goog-storage-class
REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
gzip
last-modified
Wed, 12 Apr 2023 14:36:34 GMT
server
cloudflare
etag
W/"f1498a866eee7722ac76d38581562620"
vary
Accept-Encoding
x-goog-generation
1681310194596111
content-type
application/javascript
x-goog-hash
crc32c=B4N9lA==, md5=8UmKhm7udyKsdtOFgVYmIA==
cache-control
public, max-age=900
x-goog-stored-content-length
179052
timing-allow-origin
*
cf-ray
7be387a44cc73688-FRA
expires
Thu, 27 Apr 2023 02:25:34 GMT
new-user
cmpv2.csoonline.com/wrapper/tcfv2/v2/gdpr/native-message/ Frame
0
0
Preflight
General
Full URL
https://cmpv2.csoonline.com/wrapper/tcfv2/v2/gdpr/native-message/new-user?hasCsp=true&env=prod&body=%7B%22propertyId%22%3A3918%2C%22accountId%22%3A146%2C%22propertyHref%22%3A%22https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3694850%2Firanian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html%22%2C%22meta%22%3A%22%7B%5C%22mmsCookies%5C%22%3A%5B%5D%2C%5C%22resolved%5C%22%3Anull%7D%22%2C%22clientMMSOrigin%22%3A%22https%3A%2F%2Fcmpv2.csoonline.com%22%2C%22targetingParams%22%3A%22%7B%5C%22type%5C%22%3A%5C%22GDPR%5C%22%7D%22%2C%22campaignEnv%22%3A%22prod%22%2C%22legalBasisChanges%22%3Afalse%2C%22vendorListAdditions%22%3Afalse%7D&nonkeyed=%7B%22_sp_v1_uid%22%3Anull%2C%22_sp_v1_data%22%3Anull%7D&scriptVersion=2.6.0&scriptType=tcfv2&ch=4081074224201046643883
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-43.fra50.r.cloudfront.net
Software
/ Express
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
GET
Origin
https://www.csoonline.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Origin,X-Requested-With,Content-Type,Accept,Authorization,SP_SCRIPT_VERSION
access-control-allow-methods
GET, PUT, POST, DELETE
access-control-allow-origin
*
access-control-max-age
86400
cache-control
max-age=86400, s-maxage=1200
content-length
2
content-type
text/plain; charset=utf-8
date
Thu, 27 Apr 2023 02:10:34 GMT
strict-transport-security
max-age=15552000; includeSubDomains
vary
Accept-Encoding
via
1.1 b912dc97777020eb19579888add26978.cloudfront.net (CloudFront)
x-amz-cf-id
CgZc5wtSnFmF4-S8ui9f_hrnVrl-iSgNWmDvV-OlUclC9ruWBH-Pmw==
x-amz-cf-pop
FRA50-C1
x-cache
Miss from cloudfront
x-powered-by
Express
new-user
cmpv2.csoonline.com/wrapper/tcfv2/v2/gdpr/native-message/
166 KB
12 KB
XHR
General
Full URL
https://cmpv2.csoonline.com/wrapper/tcfv2/v2/gdpr/native-message/new-user?hasCsp=true&env=prod&body=%7B%22propertyId%22%3A3918%2C%22accountId%22%3A146%2C%22propertyHref%22%3A%22https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3694850%2Firanian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html%22%2C%22meta%22%3A%22%7B%5C%22mmsCookies%5C%22%3A%5B%5D%2C%5C%22resolved%5C%22%3Anull%7D%22%2C%22clientMMSOrigin%22%3A%22https%3A%2F%2Fcmpv2.csoonline.com%22%2C%22targetingParams%22%3A%22%7B%5C%22type%5C%22%3A%5C%22GDPR%5C%22%7D%22%2C%22campaignEnv%22%3A%22prod%22%2C%22legalBasisChanges%22%3Afalse%2C%22vendorListAdditions%22%3Afalse%7D&nonkeyed=%7B%22_sp_v1_uid%22%3Anull%2C%22_sp_v1_data%22%3Anull%7D&scriptVersion=2.6.0&scriptType=tcfv2&ch=4081074224201046643883
Requested by
Host: cmpv2.csoonline.com
URL: https://cmpv2.csoonline.com/wrapperMessagingWithoutDetection.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-43.fra50.r.cloudfront.net
Software
/ Express
Resource Hash
96d0dd911efdc3f82fa2ec6e9322740d6175933f9443f6b9b233b58c7b46a893
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

Referer
https://www.csoonline.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type
application/json

Response headers

date
Thu, 27 Apr 2023 02:10:34 GMT
strict-transport-security
max-age=15552000; includeSubDomains
content-encoding
gzip
via
1.1 b912dc97777020eb19579888add26978.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA50-C1
x-powered-by
Express
vary
Accept-Encoding
access-control-allow-methods
GET, PUT, POST, DELETE
content-type
application/json; charset=utf-8
access-control-allow-origin
*
x-cache
Miss from cloudfront
cache-control
max-age=0, s-maxage=1200
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization, SP_SCRIPT_VERSION
x-amz-cf-id
ye3frW35QHZs7sRvh67F2-Ur-a3neKZgSBlDWpEutGynaM-Z6CnJOw==
cso-logo-idg.svg
idge.staticworld.net/cso/
4 KB
4 KB
Image
General
Full URL
https://idge.staticworld.net/cso/cso-logo-idg.svg
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/www.idge.cso/css/article.css?v=20230412115149
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ef7755857c07a98436dce7c81f0071da4925b63aa320f6a600eafdc08d620f5f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-amz-version-id
oZFBpEq1ZhNl2KLvmAO7EkSd4kjPfufK
date
Thu, 27 Apr 2023 02:10:34 GMT
via
1.1 varnish
x-amz-request-id
08PP40TR8A0H10BG
age
1563
x-cache
HIT
content-length
3923
x-amz-id-2
xmFpu1Nn3KoTbPSTY/qHVWdtDxYq1pGdijVmMu4QZ2yiW1/Eb0JWEcpZv40fkyfap2bNhbidTBI=
x-served-by
cache-fra-eddf8230050-FRA
last-modified
Tue, 27 Mar 2018 00:09:02 GMT
server
AmazonS3
x-timer
S1682561435.528268,VS0,VE1
etag
"52e975d0aa09163968fbd12cf29e4088"
content-type
image/svg+xml
accept-ranges
bytes
x-cache-hits
1
cse.js
cse.google.com/
9 KB
4 KB
Script
General
Full URL
https://cse.google.com/cse.js?cx=011881588825642368632:b0mgdf4z90i
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
gws /
Resource Hash
ad0caf6aded59a5161a02d4625a5ae70845f1a854bb1a6df49c0acd387fbcc3f
Security Headers
Name Value
Content-Security-Policy object-src 'none';base-uri 'self';script-src 'nonce-Kq3f2gupoWkLD48Ebr_thA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

content-security-policy
object-src 'none';base-uri 'self';script-src 'nonce-Kq3f2gupoWkLD48Ebr_thA' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/other
content-encoding
br
date
Thu, 27 Apr 2023 02:10:34 GMT
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
3146
x-xss-protection
0
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Full-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-WoW64
cross-origin-opener-policy
same-origin-allow-popups; report-to="gws"
server
gws
x-frame-options
SAMEORIGIN
report-to
{"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/other"}]}
content-type
text/javascript; charset=UTF-8
cache-control
private
permissions-policy
unload=()
origin-trial
Ap+qNlnLzJDKSmEHjzM5ilaa908GuehlLqGb6ezME5lkhelj20qVzfv06zPmQ3LodoeujZuphAolrnhnPA8w4AIAAABfeyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJQZXJtaXNzaW9uc1BvbGljeVVubG9hZCIsImV4cGlyeSI6MTY4NTY2Mzk5OX0=, AvudrjMZqL7335p1KLV2lHo1kxdMeIN0dUI15d0CPz9dovVLCcXk8OAqjho1DX4s6NbHbA/AGobuGvcZv0drGgQAAAB9eyJvcmlnaW4iOiJodHRwczovL3d3dy5nb29nbGUuY29tOjQ0MyIsImZlYXR1cmUiOiJCYWNrRm9yd2FyZENhY2hlTm90UmVzdG9yZWRSZWFzb25zIiwiZXhwaXJ5IjoxNjkxNTM5MTk5LCJpc1N1YmRvbWFpbiI6dHJ1ZX0=
expires
Thu, 27 Apr 2023 02:10:34 GMT
CSO-logo-nav.svg
alt.idgesg.net/images/furniture/cso/
2 KB
2 KB
Image
General
Full URL
https://alt.idgesg.net/images/furniture/cso/CSO-logo-nav.svg
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/www.idge.cso/css/oc-header.css?v=20230412115149
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
9eb5f4aaf681528b1c83e13a0e9302e9f05132372e35dbc96c95485198028d56

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-amz-version-id
1AZpuIKi8PcjBsPZ3lrXz_o5ZjbADhP.
date
Thu, 27 Apr 2023 02:10:34 GMT
via
1.1 varnish
x-amz-request-id
A4R8Z46QZNXCD27A
age
1662
x-amz-meta-origin-date-iso8601
2019-03-20T14:28:52.000Z
x-cache
HIT
content-length
2222
x-amz-id-2
Gm0Zy3hWLszDxC6qhv7efUih48kdKvoWZZ/QuxjRR9xIR0piRr7NGUBxkayn/ZjtYa4X98/j8Qo=
x-served-by
cache-fra-eddf8230050-FRA
last-modified
Wed, 20 Mar 2019 14:29:23 GMT
server
AmazonS3
x-timer
S1682561434.288964,VS0,VE1
etag
"a826e9631dda67c762e2f43ab9fbe6a6"
content-type
image/svg+xml
accept-ranges
bytes
x-cache-hits
1
hamburger-v2.svg
alt.idgesg.net/images/furniture/
610 B
858 B
Image
General
Full URL
https://alt.idgesg.net/images/furniture/hamburger-v2.svg
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/www/css/oc-header.css?v=20230412115149
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
413215e01c47f149df91c6d2281bc5288980420466333b3190d2807c1a5a6966

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-amz-version-id
1fnsULWZsCA3r7yvlAPj1P80IHmK7W6x
date
Thu, 27 Apr 2023 02:10:34 GMT
via
1.1 varnish
x-amz-request-id
N1ESG1T8SMKG3C2A
age
2116
x-amz-meta-origin-date-iso8601
2018-12-17T19:19:51.000Z
x-cache
HIT
content-length
610
x-amz-id-2
MXd2Ru3yO4bz8ig7EEDkFIoefeqH2j7soDzatXxP5x/ZB/0WpPdPkH+sBEFLNkeUbLM6BcMnbkM=
x-served-by
cache-fra-eddf8230050-FRA
last-modified
Mon, 17 Dec 2018 19:20:57 GMT
server
AmazonS3
x-timer
S1682561434.289033,VS0,VE1
etag
"cf32478c18a5e4e5ee7de7180fb12c18"
content-type
image/svg+xml
accept-ranges
bytes
x-cache-hits
1
ss-standard.woff
www.csoonline.com/www.idge/css/webfonts/
26 KB
27 KB
Font
General
Full URL
https://www.csoonline.com/www.idge/css/webfonts/ss-standard.woff
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/www.idge/css/webfonts/ss-standard.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
d2aae940b6d023c99cbd656bbd0868f51bcf4a93455efef42cc95d8a4c7bceca
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

Referer
https://www.csoonline.com/www.idge/css/webfonts/ss-standard.css
Origin
https://www.csoonline.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:34 GMT
age
2561
x-cache
HIT, HIT, HIT, HIT
content-length
27058
x-via-fastly
Verdad
x-served-by
cache-sjc10057-SJC, cache-sjc10057-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
last-modified
Wed, 12 Apr 2023 18:46:00 GMT
server
Apache-Coyote/1.1
x-timer
S1682561434.172810,VS0,VE2
etag
W/"27096-1681325160000-gzip"
x-frame-options
deny
vary
Accept-Encoding,Cookie
content-type
font/woff
x-vcl-version
86
accept-ranges
bytes
x-cache-hits
83, 83, 1, 1
l
use.typekit.net/af/44c438/00000000000000007735a64e/30/
23 KB
23 KB
Font
General
Full URL
https://use.typekit.net/af/44c438/00000000000000007735a64e/30/l?primer=f592e0a4b9356877842506ce344308576437e4f677d7c9b78ca2162e6cad991a&fvd=n7&v=3
Requested by
Host: use.typekit.net
URL: https://use.typekit.net/vjj6ndp.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:148f Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
3472bf5f9320c4b1df7296ee201873128a3cc7db522928274ed50ce0427b190b

Request headers

Referer
https://use.typekit.net/vjj6ndp.css
Origin
https://www.csoonline.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 27 Apr 2023 02:10:34 GMT
server
nginx
etag
"94bbe57e0115db4dccf4e8d9fde8748b577b42c7"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
23796
l
use.typekit.net/af/08fe52/00000000000000007735a650/30/
23 KB
23 KB
Font
General
Full URL
https://use.typekit.net/af/08fe52/00000000000000007735a650/30/l?primer=f592e0a4b9356877842506ce344308576437e4f677d7c9b78ca2162e6cad991a&fvd=n4&v=3
Requested by
Host: use.typekit.net
URL: https://use.typekit.net/vjj6ndp.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:3500:16::215:148f Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
nginx /
Resource Hash
4c19de2a2807b21157d84619e86d71d6afbf4ecf0ee81b0facc3d0b0bfd19f5b

Request headers

Referer
https://use.typekit.net/vjj6ndp.css
Origin
https://www.csoonline.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 27 Apr 2023 02:10:34 GMT
server
nginx
etag
"70600c9f9504b5ae852c963aee91ae0a0d1ed401"
content-type
application/font-woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
content-length
23652
ss-social-circle.woff
www.csoonline.com/www.idge/css/webfonts/
10 KB
10 KB
Font
General
Full URL
https://www.csoonline.com/www.idge/css/webfonts/ss-social-circle.woff
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/www.idge/css/webfonts/ss-social.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
8982bee74ee4a24031eea6ffe2cf2a3a41b3eee01490dfb4b8a641ef69dc923f
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

Referer
https://www.csoonline.com/www.idge/css/webfonts/ss-social.css
Origin
https://www.csoonline.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:34 GMT
age
3887
x-cache
HIT, HIT, HIT, HIT
content-length
9695
x-via-fastly
Verdad
x-served-by
cache-sjc10050-SJC, cache-sjc10050-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
last-modified
Wed, 12 Apr 2023 18:46:00 GMT
server
Apache-Coyote/1.1
x-timer
S1682561434.172795,VS0,VE1
etag
W/"9732-1681325160000-gzip"
x-frame-options
deny
vary
Accept-Encoding,Cookie
content-type
font/woff
x-vcl-version
86
accept-ranges
bytes
x-cache-hits
104, 104, 1, 1
fa-solid-900.woff2
use.fontawesome.com/releases/v5.6.1/webfonts/
77 KB
78 KB
Font
General
Full URL
https://use.fontawesome.com/releases/v5.6.1/webfonts/fa-solid-900.woff2
Requested by
Host: use.fontawesome.com
URL: https://use.fontawesome.com/releases/v5.6.1/css/all.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:e2::ac40:840f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
08aa3a5ee68a21d5771a70b20495b6da1c0f996c46982cd1b0447ad2db730d11

Request headers

Referer
https://use.fontawesome.com/releases/v5.6.1/css/all.css
Origin
https://www.csoonline.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 27 Apr 2023 02:10:34 GMT
cf-cache-status
HIT
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
x-amz-request-id
XJRXZ8XMN9HVW8PQ
age
1982298
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
79072
x-amz-id-2
uoBeglxPGDWsm80+7tnoWyhOKU8DJU1bra0RLRB2g/nBfQjyBRi3KIFD4JbE4J19n2C/0v5EaoQ=
last-modified
Wed, 30 Jun 2021 15:44:33 GMT
server
cloudflare
etag
"59ea9019c9b9bc4d83ab9783e830735c"
access-control-max-age
3000
access-control-allow-methods
GET
content-type
font/woff2
access-control-allow-origin
*
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=739O8YPvKo4No%2FHQp7RWP1jmsXIQpA7EXiAYzJuqro3qgvVg4XExM%2FsDkmTHPtsOEOltY3g4FyMiBxotZJthkk2MRlHV75N%2FcGs0Sy0DyzSdgAGqWPi1GfzOPpkTKT9tLWfyMWG1GT20nr6y7oCxr0gI"}],"group":"cf-nel","max_age":604800}
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
cache-control
max-age=31556926
accept-ranges
bytes
cf-ray
7be387a39a023a4a-FRA
pv-data
cmpv2.csoonline.com/consent/tcfv2/consent/v2/data-pipeline/ Frame
0
0
Preflight
General
Full URL
https://cmpv2.csoonline.com/consent/tcfv2/consent/v2/data-pipeline/pv-data?hasCsp=true&ch=4081074224201046643883
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-43.fra50.r.cloudfront.net
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.csoonline.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Origin,X-Requested-With,Content-Type,Accept,Authorization
access-control-allow-methods
GET, PUT, POST, DELETE
access-control-allow-origin
*
allow
POST
cache-control
no-cache
content-length
4
content-type
text/html; charset=utf-8
date
Thu, 27 Apr 2023 02:10:34 GMT
strict-transport-security
max-age=15552000; includeSubDomains
vary
Accept-Encoding
via
1.1 b912dc97777020eb19579888add26978.cloudfront.net (CloudFront)
x-amz-cf-id
AH-kTgpUes-sMZmbrI1Qc9iqE-NXQdoLtlQt890jYDLf8LFDpI7HFw==
x-amz-cf-pop
FRA50-C1
x-cache
Miss from cloudfront
pv-data
cmpv2.csoonline.com/consent/tcfv2/consent/v2/data-pipeline/
1 KB
1 KB
XHR
General
Full URL
https://cmpv2.csoonline.com/consent/tcfv2/consent/v2/data-pipeline/pv-data?hasCsp=true&ch=4081074224201046643883
Requested by
Host: cmpv2.csoonline.com
URL: https://cmpv2.csoonline.com/wrapperMessagingWithoutDetection.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-43.fra50.r.cloudfront.net
Software
/
Resource Hash
0f58934f4f992088c01669d27d5e99816f7befa4927cb2fb9ca55397d75d6791
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

Referer
https://www.csoonline.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type
application/json

Response headers

date
Thu, 27 Apr 2023 02:10:34 GMT
strict-transport-security
max-age=15552000; includeSubDomains
content-encoding
gzip
via
1.1 b912dc97777020eb19579888add26978.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA50-C1
vary
Accept-Encoding
access-control-allow-methods
GET, PUT, POST, DELETE
content-type
application/json; charset=utf-8
access-control-allow-origin
*
x-cache
Miss from cloudfront
cache-control
no-cache
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization
x-amz-cf-id
vHZJU43e5A3EPPGysvzmXG_JAPqsXeHz3iGXCWxdllD9SN4w-b4w8Q==
ss-social-regular.woff
www.csoonline.com/www.idge/css/webfonts/
16 KB
17 KB
Font
General
Full URL
https://www.csoonline.com/www.idge/css/webfonts/ss-social-regular.woff
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/www.idge/css/webfonts/ss-social.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
3d5629a5cbadabfd67e7c99b9e71569f356ebf7fddabd5b3c24e37b49a48c605
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

