Submitted URL: https://info.silobreaker.com/e2t/tc/VVN1hK6LpV61VlXzTl38wDRqW2jjqKJ4qssLHN1TFhtc4Zc_rV3Zsc37CgB-MN3c-2KKDkJ89N2cnbCQpNmFPV8_9...
Effective URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_m...
Submission: On April 16 via api from DE

Summary

This website contacted 68 IPs in 6 countries across 48 domains to perform 327 HTTP transactions. The main IP is 2606:4700::6811:7963, located in United States and belongs to CLOUDFLARENET, US. The main domain is www.darkreading.com.
TLS certificate: Issued by Cloudflare Inc ECC CA-3 on July 4th 2020. Valid for: a year.
This is the only time www.darkreading.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 2 199.60.103.254 209242 (CLOUDFLAR...)
1 11 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
11 2606:4700:303... 13335 (CLOUDFLAR...)
1 2a00:1450:400... 15169 (GOOGLE)
6 2606:4700:303... 13335 (CLOUDFLAR...)
54 2606:4700:303... 13335 (CLOUDFLAR...)
1 151.101.193.131 54113 (FASTLY)
1 2a00:1450:400... 15169 (GOOGLE)
1 142.250.186.66 15169 (GOOGLE)
2 13.32.25.45 16509 (AMAZON-02)
9 93.184.220.66 15133 (EDGECAST)
1 2620:1ec:bdf::19 8068 (MICROSOFT...)
3 2600:9000:20e... 16509 (AMAZON-02)
1 64.13.192.84 31815 (MEDIATEMPLE)
12 13.32.29.48 16509 (AMAZON-02)
1 3 34.251.60.147 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
9 2a00:1450:400... 15169 (GOOGLE)
1 99.84.156.23 16509 (AMAZON-02)
16 172.217.16.130 15169 (GOOGLE)
2 35.181.18.61 16509 (AMAZON-02)
1 1 34.253.145.149 16509 (AMAZON-02)
1 4 99.84.156.73 16509 (AMAZON-02)
6 2a03:2880:f02... 32934 (FACEBOOK)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
11 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
2 2620:1ec:c11:... 8068 (MICROSOFT...)
1 52.30.135.179 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
37 184.30.21.162 16625 (AKAMAI-AS)
1 2a02:26f0:710... 20940 (AKAMAI-ASN1)
1 99.84.156.109 16509 (AMAZON-02)
1 3.124.238.162 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
2 52.49.20.76 16509 (AMAZON-02)
1 3.10.133.216 16509 (AMAZON-02)
1 2 2620:119:50e1... 14413 (LINKEDIN)
1 1 2620:1ec:21::14 8068 (MICROSOFT...)
2 2 37.252.172.45 29990 (ASN-APPNEX)
2 3.229.100.58 14618 (AMAZON-AES)
1 99.86.2.75 16509 (AMAZON-02)
5 2a03:2880:f12... 32934 (FACEBOOK)
23 99.84.156.95 16509 (AMAZON-02)
2 184.30.21.51 16625 (AKAMAI-AS)
4 65.9.66.54 16509 (AMAZON-02)
1 104.111.229.66 16625 (AKAMAI-AS)
6 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
3 2620:103::192... 19994 (RACKSPACE)
1 2a02:26f0:6c0... 20940 (AKAMAI-ASN1)
1 2 142.0.173.134 7160 (NETDYNAMICS)
11 18.184.103.42 16509 (AMAZON-02)
1 2a00:1450:400... 15169 (GOOGLE)
3 104.108.145.75 16625 (AKAMAI-AS)
1 2 104.244.42.136 13414 (TWITTER)
1 1 142.250.185.162 15169 (GOOGLE)
1 35.244.174.68 15169 (GOOGLE)
1 2606:2800:134... 15133 (EDGECAST)
24 2606:2800:134... 15133 (EDGECAST)
2 2606:2800:233... 15133 (EDGECAST)
1 5 2a02:26f0:710... 20940 (AKAMAI-ASN1)
1 2600:9000:206... 16509 (AMAZON-02)
1 2 54.74.23.153 16509 (AMAZON-02)
1 54.210.109.30 14618 (AMAZON-AES)
1 52.203.96.188 14618 (AMAZON-AES)
1 3.214.0.136 14618 (AMAZON-AES)
327 68
Apex Domain
Subdomains
Transfer
54 deusm.com
img.deusm.com
386 KB
38 moatads.com
z.moatads.com
geo.moatads.com
px.moatads.com
723 KB
35 celtra.com
ads.celtra.com
cache-ssl.celtra.com
track.celtra.com
178 KB
27 twimg.com
cdn.syndication.twimg.com
pbs.twimg.com
ton.twimg.com
149 KB
19 doubleclick.net
securepubads.g.doubleclick.net
googleads.g.doubleclick.net
stats.g.doubleclick.net
cm.g.doubleclick.net
128 KB
18 googlesyndication.com
1c7c84c37158a202918275ae6d434610.safeframe.googlesyndication.com
tpc.googlesyndication.com
pagead2.googlesyndication.com
536 KB
13 darkreading.com
www.darkreading.com
trk.darkreading.com
50 KB
12 boltdns.net
cf-images.us-east-1.prod.boltdns.net
79 KB
11 twitter.com
platform.twitter.com
syndication.twitter.com
228 KB
11 twimgs.com
twimgs.com
95 KB
9 googletagservices.com
www.googletagservices.com
300 KB
6 adroll.com
s.adroll.com
d.adroll.com
72 KB
6 teads.tv
a.teads.tv
s8t.teads.tv
t.teads.tv
134 KB
6 bibblio.org
cdn.bibblio.org
api.bibblio.org
20 KB
6 ubm-us.net
i.ubm-us.net
dsimg.ubm-us.net
95 KB
5 facebook.com
www.facebook.com
15 KB
4 facebook.net
connect.facebook.net
164 KB
4 scorecardresearch.com
sb.scorecardresearch.com
3 KB
4 demdex.net
dpm.demdex.net
ubm.demdex.net
6 KB
4 linkedin.com
platform.linkedin.com
px.ads.linkedin.com
www.linkedin.com
58 KB
3 techweb.com
ng.techweb.com
7 KB
3 google-analytics.com
www.google-analytics.com
53 KB
3 ml314.com
ml314.com
in.ml314.com
14 KB
3 dpmsrv.com
s.dpmsrv.com
a.dpmsrv.com
91 KB
3 google.com
www.google.com
adservice.google.com
2 KB
3 flipboard.com
cdn.flipboard.com
9 KB
2 fbcdn.net
static.xx.fbcdn.net
125 KB
2 adnxs.com
ib.adnxs.com
3 KB
2 gstatic.com
www.gstatic.com
fonts.gstatic.com
150 KB
2 bing.com
bat.bing.com
9 KB
2 google.de
adservice.google.de
www.google.de
1 KB
2 omtrdc.net
ubmtech.d3.sc.omtrdc.net
763 B
2 ubembed.com
6600d6d98e534115970f9529a45f3195.js.ubembed.com
assets.ubembed.com
47 KB
2 silobreaker.com
info.silobreaker.com
4 KB
1 nextroll.com
nextroll.com
2 KB
1 chartbeat.net
ping.chartbeat.net
169 B
1 consensu.org
d.adroll.mgr.consensu.org
137 B
1 chartbeat.com
static.chartbeat.com
14 KB
1 rlcdn.com
idsync.rlcdn.com
66 B
1 en25.com
img.en25.com
3 KB
1 lightreading.com
img.lightreading.com
373 B
1 licdn.com
snap.licdn.com
2 KB
1 everesttech.net
cm.everesttech.net
517 B
1 dedoimedo.com
www.dedoimedo.com
40 KB
1 googleadservices.com
www.googleadservices.com
17 KB
1 googletagmanager.com
www.googletagmanager.com
52 KB
1 googleapis.com
fonts.googleapis.com
1 KB
1 bootstrapcdn.com
maxcdn.bootstrapcdn.com
7 KB
327 48
Domain Requested by
54 img.deusm.com www.darkreading.com
30 px.moatads.com www.darkreading.com
24 pbs.twimg.com www.darkreading.com
platform.twitter.com
23 cache-ssl.celtra.com ads.celtra.com
www.darkreading.com
16 securepubads.g.doubleclick.net www.googletagservices.com
securepubads.g.doubleclick.net
info.silobreaker.com
12 cf-images.us-east-1.prod.boltdns.net www.darkreading.com
11 track.celtra.com www.darkreading.com
11 tpc.googlesyndication.com securepubads.g.doubleclick.net
www.darkreading.com
tpc.googlesyndication.com
11 twimgs.com www.darkreading.com
img.deusm.com
11 www.darkreading.com 1 redirects info.silobreaker.com
www.darkreading.com
9 www.googletagservices.com www.darkreading.com
securepubads.g.doubleclick.net
9 platform.twitter.com www.darkreading.com
platform.twitter.com
7 z.moatads.com securepubads.g.doubleclick.net
6 pagead2.googlesyndication.com www.googletagservices.com
securepubads.g.doubleclick.net
tpc.googlesyndication.com
5 s.adroll.com 1 redirects www.darkreading.com
s.adroll.com
5 www.facebook.com www.darkreading.com
connect.facebook.net
4 api.bibblio.org cdn.bibblio.org
4 connect.facebook.net www.darkreading.com
connect.facebook.net
4 sb.scorecardresearch.com 1 redirects www.darkreading.com
3 t.teads.tv www.darkreading.com
3 ng.techweb.com img.deusm.com
ng.techweb.com
3 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
3 dpm.demdex.net 1 redirects twimgs.com
www.darkreading.com
3 cdn.flipboard.com www.darkreading.com
3 dsimg.ubm-us.net www.darkreading.com
3 i.ubm-us.net www.darkreading.com
2 ton.twimg.com platform.twitter.com
2 syndication.twitter.com 1 redirects platform.twitter.com
2 trk.darkreading.com 1 redirects www.darkreading.com
2 static.xx.fbcdn.net www.facebook.com
2 a.teads.tv securepubads.g.doubleclick.net
s8t.teads.tv
2 a.dpmsrv.com www.darkreading.com
2 ib.adnxs.com 2 redirects
2 px.ads.linkedin.com 1 redirects www.darkreading.com
2 ml314.com z.moatads.com
ml314.com
2 bat.bing.com www.darkreading.com
2 ubmtech.d3.sc.omtrdc.net twimgs.com
2 www.google.com dsimg.ubm-us.net
www.darkreading.com
2 cdn.bibblio.org www.darkreading.com
2 info.silobreaker.com 1 redirects
1 in.ml314.com ml314.com
1 nextroll.com
1 ping.chartbeat.net
1 d.adroll.com
1 d.adroll.mgr.consensu.org 1 redirects
1 static.chartbeat.com info.silobreaker.com
1 cdn.syndication.twimg.com platform.twitter.com
1 idsync.rlcdn.com www.darkreading.com
1 cm.g.doubleclick.net 1 redirects
1 stats.g.doubleclick.net www.google-analytics.com
1 s8t.teads.tv a.teads.tv
1 img.en25.com www.darkreading.com
1 img.lightreading.com www.darkreading.com
1 www.linkedin.com 1 redirects
1 geo.moatads.com z.moatads.com
1 www.google.de www.darkreading.com
1 ads.celtra.com www.darkreading.com
1 s.dpmsrv.com info.silobreaker.com
1 snap.licdn.com www.googletagmanager.com
1 fonts.gstatic.com fonts.googleapis.com
1 www.gstatic.com www.google.com
1 ubm.demdex.net twimgs.com
1 googleads.g.doubleclick.net www.googleadservices.com
1 1c7c84c37158a202918275ae6d434610.safeframe.googlesyndication.com securepubads.g.doubleclick.net
1 adservice.google.com securepubads.g.doubleclick.net
1 adservice.google.de securepubads.g.doubleclick.net
1 cm.everesttech.net 1 redirects
1 assets.ubembed.com 6600d6d98e534115970f9529a45f3195.js.ubembed.com
1 www.dedoimedo.com www.darkreading.com
1 platform.linkedin.com www.darkreading.com
1 www.googleadservices.com www.darkreading.com
1 www.googletagmanager.com www.darkreading.com
1 6600d6d98e534115970f9529a45f3195.js.ubembed.com www.darkreading.com
1 fonts.googleapis.com www.darkreading.com
1 maxcdn.bootstrapcdn.com www.darkreading.com
327 75
Subject Issuer Validity Valid
info.silobreaker.com
Cloudflare Inc ECC CA-3
2020-06-30 -
2021-06-30
a year crt.sh
darkreading.com
Cloudflare Inc ECC CA-3
2020-07-04 -
2021-07-04
a year crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3
2021-03-01 -
2022-02-28
a year crt.sh
upload.video.google.com
GTS CA 1O1
2021-03-16 -
2021-06-08
3 months crt.sh
*.js.ubembed.com
GlobalSign Atlas R3 DV TLS CA 2020
2021-03-22 -
2022-04-23
a year crt.sh
*.google-analytics.com
GTS CA 1O1
2021-03-16 -
2021-06-08
3 months crt.sh
www.googleadservices.com
GTS CA 1O1
2021-03-23 -
2021-06-15
3 months crt.sh
cdn.bibblio.org
Amazon
2020-06-20 -
2021-07-20
a year crt.sh
*.twimg.com
DigiCert TLS RSA SHA256 2020 CA1
2020-11-05 -
2021-11-09
a year crt.sh
platform.linkedin.com
DigiCert SHA2 Secure Server CA
2021-02-22 -
2021-08-21
6 months crt.sh
*.flipboard.com
DigiCert SHA2 High Assurance Server CA
2019-11-02 -
2021-11-15
2 years crt.sh
dedoimedo.com
Starfield Secure Certificate Authority - G2
2020-08-14 -
2021-08-18
a year crt.sh
*.prod.boltdns.net
Amazon
2020-12-08 -
2022-01-06
a year crt.sh
*.demdex.net
DigiCert TLS RSA SHA256 2020 CA1
2020-12-02 -
2022-01-02
a year crt.sh
www.google.com
GTS CA 1O1
2021-03-16 -
2021-06-08
3 months crt.sh
*.g.doubleclick.net
GTS CA 1O1
2021-03-16 -
2021-06-08
3 months crt.sh
assets.ubembed.com
Amazon
2021-03-06 -
2022-04-04
a year crt.sh
*.d3.sc.omtrdc.net
DigiCert SHA2 High Assurance Server CA
2020-02-28 -
2022-03-04
2 years crt.sh
*.scorecardresearch.com
Amazon
2021-02-28 -
2022-03-29
a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2021-02-10 -
2021-05-10
3 months crt.sh
*.google.de
GTS CA 1O1
2021-03-23 -
2021-06-15
3 months crt.sh
*.google.com
GTS CA 1O1
2021-03-23 -
2021-06-15
3 months crt.sh
tpc.googlesyndication.com
GTS CA 1O1
2021-03-23 -
2021-06-15
3 months crt.sh
www.bing.com
Microsoft RSA TLS CA 02
2021-01-19 -
2021-07-19
6 months crt.sh
*.gstatic.com
GTS CA 1O1
2021-03-23 -
2021-06-15
3 months crt.sh
moatads.com
DigiCert SHA2 Secure Server CA
2021-01-21 -
2022-01-25
a year crt.sh
*.licdn.com
DigiCert SHA2 Secure Server CA
2019-04-01 -
2021-05-07
2 years crt.sh
*.dpmsrv.com
Amazon
2020-06-15 -
2021-07-15
a year crt.sh
celtra.com
Amazon
2021-03-11 -
2022-04-09
a year crt.sh
www.google.de
GTS CA 1O1
2021-03-23 -
2021-06-15
3 months crt.sh
*.ml314.com
Amazon
2021-01-17 -
2022-02-14
a year crt.sh
*.moatads.com
DigiCert SHA2 Secure Server CA
2019-03-12 -
2021-06-10
2 years crt.sh
px.ads.linkedin.com
DigiCert SHA2 Secure Server CA
2021-04-15 -
2021-10-15
6 months crt.sh
*.lightreading.com
Amazon
2020-12-02 -
2021-12-31
a year crt.sh
teads.tv
R3
2021-02-18 -
2021-05-19
3 months crt.sh
api.bibblio.org
Amazon
2020-10-07 -
2021-11-07
a year crt.sh
*.en25.com
DigiCert SHA2 Secure Server CA
2020-08-13 -
2021-11-12
a year crt.sh
ng.techweb.com
R3
2021-04-08 -
2021-07-07
3 months crt.sh
trk.darkreading.com
RapidSSL TLS DV RSA Mixed SHA256 2020 CA-1
2021-02-19 -
2022-02-19
a year crt.sh
syndication.twitter.com
DigiCert TLS RSA SHA256 2020 CA1
2021-02-05 -
2022-02-04
a year crt.sh
*.rlcdn.com
Sectigo RSA Domain Validation Secure Server CA
2021-02-25 -
2022-03-28
a year crt.sh
adroll.com
R3
2021-03-30 -
2021-06-28
3 months crt.sh
*.chartbeat.com
Thawte RSA CA 2018
2020-06-01 -
2021-06-02
a year crt.sh
adroll.mgr.consensu.org
Amazon
2020-10-08 -
2021-11-07
a year crt.sh
*.chartbeat.net
Thawte RSA CA 2018
2020-12-01 -
2021-12-30
a year crt.sh
nextroll.com
R3
2021-03-21 -
2021-06-19
3 months crt.sh

This page contains 17 frames:

Primary Page: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Frame ID: CF92D2D2E95831F35526F692CF37C73D
Requests: 219 HTTP requests in this frame

Frame: https://ubm.demdex.net/dest5.html?d_nsid=0
Frame ID: BF5B76E2B7061A25E7277B487FE9CE92
Requests: 1 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuR6acmF-rDfhonQKM6_Cao9whqgIQzagsrby_2H2ZUT61jUnBxjW_yteJSyywCSu7X8i9rlcJKujMwl9AVQ4mAhGZREM66-p8LTfjVnmvxy6hw6TzZEOPeWTfySm67Vx_wao_z4jp9Npi5uL388dp78FUlW8-zuyFiZLxExIjz--OMkzwIjuf7aciFBb6vI5ZydHp2JyXP5WLaG-Np0FxZzYh28YsocK_OM7jzJpgcdRi1HnHa0uLJ5EgiNvvoWoPLHbG2mNuH_S6mxxIoK2aMbbZNnnSO1aWUFUV8upkFGwoB_Wip0puBm6aLNlDfVcWIyPXCHCT6DaOL440o5TtYo9g&sai=AMfl-YR7MwPAkLBDfPAAg9qzRB3eqIz6b4Rm4X1n64oWTjlSHfi0sQWQk13pmTCB2Qhy9xwOoC0VSqC_8IW-r8VVs-XL5aG0VjliLG1sr_-VUA&sig=Cg0ArKJSzBkY599-gsBQEAE&urlfix=1&adurl=
Frame ID: F5D238C0A8B901A43B6A19AC4E1CE2F8
Requests: 9 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstVKuaXiSw47Vqg-4vvmzHG5H7e6BoRDs_dvWnRlOum9oQGpdY96pBjADno-HR2sqkuPbGHzRhmAlghTdSX7yDprlDABw8o_V1FjFuqdvYugLHvRBKGfFlM5be0nBpchn7XTsvPwK3V0D5jDvUccowHpOPLATXxGhI_ygHLd7wGs5NXAQT1IUwiS5HgVE4TYxLuVXtiAHdh83jeN8L4i1019Lm-uHPyj63BqwC9aFyFxwIUC1PmTfNkR4Gs6qDrrbe1--F_oKbh3d_hV742StUFy0ekF47jb21EAaDJRLw-tfUKGeF-MJOpWm3DwBJLTF-zaLbs9jOqlueb0Usznp2dfqk_&sai=AMfl-YQVnN8WlXDfBYow3K7dNI_MUHW7lxC8cCxqZIPlqraq1a0n62c7n0CLhtrSd2e1KRfOUkO5eYvxkFX17R0cjfbvQ1uV_tEhsp5nzvnP3g&sig=Cg0ArKJSzMT_BjU-uHH0EAE&adurl=
Frame ID: CFDB9E3A7B1643A61D679AF1D7EEB37A
Requests: 8 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsugfwOIMzdNz1yp-JRjGqgVXR-p0CypSgvKasMGZ9WITjpjv9RpRoc72bqwYPrcQHe4PbW_ZJ7m7XZW1ocmFIl2f6E9P7bifHnwKUfyJgd-rp9F4dJQIzUF3sFSzBH_IUpTxt8iZT9i3FHsL_JAMLbJ548II5-X5cXLOkiM7xPBKiIZcYlw2JujhcROwnrUzgZiU72K7wz5AK5VzkYtUCcT8o8l729FzqW6YshWpSHf3rtoQ742Cux25IL2Wwm-XYGNCI3t-X_lqXUVQVAD7fbB5re6ZprLCPVg_yUV_YB-0S_g39LygeO_W6ve4ZYikj54mCqneNWnftw-X7MGCl8&sai=AMfl-YSt6UZhQ6iTmsDE711IePAyxtjK2uc4f9aoLFRAUVmkHX7znKQoNbSTtsMm0MkvbNRVJGzurWsUemq7ROjS77GVlfuMQw-Nwuka-bPVXQ&sig=Cg0ArKJSzNm47ZeTHM9-EAE&urlfix=1&adurl=
Frame ID: 9844802540C350A626D54A9F75A27BB2
Requests: 9 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvdl2A9Qi9aTEekdb3obT1-HbunrIxXKiKiE4XTageOVeJK-ECmo1-0Gwjp1XBdCqv7pwkmEAvWG23w42n842i1TJUMzTDOOjN5nxHcvs-xFkDPBD79KuEeuyn-jAj2IiYzPUC4Nroe2bKnlIgktusMJiH4Bx6GQvKIQxvlyodCGkWSHOz7CTrwsJ3JOMITyCnErR8Lq15r9wzXQLVI3ZkbfSzIT1nS41OCbw7V_G-BmabY34OZupk6Ti_2wzzvXeHJzIqt7Z5z7AtFuZRdkL3lxrWhIR_7lGT9ghUXYeuxIBYUsPZI7_WevNhhMi0HDLP5DH5_Z_zbClSUXSI98EY&sai=AMfl-YSOYVZ6MK8Bng7jMnKe3x2xtXtQia9vRhQC-NpUBY8SmE99LalKbQsNFvXbgc49qM8Gldnpgc-KBciwrD1q3kK_tfm8TW7aG-PctzMuLQ&sig=Cg0ArKJSzGGUFwDctStLEAE&adurl=
Frame ID: A679426FCA62967A0C4822F3CECCE9EA
Requests: 8 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstMKc7O4X-49h-51fWIw6BSCvSsV6w2IVKvxwLEtjFIK4endkR3rhq0pAh4yzfQKSIcICBQUAGhmSHENQrQp8BPQ1Wkgg8vznRe-o09bqJg_8wGC9T3hVktP6RjMK-KvNR1sNkxSs7KoTL3v_gxz7oSZaH3O8pUi4R0SnBFJQDN2SOoeMKhDYktz930vVsEcQfnZTVcyQ7XUKoHTAs8wHEiUIJHEI72ij9rceIdJPftaqC5F_ot5V4eLcWA7lvHw8W-48LbNMhp-nVaW_f7xbxS_ImCjHT8KBAXrMDRjdB0HdJy3QVrBWazFGJlEGSbEAz38hrVKd9Utlp4Xho8SWecXyI&sai=AMfl-YSiN-qA_mRsg1oN7IGmZWiU80d2eOtmkY6Eeg2xf_gO0fOuLaXPvGGLvnz6Ait3rnkq_Zw48oOpP7Mrt3ZG0XCKtckbKAdrbTCx1qmOcQ&sig=Cg0ArKJSzEuzphvR3xY3EAE&urlfix=1&adurl=
Frame ID: 7401F3A75B6070F4218B19D4EBF47681
Requests: 5 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstbYU3Y_omB0bF7EJzYUPq7GZn8I42HLrLTsZnoVvFvOpybcZ9l_OW6cSp_vWVScHXYRhmZL2OxAequ5Z4BC63zSnOe2cR6IxU_p6O5kcezGWzkPmeGOlFmAZ5hHa2KH97fzEmdHd8Hv7A6ygWJK9ToH-MkOZwklQ8JAiWIJ20GWqOYto0uKnCk3CkFBTB2t_VunysrAaebde7e2jyoi9DtbulB_H8U9NADqyCytaDZFE1O36Ympz-k_PE2D4kVfBjjU7_cja5T8gC9c6TBmksS-yO4uS7NZ9smsEhE54kTbhFhY4-40y2-gYkGMNbwwefyOIJmAfyNvJaZGPv41YE&sai=AMfl-YR0DsHQZqYGuaedpRoPKZXGv9JLVBs4QEraBjDQyqLwhwYJITXgk57ArfxACD6HBv_w_9MB2GBsto8RjqskXIXtwL_vXvR-KGsqUBl1Ug&sig=Cg0ArKJSzCuv3OI9V5auEAE&adurl=
Frame ID: 80B6B05320E19340F3C6AB82B982E614
Requests: 7 HTTP requests in this frame

Frame: https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstvu_YYM6oPHh5QpHk7gQblyHmBO-4NaUg1rTUViGNAPvQ2JlfNyNlV92M-L6IJaLVOsQa2ABsfWyqM0E7AfW2rhu4x2gTuQC5jQT2GbdMlnaebgNZ9pedcjn5l4WePfvJncy1-Bddq9X5XlTXHRlIspeLRLjsnEIlHGrm82Sux_pZ58XkbQyPqqXN5fdngCWxhYEKchnhX_I4RhaqMRfqp_r0W5rSNcBK5iDwHh5XxGgCdJFmmknNDOoICCDXp90h7snwnqKeqyTIqMfHmYxGKdwmA7PyD4h3nPCSWCwk65z9rpJskkE9rFVPQtXge0DPLMl9O2Gp-G7Opx44qY0A&sai=AMfl-YQBlEYxylEN4UzxyA0zh-Xr16p54ttqZzlqPLH5emFfRZGTdwEk0EsP55KbFcsvynDUqmejCVP4A78EcXOD5NSBpjrxt9YiXVYp6cD-IA&sig=Cg0ArKJSzLPg0dc-VJmuEAE&urlfix=1&adurl=
Frame ID: D0E40CB8A6923F9BF3263DC65E26E6E0
Requests: 6 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.63899b173766ee6f8a729a72b542b0fb.html?origin=https%3A%2F%2Fwww.darkreading.com
Frame ID: 2BDCB8A5518F533F52D64CD068A51C03
Requests: 2 HTTP requests in this frame

Frame: https://www.facebook.com/plugins/like.php?app_id=640989409269461&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df3b1c3c5daf49a%26domain%3Dwww.darkreading.com%26origin%3Dhttps%253A%252F%252Fwww.darkreading.com%252Ff29f6f44e0fede%26relation%3Dparent.parent&container_width=0&href=http%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685&layout=button&locale=en_US&sdk=joey&send=false&show_faces=false&width=87
Frame ID: 68C9CC79B41FCF2F445877DA87FEB038
Requests: 4 HTTP requests in this frame

Frame: https://ng.techweb.com/authds/login/login.jsp?type=iframe&cdsocket_client=https://www.darkreading.com/cdsocket_proxy.html
Frame ID: DBFA812379424518C494FF943D9EAEEA
Requests: 3 HTTP requests in this frame

Frame: https://cache-ssl.celtra.com/api/fonts/google/Lato:400/2_webfont.woff2?subset=CEORSU
Frame ID: 9DA85D4A6DDA4830E49CD011FDCF2B83
Requests: 22 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/tweet_button.63899b173766ee6f8a729a72b542b0fb.en.html
Frame ID: 385BD9279D811B8F9FAD3B7402BA97C9
Requests: 2 HTTP requests in this frame

Frame: https://pbs.twimg.com/card_img/1380591519502061572/j0Qe_-uP?format=jpg&name=144x144_2
Frame ID: BE2B143399A9CF546F145842F6CD6AB8
Requests: 29 HTTP requests in this frame

Frame: https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html
Frame ID: 71208181743F316D170564ED38F8608E
Requests: 2 HTTP requests in this frame

Frame: https://platform.twitter.com/jot.html
Frame ID: 2E3C37F8C71F8F01715508ED9F10FAD2
Requests: 1 HTTP requests in this frame

Screenshot


Page URL History Show full URLs

  1. https://info.silobreaker.com/e2t/tc/VVN1hK6LpV61VlXzTl38wDRqW2jjqKJ4qssLHN1TFhtc4Zc_rV3Zsc37CgB-MN3c-2KKD... Page URL
  2. https://info.silobreaker.com/events/public/v1/track/tc/VVN1hK6LpV61VlXzTl38wDRqW2jjqKJ4qssLHN1TFhtc4Zc_rV... HTTP 307
    https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • headers server /^cloudflare$/i

Page Statistics

327
Requests

100 %
HTTPS

49 %
IPv6

48
Domains

75
Subdomains

68
IPs

6
Countries

4065 kB
Transfer

11429 kB
Size

2
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://info.silobreaker.com/e2t/tc/VVN1hK6LpV61VlXzTl38wDRqW2jjqKJ4qssLHN1TFhtc4Zc_rV3Zsc37CgB-MN3c-2KKDkJ89N2cnbCQpNmFPV8_9mg8HvN0FW2kkBk_6PdrKtW2P-QKG5BHGY0W2g3bnN6-RdkDW6SPp9W8DPlFVV5NMlQ6K_gNvW8PRX607zfNxGW1rkStj3RGCX1W567Zqw3q-bL_W1clxNf205cTkW5cjXWS7H7RsmW6CjyqP8vR1YhW8y86Z_7mSPqjN8QdVsctzGkrVTJr6G8hc4nmW45t02B8pk0HZW2Tlfw84QzwdPW6S9yLp4XmGgCW1YZtht7b1Y4zW33HCNp5_nfVwW5wYMRX264wttW90m6ns27D6BxV477dc79nS0DW6T4xVQ7M5JNXW7t8tFW2zgt2hN8SyYbrS6D-lW4Fj_tQ2vFVfjW271Wql4nM4FhW95-Qnj13vPpKN4F9p50Gwhf_N7F9BlpbWlgYW2TsPjw6DVz0y35xs1 Page URL
  2. https://info.silobreaker.com/events/public/v1/track/tc/VVN1hK6LpV61VlXzTl38wDRqW2jjqKJ4qssLHN1TFhtc4Zc_rV3Zsc37CgB-MN3c-2KKDkJ89N2cnbCQpNmFPV8_9mg8HvN0FW2kkBk_6PdrKtW2P-QKG5BHGY0W2g3bnN6-RdkDW6SPp9W8DPlFVV5NMlQ6K_gNvW8PRX607zfNxGW1rkStj3RGCX1W567Zqw3q-bL_W1clxNf205cTkW5cjXWS7H7RsmW6CjyqP8vR1YhW8y86Z_7mSPqjN8QdVsctzGkrVTJr6G8hc4nmW45t02B8pk0HZW2Tlfw84QzwdPW6S9yLp4XmGgCW1YZtht7b1Y4zW33HCNp5_nfVwW5wYMRX264wttW90m6ns27D6BxV477dc79nS0DW6T4xVQ7M5JNXW7t8tFW2zgt2hN8SyYbrS6D-lW4Fj_tQ2vFVfjW271Wql4nM4FhW95-Qnj13vPpKN4F9p50Gwhf_N7F9BlpbWlgYW2TsPjw6DVz0y35xs1?_ud=cd823687-0d5a-4602-949f-bfcd158d1051&_ch=p&_pr2=p&_pl=0&_lg=en-US&_dr=b&_ts=p HTTP 307
    https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 89
  • https://www.darkreading.com/client_pathlog.asp?p=%2Fdarkreading%2Fsection%2F314&f=%2Fdarkreading%2Fsection%2F314%2F1340685&rndserial=26372 HTTP 302
  • https://img.deusm.com/images/spacer.gif
Request Chain 98
  • https://cm.everesttech.net/cm/dd?d_uuid=22198549742701970741706566790470167177 HTTP 302
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=YHlyxgAAAMj0yhHl HTTP 302
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=YHlyxgAAAMj0yhHl
Request Chain 147
  • https://sb.scorecardresearch.com/b?c1=2&c2=3005435&ns__t=1618571974293&ns_c=windows-1252&cv=3.5&c8=Malicious%20PowerShell%20Use%2C%20Attacks%20on%20Office%20365%20...&c7=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&c9= HTTP 302
  • https://sb.scorecardresearch.com/b2?c1=2&c2=3005435&ns__t=1618571974293&ns_c=windows-1252&cv=3.5&c8=Malicious%20PowerShell%20Use%2C%20Attacks%20on%20Office%20365%20...&c7=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&c9=
Request Chain 167
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2720225&time=1618571974781&url=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D2720225%26time%3D1618571974781%26url%3Dhttps%253A%252F%252Fwww.darkreading.com%252Fperimeter%252Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%252Fd%252Fd-id%252F1340685%253F_mc%253Drss_x_drr_edt_aud_dr_x_x-rss-simple%2526_hsmi%253D88974744%2526_hsenc%253Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2720225&time=1618571974781&url=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&liSync=true
Request Chain 170
  • https://ib.adnxs.com/getuid?https://a.dpmsrv.com/dpmpxl/index.php?id=$UID&q%3DxImp%26v%3D1.x%26cl%3D55%26pixelIndex%3D0%26r%3D949469%26tzOffset%3D-120%26url%3Dhttps%253A%252F%252Fwww.darkreading.com%252Fperimeter%252Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%252Fd%252Fd-id%252F1340685%253F_mc%253Drss_x_drr_edt_aud_dr_x_x-rss-simple%2526_hsmi%253D88974744%2526_hsenc%253Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&_=1618571974969 HTTP 307
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fa.dpmsrv.com%2Fdpmpxl%2Findex.php%3Fid%3D%24UID%26q%253DxImp%2526v%253D1.x%2526cl%253D55%2526pixelIndex%253D0%2526r%253D949469%2526tzOffset%253D-120%2526url%253Dhttps%25253A%25252F%25252Fwww.darkreading.com%25252Fperimeter%25252Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%25252Fd%25252Fd-id%25252F1340685%25253F_mc%25253Drss_x_drr_edt_aud_dr_x_x-rss-simple%252526_hsmi%25253D88974744%252526_hsenc%25253Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU%26_%3D1618571974969 HTTP 302
  • https://a.dpmsrv.com/dpmpxl/index.php?id=3095526004051790400&q=xImp&v=1.x&cl=55&pixelIndex=0&r=949469&tzOffset=-120&url=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&_=1618571974969
Request Chain 211
  • https://trk.darkreading.com/visitor/v200/svrGP?pps=3&siteid=2150&ref2=elqNone&tzo=-60&ms=775&optin=disabled&firstPartyCookieDomain=trk.darkreading.com HTTP 302
  • https://trk.darkreading.com/visitor/v200/svrGP.aspx?pps=3&siteid=2150&ref2=elqNone&tzo=-60&ms=775&optin=disabled&elq1pcGUID=C5D86127639C44BDAE09CAF9E52DDDF0
Request Chain 224
  • https://cm.g.doubleclick.net/pixel?google_nid=datapoint_dmp&google_cm&ap_id=3095526004051790400&pixelIndex=0&_=1618571974970 HTTP 302
  • https://a.dpmsrv.com/dpmpxl/index.php?q=dfp&ap_id=3095526004051790400&pixelIndex=0&_=1618571974970&google_gid=CAESEI0m-G1qVxKV4t_pIbOKNXE&google_cver=1
Request Chain 305
  • https://s.adroll.com/j/exp/TQSV74R4GVCSJITSZC2MCP/index.js HTTP 302
  • https://s.adroll.com/j/exp/index.js
Request Chain 307
  • https://d.adroll.mgr.consensu.org/consent/iabcheck/TQSV74R4GVCSJITSZC2MCP?_s=3c53b32ed0f6902f126da4a246754650&_b=2 HTTP 302
  • https://d.adroll.com/consent/check/TQSV74R4GVCSJITSZC2MCP/?_s=3c53b32ed0f6902f126da4a246754650&_b=2
Request Chain 316
  • https://syndication.twitter.com/i/jot HTTP 302
  • https://platform.twitter.com/jot.html

327 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
VVN1hK6LpV61VlXzTl38wDRqW2jjqKJ4qssLHN1TFhtc4Zc_rV3Zsc37CgB-MN3c-2KKDkJ89N2cnbCQpNmFPV8_9mg8HvN0FW2kkBk_6PdrKtW2P-QKG5BHGY0W2g3bnN6-RdkDW6SPp9W8DPlFVV5NMlQ6K_gNvW8PRX607zfNxGW1rkStj3RGCX1W567Zqw3q-...
info.silobreaker.com/e2t/tc/
10 KB
3 KB
Document
General
Full URL
https://info.silobreaker.com/e2t/tc/VVN1hK6LpV61VlXzTl38wDRqW2jjqKJ4qssLHN1TFhtc4Zc_rV3Zsc37CgB-MN3c-2KKDkJ89N2cnbCQpNmFPV8_9mg8HvN0FW2kkBk_6PdrKtW2P-QKG5BHGY0W2g3bnN6-RdkDW6SPp9W8DPlFVV5NMlQ6K_gNvW8PRX607zfNxGW1rkStj3RGCX1W567Zqw3q-bL_W1clxNf205cTkW5cjXWS7H7RsmW6CjyqP8vR1YhW8y86Z_7mSPqjN8QdVsctzGkrVTJr6G8hc4nmW45t02B8pk0HZW2Tlfw84QzwdPW6S9yLp4XmGgCW1YZtht7b1Y4zW33HCNp5_nfVwW5wYMRX264wttW90m6ns27D6BxV477dc79nS0DW6T4xVQ7M5JNXW7t8tFW2zgt2hN8SyYbrS6D-lW4Fj_tQ2vFVfjW271Wql4nM4FhW95-Qnj13vPpKN4F9p50Gwhf_N7F9BlpbWlgYW2TsPjw6DVz0y35xs1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.60.103.254 , United States, ASN209242 (CLOUDFLARESPECTRUM Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
4326b404001255736c37e17cb374b30cce246ef285b3b89f481d1ee200ef5918

Request headers

:method
GET
:authority
info.silobreaker.com
:scheme
https
:path
/e2t/tc/VVN1hK6LpV61VlXzTl38wDRqW2jjqKJ4qssLHN1TFhtc4Zc_rV3Zsc37CgB-MN3c-2KKDkJ89N2cnbCQpNmFPV8_9mg8HvN0FW2kkBk_6PdrKtW2P-QKG5BHGY0W2g3bnN6-RdkDW6SPp9W8DPlFVV5NMlQ6K_gNvW8PRX607zfNxGW1rkStj3RGCX1W567Zqw3q-bL_W1clxNf205cTkW5cjXWS7H7RsmW6CjyqP8vR1YhW8y86Z_7mSPqjN8QdVsctzGkrVTJr6G8hc4nmW45t02B8pk0HZW2Tlfw84QzwdPW6S9yLp4XmGgCW1YZtht7b1Y4zW33HCNp5_nfVwW5wYMRX264wttW90m6ns27D6BxV477dc79nS0DW6T4xVQ7M5JNXW7t8tFW2zgt2hN8SyYbrS6D-lW4Fj_tQ2vFVfjW271Wql4nM4FhW95-Qnj13vPpKN4F9p50Gwhf_N7F9BlpbWlgYW2TsPjw6DVz0y35xs1
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
none
sec-fetch-mode
navigate
sec-fetch-user
?1
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:31 GMT
content-type
text/html;charset=utf-8
set-cookie
__cfduid=d937fffcd1184d3f3842d20e6f65d8f1b1618571971; expires=Sun, 16-May-21 11:19:31 GMT; path=/; domain=.info.silobreaker.com; HttpOnly; SameSite=Lax __cfruid=415c371fbcb4788a4815077730e830b4252b1956-1618571971; path=/; domain=.info.silobreaker.com; HttpOnly; Secure; SameSite=None
cf-ray
640d04e5a9610d4e-ARN
vary
Accept-Encoding
cf-cache-status
MISS
access-control-allow-credentials
false
cf-request-id
097c01638600000d4e0ab55000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
referrer-policy
no-referrer
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Y7x84YBMSB00swES68nYTkS0zwLgbzBMvPcqEpRux5d%2BgOdjdrvfT58LqPbxugPlRy9Dx%2BPMLajEY774htTflRCPob2%2BxSAeSDGQ5oXnNInIciN7rg%3D%3D"}],"max_age":604800}
nel
{"max_age":604800,"report_to":"cf-nel"}
server
cloudflare
content-encoding
br
Primary Request 1340685
www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/
Redirect Chain
  • https://info.silobreaker.com/events/public/v1/track/tc/VVN1hK6LpV61VlXzTl38wDRqW2jjqKJ4qssLHN1TFhtc4Zc_rV3Zsc37CgB-MN3c-2KKDkJ89N2cnbCQpNmFPV8_9mg8HvN0FW2kkBk_6PdrKtW2P-QKG5BHGY0W2g3bnN6-RdkDW6SPp9...
  • https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2y...
151 KB
28 KB
Document
General
Full URL
https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Requested by
Host: info.silobreaker.com
URL: https://info.silobreaker.com/e2t/tc/VVN1hK6LpV61VlXzTl38wDRqW2jjqKJ4qssLHN1TFhtc4Zc_rV3Zsc37CgB-MN3c-2KKDkJ89N2cnbCQpNmFPV8_9mg8HvN0FW2kkBk_6PdrKtW2P-QKG5BHGY0W2g3bnN6-RdkDW6SPp9W8DPlFVV5NMlQ6K_gNvW8PRX607zfNxGW1rkStj3RGCX1W567Zqw3q-bL_W1clxNf205cTkW5cjXWS7H7RsmW6CjyqP8vR1YhW8y86Z_7mSPqjN8QdVsctzGkrVTJr6G8hc4nmW45t02B8pk0HZW2Tlfw84QzwdPW6S9yLp4XmGgCW1YZtht7b1Y4zW33HCNp5_nfVwW5wYMRX264wttW90m6ns27D6BxV477dc79nS0DW6T4xVQ7M5JNXW7t8tFW2zgt2hN8SyYbrS6D-lW4Fj_tQ2vFVfjW271Wql4nM4FhW95-Qnj13vPpKN4F9p50Gwhf_N7F9BlpbWlgYW2TsPjw6DVz0y35xs1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7963 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
929e505379dce9b6ac5c906a9437caf871b1cd8a237d8ad56f5cbeaa3f343df0
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains

Request headers

:method
GET
:authority
www.darkreading.com
:scheme
https
:path
/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
document
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://info.silobreaker.com/e2t/tc/VVN1hK6LpV61VlXzTl38wDRqW2jjqKJ4qssLHN1TFhtc4Zc_rV3Zsc37CgB-MN3c-2KKDkJ89N2cnbCQpNmFPV8_9mg8HvN0FW2kkBk_6PdrKtW2P-QKG5BHGY0W2g3bnN6-RdkDW6SPp9W8DPlFVV5NMlQ6K_gNvW8PRX607zfNxGW1rkStj3RGCX1W567Zqw3q-bL_W1clxNf205cTkW5cjXWS7H7RsmW6CjyqP8vR1YhW8y86Z_7mSPqjN8QdVsctzGkrVTJr6G8hc4nmW45t02B8pk0HZW2Tlfw84QzwdPW6S9yLp4XmGgCW1YZtht7b1Y4zW33HCNp5_nfVwW5wYMRX264wttW90m6ns27D6BxV477dc79nS0DW6T4xVQ7M5JNXW7t8tFW2zgt2hN8SyYbrS6D-lW4Fj_tQ2vFVfjW271Wql4nM4FhW95-Qnj13vPpKN4F9p50Gwhf_N7F9BlpbWlgYW2TsPjw6DVz0y35xs1

Response headers

date
Fri, 16 Apr 2021 11:19:32 GMT
content-type
text/html
set-cookie
__cfduid=dbf20fb28977a6607c62aae8d0f72346c1618571972; expires=Sun, 16-May-21 11:19:32 GMT; path=/; domain=.darkreading.com; HttpOnly; SameSite=Lax darkreading_lastvisit=4/16/2021 7:19:32 AM; expires=Wed, 16-Apr-2036 11:19:32 GMT; path=/; HttpOnly darkreading_lastvisit=4/16/2021 7:19:32 AM; expires=Wed, 16-Apr-2036 11:19:32 GMT; path=/; HttpOnly cplChannelTagID=; path=/ darkreading%2Dmeter=1340685; expires=Sat, 17-Apr-2021 04:00:00 GMT; path=/ darkreading%5Fvisits=2; expires=Wed, 16-Apr-2036 04:00:00 GMT; path=/
cf-ray
640d04e9993e1f51-FRA
cache-control
private
strict-transport-security
max-age=63072000; includeSubDomains
vary
Accept-Encoding
cf-cache-status
DYNAMIC
cf-request-id
097c0165fd00001f51c0b80000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-pingback
http://www.staging.new.informationweek.com/xmlrpc.asp
x-powered-by
ASP.NET
server
cloudflare
content-encoding
br

Redirect headers

date
Fri, 16 Apr 2021 11:19:32 GMT
location
https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
cf-ray
640d04e76e790d4e-ARN
link
<https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU>; rel="canonical"
vary
Accept-Encoding
cf-cache-status
MISS
access-control-allow-credentials
false
cf-request-id
097c01649f00000d4e29148000000001
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
referrer-policy
no-referrer
x-robots-tag
none
report-to
{"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=aMUAVjGvmEVpiGdU1CVbMgR%2BnBCbay5DtgBZ80%2FVoHU%2FfCLJ6sCuNopvhMYN3EcQJsX7EsyQC4eSLOuuo3iCCW9EsSaB8xwz8phqDsj5h4j6kfr0lQ%3D%3D"}],"max_age":604800}
nel
{"max_age":604800,"report_to":"cf-nel"}
server
cloudflare
font-awesome.min.css
maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/
30 KB
7 KB
Stylesheet
General
Full URL
https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:acf , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:32 GMT
content-encoding
br
x-content-type-options
nosniff
cf-cache-status
HIT
cdn-edgestorageid
722, 617
age
3167521
cdn-cachedat
2021-03-10 20:26:20
cdn-pullzone
252412
cross-origin-resource-policy
cross-origin
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
097c0168fd00004eb06e038000000001
timing-allow-origin
*
access-control-allow-origin
*
last-modified
Mon, 25 Jan 2021 22:04:55 GMT
server
cloudflare
cdn-requestpullcode
200
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-type
text/css; charset=utf-8
cdn-cache
HIT
vary
Accept-Encoding
cache-control
public, max-age=31919000
cdn-uid
b1941f61-b576-4f40-80de-5677acb38f74
cdn-requestid
ac51d65409f7a6c773e04411dc506557
cf-ray
640d04ee69b74eb0-FRA
cdn-requestcountrycode
DE
cdn-requestpullsuccess
True
common-footer.css
twimgs.com/nojitter/css/
9 KB
2 KB
Stylesheet
General
Full URL
https://twimgs.com/nojitter/css/common-footer.css?
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::6815:2f49 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3eea91bd1f33507891a2909689d21be3a6e0fb1b688037c2a7d59c042503d910

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
6092
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
097c016905000017561331b000000001
last-modified
Thu, 09 Jan 2020 06:37:35 GMT
server
cloudflare
etag
W/"23cf-59baf3e93a9c0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=ASgM58NQk%2BSD%2FYNFoUrSBHZm3i%2FB7Z3Eeo5gGAjBMv6AaMUj01jdCIsoLrSn9aBzk2O%2FMPzYxg15RrcsprV%2F0AXHz5Akk4pjXTYm%2B2IKM%2FlE%2BuW6v%2FI7"}]}
content-type
text/css
cache-control
max-age=14400
cf-ray
640d04ee68b11756-FRA
css
fonts.googleapis.com/
2 KB
1 KB
Stylesheet
General
Full URL
https://fonts.googleapis.com/css?family=Roboto+Slab:700
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:801::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
0a189471e7a93667b54e08fd6c28d17f8901d3967ac9bac9413a8e6cea38f021
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Fri, 16 Apr 2021 10:22:58 GMT
server
ESF
date
Fri, 16 Apr 2021 11:19:32 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Fri, 16 Apr 2021 11:19:32 GMT
darkreading.css
twimgs.com/nojitter/css/
17 KB
3 KB
Stylesheet
General
Full URL
https://twimgs.com/nojitter/css/darkreading.css
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::6815:2f49 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cf167be72549318f78f8c03d0d93b923f8e8e290acec47b870a1cede920e859b

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
2966
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
097c016905000017561da89000000001
last-modified
Thu, 27 Apr 2017 09:38:14 GMT
server
cloudflare
etag
W/"45f8-54e22b7428d80"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=k7IaoVBe72rd5AlgaGBlbxa%2FbFAKLmexoSI2r2N1nslIbUaBodT3UfOJKU%2F%2BI0d6ugN7X5QWKPhmItAvroRQDPeSRC%2BQkfQp6%2F6%2F%2Bneb0Q%2F6nLo5STnP"}]}
content-type
text/css
cache-control
max-age=14400
cf-ray
640d04ee68b71756-FRA
pano-framework.css
www.darkreading.com/styles/
87 KB
8 KB
Stylesheet
General
Full URL
https://www.darkreading.com/styles/pano-framework.css?v1.27
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7963 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
e76d2d771deceb87567b67f968ef2196915e110c0027ade297fab2209965fd30
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains

Request headers

:path
/styles/pano-framework.css?v1.27
pragma
no-cache
cookie
__cfduid=dbf20fb28977a6607c62aae8d0f72346c1618571972; darkreading_lastvisit=4/16/2021 7:19:32 AM; cplChannelTagID=; darkreading%2Dmeter=1340685; darkreading%5Fvisits=2
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.darkreading.com
referer
https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:32 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
2821
x-powered-by
ASP.NET
cf-bgj
minify
cf-request-id
097c0168ee00001f51a89f9000000001
last-modified
Wed, 16 Sep 2020 08:24:08 GMT
server
cloudflare
etag
W/"fe4c0bf28cd61:0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=63072000; includeSubDomains
content-type
text/css
cache-control
public, max-age=7200
cf-polished
origSize=135704
cf-ray
640d04ee49051f51-FRA
expires
Fri, 16 Apr 2021 13:19:32 GMT
styles.css
www.darkreading.com/styles/
260 B
346 B
Stylesheet
General
Full URL
https://www.darkreading.com/styles/styles.css?v7
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7963 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
10a6e0f0427a05104050292e8d62b3d01062f9422701e267df74958d0cc2eef7
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains

Request headers

:path
/styles/styles.css?v7
pragma
no-cache
cookie
__cfduid=dbf20fb28977a6607c62aae8d0f72346c1618571972; darkreading_lastvisit=4/16/2021 7:19:32 AM; cplChannelTagID=; darkreading%2Dmeter=1340685; darkreading%5Fvisits=2
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
text/css,*/*;q=0.1
cache-control
no-cache
sec-fetch-dest
style
:authority
www.darkreading.com
referer
https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:32 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
2821
x-powered-by
ASP.NET
cf-bgj
minify
cf-request-id
097c0168ef00001f517920d000000001
last-modified
Mon, 03 Apr 2017 14:07:01 GMT
server
cloudflare
etag
W/"d632e39083acd21:0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=63072000; includeSubDomains
content-type
text/css
cache-control
public, max-age=7200
cf-polished
origSize=292
cf-ray
640d04ee49071f51-FRA
expires
Fri, 16 Apr 2021 13:19:32 GMT
dr_nativead.css
i.ubm-us.net/oas/nativead/css/
2 KB
876 B
Stylesheet
General
Full URL
https://i.ubm-us.net/oas/nativead/css/dr_nativead.css?v3
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::6815:420c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f5932acd6c5f2796f354dedc5e8dfe30e206787365186bbf0f9789d083472a75

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
content-encoding
br
cf-cache-status
REVALIDATED
nel
{"max_age":604800,"report_to":"cf-nel"}
cf-polished
origSize=2145
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
097c01691c00001f4181343000000001
last-modified
Wed, 06 Feb 2019 18:48:56 GMT
server
cloudflare
etag
W/"861-5813e2d913600"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"max_age":604800,"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=7E2aSAC4M3ZiRwOoLmZOMfrbyb8ZHBtMEfIDy8HEKwbVI4ZXGgAOeP08VRQtFJLJad%2FwqWEYVx2MfD9oGHX2pplVvGari7V0smsITCx%2BMsMTS4mM%2B8Pc5Qk%3D"}]}
content-type
text/css
cache-control
max-age=14400
cf-ray
640d04ee9fa21f41-FRA
cf-bgj
minify
nativead.js
i.ubm-us.net/oas/nativead/js/
1 KB
686 B
Script
General
Full URL
https://i.ubm-us.net/oas/nativead/js/nativead.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::6815:420c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
984cd1fa5dd20c2b1b8fd77b6bb876a3a211cdf14aaaed6bc1481e3c98027544

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
85296
cf-polished
origSize=1373
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
097c01691b00001f4191025000000001
last-modified
Thu, 30 Jul 2015 14:31:41 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"max_age":604800,"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=otGj0wGOltWChlDMZC4kqnuIAS%2Fzykiz0LyKHWf8I9%2BMbLCpnHMt8BAcISmwRuH6Mty%2F2GjNTbxJHTf%2F5A4qJXSBS270dp98p4wlQYRsYR3qoFszD439vJY%3D"}]}
content-type
application/javascript
cache-control
public, max-age=86400
cf-ray
640d04ee9fa41f41-FRA
cf-bgj
minify
dr_nativead.js
i.ubm-us.net/oas/nativead/js/
8 KB
2 KB
Script
General
Full URL
https://i.ubm-us.net/oas/nativead/js/dr_nativead.js?v3
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::6815:420c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b309c9c4a6c27c7cfc64ab2bc7f545e8d7b41a795c46202ab2a9c633f7128287

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
27245
cf-polished
origSize=8434
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
097c01691b00001f41d502e000000001
last-modified
Fri, 06 Oct 2017 16:50:20 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"max_age":604800,"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Tiq4Z4ZJ1FirEVvEu8pcK%2BkbBz9CrPPerOv4z%2B243WwuytvKtiEyHv8bpM3WEN5Y8H38yo5JEFHrk9KXUHxIimE6vgWzBzPxl4FQgca%2BJK%2BzRfxPHmu9OcI%3D"}]}
content-type
application/javascript
cache-control
public, max-age=86400
cf-ray
640d04ee9fa61f41-FRA
cf-bgj
minify
respond.min.js
www.darkreading.com/script/
4 KB
2 KB
Script
General
Full URL
https://www.darkreading.com/script/respond.min.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7963 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
cf7bdb0487590885c13a3cc0a2a1450b3ac649a465de267af12f552be8bcb5fe
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains

Request headers

:path
/script/respond.min.js
pragma
no-cache
cookie
__cfduid=dbf20fb28977a6607c62aae8d0f72346c1618571972; darkreading_lastvisit=4/16/2021 7:19:32 AM; cplChannelTagID=; darkreading%2Dmeter=1340685; darkreading%5Fvisits=2
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.darkreading.com
referer
https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:32 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
2821
x-powered-by
ASP.NET
cf-request-id
097c0168ef00001f519c0cd000000001
last-modified
Mon, 22 Sep 2014 21:04:30 GMT
server
cloudflare
etag
W/"03ccda8d6cf1:0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=63072000; includeSubDomains
content-type
application/x-javascript
cache-control
public, max-age=7200
cf-ray
640d04ee490a1f51-FRA
expires
Fri, 16 Apr 2021 13:19:32 GMT
jquery.mobile.custom.min.js
www.darkreading.com/script/
8 KB
3 KB
Script
General
Full URL
https://www.darkreading.com/script/jquery.mobile.custom.min.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7963 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
b4cf7d6d50b6a36f070f6c49e975198a9a8930838695b64e480bf1f6199f0572
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains

Request headers

:path
/script/jquery.mobile.custom.min.js
pragma
no-cache
cookie
__cfduid=dbf20fb28977a6607c62aae8d0f72346c1618571972; darkreading_lastvisit=4/16/2021 7:19:32 AM; cplChannelTagID=; darkreading%2Dmeter=1340685; darkreading%5Fvisits=2
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.darkreading.com
referer
https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:32 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
2821
x-powered-by
ASP.NET
cf-request-id
097c0168ef00001f517b052000000001
last-modified
Mon, 22 Sep 2014 21:04:30 GMT
server
cloudflare
etag
W/"03ccda8d6cf1:0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=63072000; includeSubDomains
content-type
application/x-javascript
cache-control
public, max-age=7200
cf-ray
640d04ee490b1f51-FRA
expires
Fri, 16 Apr 2021 13:19:32 GMT
complete.js
twimgs.com/nojitter/js/
45 KB
9 KB
Script
General
Full URL
https://twimgs.com/nojitter/js/complete.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::6815:2f49 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8420f59cd348cf0e10e05482724523ad6b83f88467bbfacf6826eaadd3a03985

