urlscan.io logo urlscan.io
SecurityTrails logo

www.darkreading.com Open in urlscan Pro
2606:4700::6811:7763  Public Scan

Go To Rescan Add Verdict Report
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Submission: On May 18 via api from CA — Scanned from CA
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 61 IPs in 4 countries across 48 domains to perform 233 HTTP transactions. The main IP is 2606:4700::6811:7763, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.darkreading.com. The Cisco Umbrella rank of the primary domain is 199286.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on May 9th 2022. Valid for: a year.
This is the only time www.darkreading.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
35 2606:4700::68... 13335 (CLOUDFLAR...)
1 24 142.251.40.98 15169 (GOOGLE)
10 151.101.194.217 54113 (FASTLY)
2 2001:4de0:ac1... 20446 (STACKPATH...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 52.85.61.122 16509 (AMAZON-02)
1 2606:4700:440... 13335 (CLOUDFLAR...)
1 2607:f8b0:400... 15169 (GOOGLE)
1 2607:f8b0:400... 15169 (GOOGLE)
1 143.204.146.92 16509 (AMAZON-02)
1 2607:f8b0:400... 15169 (GOOGLE)
1 151.101.129.131 54113 (FASTLY)
1 23.217.37.202 16625 (AKAMAI-AS)
1 52.85.61.56 16509 (AMAZON-02)
4 2607:f8b0:400... 15169 (GOOGLE)
1 52.85.61.102 16509 (AMAZON-02)
3 2607:f8b0:400... 15169 (GOOGLE)
1 2600:9000:202... 16509 (AMAZON-02)
2 52.85.61.61 16509 (AMAZON-02)
1 99.84.126.105 16509 (AMAZON-02)
1 52.85.61.15 16509 (AMAZON-02)
1 2 142.0.173.15 7160 (NETDYNAMICS)
1 143.204.146.76 16509 (AMAZON-02)
3 3 68.67.160.132 29990 (ASN-APPNEX)
2 3.87.151.192 14618 (AMAZON-AES)
1 143.204.146.69 16509 (AMAZON-02)
1 34.226.181.34 14618 (AMAZON-AES)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2607:f8b0:400... 15169 (GOOGLE)
2 52.29.180.64 16509 (AMAZON-02)
3 2607:f8b0:400... 15169 (GOOGLE)
1 2607:f8b0:400... 15169 (GOOGLE)
1 52.49.46.73 16509 (AMAZON-02)
1 99.84.37.122 16509 (AMAZON-02)
4 5 142.251.35.162 15169 (GOOGLE)
3 5 35.190.60.146 15169 (GOOGLE)
2 2 107.178.254.65 15169 (GOOGLE)
1 1 34.98.67.3 15169 (GOOGLE)
2 12 34.111.234.236 15169 (GOOGLE)
1 2 3.224.247.179 14618 (AMAZON-AES)
3 3 52.223.40.198 16509 (AMAZON-02)
2 2 18.233.240.143 14618 (AMAZON-AES)
3 5 52.55.144.0 14618 (AMAZON-AES)
1 151.101.194.137 54113 (FASTLY)
1 2607:f8b0:400... 15169 (GOOGLE)
7 2607:f8b0:400... 15169 (GOOGLE)
1 2607:f8b0:400... 15169 (GOOGLE)
2 185.221.87.248 206998 (NEW-2)
9 2607:f8b0:400... 15169 (GOOGLE)
5 2607:f8b0:400... 15169 (GOOGLE)
32 23.52.163.40 16625 (AKAMAI-AS)
4 23.200.197.46 16625 (AKAMAI-AS)
1 35.170.140.102 14618 (AMAZON-AES)
1 18.217.19.184 16509 (AMAZON-02)
1 54.211.26.76 14618 (AMAZON-AES)
22 52.85.61.116 16509 (AMAZON-02)
1 1 104.118.9.10 16625 (AKAMAI-AS)
1 2 104.76.100.229 16625 (AKAMAI-AS)
4 23.52.164.7 16625 (AKAMAI-AS)
5 54.172.30.83 14618 (AMAZON-AES)
1 6 23.195.109.72 16625 (AKAMAI-AS)
1 1 74.119.119.150 19750 (AS-CRITEO)
1 1 2600:1f18:4e9... 14618 (AMAZON-AES)
2 2 34.229.3.43 14618 (AMAZON-AES)
1 2a02:6ea0:c40... 60068 (CDN77 ^_^)
1 52.85.61.49 16509 (AMAZON-02)
1 52.205.48.68 14618 (AMAZON-AES)
1 146.75.36.159 54113 (FASTLY)
233 61
35    2606:4700::6811:7763 (United States)

ASN13335 (CLOUDFLARENET, US)
www.darkreading.com
beta.darkreading.com
c.darkreading.com
24    142.251.40.98 (United States)

ASN15169 (GOOGLE, US)
PTR: lga25s79-in-f2.1e100.net
securepubads.g.doubleclick.net
10    151.101.194.217 (United States)

ASN54113 (FASTLY, US)
eu-images.contentstack.com
2    2001:4de0:ac18::1:a:3a (Netherlands)

ASN20446 (STACKPATH-CDN, US)
code.jquery.com
1    2606:4700::6811:190e (United States)

ASN13335 (CLOUDFLARENET, US)
cdnjs.cloudflare.com
1    2606:4700::6812:acf (United States)

ASN13335 (CLOUDFLARENET, US)
stackpath.bootstrapcdn.com
1    52.85.61.122 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-85-61-122.ewr53.r.cloudfront.net
assets.zephr.com
1    2606:4700:440e::ac40:9c1a (United States)

ASN13335 (CLOUDFLARENET, US)
static.cloudflareinsights.com
1    2607:f8b0:4006:80a::2008 (Staten Island, United States)

ASN15169 (GOOGLE, US)
www.googletagmanager.com
1    2607:f8b0:4006:80c::2003 (Staten Island, United States)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
1    143.204.146.92 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-146-92.ewr52.r.cloudfront.net
informa-dark-reading.preview.zephr.com
1    2607:f8b0:4006:81d::200e (Staten Island, United States)

ASN15169 (GOOGLE, US)
www.googleoptimize.com
1    151.101.129.131 (United States)

ASN54113 (FASTLY, US)
6600d6d98e534115970f9529a45f3195.js.ubembed.com
1    23.217.37.202 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-217-37-202.deploy.static.akamaitechnologies.com
img.en25.com
1    52.85.61.56 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-85-61-56.ewr53.r.cloudfront.net
s.dpmsrv.com
4    2607:f8b0:4006:808::200e (Staten Island, United States)

ASN15169 (GOOGLE, US)
www.youtube.com
1    52.85.61.102 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-85-61-102.ewr53.r.cloudfront.net
static.hotjar.com
3    2607:f8b0:4006:80e::200e (Staten Island, United States)

ASN15169 (GOOGLE, US)
www.google-analytics.com
1    2600:9000:202c:bc00:18:1fcd:351:7bc1 (United States)

ASN16509 (AMAZON-02, US)
static.chartbeat.com
2    52.85.61.61 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-85-61-61.ewr53.r.cloudfront.net
static.iris.informa.com
1    99.84.126.105 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-84-126-105.ewr52.r.cloudfront.net
assets.ubembed.com
1    52.85.61.15 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-85-61-15.ewr53.r.cloudfront.net
script.hotjar.com
2    142.0.173.15 (United States)

ASN7160 (NETDYNAMICS, US)
trk.darkreading.com
1    143.204.146.76 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-146-76.ewr52.r.cloudfront.net
cdn.treasuredata.com
3    68.67.160.132 (Brooklyn, United States)

ASN29990 (ASN-APPNEX, US)
PTR: 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
ib.adnxs.com
2    3.87.151.192 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-87-151-192.compute-1.amazonaws.com
a.dpmsrv.com
1    143.204.146.69 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-146-69.ewr52.r.cloudfront.net
vars.hotjar.com
1    34.226.181.34 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-226-181-34.compute-1.amazonaws.com
ping.chartbeat.net
1    2606:4700::6811:7963 (United States)

ASN13335 (CLOUDFLARENET, US)
c.darkreading.com
1    2607:f8b0:4004:c06::9b (Washington, United States)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
2    52.29.180.64 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-29-180-64.eu-central-1.compute.amazonaws.com
eu01.in.treasuredata.com
3    2607:f8b0:4006:806::2004 (Staten Island, United States)

ASN15169 (GOOGLE, US)
www.google.com
1    2607:f8b0:4006:809::2003 (Staten Island, United States)

ASN15169 (GOOGLE, US)
www.google.ca
1    52.49.46.73 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-49-46-73.eu-west-1.compute.amazonaws.com
in.hotjar.com
1    99.84.37.122 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-99-84-37-122.ewr52.r.cloudfront.net
vc.hotjar.io
5    142.251.35.162 (United States)

ASN15169 (GOOGLE, US)
PTR: lga25s78-in-f2.1e100.net
cm.g.doubleclick.net
5    35.190.60.146 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 146.60.190.35.bc.googleusercontent.com
idsync.rlcdn.com
2    107.178.254.65 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 65.254.178.107.bc.googleusercontent.com
pippio.com
1    34.98.67.3 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 3.67.98.34.bc.googleusercontent.com
tags.rd.linksynergy.com
12    34.111.234.236 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 236.234.111.34.bc.googleusercontent.com
ml314.com
2    3.224.247.179 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-224-247-179.compute-1.amazonaws.com
dpm.demdex.net
3    52.223.40.198 (United States)

ASN16509 (AMAZON-02, US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com
match.adsrvr.org
2    18.233.240.143 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-18-233-240-143.compute-1.amazonaws.com
sync.crwdcntrl.net
5    52.55.144.0 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-55-144-0.compute-1.amazonaws.com
ps.eyeota.net
1    151.101.194.137 (United States)

ASN54113 (FASTLY, US)
js-agent.newrelic.com
1    2607:f8b0:4006:80a::2002 (Staten Island, United States)

ASN15169 (GOOGLE, US)
adservice.google.com
7    2607:f8b0:4006:81e::2002 (Staten Island, United States)

ASN15169 (GOOGLE, US)
pagead2.googlesyndication.com
1    2607:f8b0:4006:806::2001 (Staten Island, United States)

ASN15169 (GOOGLE, US)
82c8e2daca830d4ec57f996206427194.safeframe.googlesyndication.com
2    185.221.87.248 (Ireland)

ASN206998 (NEW-2, IE)
bam.eu01.nr-data.net
9    2607:f8b0:4006:822::2001 (Staten Island, United States)

ASN15169 (GOOGLE, US)
tpc.googlesyndication.com
5    2607:f8b0:4006:816::2002 (Staten Island, United States)

ASN15169 (GOOGLE, US)
www.googletagservices.com
32    23.52.163.40 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-52-163-40.deploy.static.akamaitechnologies.com
z.moatads.com
px.moatads.com
4    23.200.197.46 (Piscataway, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-200-197-46.deploy.static.akamaitechnologies.com
a.teads.tv
1    35.170.140.102 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-35-170-140-102.compute-1.amazonaws.com
ads.celtra.com
1    18.217.19.184 (Columbus, United States)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-217-19-184.us-east-2.compute.amazonaws.com
geo.moatads.com
1    54.211.26.76 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-211-26-76.compute-1.amazonaws.com
in.ml314.com
22    52.85.61.116 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-85-61-116.ewr53.r.cloudfront.net
cache-ssl.celtra.com
1    104.118.9.10 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a104-118-9-10.deploy.static.akamaitechnologies.com
pixel.mathtag.com
2    104.76.100.229 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a104-76-100-229.deploy.static.akamaitechnologies.com
tags.bluekai.com
4    23.52.164.7 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-52-164-7.deploy.static.akamaitechnologies.com
t.teads.tv
5    54.172.30.83 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-172-30-83.compute-1.amazonaws.com
track.celtra.com
6    23.195.109.72 (Edison, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a23-195-109-72.deploy.static.akamaitechnologies.com
sync.teads.tv
cdn2.teads.tv
1    74.119.119.150 (United States)

ASN19750 (AS-CRITEO, US)
dis.criteo.com
1    2600:1f18:4e9:5a02:5689:a3a1:b994:601c (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
pr-bh.ybp.yahoo.com
2    34.229.3.43 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-229-3-43.compute-1.amazonaws.com
loadm.exelator.com
1    2a02:6ea0:c400::11 (United States)

ASN60068 (CDN77 ^_^, GB)
load77.exelator.com
1    52.85.61.49 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-85-61-49.ewr53.r.cloudfront.net
aa.agkn.com
1    52.205.48.68 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-205-48-68.compute-1.amazonaws.com
beacon.krxd.net
1    146.75.36.159 (Reston, United States)

ASN54113 (FASTLY, US)
pbs.twimg.com
Apex Domain
Subdomains		 Transfer
38 darkreading.com
www.darkreading.com — Cisco Umbrella Rank: 199286
beta.darkreading.com — Cisco Umbrella Rank: 667277
trk.darkreading.com
c.darkreading.com — Cisco Umbrella Rank: 847146
831 KB
33 moatads.com
z.moatads.com — Cisco Umbrella Rank: 374
geo.moatads.com — Cisco Umbrella Rank: 595
px.moatads.com — Cisco Umbrella Rank: 405
546 KB
30 doubleclick.net
securepubads.g.doubleclick.net — Cisco Umbrella Rank: 187
stats.g.doubleclick.net — Cisco Umbrella Rank: 92
cm.g.doubleclick.net — Cisco Umbrella Rank: 212
212 KB
28 celtra.com
ads.celtra.com — Cisco Umbrella Rank: 3795
cache-ssl.celtra.com — Cisco Umbrella Rank: 4530
track.celtra.com — Cisco Umbrella Rank: 4343
409 KB
17 googlesyndication.com
pagead2.googlesyndication.com — Cisco Umbrella Rank: 95
82c8e2daca830d4ec57f996206427194.safeframe.googlesyndication.com
tpc.googlesyndication.com — Cisco Umbrella Rank: 130
371 KB
14 teads.tv
a.teads.tv — Cisco Umbrella Rank: 1212
t.teads.tv — Cisco Umbrella Rank: 2574
sync.teads.tv — Cisco Umbrella Rank: 1040
cdn2.teads.tv — Cisco Umbrella Rank: 14399
142 KB
13 ml314.com
ml314.com — Cisco Umbrella Rank: 1640
in.ml314.com — Cisco Umbrella Rank: 8405
65 KB
10 contentstack.com
eu-images.contentstack.com — Cisco Umbrella Rank: 97781
73 KB
5 googletagservices.com
www.googletagservices.com — Cisco Umbrella Rank: 175
204 KB
5 eyeota.net
ps.eyeota.net — Cisco Umbrella Rank: 904
3 KB
5 rlcdn.com
idsync.rlcdn.com — Cisco Umbrella Rank: 330
566 B
4 google.com
www.google.com — Cisco Umbrella Rank: 7
adservice.google.com — Cisco Umbrella Rank: 74
2 KB
4 hotjar.com
static.hotjar.com — Cisco Umbrella Rank: 645
script.hotjar.com — Cisco Umbrella Rank: 896
vars.hotjar.com — Cisco Umbrella Rank: 989
in.hotjar.com — Cisco Umbrella Rank: 1730
69 KB
4 youtube.com
www.youtube.com — Cisco Umbrella Rank: 91
103 KB
3 exelator.com
loadm.exelator.com — Cisco Umbrella Rank: 1247
load77.exelator.com — Cisco Umbrella Rank: 3668
2 KB
3 adsrvr.org
match.adsrvr.org — Cisco Umbrella Rank: 338
1 KB
3 adnxs.com
ib.adnxs.com — Cisco Umbrella Rank: 240
3 KB
3 treasuredata.com
cdn.treasuredata.com — Cisco Umbrella Rank: 20950
eu01.in.treasuredata.com — Cisco Umbrella Rank: 61439
20 KB
3 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 37
20 KB
3 dpmsrv.com
s.dpmsrv.com — Cisco Umbrella Rank: 25780
a.dpmsrv.com — Cisco Umbrella Rank: 22485
91 KB
2 bluekai.com
tags.bluekai.com — Cisco Umbrella Rank: 458
1 KB
2 nr-data.net
bam.eu01.nr-data.net — Cisco Umbrella Rank: 9116
2 KB
2 crwdcntrl.net
sync.crwdcntrl.net — Cisco Umbrella Rank: 721
863 B
2 demdex.net
dpm.demdex.net — Cisco Umbrella Rank: 214
2 KB
2 pippio.com
pippio.com — Cisco Umbrella Rank: 765
719 B
2 informa.com
static.iris.informa.com — Cisco Umbrella Rank: 124863
26 KB
2 ubembed.com
6600d6d98e534115970f9529a45f3195.js.ubembed.com — Cisco Umbrella Rank: 413368
assets.ubembed.com — Cisco Umbrella Rank: 10175
48 KB
2 zephr.com
assets.zephr.com — Cisco Umbrella Rank: 37773
informa-dark-reading.preview.zephr.com — Cisco Umbrella Rank: 951152
16 KB
2 jquery.com
code.jquery.com — Cisco Umbrella Rank: 660
56 KB
1 twimg.com
pbs.twimg.com — Cisco Umbrella Rank: 702
2 KB
1 krxd.net
beacon.krxd.net — Cisco Umbrella Rank: 472
338 B
1 agkn.com
aa.agkn.com — Cisco Umbrella Rank: 441
656 B
1 yahoo.com
pr-bh.ybp.yahoo.com — Cisco Umbrella Rank: 485
986 B
1 criteo.com
dis.criteo.com — Cisco Umbrella Rank: 725
532 B
1 mathtag.com
pixel.mathtag.com — Cisco Umbrella Rank: 1281
642 B
1 newrelic.com
js-agent.newrelic.com — Cisco Umbrella Rank: 381
17 KB
1 linksynergy.com
tags.rd.linksynergy.com — Cisco Umbrella Rank: 4158
394 B
1 hotjar.io
vc.hotjar.io — Cisco Umbrella Rank: 2320
257 B
1 google.ca
www.google.ca — Cisco Umbrella Rank: 7955
501 B
1 chartbeat.net
ping.chartbeat.net — Cisco Umbrella Rank: 1180
201 B
1 chartbeat.com
static.chartbeat.com — Cisco Umbrella Rank: 1226
14 KB
1 en25.com
img.en25.com — Cisco Umbrella Rank: 6563
3 KB
1 googleoptimize.com
www.googleoptimize.com — Cisco Umbrella Rank: 1364
37 KB
1 gstatic.com
fonts.gstatic.com
20 KB
1 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 71
63 KB
1 cloudflareinsights.com
static.cloudflareinsights.com — Cisco Umbrella Rank: 1192
5 KB
1 bootstrapcdn.com
stackpath.bootstrapcdn.com — Cisco Umbrella Rank: 2363
15 KB
1 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 237
7 KB
233 48
Domain Requested by
28 beta.darkreading.com www.darkreading.com
beta.darkreading.com
27 px.moatads.com
24 securepubads.g.doubleclick.net 1 redirects www.darkreading.com
beta.darkreading.com
www.googletagservices.com
22 cache-ssl.celtra.com ads.celtra.com
www.darkreading.com
12 ml314.com 2 redirects beta.darkreading.com
www.darkreading.com
z.moatads.com
ml314.com
10 eu-images.contentstack.com www.darkreading.com
9 tpc.googlesyndication.com beta.darkreading.com
www.darkreading.com
securepubads.g.doubleclick.net
7 pagead2.googlesyndication.com beta.darkreading.com
tpc.googlesyndication.com
www.googletagservices.com
6 www.darkreading.com beta.darkreading.com
www.darkreading.com
5 sync.teads.tv 1 redirects beta.darkreading.com
sync.teads.tv
5 track.celtra.com
5 z.moatads.com securepubads.g.doubleclick.net
5 www.googletagservices.com securepubads.g.doubleclick.net
5 ps.eyeota.net 3 redirects www.darkreading.com
5 idsync.rlcdn.com 3 redirects www.darkreading.com
sync.teads.tv
5 cm.g.doubleclick.net 4 redirects sync.teads.tv
4 t.teads.tv
4 a.teads.tv securepubads.g.doubleclick.net
beta.darkreading.com
www.darkreading.com
4 www.youtube.com beta.darkreading.com
www.darkreading.com
www.youtube.com
3 match.adsrvr.org 3 redirects
3 www.google.com www.darkreading.com
securepubads.g.doubleclick.net
beta.darkreading.com
3 ib.adnxs.com 3 redirects
3 www.google-analytics.com beta.darkreading.com
2 loadm.exelator.com 2 redirects
2 tags.bluekai.com 1 redirects sync.teads.tv
2 bam.eu01.nr-data.net beta.darkreading.com
2 sync.crwdcntrl.net 2 redirects
2 dpm.demdex.net 1 redirects www.darkreading.com
2 pippio.com 2 redirects
2 eu01.in.treasuredata.com beta.darkreading.com
2 c.darkreading.com beta.darkreading.com
2 a.dpmsrv.com www.darkreading.com
2 trk.darkreading.com 1 redirects www.darkreading.com
2 static.iris.informa.com beta.darkreading.com
2 code.jquery.com www.darkreading.com
securepubads.g.doubleclick.net
1 pbs.twimg.com
1 beacon.krxd.net sync.teads.tv
1 aa.agkn.com sync.teads.tv
1 load77.exelator.com sync.teads.tv
1 pr-bh.ybp.yahoo.com 1 redirects
1 dis.criteo.com 1 redirects
1 cdn2.teads.tv www.darkreading.com
1 pixel.mathtag.com 1 redirects
1 in.ml314.com ml314.com
1 geo.moatads.com z.moatads.com
1 ads.celtra.com www.darkreading.com
1 82c8e2daca830d4ec57f996206427194.safeframe.googlesyndication.com beta.darkreading.com
1 adservice.google.com beta.darkreading.com
1 js-agent.newrelic.com beta.darkreading.com
1 tags.rd.linksynergy.com 1 redirects
1 vc.hotjar.io beta.darkreading.com
1 in.hotjar.com beta.darkreading.com
1 www.google.ca www.darkreading.com
1 stats.g.doubleclick.net beta.darkreading.com
1 ping.chartbeat.net www.darkreading.com
1 vars.hotjar.com beta.darkreading.com
1 cdn.treasuredata.com beta.darkreading.com
1 script.hotjar.com beta.darkreading.com
1 assets.ubembed.com beta.darkreading.com
1 static.chartbeat.com beta.darkreading.com
1 static.hotjar.com beta.darkreading.com
1 s.dpmsrv.com beta.darkreading.com
1 img.en25.com beta.darkreading.com
1 6600d6d98e534115970f9529a45f3195.js.ubembed.com beta.darkreading.com
1 www.googleoptimize.com beta.darkreading.com
1 informa-dark-reading.preview.zephr.com beta.darkreading.com
1 fonts.gstatic.com www.darkreading.com
1 www.googletagmanager.com beta.darkreading.com
1 static.cloudflareinsights.com www.darkreading.com
1 assets.zephr.com www.darkreading.com
1 stackpath.bootstrapcdn.com www.darkreading.com
1 cdnjs.cloudflare.com www.darkreading.com
233 72
Subject Issuer Validity Valid
darkreading.com
Cloudflare Inc ECC CA-3		 2022-05-09 -
2023-05-09		 a year crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2022-04-25 -
2022-07-18		 3 months crt.sh
*.contentstack.com
GlobalSign Atlas R3 DV TLS CA 2022 Q1		 2022-02-08 -
2023-03-12		 a year crt.sh
*.jquery.com
Sectigo RSA Domain Validation Secure Server CA		 2021-07-14 -
2022-08-14		 a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2021-09-21 -
2022-09-20		 a year crt.sh
assets.zephr.com
Amazon		 2022-04-28 -
2023-05-27		 a year crt.sh
*.google-analytics.com
GTS CA 1C3		 2022-04-25 -
2022-07-18		 3 months crt.sh
*.gstatic.com
GTS CA 1C3		 2022-04-25 -
2022-07-18		 3 months crt.sh
*.preview.zephr.com
Amazon		 2021-07-12 -
2022-08-10		 a year crt.sh
*.js.ubembed.com
GlobalSign Atlas R3 DV TLS CA H2 2021		 2022-01-04 -
2023-02-05		 a year crt.sh
*.en25.com
DigiCert SHA2 Secure Server CA		 2021-09-14 -
2022-09-14		 a year crt.sh
*.dpmsrv.com
Amazon		 2022-04-17 -
2023-05-16		 a year crt.sh
*.google.com
GTS CA 1C3		 2022-04-25 -
2022-07-18		 3 months crt.sh
*.hotjar.com
Amazon		 2021-11-25 -
2022-12-23		 a year crt.sh
*.chartbeat.com
Thawte RSA CA 2018		 2022-05-06 -
2023-06-03		 a year crt.sh
static.iris.informa.com
Amazon		 2021-09-02 -
2022-10-01		 a year crt.sh
assets.ubembed.com
Amazon		 2022-02-04 -
2023-03-05		 a year crt.sh
*.treasuredata.com
Amazon		 2021-09-17 -
2022-10-16		 a year crt.sh
*.chartbeat.net
Thawte RSA CA 2018		 2021-12-01 -
2022-12-30		 a year crt.sh
*.in.treasuredata.com
Amazon		 2021-07-24 -
2022-08-22		 a year crt.sh
www.google.com
GTS CA 1C3		 2022-04-25 -
2022-07-18		 3 months crt.sh
*.google.ca
GTS CA 1C3		 2022-05-04 -
2022-07-27		 3 months crt.sh
*.hotjar.io
Amazon		 2021-08-17 -
2022-09-15		 a year crt.sh
*.ml314.com
GoGetSSL RSA DV CA		 2022-03-29 -
2023-03-29		 a year crt.sh
js-agent.newrelic.com
GlobalSign Atlas R3 DV TLS CA H2 2021		 2021-10-06 -
2022-11-07		 a year crt.sh
*.eu01.nr-data.net
DigiCert TLS RSA SHA256 2020 CA1		 2021-05-24 -
2022-06-24		 a year crt.sh
tpc.googlesyndication.com
GTS CA 1C3		 2022-04-25 -
2022-07-18		 3 months crt.sh
moatads.com
DigiCert SHA2 Secure Server CA		 2021-11-27 -
2022-11-29		 a year crt.sh
teads.tv
R3		 2022-03-23 -
2022-06-21		 3 months crt.sh
celtra.com
Amazon		 2022-02-09 -
2023-03-09		 a year crt.sh
*.moatads.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-05-25 -
2022-06-25		 a year crt.sh
odc-pixel-prod-01.oracle.com
DigiCert SHA2 Secure Server CA		 2022-02-26 -
2023-03-01		 a year crt.sh
*.rlcdn.com
Sectigo RSA Domain Validation Secure Server CA		 2022-02-03 -
2023-02-25		 a year crt.sh
*.agkn.com
RapidSSL RSA CA 2018		 2020-07-25 -
2022-09-18		 2 years crt.sh
beacon.krxd.net
DigiCert TLS RSA SHA256 2020 CA1		 2021-11-03 -
2022-11-02		 a year crt.sh
*.twimg.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-07-30 -
2022-07-30		 a year crt.sh

This page contains 15 frames:

Primary Page: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Frame ID: 21C1ED8539436C92E348181FB75DA493
Requests: 147 HTTP requests in this frame

Frame: https://vars.hotjar.com/box-960463a57b3f52829a72c264e060823d.html
Frame ID: AD3CA354EC4DD0F2A2C7B32922484CFE
Requests: 1 HTTP requests in this frame

Frame: https://82c8e2daca830d4ec57f996206427194.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Frame ID: 94A6B78A3C9276C67835180F45D74745
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuLz62IaLhyXvRZ8bM-IrhU-up2rLGqCB-pKgf2s5IRGTfJv-KQIpiz-69wKRpMoSIJ0-LDcXd9pEa8XIFlRGFA4LSrqJ_R4GpZKomL-QzUanXfSvtQUxI8CiokjIMCF6OZ7HiJxLMmBunF0Zcs1vgDv9hc_cC8hz3bMcElNVv5a6jmsNKP35nPDwwrom8v5qbbjFm5EkVWvOUVAzhA0J2wHMuy14L2UrTKQLoV9tjSoQqjS9AA7Uu8tnuZSDuqtuV8wgc72ZJSiL9sQW64dmxvvJCpvlLuWcFDQqKl0kUsSdbmdW0SSMPxwHlJnBdVRjy4P-RHH0_SjhdAOs4BnD0XjLLRo-yChIa0oYs&sig=Cg0ArKJSzGOyptcF-R-LEAE&uach_m=[UACH]&urlfix=1&adurl=
Frame ID: 0791A88BA9A7E799FAA9F29C6A3A2E53
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsskmpdTiRmnV6EmjRipwhC3COHu3aE4jX7mFCB43M73jGdDBttPjPbGiZiBljuFaZlMk1iVrMFcaFv7UYX1le5Rz83z2VSqMvRh3K0Y-lhvqYpuImuF5zFpC9acf1HLBw-zxHI12E9CGqneBllqPFkpyeyICnPpEd5X2ZQcrkXLHTzD-sTEGjPBOS3F7eTXWHHQO4mFAtVVZnVR-3MFF-8S71YizsfiS2ABdt2dujsuZM8u8C-DCrTYsojcZS3-erkKQWuY-iFtlNEx3RCmSgYkboRvlloRDAH3L4ZOoO9rmEnJqBseDJs4TzcnCImes5bzV2cdWsQF0yvEAoSc130iv2iU7sxJBHjGSImqURR9d-ZQxkbRgxglik4cF9QBhIv2HMtTEkf_VYk&sig=Cg0ArKJSzEId5dX1y-QQEAE&uach_m=[UACH]&urlfix=1&adurl=
Frame ID: C435211C24223940880B0D86E7CFDC2E
Requests: 17 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvab35SdeyJUNbhkYCTEEtbIyeGxDPPlDvKN9PQ4PQ3aRfO8pjg0QYAUJSHdWom-3c7_c_bCV_iS7ytSxw7X3_KNwX0sdzm5McKAeC8GfrkwviZVHVwkVkSF4Vm1zD5wEd0T5QPbd9-lXFVY4a_y1FItvFG_OCAII1ptVKjzkJj8CRHlJvBO8Z1e500jroDCoyJgnZY-Ng_-gVVdCOEO8gskhlU2t63z_PSJ3JyMuEGKMGZURWDiVWVzlIf_IwM9r4-Pe0IyTiGZbDed-ji9TrobDb6D9YDs7zW_pqa4r7NTivKrd2C06cxlSKtIolO0Jnp-hoklsNkZ8zoo7A9AX_tSJnvzlLovPw&sig=Cg0ArKJSzNs8_V-Sn-JfEAE&uach_m=[UACH]&urlfix=1&adurl=
Frame ID: D9F488BB919A130FBDEACF6FE9E8C227
Requests: 9 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvbBZvIrgtsMbLnQOs0LXlvtGGXwU5yQV4xmo4EzeBvVyE4LgLdyFd42p60zfwp1YwICgIz__dFCBuwnpJM-vmOGmmdhsV58LW7Dv3ASMvh-lVlrUfNkJIkwmjYetckDqe3XY96jXcM02sMfFVX5Hv8HQsS7eM9rXAZxgZRqgZY9-k4_9yZ7UG4xz1klz1gEOlR0viBu3UHhpH1qRf9oVtOUvfFBISrP0j_iyEHy_nU238x3HVzTF6tCr_vnxIZV_hygLtb12AeMSmsfPW-f0hRgaYGY7cFNwVlZKVS2CV1ndzVHtVrz0VAmXljmHQyw7JV0rfYOURtqNO0hM0pLdUt-yUqRg&sig=Cg0ArKJSzKkCxW0fkNp-EAE&uach_m=[UACH]&urlfix=1&adurl=
Frame ID: 8036A3F1423793569CEC462FBE31FC19
Requests: 6 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvnz2sgEmCltkDMfnUEmOyPAdqBDpyFXBaYS5Bs3VossVv5rVmzKMZuTbI1SrDGtm_n79un2tYQJwfVMZGb3tbfZP3K9zh7z1C3qOjYugoWQcY7IsNDje71zp2A6Gt6EEs6Xu7vyPA2UM0G8AsCN3LXBuhKCGg0S_D5njHXLKYQoiQsYGQMX6TQjm7QYG-cqeeA8Mg5EiCUgsdeQUdPeXLsnZPJhr65o6g_pgRS91jN_ibMXSXB2kU0RSvy2c6IKIPgIW0dDD6cN3mEVN85Vws3a9wxSwpZTOMCWKfJGLIHfN1V2RCky_ZByNtZCSI39HqQ_gsVG-id2pV4UkRd57jDqNdePzvaZm8&sig=Cg0ArKJSzERu2fMm7GBFEAE&uach_m=[UACH]&adurl=
Frame ID: EC4B1EA1C071123CBF2273FEE67EFAE9
Requests: 8 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssTJ-qPZiCCXyWxAFPn6fDQqs3OvruFEUkxSLYXYlaCEyoljZiJgT0l7NftR2v6mlUJDcYwpdslxqLwP4aoUjmFioizuAFnfyYMEbz_AJmqMcq-xBFee6_3ii0_CDtDsj0X_VdVrAZ9Nq8gybgGzAh7nOjinbZpFxIPK7tASWEvfOMXBX36Pk8U2RSi8p4BWUZDZ9RLb-PSXXOtqjqZpDkWSCbBCA_yGboFDMCLPkPgWzGPP-UxvW8KBjBqD3IZtYkQguLsSQWHxrVyVMcfBnqPcuonHP60r81tr7Pkw8JdGFIQy35JL-mmc9R5i-uCmNUlO0hsFCGvlb_GbMsoukojWDbceYFj5SI&sig=Cg0ArKJSzMm2kukpPDw5EAE&uach_m=[UACH]&adurl=
Frame ID: D7441A2AE59C37586DB2362CF047D0BE
Requests: 9 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Frame ID: 67E70F9B7F6904D19BE11A50B13555DA
Requests: 3 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/aframe
Frame ID: 0F8CE46CEA6DD3EB713CBD342F61B701
Requests: 2 HTTP requests in this frame

Frame: https://sync.teads.tv/iframe?pid=142873&gdprIab={%22reason%22:220,%22status%22:22,%22consent%22:%22%22,%22apiVersion%22:null,%22cmpId%22:null}&fromFormat=true&env=js-web&auctid=9b3a6b04-52a1-4dd4-9bc4-94098175937f&vid=eed3fd5c-407f-43bf-8415-729de81fdb8a&1652889826570
Frame ID: 0B1CE4E24FDBF44B01040302E9FDA1C1
Requests: 10 HTTP requests in this frame

Frame: data://truncated
Frame ID: 2968BC0DFC650800429BEAFA5717E1E6
Requests: 2 HTTP requests in this frame

Frame: https://cdn2.teads.tv/scala/789231/d9e0f444644247bf94e7009f87e22c34/540_940.mp4
Frame ID: 8562FE2AC3D749B247F33669B81F7A65
Requests: 1 HTTP requests in this frame

Frame: https://cache-ssl.celtra.com/api/fonts/monotype_tradegothic800n/3_a21706b45861b8577718feb7af969a082ae4576a33ea62b203d77b518b45935a/1454a71d-cdbb-429c-8092-122f4493e0c7.woff?subset=%20%22%2C5ABCDEFGHILMOPRSTUVWabcdefghiklmnoprstuvwxy
Frame ID: F86682B969ED6C674ACFC7404E834CC5
Requests: 24 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Cyber-Espionage Attack Drops Post-Exploit Malware Framework on Microsoft Exchange Servers

Detected technologies

Overall confidence: 100%
Detected patterns
  • ubembed\.com
Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • chartbeat\.js
Overall confidence: 100%
Detected patterns
  • static\.cloudflareinsights\.com/beacon(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • googlesyndication\.com/
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Overall confidence: 100%
Detected patterns
  • googleoptimize\.com/optimize\.js
Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
Overall confidence: 100%
Detected patterns
  • //static\.hotjar\.com/
Overall confidence: 100%
Detected patterns
  • moatads\.com
Overall confidence: 100%
Detected patterns
  • /popper\.js/([0-9.]+)
Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

233
Requests

91 %
HTTPS

32 %
IPv6

48
Domains

72
Subdomains

61
IPs

4
Countries

3493 kB
Transfer

10756 kB
Size

67
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 64
  • https://trk.darkreading.com/visitor/v200/svrGP?pps=3&siteid=2150&ref=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&ref2=elqNone&tzo=0&ms=82&optin=disabled&firstPartyCookieDomain=trk.darkreading.com HTTP 302
  • https://trk.darkreading.com/visitor/v200/svrGP?pps=3&siteid=2150&ref=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&ref2=elqNone&tzo=0&ms=82&optin=disabled&elq1pcGUID=55E48DD607DB4839939B67ADFE2CDD01
Request Chain 68
  • https://ib.adnxs.com/getuid?https://a.dpmsrv.com/dpmpxl/index.php?id=$UID&q%3DxImp%26v%3D1.x%26cl%3D55%26pixelIndex%3D0%26r%3D461716%26tzOffset%3D0%26url%3Dhttps%253A%252F%252Fwww.darkreading.com%252Fattacks-breaches%252Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&_=1652889824159 HTTP 307
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fa.dpmsrv.com%2Fdpmpxl%2Findex.php%3Fid%3D%24UID%26q%253DxImp%2526v%253D1.x%2526cl%253D55%2526pixelIndex%253D0%2526r%253D461716%2526tzOffset%253D0%2526url%253Dhttps%25253A%25252F%25252Fwww.darkreading.com%25252Fattacks-breaches%25252Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers%26_%3D1652889824159 HTTP 302
  • https://a.dpmsrv.com/dpmpxl/index.php?id=4008352111651074917&q=xImp&v=1.x&cl=55&pixelIndex=0&r=461716&tzOffset=0&url=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&_=1652889824159
Request Chain 81
  • https://cm.g.doubleclick.net/pixel?google_nid=datapoint_dmp&google_cm&ap_id=4008352111651074917&pixelIndex=0&_=1652889824160 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=datapoint_dmp&google_cm=&ap_id=4008352111651074917&pixelIndex=0&_=1652889824160&google_tc= HTTP 302
  • https://a.dpmsrv.com/dpmpxl/index.php?q=dfp&ap_id=4008352111651074917&pixelIndex=0&_=1652889824160&google_gid=CAESEJCsVZSHtb0k_rjyYANTSLQ&google_cver=1
Request Chain 82
  • https://idsync.rlcdn.com/423396.gif?partner_uid=4008352111651074917 HTTP 307
  • https://idsync.rlcdn.com/1000.gif?memo=COTrGRIfChsIARDGpwEaEzQwMDgzNTIxMTE2NTEwNzQ5MTcQABoNCOCxlJQGEgUI6AcQAEIASgA HTTP 307
  • https://pippio.com/api/sync?pid=5324&it=1&iv=dbaf346bc308f2763e95ee7c4db865f1ead8d4ad23ebe1fb6fb1f19771e48a39791426b5417dce21&_=2 HTTP 307
  • https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CMwpElsKVwgBEJInGlBkYmFmMzQ2YmMzMDhmMjc2M2U5NWVlN2M0ZGI4NjVmMWVhZDhkNGFkMjNlYmUxZmI2ZmIxZjE5NzcxZTQ4YTM5NzkxNDI2YjU0MTdkY2UyMRAAGgwI4LGUlAYSBAgCEABCAEoA HTTP 302
  • https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlBkYmFmMzQ2YmMzMDhmMjc2M2U5NWVlN2M0ZGI4NjVmMWVhZDhkNGFkMjNlYmUxZmI2ZmIxZjE5NzcxZTQ4YTM5NzkxNDI2YjU0MTdkY2UyMRAAGgwI4LGUlAYSBAgCEABCAEoA&google_gid=CAESEI8wdj_SH6GDEvIO4nCow0c&google_cver=1 HTTP 307
  • https://tags.rd.linksynergy.com/rcs?ns=lr&uid3= HTTP 303
  • https://idsync.rlcdn.com/458249.gif?partner_uid=97289869-cdf6-4e7f-83df-709660c5d5d8
Request Chain 85
  • https://dpm.demdex.net/ibs:dpid=22052&dpuuid=3627294074409582600&redir= HTTP 302
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=3627294074409582600&redir=
Request Chain 86
  • https://idsync.rlcdn.com/395886.gif?partner_uid=3627294074409582600 HTTP 307
  • https://ml314.com/csync.ashx?fp=3011a0d6b988e27377674abde2d234357d6f769aab0f4ae9d890420f8817b92ef4cb09cee1a4f8eb&person_id=3627294074409582600&eid=50082
Request Chain 87
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=d0tro1j&ttd_tpi=1 HTTP 302
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=d0tro1j&ttd_tpi=1 HTTP 302
  • https://ml314.com/utsync.ashx?eid=53819&et=0&fp=34b50b2e-1c5e-4d58-86ca-d1813d53017f&gdpr=0&gdpr_consent=
Request Chain 88
  • https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3627294074409582600 HTTP 302
  • https://sync.crwdcntrl.net/map/ct=y/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3627294074409582600 HTTP 302
  • https://ml314.com/csync.ashx?fp=a6c68c311fbb44f4e440d9bac87a62df&eid=50146&person_id=3627294074409582600
Request Chain 89
  • https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif HTTP 302
  • https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif HTTP 302
  • https://ml314.com/utsync.ashx?eid=50052&et=0&fp=2hfBP6X6oYaVBcXArGASnuhVJgYnNNb-UYIQosciNY2E&gdpr=0&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil%26referrer_pid%3Dr8hrb20 HTTP 302
  • https://ml314.com/csync.ashx?fp=2hfBP6X6oYaVBcXArGASnuhVJgYnNNb-UYIQosciNY2E&person_id=3627294074409582600&eid=50052&return=https%3a%2f%2fps.eyeota.net%2fmatch%3fbid%3dr8hrb20%26uid%3dnil%26referrer_pid%3dr8hrb20 HTTP 302
  • https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20
Request Chain 112
  • https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsskmpdTiRmnV6EmjRipwhC3COHu3aE4jX7mFCB43M73jGdDBttPjPbGiZiBljuFaZlMk1iVrMFcaFv7UYX1le5Rz83z2VSqMvRh3K0Y-lhvqYpuImuF5zFpC9acf1HLBw-zxHI12E9CGqneBllqPFkpyeyICnPpEd5X2ZQcrkXLHTzD-sTEGjPBOS3F7eTXWHHQO4mFAtVVZnVR-3MFF-8S71YizsfiS2ABdt2dujsuZM8u8C-DCrTYsojcZS3-erkKQWuY-iFtlNEx3RCmSgYkboRvlloRDAH3L4ZOoO9rmEnJqBseDJs4TzcnCImes5bzV2cdWsQF0yvEAoSc130iv2iU7sxJBHjGSImqURR9d-ZQxkbRgxglik4cF9QBhIv2HMtTEkf_VYk&sig=Cg0ArKJSzEId5dX1y-QQEAE&uach_m=[UACH]&urlfix=1&adurl=https://tpc.googlesyndication.com/simgad/5740496405795669132? HTTP 302
  • https://tpc.googlesyndication.com/simgad/5740496405795669132
Request Chain 158
  • https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=3627294074409582600%26eid=50220 HTTP 302
  • https://ml314.com/csync.ashx?fp=4dde6285-18e2-4100-9567-6c40bf510df2&person_id=3627294074409582600&eid=50220
Request Chain 159
  • https://tags.bluekai.com/site/20486?limit=0&id=3627294074409582600&redir=https://ml314.com/csync.ashx%3Ffp=$_BK_UUID%26person_id=3627294074409582600%26eid=50056 HTTP 302
  • https://ml314.com/csync.ashx?fp=$_BK_UUID&person_id=3627294074409582600&eid=50056
Request Chain 160
  • https://ib.adnxs.com/getuid?https://ml314.com/csync.ashx%3Ffp=$UID%26person_id=3627294074409582600%26eid=2 HTTP 302
  • https://ml314.com/csync.ashx?fp=4008352111651074917&person_id=3627294074409582600&eid=2
Request Chain 161
  • https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm&google_sc&google_hm=MnZPSFdDTWY3NldST3ltRmVpVjZDNUktTFlhOEtzcWp5MUJFZDNKY1pSVTA&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=r8hrb20 HTTP 302
  • https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=r8hrb20&google_gid=CAESENoWp8gJmAZ_DXDHfvJtgV8&google_cver=1
Request Chain 179
  • https://sync.teads.tv/um?eid=3&fp=1&uid=&vid=eed3fd5c-407f-43bf-8415-729de81fdb8a&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D&gdpr=0&gdpr_consent=&_t=1652889826673 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=ZWVkM2ZkNWMtNDA3Zi00M2JmLTg0MTUtNzI5ZGU4MWZkYjhh
Request Chain 180
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=teads&ttd_tpi=1&gdpr=0&gdpr_consent=&_t=1652889826673 HTTP 302
  • https://sync.teads.tv/um?eid=22&uid=34b50b2e-1c5e-4d58-86ca-d1813d53017f&gdpr=0&gdpr_consent=
Request Chain 181
  • https://dis.criteo.com/dis/usersync.aspx?r=79&p=145&cp=teads&cu=1&url=https%3A%2F%2Fsync.teads.tv%2Fum%3Ffp%3D1%26eid%3D80%26uid%3D%40%40CRITEO_USERID%40%40&gdpr=0&gdpr_consent=&_t=1652889826673 HTTP 302
  • https://sync.teads.tv/um?fp=1&eid=80&uid=75ce90fb-6c80-4c61-b13b-22733d19063b&gdpr=0&gdpr_consent=
Request Chain 182
  • https://pr-bh.ybp.yahoo.com/sync/teads/eed3fd5c-407f-43bf-8415-729de81fdb8a?gdpr=0&gdpr_consent=&_t=1652889826673 HTTP 302
  • https://sync.teads.tv/um?eid=132&uid=y-bt_AJzlE2oSF4i5.bO_9gauWLCNjXOODSYo-~A
Request Chain 183
  • https://loadm.exelator.com/load/?p=204&g=810&j=0&buid=eed3fd5c-407f-43bf-8415-729de81fdb8a_us_ca&gdpr_consent=&_t=1652889826673 HTTP 302
  • https://loadm.exelator.com/load/?p=204&g=810&j=0&buid=eed3fd5c-407f-43bf-8415-729de81fdb8a_us_ca&gdpr_consent=&_t=1652889826673&xl8blockcheck=1 HTTP 302
  • https://load77.exelator.com/pixel.gif