Referer
https://www.csoonline.com/www.idge/css/webfonts/ss-social.css
Origin
https://www.csoonline.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:34 GMT
age
5565
x-cache
HIT, HIT, HIT, HIT
content-length
16793
x-via-fastly
Verdad
x-served-by
cache-sjc10044-SJC, cache-sjc10044-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
last-modified
Wed, 12 Apr 2023 18:46:00 GMT
server
Apache-Coyote/1.1
x-timer
S1682561434.256513,VS0,VE1
etag
W/"16804-1681325160000-gzip"
x-frame-options
deny
vary
Accept-Encoding,Cookie
content-type
font/woff
x-vcl-version
86
accept-ranges
bytes
x-cache-hits
21, 21, 1, 1
message_url
cmp.csoonline.com/mms/v2/
0
457 B
XHR
General
Full URL
https://cmp.csoonline.com/mms/v2/message_url?requestUUID=b2c51e39-834a-40ae-9df8-a0d9458b31d5&account_id=146&abp=false&href=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3694850%2Firanian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html&consentUUID=undefined&loadedData=%5B%7B%22id%22%3A%22CONSENT%3Aendpoint%3Ahttps%3A%2F%2Fccpa-service.sp-prod.net%3A3918%22%2C%22result%22%3A%22%7B%5C%22hasConsentData%5C%22%3Afalse%2C%5C%22consentedToAny%5C%22%3Afalse%2C%5C%22consentedToAll%5C%22%3Afalse%2C%5C%22rejectedAny%5C%22%3Afalse%7D%22%7D%5D&stage_campaign=false&cookie=%5B%22_sp_v1_uid%3D1%3A856%3Aa1fff3f5-23a7-481a-8857-021a2035e285%3B%22%2C%22_sp_v1_data%3D2%3A591288%3A1682561434%3A0%3A1%3A0%3A1%3A0%3A0%3A_%3A-1%3B%22%2C%22_sp_v1_ss%3D1%3AH4sIAAAAAAAAAItWqo5RKimOUbKKpiIjD8QwqI3ViVFKBTHzSnNygOwSsILq2mEjoRQLAKUpDPRAAQAA%22%5D&t[type]=CCPA
Requested by
Host: ccpa.sp-prod.net
URL: https://ccpa.sp-prod.net/ccpa.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.222.236.19 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-222-236-19.fra56.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubdomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 27 Apr 2023 02:10:34 GMT
strict-transport-security
max-age=15552000; includeSubdomains
x-sp-mms-node
ip-10-128-33-30
via
1.1 a2cac9c5f0e90f8b7fede4ac9aca75ca.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P4
x-cache
Miss from cloudfront
x-sp-mms-env
1
content-length
0
pragma
no-cache
access-control-allow-methods
GET
content-type
application/json
access-control-allow-origin
https://www.csoonline.com
cache-control
no-store, no-cache, private
access-control-allow-credentials
true
x-amz-cf-id
ZpZr668a1LdQdczQjwbOhWYBCIFJfadbSxA6JeSu6HnLMiixVHY81g==
expires
Sat, 15 Nov 2008 16:00:00 GMT
display-dns
ccpa-service.sp-prod.net/ccpa/consent/3918/
649 B
972 B
XHR
General
Full URL
https://ccpa-service.sp-prod.net/ccpa/consent/3918/display-dns?requestUUID=b2c51e39-834a-40ae-9df8-a0d9458b31d5
Requested by
Host: ccpa.sp-prod.net
URL: https://ccpa.sp-prod.net/ccpa.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.193.119.244 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-193-119-244.compute-1.amazonaws.com
Software
/
Resource Hash
9c10c9bbb18ea74a6ecc43dc83bc6a1878ddbd5a2a2da428df090e641502e9b4
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

Referer
https://www.csoonline.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type
application/json

Response headers

date
Thu, 27 Apr 2023 02:10:34 GMT
strict-transport-security
max-age=15552000; includeSubDomains
access-control-allow-methods
GET, PUT, POST, DELETE
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.csoonline.com
cache-control
no-cache
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization
content-length
649
display-dns
ccpa-service.sp-prod.net/ccpa/consent/3918/ Frame
0
0
Preflight
General
Full URL
https://ccpa-service.sp-prod.net/ccpa/consent/3918/display-dns?requestUUID=b2c51e39-834a-40ae-9df8-a0d9458b31d5
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.193.119.244 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-193-119-244.compute-1.amazonaws.com
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.csoonline.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Origin,X-Requested-With,Content-Type,Accept,Authorization
access-control-allow-methods
GET, PUT, POST, DELETE
access-control-allow-origin
https://www.csoonline.com
allow
POST
cache-control
no-cache
content-length
4
content-type
text/html; charset=utf-8
date
Thu, 27 Apr 2023 02:10:34 GMT
strict-transport-security
max-age=15552000; includeSubDomains
tso
www.csoonline.com/ads/
16 B
406 B
XHR
General
Full URL
https://www.csoonline.com/ads/tso?localeId=10
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/www/js/jquery/jquery-1.10.2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
2aa4924d40619a50c69124b81159e9d183bf42ed9792d2bdf442ce232fc53221
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:34 GMT
age
3525
x-cache
HIT, HIT, MISS, MISS
content-length
36
x-via-fastly
Verdad
x-served-by
cache-sjc10035-SJC, cache-sjc10035-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
server
Apache-Coyote/1.1
x-timer
S1682561434.314871,VS0,VE149
x-frame-options
deny
x-fastly-ttl
14400.000
content-type
application/json;charset=UTF-8
vary
Accept-Encoding,Cookie
cache-control
max-age=14400
x-vcl-version
86
accept-ranges
bytes
x-fastly-stale
432000.000
x-cache-hits
2, 2, 0, 0
beacon.js
sb.scorecardresearch.com/
4 KB
2 KB
Script
General
Full URL
https://sb.scorecardresearch.com/beacon.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.99.105 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-99-105.fra60.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
1aee66e2e24e851039801c0dace90f3efb7a1a17b033f7d5bbc12ca7c1d19432

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Wed, 26 Apr 2023 05:40:27 GMT
content-encoding
gzip
via
1.1 fa8c9f29fb8ef5c537a2a53f4de05240.cloudfront.net (CloudFront)
last-modified
Thu, 09 Mar 2023 09:22:40 GMT
server
AmazonS3
x-amz-cf-pop
FRA60-P3
age
73808
x-amz-server-side-encryption
AES256
etag
W/"a06e7a176f40dc26aa5e9567ac9d2d5e"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
cache-control
max-age=86400
x-amz-cf-id
Lwy3ZbqL_bMU9mWYLq2VZ4arokVwRwtnbnYm-G7g93xaRZuqD35OuA==
/
api.ipify.org/
68 B
143 B
Script
General
Full URL
https://api.ipify.org/?format=jsonp&callback=jQuery110202767835645584358_1682561433810&_=1682561433811
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/www/js/jquery/jquery-1.10.2.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
64.185.227.155 , United States, ASN18450 (WEBNX, US),
Reverse DNS
64-185-227-155.static.webnx.com
Software
/
Resource Hash
4fbfd433f5e7dbfa63ee8cb13f135d2534240c9c7a86856b8d4b07a0b97fffc1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 27 Apr 2023 02:10:34 GMT
content-length
68
vary
Origin
content-type
application/javascript
eedeabb0-9a59-4b6b-9df3-e55745819adf.json
cdn.subscribers.com/config/
3 KB
3 KB
Fetch
General
Full URL
https://cdn.subscribers.com/config/eedeabb0-9a59-4b6b-9df3-e55745819adf.json
Requested by
Host: cdn.subscribers.com
URL: https://cdn.subscribers.com/assets/subscribers.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:3882 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
076b0c51343c180d8d207f02144ce8dd5124350cc467d2f7dccc5ba4537e7155

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 27 Apr 2023 02:10:34 GMT
cf-cache-status
DYNAMIC
x-amz-request-id
MK7NDF2B4807SABW
x-amz-server-side-encryption
AES256
content-length
2789
x-amz-id-2
f5wTU/ci6BV1XsDyJK+QIn9u5tAJHTfYjrsFpDFoUPF4G2953oF+bAMpixwc+sQJ8QLbuXJHjY8=
last-modified
Wed, 26 Apr 2023 21:16:02 GMT
server
cloudflare
etag
"84f6e4ef66b944b81389189fff9f2bfb"
access-control-max-age
3600
access-control-allow-methods
GET
content-type
text/json
access-control-allow-origin
*
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method
accept-ranges
bytes
cf-ray
7be387a4eccc190b-FRA
tile
www.csoonline.com/napi/
77 B
214 B
XHR
General
Full URL
https://www.csoonline.com/napi/tile?def=blox4.dynamic&geo=10&definition=nav.fixed&placement=Nav+Fixed
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/www/js/jquery/jquery-1.10.2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
6ccbc734f00e46668252ae9d10341f50adabda27ba89547f1700899ed85f5338
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

Accept
text/html, */*; q=0.01
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:34 GMT
age
10317
x-cache
HIT, HIT, MISS, MISS
content-length
34
x-via-fastly
Verdad
x-served-by
cache-sjc10038-SJC, cache-sjc10038-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
server
Apache-Coyote/1.1
x-timer
S1682561434.368076,VS0,VE159
x-frame-options
deny
x-fastly-ttl
14400.000
content-type
text/html;charset=UTF-8
vary
Accept-Encoding,Cookie
cache-control
max-age=14400
x-vcl-version
86
accept-ranges
bytes
x-fastly-stale
432000.000
x-cache-hits
1, 1, 0, 0
tile
www.csoonline.com/napi/
72 B
208 B
XHR
General
Full URL
https://www.csoonline.com/napi/tile?def=blox4.dynamic&geo=10&placement=Nav+Mega+Column+1
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/www/js/jquery/jquery-1.10.2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
76c910bb824e43c77431224a89550f49bade4de45b824c1cfc7e94144090dc43
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

Accept
text/html, */*; q=0.01
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:34 GMT
age
3614
x-cache
HIT, HIT, MISS, MISS
content-length
34
x-via-fastly
Verdad
x-served-by
cache-sjc10082-SJC, cache-sjc10082-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
server
Apache-Coyote/1.1
x-timer
S1682561434.369848,VS0,VE149
x-frame-options
deny
x-fastly-ttl
14400.000
content-type
text/html;charset=UTF-8
vary
Accept-Encoding,Cookie
cache-control
max-age=14400
x-vcl-version
86
accept-ranges
bytes
x-fastly-stale
432000.000
x-cache-hits
1, 1, 0, 0
tile
www.csoonline.com/napi/
72 B
175 B
XHR
General
Full URL
https://www.csoonline.com/napi/tile?def=blox4.dynamic&geo=10&placement=Nav+Mega+Column+2
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/www/js/jquery/jquery-1.10.2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
76c910bb824e43c77431224a89550f49bade4de45b824c1cfc7e94144090dc43
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

Accept
text/html, */*; q=0.01
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:34 GMT
age
5549
x-cache
HIT, HIT, MISS, MISS
content-length
34
x-via-fastly
Verdad
x-served-by
cache-sjc10048-SJC, cache-sjc10048-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
server
Apache-Coyote/1.1
x-timer
S1682561434.370797,VS0,VE153
x-frame-options
deny
x-fastly-ttl
14400.000
content-type
text/html;charset=UTF-8
vary
Accept-Encoding,Cookie
cache-control
max-age=14400
x-vcl-version
86
accept-ranges
bytes
x-fastly-stale
432000.000
x-cache-hits
1, 1, 0, 0
tile
www.csoonline.com/napi/
72 B
193 B
XHR
General
Full URL
https://www.csoonline.com/napi/tile?def=blox4.dynamic&geo=10&placement=Nav+Mega+Column+3
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/www/js/jquery/jquery-1.10.2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
76c910bb824e43c77431224a89550f49bade4de45b824c1cfc7e94144090dc43
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

Accept
text/html, */*; q=0.01
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:34 GMT
age
3614
x-cache
HIT, HIT, MISS, MISS
content-length
34
x-via-fastly
Verdad
x-served-by
cache-sjc10034-SJC, cache-sjc10034-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
server
Apache-Coyote/1.1
x-timer
S1682561434.371802,VS0,VE151
x-frame-options
deny
x-fastly-ttl
14400.000
content-type
text/html;charset=UTF-8
vary
Accept-Encoding,Cookie
cache-control
max-age=14400
x-vcl-version
86
accept-ranges
bytes
x-fastly-stale
432000.000
x-cache-hits
1, 1, 0, 0
tile
www.csoonline.com/napi/
72 B
174 B
XHR
General
Full URL
https://www.csoonline.com/napi/tile?def=blox4.dynamic&geo=10&placement=Nav+Mega+Column+4
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/www/js/jquery/jquery-1.10.2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
76c910bb824e43c77431224a89550f49bade4de45b824c1cfc7e94144090dc43
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

Accept
text/html, */*; q=0.01
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:34 GMT
age
2725
x-cache
HIT, HIT, MISS, MISS
content-length
34
x-via-fastly
Verdad
x-served-by
cache-sjc10078-SJC, cache-sjc10078-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
server
Apache-Coyote/1.1
x-timer
S1682561434.372812,VS0,VE152
x-frame-options
deny
x-fastly-ttl
14400.000
content-type
text/html;charset=UTF-8
vary
Accept-Encoding,Cookie
cache-control
max-age=14400
x-vcl-version
86
accept-ranges
bytes
x-fastly-stale
432000.000
x-cache-hits
1, 1, 0, 0
tile
www.csoonline.com/napi/
125 B
396 B
XHR
General
Full URL
https://www.csoonline.com/napi/tile?def=listItemList&genericIfCategoryEmpty=true&includeArticles=true&pageSize=4&queryKey=BestTechDeals&typeId=16&wrapperElement=ul&itemTemplate=%2Fwww.idge%2F_shared%2Fcomponents%2Fmodules%2Fitem%2Frelated-articles.jsp
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/www/js/jquery/jquery-1.10.2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
b5a291b53145791eb26ce6e36a5e4d81b79a8d6f477928f9f5b72ec0b6d0f5d5
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

Accept
*/*
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:34 GMT
age
1835
x-cache
HIT, HIT, MISS, MISS
content-length
31
x-via-fastly
Verdad
x-served-by
cache-sjc10049-SJC, cache-sjc10049-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
server
Apache-Coyote/1.1
x-timer
S1682561434.396479,VS0,VE300
x-frame-options
deny
x-fastly-ttl
14400.000
content-type
text/html;charset=UTF-8
vary
Accept-Encoding,Cookie
cache-control
max-age=14400
x-vcl-version
86
accept-ranges
bytes
x-fastly-stale
432000.000
x-cache-hits
8, 8, 0, 0
tile
www.csoonline.com/napi/
4 KB
1 KB
XHR
General
Full URL
https://www.csoonline.com/napi/tile?def=listItemList&genericIfCategoryEmpty=true&includeArticles=true&pageSize=4&queryKey=TechconnectDeals&brandOwnerOnly=true&brandOwner=4194304&wrapperElement=ul&itemTemplate=%2Fwww.idge%2F_shared%2Fcomponents%2Fmodules%2Fitem%2Frelated-articles.jsp
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/www/js/jquery/jquery-1.10.2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
5f1b5087fa315ca0fd65c68e2ef58ce1c33fee26d59cd0fce07458afa3f2fe8f
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

Accept
*/*
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:34 GMT
age
8001
x-cache
HIT, HIT, MISS, MISS
content-length
706
x-via-fastly
Verdad
x-served-by
cache-sjc10029-SJC, cache-sjc10029-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
server
Apache-Coyote/1.1
x-timer
S1682561434.396434,VS0,VE149
x-frame-options
deny
x-fastly-ttl
14400.000
content-type
text/html;charset=UTF-8
vary
Accept-Encoding,Cookie
cache-control
max-age=14400
x-vcl-version
86
accept-ranges
bytes
x-fastly-stale
432000.000
x-cache-hits
1, 1, 0, 0
tile
www.csoonline.com/napi/
47 B
415 B
XHR
General
Full URL
https://www.csoonline.com/napi/tile?def=editfakeSideBar&geo=10&aid=3694850
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/www/js/jquery/jquery-1.10.2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
d2d4f317dcf44ab195d049f781fd353562cf0fa08474e0c659f0fa06609d5529
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

Accept
text/html, */*; q=0.01
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:34 GMT
age
15296
x-cache
HIT, HIT, HIT, HIT
content-length
35
x-via-fastly
Verdad
x-served-by
cache-sjc10079-SJC, cache-sjc10079-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
server
Apache-Coyote/1.1
x-timer
S1682561434.397649,VS0,VE1
x-frame-options
deny
x-fastly-ttl
14400.000
content-type
text/html;charset=UTF-8
vary
Accept-Encoding,Cookie
cache-control
max-age=14400
x-vcl-version
86
accept-ranges
bytes
x-fastly-stale
432000.000
x-cache-hits
4, 4, 1, 1
tile
www.csoonline.com/napi/
47 B
174 B
XHR
General
Full URL
https://www.csoonline.com/napi/tile?def=sponsoredfakeSideBar&geo=10&aid=3694850
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/www/js/jquery/jquery-1.10.2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
d2d4f317dcf44ab195d049f781fd353562cf0fa08474e0c659f0fa06609d5529
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

Accept
text/html, */*; q=0.01
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:34 GMT
age
4
x-cache
HIT, HIT, MISS, MISS
content-length
35
x-via-fastly
Verdad
x-served-by
cache-sjc10076-SJC, cache-sjc10076-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
server
Apache-Coyote/1.1
x-timer
S1682561434.399134,VS0,VE150
x-frame-options
deny
x-fastly-ttl
14400.000
content-type
text/html;charset=UTF-8
vary
Accept-Encoding,Cookie
cache-control
max-age=14400
x-vcl-version
86
accept-ranges
bytes
x-fastly-stale
432000.000
x-cache-hits
1, 1, 0, 0
tile
www.csoonline.com/napi/
47 B
185 B
XHR
General
Full URL
https://www.csoonline.com/napi/tile?def=nativefakeSideBar&geo=10&aid=3694850
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/www/js/jquery/jquery-1.10.2.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
d2d4f317dcf44ab195d049f781fd353562cf0fa08474e0c659f0fa06609d5529
Security Headers
Name Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Request headers

Accept
text/html, */*; q=0.01
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security
max-age=300
content-encoding
gzip
via
1.1 varnish, 1.1 varnish
date
Thu, 27 Apr 2023 02:10:34 GMT
age
15296
x-cache
HIT, HIT, HIT, HIT
content-length
35
x-via-fastly
Verdad
x-served-by
cache-sjc10041-SJC, cache-sjc10041-SJC, cache-fra-eddf8230050-FRA, cache-fra-eddf8230050-FRA
server
Apache-Coyote/1.1
x-timer
S1682561434.400100,VS0,VE1
x-frame-options
deny
x-fastly-ttl
14400.000
content-type
text/html;charset=UTF-8
vary
Accept-Encoding,Cookie
cache-control
max-age=14400
x-vcl-version
86
accept-ranges
bytes
x-fastly-stale
432000.000
x-cache-hits
5, 5, 1, 1
index.html
cmpv2.csoonline.com/ Frame 12A0
5 KB
2 KB
Document
General
Full URL
https://cmpv2.csoonline.com/index.html?message_id=773117&consentUUID=undefined&preload_message=true&hasCsp=true&version=v1&consent_origin=https%3A%2F%2Fcmpv2.csoonline.com%2Fconsent%2Ftcfv2&mms_origin=https%3A%2F%2Fcmpv2.csoonline.com%2Fmms%2Fv2
Requested by
Host: cmpv2.csoonline.com
URL: https://cmpv2.csoonline.com/wrapperMessagingWithoutDetection.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-43.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
46b92cb2cf73e41838561cc754cf5eadf2135c84877cc8b230c46080760647ee