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:32 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Fri, 05 May 2017 06:04:53 GMT
server
cloudflare
age
52587
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=ffzGQmvhNI3aAj1ztss53PCjcjAgBOBrueUkqYzcyo2UJwVfSgEoS9XaPVBt6W4zg%2F9LE%2FffOn%2BPT5UomAvABz4xNjLP0sUFRLEccJdLf%2B36g8X9dcpL"}]}
content-type
application/javascript
cache-control
public, max-age=86400
nel
{"max_age":604800,"report_to":"cf-nel"}
cf-ray
640d04ee68c41756-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
097c016906000017567934b000000001
jquery.mobile-1.4.5.js
img.deusm.com/darkreading/JQuery_Library/
256 KB
62 KB
Script
General
Full URL
https://img.deusm.com/darkreading/JQuery_Library/jquery.mobile-1.4.5.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a456c328bbb88fc991a5ddb80db492ec9e179a3ef443d50bf80b3fbbb5e8a7f7

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
5998
cf-polished
origSize=465716
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
097c01691d0000d6ed1e2ca000000001
last-modified
Tue, 17 Mar 2020 04:33:16 GMT
server
cloudflare
etag
W/"71b34-5a1056f31db00"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=7jgT7t6zQZRyj33SCfXNGjYLuytzDqcgprTyfnFDqNqozIusAePAHrdqF3y0S8apTdrh9%2B0KV4jKHYgsbW7tCL767HDY3dU9Jov8O8yKGoEw%2FIHu1CIbU%2FCo"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cf-ray
640d04ee9f0dd6ed-FRA
cf-bgj
minify
Jquery_3.4.1.js
img.deusm.com/darkreading/JQuery_Library/
140 KB
38 KB
Script
General
Full URL
https://img.deusm.com/darkreading/JQuery_Library/Jquery_3.4.1.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d50d436889f46d5b9455690493e877e02ad30ea4dca963ffcaa3024c45c1d58c

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
7088
cf-polished
origSize=290960
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
097c01691e0000d6ed702e3000000001
last-modified
Mon, 16 Mar 2020 04:36:27 GMT
server
cloudflare
etag
W/"47090-5a0f15cbce8c0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=NFGP6tyIqoxBIO1gmJYGMD86Q2%2Fj3b5eAQLnT87qMq8kU36g%2BJ1zAKs1b%2F5NVjc%2BesMx8CGKHi%2BTbpMKaQuY0GWYmEpaWeKcFdyWYKRJKbObizp1M%2FVTZYew"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cf-ray
640d04ee9f0ed6ed-FRA
cf-bgj
minify
darkreading.js
img.deusm.com/darkreading/JQuery_Library/
20 KB
3 KB
Script
General
Full URL
https://img.deusm.com/darkreading/JQuery_Library/darkreading.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
74a584aafb20fa5524e8005c8f236bb47119e12225ac0d9e30d6c6ae69354808

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
7046
cf-polished
origSize=27287
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
097c01691e0000d6edfd00d000000001
last-modified
Mon, 16 Mar 2020 04:36:15 GMT
server
cloudflare
etag
W/"6a97-5a0f15c05cdc0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=mOHmPt3TyyyLB6Er0dBc8H4n%2FsyDov6ALlppEajfgdiMvN%2FhHevkC8AVaEhin2rVEF92BMoEbtV0HXNiVZk3mlMx45evTClSorQQMIG0bRATfsvEh1SfcUBp"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cf-ray
640d04ee9f0fd6ed-FRA
cf-bgj
minify
VisitorAPI.js
twimgs.com/custom/library.gtecevent.com/assets/
45 KB
14 KB
Script
General
Full URL
https://twimgs.com/custom/library.gtecevent.com/assets/VisitorAPI.js?ormzkk
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::6815:2f49 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ed2c6c0fb3151dc9d40120a17446f07d8873a8b6e08b071bbed82cd6de9b78ba

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:32 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 16 Jan 2020 23:35:09 GMT
server
cloudflare
age
2585
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=7MIWHJIsWGtKpGFc%2FiwvBXGNtM46X4mOnDVBUL%2BjcMxxN0bVzm%2BSlxx73zVM4865ht8uhjgO8LSdi%2B72LuDPgmZ1NKZU3lKqMH7bKQlDBcrDrmBonqcP"}]}
content-type
application/javascript
cache-control
public, max-age=86400
nel
{"max_age":604800,"report_to":"cf-nel"}
cf-ray
640d04ee68cc1756-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
097c0169070000175628373000000001
at.js
twimgs.com/custom/library.gtecevent.com/assets/
106 KB
32 KB
Script
General
Full URL
https://twimgs.com/custom/library.gtecevent.com/assets/at.js?ormzkk
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::6815:2f49 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cd8ddec509daf284f644926ce4a94e2cf5a3cefa41c7c18f2358b6cca80a4a3f

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:32 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 16 Jan 2020 23:34:58 GMT
server
cloudflare
age
5620
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=FZdIVATnzLfY1OwWaHFVqaRjlwAzW%2FxxxjftrFr8%2BiAm198RqqPFYfDyEb%2BZO3V1jsMva3xZj4cRnSnplqHREVEc7OoFR4PYbwCrvldPAGxKP4RFzCVO"}]}
content-type
application/javascript
cache-control
public, max-age=86400
nel
{"max_age":604800,"report_to":"cf-nel"}
cf-ray
640d04ee68c81756-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
097c01690b0000175664ab9000000001
informa-iribbon.css
img.deusm.com/darkreading/
2 KB
1 KB
Stylesheet
General
Full URL
https://img.deusm.com/darkreading/informa-iribbon.css
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1ae4b8548f250831a2443bd449af625f6331b7c72e1f408789642a3050596d45

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
6424
cf-polished
origSize=3306
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
097c01691d0000d6ed50969000000001
last-modified
Thu, 25 Apr 2019 07:05:41 GMT
server
cloudflare
etag
W/"cea-58755722bdb40"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=jWT6Y%2BrmutYAnIF%2FgVeNWkdafutXuWdnI30YUjjfeyDTpbOa3Vv2k7cEoMGAiQ%2Fkg8NY3kY8kwrfU0XGEcYi2B4uvGfkec9RHgzaIVPn2Nx7rZTb1yWyTOKs"}],"group":"cf-nel","max_age":604800}
content-type
text/css
cf-ray
640d04ee9f0ad6ed-FRA
cf-bgj
minify
informa-iribbon.js
img.deusm.com/darkreading/
489 B
886 B
Script
General
Full URL
https://img.deusm.com/darkreading/informa-iribbon.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fb295c2a72d39784b18a1d2d5b0c9976807f7cf010fe730b86d43bc55b0ae251

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
5998
cf-polished
origSize=553
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
097c01691e0000d6ed0b19a000000001
last-modified
Thu, 25 Apr 2019 07:05:52 GMT
server
cloudflare
etag
W/"229-5875572d3b400"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=%2F%2Fmyt%2BLJw4xP7BdftEuHl6fAU7IJCRcsdOD63olKV2eJH4UPPZQVA4Ox0PYCMIeDcNDNG3FWxT0eYNAozXI1dbXpmS10nZpCpwWigfPge8FpQZJYQcTUdfMO"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
cf-ray
640d04ee9f11d6ed-FRA
cf-bgj
minify
cookie_banner.js
www.darkreading.com/script/
1 KB
594 B
Script
General
Full URL
https://www.darkreading.com/script/cookie_banner.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7963 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
c5882768d33bf8778b8c12ec81466d13a9c4e1c797d5cc1686f3f2564ab1983d
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains

Request headers

:path
/script/cookie_banner.js
pragma
no-cache
cookie
__cfduid=dbf20fb28977a6607c62aae8d0f72346c1618571972; darkreading_lastvisit=4/16/2021 7:19:32 AM; cplChannelTagID=; darkreading%2Dmeter=1340685; darkreading%5Fvisits=2
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.darkreading.com
referer
https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:32 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
2821
x-powered-by
ASP.NET
cf-bgj
minify
cf-request-id
097c0168f000001f51cba25000000001
last-modified
Fri, 11 Sep 2020 12:50:31 GMT
server
cloudflare
etag
W/"169d34223a88d61:0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=63072000; includeSubDomains
content-type
application/x-javascript
cache-control
public, max-age=7200
cf-polished
origSize=1698
cf-ray
640d04ee490d1f51-FRA
expires
Fri, 16 Apr 2021 13:19:32 GMT
/
6600d6d98e534115970f9529a45f3195.js.ubembed.com/
2 KB
1 KB
Script
General
Full URL
https://6600d6d98e534115970f9529a45f3195.js.ubembed.com/
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.193.131 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
c935264005f5d981e6afe4d3ef47726f7bde92f6d634c2af946bb1b3a3a9906a

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
content-encoding
br
x-backend-region
eu_west_1
age
4626
etag
705944b9f78007a6657523a874c92a86-v0.179.0
vary
Accept-Encoding, Referer
x-cache
Miss from cloudfront, HIT
content-type
application/json
access-control-allow-origin
*
cache-control
max-age=0, must-revalidate
x-amz-cf-pop
ARN1-C1
accept-ranges
none
x-amz-apigw-id
d3wL6G5sDoEFtHQ=
jplayer.blue.monday.css
twimgs.com/nojitter/css/
12 KB
3 KB
Stylesheet
General
Full URL
https://twimgs.com/nojitter/css/jplayer.blue.monday.css
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::6815:2f49 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0a4f12795a11d0957a7e476cdd2516967e3e00f54841456fbd8c0dd607984d92

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
2966
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
097c01690a0000175669978000000001
last-modified
Fri, 05 May 2017 07:28:28 GMT
server
cloudflare
etag
W/"2f89-54ec1d5e89f00"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=X7dswAylQeC%2BZebhs4DKIFpobBTLWdu4vm1%2B2JSpbomG0zx%2F8XZjHK97UxuHDXrZxNp%2BcSXcKjzlH9MxJUMzAgSJe6oL3L%2BaNFGFAJgNIaLPHp%2BGQB%2FL"}]}
content-type
text/css
cache-control
max-age=14400
cf-ray
640d04ee68bb1756-FRA
style.css
twimgs.com/nojitter/css/
912 B
603 B
Stylesheet
General
Full URL
https://twimgs.com/nojitter/css/style.css
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::6815:2f49 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3a08be5766c0e198ba8171f7decd09065c08a5c850276325cc1792f25e7b356e

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
2966
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
097c0169060000175645b8a000000001
last-modified
Fri, 05 May 2017 07:30:36 GMT
server
cloudflare
etag
W/"390-54ec1dd89bf00"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=gPzbcULgr%2FKUrwq7iCCUf8Jdz%2FcfvdMMLtKpkBYkLH5ybR2P8KanMzSkrnPuYDPiCXWOgGgp5KE0ej4QNfjry3oz3xyUowtKBx%2F%2ByFDadbxzRMrPgu75"}]}
content-type
text/css
cache-control
max-age=14400
cf-ray
640d04ee68bf1756-FRA
ubm-widget-style.css
dsimg.ubm-us.net/ubm-widget/css/
29 KB
5 KB
Stylesheet
General
Full URL
https://dsimg.ubm-us.net/ubm-widget/css/ubm-widget-style.css
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::6815:420c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6414656f939f73a463499bd2c5a8f75793658adf6e05d0e4cd61d1ba36636b94

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
3257
cf-polished
origSize=29587
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
097c01691c00004e20ed137000000001
last-modified
Wed, 11 Apr 2018 16:31:21 GMT
server
cloudflare
etag
W/"7393-569952b4c0840"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"max_age":604800,"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=4I7kLH0molg0CZy7LdapB4jC0ltz0fCVcSs%2B%2FMC6%2BN0sPKblzpglH%2BEEzYjhFVBRGFRH%2BLzbR1%2BeNpg5sZ0kTKIuP6HUrUFcyCyJglZI3IcmBs3vUHfLtWN12AxR"}]}
content-type
text/css
cache-control
max-age=14400
cf-ray
640d04ee997b4e20-FRA
cf-bgj
minify
ubm-widget-min.js
dsimg.ubm-us.net/ubm-widget/js/
192 KB
49 KB
Script
General
Full URL
https://dsimg.ubm-us.net/ubm-widget/js/ubm-widget-min.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::6815:420c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ffcaeef328a1e67717f714997426aaf936e4b9d378a5fbe1bd2a063dfeb50750

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
3257
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
097c01691c00004e201dacd000000001
last-modified
Wed, 11 Apr 2018 17:29:33 GMT
server
cloudflare
etag
W/"2fe99-56995fb6fbbe3"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"max_age":604800,"group":"cf-nel","endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=hPGNlpjSPaW6fO9TRdxGwnRC6ytMKQ3IEu%2FZNWafpl7CcS%2FDM9HZ%2B0qHA29tDoI5g%2BO5URIu6kd0hs5SPXF3l4fMOAlunxd18HzXkBsAZg2N8qhrTPAT64ByI1q7"}]}
content-type
application/javascript
cache-control
max-age=14400
cf-ray
640d04ee997d4e20-FRA
ng_forms.js
www.darkreading.com/script/
23 KB
5 KB
Script
General
Full URL
https://www.darkreading.com/script/ng_forms.js?v7.9
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7963 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
7d23c140b5d7396d35b446f636c1bb8220accc6834abe5f51d7355fca8d91144
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains

Request headers

:path
/script/ng_forms.js?v7.9
pragma
no-cache
cookie
__cfduid=dbf20fb28977a6607c62aae8d0f72346c1618571972; darkreading_lastvisit=4/16/2021 7:19:32 AM; cplChannelTagID=; darkreading%2Dmeter=1340685; darkreading%5Fvisits=2
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.darkreading.com
referer
https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:32 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
2821
x-powered-by
ASP.NET
cf-bgj
minify
cf-request-id
097c0168f300001f51cba26000000001
last-modified
Wed, 09 Oct 2019 11:57:33 GMT
server
cloudflare
etag
W/"28b83cbc987ed51:0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=63072000; includeSubDomains
content-type
application/x-javascript
cache-control
public, max-age=7200
cf-polished
origSize=31823
cf-ray
640d04ee490e1f51-FRA
expires
Fri, 16 Apr 2021 13:19:32 GMT
widget-extra.css
twimgs.com/nojitter/css/
443 B
506 B
Stylesheet
General
Full URL
https://twimgs.com/nojitter/css/widget-extra.css?v1
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::6815:2f49 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
61494fd1b573b217034bef7e22044bda91962797d68efada6726910d32bb995b

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:32 GMT
content-encoding
br
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
2966
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
097c016906000017567e93a000000001
last-modified
Wed, 13 Sep 2017 07:28:37 GMT
server
cloudflare
etag
W/"1bb-5590d1ba81340"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=Cby2xoXLEHjZA9LI1ACfezXUcftnL0htbirS%2BCWta%2FGnEiHiEICz9uX6HynQc01KB8F6U%2FP7%2BQQFi%2Bwg4Ard0gVISc0FfDsCPAKZHjdxjRJWWZxxBAMK"}]}
content-type
text/css
cache-control
max-age=14400
cf-ray
640d04ee68c01756-FRA
gtm.js
www.googletagmanager.com/
165 KB
52 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-WJ9RHF7
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
209e2d5d4c02a21311e4916747d103d3e7666073678b668a7e17be6fb6aa8fe8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
53053
x-xss-protection
0
last-modified
Fri, 16 Apr 2021 09:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 16 Apr 2021 11:19:33 GMT
conversion.js
www.googleadservices.com/pagead/
43 KB
17 KB
Script
General
Full URL
https://www.googleadservices.com/pagead/conversion.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.250.186.66 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra24s05-in-f2.1e100.net
Software
cafe /
Resource Hash
3788b383d339fafcf4a50db75b2f9fabc14e8a9f696fdf35a885e921c5aa6268
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
16601
x-xss-protection
0
server
cafe
etag
12266152133929636408
vary
Accept-Encoding
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=3600
timing-allow-origin
*
expires
Fri, 16 Apr 2021 11:19:33 GMT
adblockDetector.js
www.darkreading.com/prestitial/
110 B
213 B
Script
General
Full URL
https://www.darkreading.com/prestitial/adblockDetector.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7963 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
1399c38bd120b5ec5548085f61949d402a8bbf05a3831e0ff11a5f1345269046
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains

Request headers

:path
/prestitial/adblockDetector.js
pragma
no-cache
cookie
__cfduid=dbf20fb28977a6607c62aae8d0f72346c1618571972; darkreading_lastvisit=4/16/2021 7:19:32 AM; cplChannelTagID=; darkreading%2Dmeter=1340685; darkreading%5Fvisits=2
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.darkreading.com
referer
https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:32 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
HIT
age
2821
x-powered-by
ASP.NET
cf-bgj
minify
cf-request-id
097c01695100001f518eb93000000001
last-modified
Mon, 20 May 2019 09:07:27 GMT
server
cloudflare
etag
W/"46cb5f72ebed51:0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=63072000; includeSubDomains
content-type
application/x-javascript
cache-control
public, max-age=7200
cf-polished
origSize=118
cf-ray
640d04eeea0c1f51-FRA
expires
Fri, 16 Apr 2021 13:19:32 GMT
iwk-it-network-dr.gif
img.deusm.com/darkreading/
3 KB
3 KB
Image
General
Full URL
https://img.deusm.com/darkreading/iwk-it-network-dr.gif
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d6df7d1f2b9c65c06c5ae1e798650b6c388f26f6852b8814f942557d712b9745

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
4393
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
2748
cf-request-id
097c016ce300001776db28d000000001
last-modified
Wed, 02 Nov 2016 13:53:05 GMT
server
cloudflare
etag
"abc-54051c29ab240"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=3ZOUJf4h117CkxDF32WOnRUfuVQMWYUFjWsi%2FkpukXnMDcrgPO07TQimccMfXm4uFltTUSWI4iOdXiPsEy6l%2BGrcw%2F4VgRkYaNI2kldVrreaUg%2FF3vDPTt1V"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
accept-ranges
bytes
cf-ray
640d04f49de71776-FRA
DR_mobile_User_nav.png
img.deusm.com/darkreading/
1 KB
2 KB
Image
General
Full URL
https://img.deusm.com/darkreading/DR_mobile_User_nav.png
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7b02cdb496b954e874c4b87d48eb1ea16f088258786ed0d2f0771acc3d01649e

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
2122
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1470
cf-request-id
097c016ce400001776ad2df000000001
last-modified
Fri, 21 Feb 2014 14:56:03 GMT
server
cloudflare
etag
"5be-4f2ebd21a06c0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=cJIsRz02Ha2%2BjRfKK7UbU0LlKm%2F4x10RjI9CtZ8GDyi4j51uIwXd6PDYIpCNJyKOHKuoetYCb17slw1wcGh8eou03DWiY2uiTq2lI7ZPol8SxCDUVMaqHjKb"}],"group":"cf-nel","max_age":604800}
content-type
image/png
accept-ranges
bytes
cf-ray
640d04f49de91776-FRA
spacer.gif
img.deusm.com/images/
49 B
701 B
Image
General
Full URL
https://img.deusm.com/images/spacer.gif
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3c5b83e390d046c3623c4b8e35b58aaf64a7481bb2372fb51ae2e0e7818f7407

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
5303
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
49
cf-request-id
097c016ce400001776a8bb3000000001
last-modified
Fri, 13 Oct 2000 01:54:07 GMT
server
cloudflare
etag
"31-3737c29f20dc0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=5PsCzUHUlFF4HzZTlE2jH0C%2BAlC6eK9crWcckoTa11Wx3Prwnmni0yXyZWXYUclAvYPbo10Jwc1xXPafQYE03MpXkztchdNj24%2BZuolpwoUijrpWrh8%2BbBO3"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
accept-ranges
bytes
cf-ray
640d04f49ded1776-FRA
DR_search.png
img.deusm.com/darkreading/
2 KB
3 KB
Image
General
Full URL
https://img.deusm.com/darkreading/DR_search.png
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dafb72bcf008c9b9754482b88e8ba8b8e854f1a69483f0753b1c3f12101c1a9f

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
4393
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
2025
cf-request-id
097c016ce400001776918bc000000001
last-modified
Fri, 21 Feb 2014 14:56:03 GMT
server
cloudflare
etag
"7e9-4f2ebd21a06c0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=D6%2BHHzwkGXI2qvFWisCXIIKODxptYdrFyFSfjdIbHv8yt26dz9XUhmRs9csBF1Mx%2BrwvAmNYrtItt9000rgvgpaH3hBflxQ30%2FyWZgFY7cs6t6Zu92k3Qbjd"}],"group":"cf-nel","max_age":604800}
content-type
image/png
accept-ranges
bytes
cf-ray
640d04f49def1776-FRA
DR_mobile_SM.png
img.deusm.com/darkreading/
2 KB
3 KB
Image
General
Full URL
https://img.deusm.com/darkreading/DR_mobile_SM.png
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
bfc1797e85a0565d0cfba1621eac801dc5ebd78a02f45e0ab8de5c6c2eb3f987

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
4393
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
2148
cf-request-id
097c016ce500001776cea22000000001
last-modified
Fri, 21 Feb 2014 14:56:03 GMT
server
cloudflare
etag
"864-4f2ebd21a06c0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=e3W9pU0un3tAdsMBB27YUfbLZ8rklp9KHzEL7dtEoVS0rN6vvAKN1QYLzYGX8h1QJQI0CAv5ByWAFnJnXc%2B0ERHas7ZYblYQY87BPdWjTLFgOggrBpZouhmB"}],"group":"cf-nel","max_age":604800}
content-type
image/png
accept-ranges
bytes
cf-ray
640d04f49df11776-FRA
DR-sections-nav.png
img.deusm.com/darkreading/
2 KB
3 KB
Image
General
Full URL
https://img.deusm.com/darkreading/DR-sections-nav.png
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4f89a03faa36f0b6eeb92b9a8f0b8d2f9d3e564ba8bf13bb169bf05b126ca81e

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
2122
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
2474
cf-request-id
097c016ce500001776ee0a5000000001
last-modified
Fri, 21 Feb 2014 14:56:03 GMT
server
cloudflare
etag
"9aa-4f2ebd21a06c0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=hu3amjKqhWzz%2B3rD9qh8NjCRHp7qgw2Li6%2BOFG%2BEn8ZhMH8S6sW2YPY21wuAfjouEFOLsNaCSaZDsIvfKPdEJRNnMlWe%2FILe4SyCzK6Ww7h7B4hkAIHCqDh7"}],"group":"cf-nel","max_age":604800}
content-type
image/png
accept-ranges
bytes
cf-ray
640d04f49df51776-FRA
mobile_close.jpg
img.deusm.com/darkreading/
2 KB
2 KB
Image
General
Full URL
https://img.deusm.com/darkreading/mobile_close.jpg
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b5c543f59d71e1e4f6b51c896febf86975206dcf9e34757f475b125d64d16ea6

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
4393
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1592
cf-request-id
097c016ce500001776dd3c8000000001
last-modified
Thu, 13 Mar 2014 12:44:20 GMT
server
cloudflare
etag
"638-4f47c4fdf5100"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=u9fkjsMwLVTamJZNUPd4oPlE%2FQM7HYoBTgvn92jFaTGlZs6e9TtQJklPr41G%2F3ONOSQFXvpwsKIQfM1p7b4XkAtylMs5uv9zDPPvfAhhBx2tLOulrtLSwLiz"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
accept-ranges
bytes
cf-ray
640d04f49df71776-FRA
DR_logo_314x49.png
img.deusm.com/darkreading/
7 KB
8 KB
Image
General
Full URL
https://img.deusm.com/darkreading/DR_logo_314x49.png
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0615fb751c4db849533b1e432f05428e307591466902876f8ab30d7873b7f38b

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
4393
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
7032
cf-request-id
097c016ce70000177687a86000000001
last-modified
Mon, 15 Oct 2018 10:02:43 GMT
server
cloudflare
etag
"1b78-5784189c2b6f8"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=KyY6hb8QdjOOM%2Fk5I5DF5ZZCUf5tLJeJaLIKdyGtcZ%2BO%2BGmTYZ40zFypPZIPH%2BA9D8zX0KqVeZZD2f1gM%2B1ZCtuDX8ddTfshgkPEJGk9FfEJnPml0%2FnOZ4z%2F"}],"group":"cf-nel","max_age":604800}
content-type
image/png
accept-ranges
bytes
cf-ray
640d04f49dfb1776-FRA
DR_Newsletters.png
img.deusm.com/darkreading/
4 KB
5 KB
Image
General
Full URL
https://img.deusm.com/darkreading/DR_Newsletters.png
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
33194e1b282eaf349b01b68de4fee20452ff6877b4b82605d5c68c5132444f96

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
4393
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
4076
cf-request-id
097c016ce100001776e027e000000001
last-modified
Wed, 18 Sep 2019 13:04:00 GMT
server
cloudflare
etag
"fec-592d378715000"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=TxWQKQ3J6DoJlSrVEK%2B52CIYUk8Ot4AvLfuouJwqDjjYHAZhjwwugTJzKtwW2X8EvcQSWD6xFJdFg52LEpABpWLTPURkidijLeBQt5gBQy95nw%2BmzDJIAfjZ"}],"group":"cf-nel","max_age":604800}
content-type
image/png
accept-ranges
bytes
cf-ray
640d04f49dd51776-FRA
bib-related-content.min.css
cdn.bibblio.org/rcm/4.9/
22 KB
4 KB
Stylesheet
General
Full URL
https://cdn.bibblio.org/rcm/4.9/bib-related-content.min.css
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.25.45 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-25-45.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
fa30597c8340ed18b045cc801a2dfb2e1185f9ca5ea02753e5935e64df5aa4c5

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 10:18:23 GMT
content-encoding
gzip
last-modified
Fri, 20 Mar 2020 10:35:36 GMT
server
AmazonS3
age
3671
etag
W/"81695cfb2a7f57aed84745a9848ba3df"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css
via
1.1 6f6de2de0e03603ac1b58353376153d3.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-C2
x-amz-cf-id
cED3cmVemXNLhMz9LVNaZFegOg0J7SqVAm4sFEOPfBXk9ZaiFdw8NQ==
bib-related-content.min.js
cdn.bibblio.org/rcm/4.9/
45 KB
11 KB
Script
General
Full URL
https://cdn.bibblio.org/rcm/4.9/bib-related-content.min.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.32.25.45 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-25-45.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
5b21d495e672a89a4d8dc047b17ab94531525297644c1a4340a2bc3f26ab782f

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 10:18:23 GMT
content-encoding
gzip
last-modified
Fri, 20 Mar 2020 10:35:37 GMT
server
AmazonS3
age
3671
etag
W/"1274153c15863a39c136e9954d12299d"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 6f6de2de0e03603ac1b58353376153d3.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-C2
x-amz-cf-id
cFtDjkO9AUH79lYF3nBd6EaxJdAJdbZM1gIGhGZNEe_bY7SPopFOtw==
Jai-Vijayan.jpg
img.deusm.com/informationweek/
11 KB
12 KB
Image
General
Full URL
https://img.deusm.com/informationweek/Jai-Vijayan.jpg
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2e9b6fed568a85ee88f1eb2aa1d51cb2073d907cbb0109a5dd703f0b1e5651d6

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
4915
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
11367
cf-request-id
097c016ce100001776ebb00000000001
last-modified
Mon, 29 Sep 2014 13:34:14 GMT
server
cloudflare
etag
"2c67-5043452972180"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=KFBhQoIUw0ZRrqfGihd1ZfDOLSy5L14U8QchR9o7SI2Olgj%2BldevXKzEgqexlGHd6FR7xWosfhQSLF1KenM83C9D2IJGdwgZlNeBBHDA7NuwksoeeZV5le9V"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
accept-ranges
bytes
cf-ray
640d04f49dd71776-FRA
editor-TW.png
img.deusm.com/informationweek/
2 KB
2 KB
Image
General
Full URL
https://img.deusm.com/informationweek/editor-TW.png
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
32821e69d091e71a62b9dbefcd09516c2133b50c50a3f8d597207d9cab5d59b8

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
2745
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1549
cf-request-id
097c016ce100001776ba32e000000001
last-modified
Thu, 14 Nov 2013 19:33:41 GMT
server
cloudflare
etag
"60d-4eb2828b4cf40"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=eYQx9cnvw69MHfF%2BkRdtSG01r6yXcBi1YbcCBBkHwBjxeFlut0%2FVNEaFwDY8EBRPemz9PESLm%2B%2BJKYoaKcQF7sOEwUtnct3BC%2FxKX32PPL%2FWItOVQ38i4oFy"}],"group":"cf-nel","max_age":604800}
content-type
image/png
accept-ranges
bytes
cf-ray
640d04f49dda1776-FRA
editor-IN.png
img.deusm.com/informationweek/
1 KB
2 KB
Image
General
Full URL
https://img.deusm.com/informationweek/editor-IN.png
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e5cc2027e2da5b3d553fba6a4d2d7276aafa604001e9b0321e18d1fd62b03b3f

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
2812
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1463
cf-request-id
097c016ce200001776cbaf3000000001
last-modified
Thu, 14 Nov 2013 19:33:41 GMT
server
cloudflare
etag
"5b7-4eb2828b4cf40"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=mOnRgDMDKhdyRrFovV4%2F5VEIF1yPUNzDUqJiAyLN32GN5DDhKtbklQxDD5VXrwfPvkEqM0pERTaEPqMOJ%2FyvhVR0vj%2FZaody2XS7F4DeYWe1NFmLvOIkpDRf"}],"group":"cf-nel","max_age":604800}
content-type
image/png
accept-ranges
bytes
cf-ray
640d04f49ddb1776-FRA
editor-RSS.png
img.deusm.com/informationweek/
2 KB
2 KB
Image
General
Full URL
https://img.deusm.com/informationweek/editor-RSS.png
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a8f4fa7376444ffe05d0f7b296439401fb9729bdee84d760ee6286e7b663c753

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
4147
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1786
cf-request-id
097c016ce200001776e83d3000000001
last-modified
Thu, 14 Nov 2013 19:33:41 GMT
server
cloudflare
etag
"6fa-4eb2828b4cf40"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=5J66WiHrj5AZJ0HayBqdpgVB07f4ZVglgcFuv23LNJi5CPWnNoPBZkpDMogqnCCm5aBvYswMgZ%2FwfEEE%2FcDB6Hlqe5FJdl4p3%2F0Lfz33sCFtS5ZwFLlasR30"}],"group":"cf-nel","max_age":604800}
content-type
image/png
accept-ranges
bytes
cf-ray
640d04f49ddd1776-FRA
editor-email.png
img.deusm.com/informationweek/
2 KB
2 KB
Image
General
Full URL
https://img.deusm.com/informationweek/editor-email.png
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
190f689e0f479324a217a5ea88c1acc132b66d24b16559052d59b892ff5dcba2

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
2812
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1807
cf-request-id
097c016ce200001776aea71000000001
last-modified
Thu, 14 Nov 2013 19:33:40 GMT
server
cloudflare
etag
"70f-4eb2828a58d00"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=7lmAfhyYpu%2FPo%2B6KxRkx0odyo2HKYp4EkLYaXhj9apgC%2BedlqocI805vEm9QcbUHgYJGqPSDIKjTZBENUSHDh%2FsJeW2NqE6aSIoQpdem0xDxSS8dduXF%2F7G2"}],"group":"cf-nel","max_age":604800}
content-type
image/png
accept-ranges
bytes
cf-ray
640d04f49ddf1776-FRA
DR-comment.png
img.deusm.com/darkreading/
1011 B
2 KB
Image
General
Full URL
https://img.deusm.com/darkreading/DR-comment.png
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
63484bd691450c081b848e5159315bfcd02720741d3f72a69717643d6630e578

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
4393
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1011
cf-request-id
097c016ce3000017769e09a000000001
last-modified
Fri, 21 Feb 2014 14:56:02 GMT
server
cloudflare
etag
"3f3-4f2ebd20ac480"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=vsWQcXR8Li%2FTfyQDP2EeJXhqWurUOAZswQceTTNFvSvUDaZKf1cuMy0ptvxlEtP%2F%2FDkaKN5I0LZ7UymhXP82dogcRCTLHCv%2FJUpM84MUXkf%2BGYNqAd%2B8odRz"}],"group":"cf-nel","max_age":604800}
content-type
image/png
accept-ranges
bytes
cf-ray
640d04f49de21776-FRA
thumbs-up.png
img.deusm.com/darkreading/
2 KB
2 KB
Image
General
Full URL
https://img.deusm.com/darkreading/thumbs-up.png
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0c9111d9514a49ad97e7c6d5fd97a00f3232b73537e9155726f32f123eb69b5a

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
4393
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1543
cf-request-id
097c016ce3000017768f20f000000001
last-modified
Fri, 14 Mar 2014 16:09:21 GMT
server
cloudflare
etag
"607-4f4934ae90e40"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=yW5%2BzM1WGyDADg%2FBUR23SB5bbEFHaDlKw8GLF9XnZ6QTVPAEWT9lRbYhS34R5HF8yhJvEPLNKvLIpL%2BXSBBQoAblAFtTUN%2FppKRq8PktK0V4Xw3PQl7jy8Y1"}],"group":"cf-nel","max_age":604800}
content-type
image/png
accept-ranges
bytes
cf-ray
640d04f49de31776-FRA
thumbs-down.png
img.deusm.com/informationweek/
2 KB
2 KB
Image
General
Full URL
https://img.deusm.com/informationweek/thumbs-down.png
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b19f14d674857362b6e10d0dcb1703b149d9dda6f350d1737562fc36e4e67a81

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
4393
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1572
cf-request-id
097c016ce6000017768c842000000001
last-modified
Wed, 20 Nov 2013 19:20:31 GMT
server
cloudflare
etag
"624-4eba0acaa9dc0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=K6IErg9FelxaSQOE%2FCE%2FGK86QL7kpnAtz02lsRnOeSNicW%2BK7sDksQSkHDRGv5upQFLzaGOfZfJ1YZHRh9tfmlAGrCo8%2B%2FlnEJQa5wozdV5%2FtWbSOLqeE3U4"}],"group":"cf-nel","max_age":604800}
content-type
image/png
accept-ranges
bytes
cf-ray
640d04f49dfc1776-FRA
email-decode.min.js
www.darkreading.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/
1 KB
899 B
Script
General
Full URL
https://www.darkreading.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7963 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

:path
/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
pragma
no-cache
cookie
__cfduid=dbf20fb28977a6607c62aae8d0f72346c1618571972; darkreading_lastvisit=4/16/2021 7:19:32 AM; cplChannelTagID=; darkreading%2Dmeter=1340685; darkreading%5Fvisits=2
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.darkreading.com
referer
https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 14 Apr 2021 08:33:47 GMT
server
cloudflare
etag
W/"6076a8eb-4d7"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
x-frame-options
DENY
content-type
application/javascript
cache-control
max-age=172800 public
cf-ray
640d04f1be321f51-FRA
vary
Accept-Encoding
cf-request-id
097c016b0e00001f519120d000000001
expires
Sun, 18 Apr 2021 11:19:33 GMT
widgets.js
platform.twitter.com/
95 KB
29 KB
Script
General
Full URL
https://platform.twitter.com/widgets.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
93.184.220.66 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (ska/F6FC) /
Resource Hash
501ed6f37588ea4083347c8c1b9fd9bfbc560f8f9977aa2847749e0977063f6c

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 16 Apr 2021 11:19:33 GMT
Content-Encoding
gzip
Last-Modified
Thu, 15 Apr 2021 22:47:45 GMT
Server
ECS (ska/F6FC)
Age
720
Etag
"f8e2082c1f210ffae5a2de107bd73ffc+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=1800
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
28769
in.js
platform.linkedin.com/
181 KB
55 KB
Script
General
Full URL
https://platform.linkedin.com/in.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:bdf::19 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Play /
Resource Hash
dd09ac569606839a91da1ec3b96ffa4e75cf303ffd0ea8a733c4e1befb8c8e12

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:32 GMT
content-encoding
gzip
vary
Accept-Encoding
x-cdn-client-ip-version
IPV6
x-cdn
AZUR
x-cache
TCP_HIT
x-cdn-proto
HTTP2
x-azure-ref-originshield
01Wl5YAAAAAB7hfJIALeAS6YDnImfsP11TE9OMjFFREdFMDExMABkN2Q1MzcxZC04ZWE5LTRmYWYtYTQwNS1kMDYwMGIzNTE3NjM=
content-length
55606
x-li-uuid
JfFP4c1PdhYQXalUkCsAAA==
server
Play
x-li-pop
afd-prod-ech2
x-azure-ref
0xXJ5YAAAAACcs/cwdBihRpITQBYyxTWsRlJBRURHRTEwMDcAZDdkNTM3MWQtOGVhOS00ZmFmLWE0MDUtZDA2MDBiMzUxNzYz
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=3600
x-li-proto
http/1.1
x-li-fabric
prod-lva1
expires
Fri, 16 Apr 2021 11:27:41 GMT
flipboard_srsw.png
cdn.flipboard.com/badges/
322 B
763 B
Image
General
Full URL
https://cdn.flipboard.com/badges/flipboard_srsw.png
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20e8:3600:e:5a70:ca47:86e1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
44fc0a3d10c47ae5aa6c77c76b4b8f81aa08022ca464ef235005ddd86570eb5b

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 15 Apr 2021 18:47:57 GMT
via
1.1 700e1fc650af7cfb451dbdb8d79d4107.cloudfront.net (CloudFront)
last-modified
Wed, 07 Feb 2018 22:03:59 GMT
server
AmazonS3
x-amz-meta-s3cmd-attrs
atime:1518040945/ctime:1518040834/gid:20/gname:staff/md5:37351783e1813119a3e0710c16137273/mode:33152/mtime:1518064798/uid:502/uname:jlee
age
59609
etag
"37351783e1813119a3e0710c16137273"
x-cache
Hit from cloudfront
content-type
image/png
x-amz-cf-pop
TXL52-C1
accept-ranges
bytes
content-length
322
x-amz-cf-id
j6RPK_WhrpM0DykdhDsAhQedlF-k82E2aMxq-ofPRqLHOE9xmn7B2Q==
flbuttons.min.js
cdn.flipboard.com/web/buttons/js/
7 KB
8 KB
Script
General
Full URL
https://cdn.flipboard.com/web/buttons/js/flbuttons.min.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20e8:3600:e:5a70:ca47:86e1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f039e32c9e62cd2acc5bf02dec7282686e6f41be6b01bfa249f9590cda747cba

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 15 Apr 2021 15:45:47 GMT
via
1.1 700e1fc650af7cfb451dbdb8d79d4107.cloudfront.net (CloudFront)
last-modified
Wed, 23 Dec 2020 17:43:48 GMT
server
AmazonS3
x-amz-meta-s3cmd-attrs
atime:1608743508/ctime:1608745368/gid:1000/gname:ubuntu/md5:e9b04ad509ffb00302d9625f75774548/mode:33204/mtime:1608745368/uid:1000/uname:ubuntu
age
70427
etag
"e9b04ad509ffb00302d9625f75774548"
x-cache
Hit from cloudfront
content-type
text/html
x-amz-cf-pop
TXL52-C1
accept-ranges
bytes
content-length
7407
x-amz-cf-id
-H9m1rpUDw011NGQ2D-sZYvhO3UyorH-DTADiVdXi0RQcSTVtTICCA==
Reddit-30x30.png
img.deusm.com/darkreading/
1 KB
2 KB
Image
General
Full URL
https://img.deusm.com/darkreading/Reddit-30x30.png
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
86a94e7b3824da696d7bb5ee97be19ca25346b7fc59f40dced2e2b203f05b834

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
4393
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1324
cf-request-id
097c016ce600001776d7be5000000001
last-modified
Fri, 09 Oct 2020 07:16:07 GMT
server
cloudflare
etag
"52c-5b137b8e6bbc0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=kbACH2HArxT70T01d4UbZjRnLWijfLw8kTZZOk2D86x3i9mXafiDOm8%2BGUEFXwBk3YB4YMxkNcbx0s7vMN2Ywn9Qsqu6ODPNDQB31ovNQGwuqA0UfRoK%2Fbip"}],"group":"cf-nel","max_age":604800}
content-type
image/png
accept-ranges
bytes
cf-ray
640d04f49dfe1776-FRA
DR-user.jpg
img.deusm.com/darkreading/
2 KB
3 KB
Image
General
Full URL
https://img.deusm.com/darkreading/DR-user.jpg
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d4b95126382745e9e07d76812e3bbc8d6de2cfa6356c586f930ece7d4acb8052

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
4338
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
2429
cf-request-id
097c016ce700001776e2a08000000001
last-modified
Tue, 04 Mar 2014 15:58:18 GMT
server
cloudflare
etag
"97d-4f3c9f8faba80"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=fx3aYYHNWk8mk6qJ%2Faj3xkr%2BHHC4eweClW%2FKOlAVJhE%2BR0NhafrZNni%2BnIA3C1iF6llPC867Y6w8RGQAR1S05SVsJetCRaKEVjETfQjewoSiOJpckzSbNOlH"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
accept-ranges
bytes
cf-ray
640d04f49dff1776-FRA
win10-exploit-prot-teaser.png
www.dedoimedo.com/images/computers-years/2017-2/
40 KB
40 KB
Image
General
Full URL
https://www.dedoimedo.com/images/computers-years/2017-2/win10-exploit-prot-teaser.png
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
64.13.192.84 , United States, ASN31815 (MEDIATEMPLE, US),
Reverse DNS
Software
nginx/1.16.1 /
Resource Hash
df1154ada0c9c480d8c6bc604827cd308152756548366700c4cead55ae3fa543

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:34 GMT
last-modified
Wed, 20 Dec 2017 15:58:10 GMT
server
nginx/1.16.1
accept-ranges
bytes
etag
"a0ac-560c7a665c880"
content-length
41132
content-type
image/png
Robert-Lemos.png
img.deusm.com/darkreading/authors/
45 KB
46 KB
Image
General
Full URL
https://img.deusm.com/darkreading/authors/Robert-Lemos.png
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
87cdbacb358e421a482bc1a52dc9cfc04a9f6d8dfe86c7c6c66bcde013792850

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
4393
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
46548
cf-request-id
097c016ce700001776df822000000001
last-modified
Wed, 12 Dec 2018 13:37:24 GMT
server
cloudflare
etag
"b5d4-57cd34c52ed00"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=gc3c6uB32P%2B8gRcfG5itgL6cX3OY1E0V1PPpLMHLNwZhuc05RuMUeeWF3cZ8ECn99f%2BcwUnjo%2BIAujDxiNP10J%2F7R1EIyoCXiNDDPx07ZWILKB3lvdb15SzY"}],"group":"cf-nel","max_age":604800}
content-type
image/png
accept-ranges
bytes
cf-ray
640d04f49e001776-FRA
Sheridan-IWK-125x125.jpg
img.deusm.com/informationweek/
17 KB
17 KB
Image
General
Full URL
https://img.deusm.com/informationweek/Sheridan-IWK-125x125.jpg
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
88f6b155f6df559c17b78785558ec29de6429ef62232a26ad2ddbf8f8de07209

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
5579
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
16902
cf-request-id
097c016ce7000017769429d000000001
last-modified
Thu, 14 Aug 2014 20:09:58 GMT
server
cloudflare
etag
"4206-5009c7d249180"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=uNzBBAr4cI24lXBNRxqJePOadJJyobTFHa3eOUAibHjym4%2B7xPzb8mLjQdGAdz3U8LhfoViLyQ%2FonbrGiT1U5fV9E%2F9E1oem%2B1lRgw5wYkCHS0zAJu1mdQZw"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
accept-ranges
bytes
cf-ray
640d04f49e021776-FRA
Rik-Turner.png
img.deusm.com/darkreading/authors/
26 KB
27 KB
Image
General
Full URL
https://img.deusm.com/darkreading/authors/Rik-Turner.png
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f32d4bae1be71af82dcf0f97d37e4281d002eabfbbe8735753d61e1035133924

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
2122
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
27062
cf-request-id
097c016ce800001776f9a26000000001
last-modified
Thu, 15 Aug 2019 13:33:48 GMT
server
cloudflare
etag
"69b6-59027ec694700"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=6CLkYKzUnLG7pK5uZf%2FkpIiHkF5V8v6bF2o3cAqRZeLBz21TO6lH9P3oVgCYGixEDlvD04hqh6yeVd%2FT4HgZUIOFFugdACSWgyVVKV6%2BCu%2FVhblmz6%2BZDrbB"}],"group":"cf-nel","max_age":604800}
content-type
image/png
accept-ranges
bytes
cf-ray
640d04f49e031776-FRA
NL-icon.png
img.deusm.com/informationweek/
3 KB
3 KB
Image
General
Full URL
https://img.deusm.com/informationweek/NL-icon.png
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d8b7ea5cc75abc79d502a95c5ccac8f97aa82fd8c13acc74c84c754eb86cc4c3

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
4393
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
2599
cf-request-id
097c016ce800001776bd823000000001
last-modified
Fri, 08 Nov 2013 15:09:43 GMT
server
cloudflare
etag
"a27-4eaabc5a3dbc0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=UqE6mLF9e8wU8ButQslAtXEcbHHIwYyiJHq3QJNxeC3Zefxa8DymTzcgPad3DhDSGGAdNxM3DC4Dwhw8lxw1cU%2FrsB8bNcHlC4yEKN53Ednx%2FDy7fU0HgN3j"}],"group":"cf-nel","max_age":604800}
content-type
image/png
accept-ranges
bytes
cf-ray
640d04f49e041776-FRA
video-arrow_left_off.gif
img.deusm.com/darkreading/
1 KB
2 KB
Image
General
Full URL
https://img.deusm.com/darkreading/video-arrow_left_off.gif
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9f61400081191bf755c967c186a8fd356b02010fac3412f84cf83d5dfe10dd5d

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
4393
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1342
cf-request-id
097c016ce900001776cea23000000001
last-modified
Fri, 14 Mar 2014 16:02:37 GMT
server
cloudflare
etag
"53e-4f49332d48140"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=XcGHryqapGiICwX9qb6XpYgMUdZkI429Dt30Yu%2BIGIIdqXXnt759pY8MXMX%2BUpB62hvqysEsBdx1dopDiM%2FAOVa0yP1KG7l2AHYYsI2oLBOTjsBh8DG8TZ8X"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
accept-ranges
bytes
cf-ray
640d04f49e051776-FRA
image.jpg
cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/c4e73410-1fc3-4fd5-9688-1cff2b237c45/f04101da-8e67-43a7-ab09-dea298c7a098/160x90/match/
11 KB
11 KB
Image
General
Full URL
https://cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/c4e73410-1fc3-4fd5-9688-1cff2b237c45/f04101da-8e67-43a7-ab09-dea298c7a098/160x90/match/image.jpg
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.32.29.48 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-29-48.fra56.r.cloudfront.net
Software
/ BC
Resource Hash
d407e6c9443c45a0b2f4f12ebe9ed6e27f661f53747fa66575ffa5e70aa36e58

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Thu, 08 Apr 2021 00:48:24 GMT
Via
1.1 07fbd2276304c86925071791c7032951.cloudfront.net (CloudFront)
Connection
keep-alive
Last-Modified
Fri, 01 Jan 2016 00:00:00 GMT
Age
729070
X-Powered-From
gantry
X-Powered-By
BC
X-Cache
Hit from cloudfront
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000
X-Amz-Cf-Pop
FRA56-C2
Content-Length
11188
X-Amz-Cf-Id
EsNjtMRRaaRUSiTEp5DfX8cM2okvueRfT-lV60Z6hNDsR0JuCLhvMg==
Expires
Fri, 08 Apr 2022 00:48:24 GMT
comment.png
img.deusm.com/informationweek/
1 KB
2 KB
Image
General
Full URL
https://img.deusm.com/informationweek/comment.png
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4f65ccd30d1c95588b51035a804dd49090d7fbe6c2829a576a31d1b6a3e0f86b

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
2122
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1094
cf-request-id
097c016ce900001776b6217000000001
last-modified
Wed, 20 Nov 2013 19:22:53 GMT
server
cloudflare
etag
"446-4eba0b5215d40"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=AERcmkwBFAnmH%2FyyMGB%2F%2BLj7qceaIUnjtpwsiOO7szqO1POnKnQBaj75cMidB%2FZTlEAXnX4lu4zZPllSsMEYkcR5ljL8ThWqORXQ6%2F%2BM08GcsGxx7S2RcgtN"}],"group":"cf-nel","max_age":604800}
content-type
image/png
accept-ranges
bytes
cf-ray
640d04f49e061776-FRA
image.jpg
cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/aabfc51d-40f0-4e5c-9342-b6054299400a/42b10347-8df1-470f-a525-e54163acc62f/160x90/match/
10 KB
11 KB
Image
General
Full URL
https://cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/aabfc51d-40f0-4e5c-9342-b6054299400a/42b10347-8df1-470f-a525-e54163acc62f/160x90/match/image.jpg
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.32.29.48 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-29-48.fra56.r.cloudfront.net
Software
/ BC
Resource Hash
a58300cbd020e523bdb156a2b415dfd05d3a5cd1a31e89c73540208f9f9cdab2

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 22 Feb 2021 17:24:08 GMT
Via
1.1 34435958fa6d40b77fd22fa1c1f56176.cloudfront.net (CloudFront)
Connection
keep-alive
Last-Modified
Fri, 01 Jan 2016 00:00:00 GMT
Age
4557326
X-Powered-From
gantry
X-Powered-By
BC
X-Cache
Hit from cloudfront
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000
X-Amz-Cf-Pop
FRA56-C2
Content-Length
10667
X-Amz-Cf-Id
l5ERzdeg7W_rBJ5ruO_6tLF5ZTYxC_3gkXO8lHBUVuRcEH3l_U6R5w==
Expires
Tue, 22 Feb 2022 17:24:08 GMT
image.jpg
cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/9a4f3e78-3dde-48ec-92ef-2476b483fb3a/b0d9ae6e-7acd-460e-8e68-027a46d076c8/160x90/match/
11 KB
11 KB
Image
General
Full URL
https://cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/9a4f3e78-3dde-48ec-92ef-2476b483fb3a/b0d9ae6e-7acd-460e-8e68-027a46d076c8/160x90/match/image.jpg
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.32.29.48 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-29-48.fra56.r.cloudfront.net
Software
/ BC
Resource Hash
41fac5f010cdfd4662792d3f2d81a4f0ad06bd42536bf9aacd4afbd8eb52698c

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Thu, 04 Feb 2021 01:33:20 GMT
Via
1.1 aff6ac5c98fa897349204752e5877c81.cloudfront.net (CloudFront)
Connection
keep-alive
Last-Modified
Fri, 01 Jan 2016 00:00:00 GMT
Age
6169573
X-Powered-From
gantry
X-Powered-By
BC
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000
X-Amz-Cf-Pop
FRA56-C2
X-Amz-Cf-Id
ouL7qyNjk14-rQCdbEBnCQFSk6S4GMkPfRYC1ySdN6OEQE1iO5zVSQ==
Expires
Fri, 04 Feb 2022 01:33:20 GMT
image.jpg
cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/3d2bd21e-2ec5-44d3-a66f-dc6eac5ddafe/cdaeee88-f1a5-4fa4-954c-f8c74071acc4/160x90/match/
10 KB
11 KB
Image
General
Full URL
https://cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/3d2bd21e-2ec5-44d3-a66f-dc6eac5ddafe/cdaeee88-f1a5-4fa4-954c-f8c74071acc4/160x90/match/image.jpg
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.32.29.48 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-29-48.fra56.r.cloudfront.net
Software
/ BC
Resource Hash
4b3e9e481ce206001f1ca652137d83267c1b760cf3b5678012c52e3a133e556c

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Thu, 04 Feb 2021 02:35:21 GMT
Via
1.1 fdc45b521af7652438141328494a79d3.cloudfront.net (CloudFront)
Connection
keep-alive
Last-Modified
Fri, 01 Jan 2016 00:00:00 GMT
Age
6165853
X-Powered-From
gantry
X-Powered-By
BC
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000
X-Amz-Cf-Pop
FRA56-C2
X-Amz-Cf-Id
8eSy7cfG2A2PrrKAFqqxlqwhiP2No6Emsatlu_l2-y_b4vl-mOMOHw==
Expires
Fri, 04 Feb 2022 02:35:21 GMT
image.jpg
cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/fa726b0a-898c-4556-9c4e-8513ab3eb45d/11ab51b4-e776-4639-97c3-07e5210bfd9d/160x90/match/
3 KB
4 KB
Image
General
Full URL
https://cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/fa726b0a-898c-4556-9c4e-8513ab3eb45d/11ab51b4-e776-4639-97c3-07e5210bfd9d/160x90/match/image.jpg
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.32.29.48 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-29-48.fra56.r.cloudfront.net
Software
/ BC
Resource Hash
fdb0066a030a45bd44f17d459c6369901b3fa648c94de3afa0f824d87dfd1527

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 05 Feb 2021 02:03:45 GMT
Via
1.1 fd3cce3e0bafd8b312277d0ad9f4762f.cloudfront.net (CloudFront)
Connection
keep-alive
Last-Modified
Fri, 01 Jan 2016 00:00:00 GMT
Age
6081349
X-Powered-From
gantry
X-Powered-By
BC
X-Cache
Hit from cloudfront
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000
X-Amz-Cf-Pop
FRA56-C2
Content-Length
3558
X-Amz-Cf-Id
mPJ0n5LM0P94U8HbY3moMFA3xIVvoWCrDWI_HDKOHjXThynIThgDEw==
Expires
Sat, 05 Feb 2022 02:03:45 GMT
image.jpg
cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/2fe20654-2cfe-4555-8102-d79cc405847e/0e955e8e-0506-45e1-b715-3062ef29198b/160x90/match/
5 KB
5 KB
Image
General
Full URL
https://cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/2fe20654-2cfe-4555-8102-d79cc405847e/0e955e8e-0506-45e1-b715-3062ef29198b/160x90/match/image.jpg
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.32.29.48 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-29-48.fra56.r.cloudfront.net
Software
/ BC
Resource Hash
6dd394ad8df7d5e2ed0f220ff18451f281ccc907cae0d25d233c51533ad8887f

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Thu, 04 Feb 2021 04:40:41 GMT
Via
1.1 93b0598b43d63761f1a129690721f888.cloudfront.net (CloudFront)
Connection
keep-alive
Last-Modified
Fri, 01 Jan 2016 00:00:00 GMT
Age
6158333
X-Powered-From
gantry
X-Powered-By
BC
X-Cache
Hit from cloudfront
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000
X-Amz-Cf-Pop
FRA56-C2
Content-Length
4738
X-Amz-Cf-Id
pu87QQW6kV19xZgXgcTcdF-rQ5nKsJc2RF27FSe6nPura_2XBhO2uA==
Expires
Fri, 04 Feb 2022 04:40:41 GMT
image.jpg
cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/c601c055-fcb3-4a63-98f8-d1882e680cbc/32d6c778-320c-47c4-91cf-4508cb0d5c40/160x90/match/
3 KB
4 KB
Image
General
Full URL
https://cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/c601c055-fcb3-4a63-98f8-d1882e680cbc/32d6c778-320c-47c4-91cf-4508cb0d5c40/160x90/match/image.jpg
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.32.29.48 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-29-48.fra56.r.cloudfront.net
Software
/ BC
Resource Hash
01b4ebef3b601f246d0adbff5259fabbe7c8e0311f1169b495f0bb2b862db981

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 08 Feb 2021 02:08:27 GMT
Via
1.1 fd3cce3e0bafd8b312277d0ad9f4762f.cloudfront.net (CloudFront)
Connection
keep-alive
Last-Modified
Fri, 01 Jan 2016 00:00:00 GMT
Age
5821867
X-Powered-From
gantry
X-Powered-By
BC
X-Cache
Hit from cloudfront
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000
X-Amz-Cf-Pop
FRA56-C2
Content-Length
3439
X-Amz-Cf-Id
Slo2Llj2N1ujvwMG5Dx0kPlaO7spJ1lprBbTzrTpLx9esrz-GWbmog==
Expires
Tue, 08 Feb 2022 02:08:27 GMT
image.jpg
cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/a7f317ff-8706-4af7-9f0e-9e2417e9af2d/29fd1a56-9d84-4424-bebd-e25a67a974d3/160x90/match/
4 KB
5 KB
Image
General
Full URL
https://cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/a7f317ff-8706-4af7-9f0e-9e2417e9af2d/29fd1a56-9d84-4424-bebd-e25a67a974d3/160x90/match/image.jpg
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.32.29.48 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-29-48.fra56.r.cloudfront.net
Software
/ BC
Resource Hash
eb12eaa9c690d06187a7099545a6bf52318a2364411fc9c4ec73e7fa4ecbb0f9