233 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
www.darkreading.com/attacks-breaches/ 		402 KB
55 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7763 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Next.js
Resource Hash
cde3b0c2f6c0d615e0ab11adec7f0442154d49fd3c429f57b3507f900a1cdf7d

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

access-control-allow-origin
*
cache-control
s-maxage=30, stale-while-revalidate
cf-cache-status
DYNAMIC
cf-ray
70d5d3120b21ca47-YUL
content-encoding
br
content-type
text/html; charset=utf-8
date
Wed, 18 May 2022 16:03:43 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
vary
Accept-Encoding, Origin
x-powered-by
Next.js
x-proxy-by
https://www.darkreading.com
newrelic-browser.js
beta.darkreading.com/js/ 		30 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://beta.darkreading.com/js/newrelic-browser.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7763 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8b0e0e1532b550e4aa75788c0be84dea157a9e3342eb01e2d5f037cdf638521d

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:43 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 18 May 2022 08:19:56 GMT
server
cloudflare
etag
W/"7736-180d6408be0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
cache-control
public, max-age=7200
cf-ray
70d5d312fcbeca47-YUL
expires
Wed, 18 May 2022 18:03:43 GMT
adsensebase.js
beta.darkreading.com/js/prebid-ads/ 		24 B
196 B 		Script
General
Check archive.org
Download Go to
Full URL
https://beta.darkreading.com/js/prebid-ads/adsensebase.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7763 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
757c66837cfbe8c2533e8c41099d8e50b20f83fbf84ead6a6d7435dcc2ad0884

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:43 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 18 May 2022 08:19:56 GMT
server
cloudflare
etag
W/"18-180d6408be0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
cache-control
public, max-age=7200
cf-ray
70d5d312fcbfca47-YUL
expires
Wed, 18 May 2022 18:03:43 GMT
gpt.js
securepubads.g.doubleclick.net/tag/js/ 		81 KB
28 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/tag/js/gpt.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.40.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s79-in-f2.1e100.net
Software
sffe /
Resource Hash
4210ce362220f12cb0f1ba2eb9f9378546d115fc0c1d23eb71e399604275cf04
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
28394
x-xss-protection
0
server
sffe
etag
"1218 / 696 of 1000 / last-modified: 1652871876"
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Wed, 18 May 2022 16:03:43 GMT
3a00e39d4605d99565cf.css
beta.darkreading.com/_next/static/css/ 		433 KB
59 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://beta.darkreading.com/_next/static/css/3a00e39d4605d99565cf.css
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7763 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8acf63a7ff114a450762601a6156d3a1256fcbff4061a2feb24c7b173a6f86c6

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:43 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 18 May 2022 08:21:50 GMT
server
cloudflare
age
25940
etag
W/"6284ac9e-6c0f3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css
cache-control
public, max-age=31536000
cf-bgj
minify
cf-ray
70d5d312fcbdca47-YUL
expires
Thu, 18 May 2023 16:03:43 GMT
webpack-ada7255eeaa014883564.js
beta.darkreading.com/_next/static/chunks/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://beta.darkreading.com/_next/static/chunks/webpack-ada7255eeaa014883564.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7763 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
709b4a953e1fee71e6582f1610cdd46a27b4c7bff6f457bc8e5979c63055b4b6

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:43 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 18 May 2022 08:21:50 GMT
server
cloudflare
age
25940
etag
W/"6284ac9e-ce0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000
cf-bgj
minify
cf-ray
70d5d3141e1fca47-YUL
expires
Thu, 18 May 2023 16:03:43 GMT
framework-3af989d3dbeb77832f99.js
beta.darkreading.com/_next/static/chunks/ 		129 KB
42 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://beta.darkreading.com/_next/static/chunks/framework-3af989d3dbeb77832f99.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7763 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1dcc17de6c7a4aa95a465d7fbb436e3f4c412dad3aa183fde03fa32f9178c3ca

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:43 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 04 Nov 2021 09:47:52 GMT
server
cloudflare
age
16868241
etag
W/"6183ac48-2025e"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000
cf-bgj
minify
cf-ray
70d5d3141e20ca47-YUL
expires
Thu, 18 May 2023 16:03:43 GMT
main-4579d29662f3fd692d14.js
beta.darkreading.com/_next/static/chunks/ 		90 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://beta.darkreading.com/_next/static/chunks/main-4579d29662f3fd692d14.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7763 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3e34be9443c0ab7eb569e14bc5af571e06d760368b659a0a3a417ff743f785e

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:43 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 04 Nov 2021 09:47:52 GMT
server
cloudflare
age
16868242
etag
W/"6183ac48-169c2"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000
cf-bgj
minify
cf-ray
70d5d3141e21ca47-YUL
expires
Thu, 18 May 2023 16:03:43 GMT
_app-ed3bf26a215597ef97e2.js
beta.darkreading.com/_next/static/chunks/pages/ 		449 KB
142 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://beta.darkreading.com/_next/static/chunks/pages/_app-ed3bf26a215597ef97e2.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7763 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
47cb96b05d896668a55f58a1a352f71a53fe50b1ab85a9920e8da3cbe3e20a23

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:43 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 06 Apr 2022 10:53:01 GMT
server
cloudflare
age
3646868
etag
W/"624d710d-70215"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000
cf-bgj
minify
cf-ray
70d5d3141e22ca47-YUL
expires
Thu, 18 May 2023 16:03:43 GMT
75fc9c18-84e7ab66c7989b7a8b6f.js
beta.darkreading.com/_next/static/chunks/ 		59 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://beta.darkreading.com/_next/static/chunks/75fc9c18-84e7ab66c7989b7a8b6f.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7763 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0ac5442585942acb8da8f6fd1e2ef864b68a552686c83484c0044772d6a3ec77

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:43 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 08 Dec 2021 11:14:01 GMT
server
cloudflare
age
13926938
etag
W/"61b09379-eb8b"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000
cf-bgj
minify
cf-ray
70d5d3141e23ca47-YUL
expires
Thu, 18 May 2023 16:03:43 GMT
c0ed2f06-8374a19ea75854b54102.js
beta.darkreading.com/_next/static/chunks/ 		372 KB
81 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://beta.darkreading.com/_next/static/chunks/c0ed2f06-8374a19ea75854b54102.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7763 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
403e89bf468c203d1f4887cbc4ab12878370cbade342b65d30c36a38d60894ee

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:43 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 16 Mar 2022 09:48:06 GMT
server
cloudflare
age
1089824
etag
W/"6231b256-5cf19"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000
cf-bgj
minify
cf-ray
70d5d3141e25ca47-YUL
expires
Thu, 18 May 2023 16:03:43 GMT
466-a973b8e13a6f2860f90f.js
beta.darkreading.com/_next/static/chunks/ 		44 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://beta.darkreading.com/_next/static/chunks/466-a973b8e13a6f2860f90f.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7763 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8b30f33afeec62f5aef6d6e927c450c42ed04fa92264342f9a3cf361e3171d16

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:43 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 16 Mar 2022 09:48:06 GMT
server
cloudflare
age
1094442
etag
W/"6231b256-b092"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000
cf-bgj
minify
cf-ray
70d5d3143e5aca47-YUL
expires
Thu, 18 May 2023 16:03:43 GMT
291-55c701e69d5a14f2bfa0.js
beta.darkreading.com/_next/static/chunks/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://beta.darkreading.com/_next/static/chunks/291-55c701e69d5a14f2bfa0.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7763 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8ced09284a1c4ae88949d807100d854ae5afebca35c07dc3d792c937ddbdc472

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:43 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 23 Feb 2022 09:53:36 GMT
server
cloudflare
age
7103072
etag
W/"62160420-1ee4"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000
cf-bgj
minify
cf-ray
70d5d3145e6eca47-YUL
expires
Thu, 18 May 2023 16:03:43 GMT
36-4030719854f3a1daeb7a.js
beta.darkreading.com/_next/static/chunks/ 		86 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://beta.darkreading.com/_next/static/chunks/36-4030719854f3a1daeb7a.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7763 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8c99565562824219eadf0a860cd9da35ac1d48410d3e65d467968c5af4fb4f62

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:43 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 16 Dec 2021 10:43:18 GMT
server
cloudflare
age
13237161
etag
W/"61bb1846-15985"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000
cf-bgj
minify
cf-ray
70d5d3145e70ca47-YUL
expires
Thu, 18 May 2023 16:03:43 GMT
163-b67d0f660a885f8ad009.js
beta.darkreading.com/_next/static/chunks/ 		174 KB
50 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://beta.darkreading.com/_next/static/chunks/163-b67d0f660a885f8ad009.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7763 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cfd4f754e134eb42e45e6bf5e41d05516b5ad6465deb4ca63ac77ffa58292b1f

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:43 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 08 Dec 2021 11:14:01 GMT
server
cloudflare
age
13926938
etag
W/"61b09379-2b73a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000
cf-bgj
minify
cf-ray
70d5d3145e71ca47-YUL
expires
Thu, 18 May 2023 16:03:43 GMT
844-74c2dc28aa7c154127ca.js
beta.darkreading.com/_next/static/chunks/ 		19 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://beta.darkreading.com/_next/static/chunks/844-74c2dc28aa7c154127ca.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7763 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
5e14573ba9dd1cb9df5d3676c134f794ff4ff4629365e005b3c1dd79d3457870

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:43 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 27 Apr 2022 08:38:54 GMT
server
cloudflare
age
1184782
etag
W/"6269011e-4aa7"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000
cf-polished
origSize=19111
cf-bgj
minify
cf-ray
70d5d3145e80ca47-YUL
expires
Thu, 18 May 2023 16:03:43 GMT
521-c929240aebd9411602ac.js
beta.darkreading.com/_next/static/chunks/ 		7 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://beta.darkreading.com/_next/static/chunks/521-c929240aebd9411602ac.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7763 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f3e24d795b082a4439815f85eb8492536f32471869b482f1c4e4754c6fb5261b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:43 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 27 Apr 2022 08:38:54 GMT
server
cloudflare
age
1089824
etag
W/"6269011e-1ad2"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000
cf-bgj
minify
cf-ray
70d5d3146eb6ca47-YUL
expires
Thu, 18 May 2023 16:03:43 GMT
302-be658919964d3774c8db.js
beta.darkreading.com/_next/static/chunks/ 		112 KB
27 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://beta.darkreading.com/_next/static/chunks/302-be658919964d3774c8db.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7763 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
74f5dbfff8c31d8876ddeb224b893ab65552f596b25b3577cf6d6f519c9e8ac9

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:43 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 06 Apr 2022 10:53:01 GMT
server
cloudflare
age
3645588
etag
W/"624d710d-1be0b"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000
cf-polished
origSize=114187
cf-bgj
minify
cf-ray
70d5d3147ed0ca47-YUL
expires
Thu, 18 May 2023 16:03:43 GMT
920-8276df14b36f7124344e.js
beta.darkreading.com/_next/static/chunks/ 		131 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://beta.darkreading.com/_next/static/chunks/920-8276df14b36f7124344e.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7763 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f8f56a12e38109ef29bb878c56b13963bdc33d48e7deed8a788a24fe0171d9cb

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:43 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 08 Dec 2021 11:14:01 GMT
server
cloudflare
age
13926938
etag
W/"61b09379-20a77"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000
cf-bgj
minify
cf-ray
70d5d3149f22ca47-YUL
expires
Thu, 18 May 2023 16:03:43 GMT
2-8ae03f4e3e5cb6e3d66a.js
beta.darkreading.com/_next/static/chunks/ 		136 KB
43 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://beta.darkreading.com/_next/static/chunks/2-8ae03f4e3e5cb6e3d66a.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7763 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0a6c3d599df1f9652eaead106ccaf3af4eed8645fe10b0791499f8826c4febd7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:43 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 08 Dec 2021 11:14:01 GMT
server
cloudflare
age
13926618
etag
W/"61b09379-22107"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000
cf-bgj
minify
cf-ray
70d5d314af27ca47-YUL
expires
Thu, 18 May 2023 16:03:43 GMT
311-1d2910d78543a9543ff7.js
beta.darkreading.com/_next/static/chunks/ 		53 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://beta.darkreading.com/_next/static/chunks/311-1d2910d78543a9543ff7.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7763 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b913d3a87d54d8739436653cb77e8002e504ef07684ef5b652f3c8ae782acdfc

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:43 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 20 Apr 2022 10:46:21 GMT
server
cloudflare
age
2437456
etag
W/"625fe47d-d522"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000
cf-bgj
minify
cf-ray
70d5d314af46ca47-YUL
expires
Thu, 18 May 2023 16:03:43 GMT
596-25f9fe51e4bc5e4ddd4f.js
beta.darkreading.com/_next/static/chunks/ 		17 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://beta.darkreading.com/_next/static/chunks/596-25f9fe51e4bc5e4ddd4f.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7763 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
86646baf6689e8941f4bfd0619eefc77c58b85e7f54dd83d84c8d834a410c4a0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:43 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 13 Apr 2022 09:17:34 GMT
server
cloudflare
age
3047854
etag
W/"6256952e-42ee"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000
cf-bgj
minify
cf-ray
70d5d314af48ca47-YUL
expires
Thu, 18 May 2023 16:03:43 GMT
470-23c01b4437a512c2fc06.js
beta.darkreading.com/_next/static/chunks/ 		13 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://beta.darkreading.com/_next/static/chunks/470-23c01b4437a512c2fc06.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7763 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1813980c6380c04ed03acf13c8c9589024fa19202df34f668bb058fab3e251c4

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:43 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 06 Apr 2022 10:53:01 GMT
server
cloudflare
age
3646868
etag
W/"624d710d-3308"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000
cf-bgj
minify
cf-ray
70d5d314af4bca47-YUL
expires
Thu, 18 May 2023 16:03:43 GMT
450-83e8fcad1a32a34ad55b.js
beta.darkreading.com/_next/static/chunks/ 		71 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://beta.darkreading.com/_next/static/chunks/450-83e8fcad1a32a34ad55b.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7763 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9149ddb93502775a9dfce306f1b62f1328a0970f2b2971901544a82065a74605

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:43 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 11 May 2022 08:45:39 GMT
server
cloudflare
age
629378
etag
W/"627b77b3-11ca7"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000
cf-bgj
minify
cf-ray
70d5d314ffd1ca47-YUL
expires
Thu, 18 May 2023 16:03:43 GMT
%5BhybidPage%5D-73bb21ab8d211d6247f5.js
beta.darkreading.com/_next/static/chunks/pages/%5Bcategory%5D/ 		36 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://beta.darkreading.com/_next/static/chunks/pages/%5Bcategory%5D/%5BhybidPage%5D-73bb21ab8d211d6247f5.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7763 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9314a79ef761aa291e0429c9cdb4c8d84509aade781e0b02ca1848648035864e

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:43 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 11 May 2022 08:45:39 GMT
server
cloudflare
age
629378
etag
W/"627b77b3-8f0b"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000
cf-bgj
minify
cf-ray
70d5d314ffecca47-YUL
expires
Thu, 18 May 2023 16:03:43 GMT
_buildManifest.js
beta.darkreading.com/_next/static/6be8464ca465e48eb1e211c023cdc630cfb36cc9/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://beta.darkreading.com/_next/static/6be8464ca465e48eb1e211c023cdc630cfb36cc9/_buildManifest.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7763 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bb67d2393ca0a3bff485a2726f33aa655c599a6c4a252db523205b479490244a

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:43 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 18 May 2022 08:21:50 GMT
server
cloudflare
age
25939
etag
W/"6284ac9e-b66"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000
cf-bgj
minify
cf-ray
70d5d314ffedca47-YUL
expires
Thu, 18 May 2023 16:03:43 GMT
_ssgManifest.js
beta.darkreading.com/_next/static/6be8464ca465e48eb1e211c023cdc630cfb36cc9/ 		151 B
187 B 		Script
General
Check archive.org
Download Go to
Full URL
https://beta.darkreading.com/_next/static/6be8464ca465e48eb1e211c023cdc630cfb36cc9/_ssgManifest.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7763 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e162b39aa98efdc15a0f72ac6331a3d20328b220575ff833b9f20bb373d37ffe

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:43 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 18 May 2022 08:22:16 GMT
server
cloudflare
age
25939
etag
W/"6284acb8-97"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000
cf-bgj
minify
cf-ray
70d5d314fff0ca47-YUL
expires
Thu, 18 May 2023 16:03:43 GMT
iceapple_givaga_shutterstock.jpg
eu-images.contentstack.com/v3/assets/blt66983808af36a8ef/blt9f21dafa60f463e7/627b3479fddaba11fb894eaf/ 		45 KB
46 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu-images.contentstack.com/v3/assets/blt66983808af36a8ef/blt9f21dafa60f463e7/627b3479fddaba11fb894eaf/iceapple_givaga_shutterstock.jpg?quality=80&format=webply&width=690
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.217 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
e1fd91c0fc8b856b405e8455b19c605a827f1121212c1faaec8154fa535e1c49
Security Headers
Name Value
Strict-Transport-Security max-age=31557600

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:43 GMT
via
1.1 varnish, 1.1 varnish
age
648293
x-cache
HIT, HIT
fastly-io-info
ifsz=838489 idim=985x1000 ifmt=jpeg ofsz=46564 odim=690x701 ofmt=webp
filename1
custom
content-disposition
inline; filename=iceapple_givaga_shutterstock.webp
fastly-stats
io=1
content-length
46564
x-request-id
32378
x-served-by
cache-ams12720-AMS, cache-yul12825-YUL
x-runtime
51ms
x-timer
S1652889823.434918,VS0,VE1
x-contentstack-organization
blt5948195ac13977b0
etag
"Ezw9bjIvsm98yOXWfguhdph6DU5rKCj7ZG2Dnwrddxk"
strict-transport-security
max-age=31557600
content-type
image/webp
access-control-allow-origin
*
access-control-expose-headers
content-disposition, content-type, cache-control, status, content-length
cache-control
max-age=31536000
accept-ranges
bytes
x-cache-hits
1, 1
jquery-3.3.1.slim.min.js
code.jquery.com/ 		68 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-3.3.1.slim.min.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac18::1:a:3a , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software
nginx /
Resource Hash
dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:43 GMT
content-encoding
gzip
last-modified
Fri, 20 Aug 2021 17:47:53 GMT
server
nginx
etag
W/"611feac9-1111d"
vary
Accept-Encoding
x-hw
1652889823.dop003.dc2.t,1652889823.cds211.dc2.hn,1652889823.cds203.dc2.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
24038
popper.min.js
cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/ 		20 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/popper.min.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:190e , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
02835066969199e9924f1332f7172a5d7e552f023a20c3d8ba03bb6c51ce5be5
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:43 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
age
17924810
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
6458
timing-allow-origin
*
last-modified
Mon, 04 May 2020 16:15:37 GMT
server
cloudflare
cf-cdnjs-via
cfworker/kv
etag
"5eb03fa9-500f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=15780000
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=f7rcCopnIHMcZQJeNC3JBHRX%2FP0mswsbvg4C8T2edl6yy4onHF2Kz%2BTsaNc2rerpnp43EK8oPovq7eQss45cqmn7Ipfk5Fc7%2FN9%2FaP4EZ%2FCPocl0gAs1g89TQmloNzwsf4hYs1%2BxI3eRzlZH%2FI4wnElK"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=30672000
accept-ranges
bytes
cf-ray
70d5d3148c9c4bd0-YUL
expires
Mon, 08 May 2023 16:03:43 GMT
bootstrap.min.js
stackpath.bootstrapcdn.com/bootstrap/4.1.0/js/ 		49 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stackpath.bootstrapcdn.com/bootstrap/4.1.0/js/bootstrap.min.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0bca10549df770ab6790046799e5a9e920c286453ebbb2afb0d3055339245339
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:43 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
617
age
2180091
cdn-cachedat
2021-03-10 13:26:30
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
timing-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:04:05 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
vary
Accept-Encoding
cache-control
public, max-age=31919000
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
d24e8d125d26a5d4b48e2bf0f41db0a6
cdn-requestcountrycode
US
cf-ray
70d5d314cfbf4bcb-YUL
cdn-cache
HIT
cdn-requestpullsuccess
True
Whitelogo_1.png
eu-images.contentstack.com/v3/assets/blt66983808af36a8ef/blt3edeb23396a4b5dc/60b1ea7a9afdef577986633e/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu-images.contentstack.com/v3/assets/blt66983808af36a8ef/blt3edeb23396a4b5dc/60b1ea7a9afdef577986633e/Whitelogo_1.png
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.217 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
2c947fb257287976cf7cd15cd2a488c1cc4093a5c5ff2a40a56ba9a7c9e07c08
Security Headers
Name Value
Strict-Transport-Security max-age=31557600

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:43 GMT
via
1.1 varnish, 1.1 varnish
age
3760809
x-cache
HIT, HIT
fastly-io-info
ifsz=7774 idim=336x84 ifmt=png ofsz=7760 odim=336x84 ofmt=png
content-disposition
inline; filename=Whitelogo_1.png
fastly-stats
io=1
content-length
7760
x-request-id
42470
x-served-by
cache-ams21082-AMS, cache-yul12825-YUL
x-runtime
48ms
x-timer
S1652889823.467158,VS0,VE1
x-contentstack-organization
blt5948195ac13977b0
etag
"9lnNwdU3SaksRme/Az7CUYHUn98eOJQreS0ZWDc0+sA"
strict-transport-security
max-age=31557600
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
content-disposition, content-type, cache-control, status, content-length
cache-control
max-age=31536000
accept-ranges
bytes
x-cache-hits
1, 1
zephr-browser.umd.js
assets.zephr.com/zephr-browser/1.3.10/ 		39 KB
15 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.zephr.com/zephr-browser/1.3.10/zephr-browser.umd.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.122 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-122.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
d98f3c146304d61e34da5e04cb32b628c58b401b7c01576d6c47f8f1ca6bea02

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Tue, 17 May 2022 16:38:12 GMT
content-encoding
gzip
last-modified
Wed, 10 Nov 2021 11:00:47 GMT
server
AmazonS3
age
84375
etag
W/"55053cbc5cf4062ebe713185efced2ca"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 9d35ce6897d7f02042955443076a54de.cloudfront.net (CloudFront)
x-amz-cf-pop
EWR53-P1
x-amz-cf-id
sWG4JkhiqWIF2sato8FKGkalbNq00Md8UGB4jmjQZZe03R_BfewCqw==
v652eace1692a40cfa3763df669d7439c1639079717194
static.cloudflareinsights.com/beacon.min.js/ 		14 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.cloudflareinsights.com/beacon.min.js/v652eace1692a40cfa3763df669d7439c1639079717194
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:440e::ac40:9c1a , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fd0a1ac929c11b08e819fe4b0a18c5574012c44f09de8987c6be99a0f055a505

Request headers

Referer
https://www.darkreading.com/
Origin
https://www.darkreading.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:43 GMT
content-encoding
gzip
last-modified
Thu, 09 Dec 2021 19:55:17 GMT
server
cloudflare
etag
W/2021.12.0
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/javascript;charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=86400
cross-origin-resource-policy
cross-origin
cf-ray
70d5d314fd494bc5-YUL
gtm.js
www.googletagmanager.com/ 		212 KB
63 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-T52Z3Z3
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80a::2008 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
f6cc197d57066b6621a43c0189bb97f9a9962235acf8cd45daa8b9dd492e4f07
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:43 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
64288
x-xss-protection
0
last-modified
Wed, 18 May 2022 15:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Wed, 18 May 2022 16:03:43 GMT
truncated
/ 		78 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d44c3403ac31b08a81867bcfdb18981cd3a3e8e42356cf64dd68bead051b64b4

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ 		42 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type
image/gif
4UaOrEtFpBISc36j2jDu5w.woff2
fonts.gstatic.com/s/exo/v19/ 		20 KB
20 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/exo/v19/4UaOrEtFpBISc36j2jDu5w.woff2
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80c::2003 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
951d29553c936c5e999247cfe53a9b08bf29b53cbb957e878e1e0ee7bd4dcae0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
Origin
https://www.darkreading.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Thu, 12 May 2022 22:44:36 GMT
x-content-type-options
nosniff
age
494347
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20236
x-xss-protection
0
last-modified
Thu, 21 Apr 2022 17:03:25 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Fri, 12 May 2023 22:44:36 GMT
pdf.efec47dadbf7da17b090bbdb7ada07ba.png
beta.darkreading.com/_next/static/media/ 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://beta.darkreading.com/_next/static/media/pdf.efec47dadbf7da17b090bbdb7ada07ba.png
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/_next/static/css/3a00e39d4605d99565cf.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7763 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0e153b77b7b590360c91df38e894d46fd6061ce57cc0bbbc09f4c408a66bd0c7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://beta.darkreading.com/_next/static/css/3a00e39d4605d99565cf.css
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:43 GMT
cf-cache-status
HIT
age
190
cf-polished
origSize=11781
last-modified
Wed, 18 May 2022 08:21:50 GMT
content-length
8484
cf-bgj
imgq:100,h2pri
server
cloudflare
etag
"6284ac9e-2e05"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=7200
accept-ranges
bytes
cf-ray
70d5d314af4eca47-YUL
expires
Wed, 18 May 2022 18:03:43 GMT
pubads_impl_2022051201.js
securepubads.g.doubleclick.net/gpt/ 		368 KB
125 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022051201.js
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.40.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s79-in-f2.1e100.net
Software
sffe /
Resource Hash
7e34e3650444be4442224a77990a95d0ba66457124adf9e73df76e8134110d1c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 15:23:54 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2389
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
127621
x-xss-protection
0
last-modified
Thu, 12 May 2022 08:35:40 GMT
server
sffe
vary
Accept-Encoding
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
content-type
text/javascript
cache-control
public, immutable, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
expires
Thu, 18 May 2023 15:23:54 GMT
ppub_config
securepubads.g.doubleclick.net/pagead/ 		95 B
109 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pagead/ppub_config?ippd=www.darkreading.com
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.40.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s79-in-f2.1e100.net
Software
cafe /
Resource Hash
31778d7d5cdf674cb88174d58247acb84fc97239ee406994a646c5d3d0b8cb64
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 18 May 2022 16:03:43 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private, max-age=3600, stale-while-revalidate=3600
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
84
x-xss-protection
0
expires
Wed, 18 May 2022 16:03:43 GMT
465.860e9d00e68bf80b4535.js
beta.darkreading.com/_next/static/chunks/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://beta.darkreading.com/_next/static/chunks/465.860e9d00e68bf80b4535.js
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7763 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8028c67a8d75e527561d4fb6fecbba6993ff48645f0b57d5033809e558e59d13

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:43 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Wed, 08 Dec 2021 11:14:01 GMT
server
cloudflare
age
13926617
etag
W/"61b09379-95f"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=31536000
cf-bgj
minify
cf-ray
70d5d316fb24ca47-YUL
expires
Thu, 18 May 2023 16:03:43 GMT
session
www.darkreading.com/api/auth/ 		2 B
206 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://www.darkreading.com/api/auth/session
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7763 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer
https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
tracestate
3288925@nr=0-1-3288925-256687733-6669228790928a29----1652889823871
traceparent
00-4d03d8495842b627dffedeac415a9270-6669228790928a29-01
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
newrelic
eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjMyODg5MjUiLCJhcCI6IjI1NjY4NzczMyIsImlkIjoiNjY2OTIyODc5MDkyOGEyOSIsInRyIjoiNGQwM2Q4NDk1ODQyYjYyN2RmZmVkZWFjNDE1YTkyNzAiLCJ0aSI6MTY1Mjg4OTgyMzg3MX19

Response headers

date
Wed, 18 May 2022 16:03:43 GMT
x-proxy-by
https://www.darkreading.com
cf-cache-status
DYNAMIC
server
cloudflare
etag
"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding, Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
*
cf-ray
70d5d3173bd7ca47-YUL
content-length
2
session
www.darkreading.com/api/auth/ 		2 B
403 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://www.darkreading.com/api/auth/session
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7763 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

Referer
https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
tracestate
3288925@nr=0-1-3288925-256687733-e36be89cd04fe18f----1652889823872
traceparent
00-0aa6749cd2bec3243286ee4af665d710-e36be89cd04fe18f-01
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
newrelic
eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjMyODg5MjUiLCJhcCI6IjI1NjY4NzczMyIsImlkIjoiZTM2YmU4OWNkMDRmZTE4ZiIsInRyIjoiMGFhNjc0OWNkMmJlYzMyNDMyODZlZTRhZjY2NWQ3MTAiLCJ0aSI6MTY1Mjg4OTgyMzg3Mn19

Response headers

date
Wed, 18 May 2022 16:03:43 GMT
x-proxy-by
https://www.darkreading.com
cf-cache-status
DYNAMIC
server
cloudflare
etag
"2-vyGp6PvFo4RvsFtPoIWeCReyIC8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding, Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
*
cf-ray
70d5d3173bdbca47-YUL
content-length
2
Frame_1728.svg
eu-images.contentstack.com/v3/assets/blt66983808af36a8ef/blt456fd002839bae7e/620377d02be9c249dcea7cc9/ 		8 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu-images.contentstack.com/v3/assets/blt66983808af36a8ef/blt456fd002839bae7e/620377d02be9c249dcea7cc9/Frame_1728.svg?quality=80&format=webply&width=222
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.217 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
958136771bc42c0cbea29f08be65260d0b8b63020d9f41039261fbf26a0cc942
Security Headers
Name Value
Strict-Transport-Security max-age=31557600

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:43 GMT
via
1.1 varnish, 1.1 varnish
fastly-io-error
not a supported image format
age
3760808
x-cache
HIT, HIT
filename1
custom
content-disposition
inline; filename=Frame_1728.svg+xml
fastly-stats
io=1
content-encoding
gzip
content-length
3197
x-request-id
55279
x-served-by
cache-ams21056-AMS, cache-yul12825-YUL
x-runtime
77ms
x-timer
S1652889824.880179,VS0,VE0
x-contentstack-organization
blt5948195ac13977b0
vary
Accept-Encoding
strict-transport-security
max-age=31557600
content-type
image/svg+xml
access-control-allow-origin
*
access-control-expose-headers
content-disposition, content-type, cache-control, status, content-length
cache-control
max-age=31536000
accept-ranges
bytes
x-cache-hits
1, 82
Article.svg
eu-images.contentstack.com/v3/assets/blt66983808af36a8ef/blt27dca7fd9a7ec07d/60da98a6537dbc26a0e2a2d3/ 		3 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu-images.contentstack.com/v3/assets/blt66983808af36a8ef/blt27dca7fd9a7ec07d/60da98a6537dbc26a0e2a2d3/Article.svg
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.217 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
de06fea245b0036d21764fcf2b9a4791c0a0f1e927e3916c7d779cb44a1977bd
Security Headers
Name Value
Strict-Transport-Security max-age=31557600

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:43 GMT
via
1.1 varnish, 1.1 varnish
fastly-io-error
not a supported image format
age
3167586
x-cache
HIT, HIT
content-disposition
inline; filename=Article.svg
fastly-stats
io=1
content-encoding
gzip
content-length
1177
x-request-id
85735
x-served-by
cache-ams12729-AMS, cache-yul12825-YUL
x-runtime
81ms
x-timer
S1652889824.881005,VS0,VE1
x-contentstack-organization
blt5948195ac13977b0
vary
Accept-Encoding
strict-transport-security
max-age=31557600
content-type
image/svg+xml
access-control-allow-origin
*
access-control-expose-headers
content-disposition, content-type, cache-control, status, content-length
cache-control
max-age=31536000
accept-ranges
bytes
x-cache-hits
1, 1
Jai-Vijayan.jpeg
eu-images.contentstack.com/v3/assets/blt66983808af36a8ef/blt02d79fb9a44a4258/60b1e9dd2a25046b35110696/ 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu-images.contentstack.com/v3/assets/blt66983808af36a8ef/blt02d79fb9a44a4258/60b1e9dd2a25046b35110696/Jai-Vijayan.jpeg?quality=80&format=webply&width=100
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.217 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
162fdc59fe32d506fa254e5f6e6ace62991757ccb10910d0e3a4be7f8724e8b3
Security Headers
Name Value
Strict-Transport-Security max-age=31557600

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:43 GMT
via
1.1 varnish, 1.1 varnish
age
744430
x-cache
HIT, HIT
fastly-io-info
ifsz=7323 idim=125x125 ifmt=jpeg ofsz=1268 odim=100x100 ofmt=webp
filename1
custom
content-disposition
inline; filename=Jai-Vijayan.webp
fastly-stats
io=1
content-length
1268
x-request-id
45124
x-served-by
cache-ams12734-AMS, cache-yul12825-YUL
x-runtime
79ms
x-timer
S1652889824.881416,VS0,VE1
x-contentstack-organization
blt5948195ac13977b0
etag
"oFlzF3Prt483N1tOmb+H4/rb2X5P9q2Uifi+PcUEIOY"
strict-transport-security
max-age=31557600
content-type
image/webp
access-control-allow-origin
*
access-control-expose-headers
content-disposition, content-type, cache-control, status, content-length
cache-control
max-age=31536000
accept-ranges
bytes
x-cache-hits
1, 1
honey-bees_imageBROKER-Alamy.jpg
eu-images.contentstack.com/v3/assets/blt66983808af36a8ef/bltd9d0af37ce6638e1/6273e0574fcc2d07c2a581cc/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu-images.contentstack.com/v3/assets/blt66983808af36a8ef/bltd9d0af37ce6638e1/6273e0574fcc2d07c2a581cc/honey-bees_imageBROKER-Alamy.jpg?quality=80&format=webply&width=100
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.217 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
6a60be897002297376fc1adbb92b0bbaa8c82bdcb72c80fa7773d901c454f2c1
Security Headers
Name Value
Strict-Transport-Security max-age=31557600

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:43 GMT
via
1.1 varnish, 1.1 varnish
age
746300
x-cache
HIT, HIT
fastly-io-info
ifsz=128795 idim=1000x630 ifmt=jpeg ofsz=2900 odim=100x63 ofmt=webp
filename1
custom
content-disposition
inline; filename=honey-bees_imageBROKER-Alamy.webp
fastly-stats
io=1
content-length
2900
x-request-id
80180
x-served-by
cache-ams12739-AMS, cache-yul12825-YUL
x-runtime
115ms
x-timer
S1652889824.881474,VS0,VE0
x-contentstack-organization
blt5948195ac13977b0
etag
"XUT9qr2ZIcGAgVCc/G5mftGA3OB2wZ9miGnGzY8Xzow"
strict-transport-security
max-age=31557600
content-type
image/webp
access-control-allow-origin
*
access-control-expose-headers
content-disposition, content-type, cache-control, status, content-length
cache-control
max-age=31536000
accept-ranges
bytes
x-cache-hits
1, 59
Star-Wars_Lifestyle_pictures_Alamy.jpg
eu-images.contentstack.com/v3/assets/blt66983808af36a8ef/blt57836a2df908fd84/626c436848b2ca15af309211/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu-images.contentstack.com/v3/assets/blt66983808af36a8ef/blt57836a2df908fd84/626c436848b2ca15af309211/Star-Wars_Lifestyle_pictures_Alamy.jpg?quality=80&format=webply&width=100
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.217 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
d4ae683989f3ae7492b836492d857c64851fbd5ddf6cf7a2ec21de8c7be5dd18
Security Headers
Name Value
Strict-Transport-Security max-age=31557600

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:43 GMT
via
1.1 varnish, 1.1 varnish
age
819647
x-cache
HIT, HIT
fastly-io-info
ifsz=231912 idim=1200x810 ifmt=jpeg ofsz=1590 odim=100x68 ofmt=webp
filename1
custom
content-disposition
inline; filename=Star-Wars_Lifestyle_pictures_Alamy.webp
fastly-stats
io=1
content-length
1590
x-request-id
54317
x-served-by
cache-ams21076-AMS, cache-yul12825-YUL
x-runtime
110ms
x-timer
S1652889824.881535,VS0,VE1
x-contentstack-organization
blt5948195ac13977b0
etag
"aDEKQnrIfhtxy835xJKkfoWr2Y98HkMEvBxCHv+c8+A"
strict-transport-security
max-age=31557600
content-type
image/webp
access-control-allow-origin
*
access-control-expose-headers
content-disposition, content-type, cache-control, status, content-length
cache-control
max-age=31536000
accept-ranges
bytes
x-cache-hits
1, 1
CuckooBee-VivienKent-Alamy.jpg
eu-images.contentstack.com/v3/assets/blt66983808af36a8ef/blt005142148f5f384a/6272d33bfddaba11fb8949f6/ 		2 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu-images.contentstack.com/v3/assets/blt66983808af36a8ef/blt005142148f5f384a/6272d33bfddaba11fb8949f6/CuckooBee-VivienKent-Alamy.jpg?quality=80&format=webply&width=100
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.217 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
cd38a127711e65035815f163a9bf784450f30943fa2743f4df3107e92bd0fcbd
Security Headers
Name Value
Strict-Transport-Security max-age=31557600

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:43 GMT
via
1.1 varnish, 1.1 varnish
age
742360
x-cache
HIT, HIT
fastly-io-info
ifsz=2166816 idim=5184x3456 ifmt=jpeg ofsz=2366 odim=100x67 ofmt=webp
filename1
custom
content-disposition
inline; filename=CuckooBee-VivienKent-Alamy.webp
fastly-stats
io=1
content-length
2366
x-request-id
50764
x-served-by
cache-ams21073-AMS, cache-yul12825-YUL
x-runtime
61ms
x-timer
S1652889824.882214,VS0,VE0
x-contentstack-organization
blt5948195ac13977b0
etag
"ACgzZmbzqhvPreIK8t1Ld4aaLk4mqAe+mayH7kuvDTs"
strict-transport-security
max-age=31557600
content-type
image/webp
access-control-allow-origin
*
access-control-expose-headers
content-disposition, content-type, cache-control, status, content-length
cache-control
max-age=31536000
accept-ranges
bytes
x-cache-hits
2, 513
Slide_1Cover_Art.jpeg
eu-images.contentstack.com/v3/assets/blt66983808af36a8ef/bltc60ad063f076ae8e/62704b041b8c3465b79a47a4/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu-images.contentstack.com/v3/assets/blt66983808af36a8ef/bltc60ad063f076ae8e/62704b041b8c3465b79a47a4/Slide_1Cover_Art.jpeg?quality=80&format=webply&width=100
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.217 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
fd9d43ea0d4fe7ee37b7b1c8d13859413652b414def6a0bca25d342f84c206d6
Security Headers
Name Value
Strict-Transport-Security max-age=31557600