Request headers

Referer
https://www.csoonline.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

age
465
cache-control
max-age=3600
content-encoding
gzip
content-type
text/html
date
Thu, 27 Apr 2023 02:02:50 GMT
etag
W/"30b904b31ce2bc70a3fc40fefdd0c5e8"
last-modified
Wed, 12 Apr 2023 15:46:14 GMT
server
AmazonS3
vary
Accept-Encoding
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aaa.cloudfront.net (CloudFront)
x-amz-cf-id
vqMr6bFBEJuUxeQWGi5otyC9ci7234lCT2DF7ncqn3ldO08nzHSNAw==
x-amz-cf-pop
FRA50-C1
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
pxid
f5b3be27-f789-4ef1-8867-37c67da5b361.prmutv.co/v2.0/
46 B
395 B
XHR
General
Full URL
https://f5b3be27-f789-4ef1-8867-37c67da5b361.prmutv.co/v2.0/pxid?k=84c7e805-5ce9-41f4-b988-3529488bab1c
Requested by
Host: cdn.permutive.com
URL: https://cdn.permutive.com/f5b3be27-f789-4ef1-8867-37c67da5b361-web.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.241.9.51 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
51.9.241.35.bc.googleusercontent.com
Software
Permutive /
Resource Hash
64642a9f2b4bc512a962bbef490a3dd615c3d184fc64b70681b5973befc77871

Request headers

Referer
https://www.csoonline.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
content-type
text/plain

Response headers

date
Thu, 27 Apr 2023 02:10:34 GMT
content-encoding
gzip
via
1.1 google
server
Permutive
vary
Origin
content-type
application/json
access-control-allow-origin
https://www.csoonline.com
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
66
getuidj
ib.adnxs.com/
11 B
823 B
XHR
General
Full URL
https://ib.adnxs.com/getuidj
Requested by
Host: cdn.permutive.com
URL: https://cdn.permutive.com/f5b3be27-f789-4ef1-8867-37c67da5b361-web.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.89.210.46 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net
Software
nginx/1.23.2 /
Resource Hash
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
https://www.csoonline.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
content-type
text/plain

Response headers

Pragma
no-cache
Date
Thu, 27 Apr 2023 02:10:34 GMT
AN-X-Request-Uuid
518e59b7-4f92-4a52-ad71-de6105a66f89
Server
nginx/1.23.2
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
application/json; charset=utf-8
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://www.csoonline.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
X-Proxy-Origin
185.213.155.174; 185.213.155.174; 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length
11
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
f5b3be27-f789-4ef1-8867-37c67da5b361-models.bin
cdn.permutive.com/models/v2/
16 KB
12 KB
XHR
General
Full URL
https://cdn.permutive.com/models/v2/f5b3be27-f789-4ef1-8867-37c67da5b361-models.bin
Requested by
Host: cdn.permutive.com
URL: https://cdn.permutive.com/f5b3be27-f789-4ef1-8867-37c67da5b361-web.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.19.150.54 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e62105f0f4f80e7103a519d4ac0cb794a3d48f39ef62eb9058adf9b7c3586f7f

Request headers

Referer
https://www.csoonline.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
content-type
text/plain

Response headers

date
Thu, 27 Apr 2023 02:10:34 GMT
content-encoding
gzip
cf-cache-status
HIT
x-goog-meta-oid
f5b3be27-f789-4ef1-8867-37c67da5b361
age
0
x-guploader-uploadid
ADPycdv-2dXdGIbo2aqAtPQQ1lfE3bBo2FxK7CgBLen-p2B2g-aHb92mL-zdllNtOTTuCmXyhZzvF0waS2Awv2ynR70j-IIyk-e1
x-goog-storage-class
REGIONAL
x-goog-metageneration
1
x-goog-stored-content-encoding
gzip
content-length
12041
last-modified
Wed, 26 Apr 2023 06:02:41 GMT
server
cloudflare
etag
"cef6674ee59607ff73b19c3c4279f803"
vary
Accept-Encoding
x-goog-generation
1682488961445352
content-type
application/x-binary
access-control-allow-origin
*
x-goog-hash
crc32c=c0/3pA==, md5=zvZnTuWWB/9zsZw8Qnn4Aw==
access-control-expose-headers
Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control
public, max-age=900, no-transform
x-goog-stored-content-length
12041
accept-ranges
bytes
timing-allow-origin
*
cf-ray
7be387a57f213604-FRA
expires
Thu, 27 Apr 2023 01:54:56 GMT
geoip
api.permutive.com/v2.0/
261 B
370 B
XHR
General
Full URL
https://api.permutive.com/v2.0/geoip?include=geo&include=isp&include=ip_hash&k=84c7e805-5ce9-41f4-b988-3529488bab1c
Requested by
Host: cdn.permutive.com
URL: https://cdn.permutive.com/f5b3be27-f789-4ef1-8867-37c67da5b361-web.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.107.254.252 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
252.254.107.34.bc.googleusercontent.com
Software
Permutive /
Resource Hash
39c5031fa5e04352d50fff0f766f4c5f77f2e30a45fcf73d0470bd41cd041394

Request headers

Referer
https://www.csoonline.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
content-type
text/plain

Response headers

date
Thu, 27 Apr 2023 02:10:34 GMT
content-encoding
gzip
via
1.1 google
server
Permutive
vary
Origin
content-type
application/json
access-control-allow-origin
https://www.csoonline.com
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
174
watson
api.permutive.com/v2.0/
498 B
374 B
XHR
General
Full URL
https://api.permutive.com/v2.0/watson?k=84c7e805-5ce9-41f4-b988-3529488bab1c
Requested by
Host: cdn.permutive.com
URL: https://cdn.permutive.com/f5b3be27-f789-4ef1-8867-37c67da5b361-web.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.107.254.252 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
252.254.107.34.bc.googleusercontent.com
Software
Permutive /
Resource Hash
76ef37e3762dad764955f02e65d0a7605d49840206bfb72d4caa0f54e5eb87b6

Request headers

Referer
https://www.csoonline.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
content-type
text/plain

Response headers

date
Thu, 27 Apr 2023 02:10:34 GMT
content-encoding
gzip
via
1.1 google
server
Permutive
vary
Origin
content-type
application/json
access-control-allow-origin
https://www.csoonline.com
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
308
Notice.75d29.css
cmpv2.csoonline.com/ Frame 12A0
33 KB
6 KB
Stylesheet
General
Full URL
https://cmpv2.csoonline.com/Notice.75d29.css
Requested by
Host: cmpv2.csoonline.com
URL: https://cmpv2.csoonline.com/index.html?message_id=773117&consentUUID=undefined&preload_message=true&hasCsp=true&version=v1&consent_origin=https%3A%2F%2Fcmpv2.csoonline.com%2Fconsent%2Ftcfv2&mms_origin=https%3A%2F%2Fcmpv2.csoonline.com%2Fmms%2Fv2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-43.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
48b61e8846635705a81a226b1b6c757f19fc04db860f50c7a11186dfb9529a81

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cmpv2.csoonline.com/index.html?message_id=773117&consentUUID=undefined&preload_message=true&hasCsp=true&version=v1&consent_origin=https%3A%2F%2Fcmpv2.csoonline.com%2Fconsent%2Ftcfv2&mms_origin=https%3A%2F%2Fcmpv2.csoonline.com%2Fmms%2Fv2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 27 Apr 2023 02:07:06 GMT
content-encoding
gzip
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aaa.cloudfront.net (CloudFront)
last-modified
Wed, 12 Apr 2023 15:46:13 GMT
server
AmazonS3
x-amz-cf-pop
FRA50-C1
age
208
x-amz-server-side-encryption
AES256
etag
W/"2de018f30d5cd6d0356f45fa11e9f114"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css
cache-control
max-age=3600
x-amz-cf-id
r2aLFRHBRElT2ktMOFUHZ468b60Vwz3B82LhC-pxbS8YSFSv-WRK7Q==
polyfills.d36c5.js
cmpv2.csoonline.com/ Frame 12A0
5 KB
2 KB
Script
General
Full URL
https://cmpv2.csoonline.com/polyfills.d36c5.js
Requested by
Host: cmpv2.csoonline.com
URL: https://cmpv2.csoonline.com/index.html?message_id=773117&consentUUID=undefined&preload_message=true&hasCsp=true&version=v1&consent_origin=https%3A%2F%2Fcmpv2.csoonline.com%2Fconsent%2Ftcfv2&mms_origin=https%3A%2F%2Fcmpv2.csoonline.com%2Fmms%2Fv2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-43.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
533b23c57b1770cc3ee9c15b998b2eb494fa0adb2d6929fd22a9b78adfade3a7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cmpv2.csoonline.com/index.html?message_id=773117&consentUUID=undefined&preload_message=true&hasCsp=true&version=v1&consent_origin=https%3A%2F%2Fcmpv2.csoonline.com%2Fconsent%2Ftcfv2&mms_origin=https%3A%2F%2Fcmpv2.csoonline.com%2Fmms%2Fv2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 27 Apr 2023 01:47:50 GMT
content-encoding
gzip
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aaa.cloudfront.net (CloudFront)
last-modified
Wed, 12 Apr 2023 15:46:14 GMT
server
AmazonS3
x-amz-cf-pop
FRA50-C1
age
1367
x-amz-server-side-encryption
AES256
etag
W/"89661b8fd918815bcb224bba79cabab1"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/javascript
cache-control
max-age=3600
x-amz-cf-id
OXpox_cRlUgfiNfq2OnKKWVxAxZLNbWKKXc4QHJqBdDRiAgdrJnaaw==
Notice.5a0dc.js
cmpv2.csoonline.com/ Frame 12A0
263 KB
69 KB
Script
General
Full URL
https://cmpv2.csoonline.com/Notice.5a0dc.js
Requested by
Host: cmpv2.csoonline.com
URL: https://cmpv2.csoonline.com/index.html?message_id=773117&consentUUID=undefined&preload_message=true&hasCsp=true&version=v1&consent_origin=https%3A%2F%2Fcmpv2.csoonline.com%2Fconsent%2Ftcfv2&mms_origin=https%3A%2F%2Fcmpv2.csoonline.com%2Fmms%2Fv2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-43.fra50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
916ee67baa8a85524530a7988a5050cdd22569ab152e94197a7ed501ffbb7223

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cmpv2.csoonline.com/index.html?message_id=773117&consentUUID=undefined&preload_message=true&hasCsp=true&version=v1&consent_origin=https%3A%2F%2Fcmpv2.csoonline.com%2Fconsent%2Ftcfv2&mms_origin=https%3A%2F%2Fcmpv2.csoonline.com%2Fmms%2Fv2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 27 Apr 2023 01:37:15 GMT
content-encoding
gzip
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aaa.cloudfront.net (CloudFront)
last-modified
Wed, 12 Apr 2023 15:46:13 GMT
server
AmazonS3
x-amz-cf-pop
FRA50-C1
age
2000
x-amz-server-side-encryption
AES256
etag
W/"48ff8739c9e9c4655628fde91d900200"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/javascript
cache-control
max-age=3600
x-amz-cf-id
gkaoXQdyJm2b3JBjfHPcfFTnMvDVzZV4Z-_kZL773Muw4f0MhKSpGA==
85d63408-7d40-4100-bc64-a33cb9673fd7
https://www.csoonline.com/
254 KB
0
Other
General
Full URL
blob:https://www.csoonline.com/85d63408-7d40-4100-bc64-a33cb9673fd7
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1104b2d009e0442e2c4c6c1ddf1ebd49ea3a90aaa1ab81f274f70e581113c9f6

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Length
259904
Content-Type
50ebe9c8-25a4-4df8-9fa4-7033caa14e79
https://www.csoonline.com/
254 KB
0
Other
General
Full URL
blob:https://www.csoonline.com/50ebe9c8-25a4-4df8-9fa4-7033caa14e79
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1104b2d009e0442e2c4c6c1ddf1ebd49ea3a90aaa1ab81f274f70e581113c9f6

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

Content-Length
259904
Content-Type
t
jadserve.postrelease.com/
7 KB
3 KB
Script
General
Full URL
https://jadserve.postrelease.com/t?ntv_url=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3694850%2Firanian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html&ntv_mvi&ntv_kv=channel*malware
Requested by
Host: s.ntv.io
URL: https://s.ntv.io/serve/load.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.248.88.116 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-248-88-116.eu-west-1.compute.amazonaws.com
Software
nginx/1.12.2 /
Resource Hash
a30b328dddcc925fa7f945e057446747b3da997f5a56989e137c687650b17238

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 27 Apr 2023 02:10:34 GMT
content-encoding
gzip
server
nginx/1.12.2
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length
2453
expires
Mon, 1 Jan 1990 12:00:00 GMT
b2
sb.scorecardresearch.com/
0
225 B
Image
General
Full URL
https://sb.scorecardresearch.com/b2?c1=2&c2=6035308&cs_it=b9&cv=4.0.0%2B2301240627&ns__t=1682561434508&ns_c=UTF-8&c3=&c5=Malware&c6=Article%3A%20News%20Analysis&c15=3694850&gdpr=1&gdpr_p1t=0&gdpr_li=0&gdpr_purps=&gdpr_pcc=DE&cs_cmp_nc=0&cs_cmp_id=6&cs_cmp_sv=1&cs_cmp_rt=2&cs_fpcd=1&c7=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3694850%2Firanian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html&c8=Iranian%20cyberspies%20deploy%20new%20malware%20implant%20on%20Microsoft%20Exchange%20Servers%20%7C%20CSO%20Online&c9=
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.99.105 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-99-105.fra60.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 27 Apr 2023 02:10:34 GMT
via
1.1 fa8c9f29fb8ef5c537a2a53f4de05240.cloudfront.net (CloudFront)
accept-ch
UA, Platform, Arch, Model, Mobile
x-amz-cf-pop
FRA60-P3
x-amz-cf-id
A63uNUMVwLsCchP3bRAqPbOteLPdBeXx8WYarZBx6GaW3hvquB22kQ==
x-cache
Miss from cloudfront
cse_element__en.js
www.google.com/cse/static/element/a9408e9443edd8dc/
309 KB
103 KB
Script
General
Full URL
https://www.google.com/cse/static/element/a9408e9443edd8dc/cse_element__en.js?usqp=CAI%3D
Requested by
Host: cse.google.com
URL: https://cse.google.com/cse.js?cx=011881588825642368632:b0mgdf4z90i
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e2bb96a5d1a2730721d3a080417ba6e190d141449b61d9b1ccf40b392e28b100
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 20 Apr 2023 11:48:59 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
570095
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/prose-team
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
105382
x-xss-protection
0
last-modified
Wed, 12 Apr 2023 21:05:10 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"prose-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/prose-team"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="prose-team"
expires
Fri, 19 Apr 2024 11:48:59 GMT
default+en.css
www.google.com/cse/static/element/a9408e9443edd8dc/
41 KB
9 KB
Stylesheet
General
Full URL
https://www.google.com/cse/static/element/a9408e9443edd8dc/default+en.css
Requested by
Host: cse.google.com
URL: https://cse.google.com/cse.js?cx=011881588825642368632:b0mgdf4z90i
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c965aefdb4c6acf10f46758dc1601a64d811dcf3a378bf9e90278916aa47508f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Sat, 22 Apr 2023 14:30:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
387593
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/prose-team
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
9102
x-xss-protection
0
last-modified
Wed, 12 Apr 2023 21:05:10 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"prose-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/prose-team"}]}
content-type
text/css
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="prose-team"
expires
Sun, 21 Apr 2024 14:30:41 GMT
default.css
www.google.com/cse/static/style/look/v4/
4 KB
2 KB
Stylesheet
General
Full URL
https://www.google.com/cse/static/style/look/v4/default.css
Requested by
Host: cse.google.com
URL: https://cse.google.com/cse.js?cx=011881588825642368632:b0mgdf4z90i
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
dcec22bbcb68119d6c7d6d5e088fb82183a9826d0c9e3403f1386fd837f06a89
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 27 Apr 2023 01:31:04 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2370
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/prose-team
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
1345
x-xss-protection
0
last-modified
Wed, 17 Jun 2020 00:00:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"prose-team","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/prose-team"}]}
content-type
text/css
cache-control
public, max-age=3000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="prose-team"
expires
Thu, 27 Apr 2023 02:21:04 GMT
pubads_impl.js
securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/
398 KB
123 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/pagead/managed/js/gpt/m202304250101/pubads_impl.js?cb=31074156
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
37e314bfd8e8cb9262b5ea01059377cea510e23b2215fc93de8b34a5726284a8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Wed, 26 Apr 2023 12:36:30 GMT
content-encoding
br
x-content-type-options
nosniff
age
48844
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
126109
x-xss-protection
0
server
cafe
etag
6695821980177688499
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
public, immutable, max-age=31536000
timing-allow-origin
*
expires
Thu, 25 Apr 2024 12:36:30 GMT
ppub_config
securepubads.g.doubleclick.net/pagead/
50 B
68 B
XHR
General
Full URL
https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.csoonline.com
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/tag/js/gpt.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
48594162fadd244f2afa2f3f1e02795f6a04a14398ffc78779bfada998d2b7b7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 27 Apr 2023 02:10:34 GMT
content-encoding
br
x-content-type-options
nosniff
server
cafe
content-type
application/json; charset=UTF-8
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
44
x-xss-protection
0
expires
Thu, 27 Apr 2023 02:10:34 GMT
identify
api.permutive.com/v2.0/
50 B
88 B
XHR
General
Full URL
https://api.permutive.com/v2.0/identify?k=84c7e805-5ce9-41f4-b988-3529488bab1c
Requested by
Host: cdn.permutive.com
URL: https://cdn.permutive.com/f5b3be27-f789-4ef1-8867-37c67da5b361-web.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.107.254.252 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
252.254.107.34.bc.googleusercontent.com
Software
Permutive /
Resource Hash
967f7a6fbba84fc9c23b291b58a0dbff757eb5649f6aa453ef85175913a16271

Request headers

Referer
https://www.csoonline.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
content-type
text/plain

Response headers

date
Thu, 27 Apr 2023 02:10:34 GMT
content-encoding
gzip
via
1.1 google
server
Permutive
vary
Origin
content-type
application/json
access-control-allow-origin
https://www.csoonline.com
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
70
gtm.js
www.googletagmanager.com/
225 KB
75 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-5WC9SK&l=dataLayer
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WR6LD2P
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
4f260b3d6386537537aa0d48c8156c334ef9cc90ee10f52006b6f0580b43a6cd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 27 Apr 2023 02:10:34 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
76843
x-xss-protection
0
last-modified
Thu, 27 Apr 2023 01:00:47 GMT
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Thu, 27 Apr 2023 02:10:34 GMT
api.js
w.soundcloud.com/player/
5 KB
4 KB
Script
General
Full URL
https://w.soundcloud.com/player/api.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WR6LD2P
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.7.117 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-7-117.fra56.r.cloudfront.net
Software
am/2 /
Resource Hash
fe7be71169532a67a19a2178113658e2cf55413a21635fcd0a89060c839a5be6
Security Headers
Name Value
Strict-Transport-Security max-age=63072000

