it-online.co.za Open in urlscan Pro
178.62.18.215 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/
Submission: On September 02 via api (September 2nd 2021, 2:33:22 pm UTC) from US

Summary HTTP 92 Redirects Links 17 Behaviour Indicators

Summary

This website contacted 21 IPs in 5 countries across 20 domains to perform 92 HTTP transactions. The main IP is 178.62.18.215, located in London, United Kingdom and belongs to DIGITALOCEAN-ASN, US. The main domain is it-online.co.za.
TLS certificate: Issued by R3 on August 25th 2021. Valid for: 3 months.

This is the only time it-online.co.za was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
31	178.62.18.215 178.62.18.215	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
8	192.0.77.37 192.0.77.37	2635 (AUTOMATTIC) (AUTOMATTIC)
4	2a00:1450:400... 2a00:1450:4001:808::2003	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:831::2008	15169 (GOOGLE) (GOOGLE)
5	199.232.196.134 199.232.196.134	54113 (FASTLY) (FASTLY)
1	52.216.17.211 52.216.17.211	16509 (AMAZON-02) (AMAZON-02)
15	2600:9000:224... 2600:9000:2240:2800:6:8656:f5c0:93a1	16509 (AMAZON-02) (AMAZON-02)
4	151.101.64.134 151.101.64.134	54113 (FASTLY) (FASTLY)
2	151.101.14.49 151.101.14.49	54113 (FASTLY) (FASTLY)
2	2a03:2880:f01... 2a03:2880:f01c:216:face:b00c:0:3	32934 (FACEBOOK) (FACEBOOK)
2	2a00:1450:400... 2a00:1450:4001:808::200e	15169 (GOOGLE) (GOOGLE)
1	2a03:2880:f11... 2a03:2880:f11c:8083:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
2	2a00:1450:400... 2a00:1450:4001:827::200d	15169 (GOOGLE) (GOOGLE)
1	23.45.110.243 23.45.110.243	16625 (AKAMAI-AS) (AKAMAI-AS)
1	151.101.12.64 151.101.12.64	54113 (FASTLY) (FASTLY)
6	13.32.121.38 13.32.121.38	16509 (AMAZON-02) (AMAZON-02)
2 3	13.32.121.8 13.32.121.8	16509 (AMAZON-02) (AMAZON-02)
5 6	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
4 4	142.250.186.34 142.250.186.34	15169 (GOOGLE) (GOOGLE)
2 4	2a00:1450:400... 2a00:1450:4001:802::200e	15169 (GOOGLE) (GOOGLE)
1 2	34.250.127.107 34.250.127.107	16509 (AMAZON-02) (AMAZON-02)
1 1	185.33.220.145 185.33.220.145	29990 (ASN-APPNEX) (ASN-APPNEX)
2 2	193.0.160.128 193.0.160.128	54312 (ROCKETFUEL) (ROCKETFUEL)
92	21

31 178.62.18.215 (London, United Kingdom)

ASN14061 (DIGITALOCEAN-ASN, US)
PTR: it-online.co.za

it-online.co.za	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
itomedia.co.za	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 192.0.77.37 (United States)

ASN2635 (AUTOMATTIC, US)
PTR: wordpress.com

c0.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:808::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ssl.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:831::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ssl.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 199.232.196.134 (United States)

ASN54113 (FASTLY, US)

itonline.disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
referrer.disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.216.17.211 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-1.amazonaws.com

s3.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

15 2600:9000:2240:2800:6:8656:f5c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

c.disquscdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 151.101.64.134 (United States)

ASN54113 (FASTLY, US)

disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 151.101.14.49 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

a.disquscdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a03:2880:f01c:216:face:b00c:0:3 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:808::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

apis.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a03:2880:f11c:8083:face:b00c:0:25de (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:827::200d (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

accounts.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.45.110.243 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-45-110-243.deploy.static.akamaitechnologies.com

mc.us11.list-manage.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 151.101.12.64 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)

glitter.services.disqus.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 13.32.121.38 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-121-38.fra60.r.cloudfront.net

downloads.mailchimp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 13.32.121.8 (United States) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: server-13-32-121-8.fra60.r.cloudfront.net

live.rezync.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 35.244.174.68 (Kansas City, United States) 5 redirects

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

ejp.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
idsync.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 142.250.186.34 (United States) 4 redirects

ASN15169 (GOOGLE, US)
PTR: fra24s04-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:802::200e (Frankfurt am Main, Germany) 2 redirects

ASN15169 (GOOGLE, US)

fcmatch.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
fcmatch.youtube.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.250.127.107 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-250-127-107.eu-west-1.compute.amazonaws.com

io.narrative.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.33.220.145 (Amsterdam, Netherlands) 1 redirects

ASN29990 (ASN-APPNEX, US)
PTR: 623.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

ib.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 193.0.160.128 (United States) 2 redirects

ASN54312 (ROCKETFUEL, US)

p.rfihub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
20	itomedia.co.za itomedia.co.za	764 KB
17	disquscdn.com c.disquscdn.com a.disquscdn.com	524 KB
11	it-online.co.za it-online.co.za	189 KB
10	disqus.com itonline.disqus.com disqus.com referrer.disqus.com glitter.services.disqus.com	60 KB
8	wp.com c0.wp.com	56 KB
6	rlcdn.com 5 redirects ejp.rlcdn.com idsync.rlcdn.com	3 KB
6	mailchimp.com downloads.mailchimp.com	41 KB
6	google.com 2 redirects apis.google.com accounts.google.com fcmatch.google.com	42 KB
4	doubleclick.net 4 redirects cm.g.doubleclick.net	1 KB
4	gstatic.com fonts.gstatic.com ssl.gstatic.com	98 KB
3	rezync.com 2 redirects live.rezync.com	3 KB
2	rfihub.com 2 redirects p.rfihub.com	2 KB
2	narrative.io 1 redirects io.narrative.io	792 B
2	youtube.com fcmatch.youtube.com	189 B
2	facebook.net connect.facebook.net	69 KB
2	google-analytics.com ssl.google-analytics.com	17 KB
1	adnxs.com 1 redirects ib.adnxs.com	944 B
1	list-manage.com mc.us11.list-manage.com	2 KB
1	facebook.com www.facebook.com
1	amazonaws.com s3.amazonaws.com	127 KB
92	20

	Domain	Requested by
20	itomedia.co.za	it-online.co.za itomedia.co.za
15	c.disquscdn.com	itonline.disqus.com it-online.co.za disqus.com c.disquscdn.com
11	it-online.co.za	it-online.co.za c0.wp.com
8	c0.wp.com	it-online.co.za
6	downloads.mailchimp.com	s3.amazonaws.com downloads.mailchimp.com
4	idsync.rlcdn.com	3 redirects live.rezync.com
4	cm.g.doubleclick.net	4 redirects
4	disqus.com	itonline.disqus.com c.disquscdn.com
3	live.rezync.com	2 redirects c.disquscdn.com
3	referrer.disqus.com	it-online.co.za c.disquscdn.com
3	fonts.gstatic.com	it-online.co.za
2	p.rfihub.com	2 redirects
2	io.narrative.io	1 redirects
2	fcmatch.youtube.com	c.disquscdn.com live.rezync.com
2	fcmatch.google.com	2 redirects
2	ejp.rlcdn.com	2 redirects
2	accounts.google.com	apis.google.com ssl.gstatic.com
2	apis.google.com	c.disquscdn.com apis.google.com
2	connect.facebook.net	c.disquscdn.com connect.facebook.net
2	a.disquscdn.com	it-online.co.za c.disquscdn.com
2	itonline.disqus.com	it-online.co.za
2	ssl.google-analytics.com	it-online.co.za
1	ib.adnxs.com	1 redirects
1	glitter.services.disqus.com	c.disquscdn.com
1	mc.us11.list-manage.com	s3.amazonaws.com
1	ssl.gstatic.com	accounts.google.com
1	www.facebook.com	c.disquscdn.com
1	s3.amazonaws.com	it-online.co.za
92	28

This site contains links to these domains. Also see Links.

Domain
www.it-online.co.za
business-it.co.za
www.channelwise.co.za
eepurl.com
itomedia.co.za
www.facebook.com
twitter.com
www.elegantthemes.com
www.wordpress.org

Subject Issuer	Validity	Valid
it-online.co.za R3	`2021-08-25` - `2021-11-23`	3 months	crt.sh
*.wp.com Sectigo RSA Domain Validation Secure Server CA	`2020-04-02` - `2022-07-05`	2 years	crt.sh
itomedia.co.za R3	`2021-08-31` - `2021-11-29`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2021-08-16` - `2021-11-08`	3 months	crt.sh
*.google-analytics.com GTS CA 1C3	`2021-08-16` - `2021-11-08`	3 months	crt.sh
*.disqus.com DigiCert SHA2 Secure Server CA	`2020-04-20` - `2022-05-09`	2 years	crt.sh
s3.amazonaws.com DigiCert Baltimore CA-2 G2	`2021-06-23` - `2022-07-24`	a year	crt.sh
a.disquscdn.com Amazon	`2020-11-30` - `2021-12-29`	a year	crt.sh
*.disquscdn.com GlobalSign Atlas R3 DV TLS CA 2020	`2021-03-22` - `2022-04-23`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2021-07-20` - `2021-10-18`	3 months	crt.sh
*.apis.google.com GTS CA 1C3	`2021-08-16` - `2021-11-08`	3 months	crt.sh
*.google.com GTS CA 1C3	`2021-08-16` - `2021-11-08`	3 months	crt.sh
accounts.google.com GTS CA 1C3	`2021-08-16` - `2021-11-08`	3 months	crt.sh
wildcardsan.list-manage.com DigiCert Secure Site ECC CA-1	`2020-08-26` - `2021-11-25`	a year	crt.sh
*.services.disqus.com GlobalSign Atlas R3 DV TLS CA 2020	`2021-04-26` - `2022-05-28`	a year	crt.sh
downloads.mailchimp.com Amazon	`2021-07-21` - `2022-08-19`	a year	crt.sh
*.rezync.com Amazon	`2021-01-26` - `2022-02-23`	a year	crt.sh
*.narrative.io Amazon	`2021-04-07` - `2022-05-06`	a year	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2021-02-25` - `2022-03-28`	a year	crt.sh

This page contains 9 frames:

Primary Page: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/
Frame ID: 73DBB645FE6C2575280B086736FF1EF8
Requests: 56 HTTP requests in this frame

Frame: https://disqus.com/embed/comments/?base=default&f=itonline&t_i=193371%20https%3A%2F%2Fit-online.co.za%2F%3Fp%3D193371&t_u=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F&t_e=Big%20increase%20in%20MS%20Exchange%20attacks&t_d=Big%20increase%20in%20MS%20Exchange%20attacks&t_t=Big%20increase%20in%20MS%20Exchange%20attacks&s_o=default
Frame ID: 15F57B8B104D7DC6A2CF82C5F7A867EB
Requests: 24 HTTP requests in this frame

Frame: https://c.disquscdn.com/next/embed/styles/realtime.af77184dec69e96e69aff958ae2bb738.css
Frame ID: 4030F7BC62CCE64935C3F8A0A76555B8
Requests: 1 HTTP requests in this frame

Frame: https://c.disquscdn.com/next/embed/styles/realtime.af77184dec69e96e69aff958ae2bb738.css
Frame ID: C8EC93C298A204755A373A067384DB10
Requests: 1 HTTP requests in this frame

Frame: https://accounts.google.com/o/oauth2/iframe
Frame ID: 72473D308C585A34A3CA5185C50BEA6C
Requests: 3 HTTP requests in this frame

Frame: https://downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/common.css
Frame ID: 4C41C0F693051C76D976B599717AB0C3
Requests: 2 HTTP requests in this frame

Frame: https://downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/common.css
Frame ID: 8C3B32D9F649D268E11D09FDCF8FA0EB
Requests: 2 HTTP requests in this frame

Frame: https://live.rezync.com/pixel.html?c=4656c20ee35215f78e9273796625d90b&cid=cg7toam2n7k298&pctry=CH&referrer=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F
Frame ID: 6586EB9844D780DE80776C29CCF8FB69
Requests: 3 HTTP requests in this frame

Frame: https://fcmatch.youtube.com/pixel?google_gm=AMnCDoroSy3RyTw-n137rCTq4U9hsL6hLGgXid16c7s6kb0l_CbrcjqjuxpmKBAYHXC65RUYQqUkWiBMQUhlgGNxNsSY6b5bON7nJ0Hw5ismno7Dsn9XJgsfsil7fqEco4CVpjNb5XMhbbXh44A1ot5Qhv2FwBzaOA
Frame ID: 132833FAB85117E570BE1E378E2EE550
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Big increase in MS Exchange attacks - IT-Online

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i
html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

PHP (Programming Languages) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i
html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

MySQL (Databases) Expand

Overall confidence: 100%
Detected patterns

headers link /rel="https:\/\/api\.w\.org\/"/i
html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Yoast SEO (SEO) Expand

Overall confidence: 100%
Detected patterns

html /<!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Page Statistics

92
Requests

100 %
HTTPS

35 %
IPv6

20
Domains

28
Subdomains

21
IPs

5
Countries

1990 kB
Transfer

3363 kB
Size

8
Cookies

17 Outgoing links

These are links going to different origins than the main page.

URL: http://www.it-online.co.za/
Title: Home

Search URL Search Domain Scan URL

URL: http://business-it.co.za/
Title: Business IT

Search URL Search Domain Scan URL

URL: http://www.channelwise.co.za/
Title: Channelwise

Search URL Search Domain Scan URL

URL: http://eepurl.com/bsw-mn
Title: Subscribe

Search URL Search Domain Scan URL

URL: https://itomedia.co.za/www/delivery/cl.php?bannerid=397&zoneid=14&sig=1549b77c7a289ddd021b82b914e21ad4a13972d5ef09a660a3b0a31a7ff7d665&oadest=https%3A%2F%2Fgoaxiz.co.za%2Ftechnologies%2Fhpi%2F

Search URL Search Domain Scan URL

URL: https://itomedia.co.za/www/delivery/cl.php?bannerid=389&zoneid=76&sig=92cfb0e3903fa2e6ff5ee0f5d9c15d670ba1947722477bc437316556cffe7739&oadest=https%3A%2F%2Fbit.ly%2F37bZHeD

Search URL Search Domain Scan URL

URL: https://itomedia.co.za/www/delivery/cl.php?bannerid=401&zoneid=70&sig=ed31f0d663a6ca55ae6723ca5fc6a126e519bdd499edc65d9419b84f801ea1c8&oadest=http%3A%2F%2Fhpsuppliesatkolok.co.za%2F%3Futm_source%3DAffiliate%26utm_medium%3DChannelwise%26utm_campaign%3DKolok%26utm_id%3DQ321%2BHP%2BMDF%26utm_term%3DSupplies

Search URL Search Domain Scan URL

URL: https://itomedia.co.za/www/delivery/cl.php?bannerid=402&zoneid=16&sig=96dae5182514f3ac01f0a43b5aa9ef3b633547b6f6344cc0883a995bed8ca4f9&oadest=https%3A%2F%2Fwww.cocre8.africa%2Fnews%2F2021%2F09%2Ffujitsu-server-primergy-now-certified-for-windows-server-2022-it-leaders-can-implement-migration-plans-with-confidence%2F

Search URL Search Domain Scan URL

URL: https://itomedia.co.za/www/delivery/cl.php?bannerid=298&zoneid=37&sig=87df3e8073981a1eeefcc9c73fa88297d7fe120ad83899a92f7c143ca1e7ef36&oadest=http%3A%2F%2Fwww.drivecontrol.co.za%2Fproducts%2Fdelll%2Fenterprise%2Fpowerstore.html

Search URL Search Domain Scan URL

URL: https://itomedia.co.za/www/delivery/cl.php?bannerid=299&zoneid=75&sig=38238904f86fbcbaa627a47b85183abcca4353b4266a4e862fedcfbae3da2450&oadest=http%3A%2F%2Fwww.sacoronavirus.co.za

Search URL Search Domain Scan URL

URL: https://itomedia.co.za/www/delivery/cl.php?bannerid=395&zoneid=78&sig=ccf70068d53eea7d4c12d3d2b9b24623ed6e4cb5d2cd8a0392c52006c65915be&oadest=https%3A%2F%2Fwww.kyoceradocumentsolutions.co.za%2Fen%2Fbusiness-solutions%2Fsolutions%2Felectronic-and-digital-signature-solutions.html%3Futm_source%3DIT-Online%26utm_medium%3Donlinebanner-August%26utm_campaign%3Delectronic%2BSignatures

Search URL Search Domain Scan URL

URL: https://itomedia.co.za/www/delivery/cl.php?bannerid=303&zoneid=38&sig=57cb7481a0a42b37b603e542b8e68afbf7a4ef73afbbd000d19844f2c28d856c&oadest=https%3A%2F%2Fglobal.pantum.com%2Fglobal%2F

Search URL Search Domain Scan URL

URL: https://itomedia.co.za/www/delivery/cl.php?bannerid=399&zoneid=15&sig=9728de31429e6b637a714e942de7e555f81c5a2e3407c74f0fd192caa70c935d&oadest=https%3A%2F%2Fwww.epson.co.za%2Fheat-free-technology%3Futm_campaign%3Dheat-free%26cid%3Dds%3Abij21-ZA%3A111

Search URL Search Domain Scan URL

URL: https://www.facebook.com/ITOnlineSouthAfrica/
Title: Facebook

Search URL Search Domain Scan URL

URL: https://twitter.com/ITOnlineSA
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.elegantthemes.com/
Title: Elegant Themes