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 29 Jan 2021 01:12:05 GMT
Via
1.1 34435958fa6d40b77fd22fa1c1f56176.cloudfront.net (CloudFront)
Connection
keep-alive
Last-Modified
Fri, 01 Jan 2016 00:00:00 GMT
Age
6689249
X-Powered-From
gantry
X-Powered-By
BC
X-Cache
Hit from cloudfront
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000
X-Amz-Cf-Pop
FRA56-C2
Content-Length
4223
X-Amz-Cf-Id
J_4ZulsL3JYGQIVMqn1fzlk4RMWEL-0eyjK1xLri-9rs6GffNrAPYw==
Expires
Sat, 29 Jan 2022 01:12:05 GMT
image.jpg
cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/7d8fd3f5-736a-4751-9741-c63476a1c55f/9e10932e-22cf-4161-8f97-7ded08968b25/160x90/match/
4 KB
4 KB
Image
General
Full URL
https://cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/7d8fd3f5-736a-4751-9741-c63476a1c55f/9e10932e-22cf-4161-8f97-7ded08968b25/160x90/match/image.jpg
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.32.29.48 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-29-48.fra56.r.cloudfront.net
Software
/ BC
Resource Hash
2ec7b8d3c38a996f67dd4e580c975ece3e9d936d4267167d12604a59a5ff2c87

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Sat, 13 Feb 2021 04:41:04 GMT
Via
1.1 aff6ac5c98fa897349204752e5877c81.cloudfront.net (CloudFront)
Connection
keep-alive
Last-Modified
Fri, 01 Jan 2016 00:00:00 GMT
Age
5380710
X-Powered-From
gantry
X-Powered-By
BC
X-Cache
Hit from cloudfront
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000
X-Amz-Cf-Pop
FRA56-C2
Content-Length
3768
X-Amz-Cf-Id
jqcmqkCt2dC9ztkUTd4-c2Sb7HZxzBA1JM74HpZpRFXaQ46MLDkHlw==
Expires
Sun, 13 Feb 2022 04:41:04 GMT
image.jpg
cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/3afccae7-9c97-4434-b702-84e95b2c9e9b/213e62f9-b1ab-4368-a58c-5bf046478bff/160x90/match/
4 KB
4 KB
Image
General
Full URL
https://cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/3afccae7-9c97-4434-b702-84e95b2c9e9b/213e62f9-b1ab-4368-a58c-5bf046478bff/160x90/match/image.jpg
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.32.29.48 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-29-48.fra56.r.cloudfront.net
Software
/ BC
Resource Hash
c670b28572ed7804386b274eb1ddafbc0253a1aff515b0d15805c57c26bcee64

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Tue, 09 Feb 2021 05:02:01 GMT
Via
1.1 07fbd2276304c86925071791c7032951.cloudfront.net (CloudFront)
Connection
keep-alive
Last-Modified
Fri, 01 Jan 2016 00:00:00 GMT
Age
5725053
X-Powered-From
gantry
X-Powered-By
BC
X-Cache
Hit from cloudfront
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000
X-Amz-Cf-Pop
FRA56-C2
Content-Length
3870
X-Amz-Cf-Id
zsHiVF5KM5_07e38ozHGrfIB2QLmNqswytxFjuygMmmmQQXxoLxrCA==
Expires
Wed, 09 Feb 2022 05:02:01 GMT
image.jpg
cf-images.us-east-1.prod.boltdns.net/v1/jit/1568176135/1d764395-3566-4875-8962-a175d38af9e5/main/160x90/2m58s368ms/match/
3 KB
3 KB
Image
General
Full URL
https://cf-images.us-east-1.prod.boltdns.net/v1/jit/1568176135/1d764395-3566-4875-8962-a175d38af9e5/main/160x90/2m58s368ms/match/image.jpg
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.32.29.48 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-29-48.fra56.r.cloudfront.net
Software
/ BC
Resource Hash
8f72f694a588624339c24dd31a3b462da46175b36e0006200f084e32a0f660f4

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Sat, 30 Jan 2021 06:00:05 GMT
Via
1.1 93b0598b43d63761f1a129690721f888.cloudfront.net (CloudFront)
Connection
keep-alive
Last-Modified
Fri, 01 Jan 2016 00:00:00 GMT
Age
6585569
X-Powered-From
gantry
X-Powered-By
BC
X-Cache
Hit from cloudfront
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000
X-Amz-Cf-Pop
FRA56-C2
Content-Length
2952
X-Amz-Cf-Id
k2BuZV5_Bxl-zj2_FDNMUISWMqcJTn3kY0hx7fBmEkkn19KqW8pY8g==
Expires
Sun, 30 Jan 2022 06:00:05 GMT
image.jpg
cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/96082f18-026e-44fb-abf1-f81e163dc2f2/cb35f38f-1826-419f-a5e0-7e1971f4c1c6/160x90/match/
4 KB
4 KB
Image
General
Full URL
https://cf-images.us-east-1.prod.boltdns.net/v1/static/1568176135/96082f18-026e-44fb-abf1-f81e163dc2f2/cb35f38f-1826-419f-a5e0-7e1971f4c1c6/160x90/match/image.jpg
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
13.32.29.48 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-32-29-48.fra56.r.cloudfront.net
Software
/ BC
Resource Hash
71c805ad1e5135a1d4dd9fccaa913bbdaf94cc3608d9619e5b546c1b865a2c16

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Mon, 08 Feb 2021 00:55:49 GMT
Via
1.1 fdc45b521af7652438141328494a79d3.cloudfront.net (CloudFront)
Connection
keep-alive
Last-Modified
Fri, 01 Jan 2016 00:00:00 GMT
Age
5826225
X-Powered-From
gantry
X-Powered-By
BC
Transfer-Encoding
chunked
X-Cache
Hit from cloudfront
Content-Type
image/jpeg
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=31536000
X-Amz-Cf-Pop
FRA56-C2
X-Amz-Cf-Id
Eh-Te7I46xXqvXETQI9XdLTPb2CVsnMFqSv7vsFuZ1A8pD6dkM5HUw==
Expires
Tue, 08 Feb 2022 00:55:49 GMT
video-arrow_right_on.gif
img.deusm.com/darkreading/
2 KB
3 KB
Image
General
Full URL
https://img.deusm.com/darkreading/video-arrow_right_on.gif
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c7d1ee4f5a608fa05b8f9c6cbd47e3eab7516facc3380d704b7332805877afff

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
4393
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
2551
cf-request-id
097c016ce90000177682826000000001
last-modified
Fri, 14 Mar 2014 15:55:19 GMT
server
cloudflare
etag
"9f7-4f49318b927c0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=TazzdsI4WVd4W0u8e3i2qiNI6uAe4LWED0S3L%2FXisGEgv0lyG7ekEQYOCtyAktJE8di0elRXrJ1jbqsEZWKeQuVM2MRI9dnl8JGwwLlJSGDpJ%2Bg5z%2F2GP75%2F"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
accept-ranges
bytes
cf-ray
640d04f49e071776-FRA
400x300_DR_March2021toonwinner.jpg
img.deusm.com/darkreading/Edge/
56 KB
56 KB
Image
General
Full URL
https://img.deusm.com/darkreading/Edge/400x300_DR_March2021toonwinner.jpg
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4924a3b04216167215691f19cc588aec1b1ffb15f87815a8f9696a6461c6d9d7

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
2576
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
56880
cf-request-id
097c016cea00001776cbaf4000000001
last-modified
Tue, 06 Apr 2021 13:52:29 GMT
server
cloudflare
etag
"de30-5bf4e20036140"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=0I%2F3BnRRAZyl6%2FtYj1z0JWdd9RUmNlchZZw57btQcSse%2B0RasQvxTsMt3phGJU4F6NVI1yVZT5w8%2BvGcK1eTtYUWC36iInyS%2B0iIu%2FuaAK0WH8MajwFvEpnQ"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
accept-ranges
bytes
cf-ray
640d04f49e081776-FRA
DR-2021-trends-report-314.jpg
dsimg.ubm-us.net/asset/422633/668723/
36 KB
37 KB
Image
General
Full URL
https://dsimg.ubm-us.net/asset/422633/668723/DR-2021-trends-report-314.jpg
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3033::6815:420c , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0c2fdd2c372bbc50cb9591f8b7284b1bb65cd1d545f5ec8e165551bbee465233

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:34 GMT
cf-cache-status
REVALIDATED
nel
{"report_to":"cf-nel","max_age":604800}
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
36929
cf-request-id
097c016ce80000dfb70e00f000000001
last-modified
Mon, 16 Nov 2020 19:41:10 GMT
server
cloudflare
etag
"9041-5b43e8f60a19d"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=5js5y9g3mz%2B1w4bc6GjqTfyrkv9mjQ5KtDllxTxoZ%2Bv6dyh5x6S%2BNhhzJMprsdxOunDTsrhwVjxyQNkFBS61maLpgf0mKVwlJKkIZosds5bX23k3N0anF2u%2BwSXm"}],"group":"cf-nel"}
content-type
image/jpeg
cache-control
max-age=14400
accept-ranges
bytes
cf-ray
640d04f4a963dfb7-FRA
survey_jspage.asp
www.darkreading.com/
4 KB
1 KB
Script
General
Full URL
https://www.darkreading.com/survey_jspage.asp?survey_id=167&cbust=90730
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:7963 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / ASP.NET
Resource Hash
4dc2fbda68b407445c314dbe7ec3fd9cf27b8d9418367f5cb17ccc7f90064f51
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains

Request headers

:path
/survey_jspage.asp?survey_id=167&cbust=90730
pragma
no-cache
cookie
__cfduid=dbf20fb28977a6607c62aae8d0f72346c1618571972; darkreading_lastvisit=4/16/2021 7:19:32 AM; cplChannelTagID=; darkreading%2Dmeter=1340685; darkreading%5Fvisits=2; AMCV_77FB1CFE532B22840A490D45%40AdobeOrg=-330454231%7CMCIDTS%7C18734%7CvVersion%7C3.1.2; piddlNGSiteReferer=/; piddlNGPageReferer=/
accept-encoding
gzip, deflate, br
accept-language
en-US
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
sec-fetch-mode
no-cors
accept
*/*
cache-control
no-cache
sec-fetch-dest
script
:authority
www.darkreading.com
referer
https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
:scheme
https
sec-fetch-site
same-origin
:method
GET
Referer
https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:34 GMT
content-encoding
br
vary
Accept-Encoding
cf-cache-status
DYNAMIC
server
cloudflare
x-powered-by
ASP.NET
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security
max-age=63072000; includeSubDomains
content-type
text/html
cache-control
private
set-cookie
darkreading_lastvisit=4/16/2021 7:19:34 AM; expires=Wed, 16-Apr-2036 11:19:34 GMT; path=/; HttpOnly darkreading%5Fvisits=3; expires=Wed, 16-Apr-2036 04:00:00 GMT; path=/
cf-ray
640d04f2d8011f51-FRA
cf-request-id
097c016bc700001f51982b6000000001
Report_SecureApps_315x190.jpg
img.deusm.com/darkreading/Edge/
22 KB
22 KB
Image
General
Full URL
https://img.deusm.com/darkreading/Edge/Report_SecureApps_315x190.jpg
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
537252b7b9ef14f265c3b5d51dc5336ecc4bcdfef5b28e2bba829a856daf369a

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
1635
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
22040
cf-request-id
097c016cea0000177697aa5000000001
last-modified
Wed, 03 Mar 2021 17:08:16 GMT
server
cloudflare
etag
"5618-5bca4e595a000"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=IGbqzJjPMipnO%2BweoNg3TKeF532zeQWakaXhWNHxQxPhBRv78nfVIS3l2RNzTOZRjGDUZFX0SBCpNkKte%2BdQo3yPvUJW9Q1SIv4uUxaP%2BVw6zLltZtBx%2BqE2"}],"group":"cf-nel","max_age":604800}
content-type
image/jpeg
accept-ranges
bytes
cf-ray
640d04f49e0a1776-FRA
DR-bug.png
img.deusm.com/darkreading/
1 KB
2 KB
Image
General
Full URL
https://img.deusm.com/darkreading/DR-bug.png
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f30d5c0433d74c8224a2343a3c6c08468015909c22315b8693f9bdee33f48217

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
2122
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1490
cf-request-id
097c016cea00001776e027f000000001
last-modified
Fri, 21 Feb 2014 14:56:01 GMT
server
cloudflare
etag
"5d2-4f2ebd1fb8240"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=32AVAmzmv1b8TqhNlKbEPAnT3GrTbeKmzRAkkOrdoSYBGuaBslxP3PaHNRwZMnMrp7u6RfqpZtDFetK94ESM4z1jaiRJCODU%2F7quYMcLy5Y3v2uzOUr%2BT8My"}],"group":"cf-nel","max_age":604800}
content-type
image/png
accept-ranges
bytes
cf-ray
640d04f49e0c1776-FRA
Social-FB.png
img.deusm.com/darkreading/
2 KB
3 KB
Image
General
Full URL
https://img.deusm.com/darkreading/Social-FB.png
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fbb475f48d03815474a554d3c16599917c2fabf811e3fe2772aeabeee474aa8f

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
5303
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
2466
cf-request-id
097c016ceb00001776c5aa0000000001
last-modified
Fri, 11 Oct 2019 04:28:57 GMT
server
cloudflare
etag
"9a2-5949af4d49440"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=3RP8U%2BxdpgKEYE5KnwfM9CiQmjCS4knsRMsTmmZT58gg09CWf6ga0Bj6O71Sd%2BwVnqLANw3Qw1nYtZWy2cSYqOZuPOK80qRdG58hPXdM7SFu6O6TuGI1zQiM"}],"group":"cf-nel","max_age":604800}
content-type
image/png
accept-ranges
bytes
cf-ray
640d04f49e0d1776-FRA
Social-Twitter.png
img.deusm.com/darkreading/
3 KB
3 KB
Image
General
Full URL
https://img.deusm.com/darkreading/Social-Twitter.png
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0f762bf1a58c917c1ad50006bfcd192ab55b2d01a857b7c08b6c40e3af878695

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
5303
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
2604
cf-request-id
097c016ceb00001776ad2e0000000001
last-modified
Fri, 11 Oct 2019 12:05:31 GMT
server
cloudflare
etag
"a2c-594a155a3d8c0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=7xbi%2FcTtZ%2FnKqAMpo%2FhVpxu3Efdp%2Bq4N4wjJFkphWFncGbYWBd1egCVUvq5p3mXFu6QUUTAKkkOd9bwGkM%2FR%2FyYHqPVcpG0keeGmL%2BolKNnuus1yHHFk4uDX"}],"group":"cf-nel","max_age":604800}
content-type
image/png
accept-ranges
bytes
cf-ray
640d04f49e101776-FRA
Social-LI.png
img.deusm.com/darkreading/
3 KB
3 KB
Image
General
Full URL
https://img.deusm.com/darkreading/Social-LI.png
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4bbed2de83df27dc8130644101bce3dd9ddd1c178815e42bcb49118b4a73593c

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
5303
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
2571
cf-request-id
097c016ceb00001776db28e000000001
last-modified
Fri, 11 Oct 2019 12:05:08 GMT
server
cloudflare
etag
"a0b-594a15444e500"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=6oVxNI9VJ%2Bap7qUvyDu1RSTtlQcZ6bTZ%2BYEUkyjvnckV2hcfz5%2FM8VCME9bAX4b%2BEfVW%2BXMUoJ4y22nDFAhoOX9qKNyY8lj9fo%2BUaIkm0JFkuAUdXjo7s5JE"}],"group":"cf-nel","max_age":604800}
content-type
image/png
accept-ranges
bytes
cf-ray
640d04f49e111776-FRA
Social-Flip.png
img.deusm.com/darkreading/
825 B
1 KB
Image
General
Full URL
https://img.deusm.com/darkreading/Social-Flip.png
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
973ccce3f58b175a9e021c76978726083cc7e5cbed75cd0ff09ff83919934d15

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
2122
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
825
cf-request-id
097c016cec000017769a27b000000001
last-modified
Wed, 16 Oct 2019 04:56:12 GMT
server
cloudflare
etag
"339-594ffeb7d9300"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=i1vB5rWdqVkHR0w0F02%2BYkPNm5bReLz9C0Vag1QRXtiKmFEYixM9wkgAGyB%2B0ZlQnMK2UoUKdpTEX1i%2FF7rKSEmlFXWODFaJzudi0SlFkIu9UhAYW3VePHEu"}],"group":"cf-nel","max_age":604800}
content-type
image/png
accept-ranges
bytes
cf-ray
640d04f49e131776-FRA
Social-RSS.png
img.deusm.com/darkreading/
3 KB
3 KB
Image
General
Full URL
https://img.deusm.com/darkreading/Social-RSS.png
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a0761aa1289035f3d20430d55e475043a8fa40deff221715e31068905d561753

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
5303
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
2675
cf-request-id
097c016cec00001776f69b9000000001
last-modified
Fri, 11 Oct 2019 12:05:19 GMT
server
cloudflare
etag
"a73-594a154ecbdc0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=yZUy1z%2FxfCE02D5Bzfi%2FtUKmjwREw%2B3wiPZHpNEcZRrYBXUKZ6kMpfZJVxn%2FjI1b4GXflYIYTPey3DbU9Kvz4mA9qKKvfa3E6DWibSxHPo3pd1bZ1Xl3wgGs"}],"group":"cf-nel","max_age":604800}
content-type
image/png
accept-ranges
bytes
cf-ray
640d04f49e151776-FRA
Whitelogo.png
twimgs.com/nojitter/img/
7 KB
8 KB
Image
General
Full URL
https://twimgs.com/nojitter/img/Whitelogo.png
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3033::6815:2f49 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a8041ba3d02102bd99dcead4dcc9882c484902362927cfd598e389e930f68ceb

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
2582
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
7304
cf-request-id
097c016cd90000dfbb5107f000000001
last-modified
Thu, 09 Jan 2020 05:04:54 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=gkpBGRrw3Ih9HGh7pwB5iRfRoClyNd1dbgdL%2FJZ9mMbLj%2Ffm1BmhxAwDi7phYqaUDBoFgoJV3oU2sTpRMV%2FZlyzlH6rgbVwb%2FnKHd07Cbn9sFSJ%2BEyOJ"}],"group":"cf-nel","max_age":604800}
content-type
image/png
cache-control
public, max-age=86400
accept-ranges
bytes
cf-ray
640d04f48d3cdfbb-FRA
ubm-tech-global-app-measurement.js
twimgs.com/custom/library.gtecevent.com/assets/
55 KB
20 KB
Script
General
Full URL
https://twimgs.com/custom/library.gtecevent.com/assets/ubm-tech-global-app-measurement.js?ormzkk
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3033::6815:2f49 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
37a0bbeac143b190eb553c9e8ebf42b7f85b1acba06883855eda085fdf155c4b

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 16 Jan 2020 23:35:21 GMT
server
cloudflare
age
5601
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=myc%2Fp22X08rwmkrs0BzxAadPtYp%2BiPyP8WrTJ8RTgx%2B6lfA5HYl%2BSR0d%2FfEkA5VTbr6LHlfyCWx2UcJpynosVg1Sglw04DGon2yc4zr40E3IJ530A%2Fwe"}]}
content-type
application/javascript
cache-control
public, max-age=86400
nel
{"max_age":604800,"report_to":"cf-nel"}
cf-ray
640d04f44a001756-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
cf-request-id
097c016cb0000017568998b000000001
spacer.gif
img.deusm.com/images/
Redirect Chain
  • https://www.darkreading.com/client_pathlog.asp?p=%2Fdarkreading%2Fsection%2F314&f=%2Fdarkreading%2Fsection%2F314%2F1340685&rndserial=26372
  • https://img.deusm.com/images/spacer.gif
49 B
702 B
Image
General
Full URL
https://img.deusm.com/images/spacer.gif
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3c5b83e390d046c3623c4b8e35b58aaf64a7481bb2372fb51ae2e0e7818f7407

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:34 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
5304
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
49
cf-request-id
097c01700f00001776ee0d7000000001
last-modified
Fri, 13 Oct 2000 01:54:07 GMT
server
cloudflare
etag
"31-3737c29f20dc0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=%2Fm9NVagq3PqxUyrUSYrzcsRgP18jjFzJnBFt9%2FfbZsTMndULbjQmfFci3ttZ5UAe7pI5rLBgnetDQTWIrMLdMbCC32qWRZX0n2Ml8Sb4%2FSrNtuh21VEEZvhU"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
accept-ranges
bytes
cf-ray
640d04f9be091776-FRA

Redirect headers

date
Fri, 16 Apr 2021 11:19:34 GMT
cf-cache-status
DYNAMIC
server
cloudflare
x-powered-by
ASP.NET
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/html
location
https://img.deusm.com/images/spacer.gif
set-cookie
darkreading_lastvisit=4/16/2021 7:19:34 AM; expires=Wed, 16-Apr-2036 11:19:34 GMT; path=/; HttpOnly darkreading%5Fvisits=3; expires=Wed, 16-Apr-2036 04:00:00 GMT; path=/
cache-control
private
strict-transport-security
max-age=63072000; includeSubDomains
cf-ray
640d04f49a971f51-FRA
cf-request-id
097c016cdd00001f51a30ae000000001
lightreading_rating_dot_10x7.gif
img.deusm.com/lightreading/
49 B
704 B
Image
General
Full URL
https://img.deusm.com/lightreading/lightreading_rating_dot_10x7.gif
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3c5b83e390d046c3623c4b8e35b58aaf64a7481bb2372fb51ae2e0e7818f7407

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
2122
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
49
cf-request-id
097c016cec00001776e5b10000000001
last-modified
Wed, 25 Sep 2013 21:21:36 GMT
server
cloudflare
etag
"31-4e73bd694b800"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=HvGmbJCurtN9FbTVy6Lze%2FU%2BCZk2eDtz8LlwYgbYRH9nMJI8fgYPp3SDlrRXslkCi%2Fqs%2BpdaUCc4O2PzVSciPnC2iQnlntRoWLB9uL%2BoVizmj55gmeHM9bjr"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
accept-ranges
bytes
cf-ray
640d04f49e181776-FRA
twitter_intevol_18x18.gif
img.deusm.com/darkreading/
619 B
1 KB
Image
General
Full URL
https://img.deusm.com/darkreading/twitter_intevol_18x18.gif
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ebe3a0272a317857bf566a0deec42181bf0e89d280bb3143bba14da1ae1ddb10

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
4393
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
619
cf-request-id
097c016ced00001776ebb02000000001
last-modified
Fri, 09 Feb 2018 10:56:35 GMT
server
cloudflare
etag
"26b-564c561c21ec0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=1M5MJ1zCBLTjkj9Ty6Cy%2F7ZyyLZDuZH0SfkQLBkTId9X5Tym4NFjGhS3Hvav7PANCXU7yeQdQduNNtQCyDLdzYSoGYVYN5yyHiB1Nh3aFAfiZkcvCb1lbd18"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
accept-ranges
bytes
cf-ray
640d04f49e1a1776-FRA
id
dpm.demdex.net/
362 B
1 KB
XHR
General
Full URL
https://dpm.demdex.net/id?d_visid_ver=3.1.2&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=77FB1CFE532B22840A490D45%40AdobeOrg&d_nsid=0&ts=1618571973455
Requested by
Host: twimgs.com
URL: https://twimgs.com/custom/library.gtecevent.com/assets/VisitorAPI.js?ormzkk
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.251.60.147 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-251-60-147.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
cdeeae0f4627d59f432c7ceefdf9e8884bf4297ac998d128faaf38720987e041
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

DCS
dcs-prod-irl1-v090-0dce7327f.edge-irl1.demdex.com 5.80.7.20210304103356 2ms (+0ms)
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
Content-Encoding
gzip
X-TID
XuOPFOV1RY4=
Vary
Origin, Accept-Encoding, User-Agent
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://www.darkreading.com
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json;charset=utf-8
Content-Length
300
Expires
Thu, 01 Jan 1970 00:00:00 GMT
api.js
www.google.com/recaptcha/
905 B
996 B
Script
General
Full URL
https://www.google.com/recaptcha/api.js?onload=rcCallback&render=explicit
Requested by
Host: dsimg.ubm-us.net
URL: https://dsimg.ubm-us.net/ubm-widget/js/ubm-widget-min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
GSE /
Resource Hash
13b99be3a0bde88b082b4a2b333cf0686012456b5bcc07f6a1a9ec8ef431d884
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self'
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
GSE
x-frame-options
SAMEORIGIN
content-type
text/javascript; charset=UTF-8
cache-control
private, max-age=300
cross-origin-resource-policy
cross-origin
content-security-policy
frame-ancestors 'self'
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
579
x-xss-protection
1; mode=block
expires
Fri, 16 Apr 2021 11:19:33 GMT
gpt.js
www.googletagservices.com/tag/js/
63 KB
21 KB
Script
General
Full URL
https://www.googletagservices.com/tag/js/gpt.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6ad2b7a09587300eec580303a45f75396d489cf9d2e005fe832946b41f3cbe1b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"844 / 558 of 1000 / last-modified: 1618571343"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=900, stale-while-revalidate=3600
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
21121
x-xss-protection
0
expires
Fri, 16 Apr 2021 11:19:33 GMT
bundle.js
assets.ubembed.com/universalscript/releases/v0.179.0/
162 KB
46 KB
Script
General
Full URL
https://assets.ubembed.com/universalscript/releases/v0.179.0/bundle.js
Requested by
Host: 6600d6d98e534115970f9529a45f3195.js.ubembed.com
URL: https://6600d6d98e534115970f9529a45f3195.js.ubembed.com/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.156.23 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-156-23.txl52.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
aef23deda339b41ec1128bd29fb926bd6b5317b06583cfe713da67ae9db605ba

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 03:34:38 GMT
content-encoding
gzip
last-modified
Wed, 16 Dec 2020 18:50:36 GMT
server
AmazonS3
age
6162296
etag
W/"5989757bd8ad29a05f48a0b643993aae"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript
via
1.1 a57d5819527c444e16b1875e3bd28970.cloudfront.net (CloudFront)
cache-control
max-age=31536000
x-amz-cf-pop
TXL52-C1
x-amz-cf-id
KdS0nQUO7VoTELoVbhL4MChk-8LbeEA0HF3doYbeMy67Plgk8DeWLw==
pubads_impl_2021041401.js
securepubads.g.doubleclick.net/gpt/
298 KB
105 KB
Script
General
Full URL
https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041401.js?31060835
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/tag/js/gpt.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s46-in-f2.1e100.net
Software
sffe /
Resource Hash
80d0a278e7a208ae2bd234aafcbdece69e63c9bf11e800d0ab5fa3c82176cf2c
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Intervention
<https://www.chromestatus.com/feature/5718547946799104>; level="warning"

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 14 Apr 2021 08:43:31 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, immutable, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
107268
x-xss-protection
0
expires
Fri, 16 Apr 2021 11:19:33 GMT
id
ubmtech.d3.sc.omtrdc.net/
2 B
321 B
XHR
General
Full URL
https://ubmtech.d3.sc.omtrdc.net/id?d_visid_ver=3.1.2&d_fieldgroup=A&mcorgid=77FB1CFE532B22840A490D45%40AdobeOrg&mid=11702117739400692811827650329921770618&ts=1618571973733
Requested by
Host: twimgs.com
URL: https://twimgs.com/custom/library.gtecevent.com/assets/VisitorAPI.js?ormzkk
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.181.18.61 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-181-18-61.eu-west-3.compute.amazonaws.com
Software
jag /
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
x-content-type-options
nosniff
server
jag
xserver
anedge-5db677d464-hv6qv
vary
Origin
x-c
main-1455.Icbb9a9.M0-487
p3p
CP="This is not a P3P policy"
access-control-allow-origin
https://www.darkreading.com
cache-control
no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials
true
content-type
application/x-javascript;charset=utf-8
content-length
2
x-xss-protection
1; mode=block
demconf.jpg
dpm.demdex.net/
Redirect Chain
  • https://cm.everesttech.net/cm/dd?d_uuid=22198549742701970741706566790470167177
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=YHlyxgAAAMj0yhHl
  • https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=YHlyxgAAAMj0yhHl
42 B
915 B
Image
General
Full URL
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=YHlyxgAAAMj0yhHl
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.251.60.147 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-34-251-60-147.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

DCS
dcs-prod-irl1-v090-014b431e2.edge-irl1.demdex.com 5.80.7.20210304103356 0ms (+1ms)
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-Content-Type-Options
nosniff
X-TID
G+V8sbB1R1E=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
42
Expires
Thu, 01 Jan 1970 00:00:00 GMT

Redirect headers

Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-TID
RD7Gy+KWSn8=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=411&dpuuid=YHlyxgAAAMj0yhHl
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 GMT
beacon.js
sb.scorecardresearch.com/
1 KB
2 KB
Script
General
Full URL
https://sb.scorecardresearch.com/beacon.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.156.73 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-156-73.txl52.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 10:50:47 GMT
via
1.1 960b0b60c4f1507c51c75d8f9ab0dc91.cloudfront.net (CloudFront)
etag
"1827f116c73f319409b97f10b8a58ade"
last-modified
Fri, 26 Feb 2021 14:35:05 GMT
server
AmazonS3
age
1727
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
content-type
application/javascript
x-amz-cf-pop
TXL52-C1
accept-ranges
bytes
content-length
1469
x-amz-cf-id
m9OWWuPStFWVPezUmgbwBNCcPf8kEsT9i6G8-TCeootqzpC2OrJCnw==
fbevents.js
connect.facebook.net/en_US/
92 KB
24 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
9ddca568ff519cd935a816baec6f7bfce459656ec5022ec2ba6a6225891022eb
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
0
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
23960
x-fb-rlafr
0
pragma
public
x-fb-debug
5ja4aqLqztda3xlFTJaurDiDSklvmCrpDnBvzoPravh8pBTFzdMiWL3XlSWhEXRWKyx5wHmr/XZvYXx9KtRFHw==
x-fb-trip-id
917726464
x-frame-options
DENY
date
Fri, 16 Apr 2021 11:19:34 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
expires
Sat, 01 Jan 2000 00:00:00 GMT
background-pattern.png
img.deusm.com/darkreading/
493 B
1 KB
Image
General
Full URL
https://img.deusm.com/darkreading/background-pattern.png
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/styles/pano-framework.css?v1.27
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
98fb88ec226feae902fb7f98528a41db7abd7de155a6d7b65658c6ab7f2b95f4

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
4398
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
493
cf-request-id
097c016cee000017768a016000000001
last-modified
Fri, 21 Feb 2014 14:56:01 GMT
server
cloudflare
etag
"1ed-4f2ebd1fb8240"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=TqduNJLMHBweefIaxsmzqi2WXZG0oWbLifD1makSMfCMwWy70kuGSIkxaUVLXTap%2B9C9579KWSuVssn4VW34sZzObXNbpKbFHSiBaFNE8oxcdNhm5702PKK3"}],"group":"cf-nel","max_age":604800}
content-type
image/png
accept-ranges
bytes
cf-ray
640d04f49e1c1776-FRA
iribbon-logo.gif
twimgs.com/nojitter/gama/
2 KB
3 KB
Image
General
Full URL
https://twimgs.com/nojitter/gama/iribbon-logo.gif
Requested by
Host: img.deusm.com
URL: https://img.deusm.com/darkreading/informa-iribbon.css
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3033::6815:2f49 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f3bd482cd3ec17583f25ad0819d1ccbcd0cdcb0fe26f8d87b7f30fd61b3dc640

Request headers

Referer
https://img.deusm.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
36140
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1931
cf-request-id
097c016cda0000dfbb9335c000000001
last-modified
Fri, 19 Apr 2019 06:59:19 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=SYHC58FimXK3qMUgffZAuWB88VRw11UnjkOh3%2Big%2BrQgN4C9o4JpwIEzmMc8RT0BmEEy4fmeR1E861IOWSMzQYzpveF2rJNGyeVN1BwsWPn4O%2Bmp4vyn"}],"group":"cf-nel","max_age":604800}
content-type
image/gif
cache-control
public, max-age=86400
accept-ranges
bytes
cf-ray
640d04f48d40dfbb-FRA
integrator.js
adservice.google.de/adsid/
107 B
799 B
Script
General
Full URL
https://adservice.google.de/adsid/integrator.js?domain=www.darkreading.com
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041401.js?31060835
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 16 Apr 2021 11:19:33 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
integrator.js
adservice.google.com/adsid/
107 B
553 B
Script
General
Full URL
https://adservice.google.com/adsid/integrator.js?domain=www.darkreading.com
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041401.js?31060835
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 16 Apr 2021 11:19:33 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
CP="This is not a P3P policy! See http://support.google.com/accounts/answer/151657 for more info."
cache-control
private, no-cache, no-store
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/javascript; charset=UTF-8
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
100
x-xss-protection
0
ads
securepubads.g.doubleclick.net/gampad/
98 KB
20 KB
XHR
General
Full URL
https://securepubads.g.doubleclick.net/gampad/ads?gdfp_req=1&pvsid=1273043803101932&correlator=2133483545179846&output=ldjh&impl=fifs&eid=31060835%2C31060505%2C31060830&vrg=2021041401&ptt=17&sc=1&sfv=1-0-38&ecs=20210416&iu_parts=3834%2Cdarkreading.home%2Cnetwork_perimeter_security&enc_prev_ius=%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2%2C%2F0%2F1%2F2&prev_iu_szs=2x2%2C5x5%2C300x250%7C336x280%7C300x600%7C336x850%2C6x6%2C1x2%2C728x90%7C970x250%2C336x27%2C300x250%7C336x280%7C300x600%7C336x850%2C300x60%2C3x3%2C4x4%2C8x2%2C8x4&prev_scp=pos%3Dwelcome%26testAd%3D%7Cpos%3DTAPunit%26testAd%3D%7Cpos%3Drec1%26testAd%3D%7Cpos%3Dpromo%26testAd%3D%7Cpos%3Dwallpaper%26testAd%3D%7Cpos%3Dtop%26testAd%3D%7Cpos%3Dlogo%26testAd%3D%7Cpos%3Drec2%26testAd%3D%7Cpos%3Deventpromo%26testAd%3D%7Cpos%3Dribbon%26testAd%3D%7Cpos%3Dvideo%26testAd%3D%7Cpos%3Dnative%26testAd%3D%7Cpos%3Dinsight%26testAd%3D&cust_params=kw%3DAdvanced_Threats%252CApplications%252CAttacks%252CAttacks-Breaches%252CAuthentication%252CBreaches%252CCybersecurity%252CEndpoint_Security%252CGovernment%252CInformationWeek_Home%252CPerimeter%252CThreat_Intelligence%252CThreat_Intelligence%252CVulnerabilities_%2526_Threats%252CVulnerability_Management%26aid%3D1340685&cookie_enabled=1&bc=31&abxe=1&lmt=1618571973&dt=1618571973860&dlt=1618571972829&idt=983&frm=20&biw=1600&bih=1200&oid=3&adxs=0%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9&adys=35%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9%2C-9&adks=4268708346%2C1790365175%2C1197776952%2C1310211773%2C3539319411%2C1422973645%2C307491113%2C1197776955%2C3160407299%2C3390971514%2C782595692%2C2168034080%2C2586363263&ucis=1%7C2%7C3%7C4%7C5%7C6%7C7%7C8%7C9%7Ca%7Cb%7Cc%7Cd&ifi=1&u_tz=120&u_his=2&u_java=false&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_sd=1&flash=0&url=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&vis=1&dmc=8&scr_x=0&scr_y=0&psz=1600x1200%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1&msz=1600x2%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1%7C0x-1&ga_vid=1190363706.1618571974&ga_sid=1618571974&ga_hid=890355587&ga_fc=false&fws=0%2C2%2C2%2C2%2C2%2C2%2C2%2C2%2C2%2C2%2C2%2C2%2C2&ohw=0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0%2C0&uach=WyIiLCIiLCIiLCIiLCIiLFtdXQ..
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041401.js?31060835
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
172.217.16.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s46-in-f2.1e100.net
Software
cafe /
Resource Hash
b0433e6503844566fe790bfb9bfe5d88950c4446b9fa3a6565b25d1601a9332b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:34 GMT
content-encoding
br
x-content-type-options
nosniff
google-mediationgroup-id
-2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2,-2
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19956
x-xss-protection
0
google-lineitem-id
-2,5656213172,5656213172,-2,5656213172,5657449612,-2,5656631199,-2,-2,5653127970,5658199367,-2
pragma
no-cache
server
cafe
google-mediationtag-id
-2
google-creative-id
-2,138344901188,138344902208,-2,138345349102,138345261839,-2,138345615798,-2,-2,138345413495,138345856094,-2
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.darkreading.com
cache-control
no-cache, must-revalidate
access-control-allow-credentials
true
timing-allow-origin
*
expires
Fri, 01 Jan 1990 00:00:00 GMT
container.html
1c7c84c37158a202918275ae6d434610.safeframe.googlesyndication.com/safeframe/1-0-38/html/
0
0
Other
General
Full URL
https://1c7c84c37158a202918275ae6d434610.safeframe.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041401.js?31060835
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

container.html
tpc.googlesyndication.com/safeframe/1-0-38/html/
0
0
Other
General
Full URL
https://tpc.googlesyndication.com/safeframe/1-0-38/html/container.html
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041401.js?31060835
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

/
googleads.g.doubleclick.net/pagead/viewthroughconversion/1007530244/
3 KB
2 KB
Script
General
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1007530244/?random=1618571973873&cv=9&fst=1618571973873&num=1&guid=ON&resp=GooglemKTybQhCsO&eid=2505059650&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&ig=1&frm=0&url=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&tiba=Malicious%20PowerShell%20Use%2C%20Attacks%20on%20Office%20365%20...&hn=www.googleadservices.com&rfmt=3&fmt=4
Requested by
Host: www.googleadservices.com
URL: https://www.googleadservices.com/pagead/conversion.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:800::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
7a8acfda0b1c779321b8155dadf526cc7ac6c1f8fbb6bc88c4bbb4311fc7860e
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 16 Apr 2021 11:19:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
text/javascript; charset=UTF-8
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1250
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
bat.js
bat.bing.com/
29 KB
9 KB
Script
General
Full URL
https://bat.bing.com/bat.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
1fe2437a79282fb26d2267e40cdb7ac59164d0ee5e5b9f955f05a49f686ab616

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
content-encoding
gzip
last-modified
Fri, 02 Apr 2021 18:16:38 GMT
x-msedge-ref
Ref A: AE03C0C2DAC64A04B7CACDECCEE6178A Ref B: FRAEDGE1209 Ref C: 2021-04-16T11:19:34Z
etag
"0c77652ec27d71:0"
vary
Accept-Encoding
content-type
application/javascript
access-control-allow-origin
*
cache-control
private,max-age=1800
accept-ranges
bytes
content-length
8885
all.js
connect.facebook.net/en_US/
3 KB
2 KB
Script
General
Full URL
https://connect.facebook.net/en_US/all.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
6fc3dfb2b1b6a12424b2f2c1852c0a46cd759209bec21713a39d8d38fcf725e2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-md5
oXxgIP8Xl3rnzMup2wFQCg==
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
1780
x-fb-rlafr
0
x-fb-debug
pWX9vlfrQ4AxKsNEq96D+NLrlRwVxZPEZ+6qD2Uf2m3RWH9ljn/MQhKmMGB6rMDTmoWeTpIWw7md86lf4TZ+YQ==
x-fb-content-md5
ef83bc0d375c85ab65ff24ffb8d15894
x-frame-options
DENY
date
Fri, 16 Apr 2021 11:19:34 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-FB-Content-MD5
cache-control
public,max-age=1200,stale-while-revalidate=3600
etag
"e9cfcb7462b1208218bc4f846ccd5de2"
timing-allow-origin
*
priority
u=3,i
expires
Fri, 16 Apr 2021 11:24:51 GMT
Cookie set dest5.html
ubm.demdex.net/ Frame BF5B
7 KB
3 KB
Document
General
Full URL
https://ubm.demdex.net/dest5.html?d_nsid=0
Requested by
Host: twimgs.com
URL: https://twimgs.com/custom/library.gtecevent.com/assets/VisitorAPI.js?ormzkk
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.30.135.179 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Host
ubm.demdex.net
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.darkreading.com/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Cookie
demdex=22198549742701970741706566790470167177
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://www.darkreading.com/

Response headers

Accept-Ranges
bytes
Cache-Control
max-age=21600
Content-Encoding
gzip
Content-Type
text/html
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Last-Modified
Wed, 10 Mar 2021 16:01:35 GMT
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma
no-cache
Set-Cookie
demdex=22198549742701970741706566790470167177;Path=/;Domain=.demdex.net;Expires=Wed, 13-Oct-2021 11:19:34 GMT;Max-Age=15552000;Secure;SameSite=None
Strict-Transport-Security
max-age=31536000; includeSubDomains
Vary
Accept-Encoding, User-Agent
X-TID
sHy1AjhOS0U=
Content-Length
2785
Connection
keep-alive
recaptcha__en.js
www.gstatic.com/recaptcha/releases/mrdLhN7MywkJAAbzddTIjTaM/
334 KB
130 KB
Script
General
Full URL
https://www.gstatic.com/recaptcha/releases/mrdLhN7MywkJAAbzddTIjTaM/recaptcha__en.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?onload=rcCallback&render=explicit
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
030235ab6fc1739381df015b815a93e2ed3921f09832954dbacde9991708e27a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.darkreading.com
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 10:35:50 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
2624
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
133125
x-xss-protection
0
last-modified
Mon, 12 Apr 2021 21:07:37 GMT
server
sffe
vary
Accept-Encoding
content-type
text/javascript
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
expires
Sat, 16 Apr 2022 10:35:50 GMT
rss-icon.png
img.deusm.com/darkreading/
2 KB
2 KB
Image
General
Full URL
https://img.deusm.com/darkreading/rss-icon.png
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7bb0d75d42e3ccf1a9d1a055bcddfbc23003ed3ab75bb0eb49c05ba747bce8c9

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
782
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1609
cf-request-id
097c016d5300001776f92e3000000001
last-modified
Mon, 24 Feb 2014 16:00:47 GMT
server
cloudflare
etag
"649-4f329132149c0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=ZU%2F3WhFEngZ2FyVD75AD8UKKawgf6rtwpm1WOa7ISEItAEAbuFuszVzh4IrWsGylhZgNqyiukp3VDAQaKRMw7hgYFYPhe22Ks7EVICp9MytTkzf4bLJcAvP8"}],"group":"cf-nel","max_age":604800}
content-type
image/png
accept-ranges
bytes
cf-ray
640d04f55f1c1776-FRA
tw-icon.png
img.deusm.com/darkreading/
1 KB
2 KB
Image
General
Full URL
https://img.deusm.com/darkreading/tw-icon.png
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
48d211ee8f54e0f314ee98a2b63e6e470b33fb1de29d326c742be16125bda71a

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
782
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1390
cf-request-id
097c016d53000017768185f000000001
last-modified
Mon, 24 Feb 2014 16:00:47 GMT
server
cloudflare
etag
"56e-4f329132149c0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=hhwy0WD%2BCS90ryHkoB3ElS4fdSfHzb95FRJR0ASu5dZ%2BlMB0JBcRTMfCFhNaA%2Fo3dl2bfp1NmXX2s2DFofAnxB3U6i3YPgPun2AACF1b0DPVWcoB4K0bmSvO"}],"group":"cf-nel","max_age":604800}
content-type
image/png
accept-ranges
bytes
cf-ray
640d04f55f1d1776-FRA
flipboard-icon.png
img.deusm.com/darkreading/
425 B
1 KB
Image
General
Full URL
https://img.deusm.com/darkreading/flipboard-icon.png
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
22c53eeed2c33c21657590793b89fed83648ee555686c0e9ff90b39c1dab406f

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
782
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
425
cf-request-id
097c016d5300001776db294000000001
last-modified
Fri, 30 Nov 2018 12:31:36 GMT
server
cloudflare
etag
"1a9-57be0fae8ba00"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=p4ZBrpT0HQSstfSP2AxObs4lEWGPxiiQGHHIWPg7aXv%2BSeG4CkeISsVTxQcqYisAB%2Fu4z%2FJHZNWKgJvRCaSrU8FkVcDe5GTR3AvAj4Sog6s6UtDJVzLLxo%2B3"}],"group":"cf-nel","max_age":604800}
content-type
image/png
accept-ranges
bytes
cf-ray
640d04f55f1f1776-FRA
facebook-icon.png
img.deusm.com/darkreading/
1 KB
2 KB
Image
General
Full URL
https://img.deusm.com/darkreading/facebook-icon.png
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4e19e8f9902a8b9ec4840aaf54110d6f502c5fb500303dc605f8776c40f7fb67

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
782
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1193
cf-request-id
097c016d53000017768c84a000000001
last-modified
Mon, 24 Feb 2014 16:00:47 GMT
server
cloudflare
etag
"4a9-4f329132149c0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=XCKhpQDt4prlroftBzfpDXn%2Bjffx9ApCE1yYgKS4t2BgpzBZc7xl5sBtThU5ZY0Rom2gnBXT3WC1X857dDMhIjekc81ezZWdANJ9xkTbPagA5Lzmal80Wev%2F"}],"group":"cf-nel","max_age":604800}
content-type
image/png
accept-ranges
bytes
cf-ray
640d04f55f201776-FRA
li-icon.png
img.deusm.com/darkreading/
1 KB
2 KB
Image
General
Full URL
https://img.deusm.com/darkreading/li-icon.png
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
976aabc512994a6ecc5981a85c489d1bb242ba6734b746a964d69db615f72875

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:33 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
782
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1355
cf-request-id
097c016d54000017768a01b000000001
last-modified
Mon, 24 Feb 2014 16:00:47 GMT
server
cloudflare
etag
"54b-4f329132149c0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=MsYoIg6zE2q%2F8SVtFAMG5tD%2BPKFMbpsRYk57xBQKgNdYxTTAjI%2Bgo2yU9JOOZ5btkgzPRk4kqC0tJPZfZ4JX%2B44IqpsVA8RdAxpcfsSFdipHdbGRvR7hj8e%2B"}],"group":"cf-nel","max_age":604800}
content-type
image/png
accept-ranges
bytes
cf-ray
640d04f55f211776-FRA
reb-border.png
img.deusm.com/darkreading/
331 B
991 B
Image
General
Full URL
https://img.deusm.com/darkreading/reb-border.png
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
523296d1a2c9a67ee707b5e0bc582f488e5786ec9b343c7b3da58a0d162d643b

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:34 GMT
cf-cache-status
REVALIDATED
last-modified
Thu, 03 Nov 2016 06:29:01 GMT
server
cloudflare
etag
"14b-5405fac56e540"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=6a8AjQyDN9Pkj%2Fk9HkNlXu11ygq4BUMBFXD7A0%2Bk2yulWeGqgkqPzqLGsIXAP4G3bVEahE%2Fxfk6px3DC88d7Q7pMz99abIOX7LY0hRA4UHQ0H8FggGHy0jXa"}],"group":"cf-nel","max_age":604800}
content-type
image/png
nel
{"max_age":604800,"report_to":"cf-nel"}
accept-ranges
bytes
cf-ray
640d04f55f221776-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
331
cf-request-id
097c016d5400001776a4943000000001
nav-background.png
img.deusm.com/darkreading/
3 KB
3 KB
Image
General
Full URL
https://img.deusm.com/darkreading/nav-background.png
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/styles/pano-framework.css?v1.27
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a6595372db2688a9dfb0991bc6cea16343042dd3caa33483b393d21a77d1c4be

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:34 GMT
cf-cache-status
REVALIDATED
last-modified
Sat, 22 Feb 2014 17:43:38 GMT
server
cloudflare
etag
"af8-4f30247448680"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=NhBoPC0BAO59S16M96cxDN%2FhwhPh4tJaESw942XdTJTrpIvrScmChVVpIVMgtjiBxL%2FKU9jWmlJF7zxvt6hzhKrCbRQYuyxcUl9J2LB9wuvRMngpiXDLz7OT"}],"group":"cf-nel","max_age":604800}
content-type
image/png
nel
{"max_age":604800,"report_to":"cf-nel"}
accept-ranges
bytes
cf-ray
640d04f55f241776-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
2808
cf-request-id
097c016d5500001776b12e4000000001
nav-background-edge.png
img.deusm.com/darkreading/
3 KB
3 KB
Image
General
Full URL
https://img.deusm.com/darkreading/nav-background-edge.png
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/styles/pano-framework.css?v1.27
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fd2f3015d1e62a6f24420652afa85f8dbce31636ea8ee86781dc794c243dec68

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:34 GMT
cf-cache-status
REVALIDATED
last-modified
Tue, 11 Jun 2019 06:13:41 GMT
server
cloudflare
etag
"aeb-58b0632bf0f40"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=PyUAd3%2F6rXDVbRAAeCIAoqrrqws5vHZYUh9n2qAhnPdj99vRBqNSFLacEaJx5YVVdct7zWXs5QQOm%2FXHXXtWF8A2XwyURxllK5cyz5pKRllZ4Xz1teaqXKPM"}],"group":"cf-nel","max_age":604800}
content-type
image/png
nel
{"max_age":604800,"report_to":"cf-nel"}
accept-ranges
bytes
cf-ray
640d04f55f261776-FRA
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
2795
cf-request-id
097c016d5500001776cea2a000000001
BngbUXZYTXPIvIBgJJSb6s3BzlRRfKOFbvjoa4Omb2Rj.woff2
fonts.gstatic.com/s/robotoslab/v13/
19 KB
19 KB
Font
General
Full URL
https://fonts.gstatic.com/s/robotoslab/v13/BngbUXZYTXPIvIBgJJSb6s3BzlRRfKOFbvjoa4Omb2Rj.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Roboto+Slab:700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:802::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
41e3b5da84b51e3034e355b7e9ccd5c263667bfed5d8905728d82a341f55e65a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.darkreading.com
Referer
https://fonts.googleapis.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sun, 11 Apr 2021 10:03:38 GMT
x-content-type-options
nosniff
last-modified
Thu, 28 Jan 2021 22:04:01 GMT
server
sffe
age
436555
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19468
x-xss-protection
0
expires
Mon, 11 Apr 2022 10:03:38 GMT
clear.gif
cdn.flipboard.com/dev_O/
43 B
473 B
Image
General
Full URL
https://cdn.flipboard.com/dev_O/clear.gif?utm_source=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:20e8:3600:e:5a70:ca47:86e1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 15 Apr 2021 11:33:46 GMT
via
1.1 700e1fc650af7cfb451dbdb8d79d4107.cloudfront.net (CloudFront)
last-modified
Wed, 23 Dec 2020 17:41:53 GMT
server
AmazonS3
x-amz-meta-s3cmd-attrs
atime:1608745226/ctime:1608745224/gid:20/gname:staff/md5:ad4b0f606e0f8465bc4c4c170b37e1a3/mode:33188/mtime:1608745180/uid:501/uname:greg
age
120286
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3"
x-cache
Hit from cloudfront
content-type
image/gif
x-amz-cf-pop
TXL52-C1
accept-ranges
bytes
content-length
43
x-amz-cf-id
1r-4t2vgs64eVuAWp6UwK7qAmFY4cVn1nLzCX6s3DthvXfWkRxSh2Q==
bullet.png
img.deusm.com/informationweek/
1 KB
2 KB
Image
General
Full URL
https://img.deusm.com/informationweek/bullet.png
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9e0e2ad3a93ec78d016efee0993b5856ba9b4acafcee3aa4d6f7162f039fcce4

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:34 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
1841
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
1054
cf-request-id
097c016dad00001776a03e7000000001
last-modified
Sat, 02 Nov 2013 00:57:26 GMT
server
cloudflare
etag
"41e-4ea272a96e980"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=pkg6aI1A%2BLy3L7C2xxdg%2FNrd1b9YW7x2BySFBQsJPHNOk1DmBHe2nygVYxrTrlOR9YW6IjOAmpWjYp%2FLvMHi8wGHBnI%2Fa7f%2B65hyHBpShTTxJlcPCsEceGhI"}],"group":"cf-nel","max_age":604800}
content-type
image/png
accept-ranges
bytes
cf-ray
640d04f5e8211776-FRA
view
securepubads.g.doubleclick.net/pcs/ Frame F5D2
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuR6acmF-rDfhonQKM6_Cao9whqgIQzagsrby_2H2ZUT61jUnBxjW_yteJSyywCSu7X8i9rlcJKujMwl9AVQ4mAhGZREM66-p8LTfjVnmvxy6hw6TzZEOPeWTfySm67Vx_wao_z4jp9Npi5uL388dp78FUlW8-zuyFiZLxExIjz--OMkzwIjuf7aciFBb6vI5ZydHp2JyXP5WLaG-Np0FxZzYh28YsocK_OM7jzJpgcdRi1HnHa0uLJ5EgiNvvoWoPLHbG2mNuH_S6mxxIoK2aMbbZNnnSO1aWUFUV8upkFGwoB_Wip0puBm6aLNlDfVcWIyPXCHCT6DaOL440o5TtYo9g&sai=AMfl-YR7MwPAkLBDfPAAg9qzRB3eqIz6b4Rm4X1n64oWTjlSHfi0sQWQk13pmTCB2Qhy9xwOoC0VSqC_8IW-r8VVs-XL5aG0VjliLG1sr_-VUA&sig=Cg0ArKJSzBkY599-gsBQEAE&urlfix=1&adurl=
Requested by
Host: info.silobreaker.com
URL: https://info.silobreaker.com/e2t/tc/VVN1hK6LpV61VlXzTl38wDRqW2jjqKJ4qssLHN1TFhtc4Zc_rV3Zsc37CgB-MN3c-2KKDkJ89N2cnbCQpNmFPV8_9mg8HvN0FW2kkBk_6PdrKtW2P-QKG5BHGY0W2g3bnN6-RdkDW6SPp9W8DPlFVV5NMlQ6K_gNvW8PRX607zfNxGW1rkStj3RGCX1W567Zqw3q-bL_W1clxNf205cTkW5cjXWS7H7RsmW6CjyqP8vR1YhW8y86Z_7mSPqjN8QdVsctzGkrVTJr6G8hc4nmW45t02B8pk0HZW2Tlfw84QzwdPW6S9yLp4XmGgCW1YZtht7b1Y4zW33HCNp5_nfVwW5wYMRX264wttW90m6ns27D6BxV477dc79nS0DW6T4xVQ7M5JNXW7t8tFW2zgt2hN8SyYbrS6D-lW4Fj_tQ2vFVfjW271Wql4nM4FhW95-Qnj13vPpKN4F9p50Gwhf_N7F9BlpbWlgYW2TsPjw6DVz0y35xs1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s46-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 16 Apr 2021 11:19:34 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Fri, 16 Apr 2021 11:19:34 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame F5D2
118 KB
36 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041401.js?31060835
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ce2216da03d856edb71b34855ce2c67476f6053791b3e85da74477d9a37360a9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1618423651533291"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36717
x-xss-protection
0
expires
Fri, 16 Apr 2021 11:19:34 GMT
moatad.js
z.moatads.com/pentonmedia53440730609/ Frame F5D2
301 KB
102 KB
Script
General
Full URL
https://z.moatads.com/pentonmedia53440730609/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041401.js?31060835
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
d8bcc4c70c1cf500acbc7c2db7db7f2815dd372815a803f7457e4e8d7a4aec43