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 27 Apr 2023 02:07:48 GMT
via
sssr, 1.1 ecb3ea567a6c6095a23354fbdc938128.cloudfront.net (CloudFront)
content-encoding
gzip
strict-transport-security
max-age=63072000
x-amz-cf-pop
FRA56-P6
age
166
x-cache
Hit from cloudfront
p3p
policyref="https://w.soundcloud.com/player/w3c/p3p.xml", CP="NON DSP COR CUR ADM DEV TAI PSAo PSDo OUR STP CNT"
last-modified
Fri, 14 Apr 2023 13:13:44 GMT
server
am/2
etag
W/"15a4-1877fe67b40"
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
cache-control
public, max-age=300
accept-ranges
bytes
x-amz-cf-id
p4OLqFv1C0CFzWLAuOWR22fBDrFOocwsMxtibLluK4BW5ovPc-NW6w==
foundry.js
cdn.brandmetrics.com/tag/204b11895d4d4bcda0a6cefefc2b747d/
5 KB
3 KB
Script
General
Full URL
https://cdn.brandmetrics.com/tag/204b11895d4d4bcda0a6cefefc2b747d/foundry.js
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4842 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1c7b0d1505f8ee7de88bfad7de89af2514174595bc36a2f00a016a98c3189d8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 27 Apr 2023 02:10:34 GMT
content-encoding
br
cf-cache-status
HIT
cf-bgj
minify
last-modified
Thu, 27 Apr 2023 01:11:45 GMT
server
cloudflare
age
3529
cf-polished
origSize=5451
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T8DmbKm6tJ4bacxotp4eZlbddx8Czl6U%2FKEch1PCddlel5KH%2FlUgKWy1iyHGfVvymlohR48uHHI%2F8b%2FyMkaCLT26TfzF5VR0Xc6sNJg7SPnQ3HXnMTX%2BgLb2QjYlNqyGCw5hjPCqrlQKhvob%2BOWr2s9i"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript;charset=utf-8
cache-control
public, max-age=3600
cf-ray
7be387a68a1f9b1b-FRA
request-context
appId=cid-v1:5c986aee-9723-4541-b38e-d4ac73c46937
analytics.js
www.google-analytics.com/
51 KB
21 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WR6LD2P
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
date
Thu, 27 Apr 2023 00:35:44 GMT
last-modified
Mon, 17 Apr 2023 22:36:01 GMT
server
Golfe2
age
5690
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
20737
expires
Thu, 27 Apr 2023 02:35:44 GMT
js
www.googletagmanager.com/gtag/
234 KB
80 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-LKE46QM5TV&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WR6LD2P
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
fef78f8e1f00ae09508cbe22095d1a9a0b6a2b2594119cdcf8aec1997b156c5d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 27 Apr 2023 02:10:34 GMT
content-encoding
br
strict-transport-security
max-age=31536000; includeSubDomains
server
Google Tag Manager
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
access-control-allow-headers
Cache-Control
content-length
81936
x-xss-protection
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires
Thu, 27 Apr 2023 02:10:34 GMT
css2
fonts.googleapis.com/ Frame 12A0
4 KB
993 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css2?family=Montserrat:wght@400;600&display=swap
Requested by
Host: client
URL: about:client
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
19a655057c281e5368548b39329c87039728f1afe002e651e7b4862912c62c7b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cmpv2.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Thu, 27 Apr 2023 02:10:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Thu, 27 Apr 2023 01:47:51 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Thu, 27 Apr 2023 02:10:34 GMT
categories
cmpv2.csoonline.com/consent/tcfv2/vendor-list/ Frame 12A0
1 KB
1 KB
Fetch
General
Full URL
https://cmpv2.csoonline.com/consent/tcfv2/vendor-list/categories?siteId=3918&consentLanguage=en
Requested by
Host: cmpv2.csoonline.com
URL: https://cmpv2.csoonline.com/Notice.5a0dc.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.89.43 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-89-43.fra50.r.cloudfront.net
Software
/
Resource Hash
96753f997cca08f5d79ee77443fec431dc00ed61d45d8d36fd2d8584a20aa198
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cmpv2.csoonline.com/index.html?message_id=773117&consentUUID=undefined&preload_message=true&hasCsp=true&version=v1&consent_origin=https%3A%2F%2Fcmpv2.csoonline.com%2Fconsent%2Ftcfv2&mms_origin=https%3A%2F%2Fcmpv2.csoonline.com%2Fmms%2Fv2
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 27 Apr 2023 02:10:34 GMT
strict-transport-security
max-age=15552000; includeSubDomains
content-encoding
gzip
via
1.1 c6702f5f3b6e77da6f394e67ef1a6aaa.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA50-C1
vary
Accept-Encoding
access-control-allow-methods
GET, PUT, POST, DELETE
content-type
application/json; charset=utf-8
access-control-allow-origin
*
x-cache
Miss from cloudfront
cache-control
max-age=0, s-maxage=3600
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Authorization
x-amz-cf-id
2oYK9uU_asj6GsZR8udFx_-_Ll6ifd9Lzpu6kYziPmDLCFiRozBvBA==
cso-logo-100800397-orig.jpg
images.idgesg.net/images/article/2019/06/ Frame 12A0
14 KB
15 KB
Image
General
Full URL
https://images.idgesg.net/images/article/2019/06/cso-logo-100800397-orig.jpg
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
d0d5886513eda3107d1e40683961d54cac4de14f95f2656b848d1c019293c2a7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cmpv2.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-amz-version-id
TkO72FvGpYGON8HVMwG6OxoCRUar99ad
date
Thu, 27 Apr 2023 02:10:34 GMT
via
1.1 varnish
x-amz-request-id
SGG792WHS5AJDAK5
age
2636
x-cache
HIT
fastly-io-info
ifsz=18131 idim=382x189 ifmt=jpeg ofsz=14474 odim=382x189 ofmt=jpeg
fastly-stats
io=1
content-length
14474
x-amz-id-2
XTqST2svZljfMsoPgDNzrujjAIMr51I2UW3pGU+HEIlYnfEiqDfkeeVx5fkQucnFUpAZvanZxSk=
x-served-by
cache-fra-eddf8230050-FRA
server
AmazonS3
x-timer
S1682561435.757069,VS0,VE1
etag
"cPl46LE9tYXJlkOOtuDnC1Dacz9Zqt7x/zj49jS7z8Y"
content-type
image/jpeg
cache-control
public, max-age=2592000
accept-ranges
bytes
x-cache-hits
1
65568.js
cdn.brandmetrics.com/scripts/bundle/
47 KB
15 KB
Script
General
Full URL
https://cdn.brandmetrics.com/scripts/bundle/65568.js?sid=859f1054-306e-4cf1-ba1e-f830aaa45fea&toploc=www.csoonline.com
Requested by
Host: cdn.brandmetrics.com
URL: https://cdn.brandmetrics.com/tag/204b11895d4d4bcda0a6cefefc2b747d/foundry.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:4842 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
134d12e8f05221f1fcc0124af2053a600360381f5dcc6e5a99a0bac75d311f6f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 27 Apr 2023 02:10:34 GMT
content-encoding
br
cf-cache-status
HIT
cf-bgj
minify
last-modified
Thu, 27 Apr 2023 01:18:29 GMT
server
cloudflare
age
3125
cf-polished
origSize=48669
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5yWjojg%2BGDfP8Spob65J%2FJj9cMK0yunf%2F32d2mEfWtH9Om3eT81qRnVIeU1737iazFe8BkcUJoTx%2FMHJ6SLEwG%2B8gOnpqBWv%2BQk91rgN1f9XFH8ZxSfFa8hAzVpODlTGy2aWzc%2FRTXr52r95zsFrOH6m"}],"group":"cf-nel","max_age":604800}
content-type
text/javascript;charset=utf-8
cache-control
public, max-age=3600
cf-ray
7be387a78ab19b1b-FRA
request-context
appId=cid-v1:5c986aee-9723-4541-b38e-d4ac73c46937
async-ads.js
cse.google.com/adsense/search/
141 KB
52 KB
Script
General
Full URL
https://cse.google.com/adsense/search/async-ads.js
Requested by
Host: www.google.com
URL: https://www.google.com/cse/static/element/a9408e9443edd8dc/cse_element__en.js?usqp=CAI%3D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f5f2c1a6d8f0ed5823cba065bba521d2fb34ff7dd6f1389a9a2c1fccce76b551
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 27 Apr 2023 02:10:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="ads-afs-ui"
etag
"17586586324197532159"
vary
Accept-Encoding
report-to
{"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
accept-ranges
bytes
expires
Thu, 27 Apr 2023 02:10:34 GMT
generate_204
clients1.google.com/
0
117 B
Image
General
Full URL
https://clients1.google.com/generate_204
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 27 Apr 2023 02:10:34 GMT
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
collect
region1.google-analytics.com/g/
0
255 B
Ping
General
Full URL
https://region1.google-analytics.com/g/collect?v=2&tid=G-LKE46QM5TV&gtm=45je34q0&_p=883922384&cid=631449028.1682561435&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1682561434&sct=1&seg=0&dl=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3694850%2Firanian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html&dt=Iranian%20cyberspies%20deploy%20new%20malware%20implant%20on%20Microsoft%20Exchange%20Servers%20%7C%20CSO%20Online&en=page_view&_fv=1&_nsi=1&_ss=1&ep.articleId=3694850&ep.author=Lucian%20Constantin&ep.datePublished=2023-04-26&ep.dateUpdated=2023-04-26&ep.goldentaxonomyIdPrimary=67&ep.goldentaxonomyIdList=943%2C945&ep.goldentaxonomyIdAll=67%2C%20943%2C%20945&ep.categoryIdList=3513%2C3344%2C3718&ep.categoryIdPrimary=3513&ep.primaryCategory=malware&ep.primaryCategoryAll=malware%2C%20advanced%20persistent%20threats%2C%20cyberattacks&ep.primaryCategoryList=advanced%20persistent%20threats%2Ccyberattacks&ep.articleType=News%20Analysis&ep.audience=enterprise&ep.contentType=newsanalysis&ep.displayType=article&ep.Edition=de&ep.Platform=Web&ep.Property=cso%20online&ep.propertyCountry=US&ep.skimlinksId=111346X1569475&ep.Source=cso&ep.articleLocale=global&ep.categoryIdAll=3513%2C3344%2C3718&ep.Environment=production&ep.insiderSignedIn=false&ep.isBlog=false&ep.isInsiderContent=false&ep.isICN=false&ep.sponsorName=&up.jobPosition=&up.industry=&up.firstSessionDate=Thu%2C%2027%20Apr%202023%2002%3A10%3A34%20GMT&up.lastSessionDate=Thu%2C%2027%20Apr%202023%2002%3A10%3A34%20GMT&upn.daysSinceLastSession=0&upn.sessionNumber=1&up.insiderSignedIn=false&up.userId=&up.hasRegCookie=&up.jobFunction=&up.insiderProSignedIn=false
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-LKE46QM5TV&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 27 Apr 2023 02:10:34 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.csoonline.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pub.531979.min.js
www.dwin2.com/
454 KB
129 KB
Script
General
Full URL
https://www.dwin2.com/pub.531979.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5WC9SK&l=dataLayer
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:a400:f:1dcc:7540:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
efc98c44d90a834d73841149d058355f31bf5cfcef209166cecc8c4d3442d7c0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-amz-version-id
null
content-encoding
br
via
1.1 ef13dd533b8dc9dcfdc35449cf88f808.cloudfront.net (CloudFront)
date
Thu, 27 Apr 2023 02:04:02 GMT
last-modified
Wed, 26 Apr 2023 19:12:31 GMT
server
AmazonS3
x-amz-cf-pop
FRA50-C1
age
393
x-amz-server-side-encryption
AES256
etag
W/"32dfed532ef2aa0a0348d08fc12bf3fe"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/javascript
cache-control
max-age=600
x-amz-cf-id
x0Zh6hWKW0r0xNpM3oYj7vW_hi85b9Z-96ZkoOy8jIv1TUBAEpknBg==
ttj
ib.3lift.com/
6 KB
3 KB
Script
General
Full URL
https://ib.3lift.com/ttj?inv_code=tan_CSOOnline_MOAP
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.99.84 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-99-84.fra60.r.cloudfront.net
Software
/
Resource Hash
adadfb3670790ddac052b933d400e23273bd79a5cee02b0810154071ab65396f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 27 Apr 2023 02:05:55 GMT
content-encoding
gzip
via
1.1 b43c04a791e8dcb8ddb6bb0847fcf95a.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA60-P3
age
392
etag
"a1378908bfac7e049fe42c43a42f5930f4999e72"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript; charset=utf-8
cache-control
public, max-age=900
alt-svc
h3=":443"; ma=86400
content-length
2831
x-amz-cf-id
KYU8VcueDzywOfxyg4xo06EBKVoQpnQ-0-K9XszEhZRS_K0O6aMN0g==
trk.gif
jadserve.postrelease.com/
43 B
426 B
Image
General
Full URL
https://jadserve.postrelease.com/trk.gif?ntv_at=394&ntv_usid=2722050&ntv_pl=787043
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.248.88.116 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-248-88-116.eu-west-1.compute.amazonaws.com
Software
nginx/1.12.2 /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 27 Apr 2023 02:10:34 GMT
server
nginx/1.12.2
content-type
image/gif
access-control-allow-origin
*
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length
43
expires
Mon, 1 Jan 1990 12:00:00 GMT
trk.gif
jadserve.postrelease.com/
43 B
426 B
Image
General
Full URL
https://jadserve.postrelease.com/trk.gif?ntv_ui=087003ab-5192-4694-852d-83111531c05b&ntv_fl=xkQEw4iDjXVqaNTGzHIQhZkbp-jekoyUWn2vYMQXp7gy9ft3HwUVrnkmhtJ_Uu15Jk0Y1eOsZilPBVeroFf-O5H6jAXF_ZgswNGdq1zL5Vr9pKXJ8Tk-W_PZTG859_GoaBhHETdgziKvY6wfq1egJMMaQnDcS4RrpA3JZiaayPBtOhDNzKIxGNE1cBlxE7Ip7WDU9a7Mi10hUdbdu9yb7DccWQEvXVfb4Psg_KzQxceD08CfG04-657n9suhcHOxEzkApblcgeEYn7Kt5JjlflIVCikZKCtStKJLtduhl2gFbrn7Ke8Vgepr1BfLG9dqHUG_b09WruI8D2vg5nxaDg==&ntv_ht=mtlJZAA&ntv_at=321,322,333&ntv_a=AAAAAAAAAALiURA&ntv_jlt=602&ntv_jad=375&ntv_jte=12&ntv_it
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.248.88.116 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-248-88-116.eu-west-1.compute.amazonaws.com
Software
nginx/1.12.2 /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 27 Apr 2023 02:10:34 GMT
server
nginx/1.12.2
content-type
image/gif
access-control-allow-origin
*
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length
43
expires
Mon, 1 Jan 1990 12:00:00 GMT
trk.gif
jadserve.postrelease.com/
43 B
426 B
Image
General
Full URL
https://jadserve.postrelease.com/trk.gif?ntv_ui=fca1e05e-3204-40ab-adff-927b847cc2a6&ntv_fl=sx1m-i7rb_31l_AoDvFzpBxUEUS5YP4jo7iARt1b1bajGN6Xqp4tZMHvM7oh0XKITQBrkWZ8lGGABSltUdy0ZLZ4j9B66eOIZuu81WLRta8zbv7Y_X6WsuTGcoWJSXq6yb_N95z3k7FGkSuQrRCFZYg2Z1YM4kOBK9Hz86qkuiCwa6Zr0XYrUGFYGounA0JQ8DMt6o7DbzgaUQgqm9DtHV8ik7cD3r02D3U1J2w35xPqZIlVysPz6yx9Zp-Erj2tOlydLHGlTcRxtHOX4pEeDo3QS9h5YA_-yIbJbzHC3wlKah6KqyRr_DV6kcZlv1hf2LZ4zOICbmUOHk5FA5EF2A==&ntv_ht=mtlJZAA&ntv_at=303,302&ntv_a=AAAAAAAAAA7HgQA&ord=1682561434883&ntv_it
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.248.88.116 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-248-88-116.eu-west-1.compute.amazonaws.com
Software
nginx/1.12.2 /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 27 Apr 2023 02:10:34 GMT
server
nginx/1.12.2
content-type
image/gif
access-control-allow-origin
*
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length
43
expires
Mon, 1 Jan 1990 12:00:00 GMT
trk.gif
jadserve.postrelease.com/
43 B
426 B
Image
General
Full URL
https://jadserve.postrelease.com/trk.gif?ntv_ui=fca1e05e-3204-40ab-adff-927b847cc2a6&ntv_fl=sx1m-i7rb_31l_AoDvFzpBxUEUS5YP4jo7iARt1b1bajGN6Xqp4tZMHvM7oh0XKITQBrkWZ8lGGABSltUdy0ZLZ4j9B66eOIZuu81WLRta8zbv7Y_X6WsuTGcoWJSXq6yb_N95z3k7FGkSuQrRCFZYg2Z1YM4kOBK9Hz86qkuiCwa6Zr0XYrUGFYGounA0JQ8DMt6o7DbzgaUQgqm9DtHV8ik7cD3r02D3U1J2w35xPqZIlVysPz6yx9Zp-Erj2tOlydLHGlTcRxtHOX4pEeDo3QS9h5YA_-yIbJbzHC3wlKah6KqyRr_DV6kcZlv1hf2LZ4zOICbmUOHk5FA5EF2A==&ntv_ht=mtlJZAA&ntv_at=806&ntv_a=AAAAAAAAAAYwIMA&ntv_sat=5&ord=1682561434889&ntv_it
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.248.88.116 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-248-88-116.eu-west-1.compute.amazonaws.com
Software
nginx/1.12.2 /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 27 Apr 2023 02:10:34 GMT
server
nginx/1.12.2
content-type
image/gif
access-control-allow-origin
*
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length
43
expires
Mon, 1 Jan 1990 12:00:00 GMT
trk.gif
jadserve.postrelease.com/
43 B
426 B
Image
General
Full URL
https://jadserve.postrelease.com/trk.gif?ntv_ui=56a57fd0-edc8-4a60-98ec-89dc12d9043b&ntv_fl=UP8B7SdIPDJsQ-gGZI79ip3XJ_UrCLJb6z0gvDs7j_CzCE7mjClXvTOw6IfUGHewQ5PupwKBUmQlJphAx5vGFg08Y7g85JnJejDwNlfd58DKymeGi8_ZsX03Sp5VJR-Kjf6QePjaKofcWNauOiwTYt-xmgUWvgAr4NU2BgSGxbovTMdDNLE6BLDcVTDQMbbrjJBMnoKBJpKDwg_y-39tmnKu1ttffX_pkonC-pHS4dhehkrGyVdDkRe6ojcrTlNbhv9JgoAqdBO9RBCJV6PM45WlHpy0F5RClv9xRhxVgvdXSMbISCN-VBWzaJNwGS_ejFzb0L6AndStswMNaWOVIw==&ntv_ht=mtlJZAA&ntv_at=303&ntv_a=AAAAAAAAAAYwIMA&ord=1682561434889&ntv_it
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.248.88.116 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-248-88-116.eu-west-1.compute.amazonaws.com
Software
nginx/1.12.2 /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 27 Apr 2023 02:10:34 GMT
server
nginx/1.12.2
content-type
image/gif
access-control-allow-origin
*
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length
43
expires
Mon, 1 Jan 1990 12:00:00 GMT
trk.gif
jadserve.postrelease.com/
43 B
426 B
Image
General
Full URL
https://jadserve.postrelease.com/trk.gif?ntv_ui=56a57fd0-edc8-4a60-98ec-89dc12d9043b&ntv_fl=UP8B7SdIPDJsQ-gGZI79ip3XJ_UrCLJb6z0gvDs7j_CzCE7mjClXvTOw6IfUGHewQ5PupwKBUmQlJphAx5vGFg08Y7g85JnJejDwNlfd58DKymeGi8_ZsX03Sp5VJR-Kjf6QePjaKofcWNauOiwTYt-xmgUWvgAr4NU2BgSGxbovTMdDNLE6BLDcVTDQMbbrjJBMnoKBJpKDwg_y-39tmnKu1ttffX_pkonC-pHS4dhehkrGyVdDkRe6ojcrTlNbhv9JgoAqdBO9RBCJV6PM45WlHpy0F5RClv9xRhxVgvdXSMbISCN-VBWzaJNwGS_ejFzb0L6AndStswMNaWOVIw==&ntv_ht=mtlJZAA&ntv_at=808&ntv_a=AAAAAAAAAAYwIMA&ntv_sat=5&ord=1682561434891&ntv_it
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.248.88.116 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-248-88-116.eu-west-1.compute.amazonaws.com
Software
nginx/1.12.2 /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 27 Apr 2023 02:10:34 GMT
server
nginx/1.12.2
content-type
image/gif
access-control-allow-origin
*
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length
43
expires
Mon, 1 Jan 1990 12:00:00 GMT
linkid.js
www.google-analytics.com/plugins/ua/
2 KB
1 KB
Script
General
Full URL
https://www.google-analytics.com/plugins/ua/linkid.js
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 27 Apr 2023 01:48:09 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
1345
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
859
x-xss-protection
0
last-modified
Tue, 22 Oct 2019 18:15:00 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"static-on-bigtable","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/static-on-bigtable"}]}
content-type
text/javascript
cache-control
public, max-age=3600
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="static-on-bigtable"
expires
Thu, 27 Apr 2023 02:48:09 GMT
publisher:getClientId
ampcid.google.com/v1/
74 B
440 B
XHR
General
Full URL
https://ampcid.google.com/v1/publisher:getClientId?key=AIzaSyA65lEHUEizIsNtlbNo-l2K18dT680nsaM
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:806::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
991bfe84fec788f2b7d432b99a60c1e2aa2e799bc0137da8cf478299d0fc9a10
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.csoonline.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type
text/plain