Search URL Search Domain Scan URL

URL: https://www.wordpress.org/
Title: WordPress

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 88

https://ejp.rlcdn.com/501709.html HTTP 307
https://ejp.rlcdn.com/1000.gif?memo=CM3PHhoNCKHBw4kGEgUI6AcQAEIASgA HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwM1Z5S3RERzhjTHZob2pFUHR0NWF1TGVqdF82Y3FEcDBNSGlRRXZFc0kxYw==&google_cm&gdpr=1&gdpr_consent=CPLPDEMPLPDN_ADABCENBoCsAP_AAH_AAAAAGSIF5C5URCFD4GJsIJIUIAEXwFAAAGAgBgQBA4AACBCAEAwEkAAAEAAAIAAAAAAAIAIAAAAACAkAAAAAQIAAIQAAAAQAIAAAIAIACAAAEAAAAAgAAoAQEAAAAAAAAAAAgAAAAAYAQMkQLyFyoiEKGwMDQQCQoQAIigKAAAMBADAACBgAAECEAIBgJIAAAAAAAQAAAAAAAQAQAAAAAABIAAAAAgQAAQgAAAAgAQAAAQAQAEAAAIAAAABAABQAgAAAAAAAAAAABAAAAAAwAgAA.YAAAAAAAA4AA HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwM1Z5S3RERzhjTHZob2pFUHR0NWF1TGVqdF82Y3FEcDBNSGlRRXZFc0kxYw==&google_cm=&gdpr=1&gdpr_consent=CPLPDEMPLPDN_ADABCENBoCsAP_AAH_AAAAAGSIF5C5URCFD4GJsIJIUIAEXwFAAAGAgBgQBA4AACBCAEAwEkAAAEAAAIAAAAAAAIAIAAAAACAkAAAAAQIAAIQAAAAQAIAAAIAIACAAAEAAAAAgAAoAQEAAAAAAAAAAAgAAAAAYAQMkQLyFyoiEKGwMDQQCQoQAIigKAAAMBADAACBgAAECEAIBgJIAAAAAAAQAAAAAAAQAQAAAAAABIAAAAAgQAAQgAAAAgAQAAAQAQAEAAAIAAAABAABQAgAAAAAAAAAAABAAAAAAwAgAA.YAAAAAAAA4AA&google_tc= HTTP 302
https://fcmatch.google.com/pixel?google_gm=AMnCDoroSy3RyTw-n137rCTq4U9hsL6hLGgXid16c7s6kb0l_CbrcjqjuxpmKBAYHXC65RUYQqUkWiBMQUhlgGNxNsSY6b5bON7nJ0Hw5ismno7Dsn9XJgsfsil7fqEco4CVpjNb5XMhbbXh44A1ot5Qhv2FwBzaOA HTTP 302
https://fcmatch.youtube.com/pixel?google_gm=AMnCDoroSy3RyTw-n137rCTq4U9hsL6hLGgXid16c7s6kb0l_CbrcjqjuxpmKBAYHXC65RUYQqUkWiBMQUhlgGNxNsSY6b5bON7nJ0Hw5ismno7Dsn9XJgsfsil7fqEco4CVpjNb5XMhbbXh44A1ot5Qhv2FwBzaOA

Request Chain 89

https://io.narrative.io/?companyId=19&id=disqus_id%3Acg7toam2n7k298&ret=img&ref=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F HTTP 302
https://io.narrative.io/?io.narrative.guid.v2=af3f3f10-0bfa-11ec-a9a5-06119d0d8b4f&companyId=19&id=disqus_id%3Acg7toam2n7k298&ret=img&ref=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F

Request Chain 90

https://ib.adnxs.com/getuid?https%3A//live.rezync.com/sync%3Fc%3D4656c20ee35215f78e9273796625d90b%26p%3D093016b0419d19c905c78c859b815219%26pid%3D%24UID HTTP 302
https://live.rezync.com/sync?c=4656c20ee35215f78e9273796625d90b&p=093016b0419d19c905c78c859b815219&pid=8754069646064298158 HTTP 302
https://p.rfihub.com/cm?pub=39342&in=1&userid=3a434759-b2b0-4b13-bb4a-9297dd033bf0%3A1630593185.35&forward=https%3A//idsync.rlcdn.com/501709.gif%3Fpartner_uid%3Dcg7toam2n7k298 HTTP 302
https://idsync.rlcdn.com/501709.gif?partner_uid=cg7toam2n7k298 HTTP 307
https://idsync.rlcdn.com/1000.gif?memo=CM3PHhIYChQIARAFGg5jZzd0b2FtMm43azI5OBAAGg0IosHDiQYSBQjoBxAAQgBKAA HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwdThadGI5SlU3U1hfd2lmUmdPaGtxVElMWVJIMlpCLXZzNUFtREFiYWVvdw==&google_cm&gdpr=1&gdpr_consent=CPLPDEMPLPDN_ADABCENBoCsAP_AAH_AAAAAGSIF5C5URCFD4GJsIJIUIAEXwFAAAGAgBgQBA4AACBCAEAwEkAAAEAAAIAAAAAAAIAIAAAAACAkAAAAAQIAAIQAAAAQAIAAAIAIACAAAEAAAAAgAAoAQEAAAAAAAAAAAgAAAAAYAQMkQLyFyoiEKGwMDQQCQoQAIigKAAAMBADAACBgAAECEAIBgJIAAAAAAAQAAAAAAAQAQAAAAAABIAAAAAgQAAQgAAAAgAQAAAQAQAEAAAIAAAABAABQAgAAAAAAAAAAABAAAAAAwAgAA.YAAAAAAAA4AA HTTP 302
https://fcmatch.google.com/pixel?google_gm=AMnCDopXO6og-Mn1xcBsyDDZGNGRF5GNPKEETBsFIIXKkLUilFOIOBjQDXymuiU7-r-wuEqOKciJAbft0K-Pdh7O9DXkZnEv_fLcNsGqXcDDproDrVTi3hLq4uqAmvpvDhwVrlx_H3HOLLCV5i140E5VGcEpY4wZKQ HTTP 302
https://fcmatch.youtube.com/pixel?google_gm=AMnCDopXO6og-Mn1xcBsyDDZGNGRF5GNPKEETBsFIIXKkLUilFOIOBjQDXymuiU7-r-wuEqOKciJAbft0K-Pdh7O9DXkZnEv_fLcNsGqXcDDproDrVTi3hLq4uqAmvpvDhwVrlx_H3HOLLCV5i140E5VGcEpY4wZKQ

Request Chain 91

https://p.rfihub.com/cm?pub=39342&in=1&userid=3a434759-b2b0-4b13-bb4a-9297dd033bf0%3A1630593185.35&forward=https%3A//live.rezync.com/sync%3Fc%3D4656c20ee35215f78e9273796625d90b%26p%3D260a954059a0ab1986e4ee8c5c88c54c%26pid%3D%7Buserid%7D HTTP 302
https://live.rezync.com/sync?c=4656c20ee35215f78e9273796625d90b&p=260a954059a0ab1986e4ee8c5c88c54c&pid=1875819622410663399 HTTP 302
https://idsync.rlcdn.com/501709.gif?partner_uid=cg7toam2n7k298 HTTP 307
https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm HTTP 302
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEE_JoVPsUASqX1AT2MDSSdY&google_cver=1

92 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/ 148 KB
26 KB 1302ms
1301ms Document
text/html 178.62.18.215
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 178.62.18.215 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: it-online.co.za
Software: nginx / PHP/7.3.27 PleskLin
Resource Hash: 633eb9467ef7ab1782e7e232fc2b59900481eda17aa6fe8d34010bdca84904b8

Request headers

:method: GET
:authority: it-online.co.za
:scheme: https
:path: /2021/09/02/big-increase-in-ms-exchange-attacks/
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: none
sec-fetch-mode: navigate
sec-fetch-user: ?1
sec-fetch-dest: document
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

server: nginx
date: Thu, 02 Sep 2021 14:33:03 GMT
content-type: text/html; charset=UTF-8
content-length: 26585
x-powered-by: PHP/7.3.27 PleskLin
link: <https://it-online.co.za/wp-json/>; rel="https://api.w.org/", <https://it-online.co.za/wp-json/wp/v2/posts/193371>; rel="alternate"; type="application/json", <https://wp.me/p27b52-OiT>; rel=shortlink
vary: Accept-Encoding
content-encoding: gzip
x-cache-status: BYPASS

GET
H2 200 mediaelementplayer-legacy.min.css
c0.wp.com/c/5.8/wp-includes/js/mediaelement/ 11 KB
2 KB 25ms
25ms Stylesheet
text/css 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/5.8/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css

Requested by

Host: it-online.co.za
URL: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Thu, 02 Sep 2021 14:33:03 GMT
content-encoding: br
last-modified: Tue, 29 Sep 2020 15:53:06 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
timing-allow-origin: *
expires: Fri, 02 Sep 2022 14:33:03 GMT

GET
H2 200 wp-mediaelement.min.css
c0.wp.com/c/5.8/wp-includes/js/mediaelement/ 4 KB
1015 B 25ms
25ms Stylesheet
text/css 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/5.8/wp-includes/js/mediaelement/wp-mediaelement.min.css

Requested by

Host: it-online.co.za
URL: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Thu, 02 Sep 2021 14:33:03 GMT
content-encoding: br
last-modified: Fri, 07 Jun 2019 20:45:02 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
timing-allow-origin: *
expires: Fri, 02 Sep 2022 14:33:03 GMT

GET
H2 200 style.css
it-online.co.za/wp-content/themes/it-online/ 5 KB
1 KB 40ms
40ms Stylesheet
text/css 178.62.18.215
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://it-online.co.za/wp-content/themes/it-online/style.css?ver=1.0.0
Requested by: Host: it-online.co.za
URL: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 178.62.18.215 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: it-online.co.za
Software: nginx / PleskLin
Resource Hash: 54e38c867623da51ba82fe8ea1972e10092891dcc9285166c3c73420f252edf3

Request headers

:path: /wp-content/themes/it-online/style.css?ver=1.0.0
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: text/css,*/*;q=0.1
cache-control: no-cache
sec-fetch-dest: style
:authority: it-online.co.za
referer: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 02 Sep 2021 14:33:03 GMT
content-encoding: br
last-modified: Thu, 10 Jun 2021 18:23:49 GMT
server: nginx
x-powered-by: PleskLin
etag: W/"60c258b5-132f"
x-cache-status: BYPASS
content-type: text/css

GET
H2 200 jetpack.css
c0.wp.com/p/jetpack/10.0/css/ 85 KB
16 KB 25ms
25ms Stylesheet
text/css 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/p/jetpack/10.0/css/jetpack.css

Requested by

Host: it-online.co.za
URL: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

5aa600aea047cb99c7e2c22e7edaf89f0539a6772a21981636e21da89bed440a

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Thu, 02 Sep 2021 14:33:03 GMT
content-encoding: br
last-modified: Tue, 03 Aug 2021 16:19:12 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/css
access-control-allow-origin: *
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
timing-allow-origin: *
expires: Fri, 02 Sep 2022 14:33:03 GMT

GET
H2 200 IT-Online-Logo.png
it-online.co.za/wp-content/uploads/2017/12/ 8 KB
8 KB 62ms
61ms Image
image/png 178.62.18.215
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://it-online.co.za/wp-content/uploads/2017/12/IT-Online-Logo.png
Requested by: Host: it-online.co.za
URL: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 178.62.18.215 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: it-online.co.za
Software: nginx / PleskLin
Resource Hash: 8d20d85cb8769b23e5f0d2db865b04c8371893d66a2e6fec4777cf04e2c701e0

Request headers

:path: /wp-content/uploads/2017/12/IT-Online-Logo.png
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: it-online.co.za
referer: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 02 Sep 2021 14:33:03 GMT
last-modified: Tue, 19 Dec 2017 12:41:53 GMT
server: nginx
x-powered-by: PleskLin
etag: "5a390911-1e0e"
x-cache-status: BYPASS
content-type: image/png
accept-ranges: bytes
content-length: 7694

GET
H2 200 asyncjs.php Show response
itomedia.co.za/www/delivery/ 4 KB
2 KB 36ms
36ms Script
text/javascript 178.62.18.215
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://itomedia.co.za/www/delivery/asyncjs.php
Requested by: Host: it-online.co.za
URL: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 178.62.18.215 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: it-online.co.za
Software: nginx / PHP/7.4.16, PleskLin
Resource Hash: 55a41e316e9f36cc5d6be9ef0684134e4c8b0f756070859d8ba50c0dcb1fded7

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 02 Sep 2021 14:33:03 GMT
content-encoding: br
server: nginx
p3p: CP="CUR ADM OUR NOR STA NID"
x-powered-by: PHP/7.4.16, PleskLin
content-type: text/javascript;charset=UTF-8
cache-control: private, max-age=3600
expire: Thu, 02 Sep 2021 15:33:03 GMT

GET
H2 200 comment_count.js Show response
it-online.co.za/wp-content/plugins/disqus-comment-system/public/js/ 889 B
676 B 95ms
93ms Script
application/javascript 178.62.18.215
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://it-online.co.za/wp-content/plugins/disqus-comment-system/public/js/comment_count.js?ver=3.0.22
Requested by: Host: it-online.co.za
URL: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 178.62.18.215 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: it-online.co.za
Software: nginx / PleskLin
Resource Hash: cea0a05c5af6e21a409875328ed2e3dba79131b7c41f8ea07d0e0e02c7b7b59e

Request headers

:path: /wp-content/plugins/disqus-comment-system/public/js/comment_count.js?ver=3.0.22
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: it-online.co.za
referer: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 02 Sep 2021 14:33:03 GMT
content-encoding: gzip
etag: "379-5c3453ac77165-gzip"
last-modified: Thu, 27 May 2021 00:56:29 GMT
server: nginx
x-powered-by: PleskLin
x-cache-status: BYPASS
vary: Accept-Encoding
content-type: application/javascript
x-accel-version: 0.01
accept-ranges: bytes
content-length: 440

GET
H2 200 comment_embed.js Show response
it-online.co.za/wp-content/plugins/disqus-comment-system/public/js/ 1 KB
605 B 94ms
92ms Script
application/javascript 178.62.18.215
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://it-online.co.za/wp-content/plugins/disqus-comment-system/public/js/comment_embed.js?ver=3.0.22
Requested by: Host: it-online.co.za
URL: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 178.62.18.215 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: it-online.co.za
Software: nginx / PleskLin
Resource Hash: 556172885a172763c715eace05597d5575ee4d4f2df6b61d723f4666b0a730a9

Request headers

:path: /wp-content/plugins/disqus-comment-system/public/js/comment_embed.js?ver=3.0.22
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: it-online.co.za
referer: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 02 Sep 2021 14:33:03 GMT
content-encoding: br
last-modified: Thu, 27 May 2021 00:56:29 GMT
server: nginx
x-powered-by: PleskLin
etag: W/"60aeee3d-4d0"
x-cache-status: BYPASS
content-type: application/javascript

GET
H2 200 comment-reply.min.js Show response
c0.wp.com/c/5.8/wp-includes/js/ 3 KB
1 KB 27ms
25ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/5.8/wp-includes/js/comment-reply.min.js

Requested by

Host: it-online.co.za
URL: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

143ce443c390db3b8598f951de20bd04623859a581a15b8cde43ebfa1f8ec103

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Thu, 02 Sep 2021 14:33:03 GMT
content-encoding: br
last-modified: Thu, 18 Mar 2021 17:48:23 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
timing-allow-origin: *
expires: Fri, 02 Sep 2022 14:33:03 GMT

GET
H2 200 jquery.min.js Show response
c0.wp.com/c/5.8/wp-includes/js/jquery/ 87 KB
30 KB 27ms
25ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/5.8/wp-includes/js/jquery/jquery.min.js

Requested by

Host: it-online.co.za
URL: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Thu, 02 Sep 2021 14:33:03 GMT
content-encoding: br
last-modified: Wed, 10 Mar 2021 15:07:24 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
timing-allow-origin: *
expires: Fri, 02 Sep 2022 14:33:03 GMT

GET
H2 200 jquery-migrate.min.js Show response
c0.wp.com/c/5.8/wp-includes/js/jquery/ 11 KB
4 KB 27ms
25ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/5.8/wp-includes/js/jquery/jquery-migrate.min.js

Requested by

Host: it-online.co.za
URL: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Thu, 02 Sep 2021 14:33:03 GMT
content-encoding: br
last-modified: Wed, 18 Nov 2020 09:06:06 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
timing-allow-origin: *
expires: Fri, 02 Sep 2022 14:33:03 GMT

GET
H2 200 scripts.min.js Show response
it-online.co.za/wp-content/themes/Divi/js/ 248 KB
51 KB 59ms
57ms Script
application/javascript 178.62.18.215
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://it-online.co.za/wp-content/themes/Divi/js/scripts.min.js?ver=4.10.5
Requested by: Host: it-online.co.za
URL: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 178.62.18.215 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: it-online.co.za
Software: nginx / PleskLin
Resource Hash: 56f6ba9d3f7eb3d795c335af2320b0504d48c6d4cc8f0a0ffa27b9249df182ac

Request headers

:path: /wp-content/themes/Divi/js/scripts.min.js?ver=4.10.5
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: it-online.co.za
referer: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 02 Sep 2021 14:33:03 GMT
content-encoding: br
last-modified: Sun, 29 Aug 2021 00:56:14 GMT
server: nginx
x-powered-by: PleskLin
etag: W/"612adb2e-3e0a8"
x-cache-status: BYPASS
content-type: application/javascript

GET
H2 200 jquery.fitvids.js Show response
it-online.co.za/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/ 3 KB
1 KB 94ms
93ms Script
application/javascript 178.62.18.215
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://it-online.co.za/wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/jquery.fitvids.js?ver=4.10.4
Requested by: Host: it-online.co.za
URL: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 178.62.18.215 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: it-online.co.za
Software: nginx / PleskLin
Resource Hash: 462747422c6af30aa81a0373fa1cfd736455cef52bdbb816f67be9531d84eace

