urlscan.io logo urlscan.io
SecurityTrails logo

niiconsulting.com Open in urlscan Pro
166.62.10.188  Public Scan

Go To Rescan Add Verdict Report
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affe...
Submission: On July 23 via api from US — Scanned from DE
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 19 IPs in 5 countries across 12 domains to perform 74 HTTP transactions. The main IP is 166.62.10.188, located in Singapore, Singapore and belongs to AS-26496-GO-DADDY-COM-LLC, US. The main domain is niiconsulting.com.
TLS certificate: Issued by Go Daddy Secure Certificate Authority... on June 29th 2022. Valid for: a year.
This is the only time niiconsulting.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

30    166.62.10.188 (Singapore, Singapore)

ASN26496 (AS-26496-GO-DADDY-COM-LLC, US)
PTR: ip-166-62-10-188.ip.secureserver.net
niiconsulting.com
2    2a00:1450:4001:82a::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    108.157.4.87 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-157-4-87.dus51.r.cloudfront.net
platform-api.sharethis.com
12    192.0.77.2 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: i1.wp.com
i1.wp.com
i0.wp.com
i2.wp.com
8    2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC, US)
secure.gravatar.com
1.gravatar.com
0.gravatar.com
2    192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
stats.wp.com
pixel.wp.com
1    2a00:1450:4001:828::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
1    2600:9000:2156:e200:c:abe:f440:93a1 (United States)

ASN16509 (AMAZON-02, US)
buttons-config.sharethis.com
1    18.196.212.55 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-196-212-55.eu-central-1.compute.amazonaws.com
l.sharethis.com
1    2a00:1450:4001:80e::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
google-analytics.com
1    192.0.78.32 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
jetpack.wordpress.com
1    2a00:1450:4001:812::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google-analytics.com
7    192.0.77.32 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)
PTR: wordpress.com
s0.wp.com
1    2a00:1450:400c:c07::9c (Brussels, Belgium)

ASN15169 (GOOGLE, US)
stats.g.doubleclick.net
1    2a00:1450:4001:803::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
1    2a00:1450:4001:82a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.de
2    2606:2800:234:59:254c:406:2366:268c (United States)

ASN15133 (EDGECAST, US)
platform.twitter.com
1    104.244.42.8 (United States)