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:34 GMT
content-encoding
gzip
last-modified
Mon, 22 Mar 2021 15:28:47 GMT
server
AmazonS3
x-amz-request-id
0XJ62B0429R2DHZ9
etag
"67a3a3488286949059b381921b7a7377"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=45543
accept-ranges
bytes
content-length
104110
x-amz-id-2
Clhj9hmgSw0KwjIs+O4w6dwVmP72aBqGK5awRUWAuS+r03Fm+KxYzOS64QKVIalgoxU+uR0ahds=
view
securepubads.g.doubleclick.net/pcs/ Frame CFDB
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstVKuaXiSw47Vqg-4vvmzHG5H7e6BoRDs_dvWnRlOum9oQGpdY96pBjADno-HR2sqkuPbGHzRhmAlghTdSX7yDprlDABw8o_V1FjFuqdvYugLHvRBKGfFlM5be0nBpchn7XTsvPwK3V0D5jDvUccowHpOPLATXxGhI_ygHLd7wGs5NXAQT1IUwiS5HgVE4TYxLuVXtiAHdh83jeN8L4i1019Lm-uHPyj63BqwC9aFyFxwIUC1PmTfNkR4Gs6qDrrbe1--F_oKbh3d_hV742StUFy0ekF47jb21EAaDJRLw-tfUKGeF-MJOpWm3DwBJLTF-zaLbs9jOqlueb0Usznp2dfqk_&sai=AMfl-YQVnN8WlXDfBYow3K7dNI_MUHW7lxC8cCxqZIPlqraq1a0n62c7n0CLhtrSd2e1KRfOUkO5eYvxkFX17R0cjfbvQ1uV_tEhsp5nzvnP3g&sig=Cg0ArKJSzMT_BjU-uHH0EAE&adurl=
Requested by
Host: info.silobreaker.com
URL: https://info.silobreaker.com/e2t/tc/VVN1hK6LpV61VlXzTl38wDRqW2jjqKJ4qssLHN1TFhtc4Zc_rV3Zsc37CgB-MN3c-2KKDkJ89N2cnbCQpNmFPV8_9mg8HvN0FW2kkBk_6PdrKtW2P-QKG5BHGY0W2g3bnN6-RdkDW6SPp9W8DPlFVV5NMlQ6K_gNvW8PRX607zfNxGW1rkStj3RGCX1W567Zqw3q-bL_W1clxNf205cTkW5cjXWS7H7RsmW6CjyqP8vR1YhW8y86Z_7mSPqjN8QdVsctzGkrVTJr6G8hc4nmW45t02B8pk0HZW2Tlfw84QzwdPW6S9yLp4XmGgCW1YZtht7b1Y4zW33HCNp5_nfVwW5wYMRX264wttW90m6ns27D6BxV477dc79nS0DW6T4xVQ7M5JNXW7t8tFW2zgt2hN8SyYbrS6D-lW4Fj_tQ2vFVfjW271Wql4nM4FhW95-Qnj13vPpKN4F9p50Gwhf_N7F9BlpbWlgYW2TsPjw6DVz0y35xs1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s46-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 16 Apr 2021 11:19:34 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Fri, 16 Apr 2021 11:19:34 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210414/r20110914/client/ Frame CFDB
2 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210414/r20110914/client/window_focus_fy2019.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041401.js?31060835
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:15:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
263
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1303
x-xss-protection
0
server
cafe
etag
14729628269804859526
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 30 Apr 2021 11:15:11 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame CFDB
118 KB
36 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041401.js?31060835
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ce2216da03d856edb71b34855ce2c67476f6053791b3e85da74477d9a37360a9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1618423651533291"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36717
x-xss-protection
0
expires
Fri, 16 Apr 2021 11:19:34 GMT
moatad.js
z.moatads.com/pentonmedia53440730609/ Frame CFDB
301 KB
102 KB
Script
General
Full URL
https://z.moatads.com/pentonmedia53440730609/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041401.js?31060835
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
d8bcc4c70c1cf500acbc7c2db7db7f2815dd372815a803f7457e4e8d7a4aec43

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:34 GMT
content-encoding
gzip
last-modified
Mon, 22 Mar 2021 15:28:47 GMT
server
AmazonS3
x-amz-request-id
0XJ62B0429R2DHZ9
etag
"67a3a3488286949059b381921b7a7377"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=45543
accept-ranges
bytes
content-length
104110
x-amz-id-2
Clhj9hmgSw0KwjIs+O4w6dwVmP72aBqGK5awRUWAuS+r03Fm+KxYzOS64QKVIalgoxU+uR0ahds=
4255144792188325878
tpc.googlesyndication.com/simgad/ Frame CFDB
79 KB
79 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/4255144792188325878
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041401.js?31060835
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
59c10ff6a5aa73210189b990a28f79c5a85469de0398727f271952348a78ecf1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 12 Apr 2021 06:17:02 GMT
x-content-type-options
nosniff
age
363752
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
80456
x-xss-protection
0
last-modified
Fri, 02 Apr 2021 03:16:06 GMT
server
sffe
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 12 Apr 2022 06:17:02 GMT
osd.js
www.googletagservices.com/activeview/js/current/
73 KB
28 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/osd.js?cb=%2Fr20100101
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041401.js?31060835
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
74e1cf077493c33fe895c7ce5732cda76b195e2d357d928f094bc3367cc7a75f
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1618423639646658"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
28266
x-xss-protection
0
expires
Fri, 16 Apr 2021 11:19:34 GMT
insight.min.js
snap.licdn.com/li.lms-analytics/
4 KB
2 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WJ9RHF7
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:7100:48a::25ea Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
5f3b103a1268f862a5e432d607f8e5220dea9d301d13565b0ecded3ad9c25ab2

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 16 Apr 2021 11:19:34 GMT
Content-Encoding
gzip
Last-Modified
Mon, 04 Jan 2021 22:14:03 GMT
X-CDN
AKAM
Vary
Accept-Encoding
Content-Type
application/x-javascript;charset=utf-8
Cache-Control
max-age=59449
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1855
dpm_8effee409c625e1a2d8f5033631840e6ce1dcb64.min.js
s.dpmsrv.com/
823 KB
89 KB
Script
General
Full URL
https://s.dpmsrv.com/dpm_8effee409c625e1a2d8f5033631840e6ce1dcb64.min.js
Requested by
Host: info.silobreaker.com
URL: https://info.silobreaker.com/e2t/tc/VVN1hK6LpV61VlXzTl38wDRqW2jjqKJ4qssLHN1TFhtc4Zc_rV3Zsc37CgB-MN3c-2KKDkJ89N2cnbCQpNmFPV8_9mg8HvN0FW2kkBk_6PdrKtW2P-QKG5BHGY0W2g3bnN6-RdkDW6SPp9W8DPlFVV5NMlQ6K_gNvW8PRX607zfNxGW1rkStj3RGCX1W567Zqw3q-bL_W1clxNf205cTkW5cjXWS7H7RsmW6CjyqP8vR1YhW8y86Z_7mSPqjN8QdVsctzGkrVTJr6G8hc4nmW45t02B8pk0HZW2Tlfw84QzwdPW6S9yLp4XmGgCW1YZtht7b1Y4zW33HCNp5_nfVwW5wYMRX264wttW90m6ns27D6BxV477dc79nS0DW6T4xVQ7M5JNXW7t8tFW2zgt2hN8SyYbrS6D-lW4Fj_tQ2vFVfjW271Wql4nM4FhW95-Qnj13vPpKN4F9p50Gwhf_N7F9BlpbWlgYW2TsPjw6DVz0y35xs1
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
99.84.156.109 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-156-109.txl52.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
1c194d796c5b166af27f072d1cb5d32036d7d63e81ca483221d99197f987128b

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Thu, 15 Apr 2021 16:50:18 GMT
Content-Encoding
gzip
Last-Modified
Thu, 15 Apr 2021 16:50:13 GMT
Server
AmazonS3
Age
66557
ETag
"f8e8d1edaa595149c2687f1b6cf17905"
X-Cache
Hit from cloudfront
Content-Type
application/x-javascript
Via
1.1 117b54f007fbf40fc2a4bbbd8e88fc21.cloudfront.net (CloudFront)
Connection
keep-alive
X-Amz-Cf-Pop
TXL52-C1
Accept-Ranges
bytes
Content-Length
90991
X-Amz-Cf-Id
s4cpyrBhDbXc_uaJQq2XeLc78GmfPEoDn1lwrW0zI6kxvmy-EM-Crw==
view
securepubads.g.doubleclick.net/pcs/ Frame 9844
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsugfwOIMzdNz1yp-JRjGqgVXR-p0CypSgvKasMGZ9WITjpjv9RpRoc72bqwYPrcQHe4PbW_ZJ7m7XZW1ocmFIl2f6E9P7bifHnwKUfyJgd-rp9F4dJQIzUF3sFSzBH_IUpTxt8iZT9i3FHsL_JAMLbJ548II5-X5cXLOkiM7xPBKiIZcYlw2JujhcROwnrUzgZiU72K7wz5AK5VzkYtUCcT8o8l729FzqW6YshWpSHf3rtoQ742Cux25IL2Wwm-XYGNCI3t-X_lqXUVQVAD7fbB5re6ZprLCPVg_yUV_YB-0S_g39LygeO_W6ve4ZYikj54mCqneNWnftw-X7MGCl8&sai=AMfl-YSt6UZhQ6iTmsDE711IePAyxtjK2uc4f9aoLFRAUVmkHX7znKQoNbSTtsMm0MkvbNRVJGzurWsUemq7ROjS77GVlfuMQw-Nwuka-bPVXQ&sig=Cg0ArKJSzNm47ZeTHM9-EAE&urlfix=1&adurl=
Requested by
Host: info.silobreaker.com
URL: https://info.silobreaker.com/e2t/tc/VVN1hK6LpV61VlXzTl38wDRqW2jjqKJ4qssLHN1TFhtc4Zc_rV3Zsc37CgB-MN3c-2KKDkJ89N2cnbCQpNmFPV8_9mg8HvN0FW2kkBk_6PdrKtW2P-QKG5BHGY0W2g3bnN6-RdkDW6SPp9W8DPlFVV5NMlQ6K_gNvW8PRX607zfNxGW1rkStj3RGCX1W567Zqw3q-bL_W1clxNf205cTkW5cjXWS7H7RsmW6CjyqP8vR1YhW8y86Z_7mSPqjN8QdVsctzGkrVTJr6G8hc4nmW45t02B8pk0HZW2Tlfw84QzwdPW6S9yLp4XmGgCW1YZtht7b1Y4zW33HCNp5_nfVwW5wYMRX264wttW90m6ns27D6BxV477dc79nS0DW6T4xVQ7M5JNXW7t8tFW2zgt2hN8SyYbrS6D-lW4Fj_tQ2vFVfjW271Wql4nM4FhW95-Qnj13vPpKN4F9p50Gwhf_N7F9BlpbWlgYW2TsPjw6DVz0y35xs1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s46-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 16 Apr 2021 11:19:34 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Fri, 16 Apr 2021 11:19:34 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 9844
118 KB
36 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041401.js?31060835
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ce2216da03d856edb71b34855ce2c67476f6053791b3e85da74477d9a37360a9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1618423651533291"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36717
x-xss-protection
0
expires
Fri, 16 Apr 2021 11:19:34 GMT
moatad.js
z.moatads.com/pentonmedia53440730609/ Frame 9844
301 KB
102 KB
Script
General
Full URL
https://z.moatads.com/pentonmedia53440730609/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041401.js?31060835
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
d8bcc4c70c1cf500acbc7c2db7db7f2815dd372815a803f7457e4e8d7a4aec43

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:34 GMT
content-encoding
gzip
last-modified
Mon, 22 Mar 2021 15:28:47 GMT
server
AmazonS3
x-amz-request-id
0XJ62B0429R2DHZ9
etag
"67a3a3488286949059b381921b7a7377"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=45543
accept-ranges
bytes
content-length
104110
x-amz-id-2
Clhj9hmgSw0KwjIs+O4w6dwVmP72aBqGK5awRUWAuS+r03Fm+KxYzOS64QKVIalgoxU+uR0ahds=
view
securepubads.g.doubleclick.net/pcs/ Frame A679
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvdl2A9Qi9aTEekdb3obT1-HbunrIxXKiKiE4XTageOVeJK-ECmo1-0Gwjp1XBdCqv7pwkmEAvWG23w42n842i1TJUMzTDOOjN5nxHcvs-xFkDPBD79KuEeuyn-jAj2IiYzPUC4Nroe2bKnlIgktusMJiH4Bx6GQvKIQxvlyodCGkWSHOz7CTrwsJ3JOMITyCnErR8Lq15r9wzXQLVI3ZkbfSzIT1nS41OCbw7V_G-BmabY34OZupk6Ti_2wzzvXeHJzIqt7Z5z7AtFuZRdkL3lxrWhIR_7lGT9ghUXYeuxIBYUsPZI7_WevNhhMi0HDLP5DH5_Z_zbClSUXSI98EY&sai=AMfl-YSOYVZ6MK8Bng7jMnKe3x2xtXtQia9vRhQC-NpUBY8SmE99LalKbQsNFvXbgc49qM8Gldnpgc-KBciwrD1q3kK_tfm8TW7aG-PctzMuLQ&sig=Cg0ArKJSzGGUFwDctStLEAE&adurl=
Requested by
Host: info.silobreaker.com
URL: https://info.silobreaker.com/e2t/tc/VVN1hK6LpV61VlXzTl38wDRqW2jjqKJ4qssLHN1TFhtc4Zc_rV3Zsc37CgB-MN3c-2KKDkJ89N2cnbCQpNmFPV8_9mg8HvN0FW2kkBk_6PdrKtW2P-QKG5BHGY0W2g3bnN6-RdkDW6SPp9W8DPlFVV5NMlQ6K_gNvW8PRX607zfNxGW1rkStj3RGCX1W567Zqw3q-bL_W1clxNf205cTkW5cjXWS7H7RsmW6CjyqP8vR1YhW8y86Z_7mSPqjN8QdVsctzGkrVTJr6G8hc4nmW45t02B8pk0HZW2Tlfw84QzwdPW6S9yLp4XmGgCW1YZtht7b1Y4zW33HCNp5_nfVwW5wYMRX264wttW90m6ns27D6BxV477dc79nS0DW6T4xVQ7M5JNXW7t8tFW2zgt2hN8SyYbrS6D-lW4Fj_tQ2vFVfjW271Wql4nM4FhW95-Qnj13vPpKN4F9p50Gwhf_N7F9BlpbWlgYW2TsPjw6DVz0y35xs1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s46-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 16 Apr 2021 11:19:34 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Fri, 16 Apr 2021 11:19:34 GMT
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210414/r20110914/client/ Frame A679
2 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210414/r20110914/client/window_focus_fy2019.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041401.js?31060835
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:15:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
263
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1303
x-xss-protection
0
server
cafe
etag
14729628269804859526
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 30 Apr 2021 11:15:11 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame A679
118 KB
36 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041401.js?31060835
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ce2216da03d856edb71b34855ce2c67476f6053791b3e85da74477d9a37360a9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1618423651533291"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36717
x-xss-protection
0
expires
Fri, 16 Apr 2021 11:19:34 GMT
moatad.js
z.moatads.com/pentonmedia53440730609/ Frame A679
301 KB
102 KB
Script
General
Full URL
https://z.moatads.com/pentonmedia53440730609/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041401.js?31060835
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
d8bcc4c70c1cf500acbc7c2db7db7f2815dd372815a803f7457e4e8d7a4aec43

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:34 GMT
content-encoding
gzip
last-modified
Mon, 22 Mar 2021 15:28:47 GMT
server
AmazonS3
x-amz-request-id
0XJ62B0429R2DHZ9
etag
"67a3a3488286949059b381921b7a7377"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=45543
accept-ranges
bytes
content-length
104110
x-amz-id-2
Clhj9hmgSw0KwjIs+O4w6dwVmP72aBqGK5awRUWAuS+r03Fm+KxYzOS64QKVIalgoxU+uR0ahds=
5855809953972538087
tpc.googlesyndication.com/simgad/ Frame A679
38 KB
38 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/5855809953972538087
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041401.js?31060835
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
e9e8c1220d8a2b78680564a2f2f749544d8bd1d20f3b7b590eeaaf6beeea199b
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 12 Apr 2021 09:37:15 GMT
x-content-type-options
nosniff
age
351739
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
39190
x-xss-protection
0
last-modified
Wed, 31 Mar 2021 14:02:24 GMT
server
sffe
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 12 Apr 2022 09:37:15 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 7401
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstMKc7O4X-49h-51fWIw6BSCvSsV6w2IVKvxwLEtjFIK4endkR3rhq0pAh4yzfQKSIcICBQUAGhmSHENQrQp8BPQ1Wkgg8vznRe-o09bqJg_8wGC9T3hVktP6RjMK-KvNR1sNkxSs7KoTL3v_gxz7oSZaH3O8pUi4R0SnBFJQDN2SOoeMKhDYktz930vVsEcQfnZTVcyQ7XUKoHTAs8wHEiUIJHEI72ij9rceIdJPftaqC5F_ot5V4eLcWA7lvHw8W-48LbNMhp-nVaW_f7xbxS_ImCjHT8KBAXrMDRjdB0HdJy3QVrBWazFGJlEGSbEAz38hrVKd9Utlp4Xho8SWecXyI&sai=AMfl-YSiN-qA_mRsg1oN7IGmZWiU80d2eOtmkY6Eeg2xf_gO0fOuLaXPvGGLvnz6Ait3rnkq_Zw48oOpP7Mrt3ZG0XCKtckbKAdrbTCx1qmOcQ&sig=Cg0ArKJSzEuzphvR3xY3EAE&urlfix=1&adurl=
Requested by
Host: info.silobreaker.com
URL: https://info.silobreaker.com/e2t/tc/VVN1hK6LpV61VlXzTl38wDRqW2jjqKJ4qssLHN1TFhtc4Zc_rV3Zsc37CgB-MN3c-2KKDkJ89N2cnbCQpNmFPV8_9mg8HvN0FW2kkBk_6PdrKtW2P-QKG5BHGY0W2g3bnN6-RdkDW6SPp9W8DPlFVV5NMlQ6K_gNvW8PRX607zfNxGW1rkStj3RGCX1W567Zqw3q-bL_W1clxNf205cTkW5cjXWS7H7RsmW6CjyqP8vR1YhW8y86Z_7mSPqjN8QdVsctzGkrVTJr6G8hc4nmW45t02B8pk0HZW2Tlfw84QzwdPW6S9yLp4XmGgCW1YZtht7b1Y4zW33HCNp5_nfVwW5wYMRX264wttW90m6ns27D6BxV477dc79nS0DW6T4xVQ7M5JNXW7t8tFW2zgt2hN8SyYbrS6D-lW4Fj_tQ2vFVfjW271Wql4nM4FhW95-Qnj13vPpKN4F9p50Gwhf_N7F9BlpbWlgYW2TsPjw6DVz0y35xs1
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
172.217.16.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s46-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 16 Apr 2021 11:19:34 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Fri, 16 Apr 2021 11:19:34 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 7401
118 KB
36 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041401.js?31060835
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ce2216da03d856edb71b34855ce2c67476f6053791b3e85da74477d9a37360a9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1618423651533291"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36717
x-xss-protection
0
expires
Fri, 16 Apr 2021 11:19:34 GMT
moatad.js
z.moatads.com/pentonmedia53440730609/ Frame 7401
301 KB
102 KB
Script
General
Full URL
https://z.moatads.com/pentonmedia53440730609/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041401.js?31060835
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
d8bcc4c70c1cf500acbc7c2db7db7f2815dd372815a803f7457e4e8d7a4aec43

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:34 GMT
content-encoding
gzip
last-modified
Mon, 22 Mar 2021 15:28:47 GMT
server
AmazonS3
x-amz-request-id
0XJ62B0429R2DHZ9
etag
"67a3a3488286949059b381921b7a7377"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=45543
accept-ranges
bytes
content-length
104110
x-amz-id-2
Clhj9hmgSw0KwjIs+O4w6dwVmP72aBqGK5awRUWAuS+r03Fm+KxYzOS64QKVIalgoxU+uR0ahds=
web.js
ads.celtra.com/218c6053/ Frame 9844
14 KB
5 KB
Script
General
Full URL
https://ads.celtra.com/218c6053/web.js?&clickUrl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsswQA4Y7hoU9gRdVEEYvIXpaX9hTRX9U6-9y2DvtJ9q04r7CaoVV7g9wNJS43DMP2JCGLS21ZiXGNCUhXpel4p3SDUohpWAjsDBmG7jfj6x9s7jO8t0HYyjvVrs-zyRh5fgjiHhw8SR-WUaHSho_HlND-x6GfcB4eoH8SozeXD8Y8P46VqGa6jeDDkC7Wf4yq0Et_2abGwMUlcqn_wk4LxkgAvjmIdkE6QiQx03TRpehPTPd1xLsZQUwcvp1SrEm4ics8i8OmKLLXWtjUnd69JsiMxxDLOoTXroE4rYt_px8Gx9_ZIz-eXUinK2lcU3BReExnsJmprQgDbUoq8%26sai%3DAMfl-YTwaBFn7SfbslY8FtFz-3K0kyV3f7kffOC2bDAnG3iEpez25OirbepbQBsfQYMUOwHs8wQ0m2rjCaJWx-xgCLjRgJrprFOTxUceALnKWg%26sig%3DCg0ArKJSzKfHjGB2XmUAEAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26adurl%3D&expandDirection=undefined&clickEvent=advertiser&iosAdvId=&androidAdvId=&externalAdServer=DFPPremium&tagVersion=html-standard-7&eas.JWVjaWQh=138344901188&externalCreativeId=138344901188&externalPlacementId=22326604369&externalSiteId=22316126855&externalSiteName=darkreading.com&externalLineItemId=5656213172&externalCampaignId=2837012561&externalAdvertiserId=5003554797&scriptId=celtra-script-1&clientTimestamp=1618571974.288&clientTimeZoneOffsetInMinutes=-120&hostPageLoadId=4877370147088549
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.124.238.162 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
5e655f2d4823c97d262aa890bba541d0d5b4e3c45b2e790d7cfc9de866a165d5

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 16 Apr 2021 11:19:33 GMT
content-encoding
gzip
Content-Type
application/javascript; charset=utf-8
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Length
4797
Expires
0
b2
sb.scorecardresearch.com/
Redirect Chain
  • https://sb.scorecardresearch.com/b?c1=2&c2=3005435&ns__t=1618571974293&ns_c=windows-1252&cv=3.5&c8=Malicious%20PowerShell%20Use%2C%20Attacks%20on%20Office%20365%20...&c7=https%3A%2F%2Fwww.darkreadi...
  • https://sb.scorecardresearch.com/b2?c1=2&c2=3005435&ns__t=1618571974293&ns_c=windows-1252&cv=3.5&c8=Malicious%20PowerShell%20Use%2C%20Attacks%20on%20Office%20365%20...&c7=https%3A%2F%2Fwww.darkread...
64 B
329 B
Image
General
Full URL
https://sb.scorecardresearch.com/b2?c1=2&c2=3005435&ns__t=1618571974293&ns_c=windows-1252&cv=3.5&c8=Malicious%20PowerShell%20Use%2C%20Attacks%20on%20Office%20365%20...&c7=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&c9=
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.156.73 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-156-73.txl52.r.cloudfront.net
Software
/
Resource Hash
831b0d6cde4541d363bb7a67eb49010fc5fd717dda4b9c3187dd3207b1da56cd

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:34 GMT
via
1.1 960b0b60c4f1507c51c75d8f9ab0dc91.cloudfront.net (CloudFront)
x-amz-cf-pop
TXL52-C1
etag
W/"40-jHLN3x5dWpBzaQm4lkBmDWvrjrg"
x-cache
Miss from cloudfront
content-type
image/gif; charset=utf-8
content-length
64
x-amz-cf-id
y12e7uRgFzzR59Mohvfa881Uob-zc5eNkqWN90r-EjW6ehSZYA6Cow==

Redirect headers

date
Fri, 16 Apr 2021 11:19:34 GMT
via
1.1 960b0b60c4f1507c51c75d8f9ab0dc91.cloudfront.net (CloudFront)
x-amz-cf-pop
TXL52-C1
vary
Accept
x-cache
Miss from cloudfront
content-type
text/plain; charset=utf-8
location
https://sb.scorecardresearch.com/b2?c1=2&c2=3005435&ns__t=1618571974293&ns_c=windows-1252&cv=3.5&c8=Malicious%20PowerShell%20Use%2C%20Attacks%20on%20Office%20365%20...&c7=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&c9=
content-length
530
x-amz-cf-id
FpDBXTo7JDLy-71IDvqy68ki93orxWtOd4xkldzzklpFg8nz2UC9UA==
832000476880185
connect.facebook.net/signals/config/
254 KB
73 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/832000476880185?v=2.9.39&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
1df25aa660118e4199cb0197184cc63351df11b115b05df7a0e3420c173e830e
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net attachment.fbsbx.com blob: 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding
gzip
x-content-type-options
nosniff
x-xss-protection
0
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-fb-rlafr
0
pragma
public
x-fb-debug
qSCSZOrjmigIoM9pWNX035mRs6ko70iPGkoMxDpYGiQfFUYWkpp+Ub/IaEEypijMZAh1+CH2mDfAv4LaaY3sIg==
x-fb-trip-id
917726464
x-frame-options
DENY
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
date
Fri, 16 Apr 2021 11:19:34 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
report-to
{"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
expires
Sat, 01 Jan 2000 00:00:00 GMT
all.js
connect.facebook.net/en_US/
217 KB
65 KB
Script
General
Full URL
https://connect.facebook.net/en_US/all.js?hash=73125ddde17f0a44295692fe3c4f2ab3&ua=modern_es6
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
b04c1b49e3255761d4d0dd060ce37e23986b743321b5711a54070e3ce66bed0f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

Origin
https://www.darkreading.com
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; preload; includeSubDomains
content-encoding
gzip
x-content-type-options
nosniff
content-md5
VkT4dmBOamae2AzTxzbjXw==
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
65613
x-fb-rlafr
0
x-fb-debug
EPKdQ+ATOAA96t6nhSCu14la65uoqecfIMJogIu6tcxJovPC3X1jRINal/kgyzqwhuEWrDi97F7IR7rQ8mmy2Q==
x-fb-trip-id
2050670934
x-fb-content-md5
2de4bc4b0fcd33340694b8e0f3b9124c
x-frame-options
DENY
date
Fri, 16 Apr 2021 11:19:34 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
access-control-expose-headers
X-FB-Content-MD5
cache-control
public,max-age=31536000,stale-while-revalidate=3600,immutable
etag
"2cc052f6d06833642829d863b1dd4a73"
timing-allow-origin
*
priority
u=3,i
expires
Sat, 16 Apr 2022 09:38:49 GMT
/
www.google.com/pagead/1p-user-list/1007530244/
42 B
327 B
Image
General
Full URL
https://www.google.com/pagead/1p-user-list/1007530244/?random=1618571973873&cv=9&fst=1618570800000&num=1&guid=ON&eid=2505059650&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&tiba=Malicious%20PowerShell%20Use%2C%20Attacks%20on%20Office%20365%20...&fmt=3&is_vtc=1&random=512510509&resp=GooglemKTybQhCsO&rmt_tld=0&ipr=y
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 16 Apr 2021 11:19:34 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.google.de/pagead/1p-user-list/1007530244/
42 B
552 B
Image
General
Full URL
https://www.google.de/pagead/1p-user-list/1007530244/?random=1618571973873&cv=9&fst=1618570800000&num=1&guid=ON&eid=2505059650&u_h=1200&u_w=1600&u_ah=1200&u_aw=1600&u_cd=24&u_his=2&u_tz=120&u_java=false&u_nplug=0&u_nmime=0&sendb=1&frm=0&url=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&tiba=Malicious%20PowerShell%20Use%2C%20Attacks%20on%20Office%20365%20...&fmt=3&is_vtc=1&random=512510509&resp=GooglemKTybQhCsO&rmt_tld=1&ipr=y
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 16 Apr 2021 11:19:34 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-security-policy
script-src 'none'; object-src 'none'
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
NL-button.png
img.deusm.com/informationweek/
2 KB
3 KB
Image
General
Full URL
https://img.deusm.com/informationweek/NL-button.png
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/styles/pano-framework.css?v1.27
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7b5688f8b168e06251901442c4f2f72b30c4477cb472833cde7979a8dca0a862

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:34 GMT
cf-cache-status
HIT
nel
{"report_to":"cf-nel","max_age":604800}
age
1841
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
2502
cf-request-id
097c016ef30000d6ed3c9df000000001
last-modified
Fri, 08 Nov 2013 15:09:43 GMT
server
cloudflare
etag
"9c6-4eaabc5a3dbc0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=a0MZPIfV3flzDQXs6H1Yi9Xd4hFKhnpA1Wu9PDZNT93Icq4Ee%2BKBaAF7wE%2BNKoA2f4nNsh0AKX9sw9M9ZUMoVEpDyH77MX5UmYml%2Bo7E4ZPaEq9FDCryOL1h"}],"group":"cf-nel","max_age":604800}
content-type
image/png
accept-ranges
bytes
cf-ray
640d04f7ec2bd6ed-FRA
view
securepubads.g.doubleclick.net/pcs/ Frame CFDB
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvPYow-y51rbXMz4O4DoUCy_X0zult6Nlrc1Wyw-0gEQkqEW4HBLdvbs8fC77_VPBhj9WAFs_BwWvYFp-tQl6hyh7J5higraHXMGFalQnZ-j0aPtB4AjQvz-sYspQUjeNmJSVM-1yzjfKBXCh47v-cTWPLkTzyEojH5gojKt-aAW18w69kbfdSafRcyDhEctW4MaJKKEfBz-PiPbUR9VKhb8lg23wR4BMQFuJFfAq4f_vcpJ0os_IS3ZLnozyYJ_8ob_-SJLpZT00kfbDP-xioOnUOoMO3R_2mdkjGlMaXbfYJpO8GRRwZAKsD6aM3KqjNXWcmrGSjKpy_Z9_1iWkx7izvSDBM&sai=AMfl-YQ3d6kMJvpaC7dnXQXfG5wXVZPwJcbqNn8Aug8WDgl3aSQczPHu-jIDLA3V_Fte_gGRW4wtRTLJ6ISaDUnRRbiETeSl8Z-_l4zz1i6Abg&sig=Cg0ArKJSzCdq68-a5dwSEAE&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
172.217.16.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s46-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 16 Apr 2021 11:19:34 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Fri, 16 Apr 2021 11:19:34 GMT
truncated
/ Frame F5D2
216 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
cf38831bf840d88299423ad71ddd3db9bff9558b898911ae24c90fa99880387a

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame CFDB
211 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
af4a017ee305cb32dbb87c45bf47631799e4818d722e81a6095d46165e5978c8

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
view
securepubads.g.doubleclick.net/pcs/ Frame A679
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvu9w07kH9un1JhW3o10rFEE0eRmEdGj9Jd_F8XCDVMacMoTdvQHr3HMspESr3T9P-niyGMgJWKRktOZd61BPDIuKaEsSENu0yPvv3Qqj2DckYhfSSj-5P2A7F2I1ThlS9wGZzzB0isr1VMrHmbD8eYcgHqhkJYLadFQC4Hak2Vf7seuBdJt7SM-vkz92Li-gQWsoRSR5UkMpMB-VFhAN4Eq3QgeX-lUEv6vYvveGGYXowhCQ7PpPyZ8PcMe_doBU6oRXAFsWqqX885mebHBap4yn2646P9f8yJA2LTgDsm5t1o3N2YvVU0YfB6lOFW_5-PTIPsBaiSBI3O9poobT-7wg&sai=AMfl-YS5BIpq8F1K3nxZKRlqc4DcCeuPhfLX7u7IczALzKuR4qg2GXxsKh-jCpnoPLn7I_Awti3o2-d90cnKAkY-jErrYoNYYMqVoQqhhY3grA&sig=Cg0ArKJSzAekYPrDbaXzEAE&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
172.217.16.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s46-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 16 Apr 2021 11:19:34 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Fri, 16 Apr 2021 11:19:34 GMT
truncated
/ Frame 9844
216 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
808fa0400a96856a43ec1c27ef1c7aebf78f2f1696d909de2c8a929d477c9fe9

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
truncated
/ Frame A679
216 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1747fc1de85c66335718cecca4dedd536084c8b860d0b3b07af0a1708388905b

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
view
securepubads.g.doubleclick.net/pcs/ Frame 80B6
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstbYU3Y_omB0bF7EJzYUPq7GZn8I42HLrLTsZnoVvFvOpybcZ9l_OW6cSp_vWVScHXYRhmZL2OxAequ5Z4BC63zSnOe2cR6IxU_p6O5kcezGWzkPmeGOlFmAZ5hHa2KH97fzEmdHd8Hv7A6ygWJK9ToH-MkOZwklQ8JAiWIJ20GWqOYto0uKnCk3CkFBTB2t_VunysrAaebde7e2jyoi9DtbulB_H8U9NADqyCytaDZFE1O36Ympz-k_PE2D4kVfBjjU7_cja5T8gC9c6TBmksS-yO4uS7NZ9smsEhE54kTbhFhY4-40y2-gYkGMNbwwefyOIJmAfyNvJaZGPv41YE&sai=AMfl-YR0DsHQZqYGuaedpRoPKZXGv9JLVBs4QEraBjDQyqLwhwYJITXgk57ArfxACD6HBv_w_9MB2GBsto8RjqskXIXtwL_vXvR-KGsqUBl1Ug&sig=Cg0ArKJSzCuv3OI9V5auEAE&adurl=
Requested by
Host: info.silobreaker.com
URL: https://info.silobreaker.com/e2t/tc/VVN1hK6LpV61VlXzTl38wDRqW2jjqKJ4qssLHN1TFhtc4Zc_rV3Zsc37CgB-MN3c-2KKDkJ89N2cnbCQpNmFPV8_9mg8HvN0FW2kkBk_6PdrKtW2P-QKG5BHGY0W2g3bnN6-RdkDW6SPp9W8DPlFVV5NMlQ6K_gNvW8PRX607zfNxGW1rkStj3RGCX1W567Zqw3q-bL_W1clxNf205cTkW5cjXWS7H7RsmW6CjyqP8vR1YhW8y86Z_7mSPqjN8QdVsctzGkrVTJr6G8hc4nmW45t02B8pk0HZW2Tlfw84QzwdPW6S9yLp4XmGgCW1YZtht7b1Y4zW33HCNp5_nfVwW5wYMRX264wttW90m6ns27D6BxV477dc79nS0DW6T4xVQ7M5JNXW7t8tFW2zgt2hN8SyYbrS6D-lW4Fj_tQ2vFVfjW271Wql4nM4FhW95-Qnj13vPpKN4F9p50Gwhf_N7F9BlpbWlgYW2TsPjw6DVz0y35xs1
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
172.217.16.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s46-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 16 Apr 2021 11:19:34 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
window_focus_fy2019.js
tpc.googlesyndication.com/pagead/js/r20210414/r20110914/client/ Frame 80B6
2 KB
1 KB
Script
General
Full URL
https://tpc.googlesyndication.com/pagead/js/r20210414/r20110914/client/window_focus_fy2019.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041401.js?31060835
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:15:11 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
263
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1303
x-xss-protection
0
server
cafe
etag
14729628269804859526
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, max-age=1209600
timing-allow-origin
*
expires
Fri, 30 Apr 2021 11:15:11 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame 80B6
118 KB
36 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041401.js?31060835
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ce2216da03d856edb71b34855ce2c67476f6053791b3e85da74477d9a37360a9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:34 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1618423651533291"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36717
x-xss-protection
0
expires
Fri, 16 Apr 2021 11:19:34 GMT
moatad.js
z.moatads.com/pentonmedia53440730609/ Frame 80B6
301 KB
102 KB
Script
General
Full URL
https://z.moatads.com/pentonmedia53440730609/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041401.js?31060835
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
d8bcc4c70c1cf500acbc7c2db7db7f2815dd372815a803f7457e4e8d7a4aec43

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:34 GMT
content-encoding
gzip
last-modified
Mon, 22 Mar 2021 15:28:47 GMT
server
AmazonS3
x-amz-request-id
0XJ62B0429R2DHZ9
etag
"67a3a3488286949059b381921b7a7377"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=45543
accept-ranges
bytes
content-length
104110
x-amz-id-2
Clhj9hmgSw0KwjIs+O4w6dwVmP72aBqGK5awRUWAuS+r03Fm+KxYzOS64QKVIalgoxU+uR0ahds=
8312837989510548350
tpc.googlesyndication.com/simgad/ Frame 80B6
91 KB
91 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/8312837989510548350
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041401.js?31060835
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
95ab293284c0a0c7804ce334e10ef01c9a6854311ae9c45d57a59b8ccea1aa56
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 13 Apr 2021 21:30:24 GMT
x-content-type-options
nosniff
age
222550
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
93272
x-xss-protection
0
last-modified
Tue, 06 Apr 2021 21:04:09 GMT
server
sffe
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Wed, 13 Apr 2022 21:30:24 GMT
tag.aspx
ml314.com/ Frame F5D2
28 KB
13 KB
Script
General
Full URL
https://ml314.com/tag.aspx?1632021
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/pentonmedia53440730609/moatad.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.49.20.76 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
ac2295d897d9c85c39d26180d983fa960e03d52bbe0874f152274b00cf1abc99

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 16 Apr 2021 11:19:34 GMT
Content-Encoding
gzip
Last-Modified
Fri, 16 Apr 2021 06:21:43 GMT
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Cache-Control
public, max-age=68528
Connection
keep-alive
Content-Length
12550
Expires
Sat, 17 Apr 2021 06:21:43 GMT
n.js
geo.moatads.com/
100 B
275 B
Script
General
Full URL
https://geo.moatads.com/n.js?e=35&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-nwvw4053N9oCRb36FcojwKWkUwdJEJMXJKBAOq%2BVT%2Bl2tvnQIIWF3cA%2B&sc=1&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&i=PENTONMEDIA1&hp=1&wf=1&pxm=6&vb=13&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1618571974684&de=217309880495&m=0&ar=e4967b0-clean&iw=64bab64&q=2&cb=0&ym=0&cu=1618571974684&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=5003554797%3A2837012561%3A5656213172%3A138345349102&zMoatPS=wallpaper&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685&zMoatDev=Desktop&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&id=1&ii=4&bo=22316126855&bp=22326604369&bd=wallpaper&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22326604369&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22326604369&gw=pentonmedia53440730609&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A2157%3A2291%3A0%3A0&iq=na&tt=na&fs=189983&na=739616593&cs=0&callback=MoatDataJsonpRequest_83551184
Requested by
Host: z.moatads.com
URL: https://z.moatads.com/pentonmedia53440730609/moatad.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.10.133.216 London, United Kingdom, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
TornadoServer/4.5.3 /
Resource Hash
e317ba0d41b33a2edef3bf327cb4846486a03bbc8e4df86d2e4224dbe96302cc

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:34 GMT
cache-control
max-age=900
server
TornadoServer/4.5.3
timing-allow-origin
*
etag
"32f4adc6808b3e7f285546d7d470080e55848212"
content-length
100
content-type
text/html; charset=UTF-8
pixel.gif
px.moatads.com/
43 B
260 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=PENTONMEDIA1&hp=1&wf=1&pxm=6&vb=13&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1618571974684&de=217309880495&m=0&ar=e4967b0-clean&iw=64bab64&q=3&cb=0&ym=0&cu=1618571974684&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=5003554797%3A2837012561%3A5656213172%3A138345349102&zMoatPS=wallpaper&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685&zMoatDev=Desktop&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&id=1&ii=4&bo=22316126855&bp=22326604369&bd=wallpaper&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22326604369&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22326604369&gw=pentonmedia53440730609&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A2157%3A2291%3A0%3A0&iq=na&tt=na&fs=189983&na=1324191772&cs=0
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 16 Apr 2021 11:19:34 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Fri, 16 Apr 2021 11:19:34 GMT
collect
px.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2720225&time=1618571974781&url=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q...
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D2720225%26time%3D1618571974781%26url%3Dhttps%253A%252F%252Fwww.darkreading.com%25...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2720225&time=1618571974781&url=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q...
0
273 B
Image
General
Full URL
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2720225&time=1618571974781&url=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&liSync=true
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:119:50e1:101::6cae:b25 , United States, ASN14413 (LINKEDIN, US),
Reverse DNS
Software
Play /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:35 GMT
nel
{"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
server
Play
linkedin-action
1
report-to
{"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-fabric
prod-lor1
x-li-proto
http/2
x-li-pop
prod-esv5
content-type
application/javascript
content-length
0
x-li-uuid
QOQM56JSdhbwcA1KJisAAA==

Redirect headers

content-security-policy
default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id lnkd.demdex.net blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ www.google-analytics.com static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/ platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self'
x-content-type-options
nosniff
nel
{"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true}
linkedin-action
1
content-length
0
x-li-uuid
Wxgg2aJSdhaQbNZIBSsAAA==
pragma
no-cache
x-li-pop
afd-prod-lor1
x-msedge-ref
Ref A: 4B99D1A667CF4894A8318C86C6114783 Ref B: FRAEDGE1219 Ref C: 2021-04-16T11:19:35Z
x-frame-options
sameorigin
date
Fri, 16 Apr 2021 11:19:35 GMT
expect-ct
max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct"
strict-transport-security
max-age=31536000
report-to
{"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true}
x-li-fabric
prod-lor1
location
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=2720225&time=1618571974781&url=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&liSync=true
cache-control
no-cache, no-store
x-li-proto
http/2
expires
Thu, 01 Jan 1970 00:00:00 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 7401
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjssK4N_EHlbdFH_ht13I0D-TkK_vbnkPT3s8kUFZ5fU7wCAVrxqaQOGcJ5iHCYALkutmCNeSdZ6SasrZKdYFbNA4fXoRZRHJPjV6AHgfbieehF3cmDFlvYeYWUMj50BsmF5Ycmy5-MH7PLr7X9hQIVuH9wjE0USkzMGSognUFaS_YPSr7vfu13Z-RThDv8tPo744RYFuYikRdyo53UhObmTw4DP9x0qH4S7Fm9V9wr-4qJlXLl1EeDVupGiGXmmUMrHA0_gkKiSH7yzRj-87LUMUJ86CLw0oBvn53bCj1D9KadqPquLFge9c_mjY9q759dztPYWlFCfXeWGP-MSB-YRblxYYTA&sai=AMfl-YSUoEBdSzll0_UhEgJEGcdLT_jPXPGBHgMvuGvVQOCTpaHmoaJz8x2R610AS8wMmnkbO5fXWfnlZYpmH9XUPtZZvEEj_vyA2dV-vaTM1w&sig=Cg0ArKJSzCYZ_5FsUEoAEAE&urlfix=1&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
172.217.16.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s46-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 16 Apr 2021 11:19:34 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Fri, 16 Apr 2021 11:19:34 GMT
truncated
/ Frame 7401
214 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2c1e04fc87330ee32f0dbc77ae3935d20c7bb93d01e685cb4af2f3fdc17ce1a5

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
index.php
a.dpmsrv.com/dpmpxl/
Redirect Chain
  • https://ib.adnxs.com/getuid?https://a.dpmsrv.com/dpmpxl/index.php?id=$UID&q%3DxImp%26v%3D1.x%26cl%3D55%26pixelIndex%3D0%26r%3D949469%26tzOffset%3D-120%26url%3Dhttps%253A%252F%252Fwww.darkreading.co...
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fa.dpmsrv.com%2Fdpmpxl%2Findex.php%3Fid%3D%24UID%26q%253DxImp%2526v%253D1.x%2526cl%253D55%2526pixelIndex%253D0%2526r%253D949469%2526tzOffset%253...
  • https://a.dpmsrv.com/dpmpxl/index.php?id=3095526004051790400&q=xImp&v=1.x&cl=55&pixelIndex=0&r=949469&tzOffset=-120&url=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-atta...
242 B
993 B
Script
General
Full URL
https://a.dpmsrv.com/dpmpxl/index.php?id=3095526004051790400&q=xImp&v=1.x&cl=55&pixelIndex=0&r=949469&tzOffset=-120&url=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&_=1618571974969
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.229.100.58 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-229-100-58.compute-1.amazonaws.com
Software
/
Resource Hash
213d028cd435ae24f97ba5210de14632da8e3ac9021673f490ecf99ece0c43d3

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
content-encoding
gzip
Access-Control-Max-Age
10
Access-Control-Allow-Methods
GET, POST, PUT, DELETE, OPTIONS
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Type
text/javascript
Access-Control-Allow-Headers
content-type, accept
Content-Length
214
Expires
0

Redirect headers

Pragma
no-cache
Date
Fri, 16 Apr 2021 11:19:35 GMT
X-Proxy-Origin
185.236.42.17; 185.236.42.17; 693.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.173.48:80
AN-X-Request-Uuid
f3d54136-eb6d-4959-9e58-a8f89d32375e
Server
nginx/1.17.9
Access-Control-Allow-Origin
*
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Location
https://a.dpmsrv.com/dpmpxl/index.php?id=3095526004051790400&q=xImp&v=1.x&cl=55&pixelIndex=0&r=949469&tzOffset=-120&url=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&_=1618571974969
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/html; charset=utf-8
Content-Length
0
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
spacer.gif
img.lightreading.com/images/
49 B
373 B
Image
General
Full URL
https://img.lightreading.com/images/spacer.gif
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.86.2.75 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
3c5b83e390d046c3623c4b8e35b58aaf64a7481bb2372fb51ae2e0e7818f7407

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 15 Apr 2021 18:31:54 GMT
via
1.1 3095e870e1a1a1b03178e40ab1872de5.cloudfront.net (CloudFront)
last-modified
Fri, 20 Jun 2014 19:05:53 GMT
server
AmazonS3
age
112748
etag
"4909631c93ffa90e65247e3fd4454f2d"
x-cache
Hit from cloudfront
content-type
image/gif
x-amz-cf-pop
FRA6-C1
accept-ranges
bytes
content-length
49
x-amz-cf-id
_K8WebP0QjBjLzYn6dSf7si820ZZ_kk0MqcWZY5GYnN-dAJEPoFSCA==
/
www.facebook.com/tr/
44 B
411 B
Image
General
Full URL
https://www.facebook.com/tr/?id=832000476880185&ev=PageView&dl=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&rl=&if=false&ts=1618571975033&sw=1600&sh=1200&v=2.9.39&r=stable&ec=0&o=30&fbp=fb.1.1618571975030.1834063378&it=1618571974300&coo=false&rqm=GET
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f12d:83:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:35 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
44
expires
Fri, 16 Apr 2021 11:19:35 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 80B6
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstVNX_Nba1e0banIutaS4PDKEbX7VveEOAS90_s4ciHZrTUd8mHKcHLhhxMoRpYh_b4zk1REySZztLBIQBkTYu15uav141Sr7xK7u8pJKIw2rzs0ONnU9QEdErGsC3d4O5Rrv2lO-WGjB9V8_VK-bModZbqWsgoAU_xUGSVdvE1eihF4m8Rx8bJ453Rupj35KZt_TQeB-_zbcR9XlmbvlHSqDI0VNQYkx_nJOsMaCYeiIQSyPB48RKWi7MdLhgHfwpcnv1GWw-Nfa9IFplctVpChVuROP6zKhLd9lD_zKR4mSUTLGml74u7rtkvxtkyuKjTUJNsSqkjAFJI9UijqrmBEA&sai=AMfl-YSSxemy3-5lTIRfvrGbzgWVHBFjtUu2O5i-0TyGLRkaDCmPpVlHGYK8cZ3ehKUz3_E2SdZUtHm5-WUDcb9lelCDshGZjRUH9WU5_YYn9A&sig=Cg0ArKJSzOd2CS6HZOJIEAE&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
172.217.16.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s46-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 16 Apr 2021 11:19:35 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Fri, 16 Apr 2021 11:19:35 GMT
truncated
/ Frame 80B6
216 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c3afea18e435beb9cc7c30e103f013e2c06be6b53ad877533aded93c19939ae6

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
web.js
cache-ssl.celtra.com/api/creatives/ed998cd9/compiled/ Frame 9844
501 KB
118 KB
Script
General
Full URL
https://cache-ssl.celtra.com/api/creatives/ed998cd9/compiled/web.js?v=7-9bacddacd5&secure=1&cachedVariantChoices=W10-&isPurposePreview=0&eventMetadataExperiment=newMeta&inmobi=0
Requested by
Host: ads.celtra.com
URL: https://ads.celtra.com/218c6053/web.js?&clickUrl=https%3A%2F%2Fadclick.g.doubleclick.net%2Fpcs%2Fclick%3Fxai%3DAKAOjsswQA4Y7hoU9gRdVEEYvIXpaX9hTRX9U6-9y2DvtJ9q04r7CaoVV7g9wNJS43DMP2JCGLS21ZiXGNCUhXpel4p3SDUohpWAjsDBmG7jfj6x9s7jO8t0HYyjvVrs-zyRh5fgjiHhw8SR-WUaHSho_HlND-x6GfcB4eoH8SozeXD8Y8P46VqGa6jeDDkC7Wf4yq0Et_2abGwMUlcqn_wk4LxkgAvjmIdkE6QiQx03TRpehPTPd1xLsZQUwcvp1SrEm4ics8i8OmKLLXWtjUnd69JsiMxxDLOoTXroE4rYt_px8Gx9_ZIz-eXUinK2lcU3BReExnsJmprQgDbUoq8%26sai%3DAMfl-YTwaBFn7SfbslY8FtFz-3K0kyV3f7kffOC2bDAnG3iEpez25OirbepbQBsfQYMUOwHs8wQ0m2rjCaJWx-xgCLjRgJrprFOTxUceALnKWg%26sig%3DCg0ArKJSzKfHjGB2XmUAEAE%26fbs_aeid%3D%5Bgw_fbsaeid%5D%26urlfix%3D1%26adurl%3D&expandDirection=undefined&clickEvent=advertiser&iosAdvId=&androidAdvId=&externalAdServer=DFPPremium&tagVersion=html-standard-7&eas.JWVjaWQh=138344901188&externalCreativeId=138344901188&externalPlacementId=22326604369&externalSiteId=22316126855&externalSiteName=darkreading.com&externalLineItemId=5656213172&externalCampaignId=2837012561&externalAdvertiserId=5003554797&scriptId=celtra-script-1&clientTimestamp=1618571974.288&clientTimeZoneOffsetInMinutes=-120&hostPageLoadId=4877370147088549
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.156.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-156-95.txl52.r.cloudfront.net
Software
Apache /
Resource Hash
5e58c915902143f7556f02927aa84784d90114d396779cbae06bbfbf5a4a901c

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 15 Apr 2021 10:55:02 GMT
content-encoding
gzip
age
87873
x-cache
Hit from cloudfront
content-length
120270
access-control-allow-origin
*
server
Apache
etag
"198d6bfedac0315313486340ea2a2810995ad83ff866de23d1e77e64df6bbedc"
vary
Accept-Encoding
x-varnish
1606652
via
1.1 varnish (Varnish/5.0), 1.1 f23d0814f3a7efcdd4936fa69b3d072b.cloudfront.net (CloudFront)
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=31556926
access-control-allow-credentials
false
x-amz-cf-pop
TXL52-C1
accept-ranges
bytes
content-type
application/javascript
x-amz-cf-id
N60r4VZ3IA9cPNcMfZjVKXg-uoxPHyum8P1sm9CyrvZfultKXNV5Xg==
truncated
/ Frame 9844
167 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d26432e661658ef9d3d538b1f71b1478193f6c141f1cd7dfed03e5b677d178c2

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
fa292516-f533-4343-b480-184b16a947b6
https://www.darkreading.com/ Frame 9844
167 B
0
Image
General
Full URL
blob:https://www.darkreading.com/fa292516-f533-4343-b480-184b16a947b6
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
d26432e661658ef9d3d538b1f71b1478193f6c141f1cd7dfed03e5b677d178c2

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Length
167
Content-Type
image/png
status
www.facebook.com/x/oauth/
0
0
Fetch
General
Full URL
https://www.facebook.com/x/oauth/status?client_id=640989409269461&input_token&origin=1&redirect_uri=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&sdk=joey&wants_cookie_data=false
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js?hash=73125ddde17f0a44295692fe3c4f2ab3&ua=modern_es6
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f12d:83:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=15552000; preload
x-content-type-options
nosniff
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
0
x-fb-rlafr
0
pragma
no-cache
x-fb-debug
sk/So6ExbvZinNYJcM+Sp54ICWcSrh138CYjlDSGI5kClFD2qSdq3jLv8QiXmEBFw8Sz73u805THur220qkGjw==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
fb-s
unknown
cross-origin-opener-policy
same-origin-allow-popups
date
Fri, 16 Apr 2021 11:19:35 GMT
report-to
{"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type
text/plain; charset=UTF-8
access-control-allow-origin
https://www.darkreading.com
access-control-expose-headers
fb-s
cache-control
private, no-cache, no-store, must-revalidate
access-control-allow-credentials
true
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
pixel.gif
px.moatads.com/
43 B
260 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=PENTONMEDIA1&hp=1&wf=1&pxm=6&vb=13&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1618571974817&de=110898614312&m=0&ar=e4967b0-clean&iw=64bab64&q=7&cb=0&ym=0&cu=1618571974817&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=5003554797%3A2837012561%3A5656213172%3A138344902208&zMoatPS=rec1&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685&zMoatDev=Desktop&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&id=1&ii=4&bo=22316126855&bp=22326604369&bd=rec1&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22326604369&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22326604369&gw=pentonmedia53440730609&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A2157%3A2291%3A0%3A0&iq=na&tt=na&fs=189983&na=577252223&cs=0
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 16 Apr 2021 11:19:35 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Fri, 16 Apr 2021 11:19:35 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame D0E4
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjstvu_YYM6oPHh5QpHk7gQblyHmBO-4NaUg1rTUViGNAPvQ2JlfNyNlV92M-L6IJaLVOsQa2ABsfWyqM0E7AfW2rhu4x2gTuQC5jQT2GbdMlnaebgNZ9pedcjn5l4WePfvJncy1-Bddq9X5XlTXHRlIspeLRLjsnEIlHGrm82Sux_pZ58XkbQyPqqXN5fdngCWxhYEKchnhX_I4RhaqMRfqp_r0W5rSNcBK5iDwHh5XxGgCdJFmmknNDOoICCDXp90h7snwnqKeqyTIqMfHmYxGKdwmA7PyD4h3nPCSWCwk65z9rpJskkE9rFVPQtXge0DPLMl9O2Gp-G7Opx44qY0A&sai=AMfl-YQBlEYxylEN4UzxyA0zh-Xr16p54ttqZzlqPLH5emFfRZGTdwEk0EsP55KbFcsvynDUqmejCVP4A78EcXOD5NSBpjrxt9YiXVYp6cD-IA&sig=Cg0ArKJSzLPg0dc-VJmuEAE&urlfix=1&adurl=
Requested by
Host: info.silobreaker.com
URL: https://info.silobreaker.com/e2t/tc/VVN1hK6LpV61VlXzTl38wDRqW2jjqKJ4qssLHN1TFhtc4Zc_rV3Zsc37CgB-MN3c-2KKDkJ89N2cnbCQpNmFPV8_9mg8HvN0FW2kkBk_6PdrKtW2P-QKG5BHGY0W2g3bnN6-RdkDW6SPp9W8DPlFVV5NMlQ6K_gNvW8PRX607zfNxGW1rkStj3RGCX1W567Zqw3q-bL_W1clxNf205cTkW5cjXWS7H7RsmW6CjyqP8vR1YhW8y86Z_7mSPqjN8QdVsctzGkrVTJr6G8hc4nmW45t02B8pk0HZW2Tlfw84QzwdPW6S9yLp4XmGgCW1YZtht7b1Y4zW33HCNp5_nfVwW5wYMRX264wttW90m6ns27D6BxV477dc79nS0DW6T4xVQ7M5JNXW7t8tFW2zgt2hN8SyYbrS6D-lW4Fj_tQ2vFVfjW271Wql4nM4FhW95-Qnj13vPpKN4F9p50Gwhf_N7F9BlpbWlgYW2TsPjw6DVz0y35xs1
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
172.217.16.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s46-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 16 Apr 2021 11:19:35 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
tag
a.teads.tv/page/122239/ Frame D0E4
1 KB
850 B
Script
General
Full URL
https://a.teads.tv/page/122239/tag
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041401.js?31060835
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.51 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-51.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
82585d58a935ca750bf12e7bd7655acf2d6082733359b7399ebcd2442df4f7d3

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:35 GMT
content-encoding
gzip
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, must-revalidate, max-age=3600
access-control-allow-credentials
true
content-length
650
expires
Fri, 16 Apr 2021 12:19:35 GMT
rx_lidar.js
www.googletagservices.com/activeview/js/current/ Frame D0E4
118 KB
36 KB
Script
General
Full URL
https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041401.js?31060835
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
ce2216da03d856edb71b34855ce2c67476f6053791b3e85da74477d9a37360a9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:35 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1618423651533291"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36717
x-xss-protection
0
expires
Fri, 16 Apr 2021 11:19:35 GMT
moatad.js
z.moatads.com/pentonmedia53440730609/ Frame D0E4
301 KB
102 KB
Script
General
Full URL
https://z.moatads.com/pentonmedia53440730609/moatad.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041401.js?31060835
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
d8bcc4c70c1cf500acbc7c2db7db7f2815dd372815a803f7457e4e8d7a4aec43