Request headers

:path: /wp-content/themes/Divi/includes/builder/feature/dynamic-assets/assets/js/jquery.fitvids.js?ver=4.10.4
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: it-online.co.za
referer: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 02 Sep 2021 14:33:03 GMT
content-encoding: br
last-modified: Sun, 29 Aug 2021 00:56:14 GMT
server: nginx
x-powered-by: PleskLin
etag: W/"612adb2e-d15"
x-cache-status: BYPASS
content-type: application/javascript

GET
H2 200 common.js Show response
it-online.co.za/wp-content/themes/Divi/core/admin/js/ 1 KB
654 B 95ms
94ms Script
application/javascript 178.62.18.215
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://it-online.co.za/wp-content/themes/Divi/core/admin/js/common.js?ver=4.10.4
Requested by: Host: it-online.co.za
URL: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 178.62.18.215 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: it-online.co.za
Software: nginx / PleskLin
Resource Hash: 1ca76922f55b389b8f590ae7e3bcc3a2dccdce3aff1e5a4335af081b76a414ea

Request headers

:path: /wp-content/themes/Divi/core/admin/js/common.js?ver=4.10.4
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: */*
cache-control: no-cache
sec-fetch-dest: script
:authority: it-online.co.za
referer: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 02 Sep 2021 14:33:03 GMT
content-encoding: br
last-modified: Sun, 29 Aug 2021 00:56:14 GMT
server: nginx
x-powered-by: PleskLin
etag: W/"612adb2e-53f"
x-cache-status: BYPASS
content-type: application/javascript

GET
H2 200 wp-embed.min.js Show response
c0.wp.com/c/5.8/wp-includes/js/ 1 KB
696 B 26ms
25ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/c/5.8/wp-includes/js/wp-embed.min.js

Requested by

Host: it-online.co.za
URL: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Thu, 02 Sep 2021 14:33:03 GMT
content-encoding: br
last-modified: Wed, 06 Jan 2021 15:29:24 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
timing-allow-origin: *
expires: Fri, 02 Sep 2022 14:33:03 GMT

GET
H2 200 related-posts.min.js Show response
c0.wp.com/p/jetpack/10.0/_inc/build/related-posts/ 6 KB
2 KB 26ms
25ms Script
application/javascript 192.0.77.37
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL

https://c0.wp.com/p/jetpack/10.0/_inc/build/related-posts/related-posts.min.js

Requested by

Host: it-online.co.za
URL: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

192.0.77.37 , United States, ASN2635 (AUTOMATTIC, US),

Reverse DNS

wordpress.com

Software

nginx /

Resource Hash

9c6975c674a7c3077bd95750428313e78b92d370b90ca5a303b627c71d2afcf3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

x-nc: HIT ams 1
date: Thu, 02 Sep 2021 14:33:03 GMT
content-encoding: br
last-modified: Tue, 25 May 2021 17:58:16 GMT
server: nginx
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
strict-transport-security: max-age=15552000
timing-allow-origin: *
expires: Fri, 02 Sep 2022 14:33:03 GMT

GET
H2 200 mem8YaGs126MiZpBA-UFW50b.woff2
fonts.gstatic.com/s/opensans/v23/ 19 KB
19 KB 6ms
6ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v23/mem8YaGs126MiZpBA-UFW50b.woff2

Requested by

Host: it-online.co.za
URL: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

516c7b2926dbd461e33f19ff05db8587e5990184dba657483d5a569cc099a8ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://it-online.co.za
Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 27 Aug 2021 09:57:17 GMT
x-content-type-options: nosniff
age: 534946
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 19392
x-xss-protection: 0
last-modified: Tue, 10 Aug 2021 00:23:22 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 27 Aug 2022 09:57:17 GMT

GET
H2 200 mem5YaGs126MiZpBA-UNirkOXOhp.woff2
fonts.gstatic.com/s/opensans/v23/ 20 KB
20 KB 7ms
6ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v23/mem5YaGs126MiZpBA-UNirkOXOhp.woff2

Requested by

Host: it-online.co.za
URL: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5b1eb7a3036c9d68b03485722bf850a099868a9d54bf0d7c21d539eaabed0a9d

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://it-online.co.za
Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 28 Aug 2021 14:22:57 GMT
x-content-type-options: nosniff
age: 432606
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20196
x-xss-protection: 0
last-modified: Tue, 10 Aug 2021 00:23:26 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 28 Aug 2022 14:22:57 GMT

GET
H2 200 modules.ttf
it-online.co.za/wp-content/themes/Divi/core/admin/fonts/modules/all/ 90 KB
90 KB 45ms
45ms Font
application/font-sfnt 178.62.18.215
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://it-online.co.za/wp-content/themes/Divi/core/admin/fonts/modules/all/modules.ttf
Requested by: Host: it-online.co.za
URL: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 178.62.18.215 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: it-online.co.za
Software: nginx / PleskLin
Resource Hash: d201a2c3118a00c82cc48e89815f5139f23956bbe248107dcf522acc77b97c09

Request headers

:path: /wp-content/themes/Divi/core/admin/fonts/modules/all/modules.ttf
pragma: no-cache
origin: https://it-online.co.za
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: font
:authority: it-online.co.za
referer: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Origin: https://it-online.co.za
Referer: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 02 Sep 2021 14:33:03 GMT
last-modified: Sun, 29 Aug 2021 00:56:14 GMT
server: nginx
x-powered-by: PleskLin
etag: "612adb2e-168f0"
x-cache-status: BYPASS
content-type: application/font-sfnt
accept-ranges: bytes
content-length: 92400

GET
H2 200 mem5YaGs126MiZpBA-UN7rgOXOhp.woff2
fonts.gstatic.com/s/opensans/v23/ 20 KB
20 KB 7ms
7ms Font
font/woff2 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/opensans/v23/mem5YaGs126MiZpBA-UN7rgOXOhp.woff2

Requested by

Host: it-online.co.za
URL: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a401b6da1ee92f0137d4e92f68035c35fcf6600bbabdec30fca9a48f7b49fd6b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Origin: https://it-online.co.za
Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Sat, 28 Aug 2021 19:15:31 GMT
x-content-type-options: nosniff
age: 415052
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20104
x-xss-protection: 0
last-modified: Tue, 10 Aug 2021 00:23:14 GMT
server: sffe
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 28 Aug 2022 19:15:31 GMT

GET
H2 200 ga.js Show response
ssl.google-analytics.com/ 45 KB
17 KB 6ms
6ms Script
text/javascript 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl.google-analytics.com/ga.js

Requested by

Host: it-online.co.za
URL: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 11 Aug 2021 00:32:57 GMT
server: Golfe2
age: 7121
date: Thu, 02 Sep 2021 12:34:22 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 17168
expires: Thu, 02 Sep 2021 14:34:22 GMT

GET
H/1.1 200
OK count.js Show response
itonline.disqus.com/ 1 KB
1 KB 20ms
19ms Script
application/javascript 199.232.196.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://itonline.disqus.com/count.js

Requested by

Host: it-online.co.za
URL: https://it-online.co.za/wp-content/plugins/disqus-comment-system/public/js/comment_count.js?ver=3.0.22

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.196.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Thu, 02 Sep 2021 14:33:03 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Age: 20
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 871
X-XSS-Protection: 1; mode=block
Last-Modified: Mon, 30 Aug 2021 19:44:50 GMT
Server: nginx
ETag: "612d3532-367"
Strict-Transport-Security: max-age=300; includeSubdomains
Content-Type: application/javascript; charset=utf-8
Cache-Control: public, max-age=300
X-Amz-Cf-Pop: DFW55-C3
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
X-Amz-Cf-Id: ZiQ9bU3rZaQq42N10OeifXYiJtLvqmvXuJaRNfv_GQFmrJVh4b1hmA==

GET
H/1.1 200
OK embed.js Show response
itonline.disqus.com/ 74 KB
25 KB 21ms
20ms Script
application/javascript 199.232.196.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://itonline.disqus.com/embed.js

Requested by

Host: it-online.co.za
URL: https://it-online.co.za/wp-content/plugins/disqus-comment-system/public/js/comment_embed.js?ver=3.0.22

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.196.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

openresty /

Resource Hash

6f8b4042d9fe1bd6743fc4411ce77c0331f6516232c634aca53917c6fd08e602

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Thu, 02 Sep 2021 14:33:03 GMT
Content-Encoding: gzip
Server: openresty
Age: 25
Vary: Accept-Encoding
Connection: keep-alive
Content-Type: application/javascript; charset=utf-8
Cache-Control: private, max-age=60
X-Service: router
Strict-Transport-Security: max-age=300; includeSubdomains
Link: <https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length: 24676

GET
H2 200 / Show response
it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/ 2 KB
1 KB 977ms
976ms XHR
application/json 178.62.18.215
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/?relatedposts=1

Requested by

Host: c0.wp.com
URL: https://c0.wp.com/p/jetpack/10.0/_inc/build/related-posts/related-posts.min.js

Protocol

Security

TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305

Server

178.62.18.215 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

it-online.co.za

Software

nginx / PHP/7.3.27 PleskLin

Resource Hash

78fb94633831f81d2123d946f601e167ed01ff60f872411562a0b8c976cf9377

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

:path: /2021/09/02/big-increase-in-ms-exchange-attacks/?relatedposts=1
pragma: no-cache
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: cors
accept: */*
cache-control: no-cache
sec-fetch-dest: empty
:authority: it-online.co.za
x-requested-with: XMLHttpRequest
:scheme: https
sec-fetch-site: same-origin
referer: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/
:method: GET
Referer: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
x-requested-with: XMLHttpRequest

Response headers

date: Thu, 02 Sep 2021 14:33:04 GMT
content-encoding: br
x-content-type-options: nosniff
server: nginx
x-powered-by: PHP/7.3.27 PleskLin
x-cache-status: BYPASS
content-type: application/json; charset=utf-8

GET
H/1.1 200
OK embed.js Show response
s3.amazonaws.com/downloads.mailchimp.com/js/signup-forms/popup/ 126 KB
127 KB 468ms
131ms Script
application/javascript 52.216.17.211
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://s3.amazonaws.com/downloads.mailchimp.com/js/signup-forms/popup/embed.js
Requested by: Host: it-online.co.za
URL: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.216.17.211 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 07442f2bc9e417e7e700d142493b5564d926d3b28a365632e87f9e0a1c992b70

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Thu, 02 Sep 2021 14:33:05 GMT
Last-Modified: Mon, 27 Jul 2020 14:05:44 GMT
Server: AmazonS3
x-amz-request-id: YKWK7FMEJRD95WGC
ETag: "0685931cf1dde37f88e2e0520bb8fcdc"
Content-Type: application/javascript
Accept-Ranges: bytes
Content-Length: 129500
x-amz-id-2: aqcdvTJZ68sEkG0zaV/7C7m7JLplQ94O2OMM99lVw/dv0Q91m/xRaEXTMusFYQDPtpXnqqZbvec=

GET
H3-29 200 __utm.gif
ssl.google-analytics.com/r/ 35 B
54 B 14ms
13ms Image
image/gif 2a00:1450:4001:831::2008
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://ssl.google-analytics.com/r/__utm.gif?utmwv=5.7.2&utms=1&utmn=1828560623&utmhn=it-online.co.za&utmcs=UTF-8&utmsr=1600x1200&utmvp=1600x1200&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Big%20increase%20in%20MS%20Exchange%20attacks%20-%20IT-Online&utmhid=759634355&utmr=-&utmp=%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F&utmht=1630593184025&utmac=&utmcc=__utma%3D13674991.2025301754.1630593184.1630593184.1630593184.1%3B%2B__utmz%3D13674991.1630593184.1.1.utmcsr%3D(direct)%7Cutmccn%3D(direct)%7Cutmcmd%3D(none)%3B&utmjid=913176794&utmredir=1&utmu=qAAAAAAAAAAAAAAAAAAAAAAE~

Requested by

Host: it-online.co.za
URL: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:831::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Sep 2021 14:33:04 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 lounge.aa6d56595a43bd5e887186df12931c03.css
c.disquscdn.com/next/embed/styles/ 0
26 KB 7ms
6ms Other
text/css 2600:9000:2240:2800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/styles/lounge.aa6d56595a43bd5e887186df12931c03.css

Requested by

Host: itonline.disqus.com
URL: https://itonline.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2240:2800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 01 Sep 2021 22:01:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 59510
x-cache: Hit from cloudfront
content-length: 26040
x-xss-protection: 1; mode=block
x-served-by: static-web-1
access-control-allow-origin: *
surrogate-key: next
last-modified: Wed, 01 Sep 2021 21:40:36 GMT
server: nginx
etag: "612ff354-65b8"
content-type: text/css; charset=utf-8
via: 1.1 fd38301adb0ceb6cf6c42567f371a2f5.cloudfront.net (CloudFront)
expires: Thu, 01 Sep 2022 22:01:14 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA60-P1
timing-allow-origin: *
x-amz-cf-id: gHJ4Wh4K0-BNnqHrud5TxJgRWG9pjKIP1mSIwR4caTW-cZ1HWc6trg==
x-cache-hits: 0

GET
H2 200 common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js
c.disquscdn.com/next/embed/ 0
93 KB 13ms
12ms Other
application/javascript 2600:9000:2240:2800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js

Requested by

Host: itonline.disqus.com
URL: https://itonline.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2240:2800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 19 Jul 2021 20:07:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3867951
x-cache: Hit from cloudfront
content-length: 94790
x-xss-protection: 1; mode=block
x-served-by: static-web-1
access-control-allow-origin: *
surrogate-key: next
last-modified: Mon, 19 Jul 2021 19:39:06 GMT
server: nginx
etag: "60f5d4da-17246"
content-type: application/javascript; charset=utf-8
via: 1.1 fd38301adb0ceb6cf6c42567f371a2f5.cloudfront.net (CloudFront)
expires: Tue, 19 Jul 2022 20:07:13 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA60-P1
timing-allow-origin: *
x-amz-cf-id: r9awe0YEXcalOqLpDdBAHQK9D9UcIV-VnqcrLRy8MQgEdldQEPCJPA==
x-cache-hits: 0

GET
H2 200 lounge.bundle.4ea55ec26f05a70c324c6f3143e00d48.js
c.disquscdn.com/next/embed/ 0
119 KB 21ms
20ms Other
application/javascript 2600:9000:2240:2800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/lounge.bundle.4ea55ec26f05a70c324c6f3143e00d48.js

Requested by

Host: itonline.disqus.com
URL: https://itonline.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2240:2800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 01 Sep 2021 22:01:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 59510
x-cache: Hit from cloudfront
content-length: 120709
x-xss-protection: 1; mode=block
x-served-by: static-web-2
access-control-allow-origin: *
surrogate-key: next
last-modified: Wed, 01 Sep 2021 21:40:36 GMT
server: nginx
etag: "612ff354-1d785"
content-type: application/javascript; charset=utf-8
via: 1.1 fd38301adb0ceb6cf6c42567f371a2f5.cloudfront.net (CloudFront)
expires: Thu, 01 Sep 2022 22:01:14 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA60-P1
timing-allow-origin: *
x-amz-cf-id: 8cMqxggmgcR2qRsFQeM19BMv-L973dotFN_9F4wjw-goNBRpuAub7A==
x-cache-hits: 0

GET
H/1.1 200
OK config.js
disqus.com/next/ 0
13 KB 29ms
28ms Other
application/javascript 151.101.64.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/next/config.js

Requested by

Host: itonline.disqus.com
URL: https://itonline.disqus.com/embed.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.64.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Thu, 02 Sep 2021 14:33:04 GMT
X-Content-Type-Options: nosniff
Content-Type: application/javascript; charset=UTF-8
Server: nginx
Age: 23
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Access-Control-Allow-Origin: *
Cache-Control: public, stale-while-revalidate=300, s-stalewhilerevalidate=3600, max-age=60
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 12397
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK / Show response
disqus.com/embed/comments/ Frame 15F5 6 KB
4 KB 20ms
20ms Document
text/html 151.101.64.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/embed/comments/?base=default&f=itonline&t_i=193371%20https%3A%2F%2Fit-online.co.za%2F%3Fp%3D193371&t_u=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F&t_e=Big%20increase%20in%20MS%20Exchange%20attacks&t_d=Big%20increase%20in%20MS%20Exchange%20attacks&t_t=Big%20increase%20in%20MS%20Exchange%20attacks&s_o=default

Requested by

Host: itonline.disqus.com
URL: https://itonline.disqus.com/embed.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.64.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

9755d460c9a433840b200fbadf27f28d31e29fde5d1e800bfbdf927e0e6e5a18

Security Headers

Name	Value
Content-Security-Policy	script-src https://.twitter.com: https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://.services.disqus.com: https://cdn.boomtrain.com/p13n/ https://apis.google.com https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ 'unsafe-inline' https://com-disqus.netmng.com:* https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Host: disqus.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: cross-site
Sec-Fetch-Mode: navigate
Sec-Fetch-Dest: iframe
Referer: https://it-online.co.za/
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://it-online.co.za/

Response headers

Connection: keep-alive
Content-Length: 2669
Server: nginx
Content-Security-Policy: script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://apis.google.com https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ 'unsafe-inline' https://com-disqus.netmng.com:* https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Link: <https://c.disquscdn.com>;rel=preconnect,<https://c.disquscdn.com>;rel=dns-prefetch
Cache-Control: stale-if-error=3600, s-stalewhilerevalidate=3600, stale-while-revalidate=30, no-cache, must-revalidate, public, s-maxage=5
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Content-Type: text/html; charset=utf-8
Last-Modified: Thu, 02 Sep 2021 09:27:05 GMT
ETag: W/"lounge:view:8752342680.d5a9e5c6a52137be24dce66460601cbc.2"
Referrer-Policy: no-referrer-when-downgrade
Content-Encoding: gzip
Date: Thu, 02 Sep 2021 14:33:04 GMT
Age: 25
Vary: Accept-Encoding
Strict-Transport-Security: max-age=300; includeSubdomains