Response headers

date
Thu, 27 Apr 2023 02:10:35 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
ESF
vary
Origin, X-Origin, Referer
x-frame-options
SAMEORIGIN
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://www.csoonline.com
access-control-expose-headers
vary,vary,vary,content-encoding,date,server,content-length
cache-control
private
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
94
x-xss-protection
0
pixel.gif
pixel.staticworld.net/
67 B
304 B
Image
General
Full URL
https://pixel.staticworld.net/pixel.gif?b=cso&e=view&t=article&id=3694850&ts=1682561434913&ip=
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.165 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
09d46019c7a75b96187202c3c8412182f27c413a9c3661857923dc8e94e91b7b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-served-by
cache-fra-eddf8230050-FRA
date
Thu, 27 Apr 2023 02:10:35 GMT
via
1.1 varnish
last-modified
Tue, 28 Nov 2017 22:37:51 GMT
server
AmazonS3
x-amz-request-id
NZERJY18Q1DK4D8S
x-timer
S1682561435.921888,VS0,VE239
etag
"c2db45a8f494c4b40095f4fd38d613fd"
x-cache
MISS
content-type
image/gif
accept-ranges
bytes
content-length
67
x-amz-id-2
n2w+HeIj3yjytkpW5+Pdywpxk0Sl+5A1wQwEZBjtUQfdU5QOhS7Ih7TaqUybjv/jkrOGI3s0hN0=
x-cache-hits
0
bundle.js
ib.3lift.com/rev/1ed5450ac944853f2fb309a890beec56e0763d58/dist/
180 KB
58 KB
Script
General
Full URL
https://ib.3lift.com/rev/1ed5450ac944853f2fb309a890beec56e0763d58/dist/bundle.js
Requested by
Host: ib.3lift.com
URL: https://ib.3lift.com/ttj?inv_code=tan_CSOOnline_MOAP
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.99.84 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-99-84.fra60.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
ca4632c98402232ce11da4c8e646385be9993ff53bc0fe70fc5bce163f41f674

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Fri, 07 Apr 2023 16:18:13 GMT
content-encoding
gzip
via
1.1 b43c04a791e8dcb8ddb6bb0847fcf95a.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA60-P3
age
1677142
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
alt-svc
h3=":443"; ma=86400
content-length
58649
last-modified
Fri, 07 Apr 2023 15:59:41 GMT
server
AmazonS3
etag
"92969ce251b9c0b6147d989e6fdf8c76"
content-type
text/javascript
cache-control
max-age=31536000, immutable
accept-ranges
bytes
x-amz-cf-id
0QuLFw6ewdG-8tD-fZaqPwx8dib5turFNqUdqn9ojceY-eDFtqh9fA==
segment
api.permutive.com/adv/v2/
30 B
94 B
XHR
General
Full URL
https://api.permutive.com/adv/v2/segment?new-session=true&k=84c7e805-5ce9-41f4-b988-3529488bab1c
Requested by
Host: cdn.permutive.com
URL: https://cdn.permutive.com/f5b3be27-f789-4ef1-8867-37c67da5b361-web.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.107.254.252 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
252.254.107.34.bc.googleusercontent.com
Software
Permutive /
Resource Hash
b445bad8e6fcb75a280aab0d13732970ddcb3e855e14f5281ec4200b871ac7ef

Request headers

Referer
https://www.csoonline.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
content-type
text/plain

Response headers

access-control-allow-origin
*
date
Thu, 27 Apr 2023 02:10:34 GMT
via
1.1 google
server
Permutive
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
30
content-type
application/json
init.js
www.dwin2.com/
9 KB
5 KB
Script
General
Full URL
https://www.dwin2.com/init.js
Requested by
Host: www.dwin2.com
URL: https://www.dwin2.com/pub.531979.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:a400:f:1dcc:7540:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
8000fc9fd1f0bbb26e8f5b2b1ab9653b4ffb868a3cd5d5a5df2f32d1b3b08e7a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-amz-version-id
null
content-encoding
br
via
1.1 ef13dd533b8dc9dcfdc35449cf88f808.cloudfront.net (CloudFront)
date
Thu, 27 Apr 2023 02:04:48 GMT
last-modified
Thu, 27 Apr 2023 01:16:28 GMT
server
AmazonS3
x-amz-cf-pop
FRA50-C1
age
347
x-amz-server-side-encryption
AES256
etag
W/"c4bba22c55615e86abb3cfc50bfddfee"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/javascript
cache-control
max-age=600
x-amz-cf-id
r7wXpUoKp881abU8nVF-NLDPQhTcF1U5dWsuOabqIkyPmQ31LkG1Hg==
publisher:getClientId
ampcid.google.de/v1/
3 B
369 B
XHR
General
Full URL
https://ampcid.google.de/v1/publisher:getClientId?key=AIzaSyA65lEHUEizIsNtlbNo-l2K18dT680nsaM
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.csoonline.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type
text/plain

Response headers

date
Thu, 27 Apr 2023 02:10:35 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
ESF
vary
Origin, X-Origin, Referer
x-frame-options
SAMEORIGIN
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://www.csoonline.com
access-control-expose-headers
vary,vary,vary,content-encoding,date,server,content-length
cache-control
private
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
23
x-xss-protection
0
adsct
analytics.twitter.com/i/
43 B
215 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?txn_id=o3810&p_id=Twitter
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-response-time
106
date
Thu, 27 Apr 2023 02:10:34 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
a19e51a9727667c4
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
5ce9505b9e5411ac2147a048d5c4d91f4abf5cf248b02ff0b6851a1e1412e958
content-length
43
adsct
analytics.twitter.com/i/
43 B
214 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?txn_id=o2bzg&p_id=Twitter
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-response-time
104
date
Thu, 27 Apr 2023 02:10:34 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
d99f0e861660b041
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
5ce9505b9e5411ac2147a048d5c4d91f4abf5cf248b02ff0b6851a1e1412e958
content-length
43
adsct
analytics.twitter.com/i/
43 B
212 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?txn_id=o3811&p_id=Twitter
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-response-time
109
date
Thu, 27 Apr 2023 02:10:34 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
895b044bd12c6b4e
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
5ce9505b9e5411ac2147a048d5c4d91f4abf5cf248b02ff0b6851a1e1412e958
content-length
43
adsct
analytics.twitter.com/i/
43 B
394 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?txn_id=o3ao8&p_id=Twitter
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-response-time
103
date
Thu, 27 Apr 2023 02:10:35 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
4e85bf892f42d469
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
5ce9505b9e5411ac2147a048d5c4d91f4abf5cf248b02ff0b6851a1e1412e958
content-length
43
adsct
analytics.twitter.com/i/
43 B
214 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?txn_id=o3814&p_id=Twitter
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-response-time
109
date
Thu, 27 Apr 2023 02:10:34 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
0801905b0a787b1a
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
5ce9505b9e5411ac2147a048d5c4d91f4abf5cf248b02ff0b6851a1e1412e958
content-length
43
adsct
analytics.twitter.com/i/
43 B
234 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?txn_id=o37zy&p_id=Twitter
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-response-time
103
date
Thu, 27 Apr 2023 02:10:34 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
448ef8dfc004e19b
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
5ce9505b9e5411ac2147a048d5c4d91f4abf5cf248b02ff0b6851a1e1412e958
content-length
43
adsct
analytics.twitter.com/i/
43 B
215 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?txn_id=o381a&p_id=Twitter
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-response-time
114
date
Thu, 27 Apr 2023 02:10:34 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
4048a9b6f9cdda35
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
5ce9505b9e5411ac2147a048d5c4d91f4abf5cf248b02ff0b6851a1e1412e958
content-length
43
adsct
analytics.twitter.com/i/
43 B
214 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?txn_id=o3ao7&p_id=Twitter
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-response-time
113
date
Thu, 27 Apr 2023 02:10:34 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
120b4405ec9967e4
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
5ce9505b9e5411ac2147a048d5c4d91f4abf5cf248b02ff0b6851a1e1412e958
content-length
43
adsct
analytics.twitter.com/i/
43 B
216 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?txn_id=o2r7w&p_id=Twitter
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-response-time
116
date
Thu, 27 Apr 2023 02:10:35 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
b0445351019ff750
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
5ce9505b9e5411ac2147a048d5c4d91f4abf5cf248b02ff0b6851a1e1412e958
content-length
43
adsct
analytics.twitter.com/i/
43 B
215 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?txn_id=o3cw3&p_id=Twitter
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-response-time
112
date
Thu, 27 Apr 2023 02:10:34 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
261f6393c6327bde
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
5ce9505b9e5411ac2147a048d5c4d91f4abf5cf248b02ff0b6851a1e1412e958
content-length
43
adsct
analytics.twitter.com/i/
43 B
214 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?txn_id=o3cuf&p_id=Twitter
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-response-time
107
date
Thu, 27 Apr 2023 02:10:34 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
b1823102e42577df
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
5ce9505b9e5411ac2147a048d5c4d91f4abf5cf248b02ff0b6851a1e1412e958
content-length
43
adsct
analytics.twitter.com/i/
43 B
215 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?txn_id=o3cwm&p_id=Twitter
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-response-time
105
date
Thu, 27 Apr 2023 02:10:34 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
e1fe44aadf986209
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
5ce9505b9e5411ac2147a048d5c4d91f4abf5cf248b02ff0b6851a1e1412e958
content-length
43
adsct
analytics.twitter.com/i/
43 B
210 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?txn_id=o3cwc&p_id=Twitter
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-response-time
105
date
Thu, 27 Apr 2023 02:10:35 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
4a2353694f8a7a5b
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
5ce9505b9e5411ac2147a048d5c4d91f4abf5cf248b02ff0b6851a1e1412e958
content-length
43
adsct
analytics.twitter.com/i/
43 B
209 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?txn_id=o3cwb&p_id=Twitter
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-response-time
106
date
Thu, 27 Apr 2023 02:10:35 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
ccd3c0e88ba56022
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
5ce9505b9e5411ac2147a048d5c4d91f4abf5cf248b02ff0b6851a1e1412e958
content-length
43
adsct
analytics.twitter.com/i/
43 B
214 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?txn_id=o3cvw&p_id=Twitter
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-response-time
117
date
Thu, 27 Apr 2023 02:10:34 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
4083657cc6732317
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
5ce9505b9e5411ac2147a048d5c4d91f4abf5cf248b02ff0b6851a1e1412e958
content-length
43
adsct
analytics.twitter.com/i/
43 B
209 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?txn_id=o3cvv&p_id=Twitter
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-response-time
112
date
Thu, 27 Apr 2023 02:10:34 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
54d9ad7e58d85abd
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
5ce9505b9e5411ac2147a048d5c4d91f4abf5cf248b02ff0b6851a1e1412e958
content-length
43
adsct
analytics.twitter.com/i/
43 B
211 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?txn_id=o3aok&p_id=Twitter
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-response-time
112
date
Thu, 27 Apr 2023 02:10:35 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
19b82c83a9b2cac2
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
5ce9505b9e5411ac2147a048d5c4d91f4abf5cf248b02ff0b6851a1e1412e958
content-length
43
adsct
analytics.twitter.com/i/
43 B
209 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?txn_id=o3aoj&p_id=Twitter
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-response-time
112
date
Thu, 27 Apr 2023 02:10:34 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
cbbb291098fc90aa
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
5ce9505b9e5411ac2147a048d5c4d91f4abf5cf248b02ff0b6851a1e1412e958
content-length
43
adsct
analytics.twitter.com/i/
43 B
214 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?txn_id=o3aoe&p_id=Twitter
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-response-time
111
date
Thu, 27 Apr 2023 02:10:34 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
e88e819b7f0af0b5
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
5ce9505b9e5411ac2147a048d5c4d91f4abf5cf248b02ff0b6851a1e1412e958
content-length
43
adsct
analytics.twitter.com/i/
43 B
210 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?txn_id=o3gt9&p_id=Twitter
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-response-time
117
date
Thu, 27 Apr 2023 02:10:34 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
df41cbb5b5d88e3f
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
5ce9505b9e5411ac2147a048d5c4d91f4abf5cf248b02ff0b6851a1e1412e958
content-length
43
adsct
analytics.twitter.com/i/
43 B
209 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?txn_id=o3j9q&p_id=Twitter
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-response-time
109
date
Thu, 27 Apr 2023 02:10:35 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
23486f5e15978ba4
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
5ce9505b9e5411ac2147a048d5c4d91f4abf5cf248b02ff0b6851a1e1412e958
content-length
43
adsct
analytics.twitter.com/i/
43 B
209 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?txn_id=o3l0l&p_id=Twitter
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-response-time
103
date
Thu, 27 Apr 2023 02:10:35 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
007dd82cabbc0dad
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
5ce9505b9e5411ac2147a048d5c4d91f4abf5cf248b02ff0b6851a1e1412e958
content-length
43
adsct
analytics.twitter.com/i/
43 B
209 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?txn_id=o3m0j&p_id=Twitter
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-response-time
104
date
Thu, 27 Apr 2023 02:10:35 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
ee6d8a50773c1acd
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
5ce9505b9e5411ac2147a048d5c4d91f4abf5cf248b02ff0b6851a1e1412e958
content-length
43
adsct
analytics.twitter.com/i/
43 B
210 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?txn_id=o3m0l&p_id=Twitter
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-response-time
106
date
Thu, 27 Apr 2023 02:10:34 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
ad337dc9e5a8b428
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
5ce9505b9e5411ac2147a048d5c4d91f4abf5cf248b02ff0b6851a1e1412e958
content-length
43
adsct
analytics.twitter.com/i/
43 B
214 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?txn_id=o3m0n&p_id=Twitter
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-response-time
108
date
Thu, 27 Apr 2023 02:10:34 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
7c9955f9ce1e230e
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
5ce9505b9e5411ac2147a048d5c4d91f4abf5cf248b02ff0b6851a1e1412e958
content-length
43
adsct
analytics.twitter.com/i/
43 B
210 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?txn_id=o3m0q&p_id=Twitter
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-response-time
108
date
Thu, 27 Apr 2023 02:10:35 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
20e77eec89ad239e
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
5ce9505b9e5411ac2147a048d5c4d91f4abf5cf248b02ff0b6851a1e1412e958
content-length
43
adsct
analytics.twitter.com/i/
43 B
213 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?txn_id=o3m0r&p_id=Twitter
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-response-time
110
date
Thu, 27 Apr 2023 02:10:35 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
0c2fe56eddde427a
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
5ce9505b9e5411ac2147a048d5c4d91f4abf5cf248b02ff0b6851a1e1412e958
content-length
43
adsct
analytics.twitter.com/i/
43 B
211 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?txn_id=o3m0y&p_id=Twitter
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-response-time
103
date
Thu, 27 Apr 2023 02:10:34 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
5fd446380c2723dc
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
5ce9505b9e5411ac2147a048d5c4d91f4abf5cf248b02ff0b6851a1e1412e958
content-length
43
adsct
analytics.twitter.com/i/
43 B
209 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?txn_id=o3m12&p_id=Twitter
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-response-time
110
date
Thu, 27 Apr 2023 02:10:34 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
334532cfa92c7156
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
5ce9505b9e5411ac2147a048d5c4d91f4abf5cf248b02ff0b6851a1e1412e958
content-length
43
adsct
analytics.twitter.com/i/
43 B
211 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?txn_id=o3siu&p_id=Twitter
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-response-time
110
date
Thu, 27 Apr 2023 02:10:34 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
3ede6b41a97a49f5
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
5ce9505b9e5411ac2147a048d5c4d91f4abf5cf248b02ff0b6851a1e1412e958
content-length
43
adsct
analytics.twitter.com/i/
43 B
211 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?txn_id=o45cu&p_id=Twitter
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-response-time
103
date
Thu, 27 Apr 2023 02:10:35 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
20446a297aebed7d
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
5ce9505b9e5411ac2147a048d5c4d91f4abf5cf248b02ff0b6851a1e1412e958
content-length
43
adsct
analytics.twitter.com/i/
43 B
211 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?txn_id=o4t22&p_id=Twitter
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-response-time
109
date
Thu, 27 Apr 2023 02:10:34 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
71bd044f3b08ae1b
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
5ce9505b9e5411ac2147a048d5c4d91f4abf5cf248b02ff0b6851a1e1412e958
content-length
43
adsct
analytics.twitter.com/i/
43 B
210 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?txn_id=o4t23&p_id=Twitter
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-response-time
106
date
Thu, 27 Apr 2023 02:10:35 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
47935537507cde90
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
5ce9505b9e5411ac2147a048d5c4d91f4abf5cf248b02ff0b6851a1e1412e958
content-length
43
adsct
analytics.twitter.com/i/
43 B
209 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?txn_id=o4t1y&p_id=Twitter
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-response-time
103
date
Thu, 27 Apr 2023 02:10:34 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
9e81b7bab3c1c3bc
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
5ce9505b9e5411ac2147a048d5c4d91f4abf5cf248b02ff0b6851a1e1412e958
content-length
43
adsct
analytics.twitter.com/i/
43 B
214 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?txn_id=o4t1z&p_id=Twitter
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-response-time
102
date
Thu, 27 Apr 2023 02:10:34 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
f5fbe6880c28058c
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
5ce9505b9e5411ac2147a048d5c4d91f4abf5cf248b02ff0b6851a1e1412e958
content-length
43
adsct
analytics.twitter.com/i/
43 B
212 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?txn_id=o4tas&p_id=Twitter
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-response-time
111
date
Thu, 27 Apr 2023 02:10:34 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
74d21b15dd0ddfb1
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
5ce9505b9e5411ac2147a048d5c4d91f4abf5cf248b02ff0b6851a1e1412e958
content-length
43
adsct
analytics.twitter.com/i/
43 B
210 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?txn_id=o4tat&p_id=Twitter
Requested by
Host: www.csoonline.com
URL: https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-response-time
107
date
Thu, 27 Apr 2023 02:10:35 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
71a4c677d2fcfec8
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
5ce9505b9e5411ac2147a048d5c4d91f4abf5cf248b02ff0b6851a1e1412e958
content-length
43
rid
match.adsrvr.org/track/
63 B
391 B
XHR
General
Full URL
https://match.adsrvr.org/track/rid?ttd_pid=casale&fmt=json&p=187051&gdpr=1&gdpr_consent=CPq4U4APq4U4AAGABCENDBCgAAAAAH_AAAYgAAAOLAIMEAQAgAFMAAQAEAIQAAQhiQAgAAEFAIBQAAAECgAWVgEcoAAACAQAQgAAhBBQgQAAAAAAJCAABACwQAAAiAQAAgAAAIAAEABAKACQEAAAAAJAQACAAECAAiAAApCAgIgCCAFAAAAAKJDACAIMoACAQFAgAYAH4BSwCzgLyAYEAyMJALAAQAIkAZYA_YB_gIAAawA2gB8gEygMGAbeFACAA7AEUAMIBJYYACAugNAHAGWAQAAgoBrADqgHyARUIAAgLoEQBgBlgEAANYAdUA-QDIxUAQARwAywGRgNyGQAwBHADLAZGOABAAOAPkOgEgA-ALEAXMA6gB9gF2gMjAaIA28eADABUAIoBJZAACAM0hAFAEcAdQBdoDIwGiEQAQAKgExEgAIAzSUAoABAAHwBEgDCALmAdQBFQC7QGRgNvKAAgA_gEHKQBgC5gG0APsAu0BkYDbyoAQAFQAPgA2gJLAAA.YAAAAAAAAAAA
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/183980-47728333013839.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
/
Resource Hash
d2168fe2d270177063fa6b70224586afa07795a39a00695d4e24671ad9899a74