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:35 GMT
content-encoding
gzip
last-modified
Mon, 22 Mar 2021 15:28:47 GMT
server
AmazonS3
x-amz-request-id
0XJ62B0429R2DHZ9
etag
"67a3a3488286949059b381921b7a7377"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=45542
accept-ranges
bytes
content-length
104110
x-amz-id-2
Clhj9hmgSw0KwjIs+O4w6dwVmP72aBqGK5awRUWAuS+r03Fm+KxYzOS64QKVIalgoxU+uR0ahds=
s71072796567347
ubmtech.d3.sc.omtrdc.net/b/ss/cmpglobalvista/1/JS-2.8.2/
43 B
442 B
XHR
General
Full URL
https://ubmtech.d3.sc.omtrdc.net/b/ss/cmpglobalvista/1/JS-2.8.2/s71072796567347
Requested by
Host: twimgs.com
URL: https://twimgs.com/custom/library.gtecevent.com/assets/ubm-tech-global-app-measurement.js?ormzkk
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.181.18.61 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-35-181-18-61.eu-west-3.compute.amazonaws.com
Software
jag /
Resource Hash
55c9d2f019f9d7ddfd69b2ad0351c5617338a222362aebb02b3b98a4dbc18486
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

date
Fri, 16 Apr 2021 11:19:35 GMT
x-content-type-options
nosniff
x-c
main-1455.Icbb9a9.M0-487
p3p
CP="This is not a P3P policy"
content-length
43
x-xss-protection
1; mode=block
pragma
no-cache
last-modified
Sat, 17 Apr 2021 11:19:35 GMT
server
jag
xserver
anedge-5db677d464-hmd4p
etag
3475856849546608640-4621866086831499750
vary
*
content-type
image/gif;charset=utf-8
access-control-allow-origin
https://www.darkreading.com
cache-control
no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials
true
expires
Thu, 15 Apr 2021 11:19:35 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame F5D2
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsuJGIMXLnLFuGKuz5N6wGrlPb8EheGjv66IQAU-5TwvLPmf5wd8pGyw7ix0O7xzcFamLVl-W7YReb4DaSfvXjYVbA6-K8u101LvwhsYv5k2BGBW1t9GwUu0rLEgdmreuu_n3W-q3-7UbMtuHcxApkyd_5IbyqwvSpw9zagww_3eB0WNpBiTnY_K1xIJ9ARY5dLQkev-pOiOpX2hLw5eJCG6wsp15G5H6fLU4ZhqUVHKd9MR5-u0GWPeJTNoN-uPhXHWRIKWmUGajWcqo3urijnrleM7oV3RZQXdZQWaC2_-YQa1yKVPAG306OHAI4_VWE1Q-2xXIQLz9pwixLknvZ6n6Y6I7Q&sai=AMfl-YSCOsu6dxhPB2VvtElOtJ8VpCjtlAulHBdR06B2tLtz9b01QMz3m1ybTeOE0iKpfP-lcICVFMcwJtYJUOUjDxvyuZsSj2NamrisEf_yHQ&sig=Cg0ArKJSzNWu4MrSnSd4EAE&urlfix=1&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
172.217.16.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s46-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 16 Apr 2021 11:19:35 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Fri, 16 Apr 2021 11:19:35 GMT
6529971925723101231
tpc.googlesyndication.com/simgad/
25 KB
25 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/6529971925723101231?
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6a00a6df086b26f8652d0c165dc78d45c49d987b66c243228384968c438816d1
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 12 Apr 2021 13:07:30 GMT
x-content-type-options
nosniff
age
339125
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
26071
x-xss-protection
0
last-modified
Thu, 08 Apr 2021 20:24:01 GMT
server
sffe
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 12 Apr 2022 13:07:30 GMT
/
api.bibblio.org/v1/content-item-url-ingestions/ Frame
0
0
Preflight
General
Full URL
https://api.bibblio.org/v1/content-item-url-ingestions/
Protocol
H2
Server
65.9.66.54 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
POST
Access-Control-Request-Headers
authorization,content-type
Origin
https://www.darkreading.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

content-type
application/json
content-length
0
date
Fri, 16 Apr 2021 11:19:35 GMT
x-amzn-requestid
bcb5656a-9a41-4338-8453-65d2bc9d05d0
access-control-allow-origin
*
access-control-allow-headers
Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token
x-amz-apigw-id
d37fMEePjoEFjCQ=
access-control-allow-methods
POST,OPTIONS
x-cache
Miss from cloudfront
via
1.1 7e513424eee237ee26467e8fd5656ec1.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-C1
x-amz-cf-id
dbvN6dpsOaFbuUx-XkT5oRh9JLD4b-S_X0fHH4FAQvMJpvBbnuhkeg==
/
api.bibblio.org/v1/content-item-url-ingestions/
175 B
547 B
XHR
General
Full URL
https://api.bibblio.org/v1/content-item-url-ingestions/
Requested by
Host: cdn.bibblio.org
URL: https://cdn.bibblio.org/rcm/4.9/bib-related-content.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.66.54 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
6daa62ec3812d8c4cc65448351cefcbe9a190ecec9c63cc261d28a851632d5fa

Request headers

User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://www.darkreading.com/
Authorization
Bearer cad9e1a0-1087-4b12-918a-6a2155eb25a3
Content-Type
application/json

Response headers

date
Fri, 16 Apr 2021 11:19:35 GMT
via
1.1 7e513424eee237ee26467e8fd5656ec1.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-C1
x-amzn-requestid
4ee415e7-22fa-4ec2-aa65-13a83546022a
x-cache
Error from cloudfront
content-type
application/json
access-control-allow-origin
*
x-amzn-trace-id
Root=1-607972c7-3bc4381c5e20e88b3926f78e;Sampled=0
x-amz-apigw-id
d37fNEKkjoEFUQQ=
content-length
175
x-amz-cf-id
jBuTo6m0__e4pMeNn_4lwQZH0mHWJpIEKgBPC3jlrRuBoFBnIAq9kw==
recommendations
api.bibblio.org/v1/
4 KB
5 KB
XHR
General
Full URL
https://api.bibblio.org/v1/recommendations?limit=6&page=1&fields=name,url,moduleImage,datePublished,author,description&customUniqueIdentifier=1340685
Requested by
Host: cdn.bibblio.org
URL: https://cdn.bibblio.org/rcm/4.9/bib-related-content.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
65.9.66.54 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
a2e7f940b6e3194e1609c6cf10320499a1e036056580fabf1675470a7f76b04a

Request headers

User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://www.darkreading.com/
Authorization
Bearer cad9e1a0-1087-4b12-918a-6a2155eb25a3
Content-Type
application/json

Response headers

date
Fri, 16 Apr 2021 11:19:35 GMT
via
1.1 7e513424eee237ee26467e8fd5656ec1.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-C1
x-amzn-requestid
2be9b92f-0f4d-4747-a80e-465b06f210bc
x-cache
Miss from cloudfront
content-type
application/json
access-control-allow-origin
*
x-amzn-trace-id
Root=1-607972c7-2c79eddb1e22dca01c57e1a2;Sampled=0
x-amz-apigw-id
d37fNHh5joEFUeg=
content-length
4367
x-amz-cf-id
XgXu9o2pz60pgkcdcXdp-Tey7ljhmQrYRmmbEhPTB8dQX__j0_i6QA==
recommendations
api.bibblio.org/v1/ Frame
0
0
Preflight
General
Full URL
https://api.bibblio.org/v1/recommendations?limit=6&page=1&fields=name,url,moduleImage,datePublished,author,description&customUniqueIdentifier=1340685
Protocol
H2
Server
65.9.66.54 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Method
GET
Access-Control-Request-Headers
authorization,content-type
Origin
https://www.darkreading.com
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Sec-Fetch-Mode
cors

Response headers

content-type
application/json
content-length
0
date
Fri, 16 Apr 2021 11:19:35 GMT
x-amzn-requestid
0e5f2d32-a4c2-43b0-8c3a-a69a0bd6c71a
access-control-allow-origin
*
access-control-allow-headers
Content-Type,X-Amz-Date,Authorization,X-Api-Key,X-Amz-Security-Token
x-amz-apigw-id
d37fMGeBDoEFzAA=
access-control-allow-methods
GET,OPTIONS
x-cache
Miss from cloudfront
via
1.1 7e513424eee237ee26467e8fd5656ec1.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-C1
x-amz-cf-id
zdYUybJP8xVkUVFZiyYvHwgtUzujLvmNaFu1_4tF4NOF4g3Ulx2sSQ==
widget_iframe.63899b173766ee6f8a729a72b542b0fb.html
platform.twitter.com/widgets/ Frame 2BDC
319 KB
103 KB
Document
General
Full URL
https://platform.twitter.com/widgets/widget_iframe.63899b173766ee6f8a729a72b542b0fb.html?origin=https%3A%2F%2Fwww.darkreading.com
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
93.184.220.66 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (ska/F705) /
Resource Hash
5f789ea36ae4671282524bda454709578d63b915b782c1e041132a7e726ff1c3

Request headers

Host
platform.twitter.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.darkreading.com/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://www.darkreading.com/

Response headers

Content-Encoding
gzip
Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Age
41258
Cache-Control
public, max-age=315360000
Content-Type
text/html; charset=utf-8
Date
Fri, 16 Apr 2021 11:19:35 GMT
Etag
"dab7ee9ff99366614e06e117bab5e542+gzip"
Last-Modified
Thu, 15 Apr 2021 22:44:33 GMT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server
ECS (ska/F705)
Vary
Accept-Encoding
X-Cache
HIT
x-tw-cdn
VZ
Content-Length
105298
like.php
www.facebook.com/plugins/ Frame 68C9
47 KB
15 KB
Document
General
Full URL
https://www.facebook.com/plugins/like.php?app_id=640989409269461&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df3b1c3c5daf49a%26domain%3Dwww.darkreading.com%26origin%3Dhttps%253A%252F%252Fwww.darkreading.com%252Ff29f6f44e0fede%26relation%3Dparent.parent&container_width=0&href=http%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685&layout=button&locale=en_US&sdk=joey&send=false&show_faces=false&width=87
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/all.js?hash=73125ddde17f0a44295692fe3c4f2ab3&ua=modern_es6
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f12d:83:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
2cb7ae225cf3062d2ad68116562c82f0a61770c495f9b84dd55720f97fd1a4f4
Security Headers
Name Value
Content-Security-Policy default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
www.facebook.com
:scheme
https
:path
/plugins/like.php?app_id=640989409269461&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df3b1c3c5daf49a%26domain%3Dwww.darkreading.com%26origin%3Dhttps%253A%252F%252Fwww.darkreading.com%252Ff29f6f44e0fede%26relation%3Dparent.parent&container_width=0&href=http%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685&layout=button&locale=en_US&sdk=joey&send=false&show_faces=false&width=87
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.darkreading.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
fr=0HLo73U7eZYUwJBg5..BgeXLH...1.0.BgeXLH.
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://www.darkreading.com/

Response headers

vary
Accept-Encoding
x-fb-rlafr
0
pragma
no-cache
expires
Sat, 01 Jan 2000 00:00:00 GMT
content-encoding
br
strict-transport-security
max-age=15552000; preload
x-content-type-options
nosniff
x-xss-protection
0
cache-control
private, no-cache, no-store, must-revalidate
content-security-policy
default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;
content-type
text/html; charset="utf-8"
x-fb-debug
CvT4UYmzxpYmH5tcc9h8EAoMWka0FfiY2qIMA7HmuQC3N59LQTnc8UXNfBxoWldoYQs/Z3F+TDsN7+bn9H9XNw==
date
Fri, 16 Apr 2021 11:19:35 GMT
priority
u=3,i
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
elqCfg.min.js
img.en25.com/i/
6 KB
3 KB
Script
General
Full URL
https://img.en25.com/i/elqCfg.min.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
104.111.229.66 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-111-229-66.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
3346de8e2ae1bfde250c7ac5c06f79a0a60c7faef8e5e08a2c9e8fbf5ec2c9e8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Strict-Transport-Security
max-age=31536000; includeSubDomains; preload
Content-Encoding
gzip
X-Content-Type-Options
nosniff
P3P
CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Connection
keep-alive
Content-Length
2183
X-XSS-Protection
1; mode=block
Pragma
no-cache
Last-Modified
Mon, 18 Jan 2021 21:49:34 GMT
Date
Fri, 16 Apr 2021 11:19:35 GMT
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
no-cache, no-store
ETag
"22d33ecfe3edd61:0"
Accept-Ranges
bytes
Expires
Fri, 16 Apr 2021 11:19:35 GMT
0
bat.bing.com/action/
0
171 B
Image
General
Full URL
https://bat.bing.com/action/0?ti=5476211&Ver=2&mid=538c8d15-0960-433c-a7f5-6eb137bc0847&sid=9fe475809ea511eb860b1380f6650e36&vid=9fe50ae09ea511eb8239ad26848453f2&vids=1&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=Malicious%20PowerShell%20Use,%20Attacks%20on%20Office%20365%20...&p=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&r=&lt=3695&evt=pageLoad&msclkid=N&sv=1&rn=164658
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

access-control-allow-origin
*
pragma
no-cache
date
Fri, 16 Apr 2021 11:19:34 GMT
cache-control
no-cache, must-revalidate
x-msedge-ref
Ref A: 3F6727ED7C7849AA89C6273364ED2351 Ref B: FRAEDGE1209 Ref C: 2021-04-16T11:19:35Z
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel.gif
px.moatads.com/
43 B
260 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&wf=1&pxm=6&vb=13&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=1&ak=https%3A%2F%2Ftpc.googlesyndication.com%2Fsimgad%2F5855809953972538087&i=PENTONMEDIA1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-nwvw4053N9oCRb36FcojwKWkUwdJEJMXJKBAOq%2BVT%2Bl2tvnQIIWF3cA%2B&sc=1&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&bq=0&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&id=1&ii=4&f=0&j=&t=1618571974817&de=110898614312&cu=1618571974817&m=34&ar=e4967b0-clean&iw=64bab64&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=3675&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A2157%3A2291%3A0%3A0&as=0&ag=5&an=0&gf=5&gg=0&ix=5&ic=5&ez=1&aj=1&pg=100&pf=0&ib=0&cc=0&bw=5&bx=0&dj=1&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=10&cd=0&ah=10&am=0&rf=0&re=0&wb=1&cl=0&at=0&d=5003554797%3A2837012561%3A5656213172%3A138344902208&bo=22316126855&bp=22326604369&bd=rec1&zMoatPS=rec1&gw=pentonmedia53440730609&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22326604369&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22326604369&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685&zMoatDev=Desktop&zMoatDfpSlotId=div-gpt-ad-961777897907396673-4&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=div-gpt-ad-961777897907396673-4&iq=na&tt=na&tc=0&fs=189983&na=2043899239&cs=0
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 16 Apr 2021 11:19:35 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Fri, 16 Apr 2021 11:19:35 GMT
truncated
/ Frame D0E4
213 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
abbb2b30d5425bca142b54a15b7d356967e6156d2404af3e21286682a735fc23

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/png
activeview
pagead2.googlesyndication.com/pcs/ Frame CFDB
42 B
501 B
Fetch
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjst3Y5BJ-tD29AOQNjD-l1ryZ8q4dGx2AMQgCY4n8F8Leyx1ZMYgXN8B2sg7m92C5TC6j0y15w20uTNSH_pO15ICX7UoKLbdglRu-hwZHHE&sig=Cg0ArKJSzDsPLh4JpP3SEAE&id=lidar2&mcvt=1096&p=96,436,186,1164&mtos=1096,1096,1096,1096,1096&tos=1096,0,0,0,0&v=20210414&bin=7&avms=nio&bs=1600,1200&mc=1&app=0&itpl=3&adk=1422973645&rs=4&met=mue&la=0&cr=0&osd=1&vs=4&rst=1618571974187&dlt=0&rpt=625&isd=0&msd=0&r=v&uup=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 16 Apr 2021 11:19:35 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
analytics.js
www.google-analytics.com/
48 KB
19 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-WJ9RHF7
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
f79723478f4c48501cd49ac52b81d6244a6562b9d3f08ce8ab208a8b8878d4c4
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 19 Mar 2021 19:22:18 GMT
server
Golfe2
age
1581
date
Fri, 16 Apr 2021 10:53:14 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
19463
expires
Fri, 16 Apr 2021 12:53:14 GMT
Cookie set login.jsp
ng.techweb.com/authds/login/ Frame DBFA
2 KB
1 KB
Document
General
Full URL
https://ng.techweb.com/authds/login/login.jsp?type=iframe&cdsocket_client=https://www.darkreading.com/cdsocket_proxy.html
Requested by
Host: img.deusm.com
URL: https://img.deusm.com/darkreading/JQuery_Library/Jquery_3.4.1.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:103::192:155:48:119 , United States, ASN19994 (RACKSPACE, US),
Reverse DNS
Software
NG /
Resource Hash
39a2101bf98ddbf20a63d714bde3adeb9dda9412bebcb3958d21c491d9e824cf

Request headers

Host
ng.techweb.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.darkreading.com/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://www.darkreading.com/

Response headers

Set-Cookie
JSESSIONID=00B6BA3F08376374FC8DCDB5F26FDE22; Path=/; Secure; HttpOnly
vary
accept-encoding
Content-Type
text/html;charset=ISO-8859-1
Content-Length
755
Date
Fri, 16 Apr 2021 11:19:35 GMT
Server
NG
Content-Encoding
gzip
Connection
Keep-Alive
activeview
pagead2.googlesyndication.com/pcs/ Frame A679
42 B
64 B
Fetch
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsv1A_x9688p1OP9xpslcruI0iHMulgsaXM4y1I35BwdoQ3vvzSrKXW8EmzsJrk6UBRUGpP8wKa2isSDfhLtZevvw1ls-qIJ_Pl9lUmH0YM&sig=Cg0ArKJSzMr9mfP-10OOEAE&id=lidar2&mcvt=1071&p=459,960,709,1260&mtos=1071,1071,1071,1071,1071&tos=1071,0,0,0,0&v=20210414&bin=7&avms=nio&bs=1600,1200&mc=1&app=0&itpl=3&adk=1197776952&rs=4&met=mue&la=0&cr=0&osd=1&vs=4&rst=1618571974218&dlt=0&rpt=638&isd=0&msd=0&r=v&uup=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 16 Apr 2021 11:19:35 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
www.facebook.com/tr/
0
15 B
Ping
General
Full URL
https://www.facebook.com/tr/
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f12d:83:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
multipart/form-data; boundary=----WebKitFormBoundaryxhkvFmkRZnh5LTgd

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
server
proxygen-bolt
date
Fri, 16 Apr 2021 11:19:35 GMT
content-type
text/plain
access-control-allow-origin
https://www.darkreading.com
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
content-length
0
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
priority
u=3,i
pixel.gif
px.moatads.com/
43 B
260 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=PENTONMEDIA1&hp=1&wf=1&pxm=6&vb=13&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1618571974860&de=113213272367&m=0&ar=e4967b0-clean&iw=64bab64&q=11&cb=0&ym=0&cu=1618571974860&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=5004235589%3A2837984555%3A5657449612%3A138345261839&zMoatPS=top&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685&zMoatDev=Desktop&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&id=1&ii=4&bo=22316126855&bp=22326604369&bd=top&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22326604369&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22326604369&gw=pentonmedia53440730609&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A2157%3A2291%3A0%3A0&iq=na&tt=na&fs=189983&na=1933654707&cs=0
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 16 Apr 2021 11:19:35 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Fri, 16 Apr 2021 11:19:35 GMT
teads-format.min.js
s8t.teads.tv/media/format/v3/
604 KB
132 KB
Script
General
Full URL
https://s8t.teads.tv/media/format/v3/teads-format.min.js
Requested by
Host: a.teads.tv
URL: https://a.teads.tv/page/122239/tag
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:6c00:1ba::26e5 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
65f0552fdc11b004b576ad2ab17477aa0d7ee2306f3d1645f0880f3c944397ab

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:35 GMT
content-encoding
br
vary
Accept-Encoding
x-amz-request-id
DW610MRE9G426QXH
content-length
134295
x-amz-id-2
XE7rh+D7befUuOuhecNnvD0b58M/hD4iacvJtwab2JmsKt8oZYiQKXvu2Wiak+v4ovOizrMfHPA=
last-modified
Thu, 15 Apr 2021 06:25:15 GMT
etag
"02c0e1fb774a05f1c6658b829f8e50ed"
access-control-max-age
86400
access-control-allow-methods
GET,POST
content-type
text/javascript;charset=utf-8
access-control-allow-origin
*
cache-control
private, must-revalidate, max-age=1800, no-transform
access-control-allow-credentials
false
x-bucket
8
accept-ranges
bytes
access-control-allow-headers
*
expires
Fri, 16 Apr 2021 11:49:35 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame 9844
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsum3Sb-PiwKP_uLZfEYCc9zinEIwjzEONUaIzV5D8n-JIStzlCQTUfhgyrbjWs6SD9n91r8JvmQBrkJm0h6tR2dYNo7DIyPh3BEYezWKUqecePHZwg7kCshrsDtqhpFDjpXsgWqAplYi_opLftV7I-t1fD9wQh64lMlFOem52_oJGeyNyfK9Jm0U3QHTi1vjKnwVdRHCSSa0IZoTrY8iSYnFLWkk2aqk6LqJzdN6j3ydJDflARgaBbly4gpM-HxEGlTz5CUmAIS108WHIoxnTBG1GvOp9AtHLRleUOV1XPMxnajsoBKlLs6IkfyVG6dzD8AePr-NvocHD1wHPgim3CdVg&sai=AMfl-YQ3if9YXosjJnTYq35vQhZkRSa3jGrBFrRTtStCmNIyKxE1SKJtDROkphJnDmkIEF0eRzQ0FsUWivuVNRpqbvhCt7__gMvXe51LiWmnFA&sig=Cg0ArKJSzH5sCNc6tLSnEAE&urlfix=1&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
172.217.16.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s46-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 16 Apr 2021 11:19:35 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Fri, 16 Apr 2021 11:19:35 GMT
2199513255885170303
tpc.googlesyndication.com/simgad/
274 KB
274 KB
Image
General
Full URL
https://tpc.googlesyndication.com/simgad/2199513255885170303?
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
d15ed222053e330046feca6220de0d53b7c87713caabfc53f233eb2a9f7abe6a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 12 Apr 2021 09:37:16 GMT
x-content-type-options
nosniff
age
351739
x-dns-prefetch-control
off
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
280201
x-xss-protection
0
last-modified
Wed, 31 Mar 2021 14:34:07 GMT
server
sffe
content-type
image/png
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 12 Apr 2022 09:37:16 GMT
view
securepubads.g.doubleclick.net/pcs/ Frame D0E4
0
0
Fetch
General
Full URL
https://securepubads.g.doubleclick.net/pcs/view?xai=AKAOjsvNa3GQV4BSMqucE9qYmDA8cz93Z1eX9xg8guOLRXyuYVX5PK8q4vAYf3o8J3WTpSc03B6_N5ZZE6G1PaLopfq2yIoVLR_VGvge5N-3acrEyl_osQAIZcYfvDJapE1GhrThOuTRcC3YTUHNFyudILWzQm-6_agJC_mNwEU8tohW7baEuR1qZO-f8Fnwxy8N2udoFC8p1ylaBFpb8X2i6lHIi3ZXV_dA4u0j61fVfBBs7rf4ff81vCgJZvu-OZN5tvkeJ1-X6UZHR1M1i5B4OBWFw6z1sHcH4rdtBb8nj7yo2wwppaKUXm-OU8hnJ5Z2XSo7dWm_PgE20yxLQ6rCjtzVXw&sai=AMfl-YTTPCxTUIWA7GkWyWDNijHI4kcyFf2XV_ZvFgtzA3woLX8CQ_1WCcweqNZTlhrpabD5YfoZue8gWZA_5y38yiK5YbAiWrowPWMf4PEAbA&sig=Cg0ArKJSzPVuEHd3eNq-EAE&urlfix=1&adurl=
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
172.217.16.130 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
fra15s46-in-f2.1e100.net
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 16 Apr 2021 11:19:35 GMT
x-content-type-options
nosniff
accept-ch
Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Full-Version
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
server
cafe
expires
Fri, 16 Apr 2021 11:19:35 GMT
collect
www.google-analytics.com/j/
2 B
22 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j89&a=890355587&t=pageview&_s=1&dl=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&dp=%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685&ul=en-us&de=windows-1252&dt=Malicious%20PowerShell%20Use%2C%20Attacks%20on%20Office%20365%20...&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YAhAAEADQAAAAC~&jid=330191558&gjid=1836787574&cid=1190363706.1618571974&tid=UA-135180592-2&_gid=1205370757.1618571976&_r=1&gtm=2wg472WJ9RHF7&cd1=news%20analysis&cd2=jai%20vijayan&cd3=1&cd4=null&cd5=20210415&cd6=perimeter%20-%20perimeter&cd9=not%20set&cd10=0&cd11=Malicious%20PowerShell%20Use%2C%20Attacks%20on%20Office%20365%20Accounts%20Surged%20in%20Q4&cd14=rss_x_drr_edt_aud_dr_x_x-rss-simple&cd16=1340685&cd17=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&z=1358063078
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Fri, 16 Apr 2021 11:19:35 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://www.darkreading.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
js
www.google-analytics.com/gtm/
87 KB
34 KB
Script
General
Full URL
https://www.google-analytics.com/gtm/js?id=OPT-W6LRXN3&t=gtm34&cid=1190363706.1618571974
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
c24fe1d23eb18570fb3b93b456b2a7da6a6e9609a1e84b1d257ef62ff7ca068c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:35 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
34772
x-xss-protection
0
last-modified
Fri, 16 Apr 2021 09:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Fri, 16 Apr 2021 11:19:35 GMT
OqOE21UvWe3.png
static.xx.fbcdn.net/rsrc.php/v3/y5/r/ Frame 68C9
400 B
670 B
Image
General
Full URL
https://static.xx.fbcdn.net/rsrc.php/v3/y5/r/OqOE21UvWe3.png
Requested by
Host: www.facebook.com
URL: https://www.facebook.com/plugins/like.php?app_id=640989409269461&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df3b1c3c5daf49a%26domain%3Dwww.darkreading.com%26origin%3Dhttps%253A%252F%252Fwww.darkreading.com%252Ff29f6f44e0fede%26relation%3Dparent.parent&container_width=0&href=http%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685&layout=button&locale=en_US&sdk=joey&send=false&show_faces=false&width=87
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
ed91fbb0cd9308f91f8e1fd93942c94ee850fc4161ed788b16f801b743c70b9b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.facebook.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-fb-debug
WYmiIDTmjlQg8mhp/sNR2V34SjOBWaDHIQhWiwPRjrHn525NbtLRSw/uk7n12GpMu8z2qRGJ10oy7He5V92HOQ==
x-fb-trip-id
917726464
x-content-type-options
nosniff
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
content-md5
uF0RL4E+h23ClLQmPOTTMw==
date
Fri, 16 Apr 2021 11:19:35 GMT
content-type
image/png
access-control-allow-origin
*
cache-control
public,max-age=31536000,immutable
cross-origin-resource-policy
cross-origin
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
400
x-fb-rlafr
0
expires
Fri, 08 Apr 2022 21:17:01 GMT
18_Jf4ZwCu4.js
static.xx.fbcdn.net/rsrc.php/v3iEpO4/yl/l/en_US/ Frame 68C9
481 KB
125 KB
XHR
General
Full URL
https://static.xx.fbcdn.net/rsrc.php/v3iEpO4/yl/l/en_US/18_Jf4ZwCu4.js?_nc_x=Ij3Wp8lg5Kz
Requested by
Host: www.facebook.com
URL: https://www.facebook.com/plugins/like.php?app_id=640989409269461&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df3b1c3c5daf49a%26domain%3Dwww.darkreading.com%26origin%3Dhttps%253A%252F%252Fwww.darkreading.com%252Ff29f6f44e0fede%26relation%3Dparent.parent&container_width=0&href=http%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685&layout=button&locale=en_US&sdk=joey&send=false&show_faces=false&width=87
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f02d:12:face:b00c:0:3 , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
dc5ddc93ea153c05202bb974dbd591cf30ce83474d1d24aa30d5740e20955c8d
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.facebook.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:35 GMT
content-encoding
br
x-content-type-options
nosniff
content-md5
CtARvuHzcGTLtMIE4muLag==
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length
127361
x-fb-rlafr
0
x-fb-debug
NlAfpcIwodyxi+AFS/0egDjjgONrAZHWDb+AfmTX2XB7sKjci49drHkgd8GOBox0vMln0IZ6kamW0KYtY/w1uA==
x-fb-trip-id
2050670934
last-modified
Mon, 01 Jan 2001 08:00:00 GMT
vary
Accept-Encoding
content-type
application/x-javascript; charset=utf-8
access-control-allow-origin
*
cache-control
public,max-age=31536000,immutable
timing-allow-origin
*
priority
u=3,i
expires
Sat, 16 Apr 2022 02:36:31 GMT
svrGP.aspx
trk.darkreading.com/visitor/v200/
Redirect Chain
  • https://trk.darkreading.com/visitor/v200/svrGP?pps=3&siteid=2150&ref2=elqNone&tzo=-60&ms=775&optin=disabled&firstPartyCookieDomain=trk.darkreading.com
  • https://trk.darkreading.com/visitor/v200/svrGP.aspx?pps=3&siteid=2150&ref2=elqNone&tzo=-60&ms=775&optin=disabled&elq1pcGUID=C5D86127639C44BDAE09CAF9E52DDDF0
49 B
525 B
Image
General
Full URL
https://trk.darkreading.com/visitor/v200/svrGP.aspx?pps=3&siteid=2150&ref2=elqNone&tzo=-60&ms=775&optin=disabled&elq1pcGUID=C5D86127639C44BDAE09CAF9E52DDDF0
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
142.0.173.134 , United States, ASN7160 (NETDYNAMICS, US),
Reverse DNS
Software
/
Resource Hash
f1ccea6b7204d9f7913ab45e1afa51d79f83bd4f0319de937b0132e6e02b1aab
Security Headers
Name Value
Strict-Transport-Security max-age=31536000;
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Strict-Transport-Security
max-age=31536000;
X-Content-Type-Options
nosniff
Date
Fri, 16 Apr 2021 11:19:35 GMT
P3P
CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Cache-Control
private,no-store
Content-Type
image/gif
Content-Length
49
X-XSS-Protection
1; mode=block
Expires
-1

Redirect headers

Pragma
no-cache
Strict-Transport-Security
max-age=31536000;
X-Content-Type-Options
nosniff
Date
Fri, 16 Apr 2021 11:19:35 GMT
P3P
CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Location
https://trk.darkreading.com/visitor/v200/svrGP.aspx?pps=3&siteid=2150&ref2=elqNone&tzo=-60&ms=775&optin=disabled&elq1pcGUID=C5D86127639C44BDAE09CAF9E52DDDF0
Cache-Control
no-store
Content-Type
text/html; charset=utf-8
Content-Length
297
X-XSS-Protection
1; mode=block
Expires
-1
eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNjE4NTcxOTc0eDIwNjMzNWVlNWRhOGNmeDk2NzQ2MzkyIiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIwNTU0Mjc4NzEwNjYzMjA3NDQiLCJpbmRle...
track.celtra.com/json/
35 B
242 B
Image
General
Full URL
https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNjE4NTcxOTc0eDIwNjMzNWVlNWRhOGNmeDk2NzQ2MzkyIiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIwNTU0Mjc4NzEwNjYzMjA3NDQiLCJpbmRleCI6MCwiY2xpZW50VGltZXN0YW1wIjoxNjE4NTcxOTc1Ljc1NSwibmFtZSI6ImNvbnRhaW5lckJlY2FtZVZpZXdhYmxlIn1dfQ==?crc32c=1495345997
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.184.103.42 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 16 Apr 2021 11:19:35 GMT
Cache-Control
no-cache, no-store, must-revalidate
Expires
0
Connection
keep-alive
Content-Length
35
Content-Type
image/gif
collect
stats.g.doubleclick.net/j/
1 B
446 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j89&tid=UA-135180592-2&cid=1190363706.1618571974&jid=330191558&gjid=1836787574&_gid=1205370757.1618571976&_u=YAhAAEACQAAAAC~&z=1863615267
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c0c::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Fri, 16 Apr 2021 11:19:35 GMT
content-type
text/plain
access-control-allow-origin
https://www.darkreading.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
1
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel.gif
px.moatads.com/
43 B
260 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&wf=1&pxm=6&vb=13&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=1&ak=https%3A%2F%2Ftpc.googlesyndication.com%2Fsimgad%2F4255144792188325878&i=PENTONMEDIA1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-nwvw4053N9oCRb36FcojwKWkUwdJEJMXJKBAOq%2BVT%2Bl2tvnQIIWF3cA%2B&sc=1&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&bq=0&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&id=1&ii=4&f=0&j=&t=1618571974860&de=113213272367&cu=1618571974860&m=15&ar=e4967b0-clean&iw=64bab64&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=3675&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A2157%3A2291%3A0%3A0&as=0&ag=3&an=0&gf=3&gg=0&ix=3&ic=3&ez=1&aj=1&pg=100&pf=0&ib=0&cc=0&bw=3&bx=0&dj=1&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=6&cd=0&ah=6&am=0&rf=0&re=0&wb=1&cl=0&at=0&d=5004235589%3A2837984555%3A5657449612%3A138345261839&bo=22316126855&bp=22326604369&bd=top&zMoatPS=top&gw=pentonmedia53440730609&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22326604369&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22326604369&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685&zMoatDev=Desktop&zMoatDfpSlotId=div-gpt-ad-961777897907396673-3&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=div-gpt-ad-961777897907396673-3&iq=na&tt=na&tc=0&fs=189983&na=1651197044&cs=0
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 16 Apr 2021 11:19:35 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Fri, 16 Apr 2021 11:19:35 GMT
track
t.teads.tv/
23 B
143 B
Image
General
Full URL
https://t.teads.tv/track?action=debug-bts&fv=722&ts=1618571975961&env=js-web&pageId=122239&pid=132771&auctid=f6c82bf4-640f-4450-8b99-e2ea68fdfaee&f=1&debug_metadata=wb&referer=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.108.145.75 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software
/
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:36 GMT
cache-control
max-age=0, no-cache, no-store
expires
Sat, 26 Jul 1997 05:00:00 GMT
content-length
23
content-type
image/gif
track
t.teads.tv/
23 B
113 B
Image
General
Full URL
https://t.teads.tv/track?action=placementCall&env=js-web&auctid=f6c82bf4-640f-4450-8b99-e2ea68fdfaee&pageId=122239&pid=132771&debug_metadata=RM2lZm6D24&fv=722&ts=1618571975964&f=1&referer=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.108.145.75 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software
/
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:36 GMT
cache-control
private, max-age=3666
content-length
23
content-type
image/gif
track
t.teads.tv/
23 B
143 B
Image
General
Full URL
https://t.teads.tv/track?action=slotAvailable&env=js-web&auctid=f6c82bf4-640f-4450-8b99-e2ea68fdfaee&pageId=122239&pid=132771&slot=polymorph&fv=722&ts=1618571975979&f=1&referer=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
104.108.145.75 Berlin, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
Software
/
Resource Hash
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:36 GMT
cache-control
max-age=0, no-cache, no-store
expires
Sat, 26 Jul 1997 05:00:00 GMT
content-length
23
content-type
image/gif
p
sb.scorecardresearch.com/
64 B
444 B
Image
General
Full URL
https://sb.scorecardresearch.com/p?c1=2&c2=17198971&ns_ap_sv=2.1511.10&ns_type=hidden&ns_st_it=a&ns_st_sv=4.0.0&ns_st_ad=1&ns_st_sq=1&ns_st_id=1618571975984&ns_st_ec=1&ns_st_cn=1&ns_st_ev=play&ns_st_ct=va00&ns_st_cl=0&ns_st_pt=0&c3=*null&c4=*null&c6=*null&ns_ts=02560089&cs_ucfr=
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.156.73 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-156-73.txl52.r.cloudfront.net
Software
/
Resource Hash
831b0d6cde4541d363bb7a67eb49010fc5fd717dda4b9c3187dd3207b1da56cd

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:36 GMT
via
1.1 960b0b60c4f1507c51c75d8f9ab0dc91.cloudfront.net (CloudFront)
x-amz-cf-pop
TXL52-C1
etag
W/"40-jHLN3x5dWpBzaQm4lkBmDWvrjrg"
x-cache
Miss from cloudfront
content-type
image/gif; charset=utf-8
content-length
64
x-amz-cf-id
GJpHPOXU3k2k87IlWgBhRSiWT6j1ke4Zc5-1JhhigPKhNpt7D5RRxw==
ad
a.teads.tv/page/122239/
496 B
550 B
XHR
General
Full URL
https://a.teads.tv/page/122239/ad?windowWidth=1600&windowHeight=1200&windowDepth=1&windowReferrerUrl=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&page=%7B%22id%22%3A122239%2C%22placements%22%3A%5B%7B%22id%22%3A132771%2C%22validity%22%3A%7B%22status%22%3Atrue%2C%22reasons%22%3A%5B%5D%7D%2C%22player%22%3A%7B%22width%22%3A489%2C%22height%22%3A275%7D%2C%22slotType%22%3A%22polymorph%22%7D%5D%2C%22gdpr_iab%22%3A%7B%22reason%22%3A220%2C%22status%22%3A22%2C%22consent%22%3A%22%22%2C%22apiVersion%22%3Anull%2C%22cmpId%22%3Anull%7D%2C%22segments%22%3A%7B%22permutive%22%3Anull%7D%7D&auctid=f6c82bf4-640f-4450-8b99-e2ea68fdfaee&formatVersion=722&env=js-web&netBw=9.2&ttfb=739
Requested by
Host: s8t.teads.tv
URL: https://s8t.teads.tv/media/format/v3/teads-format.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.51 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-51.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
a1397f944b7ef5b0b00bd9952e153b10150d2ae2bd39ee156bbc6ec57ad50966

Request headers

Accept
application/json; charset=UTF-8
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 16 Apr 2021 11:19:36 GMT
content-encoding
gzip
vary
Accept-Encoding
content-type
application/json
access-control-allow-origin
https://www.darkreading.com
cache-control
max-age=0, no-cache, no-store
access-control-allow-credentials
true
content-length
340
expires
Fri, 16 Apr 2021 11:19:36 GMT
settings
syndication.twitter.com/ Frame 2BDC
183 B
411 B
Fetch
General
Full URL
https://syndication.twitter.com/settings?session_id=cf424952853e72d8c957a4d0b4bbb626afc38f5b
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets/widget_iframe.63899b173766ee6f8a729a72b542b0fb.html?origin=https%3A%2F%2Fwww.darkreading.com
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.244.42.136 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ced34f591157438ef47695f979ac95f8758408e8d9b88e63aee8b382ec975785
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-response-time
119
date
Fri, 16 Apr 2021 11:19:36 GMT
content-encoding
gzip
last-modified
Fri, 16 Apr 2021 11:19:36 GMT
server
tsa_o
vary
Origin
content-type
application/json; charset=utf-8
access-control-allow-origin
https://platform.twitter.com
cache-control
must-revalidate, max-age=600
access-control-allow-credentials
true
x-connection-hash
b010fdcddc424606afaa94aa88c13692
strict-transport-security
max-age=631138519
content-length
152
pixel.gif
px.moatads.com/
43 B
260 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=PENTONMEDIA1&hp=1&wf=1&pxm=6&vb=13&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1618571974883&de=714013790740&m=0&ar=e4967b0-clean&iw=64bab64&q=15&cb=0&ym=0&cu=1618571974883&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=5003554797%3A2837012561%3A5656213172%3A138344901188&zMoatPS=TAPunit&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685&zMoatDev=Desktop&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&id=1&ii=4&bo=22316126855&bp=22326604369&bd=TAPunit&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22326604369&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22326604369&gw=pentonmedia53440730609&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A2157%3A2291%3A0%3A0&iq=na&tt=na&fs=189983&na=1525168345&cs=0
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 16 Apr 2021 11:19:36 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Fri, 16 Apr 2021 11:19:36 GMT
bib_red_square.png
img.deusm.com/darkreading/
281 B
932 B
Image
General
Full URL
https://img.deusm.com/darkreading/bib_red_square.png
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/styles/pano-framework.css?v1.27
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2606:4700:3034::6815:5581 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2b54640c4481464f755e4729d7f105f4decc25690afe59923aec5c739d178aed

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:36 GMT
cf-cache-status
HIT
nel
{"max_age":604800,"report_to":"cf-nel"}
age
2967
alt-svc
h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
281
cf-request-id
097c01756e00001776f20df000000001
last-modified
Fri, 08 May 2020 12:31:10 GMT
server
cloudflare
etag
"119-5a5222c0bdf80"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report?s=TjmNxL5XtmpAQUypvidHOBYPJ5NH4djCPm0eaqKWS2VCPwMtQ0SCe5VfFiUa5fMMxpLbP1b03ScCteflFNPwf9rdirYnJiuQSH37xOovbpdxNENzHyLHrrCr"}],"group":"cf-nel","max_age":604800}
content-type
image/png
accept-ranges
bytes
cf-ray
640d05024b861776-FRA
cavalry_endpoint.php
www.facebook.com/common/ Frame 68C9
67 B
97 B
Image
General
Full URL
https://www.facebook.com/common/cavalry_endpoint.php?t_cstart=1618571975752&t_start=1618571975752&t_domcontent=1618571975786&t_layout=1618571976067&t_onload=1618571976067&t_paint=1618571976067&t_creport=1618571976067&t_tti=1618571975786&lid=6951713700658193350-0
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f12d:83:face:b00c:0:25de , United States, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
Security Headers
Name Value
Content-Security-Policy default-src facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com data: blob: 'self';script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

Referer
https://www.facebook.com/plugins/like.php?app_id=640989409269461&channel=https%3A%2F%2Fstaticxx.facebook.com%2Fx%2Fconnect%2Fxd_arbiter%2F%3Fversion%3D46%23cb%3Df3b1c3c5daf49a%26domain%3Dwww.darkreading.com%26origin%3Dhttps%253A%252F%252Fwww.darkreading.com%252Ff29f6f44e0fede%26relation%3Dparent.parent&container_width=0&href=http%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685&layout=button&locale=en_US&sdk=joey&send=false&show_faces=false&width=87
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

content-security-policy
default-src facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com data: blob: 'self';script-src *.facebook.com *.fbcdn.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.com *.facebook.com fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com cdninstagram.com *.cdninstagram.com;connect-src *.facebook.com facebook.com *.fbcdn.net wss://*.facebook.com:* attachment.fbsbx.com blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c;
content-encoding
br
x-content-type-options
nosniff
x-xss-protection
0
alt-svc
h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
x-fb-rlafr
0
pragma
no-cache
x-fb-debug
8KsbsZ1GGdtduFt8xRE+fUf09MMPZO6vwObZrHtUGev01YwpZHVJ0YHhU6Ahxe2zQMcDLqas+9+t/LlTsTUx0Q==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
DENY
date
Fri, 16 Apr 2021 11:19:36 GMT
strict-transport-security
max-age=15552000; preload
report-to
{"group":"coep_report","max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}]}
content-type
image/png
vary
Accept-Encoding
cache-control
private, no-store, no-cache, must-revalidate
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
index.php
a.dpmsrv.com/dpmpxl/
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=datapoint_dmp&google_cm&ap_id=3095526004051790400&pixelIndex=0&_=1618571974970
  • https://a.dpmsrv.com/dpmpxl/index.php?q=dfp&ap_id=3095526004051790400&pixelIndex=0&_=1618571974970&google_gid=CAESEI0m-G1qVxKV4t_pIbOKNXE&google_cver=1
0
598 B
Script
General
Full URL
https://a.dpmsrv.com/dpmpxl/index.php?q=dfp&ap_id=3095526004051790400&pixelIndex=0&_=1618571974970&google_gid=CAESEI0m-G1qVxKV4t_pIbOKNXE&google_cver=1
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.229.100.58 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-229-100-58.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Access-Control-Max-Age
10
Access-Control-Allow-Methods
GET, POST, PUT, DELETE, OPTIONS
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Access-Control-Allow-Origin
*
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Type
text/javascript
Access-Control-Allow-Headers
content-type, accept
Content-Length
0
Expires
0

Redirect headers

pragma
no-cache
date
Fri, 16 Apr 2021 11:19:36 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://a.dpmsrv.com/dpmpxl/index.php?q=dfp&ap_id=3095526004051790400&pixelIndex=0&_=1618571974970&google_gid=CAESEI0m-G1qVxKV4t_pIbOKNXE&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
368
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
423396.gif
idsync.rlcdn.com/
0
66 B
Image
General
Full URL
https://idsync.rlcdn.com/423396.gif?partner_uid=3095526004051790400
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS
68.174.244.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:36 GMT
via
1.1 google
alt-svc
clear
content-length
0
pixel.gif
px.moatads.com/
43 B
260 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=PENTONMEDIA1&hp=1&wf=1&pxm=6&vb=13&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1618571974897&de=592398994267&m=0&ar=e4967b0-clean&iw=64bab64&q=19&cb=0&ym=0&cu=1618571974897&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=5004232994%3A2838439431%3A5658199367%3A138345856094&zMoatPS=native&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685&zMoatDev=Desktop&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&id=1&ii=4&bo=22316126855&bp=22326604369&bd=native&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22326604369&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22326604369&gw=pentonmedia53440730609&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A2157%3A2291%3A0%3A0&iq=na&tt=na&fs=189983&na=1738776783&cs=0
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 16 Apr 2021 11:19:36 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Fri, 16 Apr 2021 11:19:36 GMT
2_webfont.woff2
cache-ssl.celtra.com/api/fonts/google/Lato:400/ Frame 9DA8
3 KB
4 KB
Font
General
Full URL
https://cache-ssl.celtra.com/api/fonts/google/Lato:400/2_webfont.woff2?subset=CEORSU
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.156.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-156-95.txl52.r.cloudfront.net
Software
Apache /
Resource Hash
3ac40e4154f25f76b46e76ae64e2ca269d20ac3815e11d285bdf7018ae2876aa

Request headers

Origin
https://www.darkreading.com
Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 15 Apr 2021 13:00:17 GMT
via
1.1 varnish (Varnish/5.0), 1.1 b46ec6462593127fefb6ecac53956825.cloudfront.net (CloudFront)
age
80359
x-cache
Hit from cloudfront
content-length
3244
server
Apache
etag
"3ac40e4154f25f76b46e76ae64e2ca269d20ac3815e11d285bdf7018ae2876aa"
x-varnish
2566537 1068658
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=86400
access-control-allow-credentials
false
x-amz-cf-pop
TXL52-C1
accept-ranges
bytes
content-type
application/font-woff2
x-amz-cf-id
v8hEHKPzKZL0mMJJtCodk_QEDeo2-Haljd1lE_i5Rs3B1Pr_MpLw9A==
Cato-A-practical-guide-to-SASE-migration.jpg
cache-ssl.celtra.com/api/blobs/44bb836ad5a51055c6494dd6e514f6eff4f0c1992220c16a355b799f3d1e0606/ Frame 9DA8
3 KB
4 KB
Image
General
Full URL
https://cache-ssl.celtra.com/api/blobs/44bb836ad5a51055c6494dd6e514f6eff4f0c1992220c16a355b799f3d1e0606/Cato-A-practical-guide-to-SASE-migration.jpg?transform=crush&quality=85
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.156.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-156-95.txl52.r.cloudfront.net
Software
Apache /
Resource Hash
2c48b2701eb6dc2c6af31fc1383ea931e15e3ce6e3600b591e8f21ce038631b3

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 05 Mar 2021 03:14:05 GMT
via
1.1 varnish (Varnish/5.0), 1.1 f23d0814f3a7efcdd4936fa69b3d072b.cloudfront.net (CloudFront)
age
3657931
x-cache
Hit from cloudfront
content-length
3294
server
Apache
etag
"2c48b2701eb6dc2c6af31fc1383ea931e15e3ce6e3600b591e8f21ce038631b3"
x-varnish
6300977
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=31556926
access-control-allow-credentials
false
x-amz-cf-pop
TXL52-C1
accept-ranges
bytes
content-type
image/jpeg
x-amz-cf-id
B1k1fP358fbKMwAKVjj4YSCly5nLpObab5YVnK1vG76YVb7YPvdqlQ==
Cato-What-to-consider-before-renewing-your-SD-WAN.jpg
cache-ssl.celtra.com/api/blobs/1b2df40b4e28f42022041075989a47a7cf5109173a6ce216628f6b4578b51050/ Frame 9DA8
3 KB
4 KB
Image
General
Full URL
https://cache-ssl.celtra.com/api/blobs/1b2df40b4e28f42022041075989a47a7cf5109173a6ce216628f6b4578b51050/Cato-What-to-consider-before-renewing-your-SD-WAN.jpg?transform=crush&quality=85
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.156.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-156-95.txl52.r.cloudfront.net
Software
Apache /
Resource Hash
859e5d3c91a0c306dd09da1588a808bfe0ed6a1799b99166d2dc92a5ea5ef9cb

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 06:29:43 GMT
via
1.1 varnish (Varnish/5.0), 1.1 f23d0814f3a7efcdd4936fa69b3d072b.cloudfront.net (CloudFront)
age
6151793
x-cache
Hit from cloudfront
content-length
3295
server
Apache
etag
"859e5d3c91a0c306dd09da1588a808bfe0ed6a1799b99166d2dc92a5ea5ef9cb"
x-varnish
6261699
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=31556926
access-control-allow-credentials
false
x-amz-cf-pop
TXL52-C1
accept-ranges
bytes
content-type
image/jpeg
x-amz-cf-id
YVN3kcyxBOVYPhvl_JmdUrn8sepO39FVQvzVyqM0zx2vpWx9WoFqtQ==
Cato-The-network-for-whatevers-next0a0CXO-guide.jpg
cache-ssl.celtra.com/api/blobs/9e6d1354fcbc60bb2fcfec6cba06857e42e1896ee8fc6a73eead35d4428c1ce8/ Frame 9DA8
2 KB
2 KB
Image
General
Full URL
https://cache-ssl.celtra.com/api/blobs/9e6d1354fcbc60bb2fcfec6cba06857e42e1896ee8fc6a73eead35d4428c1ce8/Cato-The-network-for-whatevers-next0a0CXO-guide.jpg?transform=crush&quality=85
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.156.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-156-95.txl52.r.cloudfront.net
Software
Apache /
Resource Hash
f59a2838b82cdcf10230a26e85b3d8a05b0bc7ff15809bb421b84036b8e57826

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 26 Jan 2021 05:53:36 GMT
via
1.1 varnish (Varnish/5.0), 1.1 f23d0814f3a7efcdd4936fa69b3d072b.cloudfront.net (CloudFront)
age
6931560
x-cache
Hit from cloudfront
content-length
1768
server
Apache
etag
"f59a2838b82cdcf10230a26e85b3d8a05b0bc7ff15809bb421b84036b8e57826"
x-varnish
11325638
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=31556926
access-control-allow-credentials
false
x-amz-cf-pop
TXL52-C1
accept-ranges
bytes
content-type
image/jpeg
x-amz-cf-id
y_jEsMVrTaHYQK9YKv34XzAUdEYkuSUqRRKwLdGv1wWXt1WCtceQ6w==
Cato-MPLS-SD-WAN-and-SASE.jpg
cache-ssl.celtra.com/api/blobs/444b6ba6714ae25977c73e1db15996933002ce14819bed0a02f7e7cc65c4633b/ Frame 9DA8
3 KB
3 KB
Image
General
Full URL
https://cache-ssl.celtra.com/api/blobs/444b6ba6714ae25977c73e1db15996933002ce14819bed0a02f7e7cc65c4633b/Cato-MPLS-SD-WAN-and-SASE.jpg?transform=crush&quality=85
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.156.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-156-95.txl52.r.cloudfront.net
Software
Apache /
Resource Hash
9808e779e13edda22b810e64f1f0ed8e4da2b57c0c33fba5dfc64ead204938ca

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 12 Feb 2021 02:18:45 GMT
via
1.1 varnish (Varnish/5.0), 1.1 f23d0814f3a7efcdd4936fa69b3d072b.cloudfront.net (CloudFront)
age
5475651
x-cache
Hit from cloudfront
content-length
2653
server
Apache
etag
"9808e779e13edda22b810e64f1f0ed8e4da2b57c0c33fba5dfc64ead204938ca"
x-varnish
348712
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=31556926
access-control-allow-credentials
false
x-amz-cf-pop
TXL52-C1
accept-ranges
bytes
content-type
image/jpeg
x-amz-cf-id
hMscyHjDk5Zmuu9Q2hO9tZc30LhwEfkV3hwIs8aSVoC7qGY1e3-cZw==
Cato-The-dark-side-of-SD-WAN.jpg
cache-ssl.celtra.com/api/blobs/477686a195b7b9994076f84ca57a050b8faf0501e3a5272a86efa7cc32d1154f/ Frame 9DA8
1 KB
2 KB
Image
General
Full URL
https://cache-ssl.celtra.com/api/blobs/477686a195b7b9994076f84ca57a050b8faf0501e3a5272a86efa7cc32d1154f/Cato-The-dark-side-of-SD-WAN.jpg?transform=crush&quality=85
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.156.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-156-95.txl52.r.cloudfront.net
Software
Apache /
Resource Hash
14eca529c982c8e3ffb86113177b05886339d6fb8479f2a3bdf3e05d7413c397

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 06 Feb 2021 03:30:29 GMT
via
1.1 varnish (Varnish/5.0), 1.1 f23d0814f3a7efcdd4936fa69b3d072b.cloudfront.net (CloudFront)
age
5989746
x-cache
Hit from cloudfront
content-length
1450
server
Apache
etag
"14eca529c982c8e3ffb86113177b05886339d6fb8479f2a3bdf3e05d7413c397"
x-varnish
8627957 10825047
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=31556926
access-control-allow-credentials
false
x-amz-cf-pop
TXL52-C1
accept-ranges
bytes
content-type
image/jpeg
x-amz-cf-id
8Cx4qom_ulN8_DsRtVQ_vSzRdNnP21meTbwLHi8eHD1IrLnoml8PWg==
li_hover.png
cache-ssl.celtra.com/api/blobs/e3228348fc17573d7db7d135ba5cf60985157f70dae6643939d3a6686b2aa699/ Frame 9DA8
591 B
1 KB
Image
General
Full URL
https://cache-ssl.celtra.com/api/blobs/e3228348fc17573d7db7d135ba5cf60985157f70dae6643939d3a6686b2aa699/li_hover.png?transform=crush
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.156.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-156-95.txl52.r.cloudfront.net
Software
Apache /
Resource Hash
c19345a03fed44d267abbe2f427bdcd261aa86a447320f15f3eef8e121690794

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 02 Feb 2021 20:32:33 GMT
via
1.1 varnish (Varnish/5.0), 1.1 f23d0814f3a7efcdd4936fa69b3d072b.cloudfront.net (CloudFront)
age
6274023
x-cache
Hit from cloudfront
content-length
591
server
Apache
etag
"c19345a03fed44d267abbe2f427bdcd261aa86a447320f15f3eef8e121690794"
x-varnish
1889363 183234
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=31556926
access-control-allow-credentials
false
x-amz-cf-pop
TXL52-C1
accept-ranges
bytes
content-type
image/png
x-amz-cf-id
U6bvgimys_Jf4AvTiyLWRIDNKI-En0_KhHCiYz6_exyRpsPJwsnlVg==
li.png
cache-ssl.celtra.com/api/blobs/2e1d1ae5940fbdaa5f95c1c17393175faf02b27a8c6b37dca2419c70113760ab/ Frame 9DA8
585 B
1 KB
Image
General
Full URL
https://cache-ssl.celtra.com/api/blobs/2e1d1ae5940fbdaa5f95c1c17393175faf02b27a8c6b37dca2419c70113760ab/li.png?transform=crush
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.156.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-156-95.txl52.r.cloudfront.net
Software
Apache /
Resource Hash
d10a2d03c9fb4943f449b97d333b8d22990200afa70d13d5c1c23ad4d783200c

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 11 Feb 2021 01:07:15 GMT
via
1.1 varnish (Varnish/5.0), 1.1 f23d0814f3a7efcdd4936fa69b3d072b.cloudfront.net (CloudFront)
age
5566341
x-cache
Hit from cloudfront
content-length
585
server
Apache
etag
"d10a2d03c9fb4943f449b97d333b8d22990200afa70d13d5c1c23ad4d783200c"
x-varnish
17914272
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=31556926
access-control-allow-credentials
false
x-amz-cf-pop
TXL52-C1
accept-ranges
bytes
content-type
image/png
x-amz-cf-id
kNz7G1gJYFWufCo0uCrLKqIUVnnb3WmTWcxj7NiOPnMmUfCwmfA1kA==
fb_hover.png
cache-ssl.celtra.com/api/blobs/652ab50d0e331e4269bb4d847fcc5a5a4e3def07bb1ebca4d2d6fda889e52604/ Frame 9DA8
348 B
857 B
Image
General
Full URL
https://cache-ssl.celtra.com/api/blobs/652ab50d0e331e4269bb4d847fcc5a5a4e3def07bb1ebca4d2d6fda889e52604/fb_hover.png?transform=crush
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.156.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-156-95.txl52.r.cloudfront.net
Software
Apache /
Resource Hash
9250f0b586e89674ec647d8dfb6fe7aedcb588be13ebb6aeb1286efa9d3cfb39