GET
H/1.1 200
OK stat.gif
referrer.disqus.com/juggler/ 43 B
295 B 121ms
120ms Image
image/gif 199.232.196.134
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://referrer.disqus.com/juggler/stat.gif?event=lounge.loading.view

Requested by

Host: it-online.co.za
URL: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.196.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Thu, 02 Sep 2021 14:33:04 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Server: nginx
Content-Type: image/gif
Connection: keep-alive
Content-Length: 43
X-XSS-Protection: 1; mode=block

GET
H2 200 disqus-social-icon-dark.a621bea3e02c9fa04fd3965a3d6f424d.svg
c.disquscdn.com/next/embed/assets/img/ 1 KB
2 KB 6ms
6ms Image
image/svg+xml 2600:9000:2240:2800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/embed/assets/img/disqus-social-icon-dark.a621bea3e02c9fa04fd3965a3d6f424d.svg

Requested by

Host: it-online.co.za
URL: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2240:2800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

ad3d0ca410aa64d933c2853e39ef8b605c4815f9826bc0e721e3d3d93860bf64

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 29 Apr 2021 07:52:30 GMT
via: 1.1 fd38301adb0ceb6cf6c42567f371a2f5.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 10910434
x-cache: Hit from cloudfront
content-length: 1042
x-xss-protection: 1; mode=block
x-served-by: static-web-1
surrogate-key: next
last-modified: Wed, 28 Apr 2021 21:48:08 GMT
server: nginx
etag: "6089d818-412"
content-type: image/svg+xml; charset=utf-8
access-control-allow-origin: *
expires: Fri, 29 Apr 2022 07:52:30 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA60-P1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: IlQEFWAE0xKwHPsj2peJ-LxRbdTEozhHB5jkApZP3WZzzGqVXe5ogg==
x-cache-hits: 0

GET
H2 200 lounge.load.2fc27c00107c7b2b4ed8e4f06d3c88da.js Show response
c.disquscdn.com/next/embed/ Frame 15F5 1 KB
1 KB 6ms
6ms Script
application/javascript 2600:9000:2240:2800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/lounge.load.2fc27c00107c7b2b4ed8e4f06d3c88da.js

Requested by

Host: disqus.com
URL: https://disqus.com/embed/comments/?base=default&f=itonline&t_i=193371%20https%3A%2F%2Fit-online.co.za%2F%3Fp%3D193371&t_u=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F&t_e=Big%20increase%20in%20MS%20Exchange%20attacks&t_d=Big%20increase%20in%20MS%20Exchange%20attacks&t_t=Big%20increase%20in%20MS%20Exchange%20attacks&s_o=default

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2240:2800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

ee55e4421382118b980a40578e6e0f0210762fe7aa1aaf97bf1a27fd6692bcdb

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Origin: https://disqus.com
Referer: https://disqus.com/embed/comments/?base=default&f=itonline&t_i=193371%20https%3A%2F%2Fit-online.co.za%2F%3Fp%3D193371&t_u=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F&t_e=Big%20increase%20in%20MS%20Exchange%20attacks&t_d=Big%20increase%20in%20MS%20Exchange%20attacks&t_t=Big%20increase%20in%20MS%20Exchange%20attacks&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 01 Sep 2021 22:01:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 59509
x-cache: Hit from cloudfront
content-length: 535
x-xss-protection: 1; mode=block
x-served-by: static-web-2
access-control-allow-origin: *
surrogate-key: next
last-modified: Wed, 01 Sep 2021 21:40:36 GMT
server: nginx
etag: "612ff354-217"
content-type: application/javascript; charset=utf-8
via: 1.1 5fa65194b963365c20fbd28444032cfc.cloudfront.net (CloudFront)
expires: Thu, 01 Sep 2022 22:01:14 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA60-P1
timing-allow-origin: *
x-amz-cf-id: TQU5Tml_8VyCOuXe-DfoTS8vJlgOyy6TpZgQ64b5FwWDlxebmaED8Q==
x-cache-hits: 0

GET
H2 200 common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js Show response
c.disquscdn.com/next/embed/ Frame 15F5 282 KB
93 KB 7ms
6ms Script
application/javascript 2600:9000:2240:2800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/lounge.load.2fc27c00107c7b2b4ed8e4f06d3c88da.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2240:2800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

443211c7845e0012dea1dfe8cda1ce659e7fef3c7b5af2b470704ed8186945c0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=itonline&t_i=193371%20https%3A%2F%2Fit-online.co.za%2F%3Fp%3D193371&t_u=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F&t_e=Big%20increase%20in%20MS%20Exchange%20attacks&t_d=Big%20increase%20in%20MS%20Exchange%20attacks&t_t=Big%20increase%20in%20MS%20Exchange%20attacks&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 19 Jul 2021 20:07:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 3867951
x-cache: Hit from cloudfront
content-length: 94790
x-xss-protection: 1; mode=block
x-served-by: static-web-1
access-control-allow-origin: *
surrogate-key: next
last-modified: Mon, 19 Jul 2021 19:39:06 GMT
server: nginx
etag: "60f5d4da-17246"
content-type: application/javascript; charset=utf-8
via: 1.1 fd38301adb0ceb6cf6c42567f371a2f5.cloudfront.net (CloudFront)
expires: Tue, 19 Jul 2022 20:07:13 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA60-P1
timing-allow-origin: *
x-amz-cf-id: bWFV66yI0g4f6IBgWw5WP2Zap6ZN_iWOJrbTq7M0wpCajPrAhKwosw==
x-cache-hits: 0

GET
H2 200 lounge.aa6d56595a43bd5e887186df12931c03.css
c.disquscdn.com/next/embed/styles/ Frame 15F5 163 KB
26 KB 6ms
6ms Stylesheet
text/css 2600:9000:2240:2800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/styles/lounge.aa6d56595a43bd5e887186df12931c03.css

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2240:2800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

cf7ffb56cda8d58d7a7783e442a5729573c7e5d7098785c9a6cb382f2a772b56

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=itonline&t_i=193371%20https%3A%2F%2Fit-online.co.za%2F%3Fp%3D193371&t_u=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F&t_e=Big%20increase%20in%20MS%20Exchange%20attacks&t_d=Big%20increase%20in%20MS%20Exchange%20attacks&t_t=Big%20increase%20in%20MS%20Exchange%20attacks&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 01 Sep 2021 22:01:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 59510
x-cache: Hit from cloudfront
content-length: 26040
x-xss-protection: 1; mode=block
x-served-by: static-web-1
access-control-allow-origin: *
surrogate-key: next
last-modified: Wed, 01 Sep 2021 21:40:36 GMT
server: nginx
etag: "612ff354-65b8"
content-type: text/css; charset=utf-8
via: 1.1 fd38301adb0ceb6cf6c42567f371a2f5.cloudfront.net (CloudFront)
expires: Thu, 01 Sep 2022 22:01:14 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA60-P1
timing-allow-origin: *
x-amz-cf-id: -KIZxz4-MIxG3rD6-eTLRCOnVlrU9HFlV4W-MLXilBvamwwC4VyE1Q==
x-cache-hits: 0

GET
H2 200 lounge.bundle.4ea55ec26f05a70c324c6f3143e00d48.js Show response
c.disquscdn.com/next/embed/ Frame 15F5 468 KB
119 KB 6ms
6ms Script
application/javascript 2600:9000:2240:2800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/lounge.bundle.4ea55ec26f05a70c324c6f3143e00d48.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2240:2800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

d05525883026126f82533f0a769bf460072de0eb2057a904488ca457cce7656e

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=itonline&t_i=193371%20https%3A%2F%2Fit-online.co.za%2F%3Fp%3D193371&t_u=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F&t_e=Big%20increase%20in%20MS%20Exchange%20attacks&t_d=Big%20increase%20in%20MS%20Exchange%20attacks&t_t=Big%20increase%20in%20MS%20Exchange%20attacks&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 01 Sep 2021 22:01:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 59510
x-cache: Hit from cloudfront
content-length: 120709
x-xss-protection: 1; mode=block
x-served-by: static-web-2
access-control-allow-origin: *
surrogate-key: next
last-modified: Wed, 01 Sep 2021 21:40:36 GMT
server: nginx
etag: "612ff354-1d785"
content-type: application/javascript; charset=utf-8
via: 1.1 fd38301adb0ceb6cf6c42567f371a2f5.cloudfront.net (CloudFront)
expires: Thu, 01 Sep 2022 22:01:14 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA60-P1
timing-allow-origin: *
x-amz-cf-id: m1Wj3AQZXOStEZnvKA9pvYzmnsEa6-2jWQwwHs5-XY2-Ef93AeEhFg==
x-cache-hits: 0

GET
H/1.1 200
OK config.js Show response
disqus.com/next/ Frame 15F5 12 KB
13 KB 20ms
20ms Script
application/javascript 151.101.64.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/next/config.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.64.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

e8be42019425fc26bcf13b4b96de105ae4317667ae197a353b3b4e55081ebd72

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=itonline&t_i=193371%20https%3A%2F%2Fit-online.co.za%2F%3Fp%3D193371&t_u=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F&t_e=Big%20increase%20in%20MS%20Exchange%20attacks&t_d=Big%20increase%20in%20MS%20Exchange%20attacks&t_t=Big%20increase%20in%20MS%20Exchange%20attacks&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Thu, 02 Sep 2021 14:33:04 GMT
X-Content-Type-Options: nosniff
Content-Type: application/javascript; charset=UTF-8
Server: nginx
Age: 23
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Access-Control-Allow-Origin: *
Cache-Control: public, stale-while-revalidate=300, s-stalewhilerevalidate=3600, max-age=60
Connection: keep-alive
Timing-Allow-Origin: *
Content-Length: 12397
X-XSS-Protection: 1; mode=block

GET
H/1.1 200
OK details Show response
disqus.com/api/3.0/forums/ Frame 15F5 3 KB
3 KB 43ms
43ms XHR
application/json 151.101.64.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://disqus.com/api/3.0/forums/details?forum=itonline&attach=forumFeatures&api_key=E8Uh5l5fHZ6gD8U3KycjAIAk46f68Zw7C6eW8WSjZvCLXebZ7p0r1yrYDrLilk2F

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.64.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

4e38f27531151dca909c853975eec2d75eef1c65c6a73ff09c94f5c5202f955f

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Accept: */*
Referer: https://disqus.com/embed/comments/?base=default&f=itonline&t_i=193371%20https%3A%2F%2Fit-online.co.za%2F%3Fp%3D193371&t_u=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F&t_e=Big%20increase%20in%20MS%20Exchange%20attacks&t_d=Big%20increase%20in%20MS%20Exchange%20attacks&t_t=Big%20increase%20in%20MS%20Exchange%20attacks&s_o=default
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Thu, 02 Sep 2021 14:33:04 GMT
X-Content-Type-Options: nosniff
Server: nginx
Age: 25
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Connection: keep-alive
Content-Type: application/json
Vary: Origin, Cookie
Content-Length: 3013
X-XSS-Protection: 1; mode=block

GET
H2 200 noavatar92.png
a.disquscdn.com/1624570071/images/ Frame 15F5 2 KB
2 KB 23ms
23ms Image
image/png 151.101.14.49
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://a.disquscdn.com/1624570071/images/noavatar92.png

Requested by

Host: it-online.co.za
URL: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.14.49 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

36ef66124133ca33c8b44c487293c3180e5ab681ff3cad3c728ea4f894ec3444

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=itonline&t_i=193371%20https%3A%2F%2Fit-online.co.za%2F%3Fp%3D193371&t_u=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F&t_e=Big%20increase%20in%20MS%20Exchange%20attacks&t_d=Big%20increase%20in%20MS%20Exchange%20attacks&t_t=Big%20increase%20in%20MS%20Exchange%20attacks&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 02 Sep 2021 14:33:04 GMT
x-content-type-options: nosniff
last-modified: Fri, 26 Feb 2021 20:50:09 GMT
server: nginx
age: 2343678
etag: "60395f01-66c"
strict-transport-security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
x-xss-protection: 1; mode=block
cache-control: max-age=2592000
x-amz-cf-pop: FRA2-C2
content-type: image/png
content-length: 1644
x-amz-cf-id: PbMVeM2iWmudwIaI31RBJmSVugFre_LpJLL2G4ilL6tNFDLra-hEMw==
expires: Fri, 06 Aug 2021 11:31:45 GMT

GET
DATA 200
OK truncated
/ Frame 15F5 37 B
0 Image
image/gif

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Content-Type: image/gif

GET
H2 200 svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg
c.disquscdn.com/next/embed/assets/img/ Frame 15F5 13 KB
13 KB 6ms
6ms Image
image/svg+xml 2600:9000:2240:2800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/embed/assets/img/svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.aa6d56595a43bd5e887186df12931c03.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2240:2800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

3270642c89180c12db93775e2a774b6dadd9bd98cffc963075c85afd2c17b6e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://c.disquscdn.com/next/embed/styles/lounge.aa6d56595a43bd5e887186df12931c03.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 28 Apr 2021 14:37:41 GMT
via: 1.1 fd38301adb0ceb6cf6c42567f371a2f5.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 10972523
x-cache: Hit from cloudfront
content-length: 13079
x-xss-protection: 1; mode=block
x-served-by: static-web-1
surrogate-key: next
last-modified: Tue, 27 Apr 2021 21:01:56 GMT
server: nginx
etag: "60887bc4-3317"
content-type: image/svg+xml; charset=utf-8
access-control-allow-origin: *
expires: Thu, 28 Apr 2022 14:37:41 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA60-P1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: Unnwcnq9N09nMUEisTAcXRJbw1ekkCBeta965mtpLfbAkLmprmu66w==
x-cache-hits: 0

GET
H2 200 loader.ba7c86e8b4b6135bb668d05223f8f127.gif
c.disquscdn.com/next/embed/assets/img/ Frame 15F5 3 KB
3 KB 6ms
6ms Image
image/gif 2600:9000:2240:2800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/embed/assets/img/loader.ba7c86e8b4b6135bb668d05223f8f127.gif

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.aa6d56595a43bd5e887186df12931c03.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2240:2800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

4c4491dcfa94cb46fb73742fc2caf49a1cd59027304af1830c7dc6ce1889857c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://c.disquscdn.com/next/embed/styles/lounge.aa6d56595a43bd5e887186df12931c03.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 03 Feb 2021 04:58:07 GMT
via: 1.1 fd38301adb0ceb6cf6c42567f371a2f5.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 18264897
x-cache: Hit from cloudfront
content-length: 2971
x-xss-protection: 1; mode=block
x-served-by: static-web-2
surrogate-key: next
last-modified: Wed, 27 Jan 2021 17:23:07 GMT
server: nginx
etag: "6011a17b-b9b"
content-type: image/gif
access-control-allow-origin: *
expires: Thu, 03 Feb 2022 04:58:07 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA60-P1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: E0swWzADbHpIY1V-vtYUp5Y1i7SaHYlW-CZJ-jL928RxTtndUUyjiA==
x-cache-hits: 0

GET
H2 200 sprite.654110a9206fd22f08cca0798e34a65e.png
c.disquscdn.com/next/embed/assets/img/ Frame 15F5 2 KB
2 KB 6ms
5ms Image
image/png 2600:9000:2240:2800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/embed/assets/img/sprite.654110a9206fd22f08cca0798e34a65e.png

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.aa6d56595a43bd5e887186df12931c03.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2240:2800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

cdba739c28b41f39ce438f2bf204fe739dc81a26cf559a9394ceed56a0666bee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://c.disquscdn.com/next/embed/styles/lounge.aa6d56595a43bd5e887186df12931c03.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Fri, 11 Jun 2021 10:47:19 GMT
via: 1.1 fd38301adb0ceb6cf6c42567f371a2f5.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 7184745
x-cache: Hit from cloudfront
content-length: 1862
x-xss-protection: 1; mode=block
x-served-by: static-web-2
surrogate-key: next
last-modified: Thu, 10 Jun 2021 21:33:44 GMT
server: nginx
etag: "60c28538-746"
content-type: image/png
access-control-allow-origin: *
expires: Sat, 11 Jun 2022 10:47:19 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA60-P1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: mnKDDZasCY-vdUSIzmtRWgKmIM1MbbQIR_kP5FwKH5ud7O6QdjAW_Q==
x-cache-hits: 0

GET
H2 200 icons.4cc7a703d2fdfe684151ff8ac24d45f1.woff2
c.disquscdn.com/next/embed/assets/font/ Frame 15F5 8 KB
8 KB 7ms
6ms Font
application/octet-stream 2600:9000:2240:2800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/assets/font/icons.4cc7a703d2fdfe684151ff8ac24d45f1.woff2

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.aa6d56595a43bd5e887186df12931c03.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2240:2800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

f2a341fc815d45c21da726d4c843c2c5d3e1f333465347c3c75d040d556df4e5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Origin: https://disqus.com
Referer: https://c.disquscdn.com/next/embed/styles/lounge.aa6d56595a43bd5e887186df12931c03.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Mon, 12 Jul 2021 19:36:59 GMT
via: 1.1 5fa65194b963365c20fbd28444032cfc.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 4474565
x-cache: Hit from cloudfront
content-length: 7900
x-xss-protection: 1; mode=block
x-served-by: static-web-2
surrogate-key: next
last-modified: Thu, 08 Jul 2021 22:07:43 GMT
server: nginx
etag: "60e7772f-1edc"
content-type: application/octet-stream
access-control-allow-origin: *
expires: Tue, 12 Jul 2022 19:36:59 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA60-P1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: vsMIX4UQvAUoSb3L8ko8X3t8i845V5xBzbLX4oYEKN0LaAL8d8c0wQ==
x-cache-hits: 0