Request headers

Referer
https://www.csoonline.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Thu, 27 Apr 2023 02:10:35 GMT
x-aspnet-version
4.0.30319
vary
Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://www.csoonline.com
cache-control
private
access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept
content-length
63
expires
Sat, 27 May 2023 02:10:35 GMT
collect
www.google-analytics.com/j/
3 B
23 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j100&a=883922384&t=pageview&_s=1&dl=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3694850%2Firanian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html&ul=en-us&de=UTF-8&dt=Iranian%20cyberspies%20deploy%20new%20malware%20implant%20on%20Microsoft%20Exchange%20Servers%20%7C%20CSO%20Online&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aCDAAEAjAAQCACAAI~&jid=1616571439&gjid=1252740767&cid=631449028.1682561435&uid=&tid=UA-300704-9&_gid=1989257628.1682561435&_r=1&_slc=1&gtm=45He34q0n81WR6LD2P&cg1=malware&cg2=newsanalysis&cg3=Lucian%20Constantin&cg4=article&cg5=de&cd1=false&cd2=&cd3=&cd4=notapplicable&cd5=Thu%2C%2027%20Apr%202023%2002%3A10%3A34%20GMT&cd6=Thu%2C%2027%20Apr%202023%2002%3A10%3A34%20GMT&cd7=0&cd8=1&cd9=production&cd10=cso%20online&cd11=US&cd12=enterprise&cd13=false&cd14=&cd15=Web&cd16=&cd17=malware&cd18=3513&cd19=malware%2C%20advanced%20persistent%20threats%2C%20cyberattacks&cd20=3513%2C%203344%2C%203718&cd21=&cd22=&cd23=&cd24=&cd25=&cd26=newsanalysis&cd27=3694850&cd28=article&cd29=Lucian%20Constantin&cd30=cso&cd31=false&cd32=&cd33=&cd34=&cd35=&cd36=&cd37=false&cd38=1&cd39=2023-04-26&cd40=2023-04-26&cd41=0&cd42=0&cd43=false&cd44=false&cd45=&cd46=false&cd47=&cd48=&cd49=&cd50=&cd51=&cd52=&cd53=67&cd54=67%2C%20943%2C%20945&cd55=&cd56=&cd58=&cd59=&cd60=&cd79=de&cd80=global&cd81=false&cd82=false&cd84=&cd104=false&z=1817838778
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.csoonline.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Thu, 27 Apr 2023 02:10:35 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.csoonline.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
3
expires
Fri, 01 Jan 1990 00:00:00 GMT
events
api.permutive.com/v2.0/batch/
4 KB
1002 B
XHR
General
Full URL
https://api.permutive.com/v2.0/batch/events?enrich=false&sdkp=true&k=84c7e805-5ce9-41f4-b988-3529488bab1c
Requested by
Host: cdn.permutive.com
URL: https://cdn.permutive.com/f5b3be27-f789-4ef1-8867-37c67da5b361-web.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.107.254.252 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
252.254.107.34.bc.googleusercontent.com
Software
Permutive /
Resource Hash
9135201db49cb86e80bb1ba1a5a56524a1cc1bf7e4c9bad84a47f598a3eb94cb

Request headers

Referer
https://www.csoonline.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
content-type
text/plain

Response headers

date
Thu, 27 Apr 2023 02:10:35 GMT
content-encoding
gzip
via
1.1 google
server
Permutive
vary
Origin
content-type
application/json
access-control-allow-origin
https://www.csoonline.com
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
984
sce
eb2.3lift.com/
37 B
140 B
Image
General
Full URL
https://eb2.3lift.com/sce?inv_code=tan_CSOOnline_MOAP&rev=1ed5450&e=Error%20getting%20gdpr%20CMPData%3A%20There%20was%20an%20error%20in%20the%20publisher%20CMP%20API%3A%20Cannot%20read%20properties%20of%20undefined%20(reading%20%27stack%27)&block=auction&lvl=3&dc=%7B%7D&cb=47177
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
76.223.111.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a0f671730127a0812.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 27 Apr 2023 02:10:36 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
37
content-type
image/gif
auction
tlx.3lift.com/web/ Frame F314
53 B
235 B
Script
General
Full URL
https://tlx.3lift.com/web/auction?inv_code=tan_CSOOnline_MOAP&referrer=https%3A%2F%2Fwww.csoonline.com%2Farticle%2F3694850%2Firanian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html&rev=1ed5450&fe=0&ft=0&cb=6066619794&gdpr=undefined
Requested by
Host: ib.3lift.com
URL: https://ib.3lift.com/rev/1ed5450ac944853f2fb309a890beec56e0763d58/dist/bundle.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.159.155.160 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-159-155-160.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
ce3a5378b700474d968f86a0fea72d8fb08e7365e54fb8a2f022b0a80f0c52ea
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/article/3694850/iranian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

content-type
application/javascript; charset=utf-8
pragma
no-cache
date
Thu, 27 Apr 2023 02:10:36 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
53
x-xss-protection
0
expires
Thu, 15 Oct 1992 20:10:00 GMT
r
eb2.3lift.com/
37 B
139 B
Image
General
Full URL
https://eb2.3lift.com/r?inv_code=tan_CSOOnline_MOAP&aid=36752348164133258407940&rev=1ed5450&domain=www.csoonline.com&ref=https%253A%252F%252Fwww.csoonline.com%252Farticle%252F3694850%252Firanian-cyberspies-deploy-new-malware-implant-on-microsoft-exchange-servers.html&pr=un&rr=not_loaded&cb=41365
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
76.223.111.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a0f671730127a0812.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 27 Apr 2023 02:10:36 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
37
content-type
image/gif
state
api.permutive.com/v1.0/
0
33 B
XHR
General
Full URL
https://api.permutive.com/v1.0/state?fetch_unseen=true&k=84c7e805-5ce9-41f4-b988-3529488bab1c
Requested by
Host: cdn.permutive.com
URL: https://cdn.permutive.com/f5b3be27-f789-4ef1-8867-37c67da5b361-web.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.107.254.252 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
252.254.107.34.bc.googleusercontent.com
Software
Permutive /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.csoonline.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
content-type
text/plain

Response headers

access-control-allow-origin
*
date
Thu, 27 Apr 2023 02:10:36 GMT
content-encoding
gzip
via
1.1 google
server
Permutive
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
adsct
analytics.twitter.com/i/
43 B
88 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?txn_id=o575m&p_id=Twitter
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-response-time
110
date
Thu, 27 Apr 2023 02:10:35 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
1decc9da61ae318e
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
5ce9505b9e5411ac2147a048d5c4d91f4abf5cf248b02ff0b6851a1e1412e958
content-length
43
adsct
analytics.twitter.com/i/
43 B
89 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?txn_id=o575w&p_id=Twitter
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.3 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

x-response-time
109
date
Thu, 27 Apr 2023 02:10:35 GMT
strict-transport-security
max-age=631138519
server
tsa_o
content-type
image/gif;charset=utf-8
x-transaction-id
d875e280562f69e7
cache-control
no-cache, no-store, max-age=0
perf
7626143928
x-connection-hash
5ce9505b9e5411ac2147a048d5c4d91f4abf5cf248b02ff0b6851a1e1412e958
content-length
43
events
api.permutive.com/v2.0/batch/
201 B
159 B
XHR
General
Full URL
https://api.permutive.com/v2.0/batch/events?enrich=false&sdkp=true&k=84c7e805-5ce9-41f4-b988-3529488bab1c
Requested by
Host: cdn.permutive.com
URL: https://cdn.permutive.com/f5b3be27-f789-4ef1-8867-37c67da5b361-web.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.107.254.252 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
252.254.107.34.bc.googleusercontent.com
Software
Permutive /
Resource Hash
0fafb7eb6aaf6e6b01b2974fd3874a5789a0b8b55e27beef4b64130ade96b555

Request headers

Referer
https://www.csoonline.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
content-type
text/plain

Response headers

date
Thu, 27 Apr 2023 02:10:36 GMT
content-encoding
gzip
via
1.1 google
server
Permutive
vary
Origin
content-type
application/json
access-control-allow-origin
https://www.csoonline.com
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
141
sce
eb2.3lift.com/
37 B
139 B
Image
General
Full URL
https://eb2.3lift.com/sce?inv_code=tan_CSOOnline_MOAP&aid=36752348164133258407940&rev=1ed5450&e=Error%20getting%20gdpr%20CMPData%3A%20There%20was%20an%20error%20in%20the%20publisher%20CMP%20API%3A%20Cannot%20read%20properties%20of%20undefined%20(reading%20%27stack%27)&block=auction&lvl=3&dc=%7B%7D&dup=1&cb=78647
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
76.223.111.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a0f671730127a0812.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 27 Apr 2023 02:10:37 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
37
content-type
image/gif
sync
eb2.3lift.com/ Frame D37D
Redirect Chain
  • https://eb2.3lift.com/sync?max=10&gdpr=false&cb=65530
  • https://eb2.3lift.com/sync?max=10&gdpr=false&cb=65530&ld=1
1 KB
2 KB
Document
General
Full URL
https://eb2.3lift.com/sync?max=10&gdpr=false&cb=65530&ld=1
Requested by
Host: ib.3lift.com
URL: https://ib.3lift.com/rev/1ed5450ac944853f2fb309a890beec56e0763d58/dist/bundle.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
76.223.111.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a0f671730127a0812.awsglobalaccelerator.com
Software
/
Resource Hash
337764f2b6947cff4698c11a9b4ef140eb8f4d051cc62f07ab6b4032a6bdbfde

Request headers

Referer
https://www.csoonline.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
no-cache, no-store, must-revalidate
content-length
1114
content-type
text/html; charset=utf-8
date
Thu, 27 Apr 2023 02:10:37 GMT
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

cache-control
no-cache, no-store, must-revalidate
content-length
0
date
Thu, 27 Apr 2023 02:10:37 GMT
location
/sync?max=10&gdpr=false&cb=65530&ld=1
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
identity
api.rlcdn.com/api/
0
254 B
XHR
General
Full URL
https://api.rlcdn.com/api/identity?pid=2&rt=envelope&cv=CPq4U4APq4U4AAGABCENDBCgAAAAAH_AAAYgAAAOLAIMEAQAgAFMAAQAEAIQAAQhiQAgAAEFAIBQAAAECgAWVgEcoAAACAQAQgAAhBBQgQAAAAAAJCAABACwQAAAiAQAAgAAAIAAEABAKACQEAAAAAJAQACAAECAAiAAApCAgIgCCAFAAAAAKJDACAIMoACAQFAgAYAH4BSwCzgLyAYEAyMJALAAQAIkAZYA_YB_gIAAawA2gB8gEygMGAbeFACAA7AEUAMIBJYYACAugNAHAGWAQAAgoBrADqgHyARUIAAgLoEQBgBlgEAANYAdUA-QDIxUAQARwAywGRgNyGQAwBHADLAZGOABAAOAPkOgEgA-ALEAXMA6gB9gF2gMjAaIA28eADABUAIoBJZAACAM0hAFAEcAdQBdoDIwGiEQAQAKgExEgAIAzSUAoABAAHwBEgDCALmAdQBFQC7QGRgNvKAAgA_gEHKQBgC5gG0APsAu0BkYDbyoAQAFQAPgA2gJLAAA.YAAAAAAAAAAA&ct=4
Requested by
Host: js-sec.indexww.com
URL: https://js-sec.indexww.com/ht/p/183980-47728333013839.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.120.133.55 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
55.133.120.34.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.csoonline.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36
Content-Type
application/x-www-form-urlencoded; charset=UTF-8

Response headers

date
Thu, 27 Apr 2023 02:10:37 GMT
via
1.1 google
access-control-allow-methods
GET, OPTIONS
access-control-allow-origin
https://www.csoonline.com
access-control-allow-credentials
true
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
access-control-allow-headers
Accept, Authorization, Content-Type, Cookie, Origin, X-Requested-With
content-length
0
generic
match.adsrvr.org/track/cmf/ Frame D37D
70 B
264 B
Image
General
Full URL
https://match.adsrvr.org/track/cmf/generic?ttd_pid=svx9t50&ttd_tpi=1&gdpr=0&gdpr_consent=
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?max=10&gdpr=false&cb=65530&ld=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.223.40.198 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
/
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

content-type
image/gif
pragma
no-cache
date
Thu, 27 Apr 2023 02:10:37 GMT
cache-control
private,no-cache, must-revalidate
x-aspnet-version
4.0.30319
content-length
70
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
ebda
eb2.3lift.com/ Frame D37D
Redirect Chain
  • https://eb2.3lift.com/ebda?sync=1&gdpr=0&gdpr_consent=
  • https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTYzOTY4MjUyODE2Mzg2NTA3ODU0OA%3D%3D
  • https://cm.g.doubleclick.net/pixel?google_nid=tl&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTYzOTY4MjUyODE2Mzg2NTA3ODU0OA%3D%3D&google_tc=
  • https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
37 B
139 B
Image
General
Full URL
https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?max=10&gdpr=false&cb=65530&ld=1
Protocol
H2
Server
76.223.111.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a0f671730127a0812.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 27 Apr 2023 02:10:37 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
37
content-type
image/gif