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sun, 07 Feb 2021 07:04:56 GMT
via
1.1 varnish (Varnish/5.0), 1.1 f23d0814f3a7efcdd4936fa69b3d072b.cloudfront.net (CloudFront)
age
5890480
x-cache
Hit from cloudfront
content-length
348
server
Apache
etag
"9250f0b586e89674ec647d8dfb6fe7aedcb588be13ebb6aeb1286efa9d3cfb39"
x-varnish
5534847
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=31556926
access-control-allow-credentials
false
x-amz-cf-pop
TXL52-C1
accept-ranges
bytes
content-type
image/png
x-amz-cf-id
bsKmofqn9N0GplBZxvcAlMHiaDmacVL-KCAcSgmpuS_-TY7LrGbfuA==
fb.png
cache-ssl.celtra.com/api/blobs/44f24c3edfffb11dd41284fe3c7bddb08dc29236aa3509e3a243c10f9804b28d/ Frame 9DA8
348 B
858 B
Image
General
Full URL
https://cache-ssl.celtra.com/api/blobs/44f24c3edfffb11dd41284fe3c7bddb08dc29236aa3509e3a243c10f9804b28d/fb.png?transform=crush
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.156.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-156-95.txl52.r.cloudfront.net
Software
Apache /
Resource Hash
e9d0cab69a4c71df7a16b6ee6f99ea474423689c8eadd7aa62ce9cef3a48c395

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 30 Jan 2021 03:47:29 GMT
via
1.1 varnish (Varnish/5.0), 1.1 f23d0814f3a7efcdd4936fa69b3d072b.cloudfront.net (CloudFront)
age
6593527
x-cache
Hit from cloudfront
content-length
348
server
Apache
etag
"e9d0cab69a4c71df7a16b6ee6f99ea474423689c8eadd7aa62ce9cef3a48c395"
x-varnish
7236456
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=31556926
access-control-allow-credentials
false
x-amz-cf-pop
TXL52-C1
accept-ranges
bytes
content-type
image/png
x-amz-cf-id
UTxXS0ryoX2H89Pai0JUAXbPd41zLhaaVFnMAGr5Qhi2YycxuSW_1w==
tw.png
cache-ssl.celtra.com/api/blobs/9ad81786e386c3155cbc468769eddcc96e3e991156ad745860288c59c63a417c/ Frame 9DA8
781 B
1 KB
Image
General
Full URL
https://cache-ssl.celtra.com/api/blobs/9ad81786e386c3155cbc468769eddcc96e3e991156ad745860288c59c63a417c/tw.png?transform=crush
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.156.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-156-95.txl52.r.cloudfront.net
Software
Apache /
Resource Hash
308e134d9a0df8031a894aa2bb6e70515cb9db2403e3e568e7554ae69f474c96

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 08 Feb 2021 03:36:02 GMT
via
1.1 varnish (Varnish/5.0), 1.1 f23d0814f3a7efcdd4936fa69b3d072b.cloudfront.net (CloudFront)
age
5816614
x-cache
Hit from cloudfront
content-length
781
server
Apache
etag
"308e134d9a0df8031a894aa2bb6e70515cb9db2403e3e568e7554ae69f474c96"
x-varnish
15178631 16388712
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=31556926
access-control-allow-credentials
false
x-amz-cf-pop
TXL52-C1
accept-ranges
bytes
content-type
image/png
x-amz-cf-id
yie5lb5yghwhihFjx2ulpnOPBCBYwIrqrhO60CRRFqAsnq_ALvyFHQ==
tw_hover.png
cache-ssl.celtra.com/api/blobs/f0cccd681d168932db801410643c93f0df03370d5c638ab3e4a16e92b80b3aa0/ Frame 9DA8
777 B
1 KB
Image
General
Full URL
https://cache-ssl.celtra.com/api/blobs/f0cccd681d168932db801410643c93f0df03370d5c638ab3e4a16e92b80b3aa0/tw_hover.png?transform=crush
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.156.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-156-95.txl52.r.cloudfront.net
Software
Apache /
Resource Hash
1ace1b17e77ec3828eda87eb3fea3671ce2a0f706426fbd158873546c4f9366e

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sun, 07 Feb 2021 09:36:35 GMT
via
1.1 varnish (Varnish/5.0), 1.1 f23d0814f3a7efcdd4936fa69b3d072b.cloudfront.net (CloudFront)
age
5881381
x-cache
Hit from cloudfront
content-length
777
server
Apache
etag
"1ace1b17e77ec3828eda87eb3fea3671ce2a0f706426fbd158873546c4f9366e"
x-varnish
16352145 3331670
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=31556926
access-control-allow-credentials
false
x-amz-cf-pop
TXL52-C1
accept-ranges
bytes
content-type
image/png
x-amz-cf-id
dCD1-b72dZkH7QxlGaAwlBokjImJ6FMcXbY2SlqhpDgqaRWKAvv5ww==
cato%20logo%20may%202019.png
cache-ssl.celtra.com/api/blobs/8bfb25c6acdb73ae06a3f52712572df19f704535d1ada494ed276d41e8a3d453/ Frame 9DA8
4 KB
5 KB
Image
General
Full URL
https://cache-ssl.celtra.com/api/blobs/8bfb25c6acdb73ae06a3f52712572df19f704535d1ada494ed276d41e8a3d453/cato%20logo%20may%202019.png?transform=crush&quality=256
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.156.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-156-95.txl52.r.cloudfront.net
Software
Apache /
Resource Hash
c0ee68eddc8d57781bd2fa09a773b8f745694291098befbd296adc879c57bd98

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 11 Feb 2021 07:54:10 GMT
via
1.1 varnish (Varnish/5.0), 1.1 f23d0814f3a7efcdd4936fa69b3d072b.cloudfront.net (CloudFront)
age
5541926
x-cache
Hit from cloudfront
content-length
4372
server
Apache
etag
"c0ee68eddc8d57781bd2fa09a773b8f745694291098befbd296adc879c57bd98"
x-varnish
26485287
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=31556926
access-control-allow-credentials
false
x-amz-cf-pop
TXL52-C1
accept-ranges
bytes
content-type
image/png
x-amz-cf-id
SRmePXs_PhMyMNFYU-vu56akP6C9fnO6257YpWl_oS7hsThnJzRdYA==
pixel.gif
px.moatads.com/
43 B
260 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=PENTONMEDIA1&hp=1&wf=1&pxm=6&vb=13&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1618571975099&de=368686243207&m=0&ar=e4967b0-clean&iw=64bab64&q=23&cb=0&ym=0&cu=1618571975099&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=4858577417%3A2838057998%3A5656631199%3A138345615798&zMoatPS=rec2&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685&zMoatDev=Desktop&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&id=1&ii=4&bo=22316126855&bp=22326604369&bd=rec2&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22326604369&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22326604369&gw=pentonmedia53440730609&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A2157%3A2291%3A0%3A0&iq=na&tt=na&fs=189983&na=1073639604&cs=0
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 16 Apr 2021 11:19:36 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Fri, 16 Apr 2021 11:19:36 GMT
style.css
ng.techweb.com/authds/login/css/ Frame DBFA
26 KB
5 KB
Stylesheet
General
Full URL
https://ng.techweb.com/authds/login/css/style.css
Requested by
Host: ng.techweb.com
URL: https://ng.techweb.com/authds/login/login.jsp?type=iframe&cdsocket_client=https://www.darkreading.com/cdsocket_proxy.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:103::192:155:48:119 , United States, ASN19994 (RACKSPACE, US),
Reverse DNS
Software
NG /
Resource Hash
7ead23ac369cb17e84781bb0d0c104e02849ba9e7e6719906c565bc6404eff33

Request headers

Referer
https://ng.techweb.com/authds/login/login.jsp?type=iframe&cdsocket_client=https://www.darkreading.com/cdsocket_proxy.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 16 Apr 2021 11:19:35 GMT
Content-Encoding
gzip
Last-Modified
Thu, 25 Mar 2021 15:58:14 GMT
Server
NG
ETag
W/"26288-1616687894000"
vary
accept-encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Content-Length
4649
auth-login.css
ng.techweb.com/authds/login/css/ Frame DBFA
691 B
922 B
Stylesheet
General
Full URL
https://ng.techweb.com/authds/login/css/auth-login.css
Requested by
Host: ng.techweb.com
URL: https://ng.techweb.com/authds/login/login.jsp?type=iframe&cdsocket_client=https://www.darkreading.com/cdsocket_proxy.html
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:103::192:155:48:119 , United States, ASN19994 (RACKSPACE, US),
Reverse DNS
Software
NG /
Resource Hash
5738e8b5706cc09cf388010fd24feb6cc532ddc0ff14e9d8a8ab1463132e1d75

Request headers

Referer
https://ng.techweb.com/authds/login/login.jsp?type=iframe&cdsocket_client=https://www.darkreading.com/cdsocket_proxy.html
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 16 Apr 2021 11:19:35 GMT
Last-Modified
Thu, 25 Mar 2021 15:29:06 GMT
Server
NG
ETag
W/"691-1616686146000"
Vary
Accept-Encoding
Content-Type
text/css
Accept-Ranges
bytes
Content-Length
691
pixel.gif
px.moatads.com/
43 B
260 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&wf=1&pxm=6&vb=13&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=1&ak=https%3A%2F%2Ftpc.googlesyndication.com%2Fsimgad%2F8312837989510548350&i=PENTONMEDIA1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-nwvw4053N9oCRb36FcojwKWkUwdJEJMXJKBAOq%2BVT%2Bl2tvnQIIWF3cA%2B&sc=1&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&bq=0&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&id=1&ii=4&f=0&j=&t=1618571975099&de=368686243207&cu=1618571975099&m=20&ar=e4967b0-clean&iw=64bab64&cb=0&ym=0&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=3967&le=1&gm=1&io=1&vv=1&vw=1%3A3%3A0&vp=0&vx=0%3A-%3A-&pe=1%3A2157%3A2291%3A0%3A0&as=0&ag=0&an=0&gf=0&gg=0&ix=0&ic=0&pg=0&pf=0&ib=1&cc=0&bw=0&bx=0&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5&cd=0&ah=5&am=0&rf=0&re=0&wb=1&cl=0&at=0&d=4858577417%3A2838057998%3A5656631199%3A138345615798&bo=22316126855&bp=22326604369&bd=rec2&zMoatPS=rec2&gw=pentonmedia53440730609&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22326604369&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22326604369&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685&zMoatDev=Desktop&zMoatDfpSlotId=div-gpt-ad-961777897907396673-5&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&oq=0&ot=0&zMoatJS=3%3A-&ti=0&ih=1&tz=div-gpt-ad-961777897907396673-5&iq=na&tt=na&tc=0&fs=189983&na=748590358&cs=0
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 16 Apr 2021 11:19:36 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Fri, 16 Apr 2021 11:19:36 GMT
pixel.gif
px.moatads.com/
43 B
260 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=17&i=PENTONMEDIA1&hp=1&wf=1&pxm=6&vb=13&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&bq=0&f=0&j=&t=1618571975479&de=141510940196&m=0&ar=e4967b0-clean&iw=64bab64&q=27&cb=0&ym=0&cu=1618571975479&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=4448790601%3A2827245798%3A5653127970%3A138345413495&zMoatPS=video&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685&zMoatDev=Desktop&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&id=1&ii=4&bo=22316126855&bp=22326604369&bd=video&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22326604369&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22326604369&gw=pentonmedia53440730609&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A2157%3A2291%3A0%3A3640&iq=na&tt=na&fs=189983&na=1008564901&cs=0
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 16 Apr 2021 11:19:36 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Fri, 16 Apr 2021 11:19:36 GMT
moment~timeline.bcb1cafa923482f4826e32741fe16a98.js
platform.twitter.com/js/
25 KB
8 KB
Script
General
Full URL
https://platform.twitter.com/js/moment~timeline.bcb1cafa923482f4826e32741fe16a98.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
93.184.220.66 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (ska/F711) /
Resource Hash
5197134265816a7fc5bf360b151eccef4b22bad4b875f4314970860a2e1f2127

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 16 Apr 2021 11:19:36 GMT
Content-Encoding
gzip
Last-Modified
Thu, 15 Apr 2021 22:44:20 GMT
Server
ECS (ska/F711)
Age
41259
Etag
"16c9189d13c8dd38e3e003ac2c6bcc8f+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
8011
timeline.28ecda9667eeb8e1b18898b99fee6c31.js
platform.twitter.com/js/
20 KB
7 KB
Script
General
Full URL
https://platform.twitter.com/js/timeline.28ecda9667eeb8e1b18898b99fee6c31.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
93.184.220.66 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (ska/F6FC) /
Resource Hash
a5069082fd23bba93317d61fd6da244d6a85f60e68af7dcb9b0a43284f1d835a

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 16 Apr 2021 11:19:36 GMT
Content-Encoding
gzip
Last-Modified
Thu, 15 Apr 2021 22:44:20 GMT
Server
ECS (ska/F6FC)
Age
41254
Etag
"c0840e4754c01a08685ae9833ec830c8+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
6363
button.5573c974dc31bbdab5ea7923a0bd5cf3.js
platform.twitter.com/js/
7 KB
3 KB
Script
General
Full URL
https://platform.twitter.com/js/button.5573c974dc31bbdab5ea7923a0bd5cf3.js
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
93.184.220.66 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (ska/F6FC) /
Resource Hash
e05edf2ae58e3a9f1d2a84d32a8b216fd0aece46f527b58dcbce75255989ea88

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 16 Apr 2021 11:19:36 GMT
Content-Encoding
gzip
Last-Modified
Thu, 15 Apr 2021 22:44:19 GMT
Server
ECS (ska/F6FC)
Age
41259
Etag
"382be2960021b88f6ce982d997cdbd01+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Content-Length
2294
cato%20logo%20may%202019.png
cache-ssl.celtra.com/api/blobs/8bfb25c6acdb73ae06a3f52712572df19f704535d1ada494ed276d41e8a3d453/ Frame 9DA8
4 KB
5 KB
Image
General
Full URL
https://cache-ssl.celtra.com/api/blobs/8bfb25c6acdb73ae06a3f52712572df19f704535d1ada494ed276d41e8a3d453/cato%20logo%20may%202019.png?transform=crush&quality=256
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.156.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-156-95.txl52.r.cloudfront.net
Software
Apache /
Resource Hash
c0ee68eddc8d57781bd2fa09a773b8f745694291098befbd296adc879c57bd98

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 11 Feb 2021 07:54:10 GMT
via
1.1 varnish (Varnish/5.0), 1.1 f23d0814f3a7efcdd4936fa69b3d072b.cloudfront.net (CloudFront)
age
5541926
x-cache
Hit from cloudfront
content-length
4372
server
Apache
etag
"c0ee68eddc8d57781bd2fa09a773b8f745694291098befbd296adc879c57bd98"
x-varnish
26485287
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=31556926
access-control-allow-credentials
false
x-amz-cf-pop
TXL52-C1
accept-ranges
bytes
content-type
image/png
x-amz-cf-id
DZt34JkOQ3YLdgCCx2Y-Ev-BzN_jTHwjrB8wUx-BMkDdJjiVAmQQqg==
Cato-A-practical-guide-to-SASE-migration.jpg
cache-ssl.celtra.com/api/blobs/44bb836ad5a51055c6494dd6e514f6eff4f0c1992220c16a355b799f3d1e0606/ Frame 9DA8
3 KB
4 KB
Image
General
Full URL
https://cache-ssl.celtra.com/api/blobs/44bb836ad5a51055c6494dd6e514f6eff4f0c1992220c16a355b799f3d1e0606/Cato-A-practical-guide-to-SASE-migration.jpg?transform=crush&quality=85
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.156.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-156-95.txl52.r.cloudfront.net
Software
Apache /
Resource Hash
2c48b2701eb6dc2c6af31fc1383ea931e15e3ce6e3600b591e8f21ce038631b3

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 05 Mar 2021 03:14:05 GMT
via
1.1 varnish (Varnish/5.0), 1.1 f23d0814f3a7efcdd4936fa69b3d072b.cloudfront.net (CloudFront)
age
3657931
x-cache
Hit from cloudfront
content-length
3294
server
Apache
etag
"2c48b2701eb6dc2c6af31fc1383ea931e15e3ce6e3600b591e8f21ce038631b3"
x-varnish
6300977
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=31556926
access-control-allow-credentials
false
x-amz-cf-pop
TXL52-C1
accept-ranges
bytes
content-type
image/jpeg
x-amz-cf-id
K4T2qQn3WLp2nQcuYwz4tZFUcB_5zsbJarGcMNqC2JNCibtddpfb4Q==
Cato-What-to-consider-before-renewing-your-SD-WAN.jpg
cache-ssl.celtra.com/api/blobs/1b2df40b4e28f42022041075989a47a7cf5109173a6ce216628f6b4578b51050/ Frame 9DA8
3 KB
4 KB
Image
General
Full URL
https://cache-ssl.celtra.com/api/blobs/1b2df40b4e28f42022041075989a47a7cf5109173a6ce216628f6b4578b51050/Cato-What-to-consider-before-renewing-your-SD-WAN.jpg?transform=crush&quality=85
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.156.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-156-95.txl52.r.cloudfront.net
Software
Apache /
Resource Hash
859e5d3c91a0c306dd09da1588a808bfe0ed6a1799b99166d2dc92a5ea5ef9cb

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 04 Feb 2021 06:29:43 GMT
via
1.1 varnish (Varnish/5.0), 1.1 f23d0814f3a7efcdd4936fa69b3d072b.cloudfront.net (CloudFront)
age
6151793
x-cache
Hit from cloudfront
content-length
3295
server
Apache
etag
"859e5d3c91a0c306dd09da1588a808bfe0ed6a1799b99166d2dc92a5ea5ef9cb"
x-varnish
6261699
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=31556926
access-control-allow-credentials
false
x-amz-cf-pop
TXL52-C1
accept-ranges
bytes
content-type
image/jpeg
x-amz-cf-id
7zb4K6ytSh4EeGpehwXZPzn6HxEVfp8Hu6csndqilkczAPr5cn4izQ==
Cato-The-network-for-whatevers-next0a0CXO-guide.jpg
cache-ssl.celtra.com/api/blobs/9e6d1354fcbc60bb2fcfec6cba06857e42e1896ee8fc6a73eead35d4428c1ce8/ Frame 9DA8
2 KB
2 KB
Image
General
Full URL
https://cache-ssl.celtra.com/api/blobs/9e6d1354fcbc60bb2fcfec6cba06857e42e1896ee8fc6a73eead35d4428c1ce8/Cato-The-network-for-whatevers-next0a0CXO-guide.jpg?transform=crush&quality=85
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.156.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-156-95.txl52.r.cloudfront.net
Software
Apache /
Resource Hash
f59a2838b82cdcf10230a26e85b3d8a05b0bc7ff15809bb421b84036b8e57826

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Tue, 26 Jan 2021 05:53:36 GMT
via
1.1 varnish (Varnish/5.0), 1.1 f23d0814f3a7efcdd4936fa69b3d072b.cloudfront.net (CloudFront)
age
6931560
x-cache
Hit from cloudfront
content-length
1768
server
Apache
etag
"f59a2838b82cdcf10230a26e85b3d8a05b0bc7ff15809bb421b84036b8e57826"
x-varnish
11325638
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=31556926
access-control-allow-credentials
false
x-amz-cf-pop
TXL52-C1
accept-ranges
bytes
content-type
image/jpeg
x-amz-cf-id
Dr7fef3LjmuPzimZomUUqHL4vu2vj8uPyfwZboOXm_HHq0XXwShs_g==
Cato-MPLS-SD-WAN-and-SASE.jpg
cache-ssl.celtra.com/api/blobs/444b6ba6714ae25977c73e1db15996933002ce14819bed0a02f7e7cc65c4633b/ Frame 9DA8
3 KB
3 KB
Image
General
Full URL
https://cache-ssl.celtra.com/api/blobs/444b6ba6714ae25977c73e1db15996933002ce14819bed0a02f7e7cc65c4633b/Cato-MPLS-SD-WAN-and-SASE.jpg?transform=crush&quality=85
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.156.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-156-95.txl52.r.cloudfront.net
Software
Apache /
Resource Hash
9808e779e13edda22b810e64f1f0ed8e4da2b57c0c33fba5dfc64ead204938ca

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 12 Feb 2021 02:18:45 GMT
via
1.1 varnish (Varnish/5.0), 1.1 f23d0814f3a7efcdd4936fa69b3d072b.cloudfront.net (CloudFront)
age
5475651
x-cache
Hit from cloudfront
content-length
2653
server
Apache
etag
"9808e779e13edda22b810e64f1f0ed8e4da2b57c0c33fba5dfc64ead204938ca"
x-varnish
348712
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=31556926
access-control-allow-credentials
false
x-amz-cf-pop
TXL52-C1
accept-ranges
bytes
content-type
image/jpeg
x-amz-cf-id
VYX0IMcdEl0HlCGlOXwG0hzNoBnp4TIiK-Sx7P9j9eZWbaiOMN374w==
Cato-The-dark-side-of-SD-WAN.jpg
cache-ssl.celtra.com/api/blobs/477686a195b7b9994076f84ca57a050b8faf0501e3a5272a86efa7cc32d1154f/ Frame 9DA8
1 KB
2 KB
Image
General
Full URL
https://cache-ssl.celtra.com/api/blobs/477686a195b7b9994076f84ca57a050b8faf0501e3a5272a86efa7cc32d1154f/Cato-The-dark-side-of-SD-WAN.jpg?transform=crush&quality=85
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.156.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-156-95.txl52.r.cloudfront.net
Software
Apache /
Resource Hash
14eca529c982c8e3ffb86113177b05886339d6fb8479f2a3bdf3e05d7413c397

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 06 Feb 2021 03:30:29 GMT
via
1.1 varnish (Varnish/5.0), 1.1 f23d0814f3a7efcdd4936fa69b3d072b.cloudfront.net (CloudFront)
age
5989746
x-cache
Hit from cloudfront
content-length
1450
server
Apache
etag
"14eca529c982c8e3ffb86113177b05886339d6fb8479f2a3bdf3e05d7413c397"
x-varnish
8627957 10825047
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=31556926
access-control-allow-credentials
false
x-amz-cf-pop
TXL52-C1
accept-ranges
bytes
content-type
image/jpeg
x-amz-cf-id
uwu2_HbtAjioFkAEuAYIvJDAEeYHxanAk43FrZ7CtHkd6kmvV0bXBA==
li.png
cache-ssl.celtra.com/api/blobs/2e1d1ae5940fbdaa5f95c1c17393175faf02b27a8c6b37dca2419c70113760ab/ Frame 9DA8
585 B
1 KB
Image
General
Full URL
https://cache-ssl.celtra.com/api/blobs/2e1d1ae5940fbdaa5f95c1c17393175faf02b27a8c6b37dca2419c70113760ab/li.png?transform=crush
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.156.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-156-95.txl52.r.cloudfront.net
Software
Apache /
Resource Hash
d10a2d03c9fb4943f449b97d333b8d22990200afa70d13d5c1c23ad4d783200c

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 11 Feb 2021 01:07:15 GMT
via
1.1 varnish (Varnish/5.0), 1.1 f23d0814f3a7efcdd4936fa69b3d072b.cloudfront.net (CloudFront)
age
5566341
x-cache
Hit from cloudfront
content-length
585
server
Apache
etag
"d10a2d03c9fb4943f449b97d333b8d22990200afa70d13d5c1c23ad4d783200c"
x-varnish
17914272
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=31556926
access-control-allow-credentials
false
x-amz-cf-pop
TXL52-C1
accept-ranges
bytes
content-type
image/png
x-amz-cf-id
TkAnjP0mLxU0ZQaFxlvK7mntKl8iI-l0R39xKrMg1YQqcQl7UM-sfg==
fb.png
cache-ssl.celtra.com/api/blobs/44f24c3edfffb11dd41284fe3c7bddb08dc29236aa3509e3a243c10f9804b28d/ Frame 9DA8
348 B
851 B
Image
General
Full URL
https://cache-ssl.celtra.com/api/blobs/44f24c3edfffb11dd41284fe3c7bddb08dc29236aa3509e3a243c10f9804b28d/fb.png?transform=crush
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.156.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-156-95.txl52.r.cloudfront.net
Software
Apache /
Resource Hash
e9d0cab69a4c71df7a16b6ee6f99ea474423689c8eadd7aa62ce9cef3a48c395

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Sat, 30 Jan 2021 03:47:29 GMT
via
1.1 varnish (Varnish/5.0), 1.1 f23d0814f3a7efcdd4936fa69b3d072b.cloudfront.net (CloudFront)
age
6593527
x-cache
Hit from cloudfront
content-length
348
server
Apache
etag
"e9d0cab69a4c71df7a16b6ee6f99ea474423689c8eadd7aa62ce9cef3a48c395"
x-varnish
7236456
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=31556926
access-control-allow-credentials
false
x-amz-cf-pop
TXL52-C1
accept-ranges
bytes
content-type
image/png
x-amz-cf-id
g7nzTw9oXRJktIMV9nzSwfroWNmwUaElB2MIsFj0jgXnP7CKjd-UUQ==
tw.png
cache-ssl.celtra.com/api/blobs/9ad81786e386c3155cbc468769eddcc96e3e991156ad745860288c59c63a417c/ Frame 9DA8
781 B
1 KB
Image
General
Full URL
https://cache-ssl.celtra.com/api/blobs/9ad81786e386c3155cbc468769eddcc96e3e991156ad745860288c59c63a417c/tw.png?transform=crush
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
99.84.156.95 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-99-84-156-95.txl52.r.cloudfront.net
Software
Apache /
Resource Hash
308e134d9a0df8031a894aa2bb6e70515cb9db2403e3e568e7554ae69f474c96

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Mon, 08 Feb 2021 03:36:02 GMT
via
1.1 varnish (Varnish/5.0), 1.1 f23d0814f3a7efcdd4936fa69b3d072b.cloudfront.net (CloudFront)
age
5816614
x-cache
Hit from cloudfront
content-length
781
server
Apache
etag
"308e134d9a0df8031a894aa2bb6e70515cb9db2403e3e568e7554ae69f474c96"
x-varnish
15178631 16388712
access-control-allow-origin
*
access-control-expose-headers
Accept-Ranges, Content-Encoding, Content-Length, Content-Range, Content-Disposition
cache-control
max-age=31556926
access-control-allow-credentials
false
x-amz-cf-pop
TXL52-C1
accept-ranges
bytes
content-type
image/png
x-amz-cf-id
txCDwrHMfqYVytB-d_b82aIIeS6uaqjzn7vJniX5k5IgkTv3f0U4PQ==
eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNjE4NTcxOTc0eDIwNjMzNWVlNWRhOGNmeDk2NzQ2MzkyIiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIwNTU0Mjc4NzEwNjYzMjA3NDQiLCJpbmRle...
track.celtra.com/json/
35 B
242 B
Image
General
Full URL
https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNjE4NTcxOTc0eDIwNjMzNWVlNWRhOGNmeDk2NzQ2MzkyIiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIwNTU0Mjc4NzEwNjYzMjA3NDQiLCJpbmRleCI6MSwiY2xpZW50VGltZXN0YW1wIjoxNjE4NTcxOTc1Ljc5Nywic2NvcGUiOiJnbG9iYWwiLCJ1c2VyQWdlbnQiOiJNb3ppbGxhLzUuMCAoV2luZG93cyBOVCAxMC4wOyBXaW42NDsgeDY0KSBBcHBsZVdlYktpdC81MzcuMzYgKEtIVE1MLCBsaWtlIEdlY2tvKSBDaHJvbWUvODkuMC40Mzg5LjcyIFNhZmFyaS81MzcuMzYiLCJvcmllbnRhdGlvbiI6MCwidG9wbW9zdFJlYWNoYWJsZVdpbmRvdyI6eyJ3aWR0aCI6MTYwMCwiaGVpZ2h0IjoxMjAwfSwiaG9zdFdpbmRvdyI6eyJ3aWR0aCI6NSwiaGVpZ2h0Ijo1fSwibmVzdGluZyI6eyJpZnJhbWUiOnRydWUsImZyaWVuZGx5SWZyYW1lIjp0cnVlLCJpYWJGcmllbmRseUlmcmFtZSI6dHJ1ZSwiaG9zdGlsZUlmcmFtZSI6ZmFsc2UsImlmcmFtZURlcHRoIjoxfSwicGFnZVZpc2liaWxpdHlBcGkiOnRydWUsInJlcXVlc3RBbmltYXRpb25GcmFtZSI6dHJ1ZSwidG9wV2luZG93TmF0aXZlUkFGU3VwcG9ydGVkIjp0cnVlLCJhbGxvd05vbk5hdGl2ZVJBRkZvclZpZXdhYmxlVGltZVVzZWQiOmZhbHNlLCJjbGllbnRUaW1lWm9uZU9mZnNldEluTWludXRlcyI6LTEyMCwic3VwcG9ydHNDb250YWluZXJWaWV3YWJpbGl0eSI6dHJ1ZSwic3VwcG9ydHNDb250YWluZXJJbml0aWFsVmlld2FiaWxpdHkiOnRydWUsInRhZ1BhcmVudFdpZHRoIjowLCJ0YWdQYXJlbnRIZWlnaHQiOjAsImFtcERldGVjdGVkIjpmYWxzZSwiYW1wTmVzdGluZ0xldmVsIjoiIiwic2FmZUZyYW1lRGV0ZWN0ZWQiOmZhbHNlLCJmZXRjaFN1cHBvcnRlZCI6dHJ1ZSwiYXNhcEVuYWJsZWQiOm51bGwsIm5hdGl2ZVByb21pc2VzU3VwcG9ydGVkIjp0cnVlLCJiZWFjb25TdXBwb3J0ZWQiOnRydWUsIkludGVyc2VjdGlvbk9ic2VydmVyU3VwcG9ydGVkIjp0cnVlLCJpc011dGF0aW9uT2JzZXJ2ZXJTdXBwb3J0ZWQiOnRydWUsIndlYlZpZXciOm51bGwsImlzV2luZG93T3Blbk5hdGl2ZSI6dHJ1ZSwicHJvdG9Mb2FkaW5nIjp7ImRhdGFMb2FkU3RhdHVzIjoic3VwcG9ydGVkIiwiYmxvYkxvYWRTdGF0dXMiOiJzdXBwb3J0ZWQifSwidG9wV2luZG93TG9jYXRpb24iOiJodHRwczovL3d3dy5kYXJrcmVhZGluZy5jb20iLCJ0b3BXaW5kb3dMb2NhdGlvbkxlbmd0aCI6MjcsIm5hbWUiOiJlbnZpcm9ubWVudEluZm8ifSx7InNlc3Npb25JZCI6InMxNjE4NTcxOTc0eDIwNjMzNWVlNWRhOGNmeDk2NzQ2MzkyIiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIwNTU0Mjc4NzEwNjYzMjA3NDQiLCJpbmRleCI6MiwiY2xpZW50VGltZXN0YW1wIjoxNjE4NTcxOTc2LjMxNSwibmFtZSI6ImNyZWF0aXZlTG9hZGVkIiwidmlld2FiaWxpdHkwME1lYXN1cmFibGUiOnRydWUsInZpZXdhYmlsaXR5NTAxTWVhc3VyYWJsZSI6dHJ1ZSwidmlld2FibGVUaW1lTWVhc3VyYWJsZSI6dHJ1ZSwiY2RuVmFyaWFudCI6Im5vbmUifSx7InNlc3Npb25JZCI6InMxNjE4NTcxOTc0eDIwNjMzNWVlNWRhOGNmeDk2NzQ2MzkyIiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIwNTU0Mjc4NzEwNjYzMjA3NDQiLCJpbmRleCI6MywiY2xpZW50VGltZXN0YW1wIjoxNjE4NTcxOTc2LjM0MiwibmFtZSI6InZpZXdwb3J0UGxhY2VtZW50R2VvbWV0cnkiLCJwYWdlRGltZW5zaW9ucyI6eyJoZWlnaHQiOjU3NDIsIndpZHRoIjoxNjAwfSwidmlld3BvcnRQb3NpdGlvblJlY3QiOnsid2lkdGgiOjE2MDAsImhlaWdodCI6MTIwMCwibGVmdCI6MCwidG9wIjowfSwiZmlyc3RQbGFjZW1lbnRQb3NpdGlvblJlY3QiOnsibGVmdCI6OTQyLCJ0b3AiOjQzMy45MjE4NzUsIndpZHRoIjozMzYsImhlaWdodCI6NjAwfX1dfQ==?crc32c=979549233
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.184.103.42 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 16 Apr 2021 11:19:36 GMT
Cache-Control
no-cache, no-store, must-revalidate
Expires
0
Connection
keep-alive
Content-Length
35
Content-Type
image/gif
activeview
pagead2.googlesyndication.com/pcs/ Frame F5D2
42 B
108 B
Fetch
General
Full URL
https://pagead2.googlesyndication.com/pcs/activeview?xai=AKAOjsugmqfG7IGVPs5R_yOAxgI8we9PJgfeEHloWR83RmmXfKhXsHfKBt8s18oROJ-iFhnyWW-cPJzYRGOhlMCF6Q6UfxRqwnQMMA-PH5BD_jQ&sig=Cg0ArKJSzIesakpwJ8UTEAE&id=lidar2&mcvt=1026&p=358,300,360,301&mtos=1026,1026,1026,1026,1026&tos=1026,0,0,0,0&v=20210414&bin=7&avms=nio&bs=1600,1200&mc=1&app=0&itpl=19&adk=3539319411&rs=4&met=ce&la=0&cr=0&osd=1&vs=4&rst=1618571974181&dlt=0&rpt=630&isd=0&msd=0&r=v&uup=0
Requested by
Host: www.googletagservices.com
URL: https://www.googletagservices.com/activeview/js/current/rx_lidar.js?cache=r20110914
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 16 Apr 2021 11:19:36 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pixel.gif
px.moatads.com/
43 B
260 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=37&q=0&hp=1&wf=1&pxm=6&vb=13&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=1&ak=-&i=PENTONMEDIA1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-nwvw4053N9oCRb36FcojwKWkUwdJEJMXJKBAOq%2BVT%2Bl2tvnQIIWF3cA%2B&sc=1&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&id=1&ii=4&f=0&j=&t=1618571974860&de=113213272367&cu=1618571974860&m=1193&ar=e4967b0-clean&iw=64bab64&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=5142&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A2157%3A2291%3A0%3A0&as=1&ag=1184&an=3&gi=1&gf=1184&gg=3&ix=1184&ic=1184&ez=1&ck=1184&kw=914&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1184&bx=3&ci=1184&jz=914&dj=1&aa=1&ad=1017&cn=0&gn=1&gk=1017&gl=0&ik=1017&co=1017&cp=914&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=914&cd=6&ah=914&am=6&rf=0&re=1&ft=1017&fv=0&fw=1017&wb=1&cl=0&at=0&d=5004235589%3A2837984555%3A5657449612%3A138345261839&bo=22316126855&bp=22326604369&bd=top&zMoatPS=top&gw=pentonmedia53440730609&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22326604369&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22326604369&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685&zMoatDev=Desktop&zMoatDfpSlotId=div-gpt-ad-961777897907396673-3&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=div-gpt-ad-961777897907396673-3&iq=na&tt=na&tc=0&fs=189983&na=1950574318&cs=0
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 16 Apr 2021 11:19:36 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Fri, 16 Apr 2021 11:19:36 GMT
eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNjE4NTcxOTc0eDIwNjMzNWVlNWRhOGNmeDk2NzQ2MzkyIiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIwNTU0Mjc4NzEwNjYzMjA3NDQiLCJpbmRle...
track.celtra.com/json/
35 B
242 B
Image
General
Full URL
https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNjE4NTcxOTc0eDIwNjMzNWVlNWRhOGNmeDk2NzQ2MzkyIiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIwNTU0Mjc4NzEwNjYzMjA3NDQiLCJpbmRleCI6NCwiY2xpZW50VGltZXN0YW1wIjoxNjE4NTcxOTc2LjM3MSwibmFtZSI6InZpZXdhYmxlMDAiLCJjcml0ZXJpb24iOnsibmFtZSI6IkNvcmUiLCJyYXRpbyI6MCwidGltZSI6MH19LHsic2Vzc2lvbklkIjoiczE2MTg1NzE5NzR4MjA2MzM1ZWU1ZGE4Y2Z4OTY3NDYzOTIiLCJhY2NvdW50SWQiOiI0NGI3NGIzNSIsInN0cmVhbSI6ImFkRXZlbnRzIiwiaW5zdGFudGlhdGlvbiI6IjA1NTQyNzg3MTA2NjMyMDc0NCIsImluZGV4Ijo1LCJjbGllbnRUaW1lc3RhbXAiOjE2MTg1NzE5NzYuMzc0LCJ1bml0TmFtZSI6ImJhbm5lciIsInVuaXRWYXJpYW50TG9jYWxJZCI6bnVsbCwic2NyZWVuTG9jYWxJZCI6MTM2OCwic2NyZWVuVGl0bGUiOiJSZXNvdXJjZXMiLCJzY3JlZW5Jc01hc3RlciI6ZmFsc2UsIm9iamVjdExvY2FsSWQiOm51bGwsIm9iamVjdE5hbWUiOm51bGwsIm9iamVjdENsYXp6IjpudWxsLCJpbml0aWF0aW9uVGltZXN0YW1wIjoxNjE4NTcxOTc2LjM3NCwibmFtZSI6InNjcmVlblNob3duIn0seyJzZXNzaW9uSWQiOiJzMTYxODU3MTk3NHgyMDYzMzVlZTVkYThjZng5Njc0NjM5MiIsImFjY291bnRJZCI6IjQ0Yjc0YjM1Iiwic3RyZWFtIjoiYWRFdmVudHMiLCJpbnN0YW50aWF0aW9uIjoiMDU1NDI3ODcxMDY2MzIwNzQ0IiwiaW5kZXgiOjYsImNsaWVudFRpbWVzdGFtcCI6MTYxODU3MTk3Ni4zNzQsIm5hbWUiOiJjcmVhdGl2ZVJlbmRlcmVkIn0seyJzZXNzaW9uSWQiOiJzMTYxODU3MTk3NHgyMDYzMzVlZTVkYThjZng5Njc0NjM5MiIsImFjY291bnRJZCI6IjQ0Yjc0YjM1Iiwic3RyZWFtIjoiYWRFdmVudHMiLCJpbnN0YW50aWF0aW9uIjoiMDU1NDI3ODcxMDY2MzIwNzQ0IiwiaW5kZXgiOjcsImNsaWVudFRpbWVzdGFtcCI6MTYxODU3MTk3Ni4zODUsIm5hbWUiOiJ2aWV3YWJsZVRpbWUiLCJmcm9tIjoxNjE4NTcxOTc2LjM3MiwidG8iOjE2MTg1NzE5NzYuMzcyfV19?crc32c=452217486
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.184.103.42 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 16 Apr 2021 11:19:36 GMT
Cache-Control
no-cache, no-store, must-revalidate
Expires
0
Connection
keep-alive
Content-Length
35
Content-Type
image/gif
profile
cdn.syndication.twimg.com/timeline/
156 KB
11 KB
Script
General
Full URL
https://cdn.syndication.twimg.com/timeline/profile?callback=__twttr.callbacks.tl_i0_profile_DarkReading_old&dnt=true&domain=www.darkreading.com&lang=en&screen_name=DarkReading&suppress_response_codes=true&t=1798413&tz=GMT%2B0200&with_replies=false
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:1a0d:1429:742:782:b6 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (lcy/1D57) /
Resource Hash
566686b6e2a2aec696b9d828018515a7472bb1addfdbe2dd47871114af0511b8
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
248
x-cache
HIT
content-disposition
attachment; filename=jsonp.jsonp
access-control-allow-methods
GET
vary
Accept-Encoding
content-length
10779
x-xss-protection
0
x-response-time
173
last-modified
Fri, 16 Apr 2021 11:15:28 GMT
server
ECS (lcy/1D57)
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=631138519
x-tw-cdn
VZ, VZ
content-type
application/javascript;charset=utf-8
expires
Fri, 16 Apr 2021 11:24:35 GMT
cache-control
must-revalidate, max-age=300
x-connection-hash
03c6770e28cdd98df9a8fd1b9bb62dd5
accept-ranges
bytes
timing-allow-origin
*
x-transaction
009f1797006a22f4
access-contol-allow-origin
platform.twitter.com
tweet_button.63899b173766ee6f8a729a72b542b0fb.en.html
platform.twitter.com/widgets/ Frame 385B
32 KB
12 KB
Document
General
Full URL
https://platform.twitter.com/widgets/tweet_button.63899b173766ee6f8a729a72b542b0fb.en.html
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
93.184.220.66 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (ska/F6FC) /
Resource Hash
e6203cb164df8f73860edf3dc7e89c3494e024eea8976a9fbc2a2e05771127b3

Request headers

Host
platform.twitter.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.darkreading.com/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://www.darkreading.com/

Response headers

Content-Encoding
gzip
Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Age
41258
Cache-Control
public, max-age=315360000
Content-Type
text/html; charset=utf-8
Date
Fri, 16 Apr 2021 11:19:36 GMT
Etag
"8fb8dc069afa145927261ef32e8e053c+gzip"
Last-Modified
Thu, 15 Apr 2021 22:44:26 GMT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server
ECS (ska/F6FC)
Vary
Accept-Encoding
X-Cache
HIT
x-tw-cdn
VZ
Content-Length
12228
j0Qe_-uP
pbs.twimg.com/card_img/1380591519502061572/ Frame BE2B
3 KB
3 KB
Image
General
Full URL
https://pbs.twimg.com/card_img/1380591519502061572/j0Qe_-uP?format=jpg&name=144x144_2
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/674D) /
Resource Hash
fd6866419093102bb76f572a3624815e405fe9b9e8cac007430f041d4d2f2ba8
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:36 GMT
x-content-type-options
nosniff
age
569023
x-cache
HIT
content-length
3010
x-response-time
135
surrogate-key
card_img card_img/bucket/4 card_img/1380591519502061572
last-modified
Fri, 09 Apr 2021 18:38:43 GMT
server
ECS (frb/674D)
strict-transport-security
max-age=631138519
x-tw-cdn
VZ, VZ
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-connection-hash
b98fec0b9f5c898ca02c2c732dedeb5c
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
5buHlRzU
pbs.twimg.com/card_img/1382738960368214022/ Frame BE2B
3 KB
3 KB
Image
General
Full URL
https://pbs.twimg.com/card_img/1382738960368214022/5buHlRzU?format=jpg&name=144x144_2
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/6752) /
Resource Hash
a8e2f3be21e77af60268f646f6dc6d3b960fdef0c540ff9cbbee6bb46bf8b70d
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:36 GMT
x-content-type-options
nosniff
age
65904
x-cache
HIT
content-length
3395
x-response-time
135
surrogate-key
card_img card_img/bucket/7 card_img/1382738960368214022
last-modified
Thu, 15 Apr 2021 16:51:52 GMT
server
ECS (frb/6752)
strict-transport-security
max-age=631138519
x-tw-cdn
VZ, VZ
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-connection-hash
01819e7767412848a58654ca2c67125f
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
yhxfFz5e
pbs.twimg.com/card_img/1380213854513156097/ Frame BE2B
3 KB
3 KB
Image
General
Full URL
https://pbs.twimg.com/card_img/1380213854513156097/yhxfFz5e?format=jpg&name=144x144_2
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/67C0) /
Resource Hash
fd6866419093102bb76f572a3624815e405fe9b9e8cac007430f041d4d2f2ba8
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:36 GMT
x-content-type-options
nosniff
age
60180
x-cache
HIT
content-length
3010
x-response-time
121
surrogate-key
card_img card_img/bucket/8 card_img/1380213854513156097
last-modified
Thu, 08 Apr 2021 17:38:00 GMT
server
ECS (frb/67C0)
strict-transport-security
max-age=631138519
x-tw-cdn
VZ, VZ
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-connection-hash
914f9d4df4cba534abd94b968931317a
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
b30HQ_f5
pbs.twimg.com/card_img/1382721564479680514/ Frame BE2B
7 KB
7 KB
Image
General
Full URL
https://pbs.twimg.com/card_img/1382721564479680514/b30HQ_f5?format=jpg&name=144x144_2
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/668D) /
Resource Hash
f70b9343194b66c8453296dc822f4a084f94a0be3758d26d61db9db41b7ac222
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:36 GMT
x-content-type-options
nosniff
age
70365
x-cache
HIT
content-length
7358
x-response-time
142
surrogate-key
card_img card_img/bucket/9 card_img/1382721564479680514
last-modified
Thu, 15 Apr 2021 15:42:45 GMT
server
ECS (frb/668D)
strict-transport-security
max-age=631138519
x-tw-cdn
VZ, VZ
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-connection-hash
bf87741ab7f8da5d3d50715163465ff7
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
iNPnk0mF
pbs.twimg.com/card_img/1382362698776780803/ Frame BE2B
4 KB
4 KB
Image
General
Full URL
https://pbs.twimg.com/card_img/1382362698776780803/iNPnk0mF?format=jpg&name=144x144_2
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/668C) /
Resource Hash
3974ecdf657fe7d442eacbfdb8fada9277529d69d369a982630240711b6b2399
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:36 GMT
x-content-type-options
nosniff
age
155844
x-cache
HIT
content-length
3665
x-response-time
156
surrogate-key
card_img card_img/bucket/6 card_img/1382362698776780803
last-modified
Wed, 14 Apr 2021 15:56:45 GMT
server
ECS (frb/668C)
strict-transport-security
max-age=631138519
x-tw-cdn
VZ, VZ
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-connection-hash
11f07d7d3e01b8dcec59855adb48216c
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
timeline.32f7f89e2e680ebfe3f4cfefb27966ae.light.ltr.css
platform.twitter.com/css/ Frame BE2B
53 KB
12 KB
Stylesheet
General
Full URL
https://platform.twitter.com/css/timeline.32f7f89e2e680ebfe3f4cfefb27966ae.light.ltr.css
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
93.184.220.66 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (ska/F717) /
Resource Hash
8a322ede0b619b9051fccbe2a1a31f402f416d45f92c245aafcbe75e42f6f2b2

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 16 Apr 2021 11:19:36 GMT
Content-Encoding
gzip
Last-Modified
Thu, 15 Apr 2021 22:44:16 GMT
Server
ECS (ska/F717)
Age
41260
Etag
"fb5a989a2b36d6be5344baad6a1936fd+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
text/css; charset=utf-8
Content-Length
12144
timeline.32f7f89e2e680ebfe3f4cfefb27966ae.light.ltr.css
platform.twitter.com/css/
53 KB
53 KB
Image
General
Full URL
https://platform.twitter.com/css/timeline.32f7f89e2e680ebfe3f4cfefb27966ae.light.ltr.css
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
93.184.220.66 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (ska/F717) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 16 Apr 2021 11:19:36 GMT
Content-Encoding
gzip
Last-Modified
Thu, 15 Apr 2021 22:44:16 GMT
Server
ECS (ska/F717)
Age
41260
Etag
"fb5a989a2b36d6be5344baad6a1936fd+gzip"
Vary
Accept-Encoding
x-tw-cdn
VZ
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=315360000
X-Cache
HIT
Access-Control-Allow-Methods
GET
Content-Type
text/css; charset=utf-8
Content-Length
12144
pixel.gif
px.moatads.com/
43 B
260 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=5&q=0&hp=1&wf=1&pxm=6&vb=13&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=1&ak=-&i=PENTONMEDIA1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-nwvw4053N9oCRb36FcojwKWkUwdJEJMXJKBAOq%2BVT%2Bl2tvnQIIWF3cA%2B&sc=1&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=2&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&id=1&ii=4&f=0&j=&t=1618571974860&de=113213272367&cu=1618571974860&m=1195&ar=e4967b0-clean&iw=64bab64&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=5142&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A2157%3A2291%3A0%3A0&as=1&ag=1184&an=1184&gi=1&gf=1184&gg=1184&ix=1184&ic=1184&ez=1&ck=1184&kw=914&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1184&bx=1184&ci=1184&jz=914&dj=1&aa=1&ad=1017&cn=1017&gn=1&gk=1017&gl=1017&ik=1017&co=1017&cp=914&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=914&cd=914&ah=914&am=914&rf=0&re=1&ft=1017&fv=1017&fw=1017&wb=1&cl=0&at=0&d=5004235589%3A2837984555%3A5657449612%3A138345261839&bo=22316126855&bp=22326604369&bd=top&zMoatPS=top&gw=pentonmedia53440730609&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22326604369&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22326604369&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685&zMoatDev=Desktop&zMoatDfpSlotId=div-gpt-ad-961777897907396673-3&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=div-gpt-ad-961777897907396673-3&iq=na&tt=na&tc=0&fs=189983&na=1559457114&cs=0
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 16 Apr 2021 11:19:36 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Fri, 16 Apr 2021 11:19:36 GMT
truncated
/ Frame 385B
822 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
bed57a09b10b5cfc83c33f5bc6205831a9db085c874bc72d096d05ad2136e4b4

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/svg+xml
j0Qe_-uP
pbs.twimg.com/card_img/1380591519502061572/ Frame BE2B
3 KB
3 KB
Image
General
Full URL
https://pbs.twimg.com/card_img/1380591519502061572/j0Qe_-uP?format=jpg&name=144x144_2
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/js/moment~timeline.bcb1cafa923482f4826e32741fe16a98.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/674D) /
Resource Hash
fd6866419093102bb76f572a3624815e405fe9b9e8cac007430f041d4d2f2ba8
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:36 GMT
x-content-type-options
nosniff
age
569023
x-cache
HIT
content-length
3010
x-response-time
135
surrogate-key
card_img card_img/bucket/4 card_img/1380591519502061572
last-modified
Fri, 09 Apr 2021 18:38:43 GMT
server
ECS (frb/674D)
strict-transport-security
max-age=631138519
x-tw-cdn
VZ, VZ
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-connection-hash
b98fec0b9f5c898ca02c2c732dedeb5c
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
5buHlRzU
pbs.twimg.com/card_img/1382738960368214022/ Frame BE2B
3 KB
3 KB
Image
General
Full URL
https://pbs.twimg.com/card_img/1382738960368214022/5buHlRzU?format=jpg&name=144x144_2
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/js/moment~timeline.bcb1cafa923482f4826e32741fe16a98.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/6752) /
Resource Hash
a8e2f3be21e77af60268f646f6dc6d3b960fdef0c540ff9cbbee6bb46bf8b70d
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:36 GMT
x-content-type-options
nosniff
age
65904
x-cache
HIT
content-length
3395
x-response-time
135
surrogate-key
card_img card_img/bucket/7 card_img/1382738960368214022
last-modified
Thu, 15 Apr 2021 16:51:52 GMT
server
ECS (frb/6752)
strict-transport-security
max-age=631138519
x-tw-cdn
VZ, VZ
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-connection-hash
01819e7767412848a58654ca2c67125f
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
yhxfFz5e
pbs.twimg.com/card_img/1380213854513156097/ Frame BE2B
3 KB
3 KB
Image
General
Full URL
https://pbs.twimg.com/card_img/1380213854513156097/yhxfFz5e?format=jpg&name=144x144_2
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/js/moment~timeline.bcb1cafa923482f4826e32741fe16a98.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/67C0) /
Resource Hash
fd6866419093102bb76f572a3624815e405fe9b9e8cac007430f041d4d2f2ba8
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:36 GMT
x-content-type-options
nosniff
age
60180
x-cache
HIT
content-length
3010
x-response-time
121
surrogate-key
card_img card_img/bucket/8 card_img/1380213854513156097
last-modified
Thu, 08 Apr 2021 17:38:00 GMT
server
ECS (frb/67C0)
strict-transport-security
max-age=631138519
x-tw-cdn
VZ, VZ
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-connection-hash
914f9d4df4cba534abd94b968931317a
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
b30HQ_f5
pbs.twimg.com/card_img/1382721564479680514/ Frame BE2B
7 KB
7 KB
Image
General
Full URL
https://pbs.twimg.com/card_img/1382721564479680514/b30HQ_f5?format=jpg&name=144x144_2
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/js/moment~timeline.bcb1cafa923482f4826e32741fe16a98.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/668D) /
Resource Hash
f70b9343194b66c8453296dc822f4a084f94a0be3758d26d61db9db41b7ac222
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:36 GMT
x-content-type-options
nosniff
age
70365
x-cache
HIT
content-length
7358
x-response-time
142
surrogate-key
card_img card_img/bucket/9 card_img/1382721564479680514
last-modified
Thu, 15 Apr 2021 15:42:45 GMT
server
ECS (frb/668D)
strict-transport-security
max-age=631138519
x-tw-cdn
VZ, VZ
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-connection-hash
bf87741ab7f8da5d3d50715163465ff7
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
iNPnk0mF
pbs.twimg.com/card_img/1382362698776780803/ Frame BE2B
4 KB
4 KB
Image
General
Full URL
https://pbs.twimg.com/card_img/1382362698776780803/iNPnk0mF?format=jpg&name=144x144_2
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/js/moment~timeline.bcb1cafa923482f4826e32741fe16a98.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/668C) /
Resource Hash
3974ecdf657fe7d442eacbfdb8fada9277529d69d369a982630240711b6b2399
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:36 GMT
x-content-type-options
nosniff
age
155844
x-cache
HIT
content-length
3665
x-response-time
156
surrogate-key
card_img card_img/bucket/6 card_img/1382362698776780803
last-modified
Wed, 14 Apr 2021 15:56:45 GMT
server
ECS (frb/668C)
strict-transport-security
max-age=631138519
x-tw-cdn
VZ, VZ
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-connection-hash
11f07d7d3e01b8dcec59855adb48216c
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
MhyYtRkv_normal.jpg
pbs.twimg.com/profile_images/1338542819498217478/ Frame BE2B
2 KB
2 KB
Image
General
Full URL
https://pbs.twimg.com/profile_images/1338542819498217478/MhyYtRkv_normal.jpg
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/6727) /
Resource Hash
adaf986c7a8d1fcd6c754b1a98bab48cc2e1e3c9c49de26d52a8a5cdece63fe6
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:36 GMT
x-content-type-options
nosniff
age
321624
x-cache
HIT
content-length
1883
x-response-time
124
surrogate-key
profile_images profile_images/bucket/4 profile_images/1338542819498217478
last-modified
Mon, 14 Dec 2020 17:52:11 GMT
server
ECS (frb/6727)
strict-transport-security
max-age=631138519
x-tw-cdn
VZ, VZ
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-connection-hash
c5e6368534cc0ec230256d8963977c6a
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
syndication_bundle_v1_73385286cca9d2256f6bf3993470820d4827b058.css
ton.twimg.com/tfw/css/ Frame BE2B
44 KB
7 KB
Stylesheet
General
Full URL
https://ton.twimg.com/tfw/css/syndication_bundle_v1_73385286cca9d2256f6bf3993470820d4827b058.css
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:7ee2:97c:ab4c:6c70:be36 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8FC6) /
Resource Hash
a549034009f79ead18a2154a8b730d8acb61e2f36c0434c0f9cff0f73df5d8cf
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
147130
x-ton-expected-size
45170
x-cache
HIT
vary
Accept-Encoding
content-length
6839
x-response-time
14
surrogate-key
tfw
last-modified
Tue, 14 May 2019 18:53:54 GMT
server
ECAcc (frc/8FC6)
etag
"4mhImCFS9rptiUICNnLD1g=="
strict-transport-security
max-age=631138519
content-type
text/css
access-control-allow-origin
*
x-connection-hash
daee43eec354cd8f8dc0923d062ba87f
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
expires
Fri, 23 Apr 2021 11:19:36 GMT
syndication_bundle_v1_73385286cca9d2256f6bf3993470820d4827b058.css
ton.twimg.com/tfw/css/
44 KB
44 KB
Image
General
Full URL
https://ton.twimg.com/tfw/css/syndication_bundle_v1_73385286cca9d2256f6bf3993470820d4827b058.css
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:233:7ee2:97c:ab4c:6c70:be36 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECAcc (frc/8FC6) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
147130
x-ton-expected-size
45170
x-cache
HIT
vary
Accept-Encoding
content-length
6839
x-response-time
14
surrogate-key
tfw
last-modified
Tue, 14 May 2019 18:53:54 GMT
server
ECAcc (frc/8FC6)
etag
"4mhImCFS9rptiUICNnLD1g=="
strict-transport-security
max-age=631138519
content-type
text/css
access-control-allow-origin
*
x-connection-hash
daee43eec354cd8f8dc0923d062ba87f
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
expires
Fri, 23 Apr 2021 11:19:36 GMT
truncated
/ Frame BE2B
825 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
45055babdbc02ea34c7baa53f33fc68389c4c5f73afe0bfafd6c9bc5733399bc