ASN13414 (TWITTER, US)
syndication.twitter.com
Apex Domain
Subdomains		 Transfer
30 niiconsulting.com
niiconsulting.com
292 KB
21 wp.com
i1.wp.com — Cisco Umbrella Rank: 6672
i0.wp.com — Cisco Umbrella Rank: 2855
i2.wp.com — Cisco Umbrella Rank: 5973
stats.wp.com — Cisco Umbrella Rank: 2293
s0.wp.com — Cisco Umbrella Rank: 6176
pixel.wp.com — Cisco Umbrella Rank: 2110
136 KB
8 gravatar.com
secure.gravatar.com — Cisco Umbrella Rank: 1482
1.gravatar.com — Cisco Umbrella Rank: 7339
0.gravatar.com — Cisco Umbrella Rank: 7227
21 KB
3 twitter.com
platform.twitter.com — Cisco Umbrella Rank: 668
syndication.twitter.com — Cisco Umbrella Rank: 871
133 KB
3 sharethis.com
platform-api.sharethis.com — Cisco Umbrella Rank: 4818
buttons-config.sharethis.com — Cisco Umbrella Rank: 5665
l.sharethis.com — Cisco Umbrella Rank: 4672
43 KB
2 google-analytics.com
google-analytics.com — Cisco Umbrella Rank: 43
www.google-analytics.com — Cisco Umbrella Rank: 52
20 KB
2 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 72
2 KB
1 google.de
www.google.de — Cisco Umbrella Rank: 5701
501 B
1 google.com
www.google.com — Cisco Umbrella Rank: 10
501 B
1 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 117
443 B
1 wordpress.com
jetpack.wordpress.com — Cisco Umbrella Rank: 11301
8 KB
1 gstatic.com
fonts.gstatic.com
44 KB
74 12
Domain Requested by
30 niiconsulting.com niiconsulting.com
7 s0.wp.com jetpack.wordpress.com
s0.wp.com
5 i1.wp.com niiconsulting.com
4 secure.gravatar.com niiconsulting.com
secure.gravatar.com
4 i0.wp.com niiconsulting.com
3 0.gravatar.com jetpack.wordpress.com
0.gravatar.com
3 i2.wp.com niiconsulting.com
2 platform.twitter.com niiconsulting.com
platform.twitter.com
2 fonts.googleapis.com niiconsulting.com
1 syndication.twitter.com platform.twitter.com
1 pixel.wp.com niiconsulting.com
1 www.google.de niiconsulting.com
1 www.google.com niiconsulting.com
1 stats.g.doubleclick.net google-analytics.com
1 1.gravatar.com jetpack.wordpress.com
1 www.google-analytics.com google-analytics.com
1 jetpack.wordpress.com niiconsulting.com
1 google-analytics.com niiconsulting.com
1 l.sharethis.com platform-api.sharethis.com
1 buttons-config.sharethis.com platform-api.sharethis.com
1 fonts.gstatic.com fonts.googleapis.com
1 stats.wp.com niiconsulting.com
1 platform-api.sharethis.com niiconsulting.com
74 23
Subject Issuer Validity Valid
niiconsulting.com
Go Daddy Secure Certificate Authority - G2		 2022-06-29 -
2023-07-01		 a year crt.sh
upload.video.google.com
GTS CA 1C3		 2022-07-04 -
2022-09-26		 3 months crt.sh
sharethis.com
Amazon		 2022-06-19 -
2023-07-18		 a year crt.sh
*.wp.com
Sectigo RSA Domain Validation Secure Server CA		 2022-06-11 -
2023-07-12		 a year crt.sh
*.gravatar.com
Sectigo RSA Domain Validation Secure Server CA		 2020-08-14 -
2022-11-16		 2 years crt.sh
*.gstatic.com
GTS CA 1C3		 2022-07-04 -
2022-09-26		 3 months crt.sh
*.google-analytics.com
GTS CA 1C3		 2022-07-04 -
2022-09-26		 3 months crt.sh
*.wordpress.com
Sectigo RSA Domain Validation Secure Server CA		 2020-08-12 -
2022-11-14		 2 years crt.sh
*.g.doubleclick.net
GTS CA 1C3		 2022-07-04 -
2022-09-26		 3 months crt.sh
www.google.com
GTS CA 1C3		 2022-07-04 -
2022-09-26		 3 months crt.sh
www.google.de
GTS CA 1C3		 2022-07-04 -
2022-09-26		 3 months crt.sh
*.twimg.com
DigiCert TLS RSA SHA256 2020 CA1		 2021-10-20 -
2022-10-19		 a year crt.sh
syndication.twitter.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1		 2022-03-07 -
2023-03-06		 a year crt.sh

This page contains 3 frames:

Primary Page: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Frame ID: 166915FE51CBFD73ED1BA48D58B235A6
Requests: 69 HTTP requests in this frame

Frame: https://jetpack.wordpress.com/jetpack-comment/?blogid=9704473&postid=4247&comment_registration=0&require_name_email=1&stc_enabled=1&stb_enabled=1&show_avatars=1&avatar_default=mystery&greeting=Leave+a+Comment&greeting_reply=Leave+a+Reply+to+%25s&color_scheme=light&lang=en_US&jetpack_version=8.4.3&show_cookie_consent=10&has_cookie_consent=0&token_key=%3Bnormal%3B&sig=2a3bbe85abe489da41e5444b763962a1d23486b4
Frame ID: C210A48535236F87F0806617428C1BE8
Requests: 12 HTTP requests in this frame

Frame: https://platform.twitter.com/widgets/widget_iframe.dc05643fdb8d0e2b89e5cc3c1d26d1b5.html?origin=https%3A%2F%2Fniiconsulting.com
Frame ID: 534CBB51BE1FFAEFADF5796E429EC62F
Requests: 2 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Threat actor groups are targeting VMware Horizon servers running versions affected by Log4Shell vulnerabilities - Checkmate