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:43 GMT
via
1.1 varnish, 1.1 varnish
age
819647
x-cache
HIT, HIT
fastly-io-info
ifsz=120722 idim=640x427 ifmt=jpeg ofsz=1990 odim=100x67 ofmt=webp
filename1
custom
content-disposition
inline; filename=Slide_1Cover_Art.webp
fastly-stats
io=1
content-length
1990
x-request-id
31037
x-served-by
cache-ams21020-AMS, cache-yul12825-YUL
x-runtime
123ms
x-timer
S1652889824.882208,VS0,VE0
x-contentstack-organization
blt5948195ac13977b0
etag
"F3jdGxeLhV/YUeWebzGauje3uMCIObvB49uCLZuqQV0"
strict-transport-security
max-age=31557600
content-type
image/webp
access-control-allow-origin
*
access-control-expose-headers
content-disposition, content-type, cache-control, status, content-length
cache-control
max-age=31536000
accept-ranges
bytes
x-cache-hits
1, 492
cookie-close.svg
beta.darkreading.com/icons/ 		667 B
562 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://beta.darkreading.com/icons/cookie-close.svg
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7763 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e5a1598944cdacee0760775794bff19417c31947033f3b013af8b6ceac45875c

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:44 GMT
content-encoding
br
cf-cache-status
MISS
last-modified
Wed, 18 May 2022 08:19:56 GMT
server
cloudflare
etag
W/"29b-180d6408be0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
public, max-age=7200
cf-ray
70d5d3174be3ca47-YUL
expires
Wed, 18 May 2022 18:03:44 GMT
features
informa-dark-reading.preview.zephr.com/zephr/ 		3 B
847 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://informa-dark-reading.preview.zephr.com/zephr/features
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.146.92 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-146-92.ewr52.r.cloudfront.net
Software
/
Resource Hash
5984eac0c5c6d947241e29dd5671b81a1546cedf77e08d38438ac47029969afa

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:44 GMT
via
1.1 fd4983be77ace22659323918c5b30f1e.cloudfront.net (CloudFront)
x-amz-cf-pop
EWR52-C2
x-cache
Miss from cloudfront
content-type
application/json; charset=UTF-8
access-control-allow-origin
https://www.darkreading.com
cache-control
public, max-age=300
access-control-allow-credentials
true
access-control-allow-headers
Accept,Origin,Keep-Alive,Content-Type,User-Agent,Referer,Accept-Language,Cookie,Authorization,Cache-Control,Expires,Access-Control-Request-Method,Access-Control-Request-Headers,Accept-Encoding
content-length
3
x-amz-cf-id
fch_rNZq8q6yimSyt3HqHCK-xnuVA3yC33_jh5sPvKTypRlcYlbbiw==
x-blaize-request
3fbc6125
image
www.darkreading.com/_next/ 		654 B
876 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.darkreading.com/_next/image?url=%2F_next%2Fstatic%2Fimage%2Fpublic%2Fimages%2Firibbon-logo.61822a6f728dd50c5ab494ce9936bac3.png&w=96&q=75
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7763 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ab36b8356d4b7e3e3591b161427e6fb18512a2ccc8a787f8cc03294cf2f30478
Security Headers
Name Value
Content-Security-Policy script-src 'none'; sandbox;

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:44 GMT
x-proxy-by
https://www.darkreading.com
cf-cache-status
DYNAMIC
server
cloudflare
etag
qza4NW1Lfj41kbFhQn5vsYUSoszIp4f4zAMpTPLzBHg=
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept, Origin, Accept-Encoding
content-type
image/webp
access-control-allow-origin
*
content-disposition
inline; filename="iribbon-logo.webp"
cache-control
public, max-age=315360000, immutable
content-security-policy
script-src 'none'; sandbox;
cf-ray
70d5d317cc75ca47-YUL
optimize.js
www.googleoptimize.com/ 		94 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googleoptimize.com/optimize.js?id=OPT-W6LRXN3
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:81d::200e Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
26d9536ee3db6eb4f8fd86f5537707c5d86a824c9d0aac6fca71f3711c641351
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:44 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
37402
x-xss-protection
0
last-modified
Wed, 18 May 2022 15:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Wed, 18 May 2022 16:03:44 GMT
/
6600d6d98e534115970f9529a45f3195.js.ubembed.com/ 		482 B
644 B 		Script
General
Check archive.org
Download Go to
Full URL
https://6600d6d98e534115970f9529a45f3195.js.ubembed.com/
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.129.131 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
c540a8aa336e92c3a20d1872e66a2ce2d2c2629a66c939a33a663aa2c0b8c832

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:44 GMT
content-encoding
br
x-backend-region
us_east_1
age
3385
etag
W/aaab40e12ca91eabbcb0f8f10bd5715a-v0.179.2
vary
Accept-Encoding, Referer
x-cache
Miss from cloudfront, HIT
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=0, must-revalidate
x-amz-cf-pop
YUL62-C1
accept-ranges
none
x-amz-apigw-id
SU7CKE8dIAMFiZw=
elqCfg.min.js
img.en25.com/i/ 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://img.en25.com/i/elqCfg.min.js
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
23.217.37.202 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-217-37-202.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
3346de8e2ae1bfde250c7ac5c06f79a0a60c7faef8e5e08a2c9e8fbf5ec2c9e8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
X-Content-Type-Options
nosniff
P3P
CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Connection
keep-alive
Content-Length
2183
X-XSS-Protection
1; mode=block
Pragma
no-cache
Last-Modified
Fri, 14 Jan 2022 15:05:19 GMT
Date
Wed, 18 May 2022 16:03:44 GMT
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
no-store
ETag
"3cc21925589d81:0"
Accept-Ranges
bytes
X-Robots-Tag
noindex, nofollow
Expires
Wed, 18 May 2022 16:03:44 GMT
dpm_8effee409c625e1a2d8f5033631840e6ce1dcb64.min.js
s.dpmsrv.com/ 		824 KB
89 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.dpmsrv.com/dpm_8effee409c625e1a2d8f5033631840e6ce1dcb64.min.js
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.56 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-56.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
d69c8c5f885b4025138d313cbe08b8f164469f35e5465749a2699074600ea7ca

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Wed, 18 May 2022 08:39:04 GMT
Content-Encoding
gzip
Last-Modified
Tue, 12 Apr 2022 19:50:13 GMT
Server
AmazonS3
Age
26681
ETag
"55d7ae85f66d9c2107fb93eafcd4a55d"
X-Cache
Hit from cloudfront
Content-Type
application/x-javascript
Via
1.1 9d35ce6897d7f02042955443076a54de.cloudfront.net (CloudFront)
Connection
keep-alive
X-Amz-Cf-Pop
EWR53-P1
Accept-Ranges
bytes
Content-Length
90835
X-Amz-Cf-Id
h3MxItUIFurPXAzZzlVfnadeWLwlpA03GUckBktRKyPfWkMkQY5LJA==
iframe_api
www.youtube.com/ 		980 B
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/iframe_api
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:808::200e Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
3862fb70baa9ad01816c503f9d38a76f3ceb4b4e0f1f027f6e9c117909987118
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:44 GMT
content-encoding
br
x-content-type-options
nosniff
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657?hl=en for more info."
critical-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
server
ESF
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
report-to
{"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
content-type
text/javascript; charset=utf-8
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
vary
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control
private, max-age=0
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only
same-origin; report-to="youtube_main"
expires
Wed, 18 May 2022 16:03:44 GMT
hotjar-2610568.js
static.hotjar.com/c/ 		9 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.hotjar.com/c/hotjar-2610568.js?sv=6
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.102 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-102.ewr53.r.cloudfront.net
Software
/
Resource Hash
f61d5c95c64f5584a106978ece0263f6c0a74432dccc57025e7512ff335c694b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:02:46 GMT
content-encoding
br
x-content-type-options
nosniff
cache-control
max-age=60
age
58
etag
W/1342eb9346d9bb9a5a6e85feab9e53a6
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
x-cache-hit
1
cross-origin-resource-policy
cross-origin
x-amz-cf-pop
EWR53-P1
x-amz-cf-id
FIHA7CJi4GmWVp4R71-_mGCUVVxTM7NHDUvYjhYvaNvchHJLm9ythg==
via
1.1 b8d8693cc4ac05b6a9cebe2651a2c8b8.cloudfront.net (CloudFront)
analytics.js
www.google-analytics.com/ 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80e::200e Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 13 Apr 2022 21:02:38 GMT
server
Golfe2
age
4790
date
Wed, 18 May 2022 14:43:54 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20006
expires
Wed, 18 May 2022 16:43:54 GMT
chartbeat.js
static.chartbeat.com/js/ 		35 KB
14 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.chartbeat.com/js/chartbeat.js
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:202c:bc00:18:1fcd:351:7bc1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
04d64f65072f624d3a1c5c29b27f02e1d8c09aad3d1f7b1a2b86f200cdc883aa

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 14:08:52 GMT
content-encoding
gzip
last-modified
Wed, 20 Apr 2022 00:08:30 GMT
server
nginx
age
6892
etag
W/"625f4efe-8bf5"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/x-javascript
via
1.1 7f0fedc5c1b6155cbeb8fd32bdcdb07a.cloudfront.net (CloudFront)
cache-control
max-age=7200
cross-origin-resource-policy
cross-origin
x-amz-cf-pop
EWR52-C2
x-amz-cf-id
IUFU9AZkQTl6kzNFHmRCnYXaggJjvD3GSGhi7PSNHpJjCOKKYycimg==
expires
Wed, 18 May 2022 16:08:52 GMT
iris-t.js
static.iris.informa.com/widgets/v3.0/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.iris.informa.com/widgets/v3.0/iris-t.js
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.61 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-61.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
46d3462282e19bb7a4f1a0b20005700ef582f8ba6d7d0ea10393ae29d840c1cd

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Wed, 18 May 2022 10:49:11 GMT
content-encoding
br
last-modified
Wed, 20 Apr 2022 10:12:08 GMT
server
AmazonS3
age
18874
etag
W/"69304c86e9345c5bea495fc238ccd678"
vary
Accept-Encoding
x-cache
Hit from cloudfront
x-amz-version-id
l7wBMju3tHKRyvFNyEb46H8dm7i.VwoY
via
1.1 11140291d542e546b40770525cf1e1b4.cloudfront.net (CloudFront)
x-amz-cf-pop
EWR53-P1
content-type
application/javascript
x-amz-cf-id
S0IXxPTKEfV7rVsbezKyhBeCG08rY3FW1oKlk0vYg3utDNvtFZnHig==
bundle.js
assets.ubembed.com/universalscript/releases/v0.179.2/ 		174 KB
48 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.ubembed.com/universalscript/releases/v0.179.2/bundle.js
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.126.105 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-126-105.ewr52.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
b318b179b35ca92c87626801798f3bce3864172926ae10288f0460a53f30177c

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Tue, 05 Apr 2022 17:08:16 GMT
content-encoding
gzip
last-modified
Tue, 05 Apr 2022 16:31:05 GMT
server
AmazonS3
age
3711329
etag
W/"359008fe01078c59c66e034866170bd2"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 3cd1317514b30fdf5f6be98709ec1b0e.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
EWR52-C3
x-amz-cf-id
1wnDpzmjxtQvIfrAuNfWu5Mi3R9Gb-LOnlgtCNpquY-C3wKxg_Yhig==
modules.461979a9e1f93282b2c3.js
script.hotjar.com/ 		243 KB
63 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://script.hotjar.com/modules.461979a9e1f93282b2c3.js
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.15 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-15.ewr53.r.cloudfront.net
Software
/
Resource Hash
d0ca6f1ae5bad99980d99a56ee95d900bb59b540dad35fda08ba76eb4bb22af7
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 13:08:07 GMT
content-encoding
br
x-content-type-options
nosniff
age
10537
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
content-length
63673
access-control-allow-origin
*
last-modified
Wed, 18 May 2022 13:07:59 GMT
etag
"ecb1c94d8ccd9210f383bf93760cbe42"
vary
Accept-Encoding
content-type
application/javascript
via
1.1 0812978283e8debc2d404f4a7b32d866.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
EWR53-P1
accept-ranges
bytes
x-robots-tag
none
x-amz-cf-id
XJ9x7Xkpr0WZI8jR2gXZJW3yU8_bKoIWPiUadi-WicdBHXleXKLvag==
svrGP
trk.darkreading.com/visitor/v200/
Redirect Chain
  • https://trk.darkreading.com/visitor/v200/svrGP?pps=3&siteid=2150&ref=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-s...
  • https://trk.darkreading.com/visitor/v200/svrGP?pps=3&siteid=2150&ref=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-s...
49 B
504 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trk.darkreading.com/visitor/v200/svrGP?pps=3&siteid=2150&ref=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&ref2=elqNone&tzo=0&ms=82&optin=disabled&elq1pcGUID=55E48DD607DB4839939B67ADFE2CDD01
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
HTTP/1.1
Server
142.0.173.15 , United States, ASN7160 (NETDYNAMICS, US),
Reverse DNS
Software
/
Resource Hash
f1ccea6b7204d9f7913ab45e1afa51d79f83bd4f0319de937b0132e6e02b1aab
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 18 May 2022 16:03:44 GMT
X-Content-Type-Options
nosniff
Content-Type
image/gif
P3P
CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Cache-Control
no-store
X-Robots-Tag
noindex, nofollow
Content-Length
49
X-Xss-Protection
1; mode=block
Expires
-1

Redirect headers

Pragma
no-cache
Date
Wed, 18 May 2022 16:03:44 GMT
X-Content-Type-Options
nosniff
Content-Type
text/html; charset=utf-8
P3P
CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Location
https://trk.darkreading.com/visitor/v200/svrGP?pps=3&siteid=2150&ref=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&ref2=elqNone&tzo=0&ms=82&optin=disabled&elq1pcGUID=55E48DD607DB4839939B67ADFE2CDD01
Cache-Control
no-store
X-Robots-Tag
noindex, nofollow
Content-Length
432
X-Xss-Protection
1; mode=block
Expires
-1
f23io39d.js
static.iris.informa.com/ 		70 KB
23 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://static.iris.informa.com/f23io39d.js
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.61 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-61.ewr53.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
4f381ccb6f965e2011700b253aa446e84060a338cc416055eabca3b62fa35435

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

x-amz-version-id
r.70SgccGRmRk8cXfo6q55SZB1TmHyVy
content-encoding
gzip
etag
W/"a790df23a63287b42b6e7324cb81afd9"
last-modified
Thu, 02 Sep 2021 16:02:23 GMT
server
AmazonS3
age
54655
x-amz-server-side-encryption
AES256
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 11140291d542e546b40770525cf1e1b4.cloudfront.net (CloudFront)
date
Wed, 18 May 2022 06:56:01 GMT
x-amz-cf-pop
EWR53-P1
x-amz-cf-id
hBu_42AKYYWcU2xYWptFUfy5LjeqNNHn7Qli9ZQdSbhTIpMZkCwspw==
td.min.js
cdn.treasuredata.com/sdk/3.0/ 		58 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.treasuredata.com/sdk/3.0/td.min.js
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
143.204.146.76 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-146-76.ewr52.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
262f87d47643975a4633b675fc224c7a178d99e579e5d767f4a43ca7cc0bb9de

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Mon, 16 May 2022 11:42:13 GMT
Content-Encoding
gzip
Age
188492
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Cross-Origin-Resource-Policy
cross-origin
Connection
keep-alive
Last-Modified
Mon, 05 Jul 2021 08:58:13 GMT
Server
AmazonS3
Etag
W/"4b9abb36767431f05495228eb82edf01"
Vary
Accept-Encoding
Content-Type
application/javascript
Via
1.1 b7ddb18a56b4bad68ca78b085e9ca450.cloudfront.net (CloudFront)
Cache-Control
public, max-age=315360000
X-Amz-Cf-Pop
EWR52-C2
X-Amz-Cf-Id
QIcepk5R_S3WeTuXlzpPyUShfY8_tbkSLsFnLywOCm-WFD_bpoHvnQ==
collect
www.google-analytics.com/j/ 		2 B
22 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j96&a=737115392&t=pageview&_s=1&dl=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&dp=%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&ul=en-us&de=UTF-8&dt=Cyber-Espionage%20Attack%20Drops%20Post-Exploit%20Malware%20Framework%20on%20Microsoft%20Exchange%20Servers&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGBACEABRAAAAC~&jid=1904452185&gjid=752419053&cid=1366153732.1652889824&tid=UA-135180592-2&_gid=2062177657.1652889824&_r=1&gtm=2wg5g0T52Z3Z3&cg1=article&cg2=News&cg3=Attacks%2FBreaches&cd1=article&cd2=jai%20vijayan&cd3=&cd4=News&cd5=May%2011%2C%202022&cd6=attacks-breaches&cd9=application-security%2Cthreat-intelligence&cd10=0&cd16=blt0534aed8e124c811&cd17=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&cd18=3834%2Fdarkreading.home%2Farticle%2Fattacks-breaches&cd20=vanguard%20-%20112&z=995732982
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80e::200e Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.darkreading.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:44 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.darkreading.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
index.php
a.dpmsrv.com/dpmpxl/
Redirect Chain
  • https://ib.adnxs.com/getuid?https://a.dpmsrv.com/dpmpxl/index.php?id=$UID&q%3DxImp%26v%3D1.x%26cl%3D55%26pixelIndex%3D0%26r%3D461716%26tzOffset%3D0%26url%3Dhttps%253A%252F%252Fwww.darkreading.com%2...
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fa.dpmsrv.com%2Fdpmpxl%2Findex.php%3Fid%3D%24UID%26q%253DxImp%2526v%253D1.x%2526cl%253D55%2526pixelIndex%253D0%2526r%253D461716%2526tzOffset%253...
  • https://a.dpmsrv.com/dpmpxl/index.php?id=4008352111651074917&q=xImp&v=1.x&cl=55&pixelIndex=0&r=461716&tzOffset=0&url=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-so...
249 B
998 B 		Script
General
Check archive.org
Download Go to
Full URL
https://a.dpmsrv.com/dpmpxl/index.php?id=4008352111651074917&q=xImp&v=1.x&cl=55&pixelIndex=0&r=461716&tzOffset=0&url=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&_=1652889824159
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
HTTP/1.1
Server
3.87.151.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-87-151-192.compute-1.amazonaws.com
Software
/
Resource Hash
be8ae18f23a0f6080b6f5a20913e538729bc7bc11ba80a08153f21adb3e4589a

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Pragma
no-cache
content-encoding
gzip
Access-Control-Max-Age
10
Access-Control-Allow-Methods
GET, POST, PUT, DELETE, OPTIONS
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Type
text/javascript
Access-Control-Allow-Headers
content-type, accept
Content-Length
219
Expires
0

Redirect headers

Pragma
no-cache
Date
Wed, 18 May 2022 16:03:44 GMT
X-Proxy-Origin
149.56.153.183; 149.56.153.183; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid
6a04f667-9c94-4f54-b1c8-46422435bc7d
Server
nginx/1.21.3
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://a.dpmsrv.com/dpmpxl/index.php?id=4008352111651074917&q=xImp&v=1.x&cl=55&pixelIndex=0&r=461716&tzOffset=0&url=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&_=1652889824159
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
www-widgetapi.js
www.youtube.com/s/player/9c7ce883/www-widgetapi.vflset/ 		155 KB
50 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/9c7ce883/www-widgetapi.vflset/www-widgetapi.js
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:808::200e Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
466d1544e0e59534eda589619707ad31a52aaea08b72d0ca4b6f259058f3a491
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Tue, 17 May 2022 16:01:49 GMT
content-encoding
br
x-content-type-options
nosniff
age
86515
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
51672
x-xss-protection
0
last-modified
Mon, 16 May 2022 20:25:09 GMT
server
sffe
vary
Accept-Encoding, Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Wed, 17 May 2023 16:01:49 GMT
box-960463a57b3f52829a72c264e060823d.html
vars.hotjar.com/ Frame AD3C 		2 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://vars.hotjar.com/box-960463a57b3f52829a72c264e060823d.html
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
143.204.146.69 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-143-204-146-69.ewr52.r.cloudfront.net
Software
/
Resource Hash
46d2fa2c3db4ca065880a66c04ef9a9fa8719ddefe8ada3f7e05719a1767ca19

Request headers

Referer
https://www.darkreading.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
2269298
cache-control
max-age=31536000
content-encoding
br
content-length
1044
content-type
text/html
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Fri, 22 Apr 2022 09:42:06 GMT
etag
"8797eddcaf006e2edcb6ddd49955bd89"
last-modified
Fri, 22 Apr 2022 09:41:41 GMT
vary
Accept-Encoding
via
1.1 4c4a56815dfe3e256aedb11d486092f0.cloudfront.net (CloudFront)
x-amz-cf-id
3jSrCJT3xl-Ip4PHEjgWNRW6FuG5NqzzLXBOzziL2doh6KQaWdc50Q==
x-amz-cf-pop
EWR52-C2
x-cache
Hit from cloudfront
x-robots-tag
none
ping
ping.chartbeat.net/ 		43 B
201 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ping.chartbeat.net/ping?h=darkreading.com&p=%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&u=DPR0VAEPW4ODNt5U4&d=darkreading.com&g=53678&g0=attacks-breaches&g1=jai%20vijayan&g4=article&n=1&f=00001&c=0&x=0&m=0&y=4057&o=1600&w=1200&j=45&R=1&W=0&I=0&E=0&e=0&r=&b=1200&t=DEa3IKCnTuqEac9jcDpyg7kD7Qmgz&V=132&i=Cyber-Espionage%20Attack%20Drops%20Post-Exploit%20Malware%20Framework%20on%20Microsoft%20Exchange%20Servers&tz=0&sn=1&sv=B9A4BUBKN1pjDqaGBgDfm2NvDvddAC&sd=1&im=067b2fff&_
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.226.181.34 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-226-181-34.compute-1.amazonaws.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:44 GMT
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
content-length
43
expires
0
ed0
c.darkreading.com/com.iiris/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://c.darkreading.com/com.iiris/ed0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7963 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.darkreading.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type, SP-Anonymous
access-control-allow-origin
https://www.darkreading.com
access-control-max-age
5
cf-cache-status
DYNAMIC
cf-ray
70d5d319be534bb9-YUL
content-length
0
date
Wed, 18 May 2022 16:03:44 GMT
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
server
cloudflare
ed0
c.darkreading.com/com.iiris/ 		2 B
320 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://c.darkreading.com/com.iiris/ed0
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7763 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df

Request headers

Referer
https://www.darkreading.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
Content-Type
application/json; charset=UTF-8

Response headers

date
Wed, 18 May 2022 16:03:45 GMT
cf-cache-status
DYNAMIC
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
cf-ray
70d5d31c2c29ca47-YUL
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA"
access-control-allow-origin
https://www.darkreading.com
access-control-allow-credentials
true
content-type
text/plain; charset=UTF-8
content-length
2
collect
stats.g.doubleclick.net/j/ 		4 B
445 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-135180592-2&cid=1366153732.1652889824&jid=1904452185&gjid=752419053&_gid=2062177657.1652889824&_u=aGBACEAARAAAAC~&z=352061331
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c06::9b Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.darkreading.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Wed, 18 May 2022 16:03:44 GMT
content-type
text/plain
access-control-allow-origin
https://www.darkreading.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
js_pageviews_itcyber_darkreading
eu01.in.treasuredata.com/js/v3/event/webtracking_itcyber/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://eu01.in.treasuredata.com/js/v3/event/webtracking_itcyber/js_pageviews_itcyber_darkreading?modified=1652889824272
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.29.180.64 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-29-180-64.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type,x-td-fetch-api,x-td-write-key
Access-Control-Request-Method
POST
Origin
https://www.darkreading.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Authorization, X-Requested-With, X-TD-Write-Key, X-TD-Fetch-Api, Content-Type
access-control-allow-methods
GET, POST
access-control-allow-origin
https://www.darkreading.com
access-control-max-age
7200
date
Wed, 18 May 2022 16:03:44 GMT
strict-transport-security
max-age=31536000
js_pageviews_itcyber_darkreading
eu01.in.treasuredata.com/js/v3/event/webtracking_itcyber/ 		16 B
478 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://eu01.in.treasuredata.com/js/v3/event/webtracking_itcyber/js_pageviews_itcyber_darkreading?modified=1652889824272
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.29.180.64 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-29-180-64.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
56587cffbb30e338497c9114f74803a530a713ebe374b69fcfa8551ad8dad1e9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

X-TD-Write-Key
100/bb9cbe21de3db7a5428506d7528e45b2c801a48c
Referer
https://www.darkreading.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
X-TD-Fetch-Api
true
Content-Type
application/json

Response headers

date
Wed, 18 May 2022 16:03:44 GMT
strict-transport-security
max-age=31536000
access-control-allow-methods
GET, POST
p3p
CP="This is not a P3P policy! See https://docs.treasuredata.com/articles/p3p"
access-control-allow-origin
https://www.darkreading.com
access-control-allow-credentials
true
content-type
application/json
access-control-allow-headers
Authorization, X-Requested-With, X-TD-Write-Key, X-TD-Fetch-Api, Content-Type
content-length
16
ga-audiences
www.google.com/ads/ 		42 B
501 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-135180592-2&cid=1366153732.1652889824&jid=1904452185&_u=aGBACEAARAAAAC~&z=1219082465
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:806::2004 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:44 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.ca/ads/ 		42 B
501 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.ca/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-135180592-2&cid=1366153732.1652889824&jid=1904452185&_u=aGBACEAARAAAAC~&z=1219082465
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:809::2003 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:44 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
visit-data
in.hotjar.com/api/v2/client/sites/2610568/ 		147 B
322 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://in.hotjar.com/api/v2/client/sites/2610568/visit-data?sv=6
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.49.46.73 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-49-46-73.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
3e8e76a70b5ec0a97f60491364274ab39aebd8f949b6a310a174633b015d4738

Request headers

Referer
https://www.darkreading.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
Content-Type
text/plain; charset=UTF-8

Response headers

date
Wed, 18 May 2022 16:03:44 GMT
content-encoding
br
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
*
access-control-max-age
86400
cache-control
no-cache, no-store
access-control-allow-credentials
true
2610568
vc.hotjar.io/sessions/ 		0
257 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://vc.hotjar.io/sessions/2610568?s=0.25&r=0.12912759921238193
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.37.122 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-37-122.ewr52.r.cloudfront.net
Software
Python/3.7 aiohttp/3.5.4 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:44 GMT
via
1.1 9dc6533b1432a725b72f49ca8658a3c6.cloudfront.net (CloudFront)
server
Python/3.7 aiohttp/3.5.4
x-amz-cf-pop
EWR52-C4
x-cache
Miss from cloudfront
access-control-allow-origin
*
cache-control
no-store
x-amz-cf-id
-UmeQFE19Ckph_8cJgFXG934TFSJ6Dy9pC12Rz289CqH4A3Z6K5MQA==
index.php
a.dpmsrv.com/dpmpxl/
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=datapoint_dmp&google_cm&ap_id=4008352111651074917&pixelIndex=0&_=1652889824160
  • https://cm.g.doubleclick.net/pixel?google_nid=datapoint_dmp&google_cm=&ap_id=4008352111651074917&pixelIndex=0&_=1652889824160&google_tc=
  • https://a.dpmsrv.com/dpmpxl/index.php?q=dfp&ap_id=4008352111651074917&pixelIndex=0&_=1652889824160&google_gid=CAESEJCsVZSHtb0k_rjyYANTSLQ&google_cver=1
0
598 B 		Script
General
Check archive.org
Download Go to
Full URL
https://a.dpmsrv.com/dpmpxl/index.php?q=dfp&ap_id=4008352111651074917&pixelIndex=0&_=1652889824160&google_gid=CAESEJCsVZSHtb0k_rjyYANTSLQ&google_cver=1
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
HTTP/1.1
Server
3.87.151.192 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-87-151-192.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Pragma
no-cache
Access-Control-Max-Age
10
Access-Control-Allow-Methods
GET, POST, PUT, DELETE, OPTIONS
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Type
text/javascript
Access-Control-Allow-Headers
content-type, accept
Content-Length
0
Expires
0

Redirect headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:44 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://a.dpmsrv.com/dpmpxl/index.php?q=dfp&ap_id=4008352111651074917&pixelIndex=0&_=1652889824160&google_gid=CAESEJCsVZSHtb0k_rjyYANTSLQ&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
368
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
458249.gif
idsync.rlcdn.com/
Redirect Chain
  • https://idsync.rlcdn.com/423396.gif?partner_uid=4008352111651074917
  • https://idsync.rlcdn.com/1000.gif?memo=COTrGRIfChsIARDGpwEaEzQwMDgzNTIxMTE2NTEwNzQ5MTcQABoNCOCxlJQGEgUI6AcQAEIASgA
  • https://pippio.com/api/sync?pid=5324&it=1&iv=dbaf346bc308f2763e95ee7c4db865f1ead8d4ad23ebe1fb6fb1f19771e48a39791426b5417dce21&_=2
  • https://cm.g.doubleclick.net/pixel?google_nid=pippio_dmp&google_cm&google_no_sc&m=CMwpElsKVwgBEJInGlBkYmFmMzQ2YmMzMDhmMjc2M2U5NWVlN2M0ZGI4NjVmMWVhZDhkNGFkMjNlYmUxZmI2ZmIxZjE5NzcxZTQ4YTM5NzkxNDI2YjU...
  • https://pippio.com/api/sync/ddp?pid=2&m=CMwpElsKVwgBEJInGlBkYmFmMzQ2YmMzMDhmMjc2M2U5NWVlN2M0ZGI4NjVmMWVhZDhkNGFkMjNlYmUxZmI2ZmIxZjE5NzcxZTQ4YTM5NzkxNDI2YjU0MTdkY2UyMRAAGgwI4LGUlAYSBAgCEABCAEoA&goog...
  • https://tags.rd.linksynergy.com/rcs?ns=lr&uid3=
  • https://idsync.rlcdn.com/458249.gif?partner_uid=97289869-cdf6-4e7f-83df-709660c5d5d8
42 B
60 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://idsync.rlcdn.com/458249.gif?partner_uid=97289869-cdf6-4e7f-83df-709660c5d5d8
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H3
Server
35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
146.60.190.35.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 18 May 2022 16:03:44 GMT
via
1.1 google
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control
no-cache, no-store
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
42

Redirect headers

location
https://idsync.rlcdn.com/458249.gif?partner_uid=97289869-cdf6-4e7f-83df-709660c5d5d8
date
Wed, 18 May 2022 16:03:44 GMT
via
1.1 google
x-samesite
secure
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
111
content-type
text/html; charset=utf-8
tag.aspx
ml314.com/ 		31 KB
32 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ml314.com/tag.aspx?184
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.111.234.236 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
236.234.111.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
75d893335a1d25db1bf02e25ab904d97a3af743128850d8566b93d197e56e9e9

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 15:22:47 GMT
age
2458
x-guploader-uploadid
ADPycdubVvkT03QoYyE5LHv4rNrZ4qNinj3qU-FEorL2d1ChEJx_YmwbSj7uRl-qVi939Tnbxmli7NKcRmZyztT0smjE4Q
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
32025
last-modified
Mon, 04 Apr 2022 15:43:44 GMT
server
UploadServer
cache-control
public,max-age=3600
etag
"25b1f355dd487bdf5381a749056080c4"
x-goog-hash
crc32c=dPpbog==, md5=JbHzVd1Ie99TgadJBWCAxA==
x-goog-generation
1649087024620619
cache-id
YUL-62c5aa93
x-cache-hit
hit
x-goog-stored-content-length
32025
accept-ranges
bytes
content-type
application/javascript
utsync.ashx
ml314.com/ 		644 B
667 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=62439&ct=js&pi=&fp=&clid=&if=0&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&pv=1652889825049_fii83xggv&bl=en-us&cb=4270035&return=&ht=&d=&dc=&si=1652889825049_fii83xggv&cid=&s=1600x1200&rp=&v=2.5.1.2
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.111.234.236 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
236.234.111.34.bc.googleusercontent.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
01dbd527a90b3355432c7dbcc4f8401812f29d8acab256b1c4b079f2a286b650

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:44 GMT
via
1.1 google
server
Microsoft-IIS/10.0
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
p3p
CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
cache-control
private
content-type
application/javascript; charset=utf-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
644
expires
0
demconf.jpg
dpm.demdex.net/
Redirect Chain
  • https://dpm.demdex.net/ibs:dpid=22052&dpuuid=3627294074409582600&redir=
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=3627294074409582600&redir=
42 B
943 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=3627294074409582600&redir=
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
HTTP/1.1
Server
3.224.247.179 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-224-247-179.compute-1.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

DCS
dcs-prod-va6-2-v031-096aa2567.edge-va6.demdex.com UNKNOWN
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-Content-Type-Options
nosniff
X-TID
qNevX160TB8=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
59
Expires
Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS
dcs-prod-va6-1-v031-0cff29757.edge-va6.demdex.com UNKNOWN
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-TID
s83F1BG3QgI=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=22052&dpuuid=3627294074409582600&redir=
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 UTC
csync.ashx
ml314.com/
Redirect Chain
  • https://idsync.rlcdn.com/395886.gif?partner_uid=3627294074409582600
  • https://ml314.com/csync.ashx?fp=3011a0d6b988e27377674abde2d234357d6f769aab0f4ae9d890420f8817b92ef4cb09cee1a4f8eb&person_id=3627294074409582600&eid=50082
43 B
60 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ml314.com/csync.ashx?fp=3011a0d6b988e27377674abde2d234357d6f769aab0f4ae9d890420f8817b92ef4cb09cee1a4f8eb&person_id=3627294074409582600&eid=50082
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H3
Server
34.111.234.236 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
236.234.111.34.bc.googleusercontent.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:45 GMT
via
1.1 google
server
Microsoft-IIS/10.0
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
content-type
image/gif
cache-control
private
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Thu, 19 May 2022 12:03:45 GMT

Redirect headers

date
Wed, 18 May 2022 16:03:45 GMT
via
1.1 google
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
location
https://ml314.com/csync.ashx?fp=3011a0d6b988e27377674abde2d234357d6f769aab0f4ae9d890420f8817b92ef4cb09cee1a4f8eb&person_id=3627294074409582600&eid=50082
cache-control
no-cache, no-store
timing-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
utsync.ashx
ml314.com/
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=d0tro1j&ttd_tpi=1
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=d0tro1j&ttd_tpi=1
  • https://ml314.com/utsync.ashx?eid=53819&et=0&fp=34b50b2e-1c5e-4d58-86ca-d1813d53017f&gdpr=0&gdpr_consent=
43 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ml314.com/utsync.ashx?eid=53819&et=0&fp=34b50b2e-1c5e-4d58-86ca-d1813d53017f&gdpr=0&gdpr_consent=
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H3
Server
34.111.234.236 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
236.234.111.34.bc.googleusercontent.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:44 GMT
via
1.1 google
server
Microsoft-IIS/10.0
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
p3p
CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
cache-control
private
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
0,Thu, 19 May 2022 12:03:45 GMT

Redirect headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:45 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://ml314.com/utsync.ashx?eid=53819&et=0&fp=34b50b2e-1c5e-4d58-86ca-d1813d53017f&gdpr=0&gdpr_consent=
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
241
csync.ashx
ml314.com/
Redirect Chain
  • https://sync.crwdcntrl.net/map/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3627294074409582600
  • https://sync.crwdcntrl.net/map/ct=y/c=6985/tp=BOMB?https://ml314.com/csync.ashx%3Ffp%3D%24%7Bprofile_id%7D%26eid%3D50146%26person_id%3D3627294074409582600
  • https://ml314.com/csync.ashx?fp=a6c68c311fbb44f4e440d9bac87a62df&eid=50146&person_id=3627294074409582600
43 B
60 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ml314.com/csync.ashx?fp=a6c68c311fbb44f4e440d9bac87a62df&eid=50146&person_id=3627294074409582600
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H3
Server
34.111.234.236 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
236.234.111.34.bc.googleusercontent.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:44 GMT
via
1.1 google
server
Microsoft-IIS/10.0
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
content-type
image/gif
cache-control
private
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Thu, 19 May 2022 12:03:45 GMT

Redirect headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:45 GMT
server
Jetty(9.4.38.v20210224)
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
location
https://ml314.com/csync.ashx?fp=a6c68c311fbb44f4e440d9bac87a62df&eid=50146&person_id=3627294074409582600
cache-control
no-cache
x-server
10.40.6.73
content-length
0
expires
0
match
ps.eyeota.net/
Redirect Chain
  • https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif
  • https://ps.eyeota.net/pixel/bounce/?pid=r8hrb20&t=gif
  • https://ml314.com/utsync.ashx?eid=50052&et=0&fp=2hfBP6X6oYaVBcXArGASnuhVJgYnNNb-UYIQosciNY2E&gdpr=0&gdpr_consent=&return=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fbid%3Dr8hrb20%26uid%3Dnil%26referrer_p...
  • https://ml314.com/csync.ashx?fp=2hfBP6X6oYaVBcXArGASnuhVJgYnNNb-UYIQosciNY2E&person_id=3627294074409582600&eid=50052&return=https%3a%2f%2fps.eyeota.net%2fmatch%3fbid%3dr8hrb20%26uid%3dnil%26referre...
  • https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20
70 B
440 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
HTTP/1.1
Server
52.55.144.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-55-144-0.compute-1.amazonaws.com
Software
/
Resource Hash
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Wed, 18 May 2022 16:03:45 GMT
Content-Type
image/gif
Content-Length
70
P3P
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

Redirect headers

date
Wed, 18 May 2022 16:03:45 GMT
via
1.1 google
server
Microsoft-IIS/10.0
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
content-type
text/html; charset=utf-8
location
https://ps.eyeota.net/match?bid=r8hrb20&uid=nil&referrer_pid=r8hrb20
cache-control
private
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
193
expires
Thu, 19 May 2022 12:03:45 GMT
nr-spa-1212.min.js
js-agent.newrelic.com/ 		44 KB
17 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js-agent.newrelic.com/nr-spa-1212.min.js
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.194.137 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
ebfe453394ff1be6ef75d380ab7c5535aea0b51832d045f0d5d0ef7e6535969c