GET
H2 200 realtime.af77184dec69e96e69aff958ae2bb738.css
c.disquscdn.com/next/embed/styles/ Frame 4030 337 B
808 B 6ms
6ms Stylesheet
text/css 2600:9000:2240:2800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/styles/realtime.af77184dec69e96e69aff958ae2bb738.css

Requested by

Host: itonline.disqus.com
URL: https://itonline.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2240:2800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

c284dcb06ef882b1b45e11e0a16baa223b4117eca94e243c8e725c4ce3f909b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 05 May 2021 03:13:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10408770
x-cache: Hit from cloudfront
content-length: 244
x-xss-protection: 1; mode=block
x-served-by: static-web-2
access-control-allow-origin: *
surrogate-key: next
last-modified: Wed, 28 Apr 2021 21:48:08 GMT
server: nginx
etag: "6089d818-f4"
content-type: text/css; charset=utf-8
via: 1.1 fd38301adb0ceb6cf6c42567f371a2f5.cloudfront.net (CloudFront)
expires: Thu, 05 May 2022 03:13:34 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA60-P1
timing-allow-origin: *
x-amz-cf-id: ZHIUScDxgQCsA7FcKdx9cUzNBi96YwsyBD0tGa-QfBnI2baqx4k-rA==
x-cache-hits: 0

GET
H2 200 realtime.af77184dec69e96e69aff958ae2bb738.css
c.disquscdn.com/next/embed/styles/ Frame C8EC 337 B
808 B 6ms
6ms Stylesheet
text/css 2600:9000:2240:2800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://c.disquscdn.com/next/embed/styles/realtime.af77184dec69e96e69aff958ae2bb738.css

Requested by

Host: itonline.disqus.com
URL: https://itonline.disqus.com/embed.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2240:2800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

c284dcb06ef882b1b45e11e0a16baa223b4117eca94e243c8e725c4ce3f909b3

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 05 May 2021 03:13:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 10408770
x-cache: Hit from cloudfront
content-length: 244
x-xss-protection: 1; mode=block
x-served-by: static-web-2
access-control-allow-origin: *
surrogate-key: next
last-modified: Wed, 28 Apr 2021 21:48:08 GMT
server: nginx
etag: "6089d818-f4"
content-type: text/css; charset=utf-8
via: 1.1 fd38301adb0ceb6cf6c42567f371a2f5.cloudfront.net (CloudFront)
expires: Thu, 05 May 2022 03:13:34 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA60-P1
timing-allow-origin: *
x-amz-cf-id: lPrM-dEbAYj4hCgCXuuhsowOdzQnBk4tE4WktuZtYvXI_QgIv2_q9Q==
x-cache-hits: 0

GET
H2 200 sdk.js Show response
connect.facebook.net/en_US/ Frame 15F5 3 KB
2 KB 7ms
6ms Script
application/x-javascript 2a03:2880:f01c:216:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

1e3561dbb5d8983e257c9e8e1782b65364bdd1b4b4c9bdc8fa879cf2ef775a59

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=itonline&t_i=193371%20https%3A%2F%2Fit-online.co.za%2F%3Fp%3D193371&t_u=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F&t_e=Big%20increase%20in%20MS%20Exchange%20attacks&t_d=Big%20increase%20in%20MS%20Exchange%20attacks&t_t=Big%20increase%20in%20MS%20Exchange%20attacks&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: tLKLUx0HbeSl4dzKXRY3vA==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 1688
x-fb-rlafr: 0
x-fb-debug: oBdScQSnhDe9Sbg3QKW0drazcutfTXCcxGL+LlkJDt4mrlgI2WQW+FHwkiUIG5krOAbY8zfGezSQnAPBawVkFA==
x-fb-trip-id: 686109401
x-fb-content-md5: 85edddbaff4455330cad322f85b60216
x-frame-options: DENY
date: Thu, 02 Sep 2021 14:33:04 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=1200,stale-while-revalidate=3600
etag: "6cf8558ac8f570edb7ddf7cd84d858f5"
timing-allow-origin: *
priority: u=3,i
expires: Thu, 02 Sep 2021 14:35:27 GMT

GET
H2 200 api.js Show response
apis.google.com/js/ Frame 15F5 12 KB
6 KB 192ms
192ms Script
application/javascript 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/js/api.js

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

6051b0bcec1920eb2bbe7878c2a34f9b70621bf4d7956479288c7bfce692ace7

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-giy8OqflMFnsYnJbMadDtQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=itonline&t_i=193371%20https%3A%2F%2Fit-online.co.za%2F%3Fp%3D193371&t_u=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F&t_e=Big%20increase%20in%20MS%20Exchange%20attacks&t_d=Big%20increase%20in%20MS%20Exchange%20attacks&t_t=Big%20increase%20in%20MS%20Exchange%20attacks&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 02 Sep 2021 14:33:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
x-ua-compatible: IE=edge, chrome=1
server: ESF
x-frame-options: SAMEORIGIN
etag: "2fd189536e81897dab177be9d624bb8e"
strict-transport-security: max-age=31536000
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=1800, stale-while-revalidate=1800
content-security-policy: script-src 'report-sample' 'nonce-giy8OqflMFnsYnJbMadDtQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
timing-allow-origin: *
expires: Thu, 02 Sep 2021 14:33:04 GMT

GET
H/1.1 200
OK event.js Show response
referrer.disqus.com/juggler/ Frame 15F5 40 B
278 B 121ms
121ms Script
application/javascript 199.232.196.134
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://referrer.disqus.com/juggler/event.js?experiment=network_default_hidden&variant=fallthrough&page_referrer=direct&product=embed&thread=8752342680&thread_id=8752342680&forum=itonline&forum_id=818083&zone=thread&page_url=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F&service=dynamic&verb=view&object_type=product&object_id=embed&extra_data=%7B%22color_scheme%22%3A%22light%22%2C%22anchor_color%22%3A%22rgb(46%2C163%2C242)%22%2C%22typeface%22%3A%22sans-serif%22%2C%22width%22%3A795%7D&event=activity&imp=g7to88255vhvl&prev_imp=&section=default&area=n%2Fa

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.196.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

f5627ea74eac809576ae16667ed7522b8dff46df48c38d9452dbe2eb208d2eef

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=itonline&t_i=193371%20https%3A%2F%2Fit-online.co.za%2F%3Fp%3D193371&t_u=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F&t_e=Big%20increase%20in%20MS%20Exchange%20attacks&t_d=Big%20increase%20in%20MS%20Exchange%20attacks&t_t=Big%20increase%20in%20MS%20Exchange%20attacks&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Thu, 02 Sep 2021 14:33:04 GMT
X-Content-Type-Options: nosniff
Server: nginx
Connection: keep-alive
X-XSS-Protection: 1; mode=block
transfer-encoding: chunked
Content-Type: application/javascript

GET
H2 200 svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg
c.disquscdn.com/next/embed/assets/img/ Frame 15F5 13 KB
13 KB 6ms
6ms Image
image/svg+xml 2600:9000:2240:2800:6:8656:f5c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://c.disquscdn.com/next/embed/assets/img/svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.aa6d56595a43bd5e887186df12931c03.css

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2240:2800:6:8656:f5c0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

nginx /

Resource Hash

3270642c89180c12db93775e2a774b6dadd9bd98cffc963075c85afd2c17b6e4

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://c.disquscdn.com/next/embed/styles/lounge.aa6d56595a43bd5e887186df12931c03.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 28 Apr 2021 14:37:41 GMT
via: 1.1 fd38301adb0ceb6cf6c42567f371a2f5.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 10972523
x-cache: Hit from cloudfront
content-length: 13079
x-xss-protection: 1; mode=block
x-served-by: static-web-1
surrogate-key: next
last-modified: Tue, 27 Apr 2021 21:01:56 GMT
server: nginx
etag: "60887bc4-3317"
content-type: image/svg+xml; charset=utf-8
access-control-allow-origin: *
expires: Thu, 28 Apr 2022 14:37:41 GMT
cache-control: max-age=31536000, public, immutable, no-transform
x-amz-cf-pop: FRA60-P1
accept-ranges: bytes
timing-allow-origin: *
x-amz-cf-id: -4NHgjuY1yUVStkwS4G9VoKKq_WYadCXEADPCnn2Da6mOyP1qYXkMg==
x-cache-hits: 0

GET
H3-29 200 sdk.js Show response
connect.facebook.net/en_US/ Frame 15F5 227 KB
67 KB 6ms
6ms Script
application/x-javascript 2a03:2880:f01c:216:face:b00c:0:3
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/sdk.js?hash=a92106854ba46dfb9831281c321844c9

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/sdk.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

e13952f84be306cc90869e3e26b5667b65073198f666a9af1f68fd4269fa676d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Origin: https://disqus.com
Referer: https://disqus.com/embed/comments/?base=default&f=itonline&t_i=193371%20https%3A%2F%2Fit-online.co.za%2F%3Fp%3D193371&t_u=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F&t_e=Big%20increase%20in%20MS%20Exchange%20attacks&t_d=Big%20increase%20in%20MS%20Exchange%20attacks&t_t=Big%20increase%20in%20MS%20Exchange%20attacks&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; preload; includeSubDomains
content-encoding: gzip
x-content-type-options: nosniff
content-md5: bKMitwfbIm+wDSFXCd6hng==
cross-origin-resource-policy: cross-origin
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 68285
x-fb-rlafr: 0
x-fb-debug: wMGC9tFcDCJUKfbVu5yKNt4OGiehWLhWJXiDvpvaeTvaPP1sv+8xbgPq5do9fgyPyW+ysBb/lNKSPCZChvlDkw==
x-fb-content-md5: 656b7a5ae26d3baf5de1a942a4c7b219
x-frame-options: DENY
date: Thu, 02 Sep 2021 14:33:04 GMT
vary: Accept-Encoding
content-type: application/x-javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: X-FB-Content-MD5
cache-control: public,max-age=31536000,stale-while-revalidate=3600,immutable
etag: "72a3b3916f40d24610d3b48dfbf7f87e"
timing-allow-origin: *
priority: u=3,i
expires: Fri, 02 Sep 2022 12:52:06 GMT

GET
H2 200 status
www.facebook.com/x/oauth/ Frame 15F5 0
0 34ms
33ms Fetch
text/plain 2a03:2880:f11c:8083:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/x/oauth/status?ancestor_origins=https%3A%2F%2Fit-online.co.za&client_id=52254943976&input_token&origin=1&redirect_uri=https%3A%2F%2Fdisqus.com%2Fembed%2Fcomments%2F%3Fbase%3Ddefault%26f%3Ditonline%26t_i%3D193371%2520https%253A%252F%252Fit-online.co.za%252F%253Fp%253D193371%26t_u%3Dhttps%253A%252F%252Fit-online.co.za%252F2021%252F09%252F02%252Fbig-increase-in-ms-exchange-attacks%252F%26t_e%3DBig%2520increase%2520in%2520MS%2520Exchange%2520attacks%26t_d%3DBig%2520increase%2520in%2520MS%2520Exchange%2520attacks%26t_t%3DBig%2520increase%2520in%2520MS%2520Exchange%2520attacks%26s_o%3Ddefault%23version%3D2fc27c00107c7b2b4ed8e4f06d3c88da&sdk=joey&wants_cookie_data=false

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f11c:8083:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://disqus.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

strict-transport-security: max-age=15552000; preload
x-content-type-options: nosniff
content-security-policy-report-only: default-src 'self' data: blob: https://*.fbsbx.com 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net;script-src connect.facebook.net static.xx.fbcdn.net 'unsafe-inline' *.facebook.com 'unsafe-eval' *.fbcdn.net data:;connect-src wss://gateway.facebook.com wss://edge-chat.facebook.com *.facebook.com *.fbcdn.net wss://snaptu-d.facebook.com wss://kaios-d-test.facebook.com/ wss://kaios-d.facebook.com/ *.fbxbs.com;font-src data: *.gstatic.com *.facebook.com *.fbcdn.net;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com *.tenor.co facebook.com *.cdninstagram.com fbsbx.com fbcdn.net *.giphy.com connect.facebook.net *.carriersignal.info *.atdmt.com blob: android-webview-video-poster:;frame-src *.doubleclick.net *.google.com *.facebook.com www.googleadservices.com *.fbsbx.com *.atdmt.com;worker-src blob:;report-uri https://www.facebook.com/csp/reporting/?minimize=0;
alt-svc: h3-29=":443"; ma=3600,h3-27=":443"; ma=3600
content-length: 0
x-fb-rlafr: 0
pragma: no-cache
x-fb-debug: 02jJCIus0/1HwkrQOqBSZ4XR9VIE+eW2A9SLSdnRp1UBueFXmRcxOiEWDNS7UOt4gcRRpSg8qHGMtcfo5XF2Lw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
fb-s: unknown
cross-origin-opener-policy: same-origin-allow-popups
date: Thu, 02 Sep 2021 14:33:04 GMT
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/"}],"group":"coep_report"}
content-type: text/plain; charset=UTF-8
access-control-allow-origin: https://disqus.com
access-control-expose-headers: fb-s
cache-control: private, no-cache, no-store, must-revalidate
access-control-allow-credentials: true
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H3-29 200 cb=gapi.loaded_0 Show response
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.UYHeVG_mX5s.O/m=auth2/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCPDcESMLF74mIvk5CKxuCjzYIf5XA/ Frame 15F5 103 KB
34 KB 23ms
8ms Script
text/javascript 2a00:1450:4001:808::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.UYHeVG_mX5s.O/m=auth2/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCPDcESMLF74mIvk5CKxuCjzYIf5XA/cb=gapi.loaded_0

Requested by

Host: apis.google.com
URL: https://apis.google.com/js/api.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:808::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

539379f60baa97f505721f54604b7ddcf6d3ce022a37d045db908cc861169bea

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=itonline&t_i=193371%20https%3A%2F%2Fit-online.co.za%2F%3Fp%3D193371&t_u=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F&t_e=Big%20increase%20in%20MS%20Exchange%20attacks&t_d=Big%20increase%20in%20MS%20Exchange%20attacks&t_t=Big%20increase%20in%20MS%20Exchange%20attacks&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 01 Sep 2021 10:54:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 99532
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35096
x-xss-protection: 0
last-modified: Mon, 23 Aug 2021 18:17:31 GMT
server: sffe
vary: Accept-Encoding, Origin
content-type: text/javascript; charset=UTF-8
cache-control: public, immutable, max-age=31536000
accept-ranges: bytes
expires: Thu, 01 Sep 2022 10:54:12 GMT

GET
H2 200 iframe Show response
accounts.google.com/o/oauth2/ Frame 7247 513 B
924 B 37ms
17ms Document
text/html 2a00:1450:4001:827::200d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/o/oauth2/iframe

Requested by

Host: apis.google.com
URL: https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.UYHeVG_mX5s.O/m=auth2/rt=j/sv=1/d=1/ed=1/am=AQ/rs=AGLTcCPDcESMLF74mIvk5CKxuCjzYIf5XA/cb=gapi.loaded_0

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:827::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

b9357d815ceba3c2888b7c9f0497b9d3c7f70561e02cd046a2e436b49a4450e5

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-z5ZGifl3rG191MrZcIF7Rg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

:method: GET
:authority: accounts.google.com
:scheme: https
:path: /o/oauth2/iframe
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://disqus.com/embed/comments/?base=default&f=itonline&t_i=193371%20https%3A%2F%2Fit-online.co.za%2F%3Fp%3D193371&t_u=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F&t_e=Big%20increase%20in%20MS%20Exchange%20attacks&t_d=Big%20increase%20in%20MS%20Exchange%20attacks&t_t=Big%20increase%20in%20MS%20Exchange%20attacks&s_o=default
accept-encoding: gzip, deflate, br
accept-language: en-US
cookie: NID=222=HE_8LqmR1VDrdBeHvO5ILuZ0EAI6IuBwLdveV9iwWY-V_RNKhf7AQQyzobhRYiTWfHKM6wrfkv56-cePfuGW4Y7AJgxnNOcZgoB_uv7Oj88kM2GcJteofRo_y-I9_4-0YImO-452pL3Dg8gWTf_gEfRJOWBY5-xIUwNOcbEY_rI
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://disqus.com/embed/comments/?base=default&f=itonline&t_i=193371%20https%3A%2F%2Fit-online.co.za%2F%3Fp%3D193371&t_u=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F&t_e=Big%20increase%20in%20MS%20Exchange%20attacks&t_d=Big%20increase%20in%20MS%20Exchange%20attacks&t_t=Big%20increase%20in%20MS%20Exchange%20attacks&s_o=default

Response headers

content-type: text/html; charset=utf-8
cross-origin-resource-policy: cross-origin
cross-origin-embedder-policy: require-corp
cache-control: no-cache, no-store, max-age=0, must-revalidate
pragma: no-cache
expires: Mon, 01 Jan 1990 00:00:00 GMT
date: Thu, 02 Sep 2021 14:33:04 GMT
content-language: en-US
content-security-policy: script-src 'report-sample' 'nonce-z5ZGifl3rG191MrZcIF7Rg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport
content-encoding: gzip
server: ESF
x-xss-protection: 0
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H2 200 4131297854-idpiframe.js Show response
ssl.gstatic.com/accounts/o/ Frame 7247 116 KB
40 KB 7ms
7ms Script
text/javascript 2a00:1450:4001:808::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ssl.gstatic.com/accounts/o/4131297854-idpiframe.js