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/ Frame BE2B
572 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
42ecd6904f43af4e6cef62ddbeffa7b2b0b6c8ec5080a3e1deec4576f4294859

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
truncated
/ Frame BE2B
644 B
0
Image
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
195e8e91bc727766f427243d4cfb79cdc873639991600bf99e9d2cab5cad77c8

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf-8
pixel.gif
px.moatads.com/
43 B
260 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=37&q=1&hp=1&wf=1&pxm=6&vb=13&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=1&ak=-&i=PENTONMEDIA1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-nwvw4053N9oCRb36FcojwKWkUwdJEJMXJKBAOq%2BVT%2Bl2tvnQIIWF3cA%2B&sc=1&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=3&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&id=1&ii=4&f=0&j=&t=1618571974860&de=113213272367&cu=1618571974860&m=1196&ar=e4967b0-clean&iw=64bab64&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=5142&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A2157%3A2291%3A0%3A0&as=1&ag=1184&an=1184&gi=1&gf=1184&gg=1184&ix=1184&ic=1184&ez=1&ck=1184&kw=914&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1184&bx=1184&ci=1184&jz=914&dj=1&aa=1&ad=1017&cn=1017&gn=1&gk=1017&gl=1017&ik=1017&co=1017&cp=914&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=914&cd=914&ah=914&am=914&rf=0&re=1&ft=1017&fv=1017&fw=1017&wb=1&cl=0&at=0&d=5004235589%3A2837984555%3A5657449612%3A138345261839&bo=22316126855&bp=22326604369&bd=top&zMoatPS=top&gw=pentonmedia53440730609&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22326604369&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22326604369&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685&zMoatDev=Desktop&zMoatDfpSlotId=div-gpt-ad-961777897907396673-3&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=div-gpt-ad-961777897907396673-3&iq=na&tt=na&tc=0&fs=189983&na=1624846264&cs=0
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 16 Apr 2021 11:19:36 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Fri, 16 Apr 2021 11:19:36 GMT
j0Qe_-uP
pbs.twimg.com/card_img/1380591519502061572/ Frame BE2B
3 KB
3 KB
Image
General
Full URL
https://pbs.twimg.com/card_img/1380591519502061572/j0Qe_-uP?format=jpg&name=144x144_2
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/674D) /
Resource Hash
fd6866419093102bb76f572a3624815e405fe9b9e8cac007430f041d4d2f2ba8
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:36 GMT
x-content-type-options
nosniff
age
569023
x-cache
HIT
content-length
3010
x-response-time
135
surrogate-key
card_img card_img/bucket/4 card_img/1380591519502061572
last-modified
Fri, 09 Apr 2021 18:38:43 GMT
server
ECS (frb/674D)
strict-transport-security
max-age=631138519
x-tw-cdn
VZ, VZ
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-connection-hash
b98fec0b9f5c898ca02c2c732dedeb5c
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
pixel.gif
px.moatads.com/
43 B
260 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=37&q=0&hp=1&wf=1&pxm=6&vb=13&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=1&ak=-&i=PENTONMEDIA1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-nwvw4053N9oCRb36FcojwKWkUwdJEJMXJKBAOq%2BVT%2Bl2tvnQIIWF3cA%2B&sc=1&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&id=1&ii=4&f=0&j=&t=1618571974817&de=110898614312&cu=1618571974817&m=1252&ar=e4967b0-clean&iw=64bab64&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=5142&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A2157%3A2291%3A0%3A0&as=1&ag=1230&an=5&gi=1&gf=1230&gg=5&ix=1230&ic=1230&ez=1&ck=1230&kw=971&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1230&bx=5&ci=1230&jz=971&dj=1&aa=1&ad=1055&cn=0&gn=1&gk=1055&gl=0&ik=1055&co=1055&cp=971&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=971&cd=10&ah=971&am=10&rf=0&re=1&ft=1055&fv=0&fw=1055&wb=1&cl=0&at=0&d=5003554797%3A2837012561%3A5656213172%3A138344902208&bo=22316126855&bp=22326604369&bd=rec1&zMoatPS=rec1&gw=pentonmedia53440730609&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22326604369&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22326604369&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685&zMoatDev=Desktop&zMoatDfpSlotId=div-gpt-ad-961777897907396673-4&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=div-gpt-ad-961777897907396673-4&iq=na&tt=na&tc=0&fs=189983&na=399417060&cs=0
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 16 Apr 2021 11:19:36 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Fri, 16 Apr 2021 11:19:36 GMT
j0Qe_-uP
pbs.twimg.com/card_img/1380591519502061572/ Frame BE2B
3 KB
3 KB
Image
General
Full URL
https://pbs.twimg.com/card_img/1380591519502061572/j0Qe_-uP?format=jpg&name=144x144_2
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/674D) /
Resource Hash
fd6866419093102bb76f572a3624815e405fe9b9e8cac007430f041d4d2f2ba8
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:36 GMT
x-content-type-options
nosniff
age
569023
x-cache
HIT
content-length
3010
x-response-time
135
surrogate-key
card_img card_img/bucket/4 card_img/1380591519502061572
last-modified
Fri, 09 Apr 2021 18:38:43 GMT
server
ECS (frb/674D)
strict-transport-security
max-age=631138519
x-tw-cdn
VZ, VZ
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-connection-hash
b98fec0b9f5c898ca02c2c732dedeb5c
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
j0Qe_-uP
pbs.twimg.com/card_img/1380591519502061572/ Frame BE2B
3 KB
3 KB
Image
General
Full URL
https://pbs.twimg.com/card_img/1380591519502061572/j0Qe_-uP?format=jpg&name=144x144_2
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/674D) /
Resource Hash
fd6866419093102bb76f572a3624815e405fe9b9e8cac007430f041d4d2f2ba8
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:36 GMT
x-content-type-options
nosniff
age
569023
x-cache
HIT
content-length
3010
x-response-time
135
surrogate-key
card_img card_img/bucket/4 card_img/1380591519502061572
last-modified
Fri, 09 Apr 2021 18:38:43 GMT
server
ECS (frb/674D)
strict-transport-security
max-age=631138519
x-tw-cdn
VZ, VZ
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-connection-hash
b98fec0b9f5c898ca02c2c732dedeb5c
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
5buHlRzU
pbs.twimg.com/card_img/1382738960368214022/ Frame BE2B
3 KB
3 KB
Image
General
Full URL
https://pbs.twimg.com/card_img/1382738960368214022/5buHlRzU?format=jpg&name=144x144_2
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/6752) /
Resource Hash
a8e2f3be21e77af60268f646f6dc6d3b960fdef0c540ff9cbbee6bb46bf8b70d
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:36 GMT
x-content-type-options
nosniff
age
65904
x-cache
HIT
content-length
3395
x-response-time
135
surrogate-key
card_img card_img/bucket/7 card_img/1382738960368214022
last-modified
Thu, 15 Apr 2021 16:51:52 GMT
server
ECS (frb/6752)
strict-transport-security
max-age=631138519
x-tw-cdn
VZ, VZ
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-connection-hash
01819e7767412848a58654ca2c67125f
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
pixel.gif
px.moatads.com/
43 B
260 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=5&q=0&hp=1&wf=1&pxm=6&vb=13&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=1&ak=-&i=PENTONMEDIA1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-nwvw4053N9oCRb36FcojwKWkUwdJEJMXJKBAOq%2BVT%2Bl2tvnQIIWF3cA%2B&sc=1&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=2&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&id=1&ii=4&f=0&j=&t=1618571974817&de=110898614312&cu=1618571974817&m=1254&ar=e4967b0-clean&iw=64bab64&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=5142&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A2157%3A2291%3A0%3A0&as=1&ag=1230&an=1230&gi=1&gf=1230&gg=1230&ix=1230&ic=1230&ez=1&ck=1230&kw=971&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1230&bx=1230&ci=1230&jz=971&dj=1&aa=1&ad=1055&cn=1055&gn=1&gk=1055&gl=1055&ik=1055&co=1055&cp=971&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=971&cd=971&ah=971&am=971&rf=0&re=1&ft=1055&fv=1055&fw=1055&wb=1&cl=0&at=0&d=5003554797%3A2837012561%3A5656213172%3A138344902208&bo=22316126855&bp=22326604369&bd=rec1&zMoatPS=rec1&gw=pentonmedia53440730609&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22326604369&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22326604369&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685&zMoatDev=Desktop&zMoatDfpSlotId=div-gpt-ad-961777897907396673-4&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=div-gpt-ad-961777897907396673-4&iq=na&tt=na&tc=0&fs=189983&na=1823215788&cs=0
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 16 Apr 2021 11:19:36 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Fri, 16 Apr 2021 11:19:36 GMT
yhxfFz5e
pbs.twimg.com/card_img/1380213854513156097/ Frame BE2B
3 KB
3 KB
Image
General
Full URL
https://pbs.twimg.com/card_img/1380213854513156097/yhxfFz5e?format=jpg&name=144x144_2
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/67C0) /
Resource Hash
fd6866419093102bb76f572a3624815e405fe9b9e8cac007430f041d4d2f2ba8
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:36 GMT
x-content-type-options
nosniff
age
60180
x-cache
HIT
content-length
3010
x-response-time
121
surrogate-key
card_img card_img/bucket/8 card_img/1380213854513156097
last-modified
Thu, 08 Apr 2021 17:38:00 GMT
server
ECS (frb/67C0)
strict-transport-security
max-age=631138519
x-tw-cdn
VZ, VZ
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-connection-hash
914f9d4df4cba534abd94b968931317a
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
j0Qe_-uP
pbs.twimg.com/card_img/1380591519502061572/ Frame BE2B
3 KB
3 KB
Image
General
Full URL
https://pbs.twimg.com/card_img/1380591519502061572/j0Qe_-uP?format=jpg&name=144x144_2
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/674D) /
Resource Hash
fd6866419093102bb76f572a3624815e405fe9b9e8cac007430f041d4d2f2ba8
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:36 GMT
x-content-type-options
nosniff
age
569023
x-cache
HIT
content-length
3010
x-response-time
135
surrogate-key
card_img card_img/bucket/4 card_img/1380591519502061572
last-modified
Fri, 09 Apr 2021 18:38:43 GMT
server
ECS (frb/674D)
strict-transport-security
max-age=631138519
x-tw-cdn
VZ, VZ
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-connection-hash
b98fec0b9f5c898ca02c2c732dedeb5c
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
j0Qe_-uP
pbs.twimg.com/card_img/1380591519502061572/ Frame BE2B
3 KB
3 KB
Image
General
Full URL
https://pbs.twimg.com/card_img/1380591519502061572/j0Qe_-uP?format=jpg&name=144x144_2
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/674D) /
Resource Hash
fd6866419093102bb76f572a3624815e405fe9b9e8cac007430f041d4d2f2ba8
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:36 GMT
x-content-type-options
nosniff
age
569023
x-cache
HIT
content-length
3010
x-response-time
135
surrogate-key
card_img card_img/bucket/4 card_img/1380591519502061572
last-modified
Fri, 09 Apr 2021 18:38:43 GMT
server
ECS (frb/674D)
strict-transport-security
max-age=631138519
x-tw-cdn
VZ, VZ
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-connection-hash
b98fec0b9f5c898ca02c2c732dedeb5c
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
j0Qe_-uP
pbs.twimg.com/card_img/1380591519502061572/ Frame BE2B
3 KB
3 KB
Image
General
Full URL
https://pbs.twimg.com/card_img/1380591519502061572/j0Qe_-uP?format=jpg&name=144x144_2
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/674D) /
Resource Hash
fd6866419093102bb76f572a3624815e405fe9b9e8cac007430f041d4d2f2ba8
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:36 GMT
x-content-type-options
nosniff
age
569023
x-cache
HIT
content-length
3010
x-response-time
135
surrogate-key
card_img card_img/bucket/4 card_img/1380591519502061572
last-modified
Fri, 09 Apr 2021 18:38:43 GMT
server
ECS (frb/674D)
strict-transport-security
max-age=631138519
x-tw-cdn
VZ, VZ
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-connection-hash
b98fec0b9f5c898ca02c2c732dedeb5c
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
pixel.gif
px.moatads.com/
43 B
260 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=37&q=1&hp=1&wf=1&pxm=6&vb=13&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=1&ak=-&i=PENTONMEDIA1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-nwvw4053N9oCRb36FcojwKWkUwdJEJMXJKBAOq%2BVT%2Bl2tvnQIIWF3cA%2B&sc=1&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=3&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&id=1&ii=4&f=0&j=&t=1618571974817&de=110898614312&cu=1618571974817&m=1256&ar=e4967b0-clean&iw=64bab64&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=5142&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A2157%3A2291%3A0%3A0&as=1&ag=1230&an=1230&gi=1&gf=1230&gg=1230&ix=1230&ic=1230&ez=1&ck=1230&kw=971&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1230&bx=1230&ci=1230&jz=971&dj=1&aa=1&ad=1055&cn=1055&gn=1&gk=1055&gl=1055&ik=1055&co=1055&cp=971&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=971&cd=971&ah=971&am=971&rf=0&re=1&ft=1055&fv=1055&fw=1055&wb=1&cl=0&at=0&d=5003554797%3A2837012561%3A5656213172%3A138344902208&bo=22316126855&bp=22326604369&bd=rec1&zMoatPS=rec1&gw=pentonmedia53440730609&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22326604369&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22326604369&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685&zMoatDev=Desktop&zMoatDfpSlotId=div-gpt-ad-961777897907396673-4&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=div-gpt-ad-961777897907396673-4&iq=na&tt=na&tc=0&fs=189983&na=865344365&cs=0
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 16 Apr 2021 11:19:36 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Fri, 16 Apr 2021 11:19:36 GMT
yhxfFz5e
pbs.twimg.com/card_img/1380213854513156097/ Frame BE2B
3 KB
3 KB
Image
General
Full URL
https://pbs.twimg.com/card_img/1380213854513156097/yhxfFz5e?format=jpg&name=144x144_2
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/67C0) /
Resource Hash
fd6866419093102bb76f572a3624815e405fe9b9e8cac007430f041d4d2f2ba8
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:36 GMT
x-content-type-options
nosniff
age
60180
x-cache
HIT
content-length
3010
x-response-time
121
surrogate-key
card_img card_img/bucket/8 card_img/1380213854513156097
last-modified
Thu, 08 Apr 2021 17:38:00 GMT
server
ECS (frb/67C0)
strict-transport-security
max-age=631138519
x-tw-cdn
VZ, VZ
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-connection-hash
914f9d4df4cba534abd94b968931317a
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
j0Qe_-uP
pbs.twimg.com/card_img/1380591519502061572/ Frame BE2B
3 KB
3 KB
Image
General
Full URL
https://pbs.twimg.com/card_img/1380591519502061572/j0Qe_-uP?format=jpg&name=144x144_2
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/674D) /
Resource Hash
fd6866419093102bb76f572a3624815e405fe9b9e8cac007430f041d4d2f2ba8
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:36 GMT
x-content-type-options
nosniff
age
569023
x-cache
HIT
content-length
3010
x-response-time
135
surrogate-key
card_img card_img/bucket/4 card_img/1380591519502061572
last-modified
Fri, 09 Apr 2021 18:38:43 GMT
server
ECS (frb/674D)
strict-transport-security
max-age=631138519
x-tw-cdn
VZ, VZ
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-connection-hash
b98fec0b9f5c898ca02c2c732dedeb5c
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
j0Qe_-uP
pbs.twimg.com/card_img/1380591519502061572/ Frame BE2B
3 KB
3 KB
Image
General
Full URL
https://pbs.twimg.com/card_img/1380591519502061572/j0Qe_-uP?format=jpg&name=144x144_2
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/674D) /
Resource Hash
fd6866419093102bb76f572a3624815e405fe9b9e8cac007430f041d4d2f2ba8
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:36 GMT
x-content-type-options
nosniff
age
569023
x-cache
HIT
content-length
3010
x-response-time
135
surrogate-key
card_img card_img/bucket/4 card_img/1380591519502061572
last-modified
Fri, 09 Apr 2021 18:38:43 GMT
server
ECS (frb/674D)
strict-transport-security
max-age=631138519
x-tw-cdn
VZ, VZ
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-connection-hash
b98fec0b9f5c898ca02c2c732dedeb5c
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
b30HQ_f5
pbs.twimg.com/card_img/1382721564479680514/ Frame BE2B
7 KB
7 KB
Image
General
Full URL
https://pbs.twimg.com/card_img/1382721564479680514/b30HQ_f5?format=jpg&name=144x144_2
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/668D) /
Resource Hash
f70b9343194b66c8453296dc822f4a084f94a0be3758d26d61db9db41b7ac222
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:36 GMT
x-content-type-options
nosniff
age
70365
x-cache
HIT
content-length
7358
x-response-time
142
surrogate-key
card_img card_img/bucket/9 card_img/1382721564479680514
last-modified
Thu, 15 Apr 2021 15:42:45 GMT
server
ECS (frb/668D)
strict-transport-security
max-age=631138519
x-tw-cdn
VZ, VZ
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-connection-hash
bf87741ab7f8da5d3d50715163465ff7
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
pixel.gif
px.moatads.com/
43 B
260 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=0&q=0&hp=1&wf=1&pxm=6&vb=13&kq=1&lo=4&uk=null&pk=0&wk=1&rk=1&tk=1&ak=https%3A%2F%2Fwww.darkreading.com%2F%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F-&i=PENTONMEDIA1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-nwvw4053N9oCRb36FcojwKWkUwdJEJMXJKBAOq%2BVT%2Bl2tvnQIIWF3cA%2B&sc=1&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=0&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=600&w=300&fy=18&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&id=1&ii=4&f=0&j=&t=1618571974883&de=714013790740&cu=1618571974883&m=1748&ar=e4967b0-clean&iw=64bab64&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=5742&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A-%3A-&pe=1%3A2157%3A2291%3A0%3A0&as=0&ag=82&an=0&gf=82&gg=0&ix=82&ic=82&ez=1&aj=1&pg=100&pf=0&ib=0&cc=0&bw=82&bx=0&dj=1&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=0%3A0%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=163&cd=0&ah=163&am=0&rf=0&re=0&wb=1&cl=0&at=0&d=5003554797%3A2837012561%3A5656213172%3A138344901188&bo=22316126855&bp=22326604369&bd=TAPunit&zMoatPS=TAPunit&gw=pentonmedia53440730609&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22326604369&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22326604369&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685&zMoatDev=Desktop&zMoatDfpSlotId=div-gpt-ad-961777897907396673-8&hv=Celtra%20API&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=div-gpt-ad-961777897907396673-8&iq=na&tt=na&tc=0&fs=189983&na=2066958891&cs=0
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 16 Apr 2021 11:19:36 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Fri, 16 Apr 2021 11:19:36 GMT
iNPnk0mF
pbs.twimg.com/card_img/1382362698776780803/ Frame BE2B
4 KB
4 KB
Image
General
Full URL
https://pbs.twimg.com/card_img/1382362698776780803/iNPnk0mF?format=jpg&name=144x144_2
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:134:fa2:1627:1fe:edb:1665 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/668C) /
Resource Hash
3974ecdf657fe7d442eacbfdb8fada9277529d69d369a982630240711b6b2399
Security Headers
Name Value
Strict-Transport-Security max-age=631138519
X-Content-Type-Options nosniff

Request headers

Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:36 GMT
x-content-type-options
nosniff
age
155844
x-cache
HIT
content-length
3665
x-response-time
156
surrogate-key
card_img card_img/bucket/6 card_img/1382362698776780803
last-modified
Wed, 14 Apr 2021 15:56:45 GMT
server
ECS (frb/668C)
strict-transport-security
max-age=631138519
x-tw-cdn
VZ, VZ
content-type
image/jpeg
access-control-allow-origin
*
access-control-expose-headers
Content-Length
cache-control
max-age=604800, must-revalidate
x-connection-hash
11f07d7d3e01b8dcec59855adb48216c
accept-ranges
bytes
timing-allow-origin
https://twitter.com, https://mobile.twitter.com
sodar
pagead2.googlesyndication.com/getconfig/
9 KB
7 KB
XHR
General
Full URL
https://pagead2.googlesyndication.com/getconfig/sodar?sv=200&tid=gpt&tv=2021041401&st=env
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041401.js?31060835
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
88df697a1e6d3548502b8de443860fcb6cb51347e705cd4479e0ece6ea4c35b2
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

timing-allow-origin
*
date
Fri, 16 Apr 2021 11:19:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
cafe
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
access-control-allow-origin
*
cache-control
private
cross-origin-resource-policy
cross-origin
content-disposition
attachment; filename="f.txt"
content-type
application/json; charset=UTF-8
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
7041
x-xss-protection
0
roundtrip.js
s.adroll.com/j/
41 KB
13 KB
Script
General
Full URL
https://s.adroll.com/j/roundtrip.js
Requested by
Host: www.darkreading.com
URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:7100::687e:24b0 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f55b80216d81f421d8da8c69ae09068b1231e4b0fb6d3912eae8d147b5232d9c

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id
RbvMQlISgmBBsnMKx1p.bqgidE6ZF3W8
Content-Encoding
gzip
ETag
"4748055dbdd5649bb8f3f2a9b89f85b1"
x-amz-request-id
0TYC7TY00BPM4X39
x-amz-server-side-encryption
AES256
Connection
keep-alive
Vary
Accept-Encoding
Content-Length
12978
x-amz-id-2
xC3iFrWUEgHG0SuvuCH6nQBOaU1a4splR14HQ6mRp3SvQuveQvqOiaFUYYgTfWzs3RoZtaGAtsk=
Last-Modified
Wed, 14 Apr 2021 13:35:10 GMT
Server
AmazonS3
Date
Fri, 16 Apr 2021 11:19:36 GMT
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
text/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=3600, must-revalidate
Access-Control-Allow-Credentials
false
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
chartbeat.js
static.chartbeat.com/js/
36 KB
14 KB
Script
General
Full URL
https://static.chartbeat.com/js/chartbeat.js
Requested by
Host: info.silobreaker.com
URL: https://info.silobreaker.com/e2t/tc/VVN1hK6LpV61VlXzTl38wDRqW2jjqKJ4qssLHN1TFhtc4Zc_rV3Zsc37CgB-MN3c-2KKDkJ89N2cnbCQpNmFPV8_9mg8HvN0FW2kkBk_6PdrKtW2P-QKG5BHGY0W2g3bnN6-RdkDW6SPp9W8DPlFVV5NMlQ6K_gNvW8PRX607zfNxGW1rkStj3RGCX1W567Zqw3q-bL_W1clxNf205cTkW5cjXWS7H7RsmW6CjyqP8vR1YhW8y86Z_7mSPqjN8QdVsctzGkrVTJr6G8hc4nmW45t02B8pk0HZW2Tlfw84QzwdPW6S9yLp4XmGgCW1YZtht7b1Y4zW33HCNp5_nfVwW5wYMRX264wttW90m6ns27D6BxV477dc79nS0DW6T4xVQ7M5JNXW7t8tFW2zgt2hN8SyYbrS6D-lW4Fj_tQ2vFVfjW271Wql4nM4FhW95-Qnj13vPpKN4F9p50Gwhf_N7F9BlpbWlgYW2TsPjw6DVz0y35xs1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:206f:fa00:18:1fcd:34e:d2a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
nginx /
Resource Hash
ec93813683cccb74a7896a34a2ed1b2163288620f6959ae06de3ded30cf518b9

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Thu, 15 Apr 2021 15:16:04 GMT
content-encoding
gzip
last-modified
Fri, 02 Apr 2021 00:04:46 GMT
server
nginx
age
72212
etag
W/"60665f9e-8e96"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/x-javascript
via
1.1 c359abeab0060e721cfaac65ce34b1cc.cloudfront.net (CloudFront)
cache-control
max-age=86400
x-amz-cf-pop
FRA56-C1
x-amz-cf-id
662K-Q-OgaSjdQymQRTfDTuoQ0GMgvzRIJmPis3r4-D6IbFh-AjaDQ==
expires
Fri, 16 Apr 2021 15:16:04 GMT
sodar2.js
tpc.googlesyndication.com/sodar/
17 KB
6 KB
Script
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2.js
Requested by
Host: securepubads.g.doubleclick.net
URL: https://securepubads.g.doubleclick.net/gpt/pubads_impl_2021041401.js?31060835
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c61a719b48533a1fa932729f4927ba1377a96c441b0d6a427096b867742b4645
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
server
sffe
etag
"1616005470650935"
vary
Accept-Encoding
content-type
text/javascript
cache-control
private, max-age=3000
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
6437
x-xss-protection
0
expires
Fri, 16 Apr 2021 11:19:36 GMT
index.js
s.adroll.com/j/exp/
Redirect Chain
  • https://s.adroll.com/j/exp/TQSV74R4GVCSJITSZC2MCP/index.js
  • https://s.adroll.com/j/exp/index.js
28 B
747 B
Script
General
Full URL
https://s.adroll.com/j/exp/index.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:7100::687e:24b0 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id
8C_4p5S6NLuKOM2fXKpm7asomxwPn3IL
Content-Encoding
gzip
ETag
"5816cced8568d223aa09d889f300692b"
x-amz-request-id
A6E4D842C4F3666B
x-amz-server-side-encryption
AES256
Connection
keep-alive
Vary
Accept-Encoding
Content-Length
48
x-amz-id-2
1Pslf+Y9QwUHIZmwUo95w2CKA8MTrgZpbGBRFLUwAevxRDJ3euWTGuAJ2AJ78njOjdUd48ZsKSg=
Last-Modified
Tue, 19 Jan 2021 16:25:36 GMT
Server
AmazonS3
Date
Fri, 16 Apr 2021 11:19:37 GMT
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
false
Accept-Ranges
bytes
Access-Control-Allow-Headers
*

Redirect headers

Date
Fri, 16 Apr 2021 11:19:37 GMT
Server
AkamaiGHost
Location
https://s.adroll.com/j/exp/index.js
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Access-Control-Allow-Credentials
false
Connection
keep-alive
Access-Control-Allow-Headers
*
Content-Length
0
index.js
s.adroll.com/j/pre/TQSV74R4GVCSJITSZC2MCP/ACPJ7LN56VBITNNAUDPDMG/
4 KB
2 KB
Script
General
Full URL
https://s.adroll.com/j/pre/TQSV74R4GVCSJITSZC2MCP/ACPJ7LN56VBITNNAUDPDMG/index.js
Requested by
Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:7100::687e:24b0 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AmazonS3 /
Resource Hash
41f1e9970b646aadac0f40543bb08b21e49990bf1b09392d1ef4d71b275069ea

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id
a6Eyv_joeBSMAzY2FTDHhnOwKrVHXSys
Content-Encoding
gzip
ETag
"33ed216ef4569e95a97e55fb39d91d38"
x-amz-request-id
7KH9H8MVQ3ST96ZZ
x-amz-server-side-encryption
AES256
Connection
keep-alive
Vary
Accept-Encoding
Content-Length
1800
x-amz-id-2
tqsIuWF81yNgx63Sq+fkaYkSgDvyK0S56MG64MwA43+JhN5D1dFyyy00MVWLPR3MuYGO91/ctDM=
Last-Modified
Fri, 16 Apr 2021 08:16:05 GMT
Server
AmazonS3
Date
Fri, 16 Apr 2021 11:19:36 GMT
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
text/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
max-age=3600, must-revalidate
Access-Control-Allow-Credentials
false
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
/
d.adroll.com/consent/check/TQSV74R4GVCSJITSZC2MCP/
Redirect Chain
  • https://d.adroll.mgr.consensu.org/consent/iabcheck/TQSV74R4GVCSJITSZC2MCP?_s=3c53b32ed0f6902f126da4a246754650&_b=2
  • https://d.adroll.com/consent/check/TQSV74R4GVCSJITSZC2MCP/?_s=3c53b32ed0f6902f126da4a246754650&_b=2
385 B
477 B
Script
General
Full URL
https://d.adroll.com/consent/check/TQSV74R4GVCSJITSZC2MCP/?_s=3c53b32ed0f6902f126da4a246754650&_b=2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.74.23.153 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-74-23-153.eu-west-1.compute.amazonaws.com
Software
nginx/1.18.0 /
Resource Hash
d7fbef096a735e3913450358df298895e676ee16f9c7c9352a406096a7777a19

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 11:19:37 GMT
server
nginx/1.18.0
content-length
385
content-type
application/javascript

Redirect headers

location
https://d.adroll.com/consent/check/TQSV74R4GVCSJITSZC2MCP/?_s=3c53b32ed0f6902f126da4a246754650&_b=2
date
Fri, 16 Apr 2021 11:19:37 GMT
server
nginx/1.18.0
content-length
105
runner.html
tpc.googlesyndication.com/sodar/sodar2/222/ Frame 7120
12 KB
5 KB
Document
General
Full URL
https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2.js
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2001 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
6836719899bda27cd22c1551cb7fbfc33fb0bbbedaa89e4baa8715fef8202cbc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
tpc.googlesyndication.com
:scheme
https
:path
/sodar/sodar2/222/runner.html
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.darkreading.com/
accept-encoding
gzip, deflate, br
accept-language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Referer
https://www.darkreading.com/

Response headers

accept-ranges
bytes
vary
Accept-Encoding
content-encoding
gzip
content-type
text/html
cross-origin-resource-policy
cross-origin
content-length
5022
date
Fri, 16 Apr 2021 10:35:37 GMT
expires
Sat, 16 Apr 2022 10:35:37 GMT
last-modified
Wed, 20 Jan 2021 19:23:06 GMT
x-content-type-options
nosniff
server
sffe
x-xss-protection
0
cache-control
public, max-age=31536000
age
2639
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
ping
ping.chartbeat.net/
43 B
169 B
Image
General
Full URL
https://ping.chartbeat.net/ping?h=darkreading.com&p=%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685&u=Dmc6fwPu-ntCxojbO&d=darkreading.com&g=53678&g0=perimeter%20-%20perimeter&g1=jai%20vijayan&g4=news%20analysis&n=1&f=00001&c=0&x=0&m=0&y=6142&o=1600&w=1200&j=45&R=1&W=0&I=0&E=0&e=0&r=&b=5202&t=DqJw2WCbmly1BpEMV-CS-yXNuCFq5&V=126&i=Malicious%20PowerShell%20Use%2C%20Attacks%20on%20Office%20365%20...&tz=-120&sn=1&sv=RqqcjDcuix_DaghaPDol_ErCQPLNn&sd=1&im=067b0efa&_
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.210.109.30 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-210-109-30.compute-1.amazonaws.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 16 Apr 2021 11:19:37 GMT
cache-control
no-cache, no-store, must-revalidate
content-type
image/gif
content-length
43
expires
0
wkpRfPPcRT5gRuVOwfaUS9di2m_GhEf8-oTDdHI7uwk.js
pagead2.googlesyndication.com/bg/ Frame 7120
14 KB
6 KB
Script
General
Full URL
https://pagead2.googlesyndication.com/bg/wkpRfPPcRT5gRuVOwfaUS9di2m_GhEf8-oTDdHI7uwk.js
Requested by
Host: tpc.googlesyndication.com
URL: https://tpc.googlesyndication.com/sodar/sodar2/222/runner.html
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c24a517cf3dc453e6046e54ec1f6944bd762da6fc68447fcfa84c374723bbb09
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://tpc.googlesyndication.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

date
Fri, 16 Apr 2021 10:41:42 GMT
content-encoding
br
x-content-type-options
nosniff
last-modified
Thu, 08 Apr 2021 09:18:00 GMT
server
sffe
age
2275
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
5710
x-xss-protection
0
expires
Sat, 16 Apr 2022 10:41:42 GMT
gen_204
pagead2.googlesyndication.com/pagead/
0
20 B
Image
General
Full URL
https://pagead2.googlesyndication.com/pagead/gen_204?id=sodar2&v=222&t=2&li=gpt_2021041401&jk=1273043803101932&bg=!LyylLGjNAAZUuIlwVLg7ACkAdvg8WrPjCdImlj45zlslawgiZq4lQxl1_5jActF2EYM_H79TL0inNgIAAACLUgAAAA9oAQcKAL94ieZK39cpywWAYzEJM2eFvv0-0bIHxuE_cKeeZGE7_vX3Y8_gRedcKMXEQ1siPhf-jVqezYuvV7I2jwcFODU3nFhw3EHCphmzDWCsjKmhbH2EZJ-rC-obM1qPbN_yifOcb5v5wznPjIgwpmCFbJGU81SOdxLuNkOEBwFcNE-X4_7GPBWZdvejH_yita-ojxTWUsxhAjm1GWC82epEJr9xf40IlNtBcoBS6eJeXO2t7Qg5LWDIk624phqsjqXHxJkCMVafSoSoNHzrP0JJnnpDEXh0dbtfBVySsIWJEjBryPUCaFEHF__D8W7AnorQ9RdtBDF_2NivKQi-uuWRw94XEzSKUtiUjgnlpmr-JFGKv65eXq6zzqpYf1GKBx9DD_sbhLRLHEf3xXWfh3Rrm_YeVy-PuKkDc9ABo1J5V0mMC59sZRonl_labgE1an0TMx2MTeYVxVdMMP-M0LcbJow7mFLr7VYFbp5LfhyFE87KF6ybILpidNBErvclCWcKix_auThYpOT7eeEmQOi4wjSMUcPGr2huLzDYOflWGxTkO2Hv_NyDmfWNf80Gz6cLMYPb55op-VYyqgF3dOzrUgoHLUlQ9ckDW6LUShN3MZcXDgSZ10b21zEYfMuGK_SrGKn-FEKDB6VXJRlgteuCKRTDChD3vPahd5ZBsbM0oI0C87rwr3uhDEYZYZRlqvI6AffC3TgC8eu7b-829dZo6yb1XGJgBvqze8adbGziMNQ1Qhusi38WGyPeE186oHai2TPQ-xQySzVSR8iN3YjU5rGjxVoIcSXRmst13tuqbwl5uoZoe7KJAMbf-dZ9epuLufJOa5kNCtvMFXxMTVrTBc7m-yhetMyJNMtl7LHBl9Rou4P1rZ1TA92bAjmjGsVdyDsUs3s1k2Zy0YPoGI17OQCdrcIAJoxZGD4r9Z0GtxhJNA7ZSKQE_BY6syaMksItpzJZZizbj88TrbUSzDTtfemEb1wHO8l64WBkcDlOjyBxcokYgA
Protocol
H3-29
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 16 Apr 2021 11:19:37 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
consent_tcfv2.js
s.adroll.com/j/
397 KB
55 KB
Script
General
Full URL
https://s.adroll.com/j/consent_tcfv2.js
Requested by
Host: s.adroll.com
URL: https://s.adroll.com/j/roundtrip.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:7100::687e:24b0 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
AmazonS3 /
Resource Hash
bf40c262b047615208bc2d84984e7854b8a2ec9801f1c6e99c0b79a9f32380b5

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

x-amz-version-id
7sDcLvGKTPrh8xIq2f5DynXc_Mi9vQVX
Content-Encoding
gzip
ETag
"1f2c64002f8e1b6eb56c304c2e892afb"
x-amz-request-id
9C0A466D5B644741
x-amz-server-side-encryption
AES256
Connection
keep-alive
Vary
Accept-Encoding
Content-Length
55575
x-amz-id-2
RKvpIdckCIUfU1lGu4A9Vc4434+rKFeY6PhXnAc0s4O7wCj+IxmfMnCnJnqRhSwxJEODB4ztDYM=
Last-Modified
Mon, 07 Dec 2020 23:59:35 GMT
Server
AmazonS3
Date
Fri, 16 Apr 2021 11:19:37 GMT
Access-Control-Max-Age
600
Access-Control-Allow-Methods
GET
Content-Type
application/javascript
Access-Control-Allow-Origin
*
Cache-Control
max-age=300, must-revalidate
Access-Control-Allow-Credentials
false
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
favicon-32x32.png
nextroll.com/
2 KB
2 KB
Image
General
Full URL
https://nextroll.com/favicon-32x32.png
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.203.96.188 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-52-203-96-188.compute-1.amazonaws.com
Software
Apache /
Resource Hash
bcaf0e3f087296133e0a996ee3d289a8d1a690147c93e0ab62019b505e6f9355

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 16 Apr 2021 11:19:37 GMT
Via
1.1 vegur
Last-Modified
Thu, 08 Apr 2021 16:18:59 GMT
Server
Apache
Etag
"64f-5bf78679ee2c0"
Content-Type
image/png
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
1615
eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNjE4NTcxOTc0eDIwNjMzNWVlNWRhOGNmeDk2NzQ2MzkyIiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIwNTU0Mjc4NzEwNjYzMjA3NDQiLCJpbmRle...
track.celtra.com/json/
35 B
242 B
Image
General
Full URL
https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNjE4NTcxOTc0eDIwNjMzNWVlNWRhOGNmeDk2NzQ2MzkyIiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIwNTU0Mjc4NzEwNjYzMjA3NDQiLCJpbmRleCI6OCwiY2xpZW50VGltZXN0YW1wIjoxNjE4NTcxOTc3LjM3OCwibmFtZSI6InZpZXdhYmxlNTAxIiwiY3JpdGVyaW9uIjp7Im5hbWUiOiI1MC8xIiwicmF0aW8iOjAuNSwidGltZSI6MTAwMH19XX0=?crc32c=4157970440
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.184.103.42 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 16 Apr 2021 11:19:37 GMT
Cache-Control
no-cache, no-store, must-revalidate
Expires
0
Connection
keep-alive
Content-Length
35
Content-Type
image/gif
eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNjE4NTcxOTc0eDIwNjMzNWVlNWRhOGNmeDk2NzQ2MzkyIiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIwNTU0Mjc4NzEwNjYzMjA3NDQiLCJpbmRle...
track.celtra.com/json/
35 B
242 B
Image
General
Full URL
https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNjE4NTcxOTc0eDIwNjMzNWVlNWRhOGNmeDk2NzQ2MzkyIiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIwNTU0Mjc4NzEwNjYzMjA3NDQiLCJpbmRleCI6OSwiY2xpZW50VGltZXN0YW1wIjoxNjE4NTcxOTc3LjM4NiwibmFtZSI6InZpZXdhYmxlVGltZSIsImZyb20iOjE2MTg1NzE5NzYuMzcyLCJ0byI6MTYxODU3MTk3Ny4zODV9XX0=?crc32c=2731784190
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.184.103.42 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 16 Apr 2021 11:19:37 GMT
Cache-Control
no-cache, no-store, must-revalidate
Expires
0
Connection
keep-alive
Content-Length
35
Content-Type
image/gif
jot.html
platform.twitter.com/ Frame 2E3C
Redirect Chain
  • https://syndication.twitter.com/i/jot
  • https://platform.twitter.com/jot.html
80 B
600 B
Document
General
Full URL
https://platform.twitter.com/jot.html
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
93.184.220.66 London, United Kingdom, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (ska/F6FC) /
Resource Hash
90214d135602962e47ea9587a7eeb62fac1c64a541e373ea76e2b4e8b33e3f88

Request headers

Host
platform.twitter.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
Origin
https://www.darkreading.com
Content-Type
application/x-www-form-urlencoded
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Accept-Ranges
bytes
Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Access-Control-Max-Age
3000
Age
41254
Cache-Control
public, max-age=315360000
Content-Type
text/html; charset=utf-8
Date
Fri, 16 Apr 2021 11:19:37 GMT
Etag
"d9592a6c704736fa4da218d4357976dd"
Last-Modified
Thu, 15 Apr 2021 22:47:44 GMT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server
ECS (ska/F6FC)
X-Cache
HIT
x-tw-cdn
VZ
Content-Length
80

Redirect headers

cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
content-length
0
content-type
text/html;charset=utf-8
date
Fri, 16 Apr 2021 11:19:37 GMT
expires
Tue, 31 Mar 1981 05:00:00 GMT
last-modified
Fri, 16 Apr 2021 11:19:37 GMT
location
https://platform.twitter.com/jot.html
pragma
no-cache
server
tsa_o
status
302 Found
strict-transport-security
max-age=631138519
x-connection-hash
b010fdcddc424606afaa94aa88c13692
x-content-type-options
nosniff
x-frame-options
SAMEORIGIN
x-response-time
131
x-transaction
0039d6d500b2eb6d
x-tsa-request-body-time
30
x-twitter-response-tags
BouncerCompliant
x-xss-protection
0
pixel.gif
px.moatads.com/
43 B
260 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=37&q=0&hp=1&wf=1&pxm=6&vb=13&kq=1&lo=4&uk=null&pk=0&wk=1&rk=1&tk=1&ak=-&i=PENTONMEDIA1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-nwvw4053N9oCRb36FcojwKWkUwdJEJMXJKBAOq%2BVT%2Bl2tvnQIIWF3cA%2B&sc=1&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=600&w=300&fy=18&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&id=1&ii=4&f=0&j=&t=1618571974883&de=714013790740&cu=1618571974883&m=2835&ar=e4967b0-clean&iw=64bab64&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=6127&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A2157%3A2291%3A0%3A0&as=1&ag=1171&an=82&gi=1&gf=1171&gg=82&ix=1171&ic=1171&ez=1&ck=1171&kw=1051&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1171&bx=82&ci=1171&jz=1051&dj=1&aa=1&ad=1069&cn=0&gn=1&gk=1069&gl=0&ik=1069&co=1069&cp=1051&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1051&cd=163&ah=1051&am=163&rf=0&re=0&wb=1&cl=0&at=0&d=5003554797%3A2837012561%3A5656213172%3A138344901188&bo=22316126855&bp=22326604369&bd=TAPunit&zMoatPS=TAPunit&gw=pentonmedia53440730609&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22326604369&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22326604369&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685&zMoatDev=Desktop&zMoatDfpSlotId=div-gpt-ad-961777897907396673-8&hv=Exps%3A%20Celtra%20Banner%2FVideo%20%7C%20Celtra%20API&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=div-gpt-ad-961777897907396673-8&iq=na&tt=na&tc=0&fs=189983&na=1385938530&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 16 Apr 2021 11:19:37 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Fri, 16 Apr 2021 11:19:37 GMT
pixel.gif
px.moatads.com/
43 B
260 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=5&q=0&hp=1&wf=1&pxm=6&vb=13&kq=1&lo=4&uk=null&pk=0&wk=1&rk=1&tk=1&ak=-&i=PENTONMEDIA1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-nwvw4053N9oCRb36FcojwKWkUwdJEJMXJKBAOq%2BVT%2Bl2tvnQIIWF3cA%2B&sc=1&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=2&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=600&w=300&fy=18&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&id=1&ii=4&f=0&j=&t=1618571974883&de=714013790740&cu=1618571974883&m=2838&ar=e4967b0-clean&iw=64bab64&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=6127&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A2157%3A2291%3A0%3A0&as=1&ag=1171&an=1171&gi=1&gf=1171&gg=1171&ix=1171&ic=1171&ez=1&ck=1171&kw=1051&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1171&bx=1171&ci=1171&jz=1051&dj=1&aa=1&ad=1069&cn=1069&gn=1&gk=1069&gl=1069&ik=1069&co=1069&cp=1051&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1051&cd=1051&ah=1051&am=1051&rf=0&re=0&wb=1&cl=0&at=0&d=5003554797%3A2837012561%3A5656213172%3A138344901188&bo=22316126855&bp=22326604369&bd=TAPunit&zMoatPS=TAPunit&gw=pentonmedia53440730609&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22326604369&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22326604369&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685&zMoatDev=Desktop&zMoatDfpSlotId=div-gpt-ad-961777897907396673-8&hv=Exps%3A%20Celtra%20Banner%2FVideo%20%7C%20Celtra%20API&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=div-gpt-ad-961777897907396673-8&iq=na&tt=na&tc=0&fs=189983&na=1806330355&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 16 Apr 2021 11:19:37 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Fri, 16 Apr 2021 11:19:37 GMT
pixel.gif
px.moatads.com/
43 B
260 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=37&q=1&hp=1&wf=1&pxm=6&vb=13&kq=1&lo=4&uk=null&pk=0&wk=1&rk=1&tk=1&ak=-&i=PENTONMEDIA1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-nwvw4053N9oCRb36FcojwKWkUwdJEJMXJKBAOq%2BVT%2Bl2tvnQIIWF3cA%2B&sc=1&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=3&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=600&w=300&fy=18&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&id=1&ii=4&f=0&j=&t=1618571974883&de=714013790740&cu=1618571974883&m=2839&ar=e4967b0-clean&iw=64bab64&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=6127&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A2157%3A2291%3A0%3A0&as=1&ag=1171&an=1171&gi=1&gf=1171&gg=1171&ix=1171&ic=1171&ez=1&ck=1171&kw=1051&aj=1&pg=100&pf=100&ib=0&cc=1&bw=1171&bx=1171&ci=1171&jz=1051&dj=1&aa=1&ad=1069&cn=1069&gn=1&gk=1069&gl=1069&ik=1069&co=1069&cp=1051&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=1051&cd=1051&ah=1051&am=1051&rf=0&re=0&wb=1&cl=0&at=0&d=5003554797%3A2837012561%3A5656213172%3A138344901188&bo=22316126855&bp=22326604369&bd=TAPunit&zMoatPS=TAPunit&gw=pentonmedia53440730609&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22326604369&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22326604369&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685&zMoatDev=Desktop&zMoatDfpSlotId=div-gpt-ad-961777897907396673-8&hv=Exps%3A%20Celtra%20Banner%2FVideo%20%7C%20Celtra%20API&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=div-gpt-ad-961777897907396673-8&iq=na&tt=na&tc=0&fs=189983&na=501707925&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 16 Apr 2021 11:19:37 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Fri, 16 Apr 2021 11:19:37 GMT
utsync.ashx
ml314.com/ Frame F5D2
62 B
572 B
Script
General
Full URL
https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=62439&ct=js&pi=&fp=&clid=&if=1&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&pv=1618571975244_ubyiscx0b&bl=en-us&cb=5447859&return=&ht=&d=&dc=&si=1618571975244_ubyiscx0b&cid=&s=1600x1200&rp=
Requested by
Host: ml314.com
URL: https://ml314.com/tag.aspx?1632021
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.49.20.76 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
5a1ba6ff6db12f791bbbfc4da3cb389e06f0cd53eede09ef3eb3ceb074089ef1