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

x-amz-version-id
wY72Ah.NJX5KzzqRFK3uhSo3Jh07tDe4
content-encoding
gzip
etag
"8bd93bf0ecb2f4e971a2055a41402bb6"
x-amz-request-id
HFEZYP6ZP4JYCVWD
x-cache
HIT
cross-origin-resource-policy
cross-origin
content-length
16636
x-amz-id-2
dJ0BkI1jAp+pR0bJsLkoMDir0AxL3+lgsSzUqIN3yOISkz5A99dyyjzKZBGW9VU+JjRRau7086c=
x-served-by
cache-yul12826-YUL
last-modified
Thu, 04 Nov 2021 21:16:16 GMT
server
AmazonS3
x-timer
S1652889826.513106,VS0,VE0
date
Wed, 18 May 2022 16:03:45 GMT
vary
Accept-Encoding
content-type
application/javascript
via
1.1 varnish
cache-control
public, max-age=7200, stale-if-error=604800
accept-ranges
bytes
x-cache-hits
64
integrator.js
adservice.google.com/adsid/ 		107 B
549 B 		Script
General
Check archive.org
Download Go to
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.darkreading.com
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80a::2002 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 18 May 2022 16:03:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/ 		31 KB
11 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3504935758733139&correlator=2076224644090537&eid=44742768&output=ldjh&gdfp_req=1&vrg=2022051201&ptt=17&impl=fif&npa=1&iu_parts=3834%2Cdarkreading.home%2Carticle%2Cattacks-breaches&enc_prev_ius=0%2F1%2F2%2F3&prev_iu_szs=1x1&ifi=1&adks=636043426&sfv=1-0-38&ecs=20220518&fsapi=false&prev_scp=pos%3Dwelcome_v%26ptype%3Darticle%26pageid%3Dblt0534aed8e124c811%26aid%3D058601%26reg%3Danonymous&sc=1&cookie_enabled=1&abxe=1&dt=1652889825570&lmt=1652889825&dlt=1652889823147&idt=865&biw=1600&bih=1200&adxs=0&adys=0&ucis=1&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&url=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&frm=20&vis=1&scr_x=0&scr_y=0&psz=1600x4056&msz=0x0&fws=132&ohw=1600&ga_vid=1366153732.1652889824&ga_sid=1652889826&ga_hid=737115392&ga_fc=true&btvi=0&topics=1
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.40.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s79-in-f2.1e100.net
Software
cafe /
Resource Hash
ab4dbd897f0d59d6bbf97238b3e7d160bfc2e6187d37cd91f3c79cac26fc42e7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:45 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11502
x-xss-protection
0
google-lineitem-id
5940610987
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138392437444
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.darkreading.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/ 		8 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3504935758733139&correlator=2076224644090537&eid=44742768&output=ldjh&gdfp_req=1&vrg=2022051201&ptt=17&impl=fif&npa=1&iu_parts=3834%2Cdarkreading.home%2Carticle%2Cattacks-breaches&enc_prev_ius=0%2F1%2F2%2F3&prev_iu_szs=1x1&ifi=2&adks=307046208&sfv=1-0-38&ecs=20220518&ists=1&fsapi=false&prev_scp=pos%3Dwallpaper_v%26ptype%3Darticle%26pageid%3Dblt0534aed8e124c811%26aid%3D058601%26reg%3Danonymous&sc=1&cookie_enabled=1&abxe=1&dt=1652889825578&lmt=1652889825&dlt=1652889823147&idt=865&biw=1600&bih=1200&adxs=-12245933&adys=-12245933&ucis=2&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&url=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&frm=20&vis=1&scr_x=0&scr_y=0&psz=1600x4056&msz=0x0&fws=132&ohw=1600&ga_vid=1366153732.1652889824&ga_sid=1652889826&ga_hid=737115392&ga_fc=true&btvi=-1&topics=1
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.40.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s79-in-f2.1e100.net
Software
cafe /
Resource Hash
067b8ebe203f9377c57d506b933f517839f293dd9a8be2f7e323e5f4040f9122
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:45 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3268
x-xss-protection
0
google-lineitem-id
5909690628
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138385553298
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.darkreading.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/ 		556 B
309 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3504935758733139&correlator=2076224644090537&eid=44742768&output=ldjh&gdfp_req=1&vrg=2022051201&ptt=17&impl=fif&npa=1&iu_parts=3834%2Cdarkreading.home%2Carticle%2Cattacks-breaches&enc_prev_ius=0%2F1%2F2%2F3&prev_iu_szs=1x1&ifi=3&adks=1582870506&sfv=1-0-38&ecs=20220518&ists=1&fsapi=false&prev_scp=pos%3Doop_v%26ptype%3Darticle%26pageid%3Dblt0534aed8e124c811%26aid%3D058601%26reg%3Danonymous&sc=1&cookie_enabled=1&abxe=1&dt=1652889825582&lmt=1652889825&dlt=1652889823147&idt=865&biw=1600&bih=1200&adxs=0&adys=0&ucis=3&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&url=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&frm=20&vis=1&scr_x=0&scr_y=0&psz=1600x4056&msz=0x0&fws=132&ohw=1600&ga_vid=1366153732.1652889824&ga_sid=1652889826&ga_hid=737115392&ga_fc=true&btvi=0&topics=1
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.40.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s79-in-f2.1e100.net
Software
cafe /
Resource Hash
74b0bdf21addb85c17a709b87d27b77f8cf39101af6ec782b24404b3b85efcf0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:45 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
280
x-xss-protection
0
google-lineitem-id
-2
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
-2
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.darkreading.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/ 		556 B
309 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3504935758733139&correlator=2076224644090537&eid=44742768&output=ldjh&gdfp_req=1&vrg=2022051201&ptt=17&impl=fif&npa=1&iu_parts=3834%2Cdarkreading.home%2Carticle%2Cattacks-breaches&enc_prev_ius=0%2F1%2F2%2F3&prev_iu_szs=1x1&ifi=4&adks=4013581329&sfv=1-0-38&ecs=20220518&fsapi=false&prev_scp=pos%3Dfloor_v%26gdpr_banner%3Don%26ptype%3Darticle%26pageid%3Dblt0534aed8e124c811%26aid%3D058601%26reg%3Danonymous&sc=1&cookie_enabled=1&abxe=1&dt=1652889825586&lmt=1652889825&dlt=1652889823147&idt=865&biw=1600&bih=1200&adxs=0&adys=0&ucis=4&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&url=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&frm=20&vis=1&scr_x=0&scr_y=0&psz=1600x4056&msz=0x0&fws=132&ohw=1600&ga_vid=1366153732.1652889824&ga_sid=1652889826&ga_hid=737115392&ga_fc=true&btvi=0&topics=1
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.40.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s79-in-f2.1e100.net
Software
cafe /
Resource Hash
4d6f1cf5d9614b5be94ec1299a84df371511a41dd06768bee621ea3bcfada833
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:45 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
280
x-xss-protection
0
google-lineitem-id
-2
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
-2
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.darkreading.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/ 		556 B
308 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3504935758733139&correlator=2076224644090537&eid=44742768&output=ldjh&gdfp_req=1&vrg=2022051201&ptt=17&impl=fif&npa=1&iu_parts=3834%2Cdarkreading.home%2Carticle%2Cattacks-breaches&enc_prev_ius=0%2F1%2F2%2F3&prev_iu_szs=7x7&ifi=5&adks=356548446&sfv=1-0-38&ecs=20220518&fsapi=false&prev_scp=pos%3Dadhesion_v%26gdpr_banner%3Don%26ptype%3Darticle%26pageid%3Dblt0534aed8e124c811%26aid%3D058601%26reg%3Danonymous&sc=1&cookie_enabled=1&abxe=1&dt=1652889825590&lmt=1652889825&dlt=1652889823147&idt=865&biw=1600&bih=1200&adxs=0&adys=0&ucis=5&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&url=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&frm=20&vis=1&scr_x=0&scr_y=0&psz=1600x4056&msz=7x0&fws=132&ohw=1600&ga_vid=1366153732.1652889824&ga_sid=1652889826&ga_hid=737115392&ga_fc=true&btvi=0&topics=1
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.40.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s79-in-f2.1e100.net
Software
cafe /
Resource Hash
a9501660e1ee63dd0a9fea4ca45f506b815775c692f689940845d341826af96d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:45 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
279
x-xss-protection
0
google-lineitem-id
-2
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
-2
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.darkreading.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
sodar
pagead2.googlesyndication.com/getconfig/ 		14 KB
11 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2022051201&st=env
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:81e::2002 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
27a3639eb98cd49240126c3693b8ec1d5e20a5a5e924ee498029bd5390841e5d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 18 May 2022 16:03:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
10516
x-xss-protection
0
container.html
82c8e2daca830d4ec57f996206427194.safeframe.googlesyndication.com/safeframe/1-0-38/html/ Frame 94A6 		6 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://82c8e2daca830d4ec57f996206427194.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:806::2001 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, immutable, max-age=31536000
content-encoding
gzip
content-length
3108
content-type
text/html
cross-origin-opener-policy-report-only
same-origin; report-to="ads-gpt-scs"
cross-origin-resource-policy
cross-origin
date
Wed, 18 May 2022 16:03:45 GMT
expires
Thu, 18 May 2023 16:03:45 GMT
last-modified
Tue, 02 Mar 2021 20:17:03 GMT
report-to
{"group":"ads-gpt-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-gpt-scs"}]}
server
sffe
timing-allow-origin
*
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
rum
www.darkreading.com/cdn-cgi/ 		0
189 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.darkreading.com/cdn-cgi/rum?
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7763 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
tracestate
3288925@nr=0-1-3288925-256687733-0280345c30d7e082----1652889825624
traceparent
00-36236ca5d250d1a49a6e0da7318e2b50-0280345c30d7e082-01
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
newrelic
eyJ2IjpbMCwxXSwiZCI6eyJ0eSI6IkJyb3dzZXIiLCJhYyI6IjMyODg5MjUiLCJhcCI6IjI1NjY4NzczMyIsImlkIjoiMDI4MDM0NWMzMGQ3ZTA4MiIsInRyIjoiMzYyMzZjYTVkMjUwZDFhNDlhNmUwZGE3MzE4ZTJiNTAiLCJ0aSI6MTY1Mjg4OTgyNTYyNH19
content-type
application/json

Response headers

date
Wed, 18 May 2022 16:03:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cloudflare
x-frame-options
DENY
access-control-allow-methods
POST,OPTIONS
content-type
text/plain
access-control-allow-origin
https://www.darkreading.com
access-control-max-age
86400
access-control-allow-credentials
true
cf-ray
70d5d3223b87ca47-YUL
vary
Origin
ads
securepubads.g.doubleclick.net/gampad/ 		20 KB
9 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3504935758733139&correlator=2076224644090537&eid=44742768&output=ldjh&gdfp_req=1&vrg=2022051201&ptt=17&impl=fif&npa=1&iu_parts=3834%2Cdarkreading.home%2Carticle%2Cattacks-breaches&enc_prev_ius=0%2F1%2F2%2F3&prev_iu_szs=1x1&ifi=6&adks=1891560237&sfv=1-0-38&ecs=20220518&fsapi=false&prev_scp=pos%3Dvideo_v%26ptype%3Darticle%26pageid%3Dblt0534aed8e124c811%26aid%3D058601%26reg%3Danonymous&sc=1&cookie_enabled=1&abxe=1&dt=1652889825630&lmt=1652889825&dlt=1652889823147&idt=865&biw=1600&bih=1200&adxs=308&adys=1199&ucis=6&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&url=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&frm=20&vis=1&scr_x=0&scr_y=0&psz=646x1664&msz=646x0&fws=4&ohw=1600&ga_vid=1366153732.1652889824&ga_sid=1652889826&ga_hid=737115392&ga_fc=true&btvi=0&topics=1
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.40.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s79-in-f2.1e100.net
Software
cafe /
Resource Hash
711939c856bb03ca15f065d9281370f0576f85937f3f818e1cad70631ab5fee9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:45 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
8801
x-xss-protection
0
google-lineitem-id
5674929725
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138347225724
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.darkreading.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/ 		22 KB
10 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3504935758733139&correlator=2076224644090537&eid=44742768&output=ldjh&gdfp_req=1&vrg=2022051201&ptt=17&impl=fif&npa=1&iu_parts=3834%2Cdarkreading.home%2Carticle%2Cattacks-breaches&enc_prev_ius=0%2F1%2F2%2F3&prev_iu_szs=300x600%7C300x250%7C5x5&ifi=7&adks=1375599752&sfv=1-0-38&ecs=20220518&fsapi=false&prev_scp=pos%3D300_1v%26ptype%3Darticle%26pageid%3Dblt0534aed8e124c811%26aid%3D058601%26reg%3Danonymous&sc=1&cookie_enabled=1&abxe=1&dt=1652889825636&lmt=1652889825&dlt=1652889823147&idt=865&biw=1600&bih=1200&adxs=988&adys=126&ucis=7&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&url=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&frm=20&vis=1&scr_x=0&scr_y=0&psz=308x0&msz=300x0&fws=4&ohw=1600&ga_vid=1366153732.1652889824&ga_sid=1652889826&ga_hid=737115392&ga_fc=true&btvi=0&topics=1
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.40.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s79-in-f2.1e100.net
Software
cafe /
Resource Hash
2df5b8c108129299c6bf055d3923cf1e2614262da142c75a3751ed524bad7162
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:45 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9999
x-xss-protection
0
google-lineitem-id
5909690628
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138385472699
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.darkreading.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/ 		29 KB
12 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3504935758733139&correlator=2076224644090537&eid=44742768&output=ldjh&gdfp_req=1&vrg=2022051201&ptt=17&impl=fif&npa=1&iu_parts=3834%2Cdarkreading.home%2Carticle%2Cattacks-breaches&enc_prev_ius=0%2F1%2F2%2F3&prev_iu_szs=300x250%7C300x600&ifi=8&adks=3086305157&sfv=1-0-38&ecs=20220518&fsapi=false&prev_scp=pos%3D300_2v%26ptype%3Darticle%26pageid%3Dblt0534aed8e124c811%26aid%3D058601%26reg%3Danonymous&sc=1&cookie_enabled=1&abxe=1&dt=1652889825641&lmt=1652889825&dlt=1652889823147&idt=865&biw=1600&bih=1200&adxs=988&adys=126&ucis=8&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&url=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&frm=20&vis=1&scr_x=0&scr_y=0&psz=308x0&msz=300x0&fws=4&ohw=1600&ga_vid=1366153732.1652889824&ga_sid=1652889826&ga_hid=737115392&ga_fc=true&btvi=0&topics=1
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.40.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s79-in-f2.1e100.net
Software
cafe /
Resource Hash
65c8781d450035fd50d0f6640abe12a521d7772b92531f2fe9e9e34a8bc51276
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:45 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12221
x-xss-protection
0
google-lineitem-id
5909690628
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138385472861
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.darkreading.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
ads
securepubads.g.doubleclick.net/gampad/ 		29 KB
12 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?pvsid=3504935758733139&correlator=2076224644090537&eid=44742768&output=ldjh&gdfp_req=1&vrg=2022051201&ptt=17&impl=fif&npa=1&iu_parts=3834%2Cdarkreading.home%2Carticle%2Cattacks-breaches&enc_prev_ius=0%2F1%2F2%2F3&prev_iu_szs=970x90%7C970x250%7C728x90&ifi=9&adks=2174547932&sfv=1-0-38&ecs=20220518&fsapi=false&prev_scp=pos%3D728_1v%26ptype%3Darticle%26pageid%3Dblt0534aed8e124c811%26aid%3D058601%26reg%3Danonymous&sc=1&cookie_enabled=1&abxe=1&dt=1652889825646&lmt=1652889825&dlt=1652889823147&idt=865&biw=1600&bih=1200&adxs=315&adys=86&ucis=9&oid=2&u_his=2&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&dmc=8&bc=31&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0.&nvt=1&url=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&frm=20&vis=1&scr_x=0&scr_y=0&psz=984x0&msz=970x0&fws=4&ohw=1600&ga_vid=1366153732.1652889824&ga_sid=1652889826&ga_hid=737115392&ga_fc=true&btvi=0&topics=1
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.40.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s79-in-f2.1e100.net
Software
cafe /
Resource Hash
4eb103094821b4a4fda221f8c5a8f81c4361766ea11c84bd2f8e48fdabe23f82
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:45 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
12220
x-xss-protection
0
google-lineitem-id
5800261410
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
138383383812
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.darkreading.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
NRJS-4eee28fd5f21ed85217
bam.eu01.nr-data.net/1/ 		49 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://bam.eu01.nr-data.net/1/NRJS-4eee28fd5f21ed85217?a=256687733&sa=1&v=1212.e95d35c&t=Unnamed%20Transaction&rst=2657&ck=1&ref=https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&be=341&fe=2475&dc=926&af=err,xhr,stn,ins,spa&perf=%7B%22timing%22:%7B%22of%22:1652889823000,%22n%22:0,%22f%22:1,%22dn%22:1,%22dne%22:15,%22c%22:15,%22s%22:24,%22ce%22:42,%22rq%22:42,%22rp%22:141,%22rpe%22:153,%22dl%22:147,%22di%22:534,%22ds%22:926,%22de%22:927,%22dc%22:2472,%22l%22:2475,%22le%22:2606%7D,%22navigation%22:%7B%7D%7D&fp=400&jsonp=NREUM.setToken
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
185.221.87.248 , Ireland, ASN206998 (NEW-2, IE),
Reverse DNS
Software
cloudflare /
Resource Hash
dac715f087720dd7ff7067f5d2ec1988851fa93140ae8a9cbfaa15659dd7fd82

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Wed, 18 May 2022 16:03:46 GMT
Content-Encoding
gzip
CF-Cache-Status
DYNAMIC
NEL
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
Transfer-Encoding
chunked
x-envoy-upstream-service-time
3
cross-origin-resource-policy
cross-origin
access-control-allow-methods
GET, POST, PUT, HEAD, OPTIONS
Connection
keep-alive
Server
cloudflare
Expect-CT
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary
Accept-Encoding
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2tT1cG7PfjZwDogr9Qyuj7jO4nK8V8NpcvJeDGu%2F7079dBhfgEpviZM65UIadpokRLmb%2BfHaiK5zm54xYDRjaF5PLxE6szGbKXTgmy5Dtxq%2BjHD1h%2FCPCY4TQuRIaCD4%2FZ7bv%2B5d"}],"group":"cf-nel","max_age":604800}
Content-Type
text/javascript
Access-Control-Allow-Origin
*
access-control-allow-credentials
true
CF-Ray
70d5d3236807a204-YYZ
sodar2.js
tpc.googlesyndication.com/sodar/ 		17 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:822::2001 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6386
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
etag
"1637097310169751"
vary
Accept-Encoding
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Wed, 18 May 2022 16:03:45 GMT
2732925589158490930
tpc.googlesyndication.com/simgad/ 		167 KB
168 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/2732925589158490930?
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:822::2001 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f8c9c8046ab5ae13163dcb2143f7abe357e096f285c08167cf070b33da37645c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Tue, 17 May 2022 18:10:20 GMT
x-content-type-options
nosniff
age
78805
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
171440
x-xss-protection
0
last-modified
Tue, 22 Mar 2022 14:02:44 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Wed, 17 May 2023 18:10:20 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 0791 		0
26 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuLz62IaLhyXvRZ8bM-IrhU-up2rLGqCB-pKgf2s5IRGTfJv-KQIpiz-69wKRpMoSIJ0-LDcXd9pEa8XIFlRGFA4LSrqJ_R4GpZKomL-QzUanXfSvtQUxI8CiokjIMCF6OZ7HiJxLMmBunF0Zcs1vgDv9hc_cC8hz3bMcElNVv5a6jmsNKP35nPDwwrom8v5qbbjFm5EkVWvOUVAzhA0J2wHMuy14L2UrTKQLoV9tjSoQqjS9AA7Uu8tnuZSDuqtuV8wgc72ZJSiL9sQW64dmxvvJCpvlLuWcFDQqKl0kUsSdbmdW0SSMPxwHlJnBdVRjy4P-RHH0_SjhdAOs4BnD0XjLLRo-yChIa0oYs&sig=Cg0ArKJSzGOyptcF-R-LEAE&uach_m=[UACH]&urlfix=1&adurl=
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.40.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s79-in-f2.1e100.net
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 18 May 2022 16:03:45 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
view
securepubads.g.doubleclick.net/pcs/ Frame C435 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsskmpdTiRmnV6EmjRipwhC3COHu3aE4jX7mFCB43M73jGdDBttPjPbGiZiBljuFaZlMk1iVrMFcaFv7UYX1le5Rz83z2VSqMvRh3K0Y-lhvqYpuImuF5zFpC9acf1HLBw-zxHI12E9CGqneBllqPFkpyeyICnPpEd5X2ZQcrkXLHTzD-sTEGjPBOS3F7eTXWHHQO4mFAtVVZnVR-3MFF-8S71YizsfiS2ABdt2dujsuZM8u8C-DCrTYsojcZS3-erkKQWuY-iFtlNEx3RCmSgYkboRvlloRDAH3L4ZOoO9rmEnJqBseDJs4TzcnCImes5bzV2cdWsQF0yvEAoSc130iv2iU7sxJBHjGSImqURR9d-ZQxkbRgxglik4cF9QBhIv2HMtTEkf_VYk&sig=Cg0ArKJSzEId5dX1y-QQEAE&uach_m=[UACH]&urlfix=1&adurl=
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.40.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s79-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 18 May 2022 16:03:45 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
jquery-1.11.0.min.js
code.jquery.com/ Frame C435 		94 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://code.jquery.com/jquery-1.11.0.min.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022051201.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4de0:ac18::1:a:3a , Netherlands, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
Software
nginx /
Resource Hash
b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:45 GMT
content-encoding
gzip
last-modified
Fri, 20 Aug 2021 17:47:53 GMT
server
nginx
etag
W/"611feac9-1787d"
vary
Accept-Encoding
x-hw
1652889825.dop003.dc2.t,1652889825.cds211.dc2.hn,1652889825.cds045.dc2.c
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
max-age=315360000, public
accept-ranges
bytes
content-length
33357
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame C435 		133 KB
41 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022051201.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:816::2002 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
53b0053087c796bee6fb74269f3ff3e6316beb7e06309cfbccb5d52a45e69d7f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
41645
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1652701179351892"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Wed, 18 May 2022 16:03:45 GMT
moatad.js
z.moatads.com/pentonmedia53440730609/ Frame C435 		317 KB
108 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/pentonmedia53440730609/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022051201.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
ac0724d7dca2e69ee2d98ca70df60aeed0f97b7dd362d55ee8943a93e4665eea

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:45 GMT
content-encoding
gzip
last-modified
Thu, 12 May 2022 16:31:53 GMT
server
AmazonS3
x-amz-request-id
R15C3RG3YR5YYM0M
etag
"31c8a4d626c9b43cf421abc3f9686e80"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=41275
accept-ranges
bytes
content-length
109763
x-amz-id-2
4Hs+bgk449K0DsYsomlMt0FOH8NVl8ifC0BDU7s+VvYgNBlRf7WNzNEgZnpfag80GVRlCTKEfcE=
5740496405795669132
tpc.googlesyndication.com/simgad/ Frame C435
Redirect Chain
  • https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsskmpdTiRmnV6EmjRipwhC3COHu3aE4jX7mFCB43M73jGdDBttPjPbGiZiBljuFaZlMk1iVrMFcaFv7UYX1le5Rz83z2VSqMvRh3K0Y-lhvqYpuImuF5zFpC9acf1HLBw-zxHI12E9CG...
  • https://tpc.googlesyndication.com/simgad/5740496405795669132?
42 KB
42 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/5740496405795669132?
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H3
Server
2607:f8b0:4006:822::2001 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b5de7e9995d540bac806a791f3b52d1397c98fb5717736a4b448e76a28443747
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 04:12:47 GMT
x-content-type-options
nosniff
age
42658
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42580
x-xss-protection
0
last-modified
Tue, 08 Mar 2022 18:08:04 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Thu, 18 May 2023 04:12:47 GMT

Redirect headers

timing-allow-origin
*
date
Wed, 18 May 2022 16:03:45 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
access-control-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://tpc.googlesyndication.com/simgad/5740496405795669132?
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
Frame_1728.svg
eu-images.contentstack.com/v3/assets/blt66983808af36a8ef/blt456fd002839bae7e/620377d02be9c249dcea7cc9/ Frame C435 		8 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eu-images.contentstack.com/v3/assets/blt66983808af36a8ef/blt456fd002839bae7e/620377d02be9c249dcea7cc9/Frame_1728.svg?quality=80&format=jpg&width=222
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.194.217 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
958136771bc42c0cbea29f08be65260d0b8b63020d9f41039261fbf26a0cc942
Security Headers
Name Value
Strict-Transport-Security max-age=31557600

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:45 GMT
via
1.1 varnish, 1.1 varnish
fastly-io-error
not a supported image format
age
3760811
x-cache
HIT, HIT
filename1
custom
content-disposition
inline; filename=Frame_1728.svg+xml
fastly-stats
io=1
content-encoding
gzip
content-length
3197
x-request-id
55279
x-served-by
cache-ams21079-AMS, cache-yul12825-YUL
x-runtime
77ms
x-timer
S1652889826.745093,VS0,VE0
x-contentstack-organization
blt5948195ac13977b0
vary
Accept-Encoding
strict-transport-security
max-age=31557600
content-type
image/svg+xml
access-control-allow-origin
*
access-control-expose-headers
content-disposition, content-type, cache-control, status, content-length
cache-control
max-age=31536000
accept-ranges
bytes
x-cache-hits
18, 49
collect
www.google-analytics.com/ 		35 B
55 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google-analytics.com/collect?v=1&_v=j96&a=737115392&t=event&ni=1&_s=1&dl=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&dp=%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&ul=en-us&de=UTF-8&dt=Cyber-Espionage%20Attack%20Drops%20Post-Exploit%20Malware%20Framework%20on%20Microsoft%20Exchange%20Servers&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=welcome%20ad%20served&ea=5940610987&el=138392437444&_u=aGDACEABRAAAAC~&jid=&gjid=&cid=1366153732.1652889824&tid=UA-135180592-2&_gid=2062177657.1652889824&gtm=2wg5g0T52Z3Z3&cg1=article&cg2=News&cg3=Attacks%2FBreaches&cd1=article&cd2=jai%20vijayan&cd3=&cd4=News&cd5=May%2011%2C%202022&cd6=attacks-breaches&cd9=application-security%2Cthreat-intelligence&cd10=0&cd16=blt0534aed8e124c811&cd17=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&cd18=3834%2Fdarkreading.home%2Farticle%2Fattacks-breaches&cd20=vanguard%20-%20112&z=228628307
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:80e::200e Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Tue, 17 May 2022 23:29:59 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
59626
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame D9F4 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvab35SdeyJUNbhkYCTEEtbIyeGxDPPlDvKN9PQ4PQ3aRfO8pjg0QYAUJSHdWom-3c7_c_bCV_iS7ytSxw7X3_KNwX0sdzm5McKAeC8GfrkwviZVHVwkVkSF4Vm1zD5wEd0T5QPbd9-lXFVY4a_y1FItvFG_OCAII1ptVKjzkJj8CRHlJvBO8Z1e500jroDCoyJgnZY-Ng_-gVVdCOEO8gskhlU2t63z_PSJ3JyMuEGKMGZURWDiVWVzlIf_IwM9r4-Pe0IyTiGZbDed-ji9TrobDb6D9YDs7zW_pqa4r7NTivKrd2C06cxlSKtIolO0Jnp-hoklsNkZ8zoo7A9AX_tSJnvzlLovPw&sig=Cg0ArKJSzNs8_V-Sn-JfEAE&uach_m=[UACH]&urlfix=1&adurl=
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.40.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s79-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 18 May 2022 16:03:45 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame D9F4 		133 KB
41 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022051201.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:816::2002 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
53b0053087c796bee6fb74269f3ff3e6316beb7e06309cfbccb5d52a45e69d7f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
41645
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1652701179351892"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Wed, 18 May 2022 16:03:45 GMT
moatad.js
z.moatads.com/pentonmedia53440730609/ Frame D9F4 		317 KB
108 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/pentonmedia53440730609/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022051201.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
ac0724d7dca2e69ee2d98ca70df60aeed0f97b7dd362d55ee8943a93e4665eea

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:45 GMT
content-encoding
gzip
last-modified
Thu, 12 May 2022 16:31:53 GMT
server
AmazonS3
x-amz-request-id
R15C3RG3YR5YYM0M
etag
"31c8a4d626c9b43cf421abc3f9686e80"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=41275
accept-ranges
bytes
content-length
109763
x-amz-id-2
4Hs+bgk449K0DsYsomlMt0FOH8NVl8ifC0BDU7s+VvYgNBlRf7WNzNEgZnpfag80GVRlCTKEfcE=
view
securepubads.g.doubleclick.net/pcs/ Frame 8036 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvbBZvIrgtsMbLnQOs0LXlvtGGXwU5yQV4xmo4EzeBvVyE4LgLdyFd42p60zfwp1YwICgIz__dFCBuwnpJM-vmOGmmdhsV58LW7Dv3ASMvh-lVlrUfNkJIkwmjYetckDqe3XY96jXcM02sMfFVX5Hv8HQsS7eM9rXAZxgZRqgZY9-k4_9yZ7UG4xz1klz1gEOlR0viBu3UHhpH1qRf9oVtOUvfFBISrP0j_iyEHy_nU238x3HVzTF6tCr_vnxIZV_hygLtb12AeMSmsfPW-f0hRgaYGY7cFNwVlZKVS2CV1ndzVHtVrz0VAmXljmHQyw7JV0rfYOURtqNO0hM0pLdUt-yUqRg&sig=Cg0ArKJSzKkCxW0fkNp-EAE&uach_m=[UACH]&urlfix=1&adurl=
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.40.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s79-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 18 May 2022 16:03:45 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
tag
a.teads.tv/page/130102/ Frame 8036 		752 B
670 B 		Script
General
Check archive.org
Download Go to
Full URL
https://a.teads.tv/page/130102/tag
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022051201.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.200.197.46 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-200-197-46.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e8801beb8f5d63bc2a0ba0b3d6399a0c36c1b20549e3346a8f0e9e5b2a0ca07e

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:45 GMT
content-encoding
gzip
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, must-revalidate, max-age=3600
access-control-allow-credentials
true
content-length
470
expires
Wed, 18 May 2022 17:03:45 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 8036 		133 KB
41 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022051201.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:816::2002 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
53b0053087c796bee6fb74269f3ff3e6316beb7e06309cfbccb5d52a45e69d7f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
41645
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1652701179351892"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Wed, 18 May 2022 16:03:45 GMT
moatad.js
z.moatads.com/pentonmedia53440730609/ Frame 8036 		317 KB
108 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/pentonmedia53440730609/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022051201.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
ac0724d7dca2e69ee2d98ca70df60aeed0f97b7dd362d55ee8943a93e4665eea

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:45 GMT
content-encoding
gzip
last-modified
Thu, 12 May 2022 16:31:53 GMT
server
AmazonS3
x-amz-request-id
R15C3RG3YR5YYM0M
etag
"31c8a4d626c9b43cf421abc3f9686e80"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=41275
accept-ranges
bytes
content-length
109763
x-amz-id-2
4Hs+bgk449K0DsYsomlMt0FOH8NVl8ifC0BDU7s+VvYgNBlRf7WNzNEgZnpfag80GVRlCTKEfcE=
view
securepubads.g.doubleclick.net/pcs/ Frame EC4B 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvnz2sgEmCltkDMfnUEmOyPAdqBDpyFXBaYS5Bs3VossVv5rVmzKMZuTbI1SrDGtm_n79un2tYQJwfVMZGb3tbfZP3K9zh7z1C3qOjYugoWQcY7IsNDje71zp2A6Gt6EEs6Xu7vyPA2UM0G8AsCN3LXBuhKCGg0S_D5njHXLKYQoiQsYGQMX6TQjm7QYG-cqeeA8Mg5EiCUgsdeQUdPeXLsnZPJhr65o6g_pgRS91jN_ibMXSXB2kU0RSvy2c6IKIPgIW0dDD6cN3mEVN85Vws3a9wxSwpZTOMCWKfJGLIHfN1V2RCky_ZByNtZCSI39HqQ_gsVG-id2pV4UkRd57jDqNdePzvaZm8&sig=Cg0ArKJSzERu2fMm7GBFEAE&uach_m=[UACH]&adurl=
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.40.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s79-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 18 May 2022 16:03:45 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20220511/r20110914/client/ Frame EC4B 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20220511/r20110914/client/window_focus_fy2019.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022051201.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::2001 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 15:55:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
496
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1359
x-xss-protection
0
server
cafe
etag
1484984001845508991
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 01 Jun 2022 15:55:29 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame EC4B 		133 KB
41 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022051201.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:816::2002 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
53b0053087c796bee6fb74269f3ff3e6316beb7e06309cfbccb5d52a45e69d7f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
41645
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1652701179351892"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Wed, 18 May 2022 16:03:45 GMT
moatad.js
z.moatads.com/pentonmedia53440730609/ Frame EC4B 		317 KB
108 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/pentonmedia53440730609/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022051201.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
ac0724d7dca2e69ee2d98ca70df60aeed0f97b7dd362d55ee8943a93e4665eea

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:45 GMT
content-encoding
gzip
last-modified
Thu, 12 May 2022 16:31:53 GMT
server
AmazonS3
x-amz-request-id
R15C3RG3YR5YYM0M
etag
"31c8a4d626c9b43cf421abc3f9686e80"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=41275
accept-ranges
bytes
content-length
109763
x-amz-id-2
4Hs+bgk449K0DsYsomlMt0FOH8NVl8ifC0BDU7s+VvYgNBlRf7WNzNEgZnpfag80GVRlCTKEfcE=
17233809508354857735
tpc.googlesyndication.com/simgad/ Frame EC4B 		14 KB
14 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/17233809508354857735
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022051201.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::2001 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d984171d5813963d57ffeaf1e666842cc6cb952a4975f56c1bafdef14ad8a4c2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Fri, 13 May 2022 01:41:26 GMT
x-content-type-options
nosniff
age
483739
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
14729
x-xss-protection
0
last-modified
Thu, 03 Mar 2022 19:53:28 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Sat, 13 May 2023 01:41:26 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame D744 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssTJ-qPZiCCXyWxAFPn6fDQqs3OvruFEUkxSLYXYlaCEyoljZiJgT0l7NftR2v6mlUJDcYwpdslxqLwP4aoUjmFioizuAFnfyYMEbz_AJmqMcq-xBFee6_3ii0_CDtDsj0X_VdVrAZ9Nq8gybgGzAh7nOjinbZpFxIPK7tASWEvfOMXBX36Pk8U2RSi8p4BWUZDZ9RLb-PSXXOtqjqZpDkWSCbBCA_yGboFDMCLPkPgWzGPP-UxvW8KBjBqD3IZtYkQguLsSQWHxrVyVMcfBnqPcuonHP60r81tr7Pkw8JdGFIQy35JL-mmc9R5i-uCmNUlO0hsFCGvlb_GbMsoukojWDbceYFj5SI&sig=Cg0ArKJSzMm2kukpPDw5EAE&uach_m=[UACH]&adurl=
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.40.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s79-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 18 May 2022 16:03:45 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20220511/r20110914/client/ Frame D744 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/pagead/js/r20220511/r20110914/client/window_focus_fy2019.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022051201.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::2001 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 15:55:29 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
496
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1359
x-xss-protection
0
server
cafe
etag
1484984001845508991
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Wed, 01 Jun 2022 15:55:29 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame D744 		133 KB
41 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022051201.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:816::2002 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
53b0053087c796bee6fb74269f3ff3e6316beb7e06309cfbccb5d52a45e69d7f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:45 GMT
content-encoding
gzip
x-content-type-options
nosniff
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/active-view-scs-read-write-acl
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
41645
x-xss-protection
0
server
sffe
cross-origin-opener-policy
same-origin; report-to="active-view-scs-read-write-acl"
etag
"1652701179351892"
vary
Accept-Encoding
report-to
{"group":"active-view-scs-read-write-acl","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/active-view-scs-read-write-acl"}]}
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
expires
Wed, 18 May 2022 16:03:45 GMT
l
www.google.com/ads/measurement/ Frame D744 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/measurement/l?ebcid=ALh7CaQVIWkoM2VztfI5SqS3C8XmFaw7YpirHhhtq6K8BM3uJytGE0V3NaLzwMFQu71ama9dw_kX
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022051201.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2004 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers
moatad.js
z.moatads.com/pentonmedia53440730609/ Frame D744 		317 KB
108 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://z.moatads.com/pentonmedia53440730609/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022051201.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
ac0724d7dca2e69ee2d98ca70df60aeed0f97b7dd362d55ee8943a93e4665eea

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:45 GMT
content-encoding
gzip
last-modified
Thu, 12 May 2022 16:31:53 GMT
server
AmazonS3
x-amz-request-id
R15C3RG3YR5YYM0M
etag
"31c8a4d626c9b43cf421abc3f9686e80"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=41275
accept-ranges
bytes
content-length
109763
x-amz-id-2
4Hs+bgk449K0DsYsomlMt0FOH8NVl8ifC0BDU7s+VvYgNBlRf7WNzNEgZnpfag80GVRlCTKEfcE=
7744945786656286024
tpc.googlesyndication.com/simgad/ Frame D744 		105 KB
105 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/simgad/7744945786656286024
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2022051201.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::2001 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
f6d55b625c304616284f3c9d1f1b9f601d2a6abfa7610a4bb10d416c542eea7b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Mon, 16 May 2022 01:17:59 GMT
x-content-type-options
nosniff
age
225946
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
107046
x-xss-protection
0
last-modified
Tue, 22 Mar 2022 14:01:45 GMT
server
sffe
report-to
{"group":"content-ads-owners","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/content-ads-owners"}]}
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to="content-ads-owners"
expires
Tue, 16 May 2023 01:17:59 GMT
web.js
ads.celtra.com/57813faf/ Frame D9F4 		14 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ads.celtra.com/57813faf/web.js?&clickUrl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsuu69tBsK7KduTlUkECxHWeUaS1HbfQb45f92re8u15H6Lmlv_Pz8fkmPS6csXMT6VVh-G7UymHlTItVdCb3D2i2oxQ1rEYifDPZAyrdzphfImqqQr_8KSZRUHOY1nGyu4DjpG34gqnpVaaU5mXYAqBnUDFQw4KqThuq80yuymkMsWFmZmZHh5yDpxK8dqaep2OyPxqDHVgSy9g-WfvPiEytECapI0-TFXh78AMIgVK8_oR_x0aRAWXEw-ExRcY5WgRcmmDVwyxqdYnzmNXq9PaAOkCZHwIMas5kimLZ_jvUUyGr0jINDNkiFRXZaIv6m5sEgxapAxFXk-dl17FDuHnHsYUrqQ%26sig%3DCg0ArKJSzGUsyFFyJEDlEAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26adurl%3D&expandDirection=undefined&clickEvent=advertiser&iosAdvId=&androidAdvId=&externalAdServer=DFPPremium&tagVersion=html-standard-7&eas.JWVjaWQh=138385472699&externalCreativeId=138385472699&externalPlacementId=22340016856&externalSiteId=22316126855&externalSiteName=darkreading.com&externalLineItemId=5909690628&externalCampaignId=2978231009&externalAdvertiserId=5124257703&coppa=0&scriptId=celtra-script-1&clientTimestamp=1652889825.855&clientTimeZoneOffsetInMinutes=0&hostPageLoadId=1885522647708704
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
35.170.140.102 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-35-170-140-102.compute-1.amazonaws.com
Software
/
Resource Hash
f467e430af661e2bade60598d2e92dff4712e07b30a9ec5b04ce2f44e6c72434

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 18 May 2022 16:03:45 GMT
content-encoding
gzip
Content-Type
application/javascript; charset=utf-8
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
4704
Expires
0
runner.html
tpc.googlesyndication.com/sodar/sodar2/225/ Frame 67E7 		13 KB
5 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::2001 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

accept-ranges
bytes
age
28616
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
public, max-age=31536000
content-encoding
gzip
content-length
5046
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="adspam-signals-scs"
cross-origin-resource-policy
cross-origin
date
Wed, 18 May 2022 08:06:49 GMT
expires
Thu, 18 May 2023 08:06:49 GMT
last-modified
Mon, 21 Jun 2021 20:47:05 GMT
report-to
{"group":"adspam-signals-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/adspam-signals-scs"}]}
server
sffe
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
aframe
www.google.com/recaptcha/api2/ Frame 0F8C 		783 B
536 B 		Document
General
Check archive.org
Download Go to
Full URL
https://www.google.com/recaptcha/api2/aframe
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:806::2004 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
7551cf70806b4962a75f55d66047e9a5c2ce0510f69b83c47024bcc23693c3a0
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-XGSkPStadSWRG3fKXOACPw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.darkreading.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
cache-control
private, max-age=300
content-encoding
gzip
content-length
514
content-security-policy
script-src 'report-sample' 'nonce-XGSkPStadSWRG3fKXOACPw' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-resource-policy
cross-origin
date
Wed, 18 May 2022 16:03:45 GMT
expires
Wed, 18 May 2022 16:03:45 GMT
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server
GSE
x-content-type-options
nosniff
x-xss-protection
1; mode=block
truncated
/ Frame C435 		211 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
35e0f79b3ddcc374c2be181d1b34f9d3c44d2743421cfbcdf326851ef7f94cd7

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type
image/png
tag.aspx
ml314.com/ Frame C435 		31 KB
31 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ml314.com/tag.aspx?1842022
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/pentonmedia53440730609/moatad.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.111.234.236 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
236.234.111.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
75d893335a1d25db1bf02e25ab904d97a3af743128850d8566b93d197e56e9e9

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:19 GMT
age
26
x-guploader-uploadid
ADPycduZVLrg_liGuIJdU4W42Bz68-MutruLf2GRtWamnrG452O0uEkAO4lJGZPgF5PvTzNXWQ8fpdnnWXypKROQulKvng
x-goog-storage-class
STANDARD
x-goog-metageneration
1
x-goog-stored-content-encoding
identity
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
32025
last-modified
Mon, 04 Apr 2022 15:43:44 GMT
server
UploadServer
cache-control
public,max-age=3600
etag
"25b1f355dd487bdf5381a749056080c4"
x-goog-hash
crc32c=dPpbog==, md5=JbHzVd1Ie99TgadJBWCAxA==
x-goog-generation
1649087024620619
cache-id
YUL-7d0cee4c
x-cache-hit
hit
x-goog-stored-content-length
32025
accept-ranges
bytes
content-type
application/javascript
n.js
geo.moatads.com/ 		113 B
287 B 		Script
General
Check archive.org
Download Go to
Full URL
https://geo.moatads.com/n.js?e=35&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CI%24%3D!Iv*Ebj.JGfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7B%2CNr1U*%26ujMUU9%3C%24kBjqI&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rb=2-LUS3hkIJ33cxUahFibJNuf9eBEDDlqciElgdmM6rBhY%3D&rs=1-5ZHC8H1EcQEJWg%3D%3D&sc=1&os=1-3g%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oDgO%3DLlE6%3ABcmUZzCFV%60pT6yv%7CEkUpF%3D3%3Ch%2C%25%3BMB1_tNOC%604dEzbSIq11_iCTpXSe%2BShooUKV%3B%2B9%7CPQPmf)P%3DH%3BCH%6029YCN%3FAbcE%3DX7IL3kQ%2CNJJ)%2Cc%7ClTr1W*d%5B4kf%2FLyUoRdByZ%3C99Ksf%2FLyUo0)H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&i=PENTONMEDIA1&hp=1&wf=1&ra=1&pxm=6&sgs=3&vb=9&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1652889825919&de=890423079164&m=0&ar=8d467bec877-clean&iw=d3fc7f9&q=2&cb=0&ym=0&cu=1652889825919&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=17506827%3A2990021191%3A5940610987%3A138392437444&zMoatPS=welcome_v&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&zMoatDev=Desktop&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&id=1&ii=4&bo=22316126855&bp=22340016856&bd=welcome_v&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22340016856&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22340016856&gw=pentonmedia53440730609&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A400%3A-%3A2606%3A534&iq=na&tt=na&fs=198321&na=1205903048&cs=0&callback=MoatDataJsonpRequest_55194081
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/pentonmedia53440730609/moatad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.217.19.184 Columbus, United States, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-217-19-184.us-east-2.compute.amazonaws.com
Software
Microsoft-IIS/6.0 /
Resource Hash
6e8ff90d8ddc47f7854a26b6a4dc1ec0df053ee96e5b609902eb00acf57c2f40

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:46 GMT
cache-control
max-age=900
server
Microsoft-IIS/6.0
timing-allow-origin
*
etag
"24b51bb00751dce8a84dbd9edcc4110cec5e3e83"
content-length
113
content-type
text/html; charset=UTF-8
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=17&i=PENTONMEDIA1&hp=1&wf=1&ra=1&pxm=6&sgs=3&vb=9&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1652889825919&de=890423079164&m=0&ar=8d467bec877-clean&iw=d3fc7f9&q=3&cb=0&ym=0&cu=1652889825919&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=17506827%3A2990021191%3A5940610987%3A138392437444&zMoatPS=welcome_v&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&zMoatDev=Desktop&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&id=1&ii=4&bo=22316126855&bp=22340016856&bd=welcome_v&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22340016856&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22340016856&gw=pentonmedia53440730609&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A400%3A-%3A2606%3A534&iq=na&tt=na&fs=198321&na=730569728&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:46 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Wed, 18 May 2022 16:03:46 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame EC4B 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvdZoJsmzfM5ox9Fp5fpveWjduAVBD1--Nj6Y5QqAkBczm2YM-GzKuzWX7TDN7FG4tiuP5c1XLJPCABurTxC6Bl1evE7kTE7tOKUdFEe-OhB7ea2APmtTfvTwFAZnV-yrMyXesuJvUQYRBDtH_WN4B6YjcgJpBhcHc9QEk7aubQVcEjfS6sr6xP_fg4J_hfO3skQwKfDCiCiINuREmH2hVL6CbhzVaIdXeBTDBm3ilglGDX8xTMABgkYazUQyXF5drAjxm4FF5P0zWgXpAcpEKiddBsxjO3ylvwDR6yVKn4dLFEVTsztLBfxfLayvXH3jWDZ6iTWFGcG05podOHxm8HD0f0iSzAJJuMCQ&sig=Cg0ArKJSzHACx92FnV4AEAE&uach_m=[UACH]&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.40.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s79-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 18 May 2022 16:03:46 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Wed, 18 May 2022 16:03:46 GMT
truncated
/ Frame D9F4 		212 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
3ef202e41d4e186d964382aa64cc2dc272a97faa390adb7130c4bc5089a44a47

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame EC4B 		211 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b25cde37aab2239b45212ac87c3eafdafca9275dd9bde878d9f93c180bdc5bcc

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame 8036 		214 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
434165aad32c85a1086d1e782f3f3321301361486b79064d1265207e07b09732