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • <!-- This site is optimized with the Yoast (?:WordPress )?SEO plugin v([\d.]+) -
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+(?:([\d.]+)/)?(?:css/)?font-awesome(?:\.min)?\.css
  • <link[^>]* href=[^>]*?(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
Overall confidence: 100%
Detected patterns
  • <link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com
Overall confidence: 100%
Detected patterns
  • ([\d.]+)?/modernizr(?:\.([\d.]+))?.*\.js
Overall confidence: 100%
Detected patterns
  • //platform\.twitter\.com/widgets\.js
Overall confidence: 100%
Detected patterns
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?
Overall confidence: 100%
Detected patterns
  • jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

74
Requests

100 %
HTTPS

56 %
IPv6

12
Domains

23
Subdomains

19
IPs

5
Countries

702 kB
Transfer

2076 kB
Size

4
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

74 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/ 		137 KB
36 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
166.62.10.188 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-10-188.ip.secureserver.net
Software
Apache / PHP/5.6.40
Resource Hash
6b50c38c85106ae73f87baf91c0daff52edb51447fcd4bf45e216bf59701360d

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

cache-control
max-age=2592000
content-encoding
br
content-length
36690
content-type
text/html; charset=UTF-8
date
Sat, 23 Jul 2022 14:21:23 GMT
expires
Mon, 22 Aug 2022 14:21:23 GMT
link
<https://niiconsulting.com/checkmate/wp-json/>; rel="https://api.w.org/", <https://niiconsulting.com/checkmate/wp-json/wp/v2/posts/4247>; rel="alternate"; type="application/json", <https://wp.me/pEIzL-16v>; rel=shortlink
server
Apache
vary
Accept-Encoding,User-Agent
x-pingback
https://niiconsulting.com/checkmate/xmlrpc.php
x-powered-by
PHP/5.6.40
style.min.css
niiconsulting.com/checkmate/wp-includes/css/dist/block-library/ 		81 KB
10 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://niiconsulting.com/checkmate/wp-includes/css/dist/block-library/style.min.css?ver=5.9.3
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
166.62.10.188 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-10-188.ip.secureserver.net
Software
Apache /
Resource Hash
cdbdaa122823601390c7dcbdd1afde33c2f1a432b8c5ff025c6137ee99ba541a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Sat, 23 Jul 2022 14:21:24 GMT
content-encoding
br
last-modified
Tue, 24 May 2022 08:04:56 GMT
server
Apache
etag
"8e27083-145db-5dfbd698f9a0e-br"
vary
Accept-Encoding,User-Agent
content-type
text/css
cache-control
max-age=2592000, public
accept-ranges
bytes
content-length
10546
expires
Mon, 22 Aug 2022 14:21:24 GMT
Total-Soft-Gallery-Video-Widget.css
niiconsulting.com/checkmate/wp-content/plugins/gallery-videos/CSS/ 		50 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://niiconsulting.com/checkmate/wp-content/plugins/gallery-videos/CSS/Total-Soft-Gallery-Video-Widget.css?ver=5.9.3
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
166.62.10.188 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-10-188.ip.secureserver.net
Software
Apache /
Resource Hash
171b7dba0375ac8de65674eb83d3672316c431ef53491d2e2f25b2ffe40091ad