Requested by

Host: accounts.google.com
URL: https://accounts.google.com/o/oauth2/iframe

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:808::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3f078a6a996e6a1628c6ddaece1d440c38441c4fd3051beb5a4948ff44421032

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://accounts.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Wed, 01 Sep 2021 14:33:54 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 86350
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/federated-signon-mpm-access
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 40499
x-xss-protection: 0
last-modified: Fri, 20 Aug 2021 20:31:40 GMT
server: sffe
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Thu, 01 Sep 2022 14:33:54 GMT

GET
H3-29 200 iframerpc Show response
accounts.google.com/o/oauth2/ Frame 7247 14 B
58 B 33ms
18ms XHR
application/json 2a00:1450:4001:827::200d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://accounts.google.com/o/oauth2/iframerpc?action=checkOrigin&origin=https%3A%2F%2Fdisqus.com&client_id=508198334196-bgmagrg0a2rub674g0shidj8fnd50dji.apps.googleusercontent.com

Requested by

Host: ssl.gstatic.com
URL: https://ssl.gstatic.com/accounts/o/4131297854-idpiframe.js

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:827::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

8daf09a6fc31937457dd77e9c25ce4b21349d605b561a8c5d557841bf964c9a0

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://accounts.google.com/o/oauth2/iframe
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
X-Requested-With: XmlHttpRequest

Response headers

date: Thu, 02 Sep 2021 14:33:04 GMT
content-encoding: gzip
x-content-type-options: nosniff
server: ESF
content-type: application/json; charset=utf-8
cache-control: public, max-age=3600
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection: 0
expires: Thu, 02 Sep 2021 15:33:04 GMT

GET
H2 200 form-settings Show response
mc.us11.list-manage.com/subscribe/ 2 KB
2 KB 70ms
26ms Script
application/json 23.45.110.243
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://mc.us11.list-manage.com/subscribe/form-settings?u=166af175bb62dde1788f099c0&id=40f40cba21&u=166af175bb62dde1788f099c0&id=40f40cba21&c=dojo_request_script_callbacks.dojo_request_script0
Requested by: Host: s3.amazonaws.com
URL: https://s3.amazonaws.com/downloads.mailchimp.com/js/signup-forms/popup/embed.js
Protocol: H2
Security: TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server: 23.45.110.243 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a23-45-110-243.deploy.static.akamaitechnologies.com
Software: openresty /
Resource Hash: 59d4e54a0d3a090c7c82d5b2efffc7bc9f706ccc2f9ea855d0d447d88a3cc94a

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 02 Sep 2021 14:33:04 GMT
content-encoding: gzip
referrer-policy: same-origin
server: openresty
vary: Accept-Encoding
content-type: application/json; charset=utf-8
expires: Thu, 02 Sep 2021 14:37:39 GMT
cache-control: max-age=275
content-length: 847
x-ua-compatible: IE=edge,chrome=1

GET
H2 200 asyncspc.php Show response
itomedia.co.za/www/delivery/ 8 KB
2 KB 42ms
42ms XHR
application/json 178.62.18.215
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL: https://itomedia.co.za/www/delivery/asyncspc.php?zones=14%7C76%7C70%7C16%7C37%7C75%7C78%7C38%7C15&prefix=revive-0-&loc=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F
Requested by: Host: itomedia.co.za
URL: https://itomedia.co.za/www/delivery/asyncjs.php
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 178.62.18.215 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: it-online.co.za
Software: nginx / PHP/7.4.16, PleskLin
Resource Hash: 5d1881aa7ba60eb52b1155d62b796e1df1fab70e19ec6e34136640b721861536

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Sep 2021 14:33:04 GMT
content-encoding: br
server: nginx
x-powered-by: PHP/7.4.16, PleskLin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: https://it-online.co.za
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
content-type: application/json
expires: 0

GET
H2 200 IT-Online-Logo.png
it-online.co.za/wp-content/uploads/2017/12/ 8 KB
8 KB 48ms
47ms Image
image/png 178.62.18.215
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://it-online.co.za/wp-content/uploads/2017/12/IT-Online-Logo.png
Requested by: Host: c0.wp.com
URL: https://c0.wp.com/c/5.8/wp-includes/js/jquery/jquery.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 178.62.18.215 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: it-online.co.za
Software: nginx / PleskLin
Resource Hash: 8d20d85cb8769b23e5f0d2db865b04c8371893d66a2e6fec4777cf04e2c701e0

Request headers

:path: /wp-content/uploads/2017/12/IT-Online-Logo.png
pragma: no-cache
cookie: __utma=13674991.2025301754.1630593184.1630593184.1630593184.1; __utmc=13674991; __utmz=13674991.1630593184.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmt=1; __utmb=13674991.1.10.1630593184
accept-encoding: gzip, deflate, br
accept-language: en-US
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
sec-fetch-mode: no-cors
accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
cache-control: no-cache
sec-fetch-dest: image
:authority: it-online.co.za
referer: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/
:scheme: https
sec-fetch-site: same-origin
:method: GET
Referer: https://it-online.co.za/2021/09/02/big-increase-in-ms-exchange-attacks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 02 Sep 2021 14:33:04 GMT
last-modified: Tue, 19 Dec 2017 12:41:53 GMT
server: nginx
x-powered-by: PleskLin
etag: "5a390911-1e0e"
x-cache-status: BYPASS
content-type: image/png
accept-ranges: bytes
content-length: 7694

GET
H/1.1 200
OK / Show response
glitter.services.disqus.com/urls/ Frame 15F5 438 B
752 B 122ms
122ms Script
application/javascript 151.101.12.64
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL

https://glitter.services.disqus.com/urls/?callback=dsqGlitterResponseHandler&forum_shortname=itonline&thread_id=8752342680&referer=

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.12.64 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

openresty /

Resource Hash

df133f7a03079e65439b5f58500a55f4a0b5ffa68f14a167f956dfff01597936

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=itonline&t_i=193371%20https%3A%2F%2Fit-online.co.za%2F%3Fp%3D193371&t_u=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F&t_e=Big%20increase%20in%20MS%20Exchange%20attacks&t_d=Big%20increase%20in%20MS%20Exchange%20attacks&t_t=Big%20increase%20in%20MS%20Exchange%20attacks&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Thu, 02 Sep 2021 14:33:04 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Server: openresty
X-Frame-Options: DENY
Connection: keep-alive
Content-Type: application/javascript
Cache-Control: no-cache
transfer-encoding: chunked
X-Service: glitter
Content-Disposition: attachment; filename=f.txt
Strict-Transport-Security: max-age=300; includeSubdomains
Vary: Accept-Encoding, Cookie

GET
H2 200 noavatar92.png
a.disquscdn.com/1624570071/images/ Frame 15F5 2 KB
2 KB 22ms
22ms Image
image/png 151.101.14.49
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://a.disquscdn.com/1624570071/images/noavatar92.png

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/lounge.bundle.4ea55ec26f05a70c324c6f3143e00d48.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

151.101.14.49 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

36ef66124133ca33c8b44c487293c3180e5ab681ff3cad3c728ea4f894ec3444

Security Headers

Name	Value
Strict-Transport-Security	max-age=300; includeSubdomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=itonline&t_i=193371%20https%3A%2F%2Fit-online.co.za%2F%3Fp%3D193371&t_u=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F&t_e=Big%20increase%20in%20MS%20Exchange%20attacks&t_d=Big%20increase%20in%20MS%20Exchange%20attacks&t_t=Big%20increase%20in%20MS%20Exchange%20attacks&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 02 Sep 2021 14:33:04 GMT
x-content-type-options: nosniff
last-modified: Fri, 26 Feb 2021 20:50:09 GMT
server: nginx
age: 2343679
etag: "60395f01-66c"
strict-transport-security: max-age=300; includeSubdomains
p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
x-xss-protection: 1; mode=block
cache-control: max-age=2592000
x-amz-cf-pop: FRA2-C2
content-type: image/png
content-length: 1644
x-amz-cf-id: PbMVeM2iWmudwIaI31RBJmSVugFre_LpJLL2G4ilL6tNFDLra-hEMw==
expires: Fri, 06 Aug 2021 11:31:45 GMT

GET
H2 200 ebb7ec903d60024b15a89a725aac97cd.jpg
itomedia.co.za/www/images/ 28 KB
29 KB 67ms
64ms Image
image/jpeg 178.62.18.215
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://itomedia.co.za/www/images/ebb7ec903d60024b15a89a725aac97cd.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 178.62.18.215 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: it-online.co.za
Software: nginx / PleskLin
Resource Hash: fe0c29d2379b85b1b89ea9a5ad374a68a69fe159834be3ff1f4184e511eb7a7f

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 02 Sep 2021 14:33:04 GMT
last-modified: Fri, 30 Jul 2021 11:17:35 GMT
server: nginx
x-powered-by: PleskLin
etag: "6103dfcf-717b"
content-type: image/jpeg
accept-ranges: bytes
content-length: 29051

GET
H2 200 lg.php
itomedia.co.za/www/delivery/ 43 B
355 B 130ms
127ms Image
image/gif 178.62.18.215
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://itomedia.co.za/www/delivery/lg.php?bannerid=397&campaignid=84&zoneid=14&loc=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F&cb=5baee1455f
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 178.62.18.215 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: it-online.co.za
Software: nginx / PHP/7.4.16, PleskLin
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Sep 2021 14:33:04 GMT
server: nginx
x-powered-by: PHP/7.4.16, PleskLin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
expires: 0

GET
H2 200 e2428e32a9c4004313c4e9071675c079.png
itomedia.co.za/www/images/ 83 KB
83 KB 128ms
125ms Image
image/png 178.62.18.215
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://itomedia.co.za/www/images/e2428e32a9c4004313c4e9071675c079.png
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 178.62.18.215 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: it-online.co.za
Software: nginx / PleskLin
Resource Hash: 53605514d5bf27427b6808545d1eb31cf58c4a1243979699e708c0bf68836134

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 02 Sep 2021 14:33:04 GMT
last-modified: Mon, 02 Aug 2021 09:45:20 GMT
server: nginx
x-powered-by: PleskLin
etag: "6107beb0-14c4f"
content-type: image/png
accept-ranges: bytes
content-length: 85071

GET
H2 200 lg.php
itomedia.co.za/www/delivery/ 43 B
355 B 130ms
127ms Image
image/gif 178.62.18.215
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://itomedia.co.za/www/delivery/lg.php?bannerid=389&campaignid=102&zoneid=76&loc=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F&cb=9db0d52b88
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 178.62.18.215 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: it-online.co.za
Software: nginx / PHP/7.4.16, PleskLin
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Sep 2021 14:33:04 GMT
server: nginx
x-powered-by: PHP/7.4.16, PleskLin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
expires: 0

GET
H2 200 479c9ac25133b944cc43718c99775b59.jpg
itomedia.co.za/www/images/ 48 KB
48 KB 97ms
94ms Image
image/jpeg 178.62.18.215
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://itomedia.co.za/www/images/479c9ac25133b944cc43718c99775b59.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 178.62.18.215 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: it-online.co.za
Software: nginx / PleskLin
Resource Hash: acf19c2e386bf23024ecd98e6df8b0d5c73ea5803c724b426a83684f79c34c38

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 02 Sep 2021 14:33:04 GMT
last-modified: Mon, 23 Aug 2021 13:52:36 GMT
server: nginx
x-powered-by: PleskLin
etag: "6123a824-befd"
content-type: image/jpeg
accept-ranges: bytes
content-length: 48893

GET
H2 200 lg.php
itomedia.co.za/www/delivery/ 43 B
355 B 130ms
127ms Image
image/gif 178.62.18.215
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://itomedia.co.za/www/delivery/lg.php?bannerid=401&campaignid=84&zoneid=70&loc=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F&cb=44bdde5fd8
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 178.62.18.215 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: it-online.co.za
Software: nginx / PHP/7.4.16, PleskLin
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Sep 2021 14:33:04 GMT
server: nginx
x-powered-by: PHP/7.4.16, PleskLin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
expires: 0

GET
H2 200 1007045a81232c9b41070e09cbe06259.jpg
itomedia.co.za/www/images/ 48 KB
48 KB 127ms
126ms Image
image/jpeg 178.62.18.215
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://itomedia.co.za/www/images/1007045a81232c9b41070e09cbe06259.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 178.62.18.215 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: it-online.co.za
Software: nginx / PleskLin
Resource Hash: 80977b01bde79e6b8a83f0f303cf23eb6bc7cdaf6e32773237a260d51ab92e10

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 02 Sep 2021 14:33:04 GMT
last-modified: Thu, 02 Sep 2021 10:34:19 GMT
server: nginx
x-powered-by: PleskLin
etag: "6130a8ab-be91"
content-type: image/jpeg
accept-ranges: bytes
content-length: 48785

GET
H2 200 lg.php
itomedia.co.za/www/delivery/ 43 B
355 B 192ms
190ms Image
image/gif 178.62.18.215
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://itomedia.co.za/www/delivery/lg.php?bannerid=402&campaignid=108&zoneid=16&loc=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F&cb=bbbeba1a22
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 178.62.18.215 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: it-online.co.za
Software: nginx / PHP/7.4.16, PleskLin
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Sep 2021 14:33:04 GMT
server: nginx
x-powered-by: PHP/7.4.16, PleskLin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
expires: 0

GET
H2 200 2d0a6cef600100754ba31a8a67d5705e.gif
itomedia.co.za/www/images/ 150 KB
150 KB 163ms
162ms Image
image/gif 178.62.18.215
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://itomedia.co.za/www/images/2d0a6cef600100754ba31a8a67d5705e.gif
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 178.62.18.215 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: it-online.co.za
Software: nginx / PleskLin
Resource Hash: 6796c892c3f575df952721c4ad31168933b27839c01315c1c75f9dec5d72f379

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 02 Sep 2021 14:33:04 GMT
last-modified: Thu, 17 Jun 2021 12:50:53 GMT
server: nginx
x-powered-by: PleskLin
etag: "60cb452d-25780"
content-type: image/gif
accept-ranges: bytes
content-length: 153472

GET
H2 200 lg.php
itomedia.co.za/www/delivery/ 43 B
355 B 194ms
193ms Image
image/gif 178.62.18.215
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://itomedia.co.za/www/delivery/lg.php?bannerid=298&campaignid=28&zoneid=37&loc=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F&cb=2cc4d5a78f
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 178.62.18.215 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: it-online.co.za
Software: nginx / PHP/7.4.16, PleskLin
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Sep 2021 14:33:04 GMT
server: nginx
x-powered-by: PHP/7.4.16, PleskLin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
expires: 0

GET
H2 200 e5930feec42758f97656a95fdbf761c3.jpg
itomedia.co.za/www/images/ 45 KB
45 KB 157ms
156ms Image
image/jpeg 178.62.18.215
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://itomedia.co.za/www/images/e5930feec42758f97656a95fdbf761c3.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 178.62.18.215 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: it-online.co.za
Software: nginx / PleskLin
Resource Hash: 83d4ecb58c324c6aaa7afd3ffeab4ad352348627a24302789721377e39ed636d

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 02 Sep 2021 14:33:04 GMT
last-modified: Mon, 14 Jun 2021 10:59:10 GMT
server: nginx
x-powered-by: PleskLin
etag: "60c7367e-b4a4"
content-type: image/jpeg
accept-ranges: bytes
content-length: 46244

GET
H2 200 lg.php
itomedia.co.za/www/delivery/ 43 B
355 B 191ms
190ms Image
image/gif 178.62.18.215
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://itomedia.co.za/www/delivery/lg.php?bannerid=299&campaignid=90&zoneid=75&loc=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F&cb=6fb79e0c11
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 178.62.18.215 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: it-online.co.za
Software: nginx / PHP/7.4.16, PleskLin
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Sep 2021 14:33:04 GMT
server: nginx
x-powered-by: PHP/7.4.16, PleskLin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
expires: 0

GET
H2 200 6d8ae0cd45be282e592be8cba419678a.jpg
itomedia.co.za/www/images/ 39 KB
39 KB 192ms
191ms Image
image/jpeg 178.62.18.215
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://itomedia.co.za/www/images/6d8ae0cd45be282e592be8cba419678a.jpg
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 178.62.18.215 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: it-online.co.za
Software: nginx / PleskLin
Resource Hash: bd87419ca21763de7be5bfd0442874f362b435633a01bc07baa0bee3d13fc64f

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 02 Sep 2021 14:33:04 GMT
last-modified: Fri, 30 Jul 2021 11:14:56 GMT
server: nginx
x-powered-by: PleskLin
etag: "6103df30-9ba9"
content-type: image/jpeg
accept-ranges: bytes
content-length: 39849

GET
H2 200 lg.php
itomedia.co.za/www/delivery/ 43 B
355 B 191ms
190ms Image
image/gif 178.62.18.215
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://itomedia.co.za/www/delivery/lg.php?bannerid=395&campaignid=107&zoneid=78&loc=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F&cb=420fd571ee
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 178.62.18.215 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: it-online.co.za
Software: nginx / PHP/7.4.16, PleskLin
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Sep 2021 14:33:04 GMT
server: nginx
x-powered-by: PHP/7.4.16, PleskLin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
expires: 0

GET
H2 200 5fe417318288f4f1663b8a1acb61c066.gif
itomedia.co.za/www/images/ 69 KB
69 KB 38ms
35ms Image
image/gif 178.62.18.215
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://itomedia.co.za/www/images/5fe417318288f4f1663b8a1acb61c066.gif
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 178.62.18.215 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: it-online.co.za
Software: nginx / PleskLin
Resource Hash: fb35ceea0987d92d581680ed9c0c621697230ba356cfa5bfb9d27c7b8787cb48

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 02 Sep 2021 14:33:05 GMT
last-modified: Mon, 14 Jun 2021 10:55:07 GMT
server: nginx
x-powered-by: PleskLin
etag: "60c7358b-113d1"
content-type: image/gif
accept-ranges: bytes
content-length: 70609