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type
image/png
view
securepubads.g.doubleclick.net/pcs/ Frame C435 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsv4HTNcExgSQdPD7MyvPP2g5d1Is-4igGAA8sKw9tEslr5xOKEdhiXitFmHX7RbZhR6Us1yimfokLh54ZqaWDAIHuhoey0llbMoGD16fc_JOCoFJI-Flx0lCKIS1qBi0EKuIB-K-HE5orsdLI6axz_IyOOaNyhkcLanp5DQwWcneoB-GfFYGkvwNiaASYUZGX5rs2AKRYEknI87-1sFw63tObj6Ylcnvm6mGKmTkw0WJKpHSG2ua5TSicByCAyc33SssG1aJeJtpYyQ5c0C2J4IMtiCQPeLkKP6nAGHQ-dNDA0_Kekl7krHyi4ZNGsVKOrjU9rVP1JSV8kpsV0ANrH-apq-i8zTRFYOGbjCUv4t&sig=Cg0ArKJSzDY0QXZsbLE2EAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.40.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s79-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 18 May 2022 16:03:46 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Wed, 18 May 2022 16:03:46 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame D744 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssNpFbBbAbOwjRCpx37EjUnOXw3BNfTfQJasNAnxyK6xoJE1PXnBrGtJFWZyMYetvW2IVat00lUV3qDwCWv9k8C8sG9Lwmkbp3G0MIwx6WBwlKE4bVKrS6pRwTPrf95Ft93ceA_R5z3s4JWqZw0qLQj-9ACsb5aV0iQ68DoS41dUHpw2UEOnuW7SjwNzJPiBRYO5YT51AF20dCOaFD8v5GlBHZ7ZrOGF_ewIHf8y4-l9zAFnSajkXwVb2qzIwgddMy4mMYHyrL39W66QHZJL47JST8ld-kQaQX9cmjcHiweQL6TN5tOyp9aDSxMHvp4sZGuUUMA6jeGos7-j3bvorByhrN3b-A0VsmtoQ&sig=Cg0ArKJSzC3iec6jU4FNEAE&uach_m=[UACH]&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.40.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s79-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 18 May 2022 16:03:46 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Wed, 18 May 2022 16:03:46 GMT
truncated
/ Frame D744 		215 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
92f01876c6d6366b6478537794c054d8cfd673c1b4b4989fd54bb0b432e266aa

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type
image/png
teads-format.min.js
a.teads.tv/media/format/v3/ 		599 KB
131 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://a.teads.tv/media/format/v3/teads-format.min.js
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.200.197.46 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-200-197-46.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
314343de4ec0e06d19e192d041f8f11ad56414b312d045bfa3f87aa038c665a5

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Wed, 18 May 2022 16:03:46 GMT
content-encoding
br
last-modified
Mon, 16 May 2022 13:23:47 GMT
x-amz-request-id
AQ89J3PMR2CNNZCF
etag
"7f4539fd7b0db71b1f348a332d0b7f39"
vary
Accept-Encoding
content-type
text/javascript;charset=utf-8
cache-control
private, must-revalidate, max-age=1800, no-transform
x-bucket
1
accept-ranges
bytes
content-length
133959
x-amz-id-2
js31yQOVxgIJqtR0qTNLzlQ2TmeFwfaw8qIqOJodMByksqCrSRIFIQMPAWmNFPHwgXJGpYyrLOI=
expires
Wed, 18 May 2022 16:33:46 GMT
utsync.ashx
ml314.com/ Frame C435 		641 B
664 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=62439&ct=js&pi=3627294074409582600&fp=&clid=&if=1&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&pv=1652889826216_apgjesyck&bl=en-us&cb=4600169&return=&ht=&d=&dc=&si=1652889825049_fii83xggv&cid=&s=1600x1200&rp=&v=2.5.1.2
Requested by
Host: ml314.com
URL: https://ml314.com/tag.aspx?1842022
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
34.111.234.236 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
236.234.111.34.bc.googleusercontent.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
437b4f1f0bd6b264f51e7a09f666e2c01eef941f4066086fc4a697e674c82f8a

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:45 GMT
via
1.1 google
server
Microsoft-IIS/10.0
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
p3p
CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
cache-control
private
content-type
application/javascript; charset=utf-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
641
expires
0
ud.ashx
in.ml314.com/ Frame C435 		20 B
482 B 		Script
General
Check archive.org
Download Go to
Full URL
https://in.ml314.com/ud.ashx?topiclimit=&cb=1842022&v=2.5.1.2
Requested by
Host: ml314.com
URL: https://ml314.com/tag.aspx?1842022
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.211.26.76 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-211-26-76.compute-1.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Wed, 18 May 2022 16:03:46 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Cache-Control
public
Connection
keep-alive
Content-Length
138
Expires
Thu, 19 May 2022 16:03:46 GMT
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=17&i=PENTONMEDIA1&hp=1&wf=1&ra=1&pxm=6&sgs=3&vb=9&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1652889826094&de=799441917199&m=0&ar=8d467bec877-clean&iw=d3fc7f9&q=7&cb=0&ym=0&cu=1652889826094&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=5124257703%3A2978231009%3A5909690628%3A138385472699&zMoatPS=300_1v&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&zMoatDev=Desktop&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&id=1&ii=4&bo=22316126855&bp=22340016856&bd=300_1v&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22340016856&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22340016856&gw=pentonmedia53440730609&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A400%3A2914%3A2606%3A534&iq=na&tt=na&fs=198321&na=2077879489&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:46 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Wed, 18 May 2022 16:03:46 GMT
web.js
cache-ssl.celtra.com/api/creatives/55ed7658/compiled/ Frame D9F4 		630 KB
140 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cache-ssl.celtra.com/api/creatives/55ed7658/compiled/web.js?v=35-1d0fe298c7&secure=1&cachedVariantChoices=W10-&isPurposePreview=0&eventMetadataExperiment=newMeta&inmobi=0&adx-in-banner-video=1
Requested by
Host: ads.celtra.com
URL: https://ads.celtra.com/57813faf/web.js?&clickUrl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsuu69tBsK7KduTlUkECxHWeUaS1HbfQb45f92re8u15H6Lmlv_Pz8fkmPS6csXMT6VVh-G7UymHlTItVdCb3D2i2oxQ1rEYifDPZAyrdzphfImqqQr_8KSZRUHOY1nGyu4DjpG34gqnpVaaU5mXYAqBnUDFQw4KqThuq80yuymkMsWFmZmZHh5yDpxK8dqaep2OyPxqDHVgSy9g-WfvPiEytECapI0-TFXh78AMIgVK8_oR_x0aRAWXEw-ExRcY5WgRcmmDVwyxqdYnzmNXq9PaAOkCZHwIMas5kimLZ_jvUUyGr0jINDNkiFRXZaIv6m5sEgxapAxFXk-dl17FDuHnHsYUrqQ%26sig%3DCg0ArKJSzGUsyFFyJEDlEAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26adurl%3D&expandDirection=undefined&clickEvent=advertiser&iosAdvId=&androidAdvId=&externalAdServer=DFPPremium&tagVersion=html-standard-7&eas.JWVjaWQh=138385472699&externalCreativeId=138385472699&externalPlacementId=22340016856&externalSiteId=22316126855&externalSiteName=darkreading.com&externalLineItemId=5909690628&externalCampaignId=2978231009&externalAdvertiserId=5124257703&coppa=0&scriptId=celtra-script-1&clientTimestamp=1652889825.855&clientTimeZoneOffsetInMinutes=0&hostPageLoadId=1885522647708704
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.116 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-116.ewr53.r.cloudfront.net
Software
Apache /
Resource Hash
15c474dcecd282ae20f40c139a2ea28ea8cfed61453757b9c1d6c30452a0649a

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Tue, 17 May 2022 09:20:14 GMT
content-encoding
gzip
age
110610
x-cache
Hit from cloudfront
content-length
142481
access-control-allow-origin
*
server
Apache
etag
"8d1d47cf6ba45da03e0fd133d7d9409ae627d9175d687faf97d0513d9151d8ea"
vary
Accept-Encoding
x-varnish
1343893 1802711
via
1.1 varnish (Varnish/6.2), 1.1 ae9634deb2e9d6f8d396fc6f1e0586fa.cloudfront.net (CloudFront)
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=31556926
access-control-allow-credentials
false
x-amz-cf-pop
EWR53-P1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
A19zwSee7wQ7sMzDlXhgvKli5SefdCzH98PflyM8prqYoQmhqiEU5g==
truncated
/ Frame D9F4 		167 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d26432e661658ef9d3d538b1f71b1478193f6c141f1cd7dfed03e5b677d178c2

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type
image/png
95e5bc03-14b6-4c85-bc4a-efbc44fd2ffe
https://www.darkreading.com/ Frame D9F4 		167 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
blob:https://www.darkreading.com/95e5bc03-14b6-4c85-bc4a-efbc44fd2ffe
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d26432e661658ef9d3d538b1f71b1478193f6c141f1cd7dfed03e5b677d178c2

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Length
167
Content-Type
image/png
view
securepubads.g.doubleclick.net/pcs/ Frame 8036 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvSIbBypnichKiJjbQyiUB-dXxThU4WbhZRIGoREdyCB9DuIYbSKrXwXEz0Voo9ZK1y5G_Sv2FSHNRd9_VT5iFelZPvGld4c-Ye65M9LnNrQJ2T0PNvI6mJD0dSHZehXrgWMdKuERvjIzaFg1Yf8Um6MTJ5NfV6l_73iNXvbV8kGnpKMGujzt0MvYXP5736lXpGOsCzf8OFnkGuTSYRPMQEYtP1KMTAJwIwUYujMPTsHVWO6sekoqwNpLM95kmuuEdcmc4yvoB8_GX6e1v5wmyCPOV0DgZFEJgCxZrencWPIPKbFul4BCowa7G_YCS1Kr0I-pm6Vb1HxfLUByzbF2h_HvtJYJE8&sig=Cg0ArKJSzGTKIwUmsYHnEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.40.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s79-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 18 May 2022 16:03:46 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Wed, 18 May 2022 16:03:46 GMT
sodar
pagead2.googlesyndication.com/pagead/ Frame 0F8C 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&li=gpt_2022051201&jk=3504935758733139&rc=
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81e::2002 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.google.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=17&i=PENTONMEDIA1&hp=1&wf=1&ra=1&pxm=6&sgs=3&vb=9&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1652889826127&de=710875480260&m=0&ar=8d467bec877-clean&iw=d3fc7f9&q=11&cb=0&ym=0&cu=1652889826127&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=4448790601%3A2827245798%3A5674929725%3A138347225724&zMoatPS=video_v&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&zMoatDev=Desktop&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&id=1&ii=4&bo=22316126855&bp=22340016856&bd=video_v&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22340016856&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22340016856&gw=pentonmedia53440730609&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A400%3A2914%3A2606%3A534&iq=na&tt=na&fs=198321&na=325703727&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:46 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Wed, 18 May 2022 16:03:46 GMT
NhRng2ZenZRcaPRuU0zAmqgyTOhBGXWeehn8uWk0bEI.js
pagead2.googlesyndication.com/bg/ Frame 67E7 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/bg/NhRng2ZenZRcaPRuU0zAmqgyTOhBGXWeehn8uWk0bEI.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81e::2002 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
36146783665e9d945c68f46e534cc09aa8324ce84119759e7a19fcb969346c42
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 01:36:57 GMT
content-encoding
br
x-content-type-options
nosniff
age
52009
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
13698
x-xss-protection
0
last-modified
Mon, 09 May 2022 12:18:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="botguard-scs"
vary
Accept-Encoding
report-to
{"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Thu, 18 May 2023 01:36:57 GMT
csync.ashx
ml314.com/ Frame C435
Redirect Chain
  • https://pixel.mathtag.com/sync/img?redir=https://ml314.com/csync.ashx%3Ffp=[MM_UUID]%26person_id=3627294074409582600%26eid=50220
  • https://ml314.com/csync.ashx?fp=4dde6285-18e2-4100-9567-6c40bf510df2&person_id=3627294074409582600&eid=50220
43 B
60 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ml314.com/csync.ashx?fp=4dde6285-18e2-4100-9567-6c40bf510df2&person_id=3627294074409582600&eid=50220
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H3
Server
34.111.234.236 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
236.234.111.34.bc.googleusercontent.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:46 GMT
via
1.1 google
server
Microsoft-IIS/10.0
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
content-type
image/gif
cache-control
private
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Thu, 19 May 2022 12:03:46 GMT

Redirect headers

Date
Wed, 18 May 2022 16:03:46 GMT
Server
MT3 4409 ba5503e master iad-pixel-x21 config:1.0.0
Access-Control-Allow-Origin
*
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Location
https://ml314.com/csync.ashx?fp=4dde6285-18e2-4100-9567-6c40bf510df2&person_id=3627294074409582600&eid=50220
Cache-Control
no-cache
Connection
keep-alive
Content-Type
image/gif
Content-Length
0
Expires
Wed, 18 May 2022 16:03:45 GMT
csync.ashx
ml314.com/ Frame C435
Redirect Chain
  • https://tags.bluekai.com/site/20486?limit=0&id=3627294074409582600&redir=https://ml314.com/csync.ashx%3Ffp=$_BK_UUID%26person_id=3627294074409582600%26eid=50056
  • https://ml314.com/csync.ashx?fp=$_BK_UUID&person_id=3627294074409582600&eid=50056
43 B
60 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ml314.com/csync.ashx?fp=$_BK_UUID&person_id=3627294074409582600&eid=50056
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H3
Server
34.111.234.236 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
236.234.111.34.bc.googleusercontent.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:45 GMT
via
1.1 google
server
Microsoft-IIS/10.0
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
content-type
image/gif
cache-control
private
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Thu, 19 May 2022 12:03:46 GMT

Redirect headers

Location
https://ml314.com/csync.ashx?fp=$_BK_UUID&person_id=3627294074409582600&eid=50056
Date
Wed, 18 May 2022 16:03:46 GMT
Connection
keep-alive
Content-Length
0
P3P
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
csync.ashx
ml314.com/ Frame C435
Redirect Chain
  • https://ib.adnxs.com/getuid?https://ml314.com/csync.ashx%3Ffp=$UID%26person_id=3627294074409582600%26eid=2
  • https://ml314.com/csync.ashx?fp=4008352111651074917&person_id=3627294074409582600&eid=2
43 B
60 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ml314.com/csync.ashx?fp=4008352111651074917&person_id=3627294074409582600&eid=2
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H3
Server
34.111.234.236 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
236.234.111.34.bc.googleusercontent.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:45 GMT
via
1.1 google
server
Microsoft-IIS/10.0
x-aspnet-version
4.0.30319
x-powered-by
ASP.NET
content-type
image/gif
cache-control
private
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
expires
Thu, 19 May 2022 12:03:46 GMT

Redirect headers

Pragma
no-cache
Date
Wed, 18 May 2022 16:03:46 GMT
X-Proxy-Origin
149.56.153.183; 149.56.153.183; 674.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
AN-X-Request-Uuid
2eeae79e-fb8e-444e-b672-f4d2e23215b3
Server
nginx/1.21.3
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://ml314.com/csync.ashx?fp=4008352111651074917&person_id=3627294074409582600&eid=2
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
match
ps.eyeota.net/ Frame C435
Redirect Chain
  • https://ps.eyeota.net/pixel?pid=r8hrb20&t=gif
  • https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm&google_sc&google_hm=MnZPSFdDTWY3NldST3ltRmVpVjZDNUktTFlhOEtzcWp5MUJFZDNKY1pSVTA&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer...
  • https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=r8hrb20&google_gid=CAESENoWp8gJmAZ_DXDHfvJtgV8&google_cver=1
70 B
440 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=r8hrb20&google_gid=CAESENoWp8gJmAZ_DXDHfvJtgV8&google_cver=1
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
HTTP/1.1
Server
52.55.144.0 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-55-144-0.compute-1.amazonaws.com
Software
/
Resource Hash
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Wed, 18 May 2022 16:03:46 GMT
Content-Type
image/gif
Content-Length
70
P3P
CP="CURa ADMa DEVa TAIo PSAo PSDo OUR SAMo BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR", policyref="http://ps.eyeota.net/w3c/p3p.xml"

Redirect headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:46 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&referrer_pid=r8hrb20&google_gid=CAESENoWp8gJmAZ_DXDHfvJtgV8&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
375
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ContentPillar_Welcome_1200.png
www.darkreading.com/sites/all/themes/penton_core_theme/images/ Frame C435 		119 KB
119 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.darkreading.com/sites/all/themes/penton_core_theme/images/ContentPillar_Welcome_1200.png
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7763 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
7ea4e2110179c11f2b787e11455b0755011bbea4ad0744385b4ad18dfeaa6337
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:46 GMT
content-encoding
br
cf-cache-status
MISS
server
cloudflare
x-powered-by
ASP.NET
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/html
cache-control
public, max-age=7200
strict-transport-security
max-age=63072000; includeSubDomains
cf-ray
70d5d326c995ca47-YUL
expires
Wed, 18 May 2022 18:03:46 GMT
NRJS-4eee28fd5f21ed85217
bam.eu01.nr-data.net/events/1/ 		24 B
873 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://bam.eu01.nr-data.net/events/1/NRJS-4eee28fd5f21ed85217?a=256687733&sa=1&v=1212.e95d35c&t=Unnamed%20Transaction&rst=3372&ck=1&ref=https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
185.221.87.248 , Ireland, ASN206998 (NEW-2, IE),
Reverse DNS
Software
cloudflare /
Resource Hash
0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300

Request headers

Referer
https://www.darkreading.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
content-type
text/plain

Response headers

Date
Wed, 18 May 2022 16:03:46 GMT
CF-Cache-Status
DYNAMIC
NEL
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
Server
cloudflare
Expect-CT
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
Vary
Accept-Encoding
access-control-allow-methods
GET, POST, PUT, HEAD, OPTIONS
Content-Type
image/gif
Access-Control-Allow-Origin
https://www.darkreading.com
Report-To
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=G5Ne6dPezNFEvkjZSJ6796g%2F5Wt5H4910HwNNOMhiPzw8cL%2B98CuMx6cwbT%2F66nXr6Jxd3UUZc4cdBHLg2BokGQCl9%2FCYrZx1WjayjDlTvu8YhIY6MxSybpuSWNXNU7Kw7GxlbfX"}],"group":"cf-nel","max_age":604800}
access-control-allow-credentials
true
x-envoy-upstream-service-time
1
Connection
keep-alive
CF-Ray
70d5d326ec77a204-YYZ
Content-Length
24
track
t.teads.tv/ 		23 B
113 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t.teads.tv/track?action=placementCall&env=js-web&auctid=9b3a6b04-52a1-4dd4-9bc4-94098175937f&pageId=130102&pid=142873&debug_metadata=dL5xPDELaE&fv=1038&ts=1652889826423&f=1&referer=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.164.7 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-164-7.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:46 GMT
cache-control
private, max-age=3666
content-length
23
content-type
image/gif
track
t.teads.tv/ 		23 B
143 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t.teads.tv/track?action=slotAvailable&env=js-web&auctid=9b3a6b04-52a1-4dd4-9bc4-94098175937f&pageId=130102&pid=142873&slot=polymorph&fv=1038&ts=1652889826431&f=1&referer=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.164.7 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-164-7.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:46 GMT
cache-control
max-age=0, no-cache, no-store
expires
Sat, 26 Jul 1997 05:00:00 GMT
content-length
23
content-type
image/gif
ad
a.teads.tv/page/130102/ 		15 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://a.teads.tv/page/130102/ad?windowWidth=1600&windowHeight=1200&windowDepth=1&windowReferrerUrl=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&page=%7B%22id%22%3A130102%2C%22placements%22%3A%5B%7B%22id%22%3A142873%2C%22validity%22%3A%7B%22status%22%3Atrue%2C%22reasons%22%3A%5B%5D%7D%2C%22player%22%3A%7B%22width%22%3A646%2C%22height%22%3A363%7D%2C%22slotType%22%3A%22polymorph%22%7D%5D%2C%22gdpr_iab%22%3A%7B%22reason%22%3A220%2C%22status%22%3A22%2C%22consent%22%3A%22%22%2C%22apiVersion%22%3Anull%2C%22cmpId%22%3Anull%7D%2C%22segments%22%3A%7B%22permutive%22%3Anull%7D%2C%22first_party_data%22%3A%7B%22firstPartyCookieTeadsId%22%3Anull%2C%22sharedIds%22%3Anull%7D%7D&auctid=9b3a6b04-52a1-4dd4-9bc4-94098175937f&formatVersion=1038&env=js-web&netBw=9.3&ttfb=99
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.200.197.46 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-200-197-46.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
8134e989e666a36aa96b14343a5a0be5cbf846fe98b2e8d16d73a1a4b3e98f7c

Request headers

Accept
application/json; charset=UTF-8
Referer
https://www.darkreading.com/
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:46 GMT
content-encoding
gzip
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://www.darkreading.com
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
content-length
3230
expires
Wed, 18 May 2022 16:03:46 GMT
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=17&i=PENTONMEDIA1&hp=1&wf=1&ra=1&pxm=6&sgs=3&vb=9&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1652889826136&de=394534657226&m=0&ar=8d467bec877-clean&iw=d3fc7f9&q=15&cb=0&ym=0&cu=1652889826136&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=4954976792%3A2914620160%3A5800261410%3A138383383812&zMoatPS=728_1v&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&zMoatDev=Desktop&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&id=1&ii=4&bo=22316126855&bp=22340016856&bd=728_1v&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22340016856&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22340016856&gw=pentonmedia53440730609&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A400%3A2914%3A2606%3A534&iq=na&tt=na&fs=198321&na=2103307133&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:46 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Wed, 18 May 2022 16:03:46 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame D9F4 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstb6iCjgL6pKExmAzpOXmOZEYjelPIMlsViJC1e5BvD7-JOVXwP3JDh8WFmlz4r38DiC9k6c6skUDjzaiHn-m7-LK24qFxeZOyA49FVZZmnIneZsvYqNw1OMX9Cs08msN7qk15pgD3n9myFDJ6dO4coev9c0v9zPvFmUeJ954te8PnZilcK4w7r5_bRaTxKsI_aKfnBA234h_ljxRgOl_SP8qcRLVkk0FQitqxPoLNrxVqRtCstAhgo-RifIsr8XSw3ov1UAtgRFqts1Fk0jXUMiU7DJWILC4WnqtBDqRpw7sBGkBkmCBygsRdoZOIcjYCAnbD50PPlAGdxfpp0VZ_TZ6uAPuBzvNxOpg&sig=Cg0ArKJSzDLQuDzo5SQpEAE&uach_m=[UACH]&urlfix=1&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.40.98 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s79-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

timing-allow-origin
*
date
Wed, 18 May 2022 16:03:46 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Wed, 18 May 2022 16:03:46 GMT
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&wf=1&ra=1&pxm=6&sgs=3&vb=9&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=0&ak=https%3A%2F%2Ftpc.googlesyndication.com%2Fsimgad%2F17233809508354857735&i=PENTONMEDIA1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CI%24%3D!Iv*Ebj.JGfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7B%2CNr1U*%26ujMUU9%3C%24kBjqI&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rb=2-LUS3hkIJ33cxUahFibJNuf9eBEDDlqciElgdmM6rBhY%3D&rs=1-5ZHC8H1EcQEJWg%3D%3D&sc=1&os=1-3g%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oDgO%3DLlE6%3ABcmUZzCFV%60pT6yv%7CEkUpF%3D3%3Ch%2C%25%3BMB1_tNOC%604dEzbSIq11_iCTpXSe%2BShooUKV%3B%2B9%7CPQPmf)P%3DH%3BCH%6029YCN%3FAbcE%3DX7IL3kQ%2CNJJ)%2Cc%7ClTr1W*d%5B4kf%2FLyUoRdByZ%3C99Ksf%2FLyUo0)H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&bq=0&g=0&h=90&w=728&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&id=1&ii=4&f=0&j=&t=1652889826136&de=394534657226&cu=1652889826136&m=18&ar=8d467bec877-clean&iw=d3fc7f9&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4251&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A400%3A2914%3A2606%3A534&as=0&ag=3&an=0&gf=3&gg=0&ix=3&ic=3&ez=1&aj=1&pg=100&pf=0&ib=0&cc=0&bw=3&bx=0&dj=1&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=0&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=6&cd=0&ah=6&am=0&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=4954976792%3A2914620160%3A5800261410%3A138383383812&bo=22316126855&bp=22340016856&bd=728_1v&zMoatPS=728_1v&gw=pentonmedia53440730609&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22340016856&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22340016856&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&zMoatDev=Desktop&zMoatDfpSlotId=6_jdwtkavrt3000000jdwtkavrt3000000jdw&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=6_jdwtkavrt3000000jdwtkavrt3000000jdw&iq=na&tt=na&tc=0&fs=198321&na=1506390962&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:46 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Wed, 18 May 2022 16:03:46 GMT
eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNjUyODg5ODI1eGI1NTY4MmY2NDhiYjUzeDI3MjAwMTk2IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIxNjI2MTY2MTI0MzkyNTA1MiIsImluZGV4I...
track.celtra.com/json/ 		35 B
242 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNjUyODg5ODI1eGI1NTY4MmY2NDhiYjUzeDI3MjAwMTk2IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIxNjI2MTY2MTI0MzkyNTA1MiIsImluZGV4IjowLCJjbGllbnRUaW1lc3RhbXAiOjE2NTI4ODk4MjYuNTE5LCJuYW1lIjoiY29udGFpbmVyQmVjYW1lVmlld2FibGUifV19?crc32c=446440238
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.172.30.83 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-172-30-83.compute-1.amazonaws.com
Software
/
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 18 May 2022 16:03:46 GMT
Cache-Control
no-cache, no-store, must-revalidate
Expires
0
Connection
keep-alive
Content-Length
35
Content-Type
image/gif
iframe
sync.teads.tv/ Frame 0B1C 		2 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://sync.teads.tv/iframe?pid=142873&gdprIab={%22reason%22:220,%22status%22:22,%22consent%22:%22%22,%22apiVersion%22:null,%22cmpId%22:null}&fromFormat=true&env=js-web&auctid=9b3a6b04-52a1-4dd4-9bc4-94098175937f&vid=eed3fd5c-407f-43bf-8415-729de81fdb8a&1652889826570
Requested by
Host: beta.darkreading.com
URL: https://beta.darkreading.com/js/newrelic-browser.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.195.109.72 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-195-109-72.deploy.static.akamaitechnologies.com
Software
akka-http/10.2.7 /
Resource Hash
6fbc242e6492c6c2be0e0e965f32cc564b088e8b9b54f4b5c552b2be35066619

Request headers

Referer
https://www.darkreading.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
accept-language
en-CA,en;q=0.9

Response headers

cache-control
max-age=0, no-cache, no-store
content-encoding
gzip
content-length
665
content-type
text/html; charset=UTF-8
date
Wed, 18 May 2022 16:03:46 GMT
expires
Wed, 18 May 2022 16:03:46 GMT
pragma
no-cache
server
akka-http/10.2.7
vary
Accept-Encoding
track
t.teads.tv/ 		23 B
143 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t.teads.tv/track?action=adReceived&env=js-web&auctid=9b3a6b04-52a1-4dd4-9bc4-94098175937f&pageId=130102&pid=142873&slot=polymorph&vid=eed3fd5c-407f-43bf-8415-729de81fdb8a&pfid=1&fv=1038&ts=1652889826573&f=1&referer=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.164.7 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-164-7.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:46 GMT
cache-control
max-age=0, no-cache, no-store
expires
Sat, 26 Jul 1997 05:00:00 GMT
content-length
23
content-type
image/gif
truncated
/ 		669 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
35463ce93e7c820faa404db98d939ff640ae78ca0e29be043861853c9e07c586

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type
image/svg+xml
truncated
/ Frame 2968 		669 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
35463ce93e7c820faa404db98d939ff640ae78ca0e29be043861853c9e07c586

Request headers

accept-language
en-CA,en;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Content-Type
image/svg+xml
player-sprite.svg
a.teads.tv/media/format/v3/assets/default/ Frame 2968 		9 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a.teads.tv/media/format/v3/assets/default/player-sprite.svg
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.200.197.46 Piscataway, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-200-197-46.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
3ba7f40e2b4080979389e9b81e6d0ed155e9b7f74b3310bc1289ee70cba2035d

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:46 GMT
content-encoding
gzip
last-modified
Tue, 15 Feb 2022 08:41:20 GMT
x-amz-request-id
8WASEDDYXWT7HQ14
etag
"6a80cb691946e09ba579b0f8456aae28"
vary
Accept-Encoding
content-type
image/svg+xml
cache-control
private, must-revalidate, max-age=16070400
x-bucket
e
content-length
3379
accept-ranges
bytes
x-datastream-cache-status
2
x-amz-id-2
M4znMmm8kjKpUmuEnSHW05NBhKcvUxx/Bn0OkN0IzNSkj7K0yaVkCwnnXBktn7rd7T83kFW1Bp8=
expires
Sun, 20 Nov 2022 16:03:46 GMT
track
t.teads.tv/ 		23 B
143 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://t.teads.tv/track?action=adAvailable-success&env=js-web&auctid=9b3a6b04-52a1-4dd4-9bc4-94098175937f&pageId=130102&pid=142873&slot=polymorph&vid=eed3fd5c-407f-43bf-8415-729de81fdb8a&pfid=1&gid=710459&fv=1038&ts=1652889826633&f=1&referer=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.164.7 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-164-7.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:46 GMT
cache-control
max-age=0, no-cache, no-store
expires
Sat, 26 Jul 1997 05:00:00 GMT
content-length
23
content-type
image/gif
540_940.mp4
cdn2.teads.tv/scala/789231/d9e0f444644247bf94e7009f87e22c34/ Frame 8562 		316 KB
0 		Media
General
Check archive.org
Download Go to
Full URL
https://cdn2.teads.tv/scala/789231/d9e0f444644247bf94e7009f87e22c34/540_940.mp4
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.195.109.72 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-195-109-72.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash

Request headers

Referer
https://www.darkreading.com/
Accept-Encoding
identity;q=1, *;q=0
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36
Range
bytes=0-

Response headers

date
Wed, 18 May 2022 16:03:46 GMT
last-modified
Fri, 06 May 2022 21:06:52 GMT
server
AmazonS3
x-amz-request-id
20VFKM51DXEEATXD
etag
"398eccdea3c8ae49e9589458cb80fa2a"
content-type
video/mp4
Content-Range
bytes 0-3892510/3892511
cache-control
private, max-age=31536000
accept-ranges
bytes
access-control-allow-origin
*
Content-Length
3892511
x-amz-id-2
cKULHDgh6JW/7MaP04MjqfgSoOChjyhQL38CBiNefW1v3pTPWU8WyrwiQKAjQmqW/IxKdkwpb1M=
expires
Thu, 18 May 2023 16:03:46 GMT
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=17&i=PENTONMEDIA1&hp=1&wf=1&ra=1&pxm=6&sgs=3&vb=9&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1652889826179&de=251728430589&m=0&ar=8d467bec877-clean&iw=d3fc7f9&q=19&cb=0&ym=0&cu=1652889826179&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=5124257703%3A2978231009%3A5909690628%3A138385472861&zMoatPS=300_2v&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&zMoatDev=Desktop&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&id=1&ii=4&bo=22316126855&bp=22340016856&bd=300_2v&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22340016856&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22340016856&gw=pentonmedia53440730609&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A400%3A2914%3A2606%3A534&iq=na&tt=na&fs=198321&na=1032593235&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:46 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Wed, 18 May 2022 16:03:46 GMT
pixel
cm.g.doubleclick.net/ Frame 0B1C
Redirect Chain
  • https://sync.teads.tv/um?eid=3&fp=1&uid=&vid=eed3fd5c-407f-43bf-8415-729de81fdb8a&fb=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dteadstv_dbm%26google_hm%3D%5BVID_B64%5D&gdpr=0&gdpr_co...
  • https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=ZWVkM2ZkNWMtNDA3Zi00M2JmLTg0MTUtNzI5ZGU4MWZkYjhh
170 B
188 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=ZWVkM2ZkNWMtNDA3Zi00M2JmLTg0MTUtNzI5ZGU4MWZkYjhh
Requested by
Host: sync.teads.tv
URL: https://sync.teads.tv/iframe?pid=142873&gdprIab={%22reason%22:220,%22status%22:22,%22consent%22:%22%22,%22apiVersion%22:null,%22cmpId%22:null}&fromFormat=true&env=js-web&auctid=9b3a6b04-52a1-4dd4-9bc4-94098175937f&vid=eed3fd5c-407f-43bf-8415-729de81fdb8a&1652889826570
Protocol
H3
Server
142.251.35.162 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s78-in-f2.1e100.net
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sync.teads.tv/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:46 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:46 GMT
server
akka-http/10.2.7
content-type
text/html; charset=UTF-8
location
https://cm.g.doubleclick.net/pixel?google_nid=teadstv_dbm&google_hm=ZWVkM2ZkNWMtNDA3Zi00M2JmLTg0MTUtNzI5ZGU4MWZkYjhh
cache-control
max-age=0, no-cache, no-store
content-length
189
expires
Wed, 18 May 2022 16:03:46 GMT
um
sync.teads.tv/ Frame 0B1C
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=teads&ttd_tpi=1&gdpr=0&gdpr_consent=&_t=1652889826673
  • https://sync.teads.tv/um?eid=22&uid=34b50b2e-1c5e-4d58-86ca-d1813d53017f&gdpr=0&gdpr_consent=
23 B
172 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.teads.tv/um?eid=22&uid=34b50b2e-1c5e-4d58-86ca-d1813d53017f&gdpr=0&gdpr_consent=
Requested by
Host: sync.teads.tv
URL: https://sync.teads.tv/iframe?pid=142873&gdprIab={%22reason%22:220,%22status%22:22,%22consent%22:%22%22,%22apiVersion%22:null,%22cmpId%22:null}&fromFormat=true&env=js-web&auctid=9b3a6b04-52a1-4dd4-9bc4-94098175937f&vid=eed3fd5c-407f-43bf-8415-729de81fdb8a&1652889826570
Protocol
H2
Server
23.195.109.72 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-195-109-72.deploy.static.akamaitechnologies.com
Software
akka-http/10.2.7 /
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sync.teads.tv/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:46 GMT
cache-control
max-age=0, no-cache, no-store
expires
Wed, 18 May 2022 16:03:46 GMT
server
akka-http/10.2.7
content-length
23
content-type
image/gif

Redirect headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:46 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://sync.teads.tv/um?eid=22&uid=34b50b2e-1c5e-4d58-86ca-d1813d53017f&gdpr=0&gdpr_consent=
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
217
um
sync.teads.tv/ Frame 0B1C
Redirect Chain
  • https://dis.criteo.com/dis/usersync.aspx?r=79&p=145&cp=teads&cu=1&url=https%3A%2F%2Fsync.teads.tv%2Fum%3Ffp%3D1%26eid%3D80%26uid%3D%40%40CRITEO_USERID%40%40&gdpr=0&gdpr_consent=&_t=1652889826673
  • https://sync.teads.tv/um?fp=1&eid=80&uid=75ce90fb-6c80-4c61-b13b-22733d19063b&gdpr=0&gdpr_consent=
23 B
172 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.teads.tv/um?fp=1&eid=80&uid=75ce90fb-6c80-4c61-b13b-22733d19063b&gdpr=0&gdpr_consent=
Requested by
Host: sync.teads.tv
URL: https://sync.teads.tv/iframe?pid=142873&gdprIab={%22reason%22:220,%22status%22:22,%22consent%22:%22%22,%22apiVersion%22:null,%22cmpId%22:null}&fromFormat=true&env=js-web&auctid=9b3a6b04-52a1-4dd4-9bc4-94098175937f&vid=eed3fd5c-407f-43bf-8415-729de81fdb8a&1652889826570
Protocol
H2
Server
23.195.109.72 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-195-109-72.deploy.static.akamaitechnologies.com
Software
akka-http/10.2.7 /
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sync.teads.tv/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:46 GMT
cache-control
max-age=0, no-cache, no-store
expires
Wed, 18 May 2022 16:03:46 GMT
server
akka-http/10.2.7
content-length
23
content-type
image/gif

Redirect headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:46 GMT
server
Kestrel
x-errorlevel
0
strict-transport-security
max-age=31536000; preload;
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location
https://sync.teads.tv/um?fp=1&eid=80&uid=75ce90fb-6c80-4c61-b13b-22733d19063b&gdpr=0&gdpr_consent=
cache-control
no-cache
cross-origin-resource-policy
cross-origin
server-processing-duration-in-ticks
1623172
content-length
0
expires
Wed, 18 May 2022 00:00:00 GMT
um
sync.teads.tv/ Frame 0B1C
Redirect Chain
  • https://pr-bh.ybp.yahoo.com/sync/teads/eed3fd5c-407f-43bf-8415-729de81fdb8a?gdpr=0&gdpr_consent=&_t=1652889826673
  • https://sync.teads.tv/um?eid=132&uid=y-bt_AJzlE2oSF4i5.bO_9gauWLCNjXOODSYo-~A
23 B
172 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.teads.tv/um?eid=132&uid=y-bt_AJzlE2oSF4i5.bO_9gauWLCNjXOODSYo-~A
Requested by
Host: sync.teads.tv
URL: https://sync.teads.tv/iframe?pid=142873&gdprIab={%22reason%22:220,%22status%22:22,%22consent%22:%22%22,%22apiVersion%22:null,%22cmpId%22:null}&fromFormat=true&env=js-web&auctid=9b3a6b04-52a1-4dd4-9bc4-94098175937f&vid=eed3fd5c-407f-43bf-8415-729de81fdb8a&1652889826570
Protocol
H2
Server
23.195.109.72 Edison, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-195-109-72.deploy.static.akamaitechnologies.com
Software
akka-http/10.2.7 /
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sync.teads.tv/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:46 GMT
cache-control
max-age=0, no-cache, no-store
expires
Wed, 18 May 2022 16:03:46 GMT
server
akka-http/10.2.7
content-length
23
content-type
image/gif

Redirect headers

date
Wed, 18 May 2022 16:03:46 GMT
referrer-policy
strict-origin-when-cross-origin
server
ATS
age
0
expect-ct
max-age=31536000, report-uri="http://csp.yahoo.com/beacon/csp?src=yahoocom-expect-ct-report-only"
strict-transport-security
max-age=31536000
location
https://sync.teads.tv/um?eid=132&uid=y-bt_AJzlE2oSF4i5.bO_9gauWLCNjXOODSYo-~A
x-xss-protection
1; mode=block
content-length
0
x-content-type-options
nosniff
pixel.gif
load77.exelator.com/ Frame 0B1C
Redirect Chain
  • https://loadm.exelator.com/load/?p=204&g=810&j=0&buid=eed3fd5c-407f-43bf-8415-729de81fdb8a_us_ca&gdpr_consent=&_t=1652889826673
  • https://loadm.exelator.com/load/?p=204&g=810&j=0&buid=eed3fd5c-407f-43bf-8415-729de81fdb8a_us_ca&gdpr_consent=&_t=1652889826673&xl8blockcheck=1
  • https://load77.exelator.com/pixel.gif
43 B
333 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://load77.exelator.com/pixel.gif
Requested by
Host: sync.teads.tv
URL: https://sync.teads.tv/iframe?pid=142873&gdprIab={%22reason%22:220,%22status%22:22,%22consent%22:%22%22,%22apiVersion%22:null,%22cmpId%22:null}&fromFormat=true&env=js-web&auctid=9b3a6b04-52a1-4dd4-9bc4-94098175937f&vid=eed3fd5c-407f-43bf-8415-729de81fdb8a&1652889826570
Protocol
H2
Server
2a02:6ea0:c400::11 , United States, ASN60068 (CDN77 ^_^, GB),
Reverse DNS
Software
CDN77-Turbo /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sync.teads.tv/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

x-77-nzt
AZySJBatX2n/rXAEAA
x-accel-expires
@1653635638
date
Wed, 18 May 2022 16:03:47 GMT
etag
"59f0c3fc-2b"
last-modified
Wed, 25 Oct 2017 17:03:56 GMT
server
CDN77-Turbo
x-77-nzt-ray
XP/RPDLSJuo
x-77-cache
HIT
content-type
image/gif
access-control-allow-origin
*
x-cache
HIT
x-age
290989
accept-ranges
bytes
x-77-pop
newyorkUSNY
content-length
43