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Sat, 23 Jul 2022 14:21:24 GMT
content-encoding
br
last-modified
Fri, 10 Sep 2021 10:51:47 GMT
server
Apache
etag
"8e010ad-c9b9-5cba1e6dd76c0-br"
vary
Accept-Encoding,User-Agent
content-type
text/css
cache-control
max-age=2592000, public
accept-ranges
bytes
content-length
3915
expires
Mon, 22 Aug 2022 14:21:24 GMT
totalsoft.css
niiconsulting.com/checkmate/wp-content/plugins/gallery-videos/CSS/ 		40 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://niiconsulting.com/checkmate/wp-content/plugins/gallery-videos/CSS/totalsoft.css?ver=5.9.3
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
166.62.10.188 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-10-188.ip.secureserver.net
Software
Apache /
Resource Hash
d6d7ea9ba6ef9165d09afe103e6804525c15cc8823b9409c7dfe3cd4af71605d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Sat, 23 Jul 2022 14:21:24 GMT
content-encoding
br
last-modified
Fri, 10 Sep 2021 10:51:47 GMT
server
Apache
etag
"8e010bd-9eae-5cba1e6dd76c0-br"
vary
Accept-Encoding,User-Agent
content-type
text/css
cache-control
max-age=2592000, public
accept-ranges
bytes
content-length
6771
expires
Mon, 22 Aug 2022 14:21:24 GMT
css
fonts.googleapis.com/ 		10 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:400,400italic,700,600
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
034a3b4edad62ee67e2010cb81b06311e564d75d1fef29a256a6ab9b86000db9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Sat, 23 Jul 2022 14:12:42 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Sat, 23 Jul 2022 14:21:24 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sat, 23 Jul 2022 14:21:24 GMT
style.css
niiconsulting.com/checkmate/wp-content/themes/mh-magazine-lite/ 		44 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://niiconsulting.com/checkmate/wp-content/themes/mh-magazine-lite/style.css?ver=2.8.6
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
166.62.10.188 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-10-188.ip.secureserver.net
Software
Apache /
Resource Hash
cc6254f5ea4094e192858c5ccea69459f0a60307a4658d9409b499450ab3a9e7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Sat, 23 Jul 2022 14:21:24 GMT
content-encoding
br
last-modified
Fri, 10 Sep 2021 10:46:20 GMT
server
Apache
etag
"8e42512-b1f1-5cba1d35fd700-br"
vary
Accept-Encoding,User-Agent
content-type
text/css
cache-control
max-age=2592000, public
accept-ranges
bytes
content-length
8821
expires
Mon, 22 Aug 2022 14:21:24 GMT
font-awesome.min.css
niiconsulting.com/checkmate/wp-content/themes/mh-magazine-lite/includes/ 		30 KB
7 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://niiconsulting.com/checkmate/wp-content/themes/mh-magazine-lite/includes/font-awesome.min.css
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
166.62.10.188 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-10-188.ip.secureserver.net
Software
Apache /
Resource Hash
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Sat, 23 Jul 2022 14:21:24 GMT
content-encoding
br
last-modified
Fri, 10 Sep 2021 10:46:19 GMT
server
Apache
etag
"8e42598-7918-5cba1d35094c0-br"
vary
Accept-Encoding,User-Agent
content-type
text/css
cache-control
max-age=2592000, public
accept-ranges
bytes
content-length
6663
expires
Mon, 22 Aug 2022 14:21:24 GMT
sassy-social-share-public.css
niiconsulting.com/checkmate/wp-content/plugins/sassy-social-share/public/css/ 		36 KB
10 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://niiconsulting.com/checkmate/wp-content/plugins/sassy-social-share/public/css/sassy-social-share-public.css?ver=3.3.20
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
166.62.10.188 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-10-188.ip.secureserver.net
Software
Apache /
Resource Hash
2c5b024ac47363f4d7bb9f9ba156f11847254f45d37783068345e1217ce3fd25

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Sat, 23 Jul 2022 14:21:24 GMT
content-encoding
br
last-modified
Fri, 10 Sep 2021 10:51:41 GMT
server
Apache
etag
"8e4027b-8ff4-5cba1e681e940-br"
vary
Accept-Encoding,User-Agent
content-type
text/css
cache-control
max-age=2592000, public
accept-ranges
bytes
content-length
9904
expires
Mon, 22 Aug 2022 14:21:24 GMT
sassy-social-share-svg.css
niiconsulting.com/checkmate/wp-content/plugins/sassy-social-share/admin/css/ 		111 KB
34 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://niiconsulting.com/checkmate/wp-content/plugins/sassy-social-share/admin/css/sassy-social-share-svg.css?ver=3.3.20
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
166.62.10.188 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-10-188.ip.secureserver.net
Software
Apache /
Resource Hash
7f8fc2a8f340314b8c37cf2e52c17df22e0b6e756625c61dd87f650ee28fdb37