GET
H2 200 lg.php
itomedia.co.za/www/delivery/ 43 B
355 B 193ms
192ms Image
image/gif 178.62.18.215
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://itomedia.co.za/www/delivery/lg.php?bannerid=303&campaignid=32&zoneid=38&loc=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F&cb=07728e611c
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 178.62.18.215 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: it-online.co.za
Software: nginx / PHP/7.4.16, PleskLin
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Sep 2021 14:33:04 GMT
server: nginx
x-powered-by: PHP/7.4.16, PleskLin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
expires: 0

GET
H2 200 cf4bc28dbe8b80bba6e32c9e80dbf1c6.gif
itomedia.co.za/www/images/ 245 KB
246 KB 39ms
37ms Image
image/gif 178.62.18.215
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://itomedia.co.za/www/images/cf4bc28dbe8b80bba6e32c9e80dbf1c6.gif
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 178.62.18.215 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: it-online.co.za
Software: nginx / PleskLin
Resource Hash: e42bb566917ffec07e020aa058eaf9fee08c0b428416f5f56ef8c0d901cb0ba1

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

date: Thu, 02 Sep 2021 14:33:05 GMT
last-modified: Mon, 16 Aug 2021 13:56:32 GMT
server: nginx
x-powered-by: PleskLin
etag: "611a6e90-3d5ea"
content-type: image/gif
accept-ranges: bytes
content-length: 251370

GET
H2 200 lg.php
itomedia.co.za/www/delivery/ 43 B
355 B 193ms
193ms Image
image/gif 178.62.18.215
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://itomedia.co.za/www/delivery/lg.php?bannerid=399&campaignid=6&zoneid=15&loc=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F&cb=e6dbc69ff0
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, CHACHA20_POLY1305
Server: 178.62.18.215 London, United Kingdom, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS: it-online.co.za
Software: nginx / PHP/7.4.16, PleskLin
Resource Hash: 4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Sep 2021 14:33:04 GMT
server: nginx
x-powered-by: PHP/7.4.16, PleskLin
p3p: CP="CUR ADM OUR NOR STA NID"
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
content-type: image/gif
expires: 0

GET
H/1.1 200
OK popup.js Show response
downloads.mailchimp.com/js/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/ 100 KB
31 KB 25ms
25ms Script
application/javascript 13.32.121.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://downloads.mailchimp.com/js/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/popup.js
Requested by: Host: s3.amazonaws.com
URL: https://s3.amazonaws.com/downloads.mailchimp.com/js/signup-forms/popup/embed.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-38.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 650e65709312c691110957b8a8cc1609ac7b5685f265e1e06f389d271da4fedf

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Thu, 02 Sep 2021 14:32:29 GMT
Content-Encoding: gzip
Last-Modified: Fri, 22 May 2020 15:07:49 GMT
Server: AmazonS3
Age: 58
ETag: W/"9e882a863f24e02737da75af35a34ee6"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: application/javascript
Via: 1.1 df3b3b9f4fa0f79195c56a91cf242364.cloudfront.net (CloudFront)
Connection: keep-alive
Transfer-Encoding: chunked
X-Amz-Cf-Pop: FRA60-P1
X-Amz-Cf-Id: OJmiobTezEpCeCJVu9xu7XAUu3Zxgl3Y0xhllvA8BD9o1HajZmP1Jg==

GET
H/1.1 200
OK common.css
downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/ Frame 4C41 9 KB
3 KB 42ms
42ms Stylesheet
text/css 13.32.121.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/common.css
Requested by: Host: downloads.mailchimp.com
URL: https://downloads.mailchimp.com/js/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/popup.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-38.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4c69c701fd3700fca10f8e6180c9f60f9af13c943ee7f1513f4b7709d8b75d72

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Thu, 02 Sep 2021 14:33:04 GMT
Content-Encoding: gzip
Last-Modified: Fri, 22 May 2020 15:07:51 GMT
Server: AmazonS3
X-Amz-Cf-Pop: FRA60-P1
ETag: W/"82e72d627b04e1654282023cca1d1e69"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: text/css
Via: 1.1 df3b3b9f4fa0f79195c56a91cf242364.cloudfront.net (CloudFront)
Transfer-Encoding: chunked
Connection: keep-alive
X-Amz-Cf-Id: 3vcb6KpHSmILGA-GnYy0vA8FvMu7n9hLswBeXzTJpKVURywoA7LCZw==

GET
H/1.1 200
OK banner.css
downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/ Frame 4C41 1005 B
938 B 20ms
19ms Stylesheet
text/css 13.32.121.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/banner.css
Requested by: Host: downloads.mailchimp.com
URL: https://downloads.mailchimp.com/js/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/popup.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-38.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: bece213397fe5f546674ee29dd3f69ec2f2cc0e480e67f09dcc4c25c0d12a3d7

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Thu, 02 Sep 2021 14:32:17 GMT
Content-Encoding: gzip
Last-Modified: Fri, 22 May 2020 15:07:52 GMT
Server: AmazonS3
Age: 48
ETag: W/"78d1bdd981816cfbeb6954a85f9efa58"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: text/css
Via: 1.1 5fa65194b963365c20fbd28444032cfc.cloudfront.net (CloudFront)
Connection: keep-alive
Transfer-Encoding: chunked
X-Amz-Cf-Pop: FRA60-P1
X-Amz-Cf-Id: 00jfPNic4f6M0liXxsrSJcwmmmIGSIoit9jRMsRvFF4s0Jp9dKovqA==

GET
H/1.1 200
OK common.css
downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/ Frame 8C3B 9 KB
3 KB 22ms
21ms Stylesheet
text/css 13.32.121.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/common.css
Requested by: Host: downloads.mailchimp.com
URL: https://downloads.mailchimp.com/js/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/popup.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-38.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 4c69c701fd3700fca10f8e6180c9f60f9af13c943ee7f1513f4b7709d8b75d72

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Thu, 02 Sep 2021 14:32:40 GMT
Content-Encoding: gzip
Last-Modified: Fri, 22 May 2020 15:07:51 GMT
Server: AmazonS3
Age: 34
ETag: W/"82e72d627b04e1654282023cca1d1e69"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: text/css
Via: 1.1 8c08c39035033b8c904aa0e3f734d6c7.cloudfront.net (CloudFront)
Connection: keep-alive
Transfer-Encoding: chunked
X-Amz-Cf-Pop: FRA60-P1
X-Amz-Cf-Id: D0UX_QkwlnDZKe94kB6OUZ9ckhJ17eV8DATb7QonBY0JgIqzXh6fIA==

GET
H/1.1 200
OK layout-1.css
downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/ Frame 8C3B 804 B
1 KB 20ms
20ms Stylesheet
text/css 13.32.121.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/layout-1.css
Requested by: Host: downloads.mailchimp.com
URL: https://downloads.mailchimp.com/js/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/popup.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-38.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 60defd0229880a6f78696fcf8e687f94e43fc8bb5ff66028e23e546d0345d2f1

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Thu, 02 Sep 2021 14:32:31 GMT
Via: 1.1 d954dd318e06aa0e69375f36dcd819de.cloudfront.net (CloudFront)
Last-Modified: Fri, 22 May 2020 15:07:51 GMT
Server: AmazonS3
Age: 74
ETag: "33e182d2957d66f0239c291b39120c17"
X-Cache: Hit from cloudfront
Content-Type: text/css
Connection: keep-alive
X-Amz-Cf-Pop: FRA60-P1
Accept-Ranges: bytes
Content-Length: 804
X-Amz-Cf-Id: V9pu2iMwCy8iQDIu-j9ouAxdU2nmOFWGWLDqlijFHn9eenBImwVzVA==

GET
H/1.1 200
OK modal.css
downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/ 3 KB
1 KB 21ms
20ms Stylesheet
text/css 13.32.121.38
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://downloads.mailchimp.com/css/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/modal.css
Requested by: Host: downloads.mailchimp.com
URL: https://downloads.mailchimp.com/js/signup-forms/popup/56e7ecd72519300e38d4c8e42744c00035f2bf09/popup.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.38 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-38.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: edc2fb6603f1299fb85244d8a40ec6fbf764d3a7cf74e50e6b66e2df487ace61

Request headers

Referer: https://it-online.co.za/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Thu, 02 Sep 2021 14:33:02 GMT
Content-Encoding: gzip
Last-Modified: Fri, 22 May 2020 15:07:52 GMT
Server: AmazonS3
Age: 20
ETag: W/"4cb20646e6160144096c6e61f322a18b"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Content-Type: text/css
Via: 1.1 75a13c74495137fb5435dc4030981df7.cloudfront.net (CloudFront)
Connection: keep-alive
Transfer-Encoding: chunked
X-Amz-Cf-Pop: FRA60-P1
X-Amz-Cf-Id: 1idB8w31iCGH0xn3m6fM_OtIli-b6p5rge0Lwuk-UILci_183-M0Dg==

GET
H/1.1 200
OK event.gif
referrer.disqus.com/juggler/ Frame 15F5 43 B
295 B 122ms
120ms Image
image/gif 199.232.196.134
FASTLY

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://referrer.disqus.com/juggler/event.gif?abe=0&embed_hidden=0&integration=wordpress%203.0.22&load_time=646&event=init_embed&thread=8752342680&forum=itonline&forum_id=818083&imp=g7to88255vhvl&prev_imp&thread_slug=big_increase_in_ms_exchange_attacks&user_type=anon&referrer=https%3A%2F%2Fit-online.co.za%2F&theme=next&dnt=0&tracking_enabled=1&experiment=network_default_hidden&variant=fallthrough&service=dynamic&promoted_enabled=false&max_enabled=false

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

199.232.196.134 , United States, ASN54113 (FASTLY, US),

Reverse DNS

Software

nginx /

Resource Hash

cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=itonline&t_i=193371%20https%3A%2F%2Fit-online.co.za%2F%3Fp%3D193371&t_u=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F&t_e=Big%20increase%20in%20MS%20Exchange%20attacks&t_d=Big%20increase%20in%20MS%20Exchange%20attacks&t_t=Big%20increase%20in%20MS%20Exchange%20attacks&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Thu, 02 Sep 2021 14:33:05 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Server: nginx
Content-Type: image/gif
Connection: keep-alive
Content-Length: 43
X-XSS-Protection: 1; mode=block

GET
H2 200 pixel.html Show response
live.rezync.com/ Frame 6586 507 B
1 KB 604ms
540ms Document
text/html 13.32.121.8
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://live.rezync.com/pixel.html?c=4656c20ee35215f78e9273796625d90b&cid=cg7toam2n7k298&pctry=CH&referrer=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F
Requested by: Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.121.8 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-121-8.fra60.r.cloudfront.net
Software: lighttpd/1.4.33 /
Resource Hash: d5424247e7a3d9e91695658c88cafcd45784aa9b16e42aaeb466485b76266b09

Request headers

:method: GET
:authority: live.rezync.com
:scheme: https
:path: /pixel.html?c=4656c20ee35215f78e9273796625d90b&cid=cg7toam2n7k298&pctry=CH&referrer=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://disqus.com/embed/comments/?base=default&f=itonline&t_i=193371%20https%3A%2F%2Fit-online.co.za%2F%3Fp%3D193371&t_u=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F&t_e=Big%20increase%20in%20MS%20Exchange%20attacks&t_d=Big%20increase%20in%20MS%20Exchange%20attacks&t_t=Big%20increase%20in%20MS%20Exchange%20attacks&s_o=default
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://disqus.com/embed/comments/?base=default&f=itonline&t_i=193371%20https%3A%2F%2Fit-online.co.za%2F%3Fp%3D193371&t_u=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F&t_e=Big%20increase%20in%20MS%20Exchange%20attacks&t_d=Big%20increase%20in%20MS%20Exchange%20attacks&t_t=Big%20increase%20in%20MS%20Exchange%20attacks&s_o=default

Response headers

content-type: text/html; charset=utf-8
content-length: 507
date: Thu, 02 Sep 2021 14:33:05 GMT
server: lighttpd/1.4.33
set-cookie: zync-uuid=3a434759-b2b0-4b13-bb4a-9297dd033bf0:1630593185.35; Domain=rezync.com; Expires=Tue, 01-Mar-2022 07:33:05 GMT; Path=/; SameSite=None; Secure sd-session-id=eyJfcGVybWFuZW50Ijp0cnVlLCJjbGllbnRzIjp7ImRpc3F1cyI6ImNnN3RvYW0ybjdrMjk4In0sInNlc3Npb25faWQiOnsiIGIiOiJNMkUwTXpRM05Ua3RZakppTUMwMFlqRXpMV0ppTkdFdE9USTVOMlJrTURNelltWXdPakUyTXpBMU9UTXhPRFV1TXpVPSJ9fQ.FBJyIQ.zUAIruwpUya5Ia3lXKvtzP6jWYc; Expires=Tue, 27-Sep-2022 14:33:05 GMT; HttpOnly; Path=/; SameSite=None; Secure
x-cache: Miss from cloudfront
via: 1.1 490f651effcacfa7d80143d3047d794e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA60-P1
x-amz-cf-id: IZzXROlqFXXgSW-iH3G5Bd-VRCK7ZMjc7EnSlK7tln8QsJzi1kmlnA==

GET
H2

200

pixel
fcmatch.youtube.com/ Frame 1328
Redirect Chain

https://ejp.rlcdn.com/501709.html
https://ejp.rlcdn.com/1000.gif?memo=CM3PHhoNCKHBw4kGEgUI6AcQAEIASgA
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwM1Z5S3RERzhjTHZob2pFUHR0NWF1TGVqdF82Y3FEcDBNSGlRRXZFc0kxYw==&google_cm&gdpr=1&gdpr_consent=CPLPDEMPLPDN_ADABCENBoCsAP_AAH_AA...
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwM1Z5S3RERzhjTHZob2pFUHR0NWF1TGVqdF82Y3FEcDBNSGlRRXZFc0kxYw==&google_cm=&gdpr=1&gdpr_consent=CPLPDEMPLPDN_ADABCENBoCsAP_AAH_A...
https://fcmatch.google.com/pixel?google_gm=AMnCDoroSy3RyTw-n137rCTq4U9hsL6hLGgXid16c7s6kb0l_CbrcjqjuxpmKBAYHXC65RUYQqUkWiBMQUhlgGNxNsSY6b5bON7nJ0Hw5ismno7Dsn9XJgsfsil7fqEco4CVpjNb5XMhbbXh44A1ot5Qhv...
https://fcmatch.youtube.com/pixel?google_gm=AMnCDoroSy3RyTw-n137rCTq4U9hsL6hLGgXid16c7s6kb0l_CbrcjqjuxpmKBAYHXC65RUYQqUkWiBMQUhlgGNxNsSY6b5bON7nJ0Hw5ismno7Dsn9XJgsfsil7fqEco4CVpjNb5XMhbbXh44A1ot5Qh...

0
0

15ms
14ms

Document
image/png

2a00:1450:4001:802::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fcmatch.youtube.com/pixel?google_gm=AMnCDoroSy3RyTw-n137rCTq4U9hsL6hLGgXid16c7s6kb0l_CbrcjqjuxpmKBAYHXC65RUYQqUkWiBMQUhlgGNxNsSY6b5bON7nJ0Hw5ismno7Dsn9XJgsfsil7fqEco4CVpjNb5XMhbbXh44A1ot5Qhv2FwBzaOA

Requested by

Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.ee2555081038338ea4f41cbb3ea1bc17.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

:method: GET
:authority: fcmatch.youtube.com
:scheme: https
:path: /pixel?google_gm=AMnCDoroSy3RyTw-n137rCTq4U9hsL6hLGgXid16c7s6kb0l_CbrcjqjuxpmKBAYHXC65RUYQqUkWiBMQUhlgGNxNsSY6b5bON7nJ0Hw5ismno7Dsn9XJgsfsil7fqEco4CVpjNb5XMhbbXh44A1ot5Qhv2FwBzaOA
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site: cross-site
sec-fetch-mode: navigate
sec-fetch-dest: iframe
referer: https://disqus.com/embed/comments/?base=default&f=itonline&t_i=193371%20https%3A%2F%2Fit-online.co.za%2F%3Fp%3D193371&t_u=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F&t_e=Big%20increase%20in%20MS%20Exchange%20attacks&t_d=Big%20increase%20in%20MS%20Exchange%20attacks&t_t=Big%20increase%20in%20MS%20Exchange%20attacks&s_o=default
accept-encoding: gzip, deflate, br
accept-language: en-US
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36
Referer: https://disqus.com/embed/comments/?base=default&f=itonline&t_i=193371%20https%3A%2F%2Fit-online.co.za%2F%3Fp%3D193371&t_u=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F&t_e=Big%20increase%20in%20MS%20Exchange%20attacks&t_d=Big%20increase%20in%20MS%20Exchange%20attacks&t_t=Big%20increase%20in%20MS%20Exchange%20attacks&s_o=default

Response headers

content-type: image/png
date: Thu, 02 Sep 2021 14:33:05 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
server: HTTP server (unknown)
content-length: 170
x-xss-protection: 0
x-frame-options: SAMEORIGIN
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

Redirect headers

location: https://fcmatch.youtube.com/pixel?google_gm=AMnCDoroSy3RyTw-n137rCTq4U9hsL6hLGgXid16c7s6kb0l_CbrcjqjuxpmKBAYHXC65RUYQqUkWiBMQUhlgGNxNsSY6b5bON7nJ0Hw5ismno7Dsn9XJgsfsil7fqEco4CVpjNb5XMhbbXh44A1ot5Qhv2FwBzaOA
date: Thu, 02 Sep 2021 14:33:05 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
server: HTTP server (unknown)
content-length: 403
x-xss-protection: 0
x-frame-options: SAMEORIGIN
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"

GET
H/1.1

200
OK

/
io.narrative.io/ Frame 15F5
Redirect Chain

https://io.narrative.io/?companyId=19&id=disqus_id%3Acg7toam2n7k298&ret=img&ref=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F
https://io.narrative.io/?io.narrative.guid.v2=af3f3f10-0bfa-11ec-a9a5-06119d0d8b4f&companyId=19&id=disqus_id%3Acg7toam2n7k298&ret=img&ref=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increa...