Redirect headers

date
Wed, 18 May 2022 16:03:47 GMT
server
nginx
x-powered-by
Undertow/1
p3p
policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
location
https://load77.exelator.com/pixel.gif
cache-control
no-cache
access-control-allow-credentials
true
content-type
image/gif
content-length
0
44858
tags.bluekai.com/site/ Frame 0B1C 		62 B
671 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tags.bluekai.com/site/44858?id=eed3fd5c-407f-43bf-8415-729de81fdb8a_us_ca&limit=1&gdpr_consent=&_t=1652889826673
Requested by
Host: sync.teads.tv
URL: https://sync.teads.tv/iframe?pid=142873&gdprIab={%22reason%22:220,%22status%22:22,%22consent%22:%22%22,%22apiVersion%22:null,%22cmpId%22:null}&fromFormat=true&env=js-web&auctid=9b3a6b04-52a1-4dd4-9bc4-94098175937f&vid=eed3fd5c-407f-43bf-8415-729de81fdb8a&1652889826570
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.76.100.229 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-76-100-229.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sync.teads.tv/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Date
Wed, 18 May 2022 16:03:46 GMT
Connection
keep-alive
P3P
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
Content-Length
62
Content-Type
image/gif
474599.gif
idsync.rlcdn.com/ Frame 0B1C 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://idsync.rlcdn.com/474599.gif?partner_uid=eed3fd5c-407f-43bf-8415-729de81fdb8a_ca&gdpr_consent=&cv=&_t=1652889826673
Requested by
Host: sync.teads.tv
URL: https://sync.teads.tv/iframe?pid=142873&gdprIab={%22reason%22:220,%22status%22:22,%22consent%22:%22%22,%22apiVersion%22:null,%22cmpId%22:null}&fromFormat=true&env=js-web&auctid=9b3a6b04-52a1-4dd4-9bc4-94098175937f&vid=eed3fd5c-407f-43bf-8415-729de81fdb8a&1652889826570
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
35.190.60.146 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
146.60.190.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sync.teads.tv/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers
g.pixel
aa.agkn.com/adscores/ Frame 0B1C 		43 B
656 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aa.agkn.com/adscores/g.pixel?sid=9212301178&puid=eed3fd5c-407f-43bf-8415-729de81fdb8a_ca&_tid=eed3fd5c-407f-43bf-8415-729de81fdb8a&gdpr_consent=&_t=1652889826673
Requested by
Host: sync.teads.tv
URL: https://sync.teads.tv/iframe?pid=142873&gdprIab={%22reason%22:220,%22status%22:22,%22consent%22:%22%22,%22apiVersion%22:null,%22cmpId%22:null}&fromFormat=true&env=js-web&auctid=9b3a6b04-52a1-4dd4-9bc4-94098175937f&vid=eed3fd5c-407f-43bf-8415-729de81fdb8a&1652889826570
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.49 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-49.ewr53.r.cloudfront.net
Software
AAWebServer /
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sync.teads.tv/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:46 GMT
via
1.1 e5bd532dbdee524acdf00690205f3b5a.cloudfront.net (CloudFront)
server
AAWebServer
x-amz-cf-pop
EWR53-P1
access-control-allow-methods
GET, POST, OPTIONS
p3p
policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
x-cache
Miss from cloudfront
content-type
image/gif
access-control-allow-headers
accept, cache-control, origin, x-requested-with, x-file-name, content-type
content-length
43
x-amz-cf-id
rTS9dt9BTqWEzuxepKa4KIQZLUkipKH2dHd5RphmJ5iLfyElvo8-cg==
expires
0
usermatch.gif
beacon.krxd.net/ Frame 0B1C 		0
338 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://beacon.krxd.net/usermatch.gif?partner=teadspartner&partner_uid=eed3fd5c-407f-43bf-8415-729de81fdb8a_ca&gdpr_consent=&_t=1652889826673
Requested by
Host: sync.teads.tv
URL: https://sync.teads.tv/iframe?pid=142873&gdprIab={%22reason%22:220,%22status%22:22,%22consent%22:%22%22,%22apiVersion%22:null,%22cmpId%22:null}&fromFormat=true&env=js-web&auctid=9b3a6b04-52a1-4dd4-9bc4-94098175937f&vid=eed3fd5c-407f-43bf-8415-729de81fdb8a&1652889826570
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.205.48.68 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-205-48-68.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://sync.teads.tv/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:46 GMT
cache-control
private, no-cache, no-store
x-request-time
D=89 t=1652889826
x-served-by
beacon-n038-ash-prod.krxd.net
p3p
policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&wf=1&ra=1&pxm=6&sgs=3&vb=9&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=0&ak=https%3A%2F%2Ftpc.googlesyndication.com%2Fsimgad%2F7744945786656286024&i=PENTONMEDIA1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CI%24%3D!Iv*Ebj.JGfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7B%2CNr1U*%26ujMUU9%3C%24kBjqI&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rb=2-LUS3hkIJ33cxUahFibJNuf9eBEDDlqciElgdmM6rBhY%3D&rs=1-5ZHC8H1EcQEJWg%3D%3D&sc=1&os=1-3g%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oDgO%3DLlE6%3ABcmUZzCFV%60pT6yv%7CEkUpF%3D3%3Ch%2C%25%3BMB1_tNOC%604dEzbSIq11_iCTpXSe%2BShooUKV%3B%2B9%7CPQPmf)P%3DH%3BCH%6029YCN%3FAbcE%3DX7IL3kQ%2CNJJ)%2Cc%7ClTr1W*d%5B4kf%2FLyUoRdByZ%3C99Ksf%2FLyUo0)H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&bq=0&g=0&h=250&w=300&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&id=1&ii=4&f=0&j=&t=1652889826179&de=251728430589&cu=1652889826179&m=13&ar=8d467bec877-clean&iw=d3fc7f9&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4251&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A400%3A2914%3A2606%3A534&as=0&ag=3&an=0&gf=3&gg=0&ix=3&ic=3&ez=1&aj=1&pg=100&pf=0&ib=0&cc=0&bw=3&bx=0&dj=1&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=0&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5&cd=0&ah=5&am=0&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=5124257703%3A2978231009%3A5909690628%3A138385472861&bo=22316126855&bp=22340016856&bd=300_2v&zMoatPS=300_2v&gw=pentonmedia53440730609&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22340016856&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22340016856&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&zMoatDev=Desktop&zMoatDfpSlotId=13_5u0n2k3ztxb000005u0n2k3ztxb000005u0&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=13_5u0n2k3ztxb000005u0n2k3ztxb000005u0&iq=na&tt=na&tc=0&fs=198321&na=806280306&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:46 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Wed, 18 May 2022 16:03:46 GMT
1454a71d-cdbb-429c-8092-122f4493e0c7.woff
cache-ssl.celtra.com/api/fonts/monotype_tradegothic800n/3_a21706b45861b8577718feb7af969a082ae4576a33ea62b203d77b518b45935a/ Frame F866 		13 KB
13 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cache-ssl.celtra.com/api/fonts/monotype_tradegothic800n/3_a21706b45861b8577718feb7af969a082ae4576a33ea62b203d77b518b45935a/1454a71d-cdbb-429c-8092-122f4493e0c7.woff?subset=%20%22%2C5ABCDEFGHILMOPRSTUVWabcdefghiklmnoprstuvwxy
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.116 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-116.ewr53.r.cloudfront.net
Software
Apache /
Resource Hash
e81814521084a1e9785d3abbfb55d43675ef3cd47b495d5a340d8412941fc3d5

Request headers

Referer
https://www.darkreading.com/
Origin
https://www.darkreading.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Sun, 08 May 2022 09:07:38 GMT
via
1.1 varnish (Varnish/6.2), 1.1 35c803afef083002d824403342d4c62e.cloudfront.net (CloudFront)
age
888967
x-cache
Hit from cloudfront
content-length
13256
server
Apache
etag
"e81814521084a1e9785d3abbfb55d43675ef3cd47b495d5a340d8412941fc3d5"
x-varnish
52499351 194097463
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=31556926
access-control-allow-credentials
false
x-amz-cf-pop
EWR53-P1
accept-ranges
bytes
content-type
application/font-woff
x-amz-cf-id
YVcSXtoIN3YwRfyit3LA-ourFotR6ifBTOULT6yynveZyfhxLQz9kQ==
57625f96-ca80-4602-9644-ec1803cb3ba3.woff
cache-ssl.celtra.com/api/fonts/monotype_tradegothicnext400n/3_78b829381fc6cb8a15b0da13bda2ee2fe6786c2b2c1c7b121149bf4daf6870f6/ Frame F866 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cache-ssl.celtra.com/api/fonts/monotype_tradegothicnext400n/3_78b829381fc6cb8a15b0da13bda2ee2fe6786c2b2c1c7b121149bf4daf6870f6/57625f96-ca80-4602-9644-ec1803cb3ba3.woff?subset=%20%2C.5ACDFMPRSTabcdefghiklmnoprstuvwxy%E2%80%99
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.116 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-116.ewr53.r.cloudfront.net
Software
Apache /
Resource Hash
fc56c9ccf3939763fe57b7803ef715e59227ff7aca27c3733c2b6f6e25657432

Request headers

Referer
https://www.darkreading.com/
Origin
https://www.darkreading.com
accept-language
en-CA,en;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 04 May 2022 18:52:17 GMT
via
1.1 varnish (Varnish/6.2), 1.1 35c803afef083002d824403342d4c62e.cloudfront.net (CloudFront)
age
1199488
x-cache
Hit from cloudfront
content-length
9008
server
Apache
etag
"fc56c9ccf3939763fe57b7803ef715e59227ff7aca27c3733c2b6f6e25657432"
x-varnish
44500273
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=31556926
access-control-allow-credentials
false
x-amz-cf-pop
EWR53-P1
accept-ranges
bytes
content-type
application/font-woff
x-amz-cf-id
448V0axheOD6OGpbLzai_WitF_831rAw52Cx0S-T_MZm4lib-Cb3Rw==
generate_204
tpc.googlesyndication.com/ Frame 67E7 		0
9 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://tpc.googlesyndication.com/generate_204?u9aZ7A
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:822::2001 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://tpc.googlesyndication.com/sodar/sodar2/225/runner.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:46 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
DR_SimSpace_The-Case-for-Cyber-Risk-Management.jpg
cache-ssl.celtra.com/api/blobs/c66981429e660b3f23d3d0c2663772377ada5ecbfde3bf9e376e4ccdc2154609/ Frame F866 		19 KB
20 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cache-ssl.celtra.com/api/blobs/c66981429e660b3f23d3d0c2663772377ada5ecbfde3bf9e376e4ccdc2154609/DR_SimSpace_The-Case-for-Cyber-Risk-Management.jpg?transform=crush&quality=85
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.116 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-116.ewr53.r.cloudfront.net
Software
Apache /
Resource Hash
7768586b1abca637ef5ca6b4e964df6ac1ec73ac7dd8c421f35bbfc553a8f76e

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Fri, 15 Apr 2022 08:53:56 GMT
via
1.1 varnish (Varnish/6.2), 1.1 ae9634deb2e9d6f8d396fc6f1e0586fa.cloudfront.net (CloudFront)
age
2876990
x-cache
Hit from cloudfront
content-length
19665
server
Apache
etag
"7768586b1abca637ef5ca6b4e964df6ac1ec73ac7dd8c421f35bbfc553a8f76e"
x-varnish
29492677
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=31556926
access-control-allow-credentials
false
x-amz-cf-pop
EWR53-P1
accept-ranges
bytes
content-type
image/jpeg
x-amz-cf-id
Z-iqANttSKdPgqZM8_L2qAaKrwGYRZfZU4tZUKvCYWAuaRNs9eL5ig==
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&wf=1&ra=1&pxm=6&sgs=3&vb=9&kq=1&lo=1&uk=null&pk=0&wk=1&rk=1&tk=0&ak=https%3A%2F%2Feu-images.contentstack.com%2Fv3%2Fassets%2Fblt66983808af36a8ef%2Fblt456fd002839bae7e%2F620377d02be9c249dcea7cc9%2FFrame_1728.svg%3Fquality%3D80%26format%3Djpg%26width%3D222&i=PENTONMEDIA1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CI%24%3D!Iv*Ebj.JGfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7B%2CNr1U*%26ujMUU9%3C%24kBjqI&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rb=2-LUS3hkIJ33cxUahFibJNuf9eBEDDlqciElgdmM6rBhY%3D&rs=1-5ZHC8H1EcQEJWg%3D%3D&sc=1&os=1-3g%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oDgO%3DLlE6%3ABcmUZzCFV%60pT6yv%7CEkUpF%3D3%3Ch%2C%25%3BMB1_tNOC%604dEzbSIq11_iCTpXSe%2BShooUKV%3B%2B9%7CPQPmf)P%3DH%3BCH%6029YCN%3FAbcE%3DX7IL3kQ%2CNJJ)%2Cc%7ClTr1W*d%5B4kf%2FLyUoRdByZ%3C99Ksf%2FLyUo0)H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&bq=0&g=0&h=61&w=248&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&id=1&ii=4&f=0&j=&t=1652889825919&de=890423079164&cu=1652889825919&m=606&ar=8d467bec877-clean&iw=d3fc7f9&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4251&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A400%3A2914%3A2606%3A534&as=0&ag=39&an=0&gf=39&gg=0&ix=39&ic=39&ez=1&aj=1&pg=100&pf=0&ib=0&cc=0&bw=39&bx=0&dj=1&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=77&cd=0&ah=77&am=0&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=17506827%3A2990021191%3A5940610987%3A138392437444&bo=22316126855&bp=22340016856&bd=welcome_v&zMoatPS=welcome_v&gw=pentonmedia53440730609&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22340016856&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22340016856&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&zMoatDev=Desktop&zMoatDfpSlotId=div-gpt-ad-welcome&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=div-gpt-ad-welcome&iq=na&tt=na&tc=0&fs=198321&na=2078404167&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:46 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Wed, 18 May 2022 16:03:46 GMT
DR_SimSpace_5-Critical-Cyber-Range-Exercises.jpg
cache-ssl.celtra.com/api/blobs/541ce5c4b466c85bfa596ec88252e7a5332bda8d8a539ca7d63babbc48c209d9/ Frame F866 		43 KB
43 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cache-ssl.celtra.com/api/blobs/541ce5c4b466c85bfa596ec88252e7a5332bda8d8a539ca7d63babbc48c209d9/DR_SimSpace_5-Critical-Cyber-Range-Exercises.jpg?transform=crush&quality=85
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.116 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-116.ewr53.r.cloudfront.net
Software
Apache /
Resource Hash
f663a408b84f51eb402c6682e5046607fb8f7aa2d138df4251d6321b12a8a11f

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 22:31:02 GMT
via
1.1 varnish (Varnish/6.2), 1.1 ae9634deb2e9d6f8d396fc6f1e0586fa.cloudfront.net (CloudFront)
age
1877564
x-cache
Hit from cloudfront
content-length
43678
server
Apache
etag
"f663a408b84f51eb402c6682e5046607fb8f7aa2d138df4251d6321b12a8a11f"
x-varnish
2265758
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=31556926
access-control-allow-credentials
false
x-amz-cf-pop
EWR53-P1
accept-ranges
bytes
content-type
image/jpeg
x-amz-cf-id
s9Fn_OC-Dkp3aMOSu9UcieM-ac8Alu21LVqzJGMVYO1GhexrZ2dSDQ==
DR_SimSpace_Improving-Realism-in-Cyber-Ranges.jpg
cache-ssl.celtra.com/api/blobs/96e796b0e5fa1d526c7b7bd1a46cc3ddf840630650b2cd6e382f01b5da4f3093/ Frame F866 		31 KB
31 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cache-ssl.celtra.com/api/blobs/96e796b0e5fa1d526c7b7bd1a46cc3ddf840630650b2cd6e382f01b5da4f3093/DR_SimSpace_Improving-Realism-in-Cyber-Ranges.jpg?transform=crush&quality=85
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.116 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-116.ewr53.r.cloudfront.net
Software
Apache /
Resource Hash
a886d8b4029fe5033428324148230a386a88c96ee0e426b259de53d36d177e0f

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 04 May 2022 18:52:17 GMT
via
1.1 varnish (Varnish/6.2), 1.1 ae9634deb2e9d6f8d396fc6f1e0586fa.cloudfront.net (CloudFront)
age
1199488
x-cache
Hit from cloudfront
content-length
31259
server
Apache
etag
"a886d8b4029fe5033428324148230a386a88c96ee0e426b259de53d36d177e0f"
x-varnish
45089478
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=31556926
access-control-allow-credentials
false
x-amz-cf-pop
EWR53-P1
accept-ranges
bytes
content-type
image/jpeg
x-amz-cf-id
MPpFVv6qMZijQV-4cbfwd30f4caOnmfTaR5Zgt2lEYrM2McV0Gr49A==
li_hover.png
cache-ssl.celtra.com/api/blobs/e3228348fc17573d7db7d135ba5cf60985157f70dae6643939d3a6686b2aa699/ Frame F866 		591 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cache-ssl.celtra.com/api/blobs/e3228348fc17573d7db7d135ba5cf60985157f70dae6643939d3a6686b2aa699/li_hover.png?transform=crush
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.116 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-116.ewr53.r.cloudfront.net
Software
Apache /
Resource Hash
c19345a03fed44d267abbe2f427bdcd261aa86a447320f15f3eef8e121690794

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Fri, 15 Apr 2022 08:40:57 GMT
via
1.1 varnish (Varnish/6.2), 1.1 ae9634deb2e9d6f8d396fc6f1e0586fa.cloudfront.net (CloudFront)
age
2877769
x-cache
Hit from cloudfront
content-length
591
server
Apache
etag
"c19345a03fed44d267abbe2f427bdcd261aa86a447320f15f3eef8e121690794"
x-varnish
38175320 20283522
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=31556926
access-control-allow-credentials
false
x-amz-cf-pop
EWR53-P1
accept-ranges
bytes
content-type
image/png
x-amz-cf-id
qTYxx244McCxRe3NCARr1HL0_tW_Ux4K8g4PsYyTQuXyoYt5s0baOg==
li.png
cache-ssl.celtra.com/api/blobs/2e1d1ae5940fbdaa5f95c1c17393175faf02b27a8c6b37dca2419c70113760ab/ Frame F866 		585 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cache-ssl.celtra.com/api/blobs/2e1d1ae5940fbdaa5f95c1c17393175faf02b27a8c6b37dca2419c70113760ab/li.png?transform=crush
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.116 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-116.ewr53.r.cloudfront.net
Software
Apache /
Resource Hash
d10a2d03c9fb4943f449b97d333b8d22990200afa70d13d5c1c23ad4d783200c

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Fri, 15 Apr 2022 08:40:57 GMT
via
1.1 varnish (Varnish/6.2), 1.1 ae9634deb2e9d6f8d396fc6f1e0586fa.cloudfront.net (CloudFront)
age
2877769
x-cache
Hit from cloudfront
content-length
585
server
Apache
etag
"d10a2d03c9fb4943f449b97d333b8d22990200afa70d13d5c1c23ad4d783200c"
x-varnish
35652382 38961283
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=31556926
access-control-allow-credentials
false
x-amz-cf-pop
EWR53-P1
accept-ranges
bytes
content-type
image/png
x-amz-cf-id
AlrU5koyJRHjPs8e5lK1yNbuLaVeXZ0iVf3difn4RlZ1n3h_NN8PqA==
fb_hover.png
cache-ssl.celtra.com/api/blobs/652ab50d0e331e4269bb4d847fcc5a5a4e3def07bb1ebca4d2d6fda889e52604/ Frame F866 		348 B
866 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cache-ssl.celtra.com/api/blobs/652ab50d0e331e4269bb4d847fcc5a5a4e3def07bb1ebca4d2d6fda889e52604/fb_hover.png?transform=crush
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.116 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-116.ewr53.r.cloudfront.net
Software
Apache /
Resource Hash
9250f0b586e89674ec647d8dfb6fe7aedcb588be13ebb6aeb1286efa9d3cfb39

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Fri, 15 Apr 2022 08:41:14 GMT
via
1.1 varnish (Varnish/6.2), 1.1 ae9634deb2e9d6f8d396fc6f1e0586fa.cloudfront.net (CloudFront)
age
2877752
x-cache
Hit from cloudfront
content-length
348
server
Apache
etag
"9250f0b586e89674ec647d8dfb6fe7aedcb588be13ebb6aeb1286efa9d3cfb39"
x-varnish
38175322 26551643
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=31556926
access-control-allow-credentials
false
x-amz-cf-pop
EWR53-P1
accept-ranges
bytes
content-type
image/png
x-amz-cf-id
q3ykGL09NmMYjYJl9kJqzScQgkYYlgbUipYH3L8lQtg33HPkkjGYRQ==
fb.png
cache-ssl.celtra.com/api/blobs/44f24c3edfffb11dd41284fe3c7bddb08dc29236aa3509e3a243c10f9804b28d/ Frame F866 		348 B
866 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cache-ssl.celtra.com/api/blobs/44f24c3edfffb11dd41284fe3c7bddb08dc29236aa3509e3a243c10f9804b28d/fb.png?transform=crush
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.116 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-116.ewr53.r.cloudfront.net
Software
Apache /
Resource Hash
e9d0cab69a4c71df7a16b6ee6f99ea474423689c8eadd7aa62ce9cef3a48c395

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Fri, 15 Apr 2022 08:42:10 GMT
via
1.1 varnish (Varnish/6.2), 1.1 ae9634deb2e9d6f8d396fc6f1e0586fa.cloudfront.net (CloudFront)
age
2877695
x-cache
Hit from cloudfront
content-length
348
server
Apache
etag
"e9d0cab69a4c71df7a16b6ee6f99ea474423689c8eadd7aa62ce9cef3a48c395"
x-varnish
36766436 10750260
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=31556926
access-control-allow-credentials
false
x-amz-cf-pop
EWR53-P1
accept-ranges
bytes
content-type
image/png
x-amz-cf-id
anGBaWxneaRJirwR6dkHyOZ466OMtnCWiGG94VCpNw8l8bY2CBaOTg==
tw.png
cache-ssl.celtra.com/api/blobs/9ad81786e386c3155cbc468769eddcc96e3e991156ad745860288c59c63a417c/ Frame F866 		781 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cache-ssl.celtra.com/api/blobs/9ad81786e386c3155cbc468769eddcc96e3e991156ad745860288c59c63a417c/tw.png?transform=crush
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.116 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-116.ewr53.r.cloudfront.net
Software
Apache /
Resource Hash
308e134d9a0df8031a894aa2bb6e70515cb9db2403e3e568e7554ae69f474c96

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Thu, 14 Apr 2022 22:16:10 GMT
via
1.1 varnish (Varnish/6.2), 1.1 ae9634deb2e9d6f8d396fc6f1e0586fa.cloudfront.net (CloudFront)
age
2915256
x-cache
Hit from cloudfront
content-length
781
server
Apache
etag
"308e134d9a0df8031a894aa2bb6e70515cb9db2403e3e568e7554ae69f474c96"
x-varnish
2163297 11141197
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=31556926
access-control-allow-credentials
false
x-amz-cf-pop
EWR53-P1
accept-ranges
bytes
content-type
image/png
x-amz-cf-id
opRKZ84l16XODB5eF0q8NQnku49Ti1KzUMTGzFR9jPeOvbXe_qjsmw==
tw_hover.png
cache-ssl.celtra.com/api/blobs/f0cccd681d168932db801410643c93f0df03370d5c638ab3e4a16e92b80b3aa0/ Frame F866 		777 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cache-ssl.celtra.com/api/blobs/f0cccd681d168932db801410643c93f0df03370d5c638ab3e4a16e92b80b3aa0/tw_hover.png?transform=crush
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.116 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-116.ewr53.r.cloudfront.net
Software
Apache /
Resource Hash
1ace1b17e77ec3828eda87eb3fea3671ce2a0f706426fbd158873546c4f9366e

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Fri, 15 Apr 2022 08:13:44 GMT
via
1.1 varnish (Varnish/6.2), 1.1 ae9634deb2e9d6f8d396fc6f1e0586fa.cloudfront.net (CloudFront)
age
2879402
x-cache
Hit from cloudfront
content-length
777
server
Apache
etag
"1ace1b17e77ec3828eda87eb3fea3671ce2a0f706426fbd158873546c4f9366e"
x-varnish
36602391 13278254
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=31556926
access-control-allow-credentials
false
x-amz-cf-pop
EWR53-P1
accept-ranges
bytes
content-type
image/png
x-amz-cf-id
cRXzDlnAv65EPRJSATyJ-t7TKTeH-gcWLy0JxUT6ehZyS0XSOxrsjQ==
Logo%20source_Main%20Hor%20Black.png
cache-ssl.celtra.com/api/blobs/53a21d123fc0d790e6b5b18a8bcc400f9551dcd4b9fbf6214cc1a20183307378/ Frame F866 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cache-ssl.celtra.com/api/blobs/53a21d123fc0d790e6b5b18a8bcc400f9551dcd4b9fbf6214cc1a20183307378/Logo%20source_Main%20Hor%20Black.png?transform=crush&quality=256
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.116 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-116.ewr53.r.cloudfront.net
Software
Apache /
Resource Hash
5a4ba516b7833541f815c01bc46edb05f853629ba58ca9ac45f74570f221552f

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Tue, 26 Apr 2022 00:12:15 GMT
via
1.1 varnish (Varnish/6.2), 1.1 ae9634deb2e9d6f8d396fc6f1e0586fa.cloudfront.net (CloudFront)
age
1957891
x-cache
Hit from cloudfront
content-length
3429
server
Apache
etag
"5a4ba516b7833541f815c01bc46edb05f853629ba58ca9ac45f74570f221552f"
x-varnish
12558252 11445999
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=31556926
access-control-allow-credentials
false
x-amz-cf-pop
EWR53-P1
accept-ranges
bytes
content-type
image/png
x-amz-cf-id
l8REcjLCihxi7ODFaIzWNgdq0rfQoXcYTpVwhpsUVqZa8Uu0aJ8gag==
eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNjUyODg5ODI1eGI1NTY4MmY2NDhiYjUzeDI3MjAwMTk2IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIxNjI2MTY2MTI0MzkyNTA1MiIsImluZGV4I...
track.celtra.com/json/ 		35 B
242 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNjUyODg5ODI1eGI1NTY4MmY2NDhiYjUzeDI3MjAwMTk2IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIxNjI2MTY2MTI0MzkyNTA1MiIsImluZGV4IjoxLCJjbGllbnRUaW1lc3RhbXAiOjE2NTI4ODk4MjYuNTU4LCJzY29wZSI6Imdsb2JhbCIsInVzZXJBZ2VudCI6Ik1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDEwLjA7IFdpbjY0OyB4NjQpIEFwcGxlV2ViS2l0LzUzNy4zNiAoS0hUTUwsIGxpa2UgR2Vja28pIENocm9tZS8xMDEuMC40OTUxLjY0IFNhZmFyaS81MzcuMzYiLCJvcmllbnRhdGlvbiI6MCwidG9wbW9zdFJlYWNoYWJsZVdpbmRvdyI6eyJ3aWR0aCI6MTYwMCwiaGVpZ2h0IjoxMjAwfSwiaG9zdFdpbmRvdyI6eyJ3aWR0aCI6NSwiaGVpZ2h0Ijo1fSwibmVzdGluZyI6eyJpZnJhbWUiOnRydWUsImZyaWVuZGx5SWZyYW1lIjp0cnVlLCJpYWJGcmllbmRseUlmcmFtZSI6dHJ1ZSwiaG9zdGlsZUlmcmFtZSI6ZmFsc2UsImlmcmFtZURlcHRoIjoxfSwicGFnZVZpc2liaWxpdHlBcGkiOnRydWUsInJlcXVlc3RBbmltYXRpb25GcmFtZSI6dHJ1ZSwidG9wV2luZG93TmF0aXZlUkFGU3VwcG9ydGVkIjpmYWxzZSwiYWxsb3dOb25OYXRpdmVSQUZGb3JWaWV3YWJsZVRpbWVVc2VkIjpmYWxzZSwiY2xpZW50VGltZVpvbmVPZmZzZXRJbk1pbnV0ZXMiOjAsInN1cHBvcnRzQ29udGFpbmVyVmlld2FiaWxpdHkiOnRydWUsInN1cHBvcnRzQ29udGFpbmVySW5pdGlhbFZpZXdhYmlsaXR5Ijp0cnVlLCJ0YWdQYXJlbnRXaWR0aCI6MCwidGFnUGFyZW50SGVpZ2h0IjowLCJhbXBEZXRlY3RlZCI6ZmFsc2UsImFtcE5lc3RpbmdMZXZlbCI6IiIsInNhZmVGcmFtZURldGVjdGVkIjpmYWxzZSwiZmV0Y2hTdXBwb3J0ZWQiOnRydWUsImFzYXBFbmFibGVkIjpudWxsLCJuYXRpdmVQcm9taXNlc1N1cHBvcnRlZCI6dHJ1ZSwiYmVhY29uU3VwcG9ydGVkIjp0cnVlLCJJbnRlcnNlY3Rpb25PYnNlcnZlclN1cHBvcnRlZCI6dHJ1ZSwiaXNNdXRhdGlvbk9ic2VydmVyU3VwcG9ydGVkIjp0cnVlLCJ3ZWJWaWV3IjpudWxsLCJpc1dpbmRvd09wZW5OYXRpdmUiOnRydWUsInByb3RvTG9hZGluZyI6eyJkYXRhTG9hZFN0YXR1cyI6InN1cHBvcnRlZCIsImJsb2JMb2FkU3RhdHVzIjoic3VwcG9ydGVkIn0sInRvcFdpbmRvd0xvY2F0aW9uIjoiaHR0cHM6Ly93d3cuZGFya3JlYWRpbmcuY29tIiwidG9wV2luZG93TG9jYXRpb25MZW5ndGgiOjI3LCJuYW1lIjoiZW52aXJvbm1lbnRJbmZvIn0seyJzZXNzaW9uSWQiOiJzMTY1Mjg4OTgyNXhiNTU2ODJmNjQ4YmI1M3gyNzIwMDE5NiIsImFjY291bnRJZCI6IjQ0Yjc0YjM1Iiwic3RyZWFtIjoiYWRFdmVudHMiLCJpbnN0YW50aWF0aW9uIjoiMTYyNjE2NjEyNDM5MjUwNTIiLCJpbmRleCI6MiwiY2xpZW50VGltZXN0YW1wIjoxNjUyODg5ODI2Ljk1MiwibmFtZSI6ImFnZ3JlZ2F0b3IiLCJtZXRyaWMiOiJtb25vdHlwZVVzYWdlUmVwb3J0ZWQiLCJ2YWx1ZSI6MSwiY3VzdG9tRGltZW5zaW9ucyI6eyJtb25vdHlwZVByb2plY3RJZCI6ImM0NmVkMDkwLTM2NzEtNDE2My1hODViLWIwNmI0MDM4YWUzOCIsImNyZWF0aXZlSWQiOiI1NWVkNzY1OCJ9fV19?crc32c=3645781425
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.172.30.83 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-172-30-83.compute-1.amazonaws.com
Software
/
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 18 May 2022 16:03:47 GMT
Cache-Control
no-cache, no-store, must-revalidate
Expires
0
Connection
keep-alive
Content-Length
35
Content-Type
image/gif
li.png
cache-ssl.celtra.com/api/blobs/2e1d1ae5940fbdaa5f95c1c17393175faf02b27a8c6b37dca2419c70113760ab/ Frame F866 		585 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cache-ssl.celtra.com/api/blobs/2e1d1ae5940fbdaa5f95c1c17393175faf02b27a8c6b37dca2419c70113760ab/li.png?transform=crush
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.116 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-116.ewr53.r.cloudfront.net
Software
Apache /
Resource Hash
d10a2d03c9fb4943f449b97d333b8d22990200afa70d13d5c1c23ad4d783200c

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Fri, 15 Apr 2022 08:40:57 GMT
via
1.1 varnish (Varnish/6.2), 1.1 ae9634deb2e9d6f8d396fc6f1e0586fa.cloudfront.net (CloudFront)
age
2877769
x-cache
Hit from cloudfront
content-length
585
server
Apache
etag
"d10a2d03c9fb4943f449b97d333b8d22990200afa70d13d5c1c23ad4d783200c"
x-varnish
35652382 38961283
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=31556926
access-control-allow-credentials
false
x-amz-cf-pop
EWR53-P1
accept-ranges
bytes
content-type
image/png
x-amz-cf-id
9UFb0O1pGGylnv7Vyngfxmc0vpG7oV_N6PGEghP934NIh9QrJNXSSQ==
fb.png
cache-ssl.celtra.com/api/blobs/44f24c3edfffb11dd41284fe3c7bddb08dc29236aa3509e3a243c10f9804b28d/ Frame F866 		348 B
865 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cache-ssl.celtra.com/api/blobs/44f24c3edfffb11dd41284fe3c7bddb08dc29236aa3509e3a243c10f9804b28d/fb.png?transform=crush
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.116 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-116.ewr53.r.cloudfront.net
Software
Apache /
Resource Hash
e9d0cab69a4c71df7a16b6ee6f99ea474423689c8eadd7aa62ce9cef3a48c395

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Fri, 15 Apr 2022 08:42:10 GMT
via
1.1 varnish (Varnish/6.2), 1.1 ae9634deb2e9d6f8d396fc6f1e0586fa.cloudfront.net (CloudFront)
age
2877695
x-cache
Hit from cloudfront
content-length
348
server
Apache
etag
"e9d0cab69a4c71df7a16b6ee6f99ea474423689c8eadd7aa62ce9cef3a48c395"
x-varnish
36766436 10750260
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=31556926
access-control-allow-credentials
false
x-amz-cf-pop
EWR53-P1
accept-ranges
bytes
content-type
image/png
x-amz-cf-id
r0CBsRFhtVwrdx7MreID2cI5egHVEdM_-1OejvLUHUYe25a1LjSsgg==
tw.png
cache-ssl.celtra.com/api/blobs/9ad81786e386c3155cbc468769eddcc96e3e991156ad745860288c59c63a417c/ Frame F866 		781 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cache-ssl.celtra.com/api/blobs/9ad81786e386c3155cbc468769eddcc96e3e991156ad745860288c59c63a417c/tw.png?transform=crush
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.116 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-116.ewr53.r.cloudfront.net
Software
Apache /
Resource Hash
308e134d9a0df8031a894aa2bb6e70515cb9db2403e3e568e7554ae69f474c96

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 04 May 2022 06:51:32 GMT
via
1.1 varnish (Varnish/6.2), 1.1 ae9634deb2e9d6f8d396fc6f1e0586fa.cloudfront.net (CloudFront)
age
1242733
x-cache
Hit from cloudfront
content-length
781
server
Apache
etag
"308e134d9a0df8031a894aa2bb6e70515cb9db2403e3e568e7554ae69f474c96"
x-varnish
39898028
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=31556926
access-control-allow-credentials
false
x-amz-cf-pop
EWR53-P1
accept-ranges
bytes
content-type
image/png
x-amz-cf-id
z52M_QmrUS7ozfCEVY93SeXBZhqEOWsCpvd5BoiVatHpteOAt8BrzA==
Logo%20source_Main%20Hor%20Black.png
cache-ssl.celtra.com/api/blobs/53a21d123fc0d790e6b5b18a8bcc400f9551dcd4b9fbf6214cc1a20183307378/ Frame F866 		3 KB
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cache-ssl.celtra.com/api/blobs/53a21d123fc0d790e6b5b18a8bcc400f9551dcd4b9fbf6214cc1a20183307378/Logo%20source_Main%20Hor%20Black.png?transform=crush&quality=256
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.116 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-116.ewr53.r.cloudfront.net
Software
Apache /
Resource Hash
5a4ba516b7833541f815c01bc46edb05f853629ba58ca9ac45f74570f221552f

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 09:47:47 GMT
via
1.1 varnish (Varnish/6.2), 1.1 ae9634deb2e9d6f8d396fc6f1e0586fa.cloudfront.net (CloudFront)
age
22559
x-cache
Hit from cloudfront
content-length
3429
server
Apache
etag
"5a4ba516b7833541f815c01bc46edb05f853629ba58ca9ac45f74570f221552f"
x-varnish
338348
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=31556926
access-control-allow-credentials
false
x-amz-cf-pop
EWR53-P1
accept-ranges
bytes
content-type
image/png
x-amz-cf-id
L0gpRRstJGVWqiokvEiYODk4Gk8MQce-Pe73z38oj-S0dxKWv-Jwgw==
DR_SimSpace_The-Case-for-Cyber-Risk-Management.jpg
cache-ssl.celtra.com/api/blobs/c66981429e660b3f23d3d0c2663772377ada5ecbfde3bf9e376e4ccdc2154609/ Frame F866 		19 KB
20 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cache-ssl.celtra.com/api/blobs/c66981429e660b3f23d3d0c2663772377ada5ecbfde3bf9e376e4ccdc2154609/DR_SimSpace_The-Case-for-Cyber-Risk-Management.jpg?transform=crush&quality=85
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.116 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-116.ewr53.r.cloudfront.net
Software
Apache /
Resource Hash
7768586b1abca637ef5ca6b4e964df6ac1ec73ac7dd8c421f35bbfc553a8f76e

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Fri, 15 Apr 2022 08:53:56 GMT
via
1.1 varnish (Varnish/6.2), 1.1 ae9634deb2e9d6f8d396fc6f1e0586fa.cloudfront.net (CloudFront)
age
2876990
x-cache
Hit from cloudfront
content-length
19665
server
Apache
etag
"7768586b1abca637ef5ca6b4e964df6ac1ec73ac7dd8c421f35bbfc553a8f76e"
x-varnish
29492677
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=31556926
access-control-allow-credentials
false
x-amz-cf-pop
EWR53-P1
accept-ranges
bytes
content-type
image/jpeg
x-amz-cf-id
_G8OvmaeRj0Ht9GzVJFxVI7kKWwVITtXT8JlK1j5gCqfVCVkzJIkRQ==
DR_SimSpace_5-Critical-Cyber-Range-Exercises.jpg
cache-ssl.celtra.com/api/blobs/541ce5c4b466c85bfa596ec88252e7a5332bda8d8a539ca7d63babbc48c209d9/ Frame F866 		43 KB
43 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cache-ssl.celtra.com/api/blobs/541ce5c4b466c85bfa596ec88252e7a5332bda8d8a539ca7d63babbc48c209d9/DR_SimSpace_5-Critical-Cyber-Range-Exercises.jpg?transform=crush&quality=85
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.116 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-116.ewr53.r.cloudfront.net
Software
Apache /
Resource Hash
f663a408b84f51eb402c6682e5046607fb8f7aa2d138df4251d6321b12a8a11f

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Tue, 17 May 2022 11:14:27 GMT
via
1.1 varnish (Varnish/6.2), 1.1 ae9634deb2e9d6f8d396fc6f1e0586fa.cloudfront.net (CloudFront)
age
103759
x-cache
Hit from cloudfront
content-length
43678
server
Apache
etag
"f663a408b84f51eb402c6682e5046607fb8f7aa2d138df4251d6321b12a8a11f"
x-varnish
1803449
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=31556926
access-control-allow-credentials
false
x-amz-cf-pop
EWR53-P1
accept-ranges
bytes
content-type
image/jpeg
x-amz-cf-id
rCQ99Tuqync9elbjt4zLLHI45wZZjL2xvWddmZh74NP5eaDWnHuicg==
DR_SimSpace_Improving-Realism-in-Cyber-Ranges.jpg
cache-ssl.celtra.com/api/blobs/96e796b0e5fa1d526c7b7bd1a46cc3ddf840630650b2cd6e382f01b5da4f3093/ Frame F866 		31 KB
31 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cache-ssl.celtra.com/api/blobs/96e796b0e5fa1d526c7b7bd1a46cc3ddf840630650b2cd6e382f01b5da4f3093/DR_SimSpace_Improving-Realism-in-Cyber-Ranges.jpg?transform=crush&quality=85
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.116 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-116.ewr53.r.cloudfront.net
Software
Apache /
Resource Hash
a886d8b4029fe5033428324148230a386a88c96ee0e426b259de53d36d177e0f

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 04 May 2022 18:52:17 GMT
via
1.1 varnish (Varnish/6.2), 1.1 ae9634deb2e9d6f8d396fc6f1e0586fa.cloudfront.net (CloudFront)
age
1199488
x-cache
Hit from cloudfront
content-length
31259
server
Apache
etag
"a886d8b4029fe5033428324148230a386a88c96ee0e426b259de53d36d177e0f"
x-varnish
45089478
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=31556926
access-control-allow-credentials
false
x-amz-cf-pop
EWR53-P1
accept-ranges
bytes
content-type
image/jpeg
x-amz-cf-id
I6GiwomSyBTzpSyjDpoUhJ-L7e-UpSCylhmIPn6EpWdLOA9czE79Hw==
eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNjUyODg5ODI1eGI1NTY4MmY2NDhiYjUzeDI3MjAwMTk2IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIxNjI2MTY2MTI0MzkyNTA1MiIsImluZGV4I...
track.celtra.com/json/ 		35 B
242 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNjUyODg5ODI1eGI1NTY4MmY2NDhiYjUzeDI3MjAwMTk2IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIxNjI2MTY2MTI0MzkyNTA1MiIsImluZGV4IjozLCJjbGllbnRUaW1lc3RhbXAiOjE2NTI4ODk4MjYuOTYyLCJuYW1lIjoiY3JlYXRpdmVMb2FkZWQiLCJ2aWV3YWJpbGl0eTAwTWVhc3VyYWJsZSI6dHJ1ZSwidmlld2FiaWxpdHk1MDFNZWFzdXJhYmxlIjp0cnVlLCJ2aWV3YWJsZVRpbWVNZWFzdXJhYmxlIjpmYWxzZSwiY2RuVmFyaWFudCI6Im5vbmUifSx7InNlc3Npb25JZCI6InMxNjUyODg5ODI1eGI1NTY4MmY2NDhiYjUzeDI3MjAwMTk2IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIxNjI2MTY2MTI0MzkyNTA1MiIsImluZGV4Ijo0LCJjbGllbnRUaW1lc3RhbXAiOjE2NTI4ODk4MjYuOTgsIm5hbWUiOiJ2aWV3cG9ydFBsYWNlbWVudEdlb21ldHJ5IiwicGFnZURpbWVuc2lvbnMiOnsiaGVpZ2h0Ijo0NTk2LCJ3aWR0aCI6MTYwMH0sInZpZXdwb3J0UG9zaXRpb25SZWN0Ijp7IndpZHRoIjoxNjAwLCJoZWlnaHQiOjEyMDAsImxlZnQiOjAsInRvcCI6MH0sImZpcnN0UGxhY2VtZW50UG9zaXRpb25SZWN0Ijp7ImxlZnQiOjk4OCwidG9wIjoyOTYsIndpZHRoIjozMDAsImhlaWdodCI6NDIwfX1dfQ==?crc32c=3601197283
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.172.30.83 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-172-30-83.compute-1.amazonaws.com
Software
/
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 18 May 2022 16:03:47 GMT
Cache-Control
no-cache, no-store, must-revalidate
Expires
0
Connection
keep-alive
Content-Length
35
Content-Type
image/gif
eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNjUyODg5ODI1eGI1NTY4MmY2NDhiYjUzeDI3MjAwMTk2IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIxNjI2MTY2MTI0MzkyNTA1MiIsImluZGV4I...
track.celtra.com/json/ 		35 B
242 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNjUyODg5ODI1eGI1NTY4MmY2NDhiYjUzeDI3MjAwMTk2IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIxNjI2MTY2MTI0MzkyNTA1MiIsImluZGV4Ijo1LCJjbGllbnRUaW1lc3RhbXAiOjE2NTI4ODk4MjYuOTksIm5hbWUiOiJ2aWV3YWJsZTAwIiwiY3JpdGVyaW9uIjp7Im5hbWUiOiJDb3JlIiwicmF0aW8iOjAsInRpbWUiOjB9fSx7InNlc3Npb25JZCI6InMxNjUyODg5ODI1eGI1NTY4MmY2NDhiYjUzeDI3MjAwMTk2IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIxNjI2MTY2MTI0MzkyNTA1MiIsImluZGV4Ijo2LCJjbGllbnRUaW1lc3RhbXAiOjE2NTI4ODk4MjYuOTk5LCJ1bml0TmFtZSI6ImJhbm5lciIsInVuaXRWYXJpYW50TG9jYWxJZCI6bnVsbCwic2NyZWVuTG9jYWxJZCI6MTM2OCwic2NyZWVuVGl0bGUiOiJSZXNvdXJjZXMiLCJzY3JlZW5Jc01hc3RlciI6ZmFsc2UsIm9iamVjdExvY2FsSWQiOm51bGwsIm9iamVjdE5hbWUiOm51bGwsIm9iamVjdENsYXp6IjpudWxsLCJpbml0aWF0aW9uVGltZXN0YW1wIjoxNjUyODg5ODI2Ljk5OSwibmFtZSI6InNjcmVlblNob3duIn0seyJzZXNzaW9uSWQiOiJzMTY1Mjg4OTgyNXhiNTU2ODJmNjQ4YmI1M3gyNzIwMDE5NiIsImFjY291bnRJZCI6IjQ0Yjc0YjM1Iiwic3RyZWFtIjoiYWRFdmVudHMiLCJpbnN0YW50aWF0aW9uIjoiMTYyNjE2NjEyNDM5MjUwNTIiLCJpbmRleCI6NywiY2xpZW50VGltZXN0YW1wIjoxNjUyODg5ODI2Ljk5OSwibmFtZSI6ImNyZWF0aXZlUmVuZGVyZWQifV19?crc32c=2023992387
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.172.30.83 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-172-30-83.compute-1.amazonaws.com
Software
/
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 18 May 2022 16:03:47 GMT
Cache-Control
no-cache, no-store, must-revalidate
Expires
0
Connection
keep-alive
Content-Length
35
Content-Type
image/gif
iframe_api
www.youtube.com/ Frame F866 		980 B
513 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/iframe_api
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:808::200e Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
3862fb70baa9ad01816c503f9d38a76f3ceb4b4e0f1f027f6e9c117909987118
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 16:03:47 GMT
content-encoding
br
x-content-type-options
nosniff
critical-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
server
ESF
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
report-to
{"group":"youtube_main","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube_main"}]}
content-type
text/javascript; charset=utf-8
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
vary
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
cache-control
private, max-age=0
permissions-policy
ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-platform=*, ch-ua-platform-version=*
cross-origin-opener-policy-report-only
same-origin; report-to="youtube_main"
expires
Wed, 18 May 2022 16:03:47 GMT
user_timeline
cache-ssl.celtra.com/api/twitter/statuses/ Frame F866 		60 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cache-ssl.celtra.com/api/twitter/statuses/user_timeline?screen_name=simspacecorp&jsonp=jsonp_celtra_twitter_proxy_11233
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/attacks-breaches/threat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.116 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-116.ewr53.r.cloudfront.net
Software
Apache /
Resource Hash
1b6ccb2e7aae3aab5b67849d4f8ef1645832fda4f483e5ccb0ef5bf0bf6f0019