Redirect headers

pragma
no-cache
date
Thu, 27 Apr 2023 02:10:37 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://eb2.3lift.com/ebda?gdpr=0&gdpr_consent=
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
248
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
xuid
eb2.3lift.com/ Frame D37D
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm&google_sc&gdpr=0&gdpr_consent=
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&google_cm=&google_sc=&gdpr=0&gdpr_consent=&google_tc=
  • https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEOYLBXd6jdewp-2bUTzzdVI&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
37 B
354 B
Image
General
Full URL
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEOYLBXd6jdewp-2bUTzzdVI&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?max=10&gdpr=false&cb=65530&ld=1
Protocol
H2
Server
76.223.111.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a0f671730127a0812.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

content-type
image/gif
date
Thu, 27 Apr 2023 02:10:37 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

pragma
no-cache
date
Thu, 27 Apr 2023 02:10:37 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://eb2.3lift.com/xuid?mid=5989&xuid=CAESEOYLBXd6jdewp-2bUTzzdVI&dongle=c627&gdpr=0&gdpr_consent=&google_cver=1
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
332
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel
cm.g.doubleclick.net/ Frame D37D
Redirect Chain
  • https://eb2.3lift.com/sync/google/demand?sync=1&gdpr=0&gdpr_consent=
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTYzOTY4MjUyODE2Mzg2NTA3ODU0OA%3D%3D
  • https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTYzOTY4MjUyODE2Mzg2NTA3ODU0OA%3D%3D&google_tc=
170 B
243 B
Image
General
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTYzOTY4MjUyODE2Mzg2NTA3ODU0OA%3D%3D&google_tc=
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?max=10&gdpr=false&cb=65530&ld=1
Protocol
H2
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 27 Apr 2023 02:10:37 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Thu, 27 Apr 2023 02:10:37 GMT
server
HTTP server (unknown)
content-type
text/html; charset=UTF-8
location
https://cm.g.doubleclick.net/pixel?google_nid=triplelift&gdpr=0&gdpr_consent=&us_privacy=&google_hm=MTYzOTY4MjUyODE2Mzg2NTA3ODU0OA%3D%3D&google_tc=
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
364
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
setuid
px.ads.linkedin.com/ Frame D37D
0
669 B
Image
General
Full URL
https://px.ads.linkedin.com/setuid?partner=tripleliftdbredirect&tlUid=1639682528163865078548&dbredirect=true&gdpr=0&consent=
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?max=10&gdpr=false&cb=65530&ld=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 27 Apr 2023 02:10:36 GMT
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: 08CA5D301951497E83DB3B76C2F8B12B Ref B: FRAEDGE1313 Ref C: 2023-04-27T02:10:37Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-lor1
x-li-source-fabric
prod-ltx1
x-li-proto
http/2
content-length
0
x-li-uuid
AAX6R9zJco+HvYPb62ljqA==
xuid
eb2.3lift.com/ Frame D37D
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=triplelift&user_id=1639682528163865078548&gdpr=0&gdpr_consent=
  • https://x.bidswitch.net/ul_cb/sync?ssp=triplelift&user_id=1639682528163865078548&gdpr=0&gdpr_consent=
  • https://ads.creative-serving.com/bsw_sync?bidswitch_ssp_id=triplelift&bsw_custom_parameter=1525d8c2-a1c4-4db0-8b40-fa8c8ead9811&gdpr=0&gdpr_consent=
  • https://ads.creative-serving.com/ul_cb/bsw_sync?bidswitch_ssp_id=triplelift&bsw_custom_parameter=1525d8c2-a1c4-4db0-8b40-fa8c8ead9811&gdpr=0&gdpr_consent=
  • https://x.bidswitch.net/sync?dsp_id=4&user_id=cff2c08d-8119-47a3-9777-2a8eacd9ce0a&ssp=triplelift&expires=30&user_group=5&bsw_param=1525d8c2-a1c4-4db0-8b40-fa8c8ead9811
  • https://eb2.3lift.com/xuid?mid=2409&xuid=1525d8c2-a1c4-4db0-8b40-fa8c8ead9811&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
37 B
354 B
Image
General
Full URL
https://eb2.3lift.com/xuid?mid=2409&xuid=1525d8c2-a1c4-4db0-8b40-fa8c8ead9811&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?max=10&gdpr=false&cb=65530&ld=1
Protocol
H2
Server
76.223.111.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a0f671730127a0812.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

content-type
image/gif
date
Thu, 27 Apr 2023 02:10:37 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location
//eb2.3lift.com/xuid?mid=2409&xuid=1525d8c2-a1c4-4db0-8b40-fa8c8ead9811&dongle=d3d3&gdpr=&gdpr_consent=&gdpr_pd=
date
Thu, 27 Apr 2023 02:10:37 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
c.gif
c.bing.com/ Frame D37D
42 B
665 B
Image
General
Full URL
https://c.bing.com/c.gif?xid=1639682528163865078548&Red3=TLMS_pd
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?max=10&gdpr=false&cb=65530&ld=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/ ASP.NET
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 27 Apr 2023 02:10:36 GMT
last-modified
Wed, 19 Apr 2023 15:34:17 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 5C7F49AE9A5040AE82F106751766BA2F Ref B: FRAEDGE1214 Ref C: 2023-04-27T02:10:37Z
etag
"f5c05c67d472d91:0"
x-powered-by
ASP.NET
x-cache
CONFIG_NOCACHE
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
content-type
image/gif
cache-control
private, no-cache, proxy-revalidate, no-store
accept-ranges
bytes
content-length
42
1639682528163865078548
pr-bh.ybp.yahoo.com/sync/triplelift/ Frame D37D
43 B
426 B
Image
General
Full URL
https://pr-bh.ybp.yahoo.com/sync/triplelift/1639682528163865078548?gdpr=0&gdpr_consent=
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?max=10&gdpr=false&cb=65530&ld=1
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a05:d018:d29:3605:114e:557c:38c4:1287 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
ATS /
Resource Hash
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
Security Headers
Name Value
Content-Security-Policy sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 27 Apr 2023 02:10:37 GMT
strict-transport-security
max-age=31536000
x-content-type-options
nosniff
referrer-policy
strict-origin-when-cross-origin
server
ATS
content-security-policy
sandbox; default-src 'self'; script-src 'none'; object-src 'none'; report-uri http://csp.yahoo.com/beacon/csp?src=generic
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
x-frame-options
DENY
content-type
image/gif
content-length
43
xuid
eb2.3lift.com/ Frame D37D
Redirect Chain
  • https://b1sync.zemanta.com/usersync/triplelift?gdpr=0&gdpr_consent=
  • https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=0
37 B
139 B
Image
General
Full URL
https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=0
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?max=10&gdpr=false&cb=65530&ld=1
Protocol
H2
Server
76.223.111.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a0f671730127a0812.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 27 Apr 2023 02:10:37 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
37
content-type
image/gif

Redirect headers

Location
https://eb2.3lift.com/xuid?mid=2460&dongle=dba8&xuid=&gdpr=0
Pragma
no-cache
Date
Thu, 27 Apr 2023 02:10:37 GMT
Cache-Control
no-cache, no-store, must-revalidate
Expires
Thu, 01 Dec 1994 16:00:00 GMT
Content-Length
95
Content-Type
text/html; charset=utf-8
xuid
eb2.3lift.com/ Frame D37D
Redirect Chain
  • https://ib.adnxs.com/getuid?https%3A%2F%2Feb2.3lift.com%2Fxuid%3Fmid%3D3335%26xuid%3D%24UID%26dongle%3D4d58%26gdpr=0%26gdpr_consent=
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253A%252F%252Feb2.3lift.com%252Fxuid%253Fmid%253D3335%2526xuid%253D%2524UID%2526dongle%253D4d58%2526gdpr%3D0%2526gdpr_consent%3D
  • https://eb2.3lift.com/xuid?mid=3335&xuid=3222147745245210378&dongle=4d58&gdpr=0&gdpr_consent=
37 B
354 B
Image
General
Full URL
https://eb2.3lift.com/xuid?mid=3335&xuid=3222147745245210378&dongle=4d58&gdpr=0&gdpr_consent=
Requested by
Host: eb2.3lift.com
URL: https://eb2.3lift.com/sync?max=10&gdpr=false&cb=65530&ld=1
Protocol
H2
Server
76.223.111.18 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a0f671730127a0812.awsglobalaccelerator.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://eb2.3lift.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

content-type
image/gif
date
Thu, 27 Apr 2023 02:10:37 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

Date
Thu, 27 Apr 2023 02:10:37 GMT
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Connection
keep-alive
X-Proxy-Origin
185.213.155.174; 185.213.155.174; 940.bm-nginx-loadbalancer.mgmt.ams3.adnexus.net; adnxs.com
Content-Length
0
X-XSS-Protection
0
Pragma
no-cache
AN-X-Request-Uuid
46f2a551-91bf-4a9a-9782-0e519abec682
Server
nginx/1.23.2
Accept-CH
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
*
Location
https://eb2.3lift.com/xuid?mid=3335&xuid=3222147745245210378&dongle=4d58&gdpr=0&gdpr_consent=
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Expires
Sat, 15 Nov 2008 16:00:00 GMT
trk.gif
jadserve.postrelease.com/
43 B
426 B
Image
General
Full URL
https://jadserve.postrelease.com/trk.gif?ntv_ui=fca1e05e-3204-40ab-adff-927b847cc2a6&ntv_fl=sx1m-i7rb_31l_AoDvFzpBxUEUS5YP4jo7iARt1b1bajGN6Xqp4tZMHvM7oh0XKITQBrkWZ8lGGABSltUdy0ZLZ4j9B66eOIZuu81WLRta8zbv7Y_X6WsuTGcoWJSXq6yb_N95z3k7FGkSuQrRCFZYg2Z1YM4kOBK9Hz86qkuiCwa6Zr0XYrUGFYGounA0JQ8DMt6o7DbzgaUQgqm9DtHV8ik7cD3r02D3U1J2w35xPqZIlVysPz6yx9Zp-Erj2tOlydLHGlTcRxtHOX4pEeDo3QS9h5YA_-yIbJbzHC3wlKah6KqyRr_DV6kcZlv1hf2LZ4zOICbmUOHk5FA5EF2A==&ntv_ht=mtlJZAA&ntv_at=808&ntv_a=AAAAAAAAAAYwIMA&ntv_sat=5&ord=1682561438003&ntv_it
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.248.88.116 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-3-248-88-116.eu-west-1.compute.amazonaws.com
Software
nginx/1.12.2 /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

pragma
no-cache
date
Thu, 27 Apr 2023 02:10:38 GMT
server
nginx/1.12.2
content-type
image/gif
access-control-allow-origin
*
p3p
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-store, no-cache, must-revalidate, post-check=0, pre-check=0
content-length
43
expires
Mon, 1 Jan 1990 12:00:00 GMT
css2
fonts.googleapis.com/
5 KB
755 B
Stylesheet
General
Full URL
https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap
Requested by
Host: client
URL: about:client
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
831997ce334905a4fc3c7f0673c30bd34701f9810d87b19335aea228804ae38a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
date
Thu, 27 Apr 2023 02:10:38 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection
0
last-modified
Thu, 27 Apr 2023 00:29:06 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Thu, 27 Apr 2023 02:10:38 GMT
CSO_Logo_Social_Media.jpg
cdn.subscribers.com/uploads/setting/modal_image/44542/
125 KB
126 KB
Image
General
Full URL
https://cdn.subscribers.com/uploads/setting/modal_image/44542/CSO_Logo_Social_Media.jpg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:10::6816:3882 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e63447566912dc84f4348c82e9908103e6cb5ac56ac63d986ffb2ac5ff0534c7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://www.csoonline.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Thu, 27 Apr 2023 02:10:38 GMT
cf-cache-status
HIT
cf-bgj
h2pri
last-modified
Tue, 01 Nov 2022 20:58:03 GMT
server
cloudflare
x-amz-request-id
PW9NCNXPVW350JZ7
age
3
etag
"4001e6c240f4c3ea2b08fdf1950a3b6a"
vary
Accept-Encoding
content-type
image/jpeg
accept-ranges
bytes
cf-ray
7be387c09a652bc7-FRA
content-length
128308
x-amz-id-2
O4Zd2NrkM3RNtteaP7qLtH/zToT5AARgPadDTW+HsWVpCqOpqdPL8MQikUeXrIUg5kLOL8nNVA4=
KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/
15 KB
16 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.csoonline.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Sat, 22 Apr 2023 06:10:15 GMT
x-content-type-options
nosniff
age
417623
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15744
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:48 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 21 Apr 2024 06:10:15 GMT
KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/
15 KB
16 KB
Font
General
Full URL
https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto:wght@400;700&display=swap
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://www.csoonline.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.5615.121 Safari/537.36

Response headers

date
Sat, 22 Apr 2023 06:22:44 GMT
x-content-type-options
nosniff
age
416874
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
15860
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:24:42 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Sun, 21 Apr 2024 06:22:44 GMT

Verdicts & Comments Add Verdict or Comment

231 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 boolean| credentialless function| getQueryVariable function| addCSS function| addScript function| $ function| jQuery boolean| amazonAPSEnabled boolean| aaxEnabled function| getApolloLocaleSlugMap function| getApolloLocaleIdMap function| getApolloLocaleDescMap function| getApolloLocaleBrandMap function| getNWWCountryCodeLocaleMap function| getCountryCodeLocaleMap function| getCookie function| setCookie function| getFastlyCountryCode function| getLocaleFromCountryCode function| getAutoLocale function| getSelectedLocale function| setSelectedLocale function| browserLocaleError function| setBrowserLocale function| getRedirectLocale function| getBrowserLocale function| getLocale function| __cmp boolean| isEU object| dataLayer function| __tcfapi function| __uspapi object| _sp_ object| _sp_ccpa object| core boolean| debug string| twitterUrl string| linkedInUrl string| facebookUrl string| youTubeUrl string| twitterHandle string| localeEdition object| IDG object| googletag string| positionDataTag object| adUnitIdsMap function| getSrcCookie function| isElementAboveTheFold function| isElementInViewport function| isVisible function| isTabVisible function| buildPositionData object| adLayer boolean| global_ShowSuper boolean| global_ShowHero string| url object| massConfig object| Logon object| $thm function| loadGPT string| suppressItemsForHoliday boolean| canRunAds string| oneRegPlacementID boolean| supMontMods object| ntvConfig string| prodNames string| prodManufacturers string| prodCategories string| prodVendors string| insiderSignedIn string| idg_uuid string| dlJobFunction object| dlJobPosition object| dlIndustry undefined| insiderToken undefined| tokens string| sincePublished string| edition string| catIdList string| goldenTaxList string| primaryCatList string| adBlockStatus function| numberFromDataLayer function| stringFromDataLayer object| permutive object| jwDefaults object| webpackChunkjwplayer function| jwplayer boolean| videoPlayerBidding boolean| beforeEndDate object| _sp_analytics boolean| hasEditions object| jQuery110202767835645584358 number| relatedTop string| coreEdition string| coreEditionAbbr string| coreEditionDescription number| ocHeadTop undefined| menuWidth function| animateSlideLeft function| animateSlideRight function| calcAdHeight function| moment function| isValidEmailAddress function| encodeQueryData function| parallaxLb function| parallaxLbHandler object| parallaxArgs function| runStickyLb boolean| supLocaleEd object| _sp_queue object| LazyLoader object| xrayAd function| exeImuMobile function| exeImuDesktop function| debounce boolean| supportsOrientationChange string| orientationEvent function| renderTSO function| selectTSOAds function| DP_jQuery_1682561434286 function| getLoginStatusForOmniture function| getQsVal function| getTrackingToken function| socialTrack function| linkedInTrack function| initZooms function| readCookie function| readRawCookie function| getUrlParams function| initAccordion undefined| ss_android undefined| ss_set undefined| ss_icons undefined| ss_keywords undefined| ss_legacy undefined| ss_getElementsByClassName undefined| ss_liga object| g_brandAnalyticsInfoMap string| slugCode undefined| newsletterFormAction function| addSlugCode number| ocHead object| relatedContentHeight number| localeId boolean| g_bRequireHttps object| _comscore undefined| jQuery110202767835645584358_1682561433810 undefined| nQuery number| ntvLoadStart object| ntv object| prdom object| onFocusEvents function| ntvjQueryInit function| ntvExtends function| ntvAppendStylesheet function| ntvAppendScript function| ntvGetElementViewability function| ntvArticleTracker function| ntvViewableImpressionTracker object| PostRelease object| ntvToutAds boolean| onFocus string| subscribersSiteId object| DOMObjects object| subscribersApp object| acceptedDomains string| cleanedHost object| a object| f object| __permutive object| tp object| COMSCORE object| ns_p object| __gcse object| ggeac object| google_tag_data object| google_js_reporting_queue object| google_tag_manager function| postscribe object| google_tag_manager_external function| onYouTubeIframeAPIReady string| firstSessionDate string| lastSessionDate string| currentSessionDate number| sessionNumber undefined| inSession number| daysSinceLastSession object| currentTime number| longExpiry undefined| lastSessionMS object| brandMetricsScript boolean| scrollTwenty string| GoogleAnalyticsObject function| ga undefined| google_measure_js_timing object| headertag string| slot object| _sp_ccpa_queue object| brandmetrics function| __assign object| SC object| module$exports$cse$search object| module$exports$cse$CustomImageSearch object| module$exports$cse$CustomWebSearch object| google object| module$exports$cse$searchcontrol object| module$exports$cse$customsearchcontrol function| _googCsa number| nextSearchboxId object| gaGlobal object| script object| child object| gaplugins function| __spreadArray object| _brandmetrics number| googleNDT_ number| googleAltLoader object| _ibConfig object| _tlImpressionBusLoader object| AWIN object| tlJsonp7763 number| _tlTagsPending function| headertag_render object| pbjs object| rubicontag object| gaData

53 Cookies

Domain/Path Name / Value
www.csoonline.com/www.idge/css/webfonts Name: fastlyCountryCode
Value: DE
www.csoonline.com/www.idge.cso/css Name: fastlyCountryCode
Value: DE
www.csoonline.com/article/3694850 Name: fastlyCountryCode
Value: DE
www.csoonline.com/www.idgcsmb/css Name: fastlyCountryCode
Value: DE
www.csoonline.com/article/3694850 Name: idg_client_ip
Value: 185.213.155.174
www.csoonline.com/www/js/jquery Name: fastlyCountryCode
Value: DE
www.csoonline.com/www.idge/css Name: fastlyCountryCode
Value: DE
www.csoonline.com/www.idge/js Name: fastlyCountryCode
Value: DE
www.csoonline.com/www/js/ads Name: fastlyCountryCode
Value: DE
www.csoonline.com/www/css Name: fastlyCountryCode
Value: DE
www.csoonline.com/www/js Name: fastlyCountryCode
Value: DE
www.csoonline.com/napi Name: fastlyCountryCode
Value: DE
.3lift.com/sync Name: sync
Value: CgoIoQEQzZzog_wwCgoI4gEQzZzog_wwCgoI5gEQzZzog_wwCgoIhwIQzZzog_wwCgkICRDNnOiD_DAKCQg6EM2c6IP8MAoJCAsQzZzog_wwCgoIjAIQzZzog_wwCgkIXxDNnOiD_DAKCQgfEM2c6IP8MA==
www.csoonline.com/ads Name: fastlyCountryCode
Value: DE
.csoonline.com/ Name: aiia
Value: true
www.csoonline.com/ Name: _sp_v1_uid
Value: 1:856:a1fff3f5-23a7-481a-8857-021a2035e285
www.csoonline.com/ Name: _sp_v1_data
Value: 2:591288:1682561434:0:1:0:1:0:0:_:-1
www.csoonline.com/ Name: _sp_v1_ss
Value: 1:H4sIAAAAAAAAAItWqo5RKimOUbKKpiIjD8QwqI3ViVFKBTHzSnNygOwSsILq2mEjoRQLAKUpDPRAAQAA
.csoonline.com/ Name: consentUUID
Value: 3a17143b-bf08-4916-80d7-ac6720f8d734
.csoonline.com/ Name: permutive-id
Value: d95c9070-2304-4bb8-b4e7-bbc1bca1aab8
.f5b3be27-f789-4ef1-8867-37c67da5b361.prmutv.co/ Name: pxid
Value: 58baf6cc-5551-4442-b32c-a583a51f4114
www.csoonline.com/ Name: inSession
Value: true
www.csoonline.com/ Name: firstSessionDate
Value: Thu, 27 Apr 2023 02:10:34 GMT
www.csoonline.com/ Name: currentSessionDate
Value: Thu, 27 Apr 2023 02:10:34 GMT
www.csoonline.com/ Name: sessionNumber
Value: 1
www.csoonline.com/ Name: lastSessionDate
Value: Thu, 27 Apr 2023 02:10:34 GMT
.postrelease.com/ Name: opt_out
Value: 1
.csoonline.com/ Name: ccpaUUID
Value: aa0eff8e-b905-4bfe-b209-fb18c305a15c
.csoonline.com/ Name: dnsDisplayed
Value: true
.csoonline.com/ Name: ccpaApplies
Value: false
.csoonline.com/ Name: signedLspa
Value: false
www.csoonline.com/ Name: ntv_as_us_privacy
Value: 1---
www.csoonline.com/ Name: ntvSession
Value: {"id":2722050,"placementID":787043,"lastInteraction":1682561434881,"sessionStart":1682561434881,"sessionEndDate":1682640000000,"experiment":""}
.csoonline.com/ Name: _ga_LKE46QM5TV
Value: GS1.1.1682561434.1.0.1682561434.0.0.0
.csoonline.com/ Name: AMP_TOKEN
Value: %24NOT_FOUND
.csoonline.com/ Name: _ga
Value: GA1.2.631449028.1682561435
.csoonline.com/ Name: _gid
Value: GA1.2.1989257628.1682561435
.csoonline.com/ Name: _gat_UA-300704-9
Value: 1
.twitter.com/ Name: personalization_id
Value: "v1_hvvLFQUheSns1s1COYyrxw=="
.3lift.com/ Name: tluid
Value: 1639682528163865078548
.adnxs.com/ Name: uuid2
Value: 3222147745245210378
.bing.com/ Name: MUID
Value: 265D1B5794026E1B1990085795D06F1C
.c.bing.com/ Name: MR
Value: 0
.bidswitch.net/ Name: tuuid
Value: 1525d8c2-a1c4-4db0-8b40-fa8c8ead9811
.bidswitch.net/ Name: c
Value: 1682561437
.bidswitch.net/ Name: tuuid_lu
Value: 1682561437
.creative-serving.com/ Name: tuuid
Value: cff2c08d-8119-47a3-9777-2a8eacd9ce0a
.creative-serving.com/ Name: c
Value: 1682561437
.creative-serving.com/ Name: tuuid_lu
Value: 1682561437
.doubleclick.net/ Name: IDE
Value: AHWqTUkT1gTsQTsmXTi52OE5SbtNBp1RTtt9QEVxKdii0_Fwb5urGoon0aBaEsGUPKw
.linkedin.com/ Name: bcookie
Value: "v=2&23bd7e8a-e2d5-410e-8dad-a956f22ba531"
.linkedin.com/ Name: li_gc
Value: MTswOzE2ODI1NjE0Mzc7MjswMjGgG0W0vix17Hu92iQCuJf6Wqn7IehSvtZz0Wp/WQKFVQ==
.linkedin.com/ Name: lidc
Value: "b=OGST05:s=O:r=O:a=O:p=O:g=2751:u=1:x=1:i=1682561437:t=1682647837:v=2:sig=AQHlUF0aePUQwMc64IO3vJ08Hx7y-0Wk"