35 B
319 B

45ms
44ms

Image
image/gif

34.250.127.107
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://io.narrative.io/?io.narrative.guid.v2=af3f3f10-0bfa-11ec-a9a5-06119d0d8b4f&companyId=19&id=disqus_id%3Acg7toam2n7k298&ret=img&ref=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.250.127.107 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-250-127-107.eu-west-1.compute.amazonaws.com
Software: nginx/1.18.0 /
Resource Hash: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Request headers

Referer: https://disqus.com/embed/comments/?base=default&f=itonline&t_i=193371%20https%3A%2F%2Fit-online.co.za%2F%3Fp%3D193371&t_u=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F&t_e=Big%20increase%20in%20MS%20Exchange%20attacks&t_d=Big%20increase%20in%20MS%20Exchange%20attacks&t_t=Big%20increase%20in%20MS%20Exchange%20attacks&s_o=default
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

Date: Thu, 02 Sep 2021 14:33:05 GMT
Cache-Control: no-cache
Server: nginx/1.18.0
Connection: keep-alive
Content-Length: 35
Content-Type: image/gif

Redirect headers

Location: https://io.narrative.io/?io.narrative.guid.v2=af3f3f10-0bfa-11ec-a9a5-06119d0d8b4f&companyId=19&id=disqus_id%3Acg7toam2n7k298&ret=img&ref=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F
Date: Thu, 02 Sep 2021 14:33:05 GMT
Server: nginx/1.18.0
Connection: keep-alive
Content-Length: 0

GET
H3-29

200

pixel
fcmatch.youtube.com/ Frame 6586
Redirect Chain

https://ib.adnxs.com/getuid?https%3A//live.rezync.com/sync%3Fc%3D4656c20ee35215f78e9273796625d90b%26p%3D093016b0419d19c905c78c859b815219%26pid%3D%24UID
https://live.rezync.com/sync?c=4656c20ee35215f78e9273796625d90b&p=093016b0419d19c905c78c859b815219&pid=8754069646064298158
https://p.rfihub.com/cm?pub=39342&in=1&userid=3a434759-b2b0-4b13-bb4a-9297dd033bf0%3A1630593185.35&forward=https%3A//idsync.rlcdn.com/501709.gif%3Fpartner_uid%3Dcg7toam2n7k298
https://idsync.rlcdn.com/501709.gif?partner_uid=cg7toam2n7k298
https://idsync.rlcdn.com/1000.gif?memo=CM3PHhIYChQIARAFGg5jZzd0b2FtMm43azI5OBAAGg0IosHDiQYSBQjoBxAAQgBKAA
https://cm.g.doubleclick.net/pixel?google_nid=liveramp&google_hm=WGMzMDcwdThadGI5SlU3U1hfd2lmUmdPaGtxVElMWVJIMlpCLXZzNUFtREFiYWVvdw==&google_cm&gdpr=1&gdpr_consent=CPLPDEMPLPDN_ADABCENBoCsAP_AAH_AA...
https://fcmatch.google.com/pixel?google_gm=AMnCDopXO6og-Mn1xcBsyDDZGNGRF5GNPKEETBsFIIXKkLUilFOIOBjQDXymuiU7-r-wuEqOKciJAbft0K-Pdh7O9DXkZnEv_fLcNsGqXcDDproDrVTi3hLq4uqAmvpvDhwVrlx_H3HOLLCV5i140E5VGc...
https://fcmatch.youtube.com/pixel?google_gm=AMnCDopXO6og-Mn1xcBsyDDZGNGRF5GNPKEETBsFIIXKkLUilFOIOBjQDXymuiU7-r-wuEqOKciJAbft0K-Pdh7O9DXkZnEv_fLcNsGqXcDDproDrVTi3hLq4uqAmvpvDhwVrlx_H3HOLLCV5i140E5VG...

170 B
189 B

28ms
14ms

Image
image/png

2a00:1450:4001:802::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://fcmatch.youtube.com/pixel?google_gm=AMnCDopXO6og-Mn1xcBsyDDZGNGRF5GNPKEETBsFIIXKkLUilFOIOBjQDXymuiU7-r-wuEqOKciJAbft0K-Pdh7O9DXkZnEv_fLcNsGqXcDDproDrVTi3hLq4uqAmvpvDhwVrlx_H3HOLLCV5i140E5VGcEpY4wZKQ

Requested by

Host: live.rezync.com
URL: https://live.rezync.com/pixel.html?c=4656c20ee35215f78e9273796625d90b&cid=cg7toam2n7k298&pctry=CH&referrer=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F

Protocol

H3-29

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:802::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

HTTP server (unknown) /

Resource Hash

0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5

Security Headers

Name	Value
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

Referer: https://live.rezync.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 02 Sep 2021 14:33:06 GMT
server: HTTP server (unknown)
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 170
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

pragma: no-cache
date: Thu, 02 Sep 2021 14:33:06 GMT
server: HTTP server (unknown)
x-frame-options: SAMEORIGIN
content-type: text/html; charset=UTF-8
location: https://fcmatch.youtube.com/pixel?google_gm=AMnCDopXO6og-Mn1xcBsyDDZGNGRF5GNPKEETBsFIIXKkLUilFOIOBjQDXymuiU7-r-wuEqOKciJAbft0K-Pdh7O9DXkZnEv_fLcNsGqXcDDproDrVTi3hLq4uqAmvpvDhwVrlx_H3HOLLCV5i140E5VGcEpY4wZKQ
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 403
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2

200

362358.gif
idsync.rlcdn.com/ Frame 6586
Redirect Chain

https://p.rfihub.com/cm?pub=39342&in=1&userid=3a434759-b2b0-4b13-bb4a-9297dd033bf0%3A1630593185.35&forward=https%3A//live.rezync.com/sync%3Fc%3D4656c20ee35215f78e9273796625d90b%26p%3D260a954059a0ab...
https://live.rezync.com/sync?c=4656c20ee35215f78e9273796625d90b&p=260a954059a0ab1986e4ee8c5c88c54c&pid=1875819622410663399
https://idsync.rlcdn.com/501709.gif?partner_uid=cg7toam2n7k298
https://cm.g.doubleclick.net/pixel?google_nid=epsilon&google_cm
https://idsync.rlcdn.com/362358.gif?google_gid=CAESEE_JoVPsUASqX1AT2MDSSdY&google_cver=1

42 B
328 B

27ms
27ms

Image
image/gif

35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://idsync.rlcdn.com/362358.gif?google_gid=CAESEE_JoVPsUASqX1AT2MDSSdY&google_cver=1
Requested by: Host: live.rezync.com
URL: https://live.rezync.com/pixel.html?c=4656c20ee35215f78e9273796625d90b&cid=cg7toam2n7k298&pctry=CH&referrer=https%3A%2F%2Fit-online.co.za%2F2021%2F09%2F02%2Fbig-increase-in-ms-exchange-attacks%2F
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer: https://live.rezync.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.159 Safari/537.36

Response headers

timing-allow-origin: *
date: Thu, 02 Sep 2021 14:33:06 GMT
via: 1.1 google
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
cache-control: no-cache, no-store
content-type: image/gif
alt-svc: clear
content-length: 42

Redirect headers

pragma: no-cache
date: Thu, 02 Sep 2021 14:33:06 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://idsync.rlcdn.com/362358.gif?google_gid=CAESEE_JoVPsUASqX1AT2MDSSdY&google_cver=1
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 289
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Verdicts & Comments Add Verdict or Comment

120 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

8 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.google.com/	1970-01-20 01:20:04	Name: NID Value: 222=HE_8LqmR1VDrdBeHvO5ILuZ0EAI6IuBwLdveV9iwWY-V_RNKhf7AQQyzobhRYiTWfHKM6wrfkv56-cePfuGW4Y7AJgxnNOcZgoB_uv7Oj88kM2GcJteofRo_y-I9_4-0YImO-452pL3Dg8gWTf_gEfRJOWBY5-xIUwNOcbEY_rI
.disqus.com/	1970-01-20 05:42:09	Name: disqus_unique Value: g7toam2n7k298
.it-online.co.za/	1970-01-19 20:56:33	Name: __utmt Value: 1
.it-online.co.za/	1970-01-20 01:19:21	Name: __utmz Value: 13674991.1630593184.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none)
.it-online.co.za/	1970-01-19 20:56:34	Name: __utmb Value: 13674991.1.10.1630593184
disqus.com/	1970-01-19 20:56:34	Name: __jid Value: g7to88255vhvl
.it-online.co.za/	1969-12-31 23:59:59	Name: __utmc Value: 13674991
.it-online.co.za/	1970-01-20 14:27:45	Name: __utma Value: 13674991.2025301754.1630593184.1630593184.1630593184.1

1 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://c0.wp.com/c/5.8/wp-includes/js/jquery/jquery-migrate.min.js(Line 2) Message: JQMIGRATE: Migrate is installed, version 3.3.2

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.disquscdn.com
accounts.google.com
apis.google.com
c.disquscdn.com
c0.wp.com
cm.g.doubleclick.net
connect.facebook.net
disqus.com
downloads.mailchimp.com
ejp.rlcdn.com
fcmatch.google.com
fcmatch.youtube.com
fonts.gstatic.com
glitter.services.disqus.com
ib.adnxs.com
idsync.rlcdn.com
io.narrative.io
it-online.co.za
itomedia.co.za
itonline.disqus.com
live.rezync.com
mc.us11.list-manage.com
p.rfihub.com
referrer.disqus.com
s3.amazonaws.com
ssl.google-analytics.com
ssl.gstatic.com
www.facebook.com
13.32.121.38
13.32.121.8
142.250.186.34
151.101.12.64
151.101.14.49
151.101.64.134
178.62.18.215
185.33.220.145
192.0.77.37
193.0.160.128
199.232.196.134
23.45.110.243
2600:9000:2240:2800:6:8656:f5c0:93a1
2a00:1450:4001:802::200e
2a00:1450:4001:808::2003
2a00:1450:4001:808::200e
2a00:1450:4001:827::200d
2a00:1450:4001:831::2008
2a03:2880:f01c:216:face:b00c:0:3
2a03:2880:f11c:8083:face:b00c:0:25de
34.250.127.107
35.244.174.68
52.216.17.211
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
07442f2bc9e417e7e700d142493b5564d926d3b28a365632e87f9e0a1c992b70
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
1259ea99bd76596239bfd3102c679eb0a5052578dc526b0452f4d42f8bcdd45f
143ce443c390db3b8598f951de20bd04623859a581a15b8cde43ebfa1f8ec103
1ca76922f55b389b8f590ae7e3bcc3a2dccdce3aff1e5a4335af081b76a414ea
1e3561dbb5d8983e257c9e8e1782b65364bdd1b4b4c9bdc8fa879cf2ef775a59
2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe
3270642c89180c12db93775e2a774b6dadd9bd98cffc963075c85afd2c17b6e4
3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875
36ef66124133ca33c8b44c487293c3180e5ab681ff3cad3c728ea4f894ec3444
3f078a6a996e6a1628c6ddaece1d440c38441c4fd3051beb5a4948ff44421032
443211c7845e0012dea1dfe8cda1ce659e7fef3c7b5af2b470704ed8186945c0
462747422c6af30aa81a0373fa1cfd736455cef52bdbb816f67be9531d84eace
4c4491dcfa94cb46fb73742fc2caf49a1cd59027304af1830c7dc6ce1889857c
4c69c701fd3700fca10f8e6180c9f60f9af13c943ee7f1513f4b7709d8b75d72
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4e38f27531151dca909c853975eec2d75eef1c65c6a73ff09c94f5c5202f955f
516c7b2926dbd461e33f19ff05db8587e5990184dba657483d5a569cc099a8ee
53605514d5bf27427b6808545d1eb31cf58c4a1243979699e708c0bf68836134
539379f60baa97f505721f54604b7ddcf6d3ce022a37d045db908cc861169bea
54e38c867623da51ba82fe8ea1972e10092891dcc9285166c3c73420f252edf3
556172885a172763c715eace05597d5575ee4d4f2df6b61d723f4666b0a730a9
55a41e316e9f36cc5d6be9ef0684134e4c8b0f756070859d8ba50c0dcb1fded7
56f6ba9d3f7eb3d795c335af2320b0504d48c6d4cc8f0a0ffa27b9249df182ac
59d4e54a0d3a090c7c82d5b2efffc7bc9f706ccc2f9ea855d0d447d88a3cc94a
5aa600aea047cb99c7e2c22e7edaf89f0539a6772a21981636e21da89bed440a
5b1eb7a3036c9d68b03485722bf850a099868a9d54bf0d7c21d539eaabed0a9d
5be614bce53f767993a5f5f14a6badd6aae6bf3af7cbdbf4d31520de49e27991
5d1881aa7ba60eb52b1155d62b796e1df1fab70e19ec6e34136640b721861536
6051b0bcec1920eb2bbe7878c2a34f9b70621bf4d7956479288c7bfce692ace7
60defd0229880a6f78696fcf8e687f94e43fc8bb5ff66028e23e546d0345d2f1
633eb9467ef7ab1782e7e232fc2b59900481eda17aa6fe8d34010bdca84904b8
650e65709312c691110957b8a8cc1609ac7b5685f265e1e06f389d271da4fedf
6796c892c3f575df952721c4ad31168933b27839c01315c1c75f9dec5d72f379
6f8b4042d9fe1bd6743fc4411ce77c0331f6516232c634aca53917c6fd08e602
78fb94633831f81d2123d946f601e167ed01ff60f872411562a0b8c976cf9377
80977b01bde79e6b8a83f0f303cf23eb6bc7cdaf6e32773237a260d51ab92e10
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
83d4ecb58c324c6aaa7afd3ffeab4ad352348627a24302789721377e39ed636d
8d20d85cb8769b23e5f0d2db865b04c8371893d66a2e6fec4777cf04e2c701e0
8daf09a6fc31937457dd77e9c25ce4b21349d605b561a8c5d557841bf964c9a0
9755d460c9a433840b200fbadf27f28d31e29fde5d1e800bfbdf927e0e6e5a18
9c6975c674a7c3077bd95750428313e78b92d370b90ca5a303b627c71d2afcf3
a401b6da1ee92f0137d4e92f68035c35fcf6600bbabdec30fca9a48f7b49fd6b
acf19c2e386bf23024ecd98e6df8b0d5c73ea5803c724b426a83684f79c34c38
ad3d0ca410aa64d933c2853e39ef8b605c4815f9826bc0e721e3d3d93860bf64
b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646
b9357d815ceba3c2888b7c9f0497b9d3c7f70561e02cd046a2e436b49a4450e5
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
bd87419ca21763de7be5bfd0442874f362b435633a01bc07baa0bee3d13fc64f
bece213397fe5f546674ee29dd3f69ec2f2cc0e480e67f09dcc4c25c0d12a3d7
c284dcb06ef882b1b45e11e0a16baa223b4117eca94e243c8e725c4ce3f909b3
cdba739c28b41f39ce438f2bf204fe739dc81a26cf559a9394ceed56a0666bee
cea0a05c5af6e21a409875328ed2e3dba79131b7c41f8ea07d0e0e02c7b7b59e
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
cf7ffb56cda8d58d7a7783e442a5729573c7e5d7098785c9a6cb382f2a772b56
d05525883026126f82533f0a769bf460072de0eb2057a904488ca457cce7656e
d201a2c3118a00c82cc48e89815f5139f23956bbe248107dcf522acc77b97c09
d5424247e7a3d9e91695658c88cafcd45784aa9b16e42aaeb466485b76266b09
df133f7a03079e65439b5f58500a55f4a0b5ffa68f14a167f956dfff01597936
e13952f84be306cc90869e3e26b5667b65073198f666a9af1f68fd4269fa676d
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e42bb566917ffec07e020aa058eaf9fee08c0b428416f5f56ef8c0d901cb0ba1
e8be42019425fc26bcf13b4b96de105ae4317667ae197a353b3b4e55081ebd72
edc2fb6603f1299fb85244d8a40ec6fbf764d3a7cf74e50e6b66e2df487ace61
ee55e4421382118b980a40578e6e0f0210762fe7aa1aaf97bf1a27fd6692bcdb
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f2a341fc815d45c21da726d4c843c2c5d3e1f333465347c3c75d040d556df4e5
f5627ea74eac809576ae16667ed7522b8dff46df48c38d9452dbe2eb208d2eef
fb35ceea0987d92d581680ed9c0c621697230ba356cfa5bfb9d27c7b8787cb48
fe0c29d2379b85b1b89ea9a5ad374a68a69fe159834be3ff1f4184e511eb7a7f

it-online.co.za Open in urlscan Pro 178.62.18.215 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

92 Requests

100 %HTTPS

35 %IPv6

20 Domains

28 Subdomains

21 IPs

5 Countries

1990 kBTransfer

3363 kBSize

8 Cookies

17 Outgoing links

Redirected requests

92 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

it-online.co.za Open in urlscan Pro
178.62.18.215 Public Scan

Screenshot
Live screenshot

Full Image

92
Requests

100 %
HTTPS

35 %
IPv6

20
Domains

28
Subdomains

21
IPs

5
Countries

1990 kB
Transfer

3363 kB
Size

8
Cookies

92 HTTP transactions
1 data transactions