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 16 Apr 2021 11:19:37 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
p3P
CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
Cache-Control
no-cache, no-store, must-revalidate
Connection
keep-alive
Content-Type
application/javascript; charset=utf-8
Content-Length
147
Expires
0
ud.ashx
in.ml314.com/ Frame F5D2
20 B
482 B
Script
General
Full URL
https://in.ml314.com/ud.ashx?topiclimit=&cb=1632021
Requested by
Host: ml314.com
URL: https://ml314.com/tag.aspx?1632021
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.214.0.136 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Date
Fri, 16 Apr 2021 11:19:38 GMT
Content-Encoding
gzip
Server
Microsoft-IIS/10.0
X-AspNet-Version
4.0.30319
X-Powered-By
ASP.NET
Vary
Accept-Encoding
Content-Type
application/javascript; charset=utf-8
Cache-Control
public
Connection
keep-alive
Content-Length
138
Expires
Sat, 17 Apr 2021 11:19:38 GMT
eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNjE4NTcxOTc0eDIwNjMzNWVlNWRhOGNmeDk2NzQ2MzkyIiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIwNTU0Mjc4NzEwNjYzMjA3NDQiLCJpbmRle...
track.celtra.com/json/
35 B
242 B
Image
General
Full URL
https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNjE4NTcxOTc0eDIwNjMzNWVlNWRhOGNmeDk2NzQ2MzkyIiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIwNTU0Mjc4NzEwNjYzMjA3NDQiLCJpbmRleCI6MTAsImNsaWVudFRpbWVzdGFtcCI6MTYxODU3MTk3OC40MTYsIm5hbWUiOiJ2aWV3YWJsZVRpbWUiLCJmcm9tIjoxNjE4NTcxOTc3LjM4NSwidG8iOjE2MTg1NzE5NzguMzg4fV19?crc32c=699726056
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.184.103.42 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 16 Apr 2021 11:19:38 GMT
Cache-Control
no-cache, no-store, must-revalidate
Expires
0
Connection
keep-alive
Content-Length
35
Content-Type
image/gif
eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNjE4NTcxOTc0eDIwNjMzNWVlNWRhOGNmeDk2NzQ2MzkyIiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIwNTU0Mjc4NzEwNjYzMjA3NDQiLCJpbmRle...
track.celtra.com/json/
35 B
242 B
Image
General
Full URL
https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNjE4NTcxOTc0eDIwNjMzNWVlNWRhOGNmeDk2NzQ2MzkyIiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIwNTU0Mjc4NzEwNjYzMjA3NDQiLCJpbmRleCI6MTEsImNsaWVudFRpbWVzdGFtcCI6MTYxODU3MTk3OS40NTcsIm5hbWUiOiJ2aWV3YWJsZVRpbWUiLCJmcm9tIjoxNjE4NTcxOTc4LjM4OCwidG8iOjE2MTg1NzE5NzkuNDQxfV19?crc32c=242783399
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.184.103.42 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 16 Apr 2021 11:19:39 GMT
Cache-Control
no-cache, no-store, must-revalidate
Expires
0
Connection
keep-alive
Content-Length
35
Content-Type
image/gif
pixel.gif
px.moatads.com/
43 B
260 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&wf=1&pxm=6&vb=13&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=1&ak=-&i=PENTONMEDIA1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-nwvw4053N9oCRb36FcojwKWkUwdJEJMXJKBAOq%2BVT%2Bl2tvnQIIWF3cA%2B&sc=1&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=4&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&id=1&ii=4&f=0&j=&t=1618571974860&de=113213272367&cu=1618571974860&m=5084&ar=e4967b0-clean&iw=64bab64&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=6127&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A2157%3A2291%3A0%3A0&as=1&ag=5075&an=1184&gi=1&gf=5075&gg=1184&ix=5075&ic=5075&ez=1&ck=1184&kw=914&aj=1&pg=100&pf=100&ib=0&cc=1&bw=5075&bx=1184&ci=1184&jz=914&dj=1&aa=1&ad=4908&cn=1017&gn=1&gk=4908&gl=1017&ik=4908&co=1017&cp=914&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=4872&cd=914&ah=4872&am=914&rf=0&re=1&ft=4805&fv=1017&fw=1017&wb=2&cl=0&at=0&d=5004235589%3A2837984555%3A5657449612%3A138345261839&bo=22316126855&bp=22326604369&bd=top&zMoatPS=top&gw=pentonmedia53440730609&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22326604369&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22326604369&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685&zMoatDev=Desktop&zMoatDfpSlotId=div-gpt-ad-961777897907396673-3&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=div-gpt-ad-961777897907396673-3&iq=na&tt=na&tc=0&fs=189983&na=1055143107&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 16 Apr 2021 11:19:39 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Fri, 16 Apr 2021 11:19:39 GMT
pixel.gif
px.moatads.com/
43 B
260 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&wf=1&pxm=6&vb=13&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=1&ak=-&i=PENTONMEDIA1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-nwvw4053N9oCRb36FcojwKWkUwdJEJMXJKBAOq%2BVT%2Bl2tvnQIIWF3cA%2B&sc=1&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=4&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&id=1&ii=4&f=0&j=&t=1618571974817&de=110898614312&cu=1618571974817&m=5145&ar=e4967b0-clean&iw=64bab64&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=6127&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=58&vx=58%3A58%3A-&pe=1%3A2157%3A2291%3A0%3A0&as=1&ag=5123&an=1230&gi=1&gf=1546&gg=1230&ix=1546&ic=1546&ez=1&ck=1230&kw=971&aj=1&pg=100&pf=100&ib=0&cc=1&bw=5123&bx=1230&ci=1230&jz=971&dj=1&aa=1&ad=4948&cn=1055&gn=1&gk=1371&gl=1055&ik=1371&co=1055&cp=971&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=4927&cd=971&ah=4927&am=971&rf=0&re=1&ft=4848&fv=1055&fw=1055&wb=1&cl=0&at=0&d=5003554797%3A2837012561%3A5656213172%3A138344902208&bo=22316126855&bp=22326604369&bd=rec1&zMoatPS=rec1&gw=pentonmedia53440730609&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22326604369&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22326604369&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685&zMoatDev=Desktop&zMoatDfpSlotId=div-gpt-ad-961777897907396673-4&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=div-gpt-ad-961777897907396673-4&iq=na&tt=na&tc=0&fs=189983&na=1096232334&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 16 Apr 2021 11:19:40 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Fri, 16 Apr 2021 11:19:40 GMT
pixel.gif
px.moatads.com/
43 B
260 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&wf=1&pxm=6&vb=13&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=1&ak=-&i=PENTONMEDIA1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-nwvw4053N9oCRb36FcojwKWkUwdJEJMXJKBAOq%2BVT%2Bl2tvnQIIWF3cA%2B&sc=1&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&id=1&ii=4&f=0&j=&t=1618571975099&de=368686243207&cu=1618571975099&m=5398&ar=e4967b0-clean&iw=64bab64&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=6127&le=1&gm=1&io=1&vv=1&vw=1%3A3%3A0&vp=0&vx=0%3A0%3A-&pe=1%3A2157%3A2291%3A0%3A0&as=0&ag=0&an=0&gf=0&gg=0&ix=0&ic=0&aj=0&pg=0&pf=0&ib=1&cc=0&bw=0&bx=0&dj=0&aa=0&ad=0&cn=0&gk=0&gl=0&ik=0&cq=0&im=0&in=0&pd=0&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=5182&cd=5&ah=5182&am=5&rf=0&re=1&wb=1&cl=0&at=0&d=4858577417%3A2838057998%3A5656631199%3A138345615798&bo=22316126855&bp=22326604369&bd=rec2&zMoatPS=rec2&gw=pentonmedia53440730609&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22326604369&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22326604369&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685&zMoatDev=Desktop&zMoatDfpSlotId=div-gpt-ad-961777897907396673-5&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&oq=0&ot=0&zMoatJS=3%3A-&ti=0&ih=1&tz=div-gpt-ad-961777897907396673-5&iq=na&tt=na&tc=0&fs=189983&na=337326172&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 16 Apr 2021 11:19:40 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Fri, 16 Apr 2021 11:19:40 GMT
eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNjE4NTcxOTc0eDIwNjMzNWVlNWRhOGNmeDk2NzQ2MzkyIiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIwNTU0Mjc4NzEwNjYzMjA3NDQiLCJpbmRle...
track.celtra.com/json/
35 B
242 B
Image
General
Full URL
https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNjE4NTcxOTc0eDIwNjMzNWVlNWRhOGNmeDk2NzQ2MzkyIiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIwNTU0Mjc4NzEwNjYzMjA3NDQiLCJpbmRleCI6MTIsImNsaWVudFRpbWVzdGFtcCI6MTYxODU3MTk4MS40NjksIm5hbWUiOiJ2aWV3YWJsZVRpbWUiLCJmcm9tIjoxNjE4NTcxOTc5LjQ0MSwidG8iOjE2MTg1NzE5ODEuNDU3fV19?crc32c=3917144607
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.184.103.42 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 16 Apr 2021 11:19:41 GMT
Cache-Control
no-cache, no-store, must-revalidate
Expires
0
Connection
keep-alive
Content-Length
35
Content-Type
image/gif
pixel.gif
px.moatads.com/
43 B
260 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=9&q=0&hp=1&wf=1&pxm=6&vb=13&kq=1&lo=4&uk=null&pk=0&wk=1&rk=1&tk=1&ak=-&i=PENTONMEDIA1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-nwvw4053N9oCRb36FcojwKWkUwdJEJMXJKBAOq%2BVT%2Bl2tvnQIIWF3cA%2B&sc=1&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=4&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=600&w=300&fy=18&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&id=1&ii=4&f=0&j=&t=1618571974883&de=714013790740&cu=1618571974883&m=6684&ar=e4967b0-clean&iw=64bab64&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=6127&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A2157%3A2291%3A0%3A0&as=1&ag=5021&an=1171&gi=1&gf=5021&gg=1171&ix=5021&ic=5021&ez=1&ck=1171&kw=1051&aj=1&pg=100&pf=100&ib=0&cc=1&bw=5021&bx=1171&ci=1171&jz=1051&dj=1&aa=1&ad=4919&cn=1069&gn=1&gk=4919&gl=1069&ik=4919&co=1069&cp=1051&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=4901&cd=1051&ah=4901&am=1051&rf=0&re=0&wb=2&cl=0&at=0&d=5003554797%3A2837012561%3A5656213172%3A138344901188&bo=22316126855&bp=22326604369&bd=TAPunit&zMoatPS=TAPunit&gw=pentonmedia53440730609&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22326604369&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22326604369&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685&zMoatDev=Desktop&zMoatDfpSlotId=div-gpt-ad-961777897907396673-8&hv=Exps%3A%20Celtra%20Banner%2FVideo%20%7C%20Celtra%20API&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=div-gpt-ad-961777897907396673-8&iq=na&tt=na&tc=0&fs=189983&na=1128298142&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 16 Apr 2021 11:19:41 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Fri, 16 Apr 2021 11:19:41 GMT
eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNjE4NTcxOTc0eDIwNjMzNWVlNWRhOGNmeDk2NzQ2MzkyIiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIwNTU0Mjc4NzEwNjYzMjA3NDQiLCJpbmRle...
track.celtra.com/json/
35 B
242 B
Image
General
Full URL
https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNjE4NTcxOTc0eDIwNjMzNWVlNWRhOGNmeDk2NzQ2MzkyIiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIwNTU0Mjc4NzEwNjYzMjA3NDQiLCJpbmRleCI6MTMsImNsaWVudFRpbWVzdGFtcCI6MTYxODU3MTk4My40ODUsIm5hbWUiOiJ2aWV3YWJsZVRpbWUiLCJmcm9tIjoxNjE4NTcxOTgxLjQ1NywidG8iOjE2MTg1NzE5ODMuNDd9XX0=?crc32c=3166691301
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.184.103.42 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 16 Apr 2021 11:19:43 GMT
Cache-Control
no-cache, no-store, must-revalidate
Expires
0
Connection
keep-alive
Content-Length
35
Content-Type
image/gif
pixel.gif
px.moatads.com/
43 B
260 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=11&i=PENTONMEDIA1&hp=1&wf=1&pxm=6&vb=13&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&k=&bq=0&f=0&j=&t=1618571974684&de=217309880495&m=0&ar=e4967b0-clean&iw=64bab64&q=28&cb=0&ym=0&cu=1618571974684&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=5003554797%3A2837012561%3A5656213172%3A138345349102&zMoatPS=wallpaper&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685&zMoatDev=Desktop&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&id=1&ii=4&bo=22316126855&bp=22326604369&bd=wallpaper&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22326604369&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22326604369&gw=pentonmedia53440730609&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A2157%3A2291%3A0%3A0&iq=na&tt=na&fs=189983&na=67239471&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 16 Apr 2021 11:19:44 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Fri, 16 Apr 2021 11:19:44 GMT
pixel.gif
px.moatads.com/
43 B
260 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=9&q=1&hp=1&wf=1&pxm=6&vb=13&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=1&ak=-&i=PENTONMEDIA1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-nwvw4053N9oCRb36FcojwKWkUwdJEJMXJKBAOq%2BVT%2Bl2tvnQIIWF3cA%2B&sc=1&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=5&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=250&w=300&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&id=1&ii=4&f=0&j=&t=1618571974817&de=110898614312&cu=1618571974817&m=10030&ar=e4967b0-clean&iw=64bab64&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=6127&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=58&vx=58%3A58%3A-&pe=1%3A2157%3A2291%3A0%3A0&as=1&ag=10008&an=5123&gi=1&gf=1546&gg=1546&ix=1546&ic=1546&ez=1&ck=1230&kw=971&aj=1&pg=100&pf=100&ib=0&cc=1&bw=10008&bx=5123&ci=1230&jz=971&dj=1&aa=1&ad=9833&cn=4948&gn=1&gk=1371&gl=1371&ik=1371&co=1055&cp=971&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=9806&cd=4927&ah=9806&am=4927&rf=0&re=1&ft=4848&fv=4848&fw=1055&wb=1&cl=0&at=0&d=5003554797%3A2837012561%3A5656213172%3A138344902208&bo=22316126855&bp=22326604369&bd=rec1&zMoatPS=rec1&gw=pentonmedia53440730609&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22326604369&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22326604369&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685&zMoatDev=Desktop&zMoatDfpSlotId=div-gpt-ad-961777897907396673-4&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=div-gpt-ad-961777897907396673-4&iq=na&tt=na&tc=0&fs=189983&na=1686542617&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 16 Apr 2021 11:19:44 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Fri, 16 Apr 2021 11:19:44 GMT
pixel.gif
px.moatads.com/
43 B
260 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=11&i=PENTONMEDIA1&hp=1&wf=1&pxm=6&vb=13&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&k=&bq=0&f=0&j=&t=1618571974897&de=592398994267&m=0&ar=e4967b0-clean&iw=64bab64&q=29&cb=0&ym=0&cu=1618571974897&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=5004232994%3A2838439431%3A5658199367%3A138345856094&zMoatPS=native&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685&zMoatDev=Desktop&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&id=1&ii=4&bo=22316126855&bp=22326604369&bd=native&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22326604369&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22326604369&gw=pentonmedia53440730609&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A2157%3A2291%3A0%3A0&iq=na&tt=na&fs=189983&na=1527544138&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 16 Apr 2021 11:19:44 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Fri, 16 Apr 2021 11:19:44 GMT
pixel.gif
px.moatads.com/
43 B
260 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=9&q=1&hp=1&wf=1&pxm=6&vb=13&kq=1&lo=0&uk=null&pk=0&wk=1&rk=1&tk=1&ak=-&i=PENTONMEDIA1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-nwvw4053N9oCRb36FcojwKWkUwdJEJMXJKBAOq%2BVT%2Bl2tvnQIIWF3cA%2B&sc=1&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=5&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=90&w=728&fy=0&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&id=1&ii=4&f=0&j=&t=1618571974860&de=113213272367&cu=1618571974860&m=10130&ar=e4967b0-clean&iw=64bab64&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=6127&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A2157%3A2291%3A0%3A0&as=1&ag=10121&an=5075&gi=1&gf=10121&gg=5075&ix=10121&ic=10121&ez=1&ck=1184&kw=914&aj=1&pg=100&pf=100&ib=0&cc=1&bw=10121&bx=5075&ci=1184&jz=914&dj=1&aa=1&ad=9954&cn=4908&gn=1&gk=9954&gl=4908&ik=9954&co=1017&cp=914&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=9916&cd=4872&ah=9916&am=4872&rf=0&re=1&ft=4805&fv=4805&fw=1017&wb=2&cl=0&at=0&d=5004235589%3A2837984555%3A5657449612%3A138345261839&bo=22316126855&bp=22326604369&bd=top&zMoatPS=top&gw=pentonmedia53440730609&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22326604369&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22326604369&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685&zMoatDev=Desktop&zMoatDfpSlotId=div-gpt-ad-961777897907396673-3&hv=Standard%20Image%20Ad%20finding%20&ab=1&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=div-gpt-ad-961777897907396673-3&iq=na&tt=na&tc=0&fs=189983&na=1199350600&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 16 Apr 2021 11:19:45 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Fri, 16 Apr 2021 11:19:45 GMT
pixel.gif
px.moatads.com/
43 B
260 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=11&i=PENTONMEDIA1&hp=1&wf=1&pxm=6&vb=13&kq=1&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&k=&bq=0&f=0&j=&t=1618571975479&de=141510940196&m=0&ar=e4967b0-clean&iw=64bab64&q=30&cb=0&ym=0&cu=1618571975479&ll=2&lm=0&ln=1&r=0&em=0&en=0&d=4448790601%3A2827245798%3A5653127970%3A138345413495&zMoatPS=video&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685&zMoatDev=Desktop&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&id=1&ii=4&bo=22316126855&bp=22326604369&bd=video&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22326604369&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22326604369&gw=pentonmedia53440730609&fd=1&ac=1&it=500&ti=0&ih=1&pe=1%3A2157%3A2291%3A0%3A3640&iq=na&tt=na&fs=189983&na=692443843&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 16 Apr 2021 11:19:45 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Fri, 16 Apr 2021 11:19:45 GMT
eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNjE4NTcxOTc0eDIwNjMzNWVlNWRhOGNmeDk2NzQ2MzkyIiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIwNTU0Mjc4NzEwNjYzMjA3NDQiLCJpbmRle...
track.celtra.com/json/
35 B
242 B
Image
General
Full URL
https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNjE4NTcxOTc0eDIwNjMzNWVlNWRhOGNmeDk2NzQ2MzkyIiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIwNTU0Mjc4NzEwNjYzMjA3NDQiLCJpbmRleCI6MTQsImNsaWVudFRpbWVzdGFtcCI6MTYxODU3MTk4NS41MDIsIm5hbWUiOiJ2aWV3YWJsZVRpbWUiLCJmcm9tIjoxNjE4NTcxOTgzLjQ3LCJ0byI6MTYxODU3MTk4NS40ODZ9XX0=?crc32c=2058800034
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.184.103.42 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 16 Apr 2021 11:19:45 GMT
Cache-Control
no-cache, no-store, must-revalidate
Expires
0
Connection
keep-alive
Content-Length
35
Content-Type
image/gif
pixel.gif
px.moatads.com/
43 B
260 B
Image
General
Full URL
https://px.moatads.com/pixel.gif?e=9&q=1&hp=1&wf=1&pxm=6&vb=13&kq=1&lo=4&uk=null&pk=0&wk=1&rk=1&tk=1&ak=-&i=PENTONMEDIA1&ol=3984263267&qn=%604%7BZEYwoqI%24%5BK%2BdLLU)%2CMm~t8!Z.%5BMhS%3A15.sn_003etW6~P6Jn)s)wC%24GL3jX%7BQqDOJ%3Eoy)G3p%2FhFjrR8D4Sq_GVK61%5Dml%22ZzTm!ja8V%22%3BU%5DDTg%7Df%2FH%40%26%2Bc%5B5IUOG(%2CWV%7BGrV~1HmDkP8D4rUDtmxT%3Bwv%40V374BKm55%3D%261fp%5BoU5tWhX%3C%3Ce%24%26~1%3Axkr%2BUe31k5X%5BG%5E%5B)%2C2iVSX%3C_Y%7B!7IQ3HbmUZzCFm%5Du!x2l.uBlTVU%2F.%3Dh%3Ft%40yUtKC&th=4007238046&tf=nMzjG---CSa7H-fUfHv-j7VIQD-xFQTS-nMzjG-&vi=111111&rc=0%2C0%2C0%2C0%2C0%2C1%2C0%2C0%2Cprobably%2Cprobably&rb=1-nwvw4053N9oCRb36FcojwKWkUwdJEJMXJKBAOq%2BVT%2Bl2tvnQIIWF3cA%2B&sc=1&os=&qp=00000&is=BBBBB2BBEYBvGl2BBCBBtUTBBRmsqbKW8BsrBu0rCFE48CRBeeBS2hWTMBBQeQBBn2soYggyUig0CBlWZ0uBBCCCCCCOgRBBiOfnE6Bkg7OxBb8MxOtJYHCBdm5kBhBBC9Y8oBXckXBR76iUUsJBCBBBBBBBBBWBSqj3BBBZeGV2BBBCMciUBBBjgEBBBBBB94UMgTdJMtEcpMBBBQBBBniOccBBBBBB47kNBBBBBBBBBBBBBhcjG6BBJM2L4Bk8BwCBQmIoRBBCzBz1BBCTClBBrbBBC4ehueB57NG9aJfR0BqBBiuwBBBB&iv=8&qt=0&gz=0&hh=0&hn=0&tw=&qc=0&qd=0&qf=1600&qe=1200&qh=1600&qg=1200&qm=-120&qa=1600&qb=1200&qi=1600&qj=1200&to=000&po=1-0020002000002120&vy=&ql=&qo=0&qr=0&vf=1&vg=100&bq=0&g=5&hq=0&hs=0&hu=0&hr=0&ht=0&dnt=0&h=600&w=300&fy=18&gp=0&zGSRC=1&gu=https%3A%2F%2Fwww.darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685%3F_mc%3Drss_x_drr_edt_aud_dr_x_x-rss-simple%26_hsmi%3D88974744%26_hsenc%3Dp2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU&id=1&ii=4&f=0&j=&t=1618571974883&de=714013790740&cu=1618571974883&m=11780&ar=e4967b0-clean&iw=64bab64&cb=0&ym=0&rd=1&ll=2&lm=0&ln=1&r=0&dl=0&dn=0&gh=1&xx=undefined%3A875484570224&td=1&lk=undefined&lb=6127&le=1&gm=1&io=1&ch=0&vv=1&vw=1%3A3%3A0&vp=100&vx=100%3A100%3A-&pe=1%3A2157%3A2291%3A0%3A0&as=1&ag=10117&an=5021&gi=1&gf=10117&gg=5021&ix=10117&ic=10117&ez=1&ck=1171&kw=1051&aj=1&pg=100&pf=100&ib=0&cc=1&bw=10117&bx=5021&ci=1171&jz=1051&dj=1&aa=1&ad=10015&cn=4919&gn=1&gk=10015&gl=4919&ik=10015&co=1069&cp=1051&cq=1&im=1&in=1&pd=1&nb=1&em=0&en=0&st=1&su=1&of=1&oz=1&oe=1%3A1%3A0%3Anull%3A-1%3Anull%3A-1%3Anull%3A-1&bu=9997&cd=4901&ah=9997&am=4901&rf=0&re=0&wb=2&cl=0&at=0&d=5003554797%3A2837012561%3A5656213172%3A138344901188&bo=22316126855&bp=22326604369&bd=TAPunit&zMoatPS=TAPunit&gw=pentonmedia53440730609&zMoatOrigSlicer1=22316126855&zMoatOrigSlicer2=22326604369&zMoatDomain=darkreading.com&zMoatSubdomain=darkreading.com&dfp=0%2C1&la=22326604369&zMoatMMV_MAX=na&zMoatMGV_MAX=na&zMoatCURL=darkreading.com%2Fperimeter%2Fmalicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4%2Fd%2Fd-id%2F1340685&zMoatDev=Desktop&zMoatDfpSlotId=div-gpt-ad-961777897907396673-8&hv=Exps%3A%20Celtra%20Banner%2FVideo%20%7C%20Celtra%20API&ab=3&ac=1&fd=1&kt=strict&it=500&fz=1&oq=1&ot=ff&zMoatJS=3%3A-&ti=0&ih=1&tz=div-gpt-ad-961777897907396673-8&iq=na&tt=na&tc=0&fs=189983&na=431132163&cs=0
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
184.30.21.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-30-21-162.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

pragma
no-cache
date
Fri, 16 Apr 2021 11:19:46 GMT
last-modified
Fri, 20 May 2016 15:16:00 GMT
server
AkamaiNetStorage
etag
"ad4b0f606e0f8465bc4c4c170b37e1a3:1463757360"
content-type
image/gif
cache-control
max-age=0, no-cache, no-store
accept-ranges
bytes
content-length
43
expires
Fri, 16 Apr 2021 11:19:46 GMT
eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNjE4NTcxOTc0eDIwNjMzNWVlNWRhOGNmeDk2NzQ2MzkyIiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIwNTU0Mjc4NzEwNjYzMjA3NDQiLCJpbmRle...
track.celtra.com/json/
35 B
242 B
Image
General
Full URL
https://track.celtra.com/json/eyJldmVudHMiOlt7InNlc3Npb25JZCI6InMxNjE4NTcxOTc0eDIwNjMzNWVlNWRhOGNmeDk2NzQ2MzkyIiwiYWNjb3VudElkIjoiNDRiNzRiMzUiLCJzdHJlYW0iOiJhZEV2ZW50cyIsImluc3RhbnRpYXRpb24iOiIwNTU0Mjc4NzEwNjYzMjA3NDQiLCJpbmRleCI6MTUsImNsaWVudFRpbWVzdGFtcCI6MTYxODU3MTk4Ny41MDYsIm5hbWUiOiJ2aWV3YWJsZVRpbWUiLCJmcm9tIjoxNjE4NTcxOTg1LjQ4NiwidG8iOjE2MTg1NzE5ODcuNTA0fV19?crc32c=1454647285
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.184.103.42 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer
https://www.darkreading.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.72 Safari/537.36

Response headers

Pragma
no-cache
Date
Fri, 16 Apr 2021 11:19:47 GMT
Cache-Control
no-cache, no-store, must-revalidate
Expires
0
Connection
keep-alive
Content-Length
35
Content-Type
image/gif

Verdicts & Comments Add Verdict or Comment

473 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| 7 object| 8 object| 9 object| 10 object| 11 object| 12 object| 13 object| 14 object| 15 object| onbeforexrselect object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker boolean| originAgentCluster object| trustedTypes boolean| crossOriginIsolated object| dataLayer function| displayDefaultNativeAd function| displayNativeAd function| displayLandingPageNativeAd function| displaySecondLandingPageNativeAd function| displayArticleNativeAd function| displayInsightAd function| displaySASInsightAd object| respond string| theSiteDomain string| theMsgChatQueueInclude string| theChatStatusInclude boolean| doHideShowDivOpacityFade function| MM_swapImgRestore function| MM_preloadImages function| MM_findObj function| MM_swapImage function| MM_openBrWindow function| SwitchColor function| MakeDark function| MakeLight string| pop_collection string| pop_styleObj function| GetObject function| SwitchHTML function| SwitchDivs function| HideDiv function| ShowDiv function| URLEncodeString object| opacitySliderTimeouts function| SlideObjOpacity function| ChangeObjOpacity object| heightSliderTimeouts function| SlideObjHeight function| ChangeObjHeight function| ClearTimeoutArray function| AttachEventFunctionToObject function| RemoveEventFunctionFromObject function| SetCookie function| GetCookie function| AlignObject function| MoveObject function| MoveDivToColTop function| AddEventListenerToObj function| ContentNotifyPrefsShortSubmit function| ContentNotifyPrefsShortGenerateAndDisplayRSSFeed function| RedirectConfirm function| blend function| returnPosYofObj function| returnPosXofObj function| returnCurrentWindowYOffset function| returnCurrentWindowXOffset object| menuMoverTimeouts number| menuMoverTimeoutCounter number| menuMaxOpacity function| ShowMenu function| ChangeObjectLeft function| ChangeObjectTop function| NumStepsToMove function| AddPopMenuEventListener boolean| lockPoppedMenu string| lockedPoppedMenuObjName function| PopMenu object| closeMenuTimeouts number| closeMenuTimeoutCounter function| PopMenuOff number| globalPopXDiff number| globalPopYDiff function| createSubmenu function| LRSliderHandler string| active_pop_collection string| active_pop_styleObj function| GetActiveObject function| PrintActiveContent function| LoadScript function| RemoveScript string| theRateLink function| ShowRateMenu function| ShowSaveInfo function| HideSaveInfo function| HideRateMenu function| RateThis function| ChangeRateMenuFormParam function| BuildAndLoadRateMenuScript function| ClearRateMenuForm function| ClearRateLink function| ContentConsumptionLoggedSuccess function| ContentSignUpLoggedSuccess function| ObjectFader function| PageEffectPopUp function| returnWidthofObj function| cookiesEnabled boolean| pop_ns4 boolean| pop_dom boolean| active_pop_ns4 boolean| active_pop_dom function| $ function| jQuery function| displayWhatsThisBox function| displayPartnerPerspectivesBox function| displayMalwareBytesPartnerPerspectivesBox function| displayEvidentioPartnerPerspectivesBox function| displayF5PartnerPerspectivesBox function| displayBitdefenderPartnerPerspectivesBox function| displayGeneralDynamicsFidelisPartnerPerspectivesBox function| displayPartnerPerspectivesBoxArticle function| displayMalwareBytesPartnerPerspectivesBoxArticle function| displayGigamonPartnerPerspectivesBoxArticle function| displayAuthorInfoBox function| highlightTopStory function| showMobileIconOverlay function| closeMobileOverlayMenu function| goToByScroll function| ToggleNavButtonMenu function| ToggleNavButton object| designlinesSliderHandler string| designlinesLeftArrowButtonMouseoutImgSrc string| designlinesRightArrowButtonMouseoutImgSrc number| oneScrollHeight number| currentTickerItem number| numberOfTickerItems boolean| tickerIsPopulated undefined| tickerTimeout boolean| tickerStopped function| InitializeNewsTicker function| RotateNewsTicker function| StartNewsTicker function| StopNewsTicker boolean| superNavEventsMenuOpen function| ToggleSuperNavEventsMenu function| swipeleftHandler function| swiperightHandler function| tapholdHandler function| tapholdOutHandler function| sizeAnyBrightcoveObjects function| sizeDocImageClass object| visitor function| Visitor object| s_c_il number| s_c_in object| adobe function| mboxCreate function| mboxDefine function| mboxUpdate function| getCookie function| setCookie string| thePageTitle string| ngenv string| ngserv string| omn_regtrackproduct string| omn_nltrackproduct function| CSBJs_Core function| CSBJs_OOP function| CSBJs_Resources function| CSBJs_ServiceRequest function| CSBJs_Exception function| CSBJs_Ajax function| CSBJs_Decorator function| CSBJs_Decorator_HtmlNode function| CSBJs_App function| CSBJs_App_Window function| CSBJs_App_Window_Modal function| CSBJs_App_Window_Alert function| CSBJs_App_Button function| CSBJs_App_Html function| CSBJs_App_Field function| CSBJs_App_Field_File function| CSBJs_App_Field_TextArea function| CSBJs_Timer function| CSBJs_Form function| CSBJs_Form_Group function| CSBJs_Form_Step function| CSBJs_Form_Element function| CSBJs_Form_Element_Html function| CSBJs_Form_Element_Image function| CSBJs_Form_Element_TextField function| CSBJs_Form_Element_OtherTextField function| CSBJs_Form_Element_Submit function| CSBJs_Form_Element_NextStep function| CSBJs_Form_Element_PreviousStep function| CSBJs_Form_Element_Reset function| CSBJs_Form_Element_Multi function| CSBJs_Form_Element_Select function| CSBJs_Form_Element_Password function| CSBJs_Form_Element_Dynamic function| CSBJs_Form_Element_Hidden function| CSBJs_Form_Element_Checkbox function| CSBJs_Form_Element_Checkboxes function| CSBJs_Form_Element_Radio function| CSBJs_Form_Element_TextArea function| CSBJs_Form_Validation function| CSBJs_Form_Validation_Regex function| CSBJs_Form_Validation_CompareEqual function| CSBJs_Form_Validation_Required function| CSBJs_Form_Validation_JsFunction function| CSBJs_Form_Validation_Ajax function| CSBJs_Form_Validation_JsonP function| CSBJs_Form_Observer function| CSBJs_Form_Observer_Action function| CSBJs_Form_Observer_Action_Hide function| CSBJs_Form_Observer_Action_ChangeDynamic function| CSBJs_Form_Filter function| CSBJs_Form_Filter_Replace function| UBM function| rcCallback string| siteLogo string| privacyLogo string| privacyText string| loginRedirectURL string| loginNextAction string| securityJobAction boolean| reloadOnClose object| ngconfig string| regHeaderContent string| regAction string| ngRegAsset object| loginWidget object| registrationWidget object| updateWidget object| optoutWidget object| newsletterWidget object| newsletterSignupWidget object| externalAuthSuppWidget function| openRegisterThanks function| login function| verifyToken function| securityJobsFromUpdate function| securityJobs function| loginWithMessage function| changePassword function| openForm function| updateForm function| newsletterForm function| newsletterSignupForm function| extAuthSuppForm function| ngLogoutUser function| ngCreateCookie function| ngRreadCookie function| ngEraseCookie function| trackShortRegistrationOpen function| trackSocialMediaBasicRegistration function| trackLongRegistrationOpen function| trackLoginOpen function| trackLoginSuccess function| trackPasswordResetOpen function| trackNewsletterPrefsOpen function| trackNewsletterPrefsConfirm function| trackShortRegistrationConfirm function| trackRegistrationThankYou object| welcomeLinks number| loginCheck string| loginHTML string| loginHTMLMobile function| initGatewayCheck function| setNGReg function| SubmitInPageSurvey number| _doubleclickRand function| jobalert object| _AdsNativeOpts object| googletag object| gptadslots object| ggeac object| google_js_reporting_queue function| Goog_AdSense_getAdAdapterInstance function| Goog_AdSense_OsdAdapter undefined| google_measure_js_timing object| _comscore function| fbq function| _fbq object| googleToken object| googleIMState function| processGoogleToken number| __google_ad_urls_id number| google_unique_id object| gaGlobal object| google_conversion_id object| google_custom_params object| google_remarketing_only function| GooglemKTybQhCsO object| google_conversion_date object| google_conversion_time number| google_conversion_snippets number| google_conversion_first_time object| google_conversion_js_version object| google_conversion_format object| google_enable_display_cookie_match object| google_tag_data object| google_conversion_type object| google_conversion_order_id object| google_conversion_language object| google_conversion_value object| google_conversion_currency object| google_conversion_domain object| google_conversion_label object| google_conversion_color object| google_disable_viewthrough object| google_gtag_event_data object| google_conversion_linker object| google_tag_for_child_directed_treatment object| google_tag_for_under_age_of_consent object| google_allow_ad_personalization_signals object| google_restricted_data_processing object| google_conversion_items object| google_conversion_merchant_id object| google_user_id object| onload_callback object| opt_image_generator object| google_gtm_url_processor object| google_conversion_page_url object| google_conversion_referrer_url object| google_gtm object| google_gcl_cookie_prefix object| google_gcl_cookie_path object| google_gcl_cookie_flags object| google_gcl_cookie_domain object| google_gcl_cookie_max_age_seconds object| google_read_gcl_cookie_opt_out object| google_basket_feed_country object| google_basket_feed_language object| google_basket_discount object| google_basket_transaction_type object| google_additional_conversion_params object| google_additional_params object| google_transport_url object| google_gtm_experiments object| uetq object| ab string| isblocked function| unhideMainContent object| _elqQ object| Bibblio object| BibblioActivity object| BibblioUtils object| BibblioEvents object| BibblioTemplates object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client object| __twttrll object| twttr object| __twttr object| __core-js_shared__ object| Sslac object| IN function| FlipboardWidgets object| google_tag_manager object| __google_ad_urls boolean| google_osd_loaded boolean| google_onload_fired string| _linkedin_data_partner_id number| _sf_startpt object| ube function| Togglehottopicseditorschoice function| udm_ object| ns_p object| COMSCORE object| FB object| lwvalues string| valueToUselw function| Toggleliveeventswebinarslive function| UET object| recaptcha object| video_reportsSliderHandler string| video_reportsLeftArrowButtonMouseoutImgSrc string| video_reportsRightArrowButtonMouseoutImgSrc function| Goog_Osd_UnloadAdBlock function| Goog_Osd_UpdateElementToMeasure function| google_osd_amcb object| Moat#G26 boolean| Moat#EVA object| MoatSuperV26 boolean| attachedML object| MoatDataJsonpRequest_83551184 function| lintrk boolean| _already_called_lintrk function| Dpxl object| dpmPixels object| jQuery1111005842484865330122 string| s_account object| s string| SCCodeVersion function| s_doPlugins function| getHier function| s_getLoadTime function| AppMeasurement_Module_ActivityMap function| AppMeasurement function| s_gi function| s_pgicq number| s_objectID number| s_giq undefined| s_code string| s_hour string| s_day string| s_timepart number| s_loadT string| x number| y number| d object| eo string| f0 object| s_i_cmpglobalvista string| thispage_sharelink string| adroll_adv_id string| adroll_pix_id string| adroll_segments boolean| recaptchaReady string| GoogleAnalyticsObject function| ga object| _sf_async_config object| __CELTRA object| teadsscript object| gaplugins object| gaData object| elqCookieValue object| _elq object| teads object| google_optimize boolean| __adroll_loaded number| _sf_endpt object| GoogleGcLKhOms string| adroll_sid object| __adroll boolean| adroll_optout object| adroll_ext_network object| adroll_callbacks function| adroll_tpc_callback object| _cb_shared object| pSUPERFLY_mab object| _cbq object| pSUPERFLY function| __cmp function| __tcfapi object| adroll_exp_list object| google_image_requests object| __adroll_consent boolean| __adroll_consent_is_gdpr object| __adroll_consent_data string| __adroll_consent_user_country string| __adroll_consent_adv_country object| $jscomp string| BANNER_VERSION string| TCF_VERSION string| IABWRITE_NO_COOKIE object| __adroll_consent_banner object| __adroll_consent_prev_lastchild

2 Cookies

Domain/Path Name / Value
.facebook.com/ Name: fr
Value: 0Xg6WtLWg5Puow2n6..BgeXLI...1.0.BgeXLI.
.darkreading.com/ Name: ELOQUA
Value: GUID=C5D86127639C44BDAE09CAF9E52DDDF0

10 Console Messages

Source Level URL
Text
console-api debug URL: https://info.silobreaker.com/e2t/tc/VVN1hK6LpV61VlXzTl38wDRqW2jjqKJ4qssLHN1TFhtc4Zc_rV3Zsc37CgB-MN3c-2KKDkJ89N2cnbCQpNmFPV8_9mg8HvN0FW2kkBk_6PdrKtW2P-QKG5BHGY0W2g3bnN6-RdkDW6SPp9W8DPlFVV5NMlQ6K_gNvW8PRX607zfNxGW1rkStj3RGCX1W567Zqw3q-bL_W1clxNf205cTkW5cjXWS7H7RsmW6CjyqP8vR1YhW8y86Z_7mSPqjN8QdVsctzGkrVTJr6G8hc4nmW45t02B8pk0HZW2Tlfw84QzwdPW6S9yLp4XmGgCW1YZtht7b1Y4zW33HCNp5_nfVwW5wYMRX264wttW90m6ns27D6BxV477dc79nS0DW6T4xVQ7M5JNXW7t8tFW2zgt2hN8SyYbrS6D-lW4Fj_tQ2vFVfjW271Wql4nM4FhW95-Qnj13vPpKN4F9p50Gwhf_N7F9BlpbWlgYW2TsPjw6DVz0y35xs1(Line 13)
Message:
toS
console-api warning URL: https://twimgs.com/custom/library.gtecevent.com/assets/at.js?ormzkk(Line 9)
Message:
AT: Adobe Target content delivery is disabled. Update your DOCTYPE to support Standards mode.
console-api log URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU(Line 425)
Message:
lpage==>notblocked
console-api log URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU(Line 433)
Message:
interstitial unit found
console-api log URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU(Line 435)
Message:
empty Interstitial
console-api log URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU(Line 447)
Message:
unhide main content
console-api info URL: https://cdn.bibblio.org/rcm/4.9/bib-related-content.min.js(Line 1)
Message:
Bibblio: This page has been queued for ingestion. Please note that a 404 response to GET /recommendations is normal. This tells us that the item does not exist and should be ingested. The 422 on POST /url-ingestions is also normal. It tells us that the item has already been queued for ingestion by a prior page load.
console-api info URL: https://platform.twitter.com/widgets.js(Line 1)
Message:
You may have been affected by an update to settings in embedded timelines. See https://twittercommunity.com/t/deprecating-widget-settings/102295. [object HTMLAnchorElement]
console-api log URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU(Line 428)
Message:
5 second timeout
console-api log URL: https://www.darkreading.com/perimeter/malicious-powershell-use-attacks-on-office-365-accounts-surged-in-q4/d/d-id/1340685?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple&_hsmi=88974744&_hsenc=p2ANqtz-_EP2yE05TwHa7jLz-tqvTrHGCsiI1jsD5UNZSGUtnb4EDcGGf8zi1Tc5AsE8q33vO5h3CTveqb3j3jpP42EESwGnQXQJV_r318NK9B3sm31gHZpqU(Line 447)
Message:
unhide main content

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

1c7c84c37158a202918275ae6d434610.safeframe.googlesyndication.com
6600d6d98e534115970f9529a45f3195.js.ubembed.com
a.dpmsrv.com
a.teads.tv
ads.celtra.com
adservice.google.com
adservice.google.de
api.bibblio.org
assets.ubembed.com
bat.bing.com
cache-ssl.celtra.com
cdn.bibblio.org
cdn.flipboard.com
cdn.syndication.twimg.com
cf-images.us-east-1.prod.boltdns.net
cm.everesttech.net
cm.g.doubleclick.net
connect.facebook.net
d.adroll.com
d.adroll.mgr.consensu.org
dpm.demdex.net
dsimg.ubm-us.net
fonts.googleapis.com
fonts.gstatic.com
geo.moatads.com
googleads.g.doubleclick.net
i.ubm-us.net
ib.adnxs.com
idsync.rlcdn.com
img.deusm.com
img.en25.com
img.lightreading.com
in.ml314.com
info.silobreaker.com
maxcdn.bootstrapcdn.com
ml314.com
nextroll.com
ng.techweb.com
pagead2.googlesyndication.com
pbs.twimg.com
ping.chartbeat.net
platform.linkedin.com
platform.twitter.com
px.ads.linkedin.com
px.moatads.com
s.adroll.com
s.dpmsrv.com
s8t.teads.tv
sb.scorecardresearch.com
securepubads.g.doubleclick.net
snap.licdn.com
static.chartbeat.com
static.xx.fbcdn.net
stats.g.doubleclick.net
syndication.twitter.com
t.teads.tv
ton.twimg.com
tpc.googlesyndication.com
track.celtra.com
trk.darkreading.com
twimgs.com
ubm.demdex.net
ubmtech.d3.sc.omtrdc.net
www.darkreading.com
www.dedoimedo.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googleadservices.com
www.googletagmanager.com
www.googletagservices.com
www.gstatic.com
www.linkedin.com
z.moatads.com
104.108.145.75
104.111.229.66
104.244.42.136
13.32.25.45
13.32.29.48
142.0.173.134
142.250.185.162
142.250.186.66
151.101.193.131
172.217.16.130
18.184.103.42
184.30.21.162
184.30.21.51
199.60.103.254
2600:9000:206f:fa00:18:1fcd:34e:d2a1
2600:9000:20e8:3600:e:5a70:ca47:86e1
2606:2800:134:1a0d:1429:742:782:b6
2606:2800:134:fa2:1627:1fe:edb:1665
2606:2800:233:7ee2:97c:ab4c:6c70:be36
2606:4700:3033::6815:2f49
2606:4700:3033::6815:420c
2606:4700:3034::6815:5581
2606:4700::6811:7963
2606:4700::6812:acf
2620:103::192:155:48:119
2620:119:50e1:101::6cae:b25
2620:1ec:21::14
2620:1ec:bdf::19
2620:1ec:c11::200
2a00:1450:4001:800::2002
2a00:1450:4001:801::200a
2a00:1450:4001:802::2003
2a00:1450:4001:803::2002
2a00:1450:4001:80e::2003
2a00:1450:4001:80f::2001
2a00:1450:4001:80f::2002
2a00:1450:4001:80f::2003
2a00:1450:4001:811::2002
2a00:1450:4001:813::2004
2a00:1450:4001:82b::2001
2a00:1450:4001:82b::2002
2a00:1450:4001:82b::2008
2a00:1450:4001:82b::200e
2a00:1450:400c:c0c::9c
2a02:26f0:6c00:1ba::26e5
2a02:26f0:7100:48a::25ea
2a02:26f0:7100::687e:24b0
2a03:2880:f02d:12:face:b00c:0:3
2a03:2880:f12d:83:face:b00c:0:25de
3.10.133.216
3.124.238.162
3.214.0.136
3.229.100.58
34.251.60.147
34.253.145.149
35.181.18.61
35.244.174.68
37.252.172.45
52.203.96.188
52.30.135.179
52.49.20.76
54.210.109.30
54.74.23.153
64.13.192.84
65.9.66.54
93.184.220.66
99.84.156.109
99.84.156.23
99.84.156.73
99.84.156.95
99.86.2.75
01b4ebef3b601f246d0adbff5259fabbe7c8e0311f1169b495f0bb2b862db981
030235ab6fc1739381df015b815a93e2ed3921f09832954dbacde9991708e27a
0615fb751c4db849533b1e432f05428e307591466902876f8ab30d7873b7f38b
0a189471e7a93667b54e08fd6c28d17f8901d3967ac9bac9413a8e6cea38f021
0a4f12795a11d0957a7e476cdd2516967e3e00f54841456fbd8c0dd607984d92
0c2fdd2c372bbc50cb9591f8b7284b1bb65cd1d545f5ec8e165551bbee465233
0c9111d9514a49ad97e7c6d5fd97a00f3232b73537e9155726f32f123eb69b5a
0f762bf1a58c917c1ad50006bfcd192ab55b2d01a857b7c08b6c40e3af878695
10a6e0f0427a05104050292e8d62b3d01062f9422701e267df74958d0cc2eef7
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
1399c38bd120b5ec5548085f61949d402a8bbf05a3831e0ff11a5f1345269046
13b99be3a0bde88b082b4a2b333cf0686012456b5bcc07f6a1a9ec8ef431d884
14eca529c982c8e3ffb86113177b05886339d6fb8479f2a3bdf3e05d7413c397
1747fc1de85c66335718cecca4dedd536084c8b860d0b3b07af0a1708388905b
190f689e0f479324a217a5ea88c1acc132b66d24b16559052d59b892ff5dcba2
195e8e91bc727766f427243d4cfb79cdc873639991600bf99e9d2cab5cad77c8
1ace1b17e77ec3828eda87eb3fea3671ce2a0f706426fbd158873546c4f9366e
1ae4b8548f250831a2443bd449af625f6331b7c72e1f408789642a3050596d45
1c194d796c5b166af27f072d1cb5d32036d7d63e81ca483221d99197f987128b
1df25aa660118e4199cb0197184cc63351df11b115b05df7a0e3420c173e830e
1fe2437a79282fb26d2267e40cdb7ac59164d0ee5e5b9f955f05a49f686ab616
209e2d5d4c02a21311e4916747d103d3e7666073678b668a7e17be6fb6aa8fe8
213d028cd435ae24f97ba5210de14632da8e3ac9021673f490ecf99ece0c43d3
22c53eeed2c33c21657590793b89fed83648ee555686c0e9ff90b39c1dab406f
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
2b54640c4481464f755e4729d7f105f4decc25690afe59923aec5c739d178aed
2c1e04fc87330ee32f0dbc77ae3935d20c7bb93d01e685cb4af2f3fdc17ce1a5
2c48b2701eb6dc2c6af31fc1383ea931e15e3ce6e3600b591e8f21ce038631b3
2cb7ae225cf3062d2ad68116562c82f0a61770c495f9b84dd55720f97fd1a4f4
2e9b6fed568a85ee88f1eb2aa1d51cb2073d907cbb0109a5dd703f0b1e5651d6
2ec7b8d3c38a996f67dd4e580c975ece3e9d936d4267167d12604a59a5ff2c87
308e134d9a0df8031a894aa2bb6e70515cb9db2403e3e568e7554ae69f474c96
32821e69d091e71a62b9dbefcd09516c2133b50c50a3f8d597207d9cab5d59b8
328e90a318268aea96180cc31666ae6d6f79d90d078c123bc3d98ee08a192fb7
33194e1b282eaf349b01b68de4fee20452ff6877b4b82605d5c68c5132444f96
3346de8e2ae1bfde250c7ac5c06f79a0a60c7faef8e5e08a2c9e8fbf5ec2c9e8
3788b383d339fafcf4a50db75b2f9fabc14e8a9f696fdf35a885e921c5aa6268
37a0bbeac143b190eb553c9e8ebf42b7f85b1acba06883855eda085fdf155c4b
3974ecdf657fe7d442eacbfdb8fada9277529d69d369a982630240711b6b2399
39a2101bf98ddbf20a63d714bde3adeb9dda9412bebcb3958d21c491d9e824cf
3a08be5766c0e198ba8171f7decd09065c08a5c850276325cc1792f25e7b356e
3ac40e4154f25f76b46e76ae64e2ca269d20ac3815e11d285bdf7018ae2876aa
3c5b83e390d046c3623c4b8e35b58aaf64a7481bb2372fb51ae2e0e7818f7407
3eea91bd1f33507891a2909689d21be3a6e0fb1b688037c2a7d59c042503d910
41e3b5da84b51e3034e355b7e9ccd5c263667bfed5d8905728d82a341f55e65a
41f1e9970b646aadac0f40543bb08b21e49990bf1b09392d1ef4d71b275069ea
41fac5f010cdfd4662792d3f2d81a4f0ad06bd42536bf9aacd4afbd8eb52698c
42ecd6904f43af4e6cef62ddbeffa7b2b0b6c8ec5080a3e1deec4576f4294859
4326b404001255736c37e17cb374b30cce246ef285b3b89f481d1ee200ef5918
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
44fc0a3d10c47ae5aa6c77c76b4b8f81aa08022ca464ef235005ddd86570eb5b
45055babdbc02ea34c7baa53f33fc68389c4c5f73afe0bfafd6c9bc5733399bc
48d211ee8f54e0f314ee98a2b63e6e470b33fb1de29d326c742be16125bda71a
4924a3b04216167215691f19cc588aec1b1ffb15f87815a8f9696a6461c6d9d7
4b3e9e481ce206001f1ca652137d83267c1b760cf3b5678012c52e3a133e556c
4bbed2de83df27dc8130644101bce3dd9ddd1c178815e42bcb49118b4a73593c
4dc2fbda68b407445c314dbe7ec3fd9cf27b8d9418367f5cb17ccc7f90064f51
4e19e8f9902a8b9ec4840aaf54110d6f502c5fb500303dc605f8776c40f7fb67
4f65ccd30d1c95588b51035a804dd49090d7fbe6c2829a576a31d1b6a3e0f86b
4f89a03faa36f0b6eeb92b9a8f0b8d2f9d3e564ba8bf13bb169bf05b126ca81e
501ed6f37588ea4083347c8c1b9fd9bfbc560f8f9977aa2847749e0977063f6c
5197134265816a7fc5bf360b151eccef4b22bad4b875f4314970860a2e1f2127
523296d1a2c9a67ee707b5e0bc582f488e5786ec9b343c7b3da58a0d162d643b
537252b7b9ef14f265c3b5d51dc5336ecc4bcdfef5b28e2bba829a856daf369a
55c9d2f019f9d7ddfd69b2ad0351c5617338a222362aebb02b3b98a4dbc18486
566686b6e2a2aec696b9d828018515a7472bb1addfdbe2dd47871114af0511b8
5738e8b5706cc09cf388010fd24feb6cc532ddc0ff14e9d8a8ab1463132e1d75
59c10ff6a5aa73210189b990a28f79c5a85469de0398727f271952348a78ecf1
5a1ba6ff6db12f791bbbfc4da3cb389e06f0cd53eede09ef3eb3ceb074089ef1
5b21d495e672a89a4d8dc047b17ab94531525297644c1a4340a2bc3f26ab782f
5e58c915902143f7556f02927aa84784d90114d396779cbae06bbfbf5a4a901c
5e655f2d4823c97d262aa890bba541d0d5b4e3c45b2e790d7cfc9de866a165d5
5f3b103a1268f862a5e432d607f8e5220dea9d301d13565b0ecded3ad9c25ab2
5f789ea36ae4671282524bda454709578d63b915b782c1e041132a7e726ff1c3
61494fd1b573b217034bef7e22044bda91962797d68efada6726910d32bb995b
63484bd691450c081b848e5159315bfcd02720741d3f72a69717643d6630e578
6414656f939f73a463499bd2c5a8f75793658adf6e05d0e4cd61d1ba36636b94
65f0552fdc11b004b576ad2ab17477aa0d7ee2306f3d1645f0880f3c944397ab
6836719899bda27cd22c1551cb7fbfc33fb0bbbedaa89e4baa8715fef8202cbc
6a00a6df086b26f8652d0c165dc78d45c49d987b66c243228384968c438816d1
6ad2b7a09587300eec580303a45f75396d489cf9d2e005fe832946b41f3cbe1b
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
6daa62ec3812d8c4cc65448351cefcbe9a190ecec9c63cc261d28a851632d5fa
6dd394ad8df7d5e2ed0f220ff18451f281ccc907cae0d25d233c51533ad8887f
6fc3dfb2b1b6a12424b2f2c1852c0a46cd759209bec21713a39d8d38fcf725e2
71c805ad1e5135a1d4dd9fccaa913bbdaf94cc3608d9619e5b546c1b865a2c16
731d7bd9ce2c95bf6af3d5719b995d714111949fb37b39919d45828875361233
74a584aafb20fa5524e8005c8f236bb47119e12225ac0d9e30d6c6ae69354808
74e1cf077493c33fe895c7ce5732cda76b195e2d357d928f094bc3367cc7a75f
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7a8acfda0b1c779321b8155dadf526cc7ac6c1f8fbb6bc88c4bbb4311fc7860e
7b02cdb496b954e874c4b87d48eb1ea16f088258786ed0d2f0771acc3d01649e
7b5688f8b168e06251901442c4f2f72b30c4477cb472833cde7979a8dca0a862
7bb0d75d42e3ccf1a9d1a055bcddfbc23003ed3ab75bb0eb49c05ba747bce8c9
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7d23c140b5d7396d35b446f636c1bb8220accc6834abe5f51d7355fca8d91144
7ead23ac369cb17e84781bb0d0c104e02849ba9e7e6719906c565bc6404eff33
808fa0400a96856a43ec1c27ef1c7aebf78f2f1696d909de2c8a929d477c9fe9
80d0a278e7a208ae2bd234aafcbdece69e63c9bf11e800d0ab5fa3c82176cf2c
82585d58a935ca750bf12e7bd7655acf2d6082733359b7399ebcd2442df4f7d3
831b0d6cde4541d363bb7a67eb49010fc5fd717dda4b9c3187dd3207b1da56cd
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8420f59cd348cf0e10e05482724523ad6b83f88467bbfacf6826eaadd3a03985
859e5d3c91a0c306dd09da1588a808bfe0ed6a1799b99166d2dc92a5ea5ef9cb
86a94e7b3824da696d7bb5ee97be19ca25346b7fc59f40dced2e2b203f05b834
87cdbacb358e421a482bc1a52dc9cfc04a9f6d8dfe86c7c6c66bcde013792850
88df697a1e6d3548502b8de443860fcb6cb51347e705cd4479e0ece6ea4c35b2
88f6b155f6df559c17b78785558ec29de6429ef62232a26ad2ddbf8f8de07209
8a322ede0b619b9051fccbe2a1a31f402f416d45f92c245aafcbe75e42f6f2b2
8f72f694a588624339c24dd31a3b462da46175b36e0006200f084e32a0f660f4
90214d135602962e47ea9587a7eeb62fac1c64a541e373ea76e2b4e8b33e3f88
9250f0b586e89674ec647d8dfb6fe7aedcb588be13ebb6aeb1286efa9d3cfb39
929e505379dce9b6ac5c906a9437caf871b1cd8a237d8ad56f5cbeaa3f343df0
95ab293284c0a0c7804ce334e10ef01c9a6854311ae9c45d57a59b8ccea1aa56
973ccce3f58b175a9e021c76978726083cc7e5cbed75cd0ff09ff83919934d15
976aabc512994a6ecc5981a85c489d1bb242ba6734b746a964d69db615f72875
9808e779e13edda22b810e64f1f0ed8e4da2b57c0c33fba5dfc64ead204938ca
984cd1fa5dd20c2b1b8fd77b6bb876a3a211cdf14aaaed6bc1481e3c98027544
98fb88ec226feae902fb7f98528a41db7abd7de155a6d7b65658c6ab7f2b95f4
9ddca568ff519cd935a816baec6f7bfce459656ec5022ec2ba6a6225891022eb
9e0e2ad3a93ec78d016efee0993b5856ba9b4acafcee3aa4d6f7162f039fcce4
9f61400081191bf755c967c186a8fd356b02010fac3412f84cf83d5dfe10dd5d
a0761aa1289035f3d20430d55e475043a8fa40deff221715e31068905d561753
a1397f944b7ef5b0b00bd9952e153b10150d2ae2bd39ee156bbc6ec57ad50966
a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79
a2e7f940b6e3194e1609c6cf10320499a1e036056580fabf1675470a7f76b04a
a456c328bbb88fc991a5ddb80db492ec9e179a3ef443d50bf80b3fbbb5e8a7f7
a4a1824defec1084ca81d496ee77891684c26196924bdc4fc21dd3482ce15e14
a5069082fd23bba93317d61fd6da244d6a85f60e68af7dcb9b0a43284f1d835a
a549034009f79ead18a2154a8b730d8acb61e2f36c0434c0f9cff0f73df5d8cf
a58300cbd020e523bdb156a2b415dfd05d3a5cd1a31e89c73540208f9f9cdab2
a6595372db2688a9dfb0991bc6cea16343042dd3caa33483b393d21a77d1c4be
a8041ba3d02102bd99dcead4dcc9882c484902362927cfd598e389e930f68ceb
a8e2f3be21e77af60268f646f6dc6d3b960fdef0c540ff9cbbee6bb46bf8b70d
a8f4fa7376444ffe05d0f7b296439401fb9729bdee84d760ee6286e7b663c753
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
abbb2b30d5425bca142b54a15b7d356967e6156d2404af3e21286682a735fc23
ac2295d897d9c85c39d26180d983fa960e03d52bbe0874f152274b00cf1abc99
adaf986c7a8d1fcd6c754b1a98bab48cc2e1e3c9c49de26d52a8a5cdece63fe6
aef23deda339b41ec1128bd29fb926bd6b5317b06583cfe713da67ae9db605ba
af4a017ee305cb32dbb87c45bf47631799e4818d722e81a6095d46165e5978c8
b0433e6503844566fe790bfb9bfe5d88950c4446b9fa3a6565b25d1601a9332b
b04c1b49e3255761d4d0dd060ce37e23986b743321b5711a54070e3ce66bed0f
b19f14d674857362b6e10d0dcb1703b149d9dda6f350d1737562fc36e4e67a81
b309c9c4a6c27c7cfc64ab2bc7f545e8d7b41a795c46202ab2a9c633f7128287
b4cf7d6d50b6a36f070f6c49e975198a9a8930838695b64e480bf1f6199f0572
b5c543f59d71e1e4f6b51c896febf86975206dcf9e34757f475b125d64d16ea6
bcaf0e3f087296133e0a996ee3d289a8d1a690147c93e0ab62019b505e6f9355
bed57a09b10b5cfc83c33f5bc6205831a9db085c874bc72d096d05ad2136e4b4
bf40c262b047615208bc2d84984e7854b8a2ec9801f1c6e99c0b79a9f32380b5
bfc1797e85a0565d0cfba1621eac801dc5ebd78a02f45e0ab8de5c6c2eb3f987
c0ee68eddc8d57781bd2fa09a773b8f745694291098befbd296adc879c57bd98
c19345a03fed44d267abbe2f427bdcd261aa86a447320f15f3eef8e121690794
c24a517cf3dc453e6046e54ec1f6944bd762da6fc68447fcfa84c374723bbb09
c24fe1d23eb18570fb3b93b456b2a7da6a6e9609a1e84b1d257ef62ff7ca068c
c3afea18e435beb9cc7c30e103f013e2c06be6b53ad877533aded93c19939ae6
c5882768d33bf8778b8c12ec81466d13a9c4e1c797d5cc1686f3f2564ab1983d
c61a719b48533a1fa932729f4927ba1377a96c441b0d6a427096b867742b4645
c670b28572ed7804386b274eb1ddafbc0253a1aff515b0d15805c57c26bcee64
c7d1ee4f5a608fa05b8f9c6cbd47e3eab7516facc3380d704b7332805877afff
c935264005f5d981e6afe4d3ef47726f7bde92f6d634c2af946bb1b3a3a9906a
cd8ddec509daf284f644926ce4a94e2cf5a3cefa41c7c18f2358b6cca80a4a3f
cdeeae0f4627d59f432c7ceefdf9e8884bf4297ac998d128faaf38720987e041
ce2216da03d856edb71b34855ce2c67476f6053791b3e85da74477d9a37360a9
ced34f591157438ef47695f979ac95f8758408e8d9b88e63aee8b382ec975785
cf167be72549318f78f8c03d0d93b923f8e8e290acec47b870a1cede920e859b
cf38831bf840d88299423ad71ddd3db9bff9558b898911ae24c90fa99880387a
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cf7bdb0487590885c13a3cc0a2a1450b3ac649a465de267af12f552be8bcb5fe
d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7
d10a2d03c9fb4943f449b97d333b8d22990200afa70d13d5c1c23ad4d783200c
d15ed222053e330046feca6220de0d53b7c87713caabfc53f233eb2a9f7abe6a
d26432e661658ef9d3d538b1f71b1478193f6c141f1cd7dfed03e5b677d178c2
d407e6c9443c45a0b2f4f12ebe9ed6e27f661f53747fa66575ffa5e70aa36e58
d4b95126382745e9e07d76812e3bbc8d6de2cfa6356c586f930ece7d4acb8052
d50d436889f46d5b9455690493e877e02ad30ea4dca963ffcaa3024c45c1d58c
d6df7d1f2b9c65c06c5ae1e798650b6c388f26f6852b8814f942557d712b9745
d7fbef096a735e3913450358df298895e676ee16f9c7c9352a406096a7777a19
d8b7ea5cc75abc79d502a95c5ccac8f97aa82fd8c13acc74c84c754eb86cc4c3
d8bcc4c70c1cf500acbc7c2db7db7f2815dd372815a803f7457e4e8d7a4aec43
dafb72bcf008c9b9754482b88e8ba8b8e854f1a69483f0753b1c3f12101c1a9f
dc5ddc93ea153c05202bb974dbd591cf30ce83474d1d24aa30d5740e20955c8d
dd09ac569606839a91da1ec3b96ffa4e75cf303ffd0ea8a733c4e1befb8c8e12
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
df1154ada0c9c480d8c6bc604827cd308152756548366700c4cead55ae3fa543
e05edf2ae58e3a9f1d2a84d32a8b216fd0aece46f527b58dcbce75255989ea88
e317ba0d41b33a2edef3bf327cb4846486a03bbc8e4df86d2e4224dbe96302cc
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5cc2027e2da5b3d553fba6a4d2d7276aafa604001e9b0321e18d1fd62b03b3f
e6203cb164df8f73860edf3dc7e89c3494e024eea8976a9fbc2a2e05771127b3
e76d2d771deceb87567b67f968ef2196915e110c0027ade297fab2209965fd30
e9d0cab69a4c71df7a16b6ee6f99ea474423689c8eadd7aa62ce9cef3a48c395
e9e8c1220d8a2b78680564a2f2f749544d8bd1d20f3b7b590eeaaf6beeea199b
eb12eaa9c690d06187a7099545a6bf52318a2364411fc9c4ec73e7fa4ecbb0f9
ebe3a0272a317857bf566a0deec42181bf0e89d280bb3143bba14da1ae1ddb10
ec93813683cccb74a7896a34a2ed1b2163288620f6959ae06de3ded30cf518b9
ed2c6c0fb3151dc9d40120a17446f07d8873a8b6e08b071bbed82cd6de9b78ba
ed91fbb0cd9308f91f8e1fd93942c94ee850fc4161ed788b16f801b743c70b9b
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f039e32c9e62cd2acc5bf02dec7282686e6f41be6b01bfa249f9590cda747cba
f1ccea6b7204d9f7913ab45e1afa51d79f83bd4f0319de937b0132e6e02b1aab
f30d5c0433d74c8224a2343a3c6c08468015909c22315b8693f9bdee33f48217
f32d4bae1be71af82dcf0f97d37e4281d002eabfbbe8735753d61e1035133924
f3bd482cd3ec17583f25ad0819d1ccbcd0cdcb0fe26f8d87b7f30fd61b3dc640
f55b80216d81f421d8da8c69ae09068b1231e4b0fb6d3912eae8d147b5232d9c
f5932acd6c5f2796f354dedc5e8dfe30e206787365186bbf0f9789d083472a75
f59a2838b82cdcf10230a26e85b3d8a05b0bc7ff15809bb421b84036b8e57826
f59e5f34a941183aacaed25322ac0856628493c2cfd936ded3fddc0a49510e52
f70b9343194b66c8453296dc822f4a084f94a0be3758d26d61db9db41b7ac222
f79723478f4c48501cd49ac52b81d6244a6562b9d3f08ce8ab208a8b8878d4c4
fa30597c8340ed18b045cc801a2dfb2e1185f9ca5ea02753e5935e64df5aa4c5
fb295c2a72d39784b18a1d2d5b0c9976807f7cf010fe730b86d43bc55b0ae251
fbb475f48d03815474a554d3c16599917c2fabf811e3fe2772aeabeee474aa8f
fd2f3015d1e62a6f24420652afa85f8dbce31636ea8ee86781dc794c243dec68
fd6866419093102bb76f572a3624815e405fe9b9e8cac007430f041d4d2f2ba8
fdb0066a030a45bd44f17d459c6369901b3fa648c94de3afa0f824d87dfd1527
ffcaeef328a1e67717f714997426aaf936e4b9d378a5fbe1bd2a063dfeb50750