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Wed, 18 May 2022 15:54:45 GMT
content-encoding
gzip
age
542
x-cache
Hit from cloudfront
content-length
4511
access-control-allow-origin
*
server
Apache
etag
"aac36d9a6b40822ed0ca32d1a6e414993c8021707cfafd02e2e1029e3f06cf52"
vary
Accept-Encoding
x-varnish
4043766
via
1.1 varnish (Varnish/6.2), 1.1 ae9634deb2e9d6f8d396fc6f1e0586fa.cloudfront.net (CloudFront)
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=900
access-control-allow-credentials
false
x-amz-cf-pop
EWR53-P1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
E6K5byUwhepbpMXgonM92C9DKNO7lxPQHcgGRhpMlwdkYLGszmT49g==
Ciso-cybersecurity-consulting-Service%20Masked.jpeg
cache-ssl.celtra.com/api/blobs/d8792bbc230494e876d0acef7d89007f6cecded3e690c9a35e74e65829fd1015/ Frame F866 		30 KB
30 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cache-ssl.celtra.com/api/blobs/d8792bbc230494e876d0acef7d89007f6cecded3e690c9a35e74e65829fd1015/Ciso-cybersecurity-consulting-Service%20Masked.jpeg?transform=crush&quality=85
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.85.61.116 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-52-85-61-116.ewr53.r.cloudfront.net
Software
Apache /
Resource Hash
ece2c00c39d3835b23f677b7f7b8ba1c0f2baee34fc6c0c8093821b580bdd156

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Fri, 15 Apr 2022 08:53:57 GMT
via
1.1 varnish (Varnish/6.2), 1.1 ae9634deb2e9d6f8d396fc6f1e0586fa.cloudfront.net (CloudFront)
age
2876989
x-cache
Hit from cloudfront
content-length
30645
server
Apache
etag
"ece2c00c39d3835b23f677b7f7b8ba1c0f2baee34fc6c0c8093821b580bdd156"
x-varnish
29492685
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=31556926
access-control-allow-credentials
false
x-amz-cf-pop
EWR53-P1
accept-ranges
bytes
content-type
image/jpeg
x-amz-cf-id
pzoII6Z_xjQgJSNZ0v5qDXkojefVbBONMNCmyNa2vz-wS2OeWRCcdg==
rft8KsMQ_normal.png
pbs.twimg.com/profile_images/1491604670002913288/ Frame F866 		1 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pbs.twimg.com/profile_images/1491604670002913288/rft8KsMQ_normal.png
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
146.75.36.159 Reston, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
87961fa53210bbb208e0df242d74cc0bbb62f1572fceb68524c1b98ff45b84ca
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

strict-transport-security
max-age=631138519
x-content-type-options
nosniff
last-modified
Thu, 10 Feb 2022 02:45:20 GMT
date
Wed, 18 May 2022 16:03:47 GMT
x-tw-cdn
FT
content-type
image/png
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-cache
HIT, HIT
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
content-length
1503
x-served-by
cache-fty21362-FTY, cache-iad-kcgs7200054-IAD, cache-tw-ZZZ1
www-widgetapi.js
www.youtube.com/s/player/9c7ce883/www-widgetapi.vflset/ Frame F866 		155 KB
50 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.youtube.com/s/player/9c7ce883/www-widgetapi.vflset/www-widgetapi.js
Requested by
Host: www.youtube.com
URL: https://www.youtube.com/iframe_api
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:808::200e Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
466d1544e0e59534eda589619707ad31a52aaea08b72d0ca4b6f259058f3a491
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

date
Tue, 17 May 2022 16:01:49 GMT
content-encoding
br
x-content-type-options
nosniff
age
86518
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
51672
x-xss-protection
0
last-modified
Mon, 16 May 2022 20:25:09 GMT
server
sffe
vary
Accept-Encoding, Origin
report-to
{"group":"youtube","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/youtube"}]}
content-type
text/javascript
cache-control
public, max-age=31536000
accept-ranges
bytes
cross-origin-opener-policy-report-only
same-origin; report-to="youtube"
expires
Wed, 17 May 2023 16:01:49 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame EC4B 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsuL6QbWJ2burlngnZKA1TLSiwvxFv8YIErBL8BzpW-ibt2pun3p2kImU_4MFD5nYgU6rM7YSrdbjxXyVue_SyqByDhhBn_5fugIZyDSOP3DAGINpjSC&sig=Cg0ArKJSzNV_PrJb_93MEAE&id=lidar2&mcvt=1001&p=126,436,216,1164&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20220516&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=3&adk=2174547932&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1652889825825&rpt=249&isd=0&lsd=0&met=mue&wmsd=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81e::2002 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:47 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame C435 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjstqh0VjzKZULIddfSRTlEVtJ3JyUcU1hK4bxaWg6m1cicoa3VcwFDJU-LnMwEsmPZ_A9l_8g-6pUpZE3utRVwE7gTsnV1mvavfJ0z9JxYAbMOQUah85i90p3po7g6yObsSIfKNqzVxz_vtlTOuH6oMwDNBLXHAy3kGQM3uI3NmgxTn8apLNhugehYQVvK4d-7MjuXwOBMv-_pI00xByQ5K0A9Z5D0RXxlQAxwIKetA4Isz7-CHjpOqHtI70-2iCV_nhReI_WkkPbvVq_KwL33ClVi6zmskX-wLxsDgqxQXUis9F73ZjoP3Vi9deO1yIdx1pRlVPSReCHTOmifLYDuDT51jPC5jjSmDQfiJ5RqYbmMS6&sig=Cg0ArKJSzDFxLBDs1YM6EAE&id=lidar2&mcvt=1000&p=0,0,1200,1600&mtos=1000,1000,1000,1000,1000&tos=1000,0,0,0,0&v=20220516&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=19&adk=636043426&rs=4&la=1&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1652889825729&rpt=432&isd=0&lsd=0&met=ce&wmsd=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81e::2002 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:47 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
activeview
pagead2.googlesyndication.com/pcs/ Frame D744 		42 B
64 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsu7OuTS4Zv9jxZCEz0qr7FLpwEXGuglbkruDMkKfvjX6z2ypfh3p0uq_xXrdMiCSt0sSPvTpq1S0kk9sADYSI5y08nnsK7Sudrq7BamU68xCTk8EU9G&sig=Cg0ArKJSzKyDqsG9t1jSEAE&id=lidar2&mcvt=1001&p=337,988,587,1288&mtos=1001,1001,1001,1001,1001&tos=1001,0,0,0,0&v=20220516&bin=7&avms=nio&bs=1600,1200&mc=1&vu=1&app=0&itpl=3&adk=3086305157&rs=4&la=0&cr=0&uach=WyIiLCIiLCIiLCIiLCIiLFtdLG51bGwsbnVsbCwiIixbXSxmYWxzZV0%3D&vs=4&r=v&rst=1652889825834&rpt=340&isd=0&lsd=0&met=mue&wmsd=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81e::2002 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:47 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=37&q=0&hp=1&wf=1&ra=1&pxm=6&sgs=3&vb=9&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=0&ak=-&i=PENTONMEDIA1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CI%24%3D!Iv*Ebj.JGfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7B%2CNr1U*%26ujMUU9%3C%24kBjqI&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rb=2-LUS3hkIJ33cxUahFibJNuf9eBEDDlqciElgdmM6rBhY%3D&rs=1-5ZHC8H1EcQEJWg%3D%3D&sc=1&os=1-3g%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oDgO%3DLlE6%3ABcmUZzCFV%60pT6yv%7CEkUpF%3D3%3Ch%2C%25%3BMB1_tNOC%604dEzbSIq11_iCTpXSe%2BShooUKV%3B%2B9%7CPQPmf)P%3DH%3BCH%6029YCN%3FAbcE%3DX7IL3kQ%2CNJJ)%2Cc%7ClTr1W*d%5B4kf%2FLyUoRdByZ%3C99Ksf%2FLyUo0)H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&vf=1&vg=100&bq=0&g=1&h=250&w=300&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&id=1&ii=4&f=0&j=&t=1652889826179&de=251728430589&cu=1652889826179&m=1058&ar=8d467bec877-clean&iw=d3fc7f9&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4596&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A400%3A2914%3A2606%3A534&as=1&ag=1050&an=3&gi=1&gf=1050&gg=3&ix=1050&ic=1050&ez=1&ck=1050&kw=851&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1050&bx=3&ci=1050&jz=851&dj=1&aa=0&ad=920&cn=0&gk=920&gl=0&ik=920&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=0&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=851&cd=5&ah=851&am=5&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=5124257703%3A2978231009%3A5909690628%3A138385472861&bo=22316126855&bp=22340016856&bd=300_2v&zMoatPS=300_2v&gw=pentonmedia53440730609&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22340016856&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22340016856&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&zMoatDev=Desktop&zMoatDfpSlotId=13_5u0n2k3ztxb000005u0n2k3ztxb000005u0&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=13_5u0n2k3ztxb000005u0n2k3ztxb000005u0&iq=na&tt=na&tc=0&fs=198321&na=425901451&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:47 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Wed, 18 May 2022 16:03:47 GMT
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=5&q=0&hp=1&wf=1&ra=1&pxm=6&sgs=3&vb=9&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=0&ak=-&i=PENTONMEDIA1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CI%24%3D!Iv*Ebj.JGfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7B%2CNr1U*%26ujMUU9%3C%24kBjqI&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rb=2-LUS3hkIJ33cxUahFibJNuf9eBEDDlqciElgdmM6rBhY%3D&rs=1-5ZHC8H1EcQEJWg%3D%3D&sc=1&os=1-3g%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oDgO%3DLlE6%3ABcmUZzCFV%60pT6yv%7CEkUpF%3D3%3Ch%2C%25%3BMB1_tNOC%604dEzbSIq11_iCTpXSe%2BShooUKV%3B%2B9%7CPQPmf)P%3DH%3BCH%6029YCN%3FAbcE%3DX7IL3kQ%2CNJJ)%2Cc%7ClTr1W*d%5B4kf%2FLyUoRdByZ%3C99Ksf%2FLyUo0)H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&vf=1&vg=100&bq=0&g=2&h=250&w=300&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&id=1&ii=4&f=0&j=&t=1652889826179&de=251728430589&cu=1652889826179&m=1060&ar=8d467bec877-clean&iw=d3fc7f9&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4596&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A400%3A2914%3A2606%3A534&as=1&ag=1050&an=1050&gi=1&gf=1050&gg=1050&ix=1050&ic=1050&ez=1&ck=1050&kw=851&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1050&bx=1050&ci=1050&jz=851&dj=1&aa=0&ad=920&cn=920&gk=920&gl=920&ik=920&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=0&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=851&cd=851&ah=851&am=851&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=5124257703%3A2978231009%3A5909690628%3A138385472861&bo=22316126855&bp=22340016856&bd=300_2v&zMoatPS=300_2v&gw=pentonmedia53440730609&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22340016856&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22340016856&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&zMoatDev=Desktop&zMoatDfpSlotId=13_5u0n2k3ztxb000005u0n2k3ztxb000005u0&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=13_5u0n2k3ztxb000005u0n2k3ztxb000005u0&iq=na&tt=na&tc=0&fs=198321&na=1845163555&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:47 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Wed, 18 May 2022 16:03:47 GMT
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=37&q=1&hp=1&wf=1&ra=1&pxm=6&sgs=3&vb=9&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=0&ak=-&i=PENTONMEDIA1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CI%24%3D!Iv*Ebj.JGfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7B%2CNr1U*%26ujMUU9%3C%24kBjqI&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rb=2-LUS3hkIJ33cxUahFibJNuf9eBEDDlqciElgdmM6rBhY%3D&rs=1-5ZHC8H1EcQEJWg%3D%3D&sc=1&os=1-3g%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oDgO%3DLlE6%3ABcmUZzCFV%60pT6yv%7CEkUpF%3D3%3Ch%2C%25%3BMB1_tNOC%604dEzbSIq11_iCTpXSe%2BShooUKV%3B%2B9%7CPQPmf)P%3DH%3BCH%6029YCN%3FAbcE%3DX7IL3kQ%2CNJJ)%2Cc%7ClTr1W*d%5B4kf%2FLyUoRdByZ%3C99Ksf%2FLyUo0)H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&vf=1&vg=100&bq=0&g=3&h=250&w=300&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&id=1&ii=4&f=0&j=&t=1652889826179&de=251728430589&cu=1652889826179&m=1061&ar=8d467bec877-clean&iw=d3fc7f9&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4596&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A400%3A2914%3A2606%3A534&as=1&ag=1050&an=1050&gi=1&gf=1050&gg=1050&ix=1050&ic=1050&ez=1&ck=1050&kw=851&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1050&bx=1050&ci=1050&jz=851&dj=1&aa=0&ad=920&cn=920&gk=920&gl=920&ik=920&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=0&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=851&cd=851&ah=851&am=851&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=5124257703%3A2978231009%3A5909690628%3A138385472861&bo=22316126855&bp=22340016856&bd=300_2v&zMoatPS=300_2v&gw=pentonmedia53440730609&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22340016856&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22340016856&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&zMoatDev=Desktop&zMoatDfpSlotId=13_5u0n2k3ztxb000005u0n2k3ztxb000005u0&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=13_5u0n2k3ztxb000005u0n2k3ztxb000005u0&iq=na&tt=na&tc=0&fs=198321&na=941573633&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:47 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Wed, 18 May 2022 16:03:47 GMT
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&wf=1&ra=1&pxm=6&sgs=3&vb=9&kq=1&lo=3&uk=null&pk=0&wk=1&rk=1&tk=0&ak=https%3A%2F%2Fwww.darkreading.com%2F%2Fattacks-breaches%2F-&i=PENTONMEDIA1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CI%24%3D!Iv*Ebj.JGfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7B%2CNr1U*%26ujMUU9%3C%24kBjqI&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rb=2-LUS3hkIJ33cxUahFibJNuf9eBEDDlqciElgdmM6rBhY%3D&rs=1-5ZHC8H1EcQEJWg%3D%3D&sc=1&os=1-3g%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oDgO%3DLlE6%3ABcmUZzCFV%60pT6yv%7CEkUpF%3D3%3Ch%2C%25%3BMB1_tNOC%604dEzbSIq11_iCTpXSe%2BShooUKV%3B%2B9%7CPQPmf)P%3DH%3BCH%6029YCN%3FAbcE%3DX7IL3kQ%2CNJJ)%2Cc%7ClTr1W*d%5B4kf%2FLyUoRdByZ%3C99Ksf%2FLyUo0)H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&vf=1&vg=100&bq=0&g=0&h=420&w=300&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&id=1&ii=4&f=0&j=&t=1652889826094&de=799441917199&cu=1652889826094&m=1212&ar=8d467bec877-clean&iw=d3fc7f9&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4596&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A400%3A2914%3A2606%3A534&as=0&ag=99&an=0&gf=99&gg=0&ix=99&ic=99&ez=1&aj=1&pg=100&pf=0&ib=0&cc=0&bw=99&bx=0&dj=1&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=0&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=197&cd=0&ah=197&am=0&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=5124257703%3A2978231009%3A5909690628%3A138385472699&bo=22316126855&bp=22340016856&bd=300_1v&zMoatPS=300_1v&gw=pentonmedia53440730609&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22340016856&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22340016856&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&zMoatDev=Desktop&zMoatDfpSlotId=12_amts25cg0a000000amts25cg0a000000amt&hv=Celtra%20API&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=12_amts25cg0a000000amts25cg0a000000amt&iq=na&tt=na&tc=0&fs=198321&na=1484397347&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:47 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Wed, 18 May 2022 16:03:47 GMT
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=37&q=0&hp=1&wf=1&ra=1&pxm=6&sgs=3&vb=9&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=0&ak=-&i=PENTONMEDIA1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CI%24%3D!Iv*Ebj.JGfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7B%2CNr1U*%26ujMUU9%3C%24kBjqI&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rb=2-LUS3hkIJ33cxUahFibJNuf9eBEDDlqciElgdmM6rBhY%3D&rs=1-5ZHC8H1EcQEJWg%3D%3D&sc=1&os=1-3g%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oDgO%3DLlE6%3ABcmUZzCFV%60pT6yv%7CEkUpF%3D3%3Ch%2C%25%3BMB1_tNOC%604dEzbSIq11_iCTpXSe%2BShooUKV%3B%2B9%7CPQPmf)P%3DH%3BCH%6029YCN%3FAbcE%3DX7IL3kQ%2CNJJ)%2Cc%7ClTr1W*d%5B4kf%2FLyUoRdByZ%3C99Ksf%2FLyUo0)H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&vf=1&vg=100&bq=0&g=1&h=90&w=728&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&id=1&ii=4&f=0&j=&t=1652889826136&de=394534657226&cu=1652889826136&m=1175&ar=8d467bec877-clean&iw=d3fc7f9&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4596&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A400%3A2914%3A2606%3A534&as=1&ag=1167&an=3&gi=1&gf=1167&gg=3&ix=1167&ic=1167&ez=1&ck=1167&kw=966&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1167&bx=3&ci=1167&jz=966&dj=1&aa=1&ad=1063&cn=0&gn=1&gk=1063&gl=0&ik=1063&co=1063&cp=966&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=0&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=966&cd=6&ah=966&am=6&xd=00&rf=0&re=1&ft=1063&fv=0&fw=1063&wb=1&cl=0&at=0&d=4954976792%3A2914620160%3A5800261410%3A138383383812&bo=22316126855&bp=22340016856&bd=728_1v&zMoatPS=728_1v&gw=pentonmedia53440730609&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22340016856&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22340016856&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&zMoatDev=Desktop&zMoatDfpSlotId=6_jdwtkavrt3000000jdwtkavrt3000000jdw&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=6_jdwtkavrt3000000jdwtkavrt3000000jdw&iq=na&tt=na&tc=0&fs=198321&na=571022148&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:47 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Wed, 18 May 2022 16:03:47 GMT
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=5&q=0&hp=1&wf=1&ra=1&pxm=6&sgs=3&vb=9&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=0&ak=-&i=PENTONMEDIA1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CI%24%3D!Iv*Ebj.JGfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7B%2CNr1U*%26ujMUU9%3C%24kBjqI&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rb=2-LUS3hkIJ33cxUahFibJNuf9eBEDDlqciElgdmM6rBhY%3D&rs=1-5ZHC8H1EcQEJWg%3D%3D&sc=1&os=1-3g%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oDgO%3DLlE6%3ABcmUZzCFV%60pT6yv%7CEkUpF%3D3%3Ch%2C%25%3BMB1_tNOC%604dEzbSIq11_iCTpXSe%2BShooUKV%3B%2B9%7CPQPmf)P%3DH%3BCH%6029YCN%3FAbcE%3DX7IL3kQ%2CNJJ)%2Cc%7ClTr1W*d%5B4kf%2FLyUoRdByZ%3C99Ksf%2FLyUo0)H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&vf=1&vg=100&bq=0&g=2&h=90&w=728&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&id=1&ii=4&f=0&j=&t=1652889826136&de=394534657226&cu=1652889826136&m=1176&ar=8d467bec877-clean&iw=d3fc7f9&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4596&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A400%3A2914%3A2606%3A534&as=1&ag=1167&an=1167&gi=1&gf=1167&gg=1167&ix=1167&ic=1167&ez=1&ck=1167&kw=966&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1167&bx=1167&ci=1167&jz=966&dj=1&aa=1&ad=1063&cn=1063&gn=1&gk=1063&gl=1063&ik=1063&co=1063&cp=966&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=0&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=966&cd=966&ah=966&am=966&xd=00&rf=0&re=1&ft=1063&fv=1063&fw=1063&wb=1&cl=0&at=0&d=4954976792%3A2914620160%3A5800261410%3A138383383812&bo=22316126855&bp=22340016856&bd=728_1v&zMoatPS=728_1v&gw=pentonmedia53440730609&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22340016856&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22340016856&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&zMoatDev=Desktop&zMoatDfpSlotId=6_jdwtkavrt3000000jdwtkavrt3000000jdw&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=6_jdwtkavrt3000000jdwtkavrt3000000jdw&iq=na&tt=na&tc=0&fs=198321&na=809501309&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:47 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Wed, 18 May 2022 16:03:47 GMT
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=37&q=1&hp=1&wf=1&ra=1&pxm=6&sgs=3&vb=9&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=0&ak=-&i=PENTONMEDIA1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CI%24%3D!Iv*Ebj.JGfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7B%2CNr1U*%26ujMUU9%3C%24kBjqI&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rb=2-LUS3hkIJ33cxUahFibJNuf9eBEDDlqciElgdmM6rBhY%3D&rs=1-5ZHC8H1EcQEJWg%3D%3D&sc=1&os=1-3g%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oDgO%3DLlE6%3ABcmUZzCFV%60pT6yv%7CEkUpF%3D3%3Ch%2C%25%3BMB1_tNOC%604dEzbSIq11_iCTpXSe%2BShooUKV%3B%2B9%7CPQPmf)P%3DH%3BCH%6029YCN%3FAbcE%3DX7IL3kQ%2CNJJ)%2Cc%7ClTr1W*d%5B4kf%2FLyUoRdByZ%3C99Ksf%2FLyUo0)H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&vf=1&vg=100&bq=0&g=3&h=90&w=728&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&id=1&ii=4&f=0&j=&t=1652889826136&de=394534657226&cu=1652889826136&m=1177&ar=8d467bec877-clean&iw=d3fc7f9&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4596&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A400%3A2914%3A2606%3A534&as=1&ag=1167&an=1167&gi=1&gf=1167&gg=1167&ix=1167&ic=1167&ez=1&ck=1167&kw=966&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1167&bx=1167&ci=1167&jz=966&dj=1&aa=1&ad=1063&cn=1063&gn=1&gk=1063&gl=1063&ik=1063&co=1063&cp=966&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=0&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=966&cd=966&ah=966&am=966&xd=00&rf=0&re=1&ft=1063&fv=1063&fw=1063&wb=1&cl=0&at=0&d=4954976792%3A2914620160%3A5800261410%3A138383383812&bo=22316126855&bp=22340016856&bd=728_1v&zMoatPS=728_1v&gw=pentonmedia53440730609&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22340016856&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22340016856&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&zMoatDev=Desktop&zMoatDfpSlotId=6_jdwtkavrt3000000jdwtkavrt3000000jdw&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=6_jdwtkavrt3000000jdwtkavrt3000000jdw&iq=na&tt=na&tc=0&fs=198321&na=280883645&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:47 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Wed, 18 May 2022 16:03:47 GMT
sodar
pagead2.googlesyndication.com/pagead/ 		0
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pagead2.googlesyndication.com/pagead/sodar?id=sodar2&v=225&t=2&li=gpt_2022051201&jk=3504935758733139&bg=!DwylDEjNAAZL3OSAa9w7ACkAdvg8Wv4lRwKJ_eqdGD4G0NqCW96O4sVg34zg8kgXPtqcLS-0cb21DwIAAAGZUgAAAAloAQeZAra0LsHxL_J0Du1TvYNU2Ssy4oOoNyVno9HNH34XTxlKa6Ujq8_pLgNkSeS7wuZdD5HK42r9qNdPt9amOqY2Z9C30WA3tmKrnNyDMh94lTx3WQ4jQ9LwPPDMoVKJI5VnvHZvTE0PJQEOjezWihjJrEhUh4EIOPwsLzSj5NIcnIfn3E8AWyP1bqOHI14YNGK6UmMhoXX33emFopVx6q-9KAUAb9Pu6jGjWt-t81eZBiLxdkwAAIumZuMYaAKQKjbqaEcXxkSekxe-4GGepyGZ5lvl0RWgf5zEHenksyy19vqYqgEm9Lh7vlOWVjoZOWNc2liVW5u7NCi1t-IeWexImHkZV_KUsVRRTcjJeJf5Q84Q0iS9znZZ50v4j7nAgkPZu1vwQkytqv34MFzijM0CeMynVgquMGj6a7Y8b1sHlncJCTrDjdk_UDRWbMmFt2GP6YLBvJ_Q3HdxHPpQPGhMC2xAGbVicxPyL22jX_Tty7-fsDeJuYnCdCgZMiraUHNnmRaaf2pnE84nbGJdguAsh02_jnAofEps_I797Uoc344qXFe2-uSsEz4H-HC8PHtPDDbXiXFH4rthx-4nK5yj2pWeEXjGNfFYUx832mKUrpPxOehGS-4ppuPjPP9aPMOtujmGjLPjX7SNHw_wPZIPsxAKemml9t11LvL8uprscYp7e6B912UMgulwwrjO4JyvfMpONPMUASIdp9TDjRJCuo2ljDWB06mPOC9RojFdkOj7w9fiJ4qsZDYeAZbDtnkblTpMYKjRhfCSoWhtwSgfspp3QAKEfbKmWwAuRqM4jJvYBYc5Gw5873Tj-C6e75FCYzD1RtSkuX3jdtLQvv9becCmPWcVi7F0mEDf8EyKqufGe1nROEkepwEoIKmjoTx2OL_TJssqSJ6ztI-dwCBv6lL759y09Muh
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2607:f8b0:4006:81e::2002 Staten Island, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=5&q=1&hp=1&wf=1&ra=1&pxm=6&sgs=3&vb=9&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=0&ak=-&i=PENTONMEDIA1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CI%24%3D!Iv*Ebj.JGfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7B%2CNr1U*%26ujMUU9%3C%24kBjqI&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rb=2-LUS3hkIJ33cxUahFibJNuf9eBEDDlqciElgdmM6rBhY%3D&rs=1-5ZHC8H1EcQEJWg%3D%3D&sc=1&os=1-3g%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oDgO%3DLlE6%3ABcmUZzCFV%60pT6yv%7CEkUpF%3D3%3Ch%2C%25%3BMB1_tNOC%604dEzbSIq11_iCTpXSe%2BShooUKV%3B%2B9%7CPQPmf)P%3DH%3BCH%6029YCN%3FAbcE%3DX7IL3kQ%2CNJJ)%2Cc%7ClTr1W*d%5B4kf%2FLyUoRdByZ%3C99Ksf%2FLyUo0)H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&vf=1&vg=100&bq=0&g=4&h=250&w=300&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&id=1&ii=4&f=0&j=&t=1652889826179&de=251728430589&cu=1652889826179&m=1263&ar=8d467bec877-clean&iw=d3fc7f9&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4596&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A400%3A2914%3A2606%3A534&as=1&ag=1255&an=1050&gi=1&gf=1255&gg=1050&ix=1255&ic=1255&ez=1&ck=1050&kw=851&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1255&bx=1050&ci=1050&jz=851&dj=1&aa=1&ad=1125&cn=920&gn=1&gk=1125&gl=920&ik=1125&co=1125&cp=1052&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=0&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1052&cd=851&ah=1052&am=851&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=5124257703%3A2978231009%3A5909690628%3A138385472861&bo=22316126855&bp=22340016856&bd=300_2v&zMoatPS=300_2v&gw=pentonmedia53440730609&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22340016856&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22340016856&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&zMoatDev=Desktop&zMoatDfpSlotId=13_5u0n2k3ztxb000005u0n2k3ztxb000005u0&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=13_5u0n2k3ztxb000005u0n2k3ztxb000005u0&iq=na&tt=na&tc=0&fs=198321&na=683267252&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:47 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Wed, 18 May 2022 16:03:47 GMT
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=37&q=0&hp=1&wf=1&ra=1&pxm=6&sgs=3&vb=9&kq=1&lo=1&uk=null&pk=0&wk=1&rk=1&tk=0&ak=-&i=PENTONMEDIA1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CI%24%3D!Iv*Ebj.JGfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7B%2CNr1U*%26ujMUU9%3C%24kBjqI&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rb=2-LUS3hkIJ33cxUahFibJNuf9eBEDDlqciElgdmM6rBhY%3D&rs=1-5ZHC8H1EcQEJWg%3D%3D&sc=1&os=1-3g%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oDgO%3DLlE6%3ABcmUZzCFV%60pT6yv%7CEkUpF%3D3%3Ch%2C%25%3BMB1_tNOC%604dEzbSIq11_iCTpXSe%2BShooUKV%3B%2B9%7CPQPmf)P%3DH%3BCH%6029YCN%3FAbcE%3DX7IL3kQ%2CNJJ)%2Cc%7ClTr1W*d%5B4kf%2FLyUoRdByZ%3C99Ksf%2FLyUo0)H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&vf=1&vg=100&bq=0&g=1&h=61&w=248&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&id=1&ii=4&f=0&j=&t=1652889825919&de=890423079164&cu=1652889825919&m=1726&ar=8d467bec877-clean&iw=d3fc7f9&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4596&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A400%3A2914%3A2606%3A534&as=1&ag=1161&an=39&gi=1&gf=1161&gg=39&ix=1161&ic=1161&ez=1&ck=1161&kw=998&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1161&bx=39&ci=1161&jz=998&dj=1&aa=0&ad=982&cn=0&gk=982&gl=0&ik=982&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=998&cd=77&ah=998&am=77&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=17506827%3A2990021191%3A5940610987%3A138392437444&bo=22316126855&bp=22340016856&bd=welcome_v&zMoatPS=welcome_v&gw=pentonmedia53440730609&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22340016856&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22340016856&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&zMoatDev=Desktop&zMoatDfpSlotId=div-gpt-ad-welcome&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=div-gpt-ad-welcome&iq=na&tt=na&tc=0&fs=198321&na=1748407793&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:47 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Wed, 18 May 2022 16:03:47 GMT
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=5&q=0&hp=1&wf=1&ra=1&pxm=6&sgs=3&vb=9&kq=1&lo=1&uk=null&pk=0&wk=1&rk=1&tk=0&ak=-&i=PENTONMEDIA1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CI%24%3D!Iv*Ebj.JGfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7B%2CNr1U*%26ujMUU9%3C%24kBjqI&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rb=2-LUS3hkIJ33cxUahFibJNuf9eBEDDlqciElgdmM6rBhY%3D&rs=1-5ZHC8H1EcQEJWg%3D%3D&sc=1&os=1-3g%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oDgO%3DLlE6%3ABcmUZzCFV%60pT6yv%7CEkUpF%3D3%3Ch%2C%25%3BMB1_tNOC%604dEzbSIq11_iCTpXSe%2BShooUKV%3B%2B9%7CPQPmf)P%3DH%3BCH%6029YCN%3FAbcE%3DX7IL3kQ%2CNJJ)%2Cc%7ClTr1W*d%5B4kf%2FLyUoRdByZ%3C99Ksf%2FLyUo0)H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&vf=1&vg=100&bq=0&g=2&h=61&w=248&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&id=1&ii=4&f=0&j=&t=1652889825919&de=890423079164&cu=1652889825919&m=1727&ar=8d467bec877-clean&iw=d3fc7f9&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4596&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A400%3A2914%3A2606%3A534&as=1&ag=1161&an=1161&gi=1&gf=1161&gg=1161&ix=1161&ic=1161&ez=1&ck=1161&kw=998&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1161&bx=1161&ci=1161&jz=998&dj=1&aa=0&ad=982&cn=982&gk=982&gl=982&ik=982&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=998&cd=998&ah=998&am=998&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=17506827%3A2990021191%3A5940610987%3A138392437444&bo=22316126855&bp=22340016856&bd=welcome_v&zMoatPS=welcome_v&gw=pentonmedia53440730609&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22340016856&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22340016856&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&zMoatDev=Desktop&zMoatDfpSlotId=div-gpt-ad-welcome&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=div-gpt-ad-welcome&iq=na&tt=na&tc=0&fs=198321&na=1760833877&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:47 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Wed, 18 May 2022 16:03:47 GMT
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=37&q=1&hp=1&wf=1&ra=1&pxm=6&sgs=3&vb=9&kq=1&lo=1&uk=null&pk=0&wk=1&rk=1&tk=0&ak=-&i=PENTONMEDIA1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CI%24%3D!Iv*Ebj.JGfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7B%2CNr1U*%26ujMUU9%3C%24kBjqI&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rb=2-LUS3hkIJ33cxUahFibJNuf9eBEDDlqciElgdmM6rBhY%3D&rs=1-5ZHC8H1EcQEJWg%3D%3D&sc=1&os=1-3g%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oDgO%3DLlE6%3ABcmUZzCFV%60pT6yv%7CEkUpF%3D3%3Ch%2C%25%3BMB1_tNOC%604dEzbSIq11_iCTpXSe%2BShooUKV%3B%2B9%7CPQPmf)P%3DH%3BCH%6029YCN%3FAbcE%3DX7IL3kQ%2CNJJ)%2Cc%7ClTr1W*d%5B4kf%2FLyUoRdByZ%3C99Ksf%2FLyUo0)H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&vf=1&vg=100&bq=0&g=3&h=61&w=248&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&id=1&ii=4&f=0&j=&t=1652889825919&de=890423079164&cu=1652889825919&m=1728&ar=8d467bec877-clean&iw=d3fc7f9&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4596&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A400%3A2914%3A2606%3A534&as=1&ag=1161&an=1161&gi=1&gf=1161&gg=1161&ix=1161&ic=1161&ez=1&ck=1161&kw=998&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1161&bx=1161&ci=1161&jz=998&dj=1&aa=0&ad=982&cn=982&gk=982&gl=982&ik=982&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=998&cd=998&ah=998&am=998&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=17506827%3A2990021191%3A5940610987%3A138392437444&bo=22316126855&bp=22340016856&bd=welcome_v&zMoatPS=welcome_v&gw=pentonmedia53440730609&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22340016856&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22340016856&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&zMoatDev=Desktop&zMoatDfpSlotId=div-gpt-ad-welcome&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=div-gpt-ad-welcome&iq=na&tt=na&tc=0&fs=198321&na=2132125547&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:47 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Wed, 18 May 2022 16:03:47 GMT
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=5&q=1&hp=1&wf=1&ra=1&pxm=6&sgs=3&vb=9&kq=1&lo=1&uk=null&pk=0&wk=1&rk=1&tk=0&ak=-&i=PENTONMEDIA1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CI%24%3D!Iv*Ebj.JGfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7B%2CNr1U*%26ujMUU9%3C%24kBjqI&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rb=2-LUS3hkIJ33cxUahFibJNuf9eBEDDlqciElgdmM6rBhY%3D&rs=1-5ZHC8H1EcQEJWg%3D%3D&sc=1&os=1-3g%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oDgO%3DLlE6%3ABcmUZzCFV%60pT6yv%7CEkUpF%3D3%3Ch%2C%25%3BMB1_tNOC%604dEzbSIq11_iCTpXSe%2BShooUKV%3B%2B9%7CPQPmf)P%3DH%3BCH%6029YCN%3FAbcE%3DX7IL3kQ%2CNJJ)%2Cc%7ClTr1W*d%5B4kf%2FLyUoRdByZ%3C99Ksf%2FLyUo0)H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&vf=1&vg=100&bq=0&g=4&h=61&w=248&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&id=1&ii=4&f=0&j=&t=1652889825919&de=890423079164&cu=1652889825919&m=1939&ar=8d467bec877-clean&iw=d3fc7f9&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4596&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A400%3A2914%3A2606%3A534&as=1&ag=1374&an=1161&gi=1&gf=1374&gg=1161&ix=1374&ic=1374&ez=1&ck=1161&kw=998&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1374&bx=1161&ci=1161&jz=998&dj=1&aa=1&ad=1195&cn=982&gn=1&gk=1195&gl=982&ik=1195&co=1195&cp=1199&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1199&cd=998&ah=1199&am=998&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=17506827%3A2990021191%3A5940610987%3A138392437444&bo=22316126855&bp=22340016856&bd=welcome_v&zMoatPS=welcome_v&gw=pentonmedia53440730609&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22340016856&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22340016856&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&zMoatDev=Desktop&zMoatDfpSlotId=div-gpt-ad-welcome&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=div-gpt-ad-welcome&iq=na&tt=na&tc=0&fs=198321&na=64561945&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:47 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Wed, 18 May 2022 16:03:47 GMT
eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNjUyODg5ODI1eGI1NTY4MmY2NDhiYjUzeDI3MjAwMTk2IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIxNjI2MTY2MTI0MzkyNTA1MiIsImluZGV4I...
track.celtra.com/json/ 		35 B
242 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNjUyODg5ODI1eGI1NTY4MmY2NDhiYjUzeDI3MjAwMTk2IiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIxNjI2MTY2MTI0MzkyNTA1MiIsImluZGV4Ijo4LCJjbGllbnRUaW1lc3RhbXAiOjE2NTI4ODk4MjguMDAyLCJuYW1lIjoidmlld2FibGU1MDEiLCJjcml0ZXJpb24iOnsibmFtZSI6IjUwLzEiLCJyYXRpbyI6MC41LCJ0aW1lIjoxMDAwfX1dfQ==?crc32c=4181535570
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.172.30.83 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-172-30-83.compute-1.amazonaws.com
Software
/
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 18 May 2022 16:03:48 GMT
Cache-Control
no-cache, no-store, must-revalidate
Expires
0
Connection
keep-alive
Content-Length
35
Content-Type
image/gif
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=37&q=0&hp=1&wf=1&ra=1&pxm=6&sgs=3&vb=9&kq=1&lo=3&uk=null&pk=0&wk=1&rk=1&tk=0&ak=-&i=PENTONMEDIA1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CI%24%3D!Iv*Ebj.JGfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7B%2CNr1U*%26ujMUU9%3C%24kBjqI&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rb=2-LUS3hkIJ33cxUahFibJNuf9eBEDDlqciElgdmM6rBhY%3D&rs=1-5ZHC8H1EcQEJWg%3D%3D&sc=1&os=1-3g%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oDgO%3DLlE6%3ABcmUZzCFV%60pT6yv%7CEkUpF%3D3%3Ch%2C%25%3BMB1_tNOC%604dEzbSIq11_iCTpXSe%2BShooUKV%3B%2B9%7CPQPmf)P%3DH%3BCH%6029YCN%3FAbcE%3DX7IL3kQ%2CNJJ)%2Cc%7ClTr1W*d%5B4kf%2FLyUoRdByZ%3C99Ksf%2FLyUo0)H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&vf=1&vg=100&bq=0&g=1&h=420&w=300&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&id=1&ii=4&f=0&j=&t=1652889826094&de=799441917199&cu=1652889826094&m=2224&ar=8d467bec877-clean&iw=d3fc7f9&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4596&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A400%3A2914%3A2606%3A534&as=1&ag=1114&an=99&gi=1&gf=1114&gg=99&ix=1114&ic=1114&ez=1&ck=1114&kw=1008&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1114&bx=99&ci=1114&jz=1008&dj=1&aa=0&ad=909&cn=0&gk=909&gl=0&ik=909&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=0&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1008&cd=197&ah=1008&am=197&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=5124257703%3A2978231009%3A5909690628%3A138385472699&bo=22316126855&bp=22340016856&bd=300_1v&zMoatPS=300_1v&gw=pentonmedia53440730609&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22340016856&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22340016856&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&zMoatDev=Desktop&zMoatDfpSlotId=12_amts25cg0a000000amts25cg0a000000amt&hv=Exps%3A%20Celtra%20Banner%2FVideo%20%7C%20Celtra%20API&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=12_amts25cg0a000000amts25cg0a000000amt&iq=na&tt=na&tc=0&fs=198321&na=2004912988&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:48 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Wed, 18 May 2022 16:03:48 GMT
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=5&q=0&hp=1&wf=1&ra=1&pxm=6&sgs=3&vb=9&kq=1&lo=3&uk=null&pk=0&wk=1&rk=1&tk=0&ak=-&i=PENTONMEDIA1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CI%24%3D!Iv*Ebj.JGfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7B%2CNr1U*%26ujMUU9%3C%24kBjqI&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rb=2-LUS3hkIJ33cxUahFibJNuf9eBEDDlqciElgdmM6rBhY%3D&rs=1-5ZHC8H1EcQEJWg%3D%3D&sc=1&os=1-3g%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oDgO%3DLlE6%3ABcmUZzCFV%60pT6yv%7CEkUpF%3D3%3Ch%2C%25%3BMB1_tNOC%604dEzbSIq11_iCTpXSe%2BShooUKV%3B%2B9%7CPQPmf)P%3DH%3BCH%6029YCN%3FAbcE%3DX7IL3kQ%2CNJJ)%2Cc%7ClTr1W*d%5B4kf%2FLyUoRdByZ%3C99Ksf%2FLyUo0)H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&vf=1&vg=100&bq=0&g=2&h=420&w=300&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&id=1&ii=4&f=0&j=&t=1652889826094&de=799441917199&cu=1652889826094&m=2226&ar=8d467bec877-clean&iw=d3fc7f9&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4596&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A400%3A2914%3A2606%3A534&as=1&ag=1114&an=1114&gi=1&gf=1114&gg=1114&ix=1114&ic=1114&ez=1&ck=1114&kw=1008&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1114&bx=1114&ci=1114&jz=1008&dj=1&aa=0&ad=909&cn=909&gk=909&gl=909&ik=909&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=0&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1008&cd=1008&ah=1008&am=1008&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=5124257703%3A2978231009%3A5909690628%3A138385472699&bo=22316126855&bp=22340016856&bd=300_1v&zMoatPS=300_1v&gw=pentonmedia53440730609&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22340016856&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22340016856&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&zMoatDev=Desktop&zMoatDfpSlotId=12_amts25cg0a000000amts25cg0a000000amt&hv=Exps%3A%20Celtra%20Banner%2FVideo%20%7C%20Celtra%20API&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=12_amts25cg0a000000amts25cg0a000000amt&iq=na&tt=na&tc=0&fs=198321&na=1164800573&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:48 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Wed, 18 May 2022 16:03:48 GMT
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=37&q=1&hp=1&wf=1&ra=1&pxm=6&sgs=3&vb=9&kq=1&lo=3&uk=null&pk=0&wk=1&rk=1&tk=0&ak=-&i=PENTONMEDIA1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CI%24%3D!Iv*Ebj.JGfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7B%2CNr1U*%26ujMUU9%3C%24kBjqI&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rb=2-LUS3hkIJ33cxUahFibJNuf9eBEDDlqciElgdmM6rBhY%3D&rs=1-5ZHC8H1EcQEJWg%3D%3D&sc=1&os=1-3g%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oDgO%3DLlE6%3ABcmUZzCFV%60pT6yv%7CEkUpF%3D3%3Ch%2C%25%3BMB1_tNOC%604dEzbSIq11_iCTpXSe%2BShooUKV%3B%2B9%7CPQPmf)P%3DH%3BCH%6029YCN%3FAbcE%3DX7IL3kQ%2CNJJ)%2Cc%7ClTr1W*d%5B4kf%2FLyUoRdByZ%3C99Ksf%2FLyUo0)H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&vf=1&vg=100&bq=0&g=3&h=420&w=300&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&id=1&ii=4&f=0&j=&t=1652889826094&de=799441917199&cu=1652889826094&m=2226&ar=8d467bec877-clean&iw=d3fc7f9&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4596&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A400%3A2914%3A2606%3A534&as=1&ag=1114&an=1114&gi=1&gf=1114&gg=1114&ix=1114&ic=1114&ez=1&ck=1114&kw=1008&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1114&bx=1114&ci=1114&jz=1008&dj=1&aa=0&ad=909&cn=909&gk=909&gl=909&ik=909&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=0&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1008&cd=1008&ah=1008&am=1008&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=5124257703%3A2978231009%3A5909690628%3A138385472699&bo=22316126855&bp=22340016856&bd=300_1v&zMoatPS=300_1v&gw=pentonmedia53440730609&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22340016856&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22340016856&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&zMoatDev=Desktop&zMoatDfpSlotId=12_amts25cg0a000000amts25cg0a000000amt&hv=Exps%3A%20Celtra%20Banner%2FVideo%20%7C%20Celtra%20API&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=12_amts25cg0a000000amts25cg0a000000amt&iq=na&tt=na&tc=0&fs=198321&na=1478748322&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:48 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Wed, 18 May 2022 16:03:48 GMT
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=5&q=1&hp=1&wf=1&ra=1&pxm=6&sgs=3&vb=9&kq=1&lo=3&uk=null&pk=0&wk=1&rk=1&tk=0&ak=-&i=PENTONMEDIA1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CI%24%3D!Iv*Ebj.JGfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7B%2CNr1U*%26ujMUU9%3C%24kBjqI&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rb=2-LUS3hkIJ33cxUahFibJNuf9eBEDDlqciElgdmM6rBhY%3D&rs=1-5ZHC8H1EcQEJWg%3D%3D&sc=1&os=1-3g%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oDgO%3DLlE6%3ABcmUZzCFV%60pT6yv%7CEkUpF%3D3%3Ch%2C%25%3BMB1_tNOC%604dEzbSIq11_iCTpXSe%2BShooUKV%3B%2B9%7CPQPmf)P%3DH%3BCH%6029YCN%3FAbcE%3DX7IL3kQ%2CNJJ)%2Cc%7ClTr1W*d%5B4kf%2FLyUoRdByZ%3C99Ksf%2FLyUo0)H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&vf=1&vg=100&bq=0&g=4&h=420&w=300&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&id=1&ii=4&f=0&j=&t=1652889826094&de=799441917199&cu=1652889826094&m=2428&ar=8d467bec877-clean&iw=d3fc7f9&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4596&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A400%3A2914%3A2606%3A534&as=1&ag=1318&an=1114&gi=1&gf=1318&gg=1114&ix=1318&ic=1318&ez=1&ck=1114&kw=1008&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1318&bx=1114&ci=1114&jz=1008&dj=1&aa=1&ad=1113&cn=909&gn=1&gk=1113&gl=909&ik=1113&co=1113&cp=1212&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=0&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1212&cd=1008&ah=1212&am=1008&xd=00&rf=0&re=0&wb=1&cl=0&at=0&d=5124257703%3A2978231009%3A5909690628%3A138385472699&bo=22316126855&bp=22340016856&bd=300_1v&zMoatPS=300_1v&gw=pentonmedia53440730609&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22340016856&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22340016856&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&zMoatDev=Desktop&zMoatDfpSlotId=12_amts25cg0a000000amts25cg0a000000amt&hv=Exps%3A%20Celtra%20Banner%2FVideo%20%7C%20Celtra%20API&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=12_amts25cg0a000000amts25cg0a000000amt&iq=na&tt=na&tc=0&fs=198321&na=1750046949&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:48 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Wed, 18 May 2022 16:03:48 GMT
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&wf=1&ra=1&pxm=6&sgs=3&vb=9&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=0&ak=-&i=PENTONMEDIA1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CI%24%3D!Iv*Ebj.JGfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7B%2CNr1U*%26ujMUU9%3C%24kBjqI&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rb=2-LUS3hkIJ33cxUahFibJNuf9eBEDDlqciElgdmM6rBhY%3D&rs=1-5ZHC8H1EcQEJWg%3D%3D&sc=1&os=1-3g%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oDgO%3DLlE6%3ABcmUZzCFV%60pT6yv%7CEkUpF%3D3%3Ch%2C%25%3BMB1_tNOC%604dEzbSIq11_iCTpXSe%2BShooUKV%3B%2B9%7CPQPmf)P%3DH%3BCH%6029YCN%3FAbcE%3DX7IL3kQ%2CNJJ)%2Cc%7ClTr1W*d%5B4kf%2FLyUoRdByZ%3C99Ksf%2FLyUo0)H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&vf=1&vg=100&bq=0&g=5&h=250&w=300&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&id=1&ii=4&f=0&j=&t=1652889826179&de=251728430589&cu=1652889826179&m=5084&ar=8d467bec877-clean&iw=d3fc7f9&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4596&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A400%3A2914%3A2606%3A534&as=1&ag=5076&an=1255&gi=1&gf=5076&gg=1255&ix=5076&ic=5076&ez=1&ck=1050&kw=851&aj=1&pg=100&pf=100&ib=0&cc=1&bw=5076&bx=1255&ci=1050&jz=851&dj=1&aa=1&ad=4946&cn=1125&gn=1&gk=4946&gl=1125&ik=4946&co=1125&cp=1052&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=0&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=4877&cd=1052&ah=4877&am=1052&xd=00&rf=0&re=0&wb=2&cl=0&at=0&d=5124257703%3A2978231009%3A5909690628%3A138385472861&bo=22316126855&bp=22340016856&bd=300_2v&zMoatPS=300_2v&gw=pentonmedia53440730609&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22340016856&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22340016856&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&zMoatDev=Desktop&zMoatDfpSlotId=13_5u0n2k3ztxb000005u0n2k3ztxb000005u0&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=13_5u0n2k3ztxb000005u0n2k3ztxb000005u0&iq=na&tt=na&tc=0&fs=198321&na=1614206562&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:51 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Wed, 18 May 2022 16:03:51 GMT
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&wf=1&ra=1&pxm=6&sgs=3&vb=9&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=0&ak=-&i=PENTONMEDIA1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CI%24%3D!Iv*Ebj.JGfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7B%2CNr1U*%26ujMUU9%3C%24kBjqI&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rb=2-LUS3hkIJ33cxUahFibJNuf9eBEDDlqciElgdmM6rBhY%3D&rs=1-5ZHC8H1EcQEJWg%3D%3D&sc=1&os=1-3g%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oDgO%3DLlE6%3ABcmUZzCFV%60pT6yv%7CEkUpF%3D3%3Ch%2C%25%3BMB1_tNOC%604dEzbSIq11_iCTpXSe%2BShooUKV%3B%2B9%7CPQPmf)P%3DH%3BCH%6029YCN%3FAbcE%3DX7IL3kQ%2CNJJ)%2Cc%7ClTr1W*d%5B4kf%2FLyUoRdByZ%3C99Ksf%2FLyUo0)H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&vf=1&vg=100&bq=0&g=4&h=90&w=728&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&id=1&ii=4&f=0&j=&t=1652889826136&de=394534657226&cu=1652889826136&m=5206&ar=8d467bec877-clean&iw=d3fc7f9&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4596&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A400%3A2914%3A2606%3A534&as=1&ag=5198&an=1167&gi=1&gf=5198&gg=1167&ix=5198&ic=5198&ez=1&ck=1167&kw=966&aj=1&pg=100&pf=100&ib=0&cc=1&bw=5198&bx=1167&ci=1167&jz=966&dj=1&aa=1&ad=5094&cn=1063&gn=1&gk=5094&gl=1063&ik=5094&co=1063&cp=966&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=0&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=4999&cd=966&ah=4999&am=966&xd=00&rf=0&re=1&ft=4993&fv=1063&fw=1063&wb=2&cl=0&at=0&d=4954976792%3A2914620160%3A5800261410%3A138383383812&bo=22316126855&bp=22340016856&bd=728_1v&zMoatPS=728_1v&gw=pentonmedia53440730609&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22340016856&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22340016856&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&zMoatDev=Desktop&zMoatDfpSlotId=6_jdwtkavrt3000000jdwtkavrt3000000jdw&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=6_jdwtkavrt3000000jdwtkavrt3000000jdw&iq=na&tt=na&tc=0&fs=198321&na=1638490743&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:51 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Wed, 18 May 2022 16:03:51 GMT
pixel.gif
px.moatads.com/ 		43 B
260 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&wf=1&ra=1&pxm=6&sgs=3&vb=9&kq=1&lo=1&uk=null&pk=0&wk=1&rk=1&tk=0&ak=-&i=PENTONMEDIA1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5t(Kc%2CI%24%3D!Iv*Ebj.JGfxECSR23_hFAkD%3Dv%3CN%5B.%22%24b_o%3FtVD%5D%5BpN%7CQF%40Sy7%7B%2CNr1U*%26ujMUU9%3C%24kBjqI&tf=1_nMzjG---CSa7H-nHVQZC-bW7qhB-LRwqH-nMzjG-&vi=111111&rb=2-LUS3hkIJ33cxUahFibJNuf9eBEDDlqciElgdmM6rBhY%3D&rs=1-5ZHC8H1EcQEJWg%3D%3D&sc=1&os=1-3g%3D%3D&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTE1RmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7Oxib8MxOtJYHCBdm5kBhIcC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBBBj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNwxBbBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=0&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=ot%24b%5Bh%40%22oDgO%3DLlE6%3ABcmUZzCFV%60pT6yv%7CEkUpF%3D3%3Ch%2C%25%3BMB1_tNOC%604dEzbSIq11_iCTpXSe%2BShooUKV%3B%2B9%7CPQPmf)P%3DH%3BCH%6029YCN%3FAbcE%3DX7IL3kQ%2CNJJ)%2Cc%7ClTr1W*d%5B4kf%2FLyUoRdByZ%3C99Ksf%2FLyUo0)H&ql=%3B%5BpwxnRd%7Dt%3Aal9EU%22y%2F.D%5B5%2F%5BGI%3Fi6%5EB61%2F%3DSqcMr1%7B%2CTu9LJJ(a.P%2B)s1(uA&qo=0&qr=0&vf=1&vg=100&bq=0&g=5&h=61&w=248&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&id=1&ii=4&f=0&j=&t=1652889825919&de=890423079164&cu=1652889825919&m=5621&ar=8d467bec877-clean&iw=d3fc7f9&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=4596&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A400%3A2914%3A2606%3A534&as=1&ag=5057&an=1374&gi=1&gf=5057&gg=1374&ix=5057&ic=5057&ez=1&ck=1161&kw=998&aj=1&pg=100&pf=100&ib=0&cc=1&bw=5057&bx=1374&ci=1161&jz=998&dj=1&aa=1&ad=4878&cn=1195&gn=1&gk=4878&gl=1195&ik=4878&co=1195&cp=1199&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=4893&cd=1199&ah=4893&am=1199&xd=00&rf=0&re=0&wb=2&cl=0&at=0&d=17506827%3A2990021191%3A5940610987%3A138392437444&bo=22316126855&bp=22340016856&bd=welcome_v&zMoatPS=welcome_v&gw=pentonmedia53440730609&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22340016856&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22340016856&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fattacks-breaches%2Fthreat-actor-deploying-sophisticated-post-exploit-framework-on-exchange-servers&zMoatDev=Desktop&zMoatDfpSlotId=div-gpt-ad-welcome&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=div-gpt-ad-welcome&iq=na&tt=na&tc=0&fs=198321&na=1988762025&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.163.40 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a23-52-163-40.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