1 Console Messages

Source Level URL
Text
network error URL: https://api.rlcdn.com/api/identity?pid=2&rt=envelope&cv=CPq4U4APq4U4AAGABCENDBCgAAAAAH_AAAYgAAAOLAIMEAQAgAFMAAQAEAIQAAQhiQAgAAEFAIBQAAAECgAWVgEcoAAACAQAQgAAhBBQgQAAAAAAJCAABACwQAAAiAQAAgAAAIAAEABAKACQEAAAAAJAQACAAECAAiAAApCAgIgCCAFAAAAAKJDACAIMoACAQFAgAYAH4BSwCzgLyAYEAyMJALAAQAIkAZYA_YB_gIAAawA2gB8gEygMGAbeFACAA7AEUAMIBJYYACAugNAHAGWAQAAgoBrADqgHyARUIAAgLoEQBgBlgEAANYAdUA-QDIxUAQARwAywGRgNyGQAwBHADLAZGOABAAOAPkOgEgA-ALEAXMA6gB9gF2gMjAaIA28eADABUAIoBJZAACAM0hAFAEcAdQBdoDIwGiEQAQAKgExEgAIAzSUAoABAAHwBEgDCALmAdQBFQC7QGRgNvKAAgA_gEHKQBgC5gG0APsAu0BkYDbyoAQAFQAPgA2gJLAAA.YAAAAAAAAAAA&ct=4
Message:
Failed to load resource: the server responded with a status of 451 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Strict-Transport-Security max-age=300
X-Frame-Options deny

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

ads.creative-serving.com
alt.idgesg.net
ampcid.google.com
ampcid.google.de
analytics.twitter.com
api.ipify.org
api.permutive.com
api.rlcdn.com
b1sync.zemanta.com
c.bing.com
ccpa-service.sp-prod.net
ccpa.sp-prod.net
cdn.brandmetrics.com
cdn.jwplayer.com
cdn.permutive.com
cdn.subscribers.com
clients1.google.com
cm.g.doubleclick.net
cmp.csoonline.com
cmpv2.csoonline.com
cse.google.com
d2zv5rkii46miq.cloudfront.net
eb2.3lift.com
f5b3be27-f789-4ef1-8867-37c67da5b361.prmutv.co
fonts.googleapis.com
fonts.gstatic.com
ib.3lift.com
ib.adnxs.com
idge.staticworld.net
images.idgesg.net
images.techhive.com
jadserve.postrelease.com
js-sec.indexww.com
match.adsrvr.org
p.typekit.net
pixel.staticworld.net
pr-bh.ybp.yahoo.com
px.ads.linkedin.com
region1.google-analytics.com
s.ntv.io
sb.scorecardresearch.com
securepubads.g.doubleclick.net
tlx.3lift.com
use.fontawesome.com
use.typekit.net
w.soundcloud.com
www.csoonline.com
www.dwin2.com
www.google-analytics.com
www.google.com
www.googletagmanager.com
x.bidswitch.net
104.18.11.47
104.19.150.54
104.244.42.3
108.138.7.117
13.32.99.105
13.32.99.84
142.250.186.66
143.204.89.43
151.101.194.165
18.159.155.160
18.66.112.88
185.89.210.46
2001:4860:4802:34::36
23.35.237.64
2600:9000:2156:a400:f:1dcc:7540:93a1
2600:9000:225e:0:1:a3fa:7cc0:93a1
2600:9000:2490:de00:17:5578:e080:21
2606:4700:10::6816:3882
2606:4700:20::ac43:4842
2606:4700:e2::ac40:840f
2620:1ec:21::14
2620:1ec:c11::200
2a00:1450:4001:800::2002
2a00:1450:4001:806::2004
2a00:1450:4001:806::200e
2a00:1450:4001:80e::200a
2a00:1450:4001:812::2008
2a00:1450:4001:812::200e
2a00:1450:4001:813::200e
2a00:1450:4001:829::2003
2a00:1450:4001:829::200e
2a00:1450:4001:831::200e
2a02:26f0:3500:16::215:148b
2a02:26f0:3500:16::215:148f
2a05:d018:d29:3605:114e:557c:38c4:1287
3.126.89.100
3.248.88.116
34.107.254.252
34.120.133.55
34.193.119.244
35.158.53.160
35.241.9.51
52.222.236.19
52.223.40.198
64.185.227.155
64.202.112.191
76.223.111.18
02d2940a00290f3a9e4955de7821626688c0cacde8c97c762838e6b40ab22926
03643efcf63e8fbfe6571cd0f1a4ce49f8575a7bee74f2e9fd7fab344e474e48
053d5c873a012d89c7a079d097426cfddb18b28494a55c51eff89e0294540dfd
06c72ef9353a39000f14acb8c982d9241484108af590496e9594f217c6802bc2
076b0c51343c180d8d207f02144ce8dd5124350cc467d2f7dccc5ba4537e7155
088c90bc5a9ec59b87adcc61ba4f15e7713e884ada4fd01165d897858c2951e0
08aa3a5ee68a21d5771a70b20495b6da1c0f996c46982cd1b0447ad2db730d11
09d46019c7a75b96187202c3c8412182f27c413a9c3661857923dc8e94e91b7b
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0dbf4106e062b56a7d4db32cb448fad76e1aad0bf204b8569091bdcb5abed21e
0f58934f4f992088c01669d27d5e99816f7befa4927cb2fb9ca55397d75d6791
0f6f002861bd83ee77f252a7d0d84f00167a6ebe1392af0814aec41463edfa39
0fafb7eb6aaf6e6b01b2974fd3874a5789a0b8b55e27beef4b64130ade96b555
1104b2d009e0442e2c4c6c1ddf1ebd49ea3a90aaa1ab81f274f70e581113c9f6
11cee06f13221dea8fa5ddb99d54510eb7831fd51aa6f8610820c5a471af58a2
120fb2279d5061dd4a428f935fdf10c09e95c1f2ec0346f7aaf6c8b7f382cf49
134d12e8f05221f1fcc0124af2053a600360381f5dcc6e5a99a0bac75d311f6f
19a655057c281e5368548b39329c87039728f1afe002e651e7b4862912c62c7b
1aee66e2e24e851039801c0dace90f3efb7a1a17b033f7d5bbc12ca7c1d19432
1b197985c0bef8bc365381bd16e15dccf184eb33d0abf0afdb4f567da2000fb2
1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb
1cffc2b3146584685cd72751d7f28aa030ab9ae2f1bc78f2c27909f8d8287b26
20aae1e27cc1b9df4f61555525643b743c88437d0cf1e9eab67b1608cde7357f
227c7b295dd2359a1a3db3c8458f2081704b18e41be7da8076f04262ba3bcc56
2aa4924d40619a50c69124b81159e9d183bf42ed9792d2bdf442ce232fc53221
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
337764f2b6947cff4698c11a9b4ef140eb8f4d051cc62f07ab6b4032a6bdbfde
3472bf5f9320c4b1df7296ee201873128a3cc7db522928274ed50ce0427b190b
37e314bfd8e8cb9262b5ea01059377cea510e23b2215fc93de8b34a5726284a8
39c5031fa5e04352d50fff0f766f4c5f77f2e30a45fcf73d0470bd41cd041394
3d5629a5cbadabfd67e7c99b9e71569f356ebf7fddabd5b3c24e37b49a48c605
413215e01c47f149df91c6d2281bc5288980420466333b3190d2807c1a5a6966
453893f7daa3d8fe9716f8c6d0f36f8ade8cacfc0093e164f4f998b46427959e
464e7cde418a559c5035942d1ab154d5d906f378f256a0dd39848d197df6180d
46b92cb2cf73e41838561cc754cf5eadf2135c84877cc8b230c46080760647ee
47c749c888c850505d68f2745651928d8aec9a6802d6a8b20869fa114af92277
48594162fadd244f2afa2f3f1e02795f6a04a14398ffc78779bfada998d2b7b7
48a33ca9f42b91902d57ad8ac52e1ce32b92c8c10c732f2dbb6fe960ebfd9438
48b61e8846635705a81a226b1b6c757f19fc04db860f50c7a11186dfb9529a81
4c19de2a2807b21157d84619e86d71d6afbf4ecf0ee81b0facc3d0b0bfd19f5b
4c8d2ebc94fc9fbb0ce45ce5086f3c3cf15f50104ffc4b3fc027a216cf9e237e
4db7d12ede1471d2a955366edf3913a77a0f12d495dedad879b064a7009416eb
4e6b5fc328bac95eec2e30afa8a58224c9accc6d70daf0e864d75c4c6d07fe94
4f260b3d6386537537aa0d48c8156c334ef9cc90ee10f52006b6f0580b43a6cd
4f4ed0e81c2f0016d06ae816dd872edc04e97612c9d36f2f3f4475f2954e7fcc
4fbfd433f5e7dbfa63ee8cb13f135d2534240c9c7a86856b8d4b07a0b97fffc1
5156e9286b87b1e03f6151c2bb29ad54d2b9da4df874a23c742a0693bdc209a1
533b23c57b1770cc3ee9c15b998b2eb494fa0adb2d6929fd22a9b78adfade3a7
55e8d16bb1a291b0524928dd3bd20c191a14d8a947e4b141271f9c595c7bb451
5e0784f265f20230748207a0c6311051fc3feb34622c64464a47465a6623119b
5f1b5087fa315ca0fd65c68e2ef58ce1c33fee26d59cd0fce07458afa3f2fe8f
5f73732b6a7db119255640eb6e05727feb081ee5830baa018beee78269e37df5
607bfd152e5c762ba0f0502f653c7bbb546ad7955e792a9840d4ae28a8219423
64642a9f2b4bc512a962bbef490a3dd615c3d184fc64b70681b5973befc77871
6467b42b646c644d356adf8dc595da52488b944fb5a0b2a7cb14aee4ad66ef19
66b5ca68288cc2506f1c5709fe38cebccca428406a7ce96e392718203666d503
66ea0c6fa4034dbeae9784e34b02aeb748608ba8c2576e1b08fabd965712ad99
676aa6d4090a54ea6893484095f55c80659fb8538db100cdb8ce1dc82bab42b8
6a0f6cf6b4648c192d81b5fc7b70cb2f6819ef4a799e421e8626cae9697aa85a
6ccbc734f00e46668252ae9d10341f50adabda27ba89547f1700899ed85f5338
71a9f7971618b14dc4014c55de13c36da054db21b986c50a6d112eaf9e366418
75878e20516aab7c1d8b3db8af6b7c27fdde3b62e41c44f30295a54a5f8cc124
76c910bb824e43c77431224a89550f49bade4de45b824c1cfc7e94144090dc43
76ef37e3762dad764955f02e65d0a7605d49840206bfb72d4caa0f54e5eb87b6
7b04d6ce2f17eeb96bf52a53711114a4bfef440bcb40927f77d395d549fe53d1
8000fc9fd1f0bbb26e8f5b2b1ab9653b4ffb868a3cd5d5a5df2f32d1b3b08e7a
831997ce334905a4fc3c7f0673c30bd34701f9810d87b19335aea228804ae38a
83d86c9e7359ed844c0e7682abcd5cdb65222d421c61156f17791ac6c2650274
8982bee74ee4a24031eea6ffe2cf2a3a41b3eee01490dfb4b8a641ef69dc923f
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
9135201db49cb86e80bb1ba1a5a56524a1cc1bf7e4c9bad84a47f598a3eb94cb
916ee67baa8a85524530a7988a5050cdd22569ab152e94197a7ed501ffbb7223
92fca55833f48b4289ac8f1cedd48752b580fce4ec4b5d81670b8193d6e51b54
95c331d662f93db24707a76978d1e803e57609516019afcdab497443b3ca11df
96753f997cca08f5d79ee77443fec431dc00ed61d45d8d36fd2d8584a20aa198
967f7a6fbba84fc9c23b291b58a0dbff757eb5649f6aa453ef85175913a16271
96d0dd911efdc3f82fa2ec6e9322740d6175933f9443f6b9b233b58c7b46a893
9844fb443bd322af1d908116fa890abdbed6b8b6fe73fba91c9beb8408318aad
991bfe84fec788f2b7d432b99a60c1e2aa2e799bc0137da8cf478299d0fc9a10
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
9c10c9bbb18ea74a6ecc43dc83bc6a1878ddbd5a2a2da428df090e641502e9b4
9ce2035e40ab7ae723a1fbf900ca078b874e6c322569d0fb60570c63e5fedce4
9eb5f4aaf681528b1c83e13a0e9302e9f05132372e35dbc96c95485198028d56
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a30b328dddcc925fa7f945e057446747b3da997f5a56989e137c687650b17238
a5e5c781317ce492049cb1f9e1deec67c47bbe5dbd03ec12f688cf7a221a79f2
a739dbffc4a907c1f133b4b26e0daf544ea743218bba5704a910313b0ef3ac10
a95ff5717cbb58f3acad7822a2413f4fac3d5c0fa1782f877067bb68e850c823
ab2f09a472db787d4a0b68a059df82e87c154e5f35d115d95d1ee6f35728f947
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ad0caf6aded59a5161a02d4625a5ae70845f1a854bb1a6df49c0acd387fbcc3f
ad20d2d42fcbd58ad9c50a6e53db21bf4425be6f8237a41f109c2717c30b4067
adadfb3670790ddac052b933d400e23273bd79a5cee02b0810154071ab65396f
af34f58ea2fc346a5f7028ad8b721a9bb31405cf283471a37dab53bad10a6a36
b1c7b0d1505f8ee7de88bfad7de89af2514174595bc36a2f00a016a98c3189d8
b42412a0e2fd452601f89dc9119e8dc4c563d204e6a54ba2f91e7c046f9de3a4
b445bad8e6fcb75a280aab0d13732970ddcb3e855e14f5281ec4200b871ac7ef
b52e06f854795718703ef9723b47a9a23edcbe2ae53ff261926d8d6059056cfe
b59054e128a42511aa22399d02cd8365ac1c66a6efe6f4f11cfe1ae16284db0c
b5a291b53145791eb26ce6e36a5e4d81b79a8d6f477928f9f5b72ec0b6d0f5d5
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bdfe5b167ff906b96e1f8f028ac8f5e41af7a1892d0cc3a275d28057ba79c0a9
c2787f84ac525e6b202f56eb25ef03f40017d11100280dd6f3866cadb4d1f50c
c2facc83585250863ffab013bd876eeada78fcbd090d015c6f3ac418a2501f38
c383325844c6616d85a4a44e0a85429ba586eecf8c807bfc06368ceb30ef09e2
c3d405a4118aebae54f30c61193f2634568e02bcbff030673eef87e064fcbfc3
c5d492c511f48abbfa3e77559fd35575dbede797bd4777d28acea42e728d569b
c965aefdb4c6acf10f46758dc1601a64d811dcf3a378bf9e90278916aa47508f
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
ca4632c98402232ce11da4c8e646385be9993ff53bc0fe70fc5bce163f41f674
cdf2700459ab474c9e19ccf7a3b9c6044a6cf2f2ff7bb0e1ab7bde2304409c87
ce3a5378b700474d968f86a0fea72d8fb08e7365e54fb8a2f022b0a80f0c52ea
d0d5886513eda3107d1e40683961d54cac4de14f95f2656b848d1c019293c2a7
d2168fe2d270177063fa6b70224586afa07795a39a00695d4e24671ad9899a74
d2aae940b6d023c99cbd656bbd0868f51bcf4a93455efef42cc95d8a4c7bceca
d2d4f317dcf44ab195d049f781fd353562cf0fa08474e0c659f0fa06609d5529
db29aa88ea3a11062a7dc45fcc65be9b8dc3fff9c849078dd6809d35974e86ec
dc1f34948cbeccb66c1b22633753475c2b3bd39c85c3f4695afba334a7f1fc75
dcb3e51a64f948ed5302183e2a8e5ecf9e84f8e86e8cd40fc5d18485fbb2c074
dcec22bbcb68119d6c7d6d5e088fb82183a9826d0c9e3403f1386fd837f06a89
e0c629f4ece53000517c7077027971a1dea36ec8c9daac30b7655bcbca84b00a
e2bb96a5d1a2730721d3a080417ba6e190d141449b61d9b1ccf40b392e28b100
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e62105f0f4f80e7103a519d4ac0cb794a3d48f39ef62eb9058adf9b7c3586f7f
e63447566912dc84f4348c82e9908103e6cb5ac56ac63d986ffb2ac5ff0534c7
e7b90d32907f89c49e9e2a2ccca95133277f756f13a14187936d9b948ff67b44
ef7755857c07a98436dce7c81f0071da4925b63aa320f6a600eafdc08d620f5f
efc98c44d90a834d73841149d058355f31bf5cfcef209166cecc8c4d3442d7c0
f0b97fc49950832323730d508911fa12bd098eca0670ccb3a18ada5af3a34699
f370d6bd05df8e6a5b671f06e038c4d85d95dc5446fdeb8f8762e817882a8322
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f5f2c1a6d8f0ed5823cba065bba521d2fb34ff7dd6f1389a9a2c1fccce76b551
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f6bbd3540733be952a2921b2e4716d3b5190d5897510efcf9baa09649a1eaedf
fb6b1425ff73fe62d725a3981ac08d9f57e16e14d5ae321c617e21e1d7403d1f
fbbbac05b654e9de243f6e42f41efa36522598661a05b5d84b7614d7effba3d6
fc630eae66d14c714e935e9686b763aab14adc301890a57262408ee4bd401978
fd66d8dc41c06a99c3877934b3af8d38de72f3a94db252c0b9474bec35014491
fe7be71169532a67a19a2178113658e2cf55413a21635fcd0a89060c839a5be6
fef78f8e1f00ae09508cbe22095d1a9a0b6a2b2594119cdcf8aec1997b156c5d