accept-language
en-CA,en;q=0.9
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 18 May 2022 16:03:51 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Wed, 18 May 2022 16:03:51 GMT

Verdicts & Comments Add Verdict or Comment

132 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| 8 object| 9 object| 10 object| 11 object| 12 object| oncontextlost object| oncontextrestored function| structuredClone function| getScreenDetails object| newRelicLoaderConfig object| newRelicInfo object| NREUM object| newrelic function| __nr_require boolean| canRunAds object| dataLayer string| gAdsNetworkId string| reg string| adsPattern string| pageId string| aid string| ptype string| kw object| zephrBrowser object| webpackChunk_N_E object| regeneratorRuntime object| __NEXT_DATA__ function| __SSG_MANIFEST_CB object| __NEXT_P object| next object| _N_E function| _ function| __NEXT_PRELOADREADY object| googletag object| ggeac object| google_tag_data object| google_js_reporting_queue function| setImmediate function| clearImmediate function| __BUILD_MANIFEST_CB string| welcad object| __BUILD_MANIFEST object| __SSG_MANIFEST function| $ function| jQuery function| Popper object| bootstrap object| __cfBeacon object| google_tag_manager function| postscribe object| google_tag_manager_external string| GoogleAnalyticsObject function| ga object| _elqQ function| hj object| _hjSettings object| _sf_async_config object| script function| onYouTubeIframeAPIReady undefined| google_measure_js_timing object| hjSiteSettings function| hjBootstrap object| hjBootstrapCalled object| hjLazyModules object| elqCookieValue object| _elq object| IIRISTracker undefined| iris-t object| GlobalSnowplowNamespace function| snowplow function| Treasure object| gaplugins object| google_optimize object| gaGlobal object| gaData function| Dpxl object| dpmPixels object| jQuery1111029279290995210827 object| scriptUrl object| ttPolicy object| YT object| YTConfig function| onYTReady object| _cb_shared object| pSUPERFLY_mab object| _cbq object| pSUPERFLY object| ube object| yt function| ytDomDomGetNextId object| ytEventsEventsListeners object| ytEventsEventsCounter object| ytglobal object| ytPubsub2Pubsub2Instance object| ytPubsub2Pubsub2SubscribedKeys object| ytPubsub2Pubsub2TopicToKeys object| ytPubsub2Pubsub2IsAsync object| ytPubsub2Pubsub2SkipSubKey object| ytNetworklessLoggingInitializationOptions object| ytPubsubPubsubInstance object| ytPubsubPubsubTopicToKeys object| ytPubsubPubsubIsSynchronous object| ytPubsubPubsubSubscribedKeys object| ytLoggingTransportGELQueue_ object| ytLoggingTransportGELProtoQueue_ object| ytLoggingTransportTokensToCttTargetIds_ object| ytLoggingTransportTokensToJspbCttTargetIds_ object| ytLoggingGelSequenceIdObj_ object| _ml object| activeAdsLoad object| googleToken object| googleIMState function| processGoogleToken number| google_unique_id object| GoogleGcLKhOms object| Moat#G26 boolean| Moat#EVA object| MoatSuperV26 boolean| attachedML object| MoatDataJsonpRequest_55194081 object| teadsscript object| teads object| __CELTRA object| google_image_requests

67 Cookies

Domain/Path Name / Value
www.darkreading.com/attacks-breaches Name: hasLiveRampMatch
Value: true
.darkreading.com/ Name: __Secure-next-auth.callback-url
Value: https%3A%2F%2Fwww.darkreading.com
.darkreading.com/ Name: _gcl_au
Value: 1.1.414458286.1652889824
www.darkreading.com/ Name: __Host-next-auth.csrf-token
Value: 3311f6bf08b8fad6a8e4599b808becc0297235dd788746fd2304a5797a211076%7C201981ce459e75987ff7ec1624308a9d5a9b0bea4a97fe102129a96e56ebb139
.youtube.com/ Name: YSC
Value: IC-ipLTfYEg
.youtube.com/ Name: VISITOR_INFO1_LIVE
Value: qUdFn2cfgDM
.darkreading.com/ Name: _ga
Value: GA1.2.1366153732.1652889824
.darkreading.com/ Name: _gid
Value: GA1.2.2062177657.1652889824
.darkreading.com/ Name: _gat_UA-135180592-2
Value: 1
www.darkreading.com/ Name: dpm_url_count
Value: 1
www.darkreading.com/ Name: _cb
Value: DPR0VAEPW4ODNt5U4
www.darkreading.com/ Name: _chartbeat2
Value: .1652889824189.1652889824189.1.B9A4BUBKN1pjDqaGBgDfm2NvDvddAC.1
www.darkreading.com/ Name: _cb_svref
Value: null
.darkreading.com/ Name: _sp_ses.94c4
Value: *
.darkreading.com/ Name: _sp_id.94c4
Value: 77d38d03-0f5f-446e-9050-25fef836688a.1652889824.1.1652889824.1652889824.2f890818-44c4-4aa3-a43f-8ffcac24592a
.adnxs.com/ Name: uuid2
Value: 4008352111651074917
.darkreading.com/ Name: __td_signed
Value: true
.darkreading.com/ Name: _td
Value: 42ef3920-8bf9-453d-9452-e1a0aa27aeaa
.darkreading.com/ Name: _hjSessionUser_2610568
Value: eyJpZCI6ImU1ZWI3MDEyLTE0MDYtNTI4MC05NmZiLTk5NjdjNTljMjc5YSIsImNyZWF0ZWQiOjE2NTI4ODk4MjQyODcsImV4aXN0aW5nIjpmYWxzZX0=
.darkreading.com/ Name: _hjFirstSeen
Value: 1
www.darkreading.com/ Name: _hjIncludedInSessionSample
Value: 0
.darkreading.com/ Name: _hjSession_2610568
Value: eyJpZCI6IjFjYzBhOTRiLWE2NGMtNDM2NS1hYTcyLTY4NGMyYWVhM2E2MSIsImNyZWF0ZWQiOjE2NTI4ODk4MjQzMjYsImluU2FtcGxlIjpmYWxzZX0=
www.darkreading.com/ Name: _hjIncludedInPageviewSample
Value: 1
.darkreading.com/ Name: _hjAbsoluteSessionInProgress
Value: 1
.dpmsrv.com/ Name: dpm_pxl
Value: be310caf6f0c01d9828e7b7d48d82f568789eb1a
.dpmsrv.com/ Name: dpm_pxl_aid
Value: 4008352111651074917
.doubleclick.net/ Name: IDE
Value: AHWqTUn5J612CzG6pkXFuSeXjra2OaliWZkbX4HsUqkK5RaEgAUNxDtznnXQZ4XRl7I
.darkreading.com/ Name: ELOQUA
Value: GUID=55E48DD607DB4839939B67ADFE2CDD01
.pippio.com/ Name: did
Value: _LQjBd1MJ8FD1YgU
.pippio.com/ Name: didts
Value: 1652889824
.pippio.com/ Name: nnls
Value:
.in.treasuredata.com/ Name: _td_global
Value: a8a77e50-3165-4e88-bf6d-65007ad242de
.pippio.com/ Name: pxrc
Value: COCxlJQGEgQIAhAAEgYI7OsBEAA=
.linksynergy.com/ Name: rmuid
Value: 97289869-cdf6-4e7f-83df-709660c5d5d8
.linksynergy.com/ Name: icts
Value: 2022-05-18T16:03:44Z
.darkreading.com/ Name: sp
Value: ae2f8877-6ebc-4704-8988-8cad73158718
.ml314.com/ Name: pi
Value: 3627294074409582600
.rlcdn.com/ Name: rlas3
Value: XBWddKEXnVLpSgN0Qi04J49uO8gUXE0Fc3t4dgc6bmE=
.rlcdn.com/ Name: pxrc
Value: COCxlJQGEgUI6AcQABIFCOhHEAASBQjbThAB
.adsrvr.org/ Name: TDID
Value: 34b50b2e-1c5e-4d58-86ca-d1813d53017f
.demdex.net/ Name: demdex
Value: 32180882708691859980464320284369069049
.crwdcntrl.net/ Name: _cc_dc
Value: 0
.crwdcntrl.net/ Name: _cc_id
Value: a6c68c311fbb44f4e440d9bac87a62df
.dpm.demdex.net/ Name: dpm
Value: 32180882708691859980464320284369069049
.eyeota.net/ Name: mako_uid
Value: 180d7e92fdb-7bf00000010a5133
.eyeota.net/ Name: SERVERID
Value: 20787~DM
www.darkreading.com/ Name: informa_gdpr_cookie
Value: 1
.darkreading.com/ Name: __gads
Value: ID=bfa9cd98ad0660f5:T=1652889825:S=ALNI_MbDCYrcnVvx8FLwozAaMpvXJtTfgA
.darkreading.com/ Name: __gpi
Value: UID=000005bb1ec8c12a:T=1652889825:RT=1652889825:S=ALNI_Ma2RtWaZ26d3_5Z_o0JNnqdEWIosQ
.nr-data.net/ Name: JSESSIONID
Value: a36ec0d7e8bd501
.ml314.com/ Name: u
Value: aHR0cHM6Ly93d3cuZGFya3JlYWRpbmcuY29tL2F0dGFja3MtYnJlYWNoZXMvdGhyZWF0LWFjdG9yLWRlcGxveWluZy1zb3BoaXN0aWNhdGVkLXBvc3QtZXhwbG9pdC1mcmFtZXdvcmstb24tZXhjaGFuZ2Utc2VydmVycw==
.ml314.com/ Name: tp
Value: 8%3b5%2f18%2f2022+12%3a03%3a46+PM%3b0
.teads.tv/ Name: tt_viewer
Value: eed3fd5c-407f-43bf-8415-729de81fdb8a
.mathtag.com/ Name: uuid
Value: 4dde6285-18e2-4100-9567-6c40bf510df2
.teads.tv/ Name: tt_exelate
Value:
.teads.tv/ Name: tt_bluekai
Value:
.teads.tv/ Name: tt_liveramp
Value:
.teads.tv/ Name: tt_neustar
Value:
.teads.tv/ Name: tt_salesforce
Value:
.adsrvr.org/ Name: TDCPM
Value: CAESFgoHZDB0cm8xahILCJKN3c3AvNw6EAUYASABKAIyCwj-zZaK17zcOhAFOAFaBXRlYWRzYAI.
.yahoo.com/ Name: A3
Value: d=AQABBOIYhWICECjGBcfg1HCHhCtcBgYI5oMFEgEBAQFqhmKOYgAAAAAA_eMAAA&S=AQAAApRcUHTqt-uZzMc4NigQNYQ
.krxd.net/ Name: _kuid_
Value: O2FGnv3k
.criteo.com/ Name: uid
Value: 75ce90fb-6c80-4c61-b13b-22733d19063b
.agkn.com/ Name: ab
Value: 0001%3AOfTrks0z7wU7UxdW%2Bb999RD8SGYPojW9
.exelator.com/ Name: EE
Value: "e53380fe2b24f6f9e062e3a726254ae5"
.exelator.com/ Name: ud
Value: "eJxrXxzq6XKLQSHV1NjYwiAt1SjJyCTNLM0y1cDMKNU40dzIzMjUJDHVdHFZatGCpaXFqSlJh5ZU5JTkNK0uiw91jHdz9PX0iVzmnFGUn5u6AiwU5hq02NDAcEl%252BUWb6ImfHxUUpaQyLSopPBR%252FI%252FgoAkyEqfQ%253D%253D"
www.darkreading.com/ Name: dpm_time_site
Value: 6.009

3 Console Messages

Source Level URL
Text
other warning URL: https://a.teads.tv/media/format/v3/teads-format.min.js
Message:
Origin trial controlled feature not enabled: 'attribution-reporting'.
network error URL: https://www.darkreading.com/sites/all/themes/penton_core_theme/images/ContentPillar_Welcome_1200.png
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://idsync.rlcdn.com/474599.gif?partner_uid=eed3fd5c-407f-43bf-8415-729de81fdb8a_ca&gdpr_consent=&cv=&_t=1652889826673
Message:
Failed to load resource: the server responded with a status of 400 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

6600d6d98e534115970f9529a45f3195.js.ubembed.com
82c8e2daca830d4ec57f996206427194.safeframe.googlesyndication.com
a.dpmsrv.com
a.teads.tv
aa.agkn.com
ads.celtra.com
adservice.google.com
assets.ubembed.com
assets.zephr.com
bam.eu01.nr-data.net
beacon.krxd.net
beta.darkreading.com
c.darkreading.com
cache-ssl.celtra.com
cdn.treasuredata.com
cdn2.teads.tv
cdnjs.cloudflare.com
cm.g.doubleclick.net
code.jquery.com
dis.criteo.com
dpm.demdex.net
eu-images.contentstack.com
eu01.in.treasuredata.com
fonts.gstatic.com
geo.moatads.com
ib.adnxs.com
idsync.rlcdn.com
img.en25.com
in.hotjar.com
in.ml314.com
informa-dark-reading.preview.zephr.com
js-agent.newrelic.com
load77.exelator.com
loadm.exelator.com
match.adsrvr.org
ml314.com
pagead2.googlesyndication.com
pbs.twimg.com
ping.chartbeat.net
pippio.com
pixel.mathtag.com
pr-bh.ybp.yahoo.com
ps.eyeota.net
px.moatads.com
s.dpmsrv.com
script.hotjar.com
securepubads.g.doubleclick.net
stackpath.bootstrapcdn.com
static.chartbeat.com
static.cloudflareinsights.com
static.hotjar.com
static.iris.informa.com
stats.g.doubleclick.net
sync.crwdcntrl.net
sync.teads.tv
t.teads.tv
tags.bluekai.com
tags.rd.linksynergy.com
tpc.googlesyndication.com
track.celtra.com
trk.darkreading.com
vars.hotjar.com
vc.hotjar.io
www.darkreading.com
www.google-analytics.com
www.google.ca
www.google.com
www.googleoptimize.com
www.googletagmanager.com
www.googletagservices.com
www.youtube.com
z.moatads.com
104.118.9.10
104.76.100.229
107.178.254.65
142.0.173.15
142.251.35.162
142.251.40.98
143.204.146.69
143.204.146.76
143.204.146.92
146.75.36.159
151.101.129.131
151.101.194.137
151.101.194.217
18.217.19.184
18.233.240.143
185.221.87.248
2001:4de0:ac18::1:a:3a
23.195.109.72
23.200.197.46
23.217.37.202
23.52.163.40
23.52.164.7
2600:1f18:4e9:5a02:5689:a3a1:b994:601c
2600:9000:202c:bc00:18:1fcd:351:7bc1
2606:4700:440e::ac40:9c1a
2606:4700::6811:190e
2606:4700::6811:7763
2606:4700::6811:7963
2606:4700::6812:acf
2607:f8b0:4004:c06::9b
2607:f8b0:4006:806::2001
2607:f8b0:4006:806::2004
2607:f8b0:4006:808::200e
2607:f8b0:4006:809::2003
2607:f8b0:4006:80a::2002
2607:f8b0:4006:80a::2008
2607:f8b0:4006:80c::2003
2607:f8b0:4006:80e::200e
2607:f8b0:4006:816::2002
2607:f8b0:4006:81d::200e
2607:f8b0:4006:81e::2002
2607:f8b0:4006:822::2001
2a02:6ea0:c400::11
3.224.247.179
3.87.151.192
34.111.234.236
34.226.181.34
34.229.3.43
34.98.67.3
35.170.140.102
35.190.60.146
52.205.48.68
52.223.40.198
52.29.180.64
52.49.46.73
52.55.144.0
52.85.61.102
52.85.61.116
52.85.61.122
52.85.61.15
52.85.61.49
52.85.61.56
52.85.61.61
54.172.30.83
54.211.26.76
68.67.160.132
74.119.119.150
99.84.126.105
99.84.37.122
01dbd527a90b3355432c7dbcc4f8401812f29d8acab256b1c4b079f2a286b650
02835066969199e9924f1332f7172a5d7e552f023a20c3d8ba03bb6c51ce5be5
04d64f65072f624d3a1c5c29b27f02e1d8c09aad3d1f7b1a2b86f200cdc883aa
067b8ebe203f9377c57d506b933f517839f293dd9a8be2f7e323e5f4040f9122
0a6c3d599df1f9652eaead106ccaf3af4eed8645fe10b0791499f8826c4febd7
0ac5442585942acb8da8f6fd1e2ef864b68a552686c83484c0044772d6a3ec77
0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
0bca10549df770ab6790046799e5a9e920c286453ebbb2afb0d3055339245339
0c9cf152a0ad00d4f102c93c613c104914be5517ac8f8e0831727f8bfbe8b300
0e153b77b7b590360c91df38e894d46fd6061ce57cc0bbbc09f4c408a66bd0c7
15c474dcecd282ae20f40c139a2ea28ea8cfed61453757b9c1d6c30452a0649a
162fdc59fe32d506fa254e5f6e6ace62991757ccb10910d0e3a4be7f8724e8b3
1813980c6380c04ed03acf13c8c9589024fa19202df34f668bb058fab3e251c4
1ace1b17e77ec3828eda87eb3fea3671ce2a0f706426fbd158873546c4f9366e
1b6ccb2e7aae3aab5b67849d4f8ef1645832fda4f483e5ccb0ef5bf0bf6f0019
1dcc17de6c7a4aa95a465d7fbb436e3f4c412dad3aa183fde03fa32f9178c3ca
262f87d47643975a4633b675fc224c7a178d99e579e5d767f4a43ca7cc0bb9de
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
26d9536ee3db6eb4f8fd86f5537707c5d86a824c9d0aac6fca71f3711c641351
27a3639eb98cd49240126c3693b8ec1d5e20a5a5e924ee498029bd5390841e5d
2c947fb257287976cf7cd15cd2a488c1cc4093a5c5ff2a40a56ba9a7c9e07c08
2df5b8c108129299c6bf055d3923cf1e2614262da142c75a3751ed524bad7162
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
308e134d9a0df8031a894aa2bb6e70515cb9db2403e3e568e7554ae69f474c96
314343de4ec0e06d19e192d041f8f11ad56414b312d045bfa3f87aa038c665a5
31778d7d5cdf674cb88174d58247acb84fc97239ee406994a646c5d3d0b8cb64
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
3346de8e2ae1bfde250c7ac5c06f79a0a60c7faef8e5e08a2c9e8fbf5ec2c9e8
35463ce93e7c820faa404db98d939ff640ae78ca0e29be043861853c9e07c586
35e0f79b3ddcc374c2be181d1b34f9d3c44d2743421cfbcdf326851ef7f94cd7
36146783665e9d945c68f46e534cc09aa8324ce84119759e7a19fcb969346c42
3862fb70baa9ad01816c503f9d38a76f3ceb4b4e0f1f027f6e9c117909987118
3ba7f40e2b4080979389e9b81e6d0ed155e9b7f74b3310bc1289ee70cba2035d
3e8e76a70b5ec0a97f60491364274ab39aebd8f949b6a310a174633b015d4738
3ef202e41d4e186d964382aa64cc2dc272a97faa390adb7130c4bc5089a44a47
403e89bf468c203d1f4887cbc4ab12878370cbade342b65d30c36a38d60894ee
4210ce362220f12cb0f1ba2eb9f9378546d115fc0c1d23eb71e399604275cf04
434165aad32c85a1086d1e782f3f3321301361486b79064d1265207e07b09732
437b4f1f0bd6b264f51e7a09f666e2c01eef941f4066086fc4a697e674c82f8a
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
466d1544e0e59534eda589619707ad31a52aaea08b72d0ca4b6f259058f3a491
46d2fa2c3db4ca065880a66c04ef9a9fa8719ddefe8ada3f7e05719a1767ca19
46d3462282e19bb7a4f1a0b20005700ef582f8ba6d7d0ea10393ae29d840c1cd
47cb96b05d896668a55f58a1a352f71a53fe50b1ab85a9920e8da3cbe3e20a23
4d6f1cf5d9614b5be94ec1299a84df371511a41dd06768bee621ea3bcfada833
4eb103094821b4a4fda221f8c5a8f81c4361766ea11c84bd2f8e48fdabe23f82
4f381ccb6f965e2011700b253aa446e84060a338cc416055eabca3b62fa35435
53b0053087c796bee6fb74269f3ff3e6316beb7e06309cfbccb5d52a45e69d7f
55a119c0394f901a8a297e109c17b5e5402689708b999ab10691c16179f32a4a
56587cffbb30e338497c9114f74803a530a713ebe374b69fcfa8551ad8dad1e9
5984eac0c5c6d947241e29dd5671b81a1546cedf77e08d38438ac47029969afa
5a4ba516b7833541f815c01bc46edb05f853629ba58ca9ac45f74570f221552f
5e14573ba9dd1cb9df5d3676c134f794ff4ff4629365e005b3c1dd79d3457870
61c32059a5e94075a7ecff678b33907966fc9cfa384daa01aa057f872da14dbb
65c8781d450035fd50d0f6640abe12a521d7772b92531f2fe9e9e34a8bc51276
6a60be897002297376fc1adbb92b0bbaa8c82bdcb72c80fa7773d901c454f2c1
6e8ff90d8ddc47f7854a26b6a4dc1ec0df053ee96e5b609902eb00acf57c2f40
6fbc242e6492c6c2be0e0e965f32cc564b088e8b9b54f4b5c552b2be35066619
709b4a953e1fee71e6582f1610cdd46a27b4c7bff6f457bc8e5979c63055b4b6
711939c856bb03ca15f065d9281370f0576f85937f3f818e1cad70631ab5fee9
74b0bdf21addb85c17a709b87d27b77f8cf39101af6ec782b24404b3b85efcf0
74f5dbfff8c31d8876ddeb224b893ab65552f596b25b3577cf6d6f519c9e8ac9
7551cf70806b4962a75f55d66047e9a5c2ce0510f69b83c47024bcc23693c3a0
757c66837cfbe8c2533e8c41099d8e50b20f83fbf84ead6a6d7435dcc2ad0884
75d893335a1d25db1bf02e25ab904d97a3af743128850d8566b93d197e56e9e9
7768586b1abca637ef5ca6b4e964df6ac1ec73ac7dd8c421f35bbfc553a8f76e
7e34e3650444be4442224a77990a95d0ba66457124adf9e73df76e8134110d1c
7ea4e2110179c11f2b787e11455b0755011bbea4ad0744385b4ad18dfeaa6337
8028c67a8d75e527561d4fb6fecbba6993ff48645f0b57d5033809e558e59d13
8134e989e666a36aa96b14343a5a0be5cbf846fe98b2e8d16d73a1a4b3e98f7c
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
86646baf6689e8941f4bfd0619eefc77c58b85e7f54dd83d84c8d834a410c4a0
8685bca4bb29a8a8289c3effd282cb8718a7d14da65f1397481f213b15469f50
87961fa53210bbb208e0df242d74cc0bbb62f1572fceb68524c1b98ff45b84ca
8aa048082094d36080fc028ab1584264596c64fb5b362038c4761ac9838d6b14
8acf63a7ff114a450762601a6156d3a1256fcbff4061a2feb24c7b173a6f86c6
8b0e0e1532b550e4aa75788c0be84dea157a9e3342eb01e2d5f037cdf638521d
8b30f33afeec62f5aef6d6e927c450c42ed04fa92264342f9a3cf361e3171d16
8c99565562824219eadf0a860cd9da35ac1d48410d3e65d467968c5af4fb4f62
8ced09284a1c4ae88949d807100d854ae5afebca35c07dc3d792c937ddbdc472
9149ddb93502775a9dfce306f1b62f1328a0970f2b2971901544a82065a74605
9250f0b586e89674ec647d8dfb6fe7aedcb588be13ebb6aeb1286efa9d3cfb39
92f01876c6d6366b6478537794c054d8cfd673c1b4b4989fd54bb0b432e266aa
9314a79ef761aa291e0429c9cdb4c8d84509aade781e0b02ca1848648035864e
951d29553c936c5e999247cfe53a9b08bf29b53cbb957e878e1e0ee7bd4dcae0
958136771bc42c0cbea29f08be65260d0b8b63020d9f41039261fbf26a0cc942
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a73730123a43c3040d889aaee11ec35094277ce5f778076b262c23a293870adb
a886d8b4029fe5033428324148230a386a88c96ee0e426b259de53d36d177e0f
a9501660e1ee63dd0a9fea4ca45f506b815775c692f689940845d341826af96d
ab36b8356d4b7e3e3591b161427e6fb18512a2ccc8a787f8cc03294cf2f30478
ab4dbd897f0d59d6bbf97238b3e7d160bfc2e6187d37cd91f3c79cac26fc42e7
ac0724d7dca2e69ee2d98ca70df60aeed0f97b7dd362d55ee8943a93e4665eea
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b25cde37aab2239b45212ac87c3eafdafca9275dd9bde878d9f93c180bdc5bcc
b294e973896f8f874e90a8eb1a8908ac790980d034c4c4bdf0fc3d37b8abf682
b318b179b35ca92c87626801798f3bce3864172926ae10288f0460a53f30177c
b5de7e9995d540bac806a791f3b52d1397c98fb5717736a4b448e76a28443747
b913d3a87d54d8739436653cb77e8002e504ef07684ef5b652f3c8ae782acdfc
bb67d2393ca0a3bff485a2726f33aa655c599a6c4a252db523205b479490244a
be8ae18f23a0f6080b6f5a20913e538729bc7bc11ba80a08153f21adb3e4589a
c19345a03fed44d267abbe2f427bdcd261aa86a447320f15f3eef8e121690794
c540a8aa336e92c3a20d1872e66a2ce2d2c2629a66c939a33a663aa2c0b8c832
cd38a127711e65035815f163a9bf784450f30943fa2743f4df3107e92bd0fcbd
cde3b0c2f6c0d615e0ab11adec7f0442154d49fd3c429f57b3507f900a1cdf7d
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cfd4f754e134eb42e45e6bf5e41d05516b5ad6465deb4ca63ac77ffa58292b1f
d0ca6f1ae5bad99980d99a56ee95d900bb59b540dad35fda08ba76eb4bb22af7
d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7
d10a2d03c9fb4943f449b97d333b8d22990200afa70d13d5c1c23ad4d783200c
d26432e661658ef9d3d538b1f71b1478193f6c141f1cd7dfed03e5b677d178c2
d44c3403ac31b08a81867bcfdb18981cd3a3e8e42356cf64dd68bead051b64b4
d4ae683989f3ae7492b836492d857c64851fbd5ddf6cf7a2ec21de8c7be5dd18
d69c8c5f885b4025138d313cbe08b8f164469f35e5465749a2699074600ea7ca
d984171d5813963d57ffeaf1e666842cc6cb952a4975f56c1bafdef14ad8a4c2
d98f3c146304d61e34da5e04cb32b628c58b401b7c01576d6c47f8f1ca6bea02
dac715f087720dd7ff7067f5d2ec1988851fa93140ae8a9cbfaa15659dd7fd82
dde76b9b2b90d30eb97fc81f06caa8c338c97b688cea7d2729c88f529f32fbb1
de06fea245b0036d21764fcf2b9a4791c0a0f1e927e3916c7d779cb44a1977bd
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
de9d3fd0eb948bd294477d0eda60a73b85caff1794803530d0463193a113da98
e162b39aa98efdc15a0f72ac6331a3d20328b220575ff833b9f20bb373d37ffe
e1fd91c0fc8b856b405e8455b19c605a827f1121212c1faaec8154fa535e1c49
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3e34be9443c0ab7eb569e14bc5af571e06d760368b659a0a3a417ff743f785e
e5a1598944cdacee0760775794bff19417c31947033f3b013af8b6ceac45875c
e81814521084a1e9785d3abbfb55d43675ef3cd47b495d5a340d8412941fc3d5
e8801beb8f5d63bc2a0ba0b3d6399a0c36c1b20549e3346a8f0e9e5b2a0ca07e
e9d0cab69a4c71df7a16b6ee6f99ea474423689c8eadd7aa62ce9cef3a48c395
ebfe453394ff1be6ef75d380ab7c5535aea0b51832d045f0d5d0ef7e6535969c
ece2c00c39d3835b23f677b7f7b8ba1c0f2baee34fc6c0c8093821b580bdd156
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f1ccea6b7204d9f7913ab45e1afa51d79f83bd4f0319de937b0132e6e02b1aab
f3e24d795b082a4439815f85eb8492536f32471869b482f1c4e4754c6fb5261b
f467e430af661e2bade60598d2e92dff4712e07b30a9ec5b04ce2f44e6c72434
f61d5c95c64f5584a106978ece0263f6c0a74432dccc57025e7512ff335c694b
f663a408b84f51eb402c6682e5046607fb8f7aa2d138df4251d6321b12a8a11f
f6cc197d57066b6621a43c0189bb97f9a9962235acf8cd45daa8b9dd492e4f07
f6d55b625c304616284f3c9d1f1b9f601d2a6abfa7610a4bb10d416c542eea7b
f8c9c8046ab5ae13163dcb2143f7abe357e096f285c08167cf070b33da37645c
f8f56a12e38109ef29bb878c56b13963bdc33d48e7deed8a788a24fe0171d9cb
fc56c9ccf3939763fe57b7803ef715e59227ff7aca27c3733c2b6f6e25657432
fd0a1ac929c11b08e819fe4b0a18c5574012c44f09de8987c6be99a0f055a505
fd9d43ea0d4fe7ee37b7b1c8d13859413652b414def6a0bca25d342f84c206d6