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Sat, 23 Jul 2022 14:21:24 GMT
content-encoding
br
last-modified
Fri, 10 Sep 2021 10:51:39 GMT
server
Apache
etag
"8e2709d-1baf8-5cba1e66364c0-br"
vary
Accept-Encoding,User-Agent
content-type
text/css
cache-control
max-age=2592000, public
accept-ranges
bytes
content-length
34593
expires
Mon, 22 Aug 2022 14:21:24 GMT
css
fonts.googleapis.com/ 		17 KB
1005 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Open+Sans%3A300italic%2C400italic%2C600italic%2C300%2C400%2C600&subset=latin%2Clatin-ext&display=fallback&ver=5.9.3
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
0246217e13d0de5f14e4ff38a51761d8ab80698420ac6ead729c62cac07b4d32
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Sat, 23 Jul 2022 12:56:46 GMT
server
ESF
cross-origin-opener-policy
same-origin-allow-popups
date
Sat, 23 Jul 2022 14:21:24 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Sat, 23 Jul 2022 14:21:24 GMT
jetpack.css
niiconsulting.com/checkmate/wp-content/plugins/jetpack/css/ 		72 KB
12 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://niiconsulting.com/checkmate/wp-content/plugins/jetpack/css/jetpack.css?ver=8.4.3
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
166.62.10.188 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-10-188.ip.secureserver.net
Software
Apache /
Resource Hash
934dc3a005115ead8f70eada94b6cb246064ed87e8b8694f1531e1582b8e7136

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Sat, 23 Jul 2022 14:21:24 GMT
content-encoding
br
last-modified
Fri, 10 Sep 2021 10:51:12 GMT
server
Apache
etag
"8e26a4d-12161-5cba1e4c76800-br"
vary
Accept-Encoding,User-Agent
content-type
text/css
cache-control
max-age=2592000, public
accept-ranges
bytes
content-length
12616
expires
Mon, 22 Aug 2022 14:21:24 GMT
wp-paginate.css
niiconsulting.com/checkmate/wp-content/plugins/wp-paginate/css/ 		3 KB
963 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://niiconsulting.com/checkmate/wp-content/plugins/wp-paginate/css/wp-paginate.css?ver=2.1.6
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
166.62.10.188 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-10-188.ip.secureserver.net
Software
Apache /
Resource Hash
e379a211e75642755c7b975859d84ebf76697490618e8a6127a41036ef82f2df

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Sat, 23 Jul 2022 14:21:24 GMT
content-encoding
br
last-modified
Fri, 10 Sep 2021 10:51:43 GMT
server
Apache
etag
"8e41539-aaa-5cba1e6a06dc0-br"
vary
Accept-Encoding,User-Agent
content-type
text/css
cache-control
max-age=2592000, public
accept-ranges
bytes
content-length
805
expires
Mon, 22 Aug 2022 14:21:24 GMT
jquery.min.js
niiconsulting.com/checkmate/wp-includes/js/jquery/ 		87 KB
30 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://niiconsulting.com/checkmate/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
166.62.10.188 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-10-188.ip.secureserver.net
Software
Apache /
Resource Hash
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Sat, 23 Jul 2022 14:21:24 GMT
content-encoding
br
last-modified
Tue, 24 May 2022 08:05:04 GMT
server
Apache
etag
"8e42a2d-15db1-5dfbd6a071fe7-br"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
cache-control
max-age=2592000, public
accept-ranges
bytes
content-length
30310
expires
Mon, 22 Aug 2022 14:21:24 GMT
jquery-migrate.min.js
niiconsulting.com/checkmate/wp-includes/js/jquery/ 		11 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://niiconsulting.com/checkmate/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.3.2
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
166.62.10.188 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-10-188.ip.secureserver.net
Software
Apache /
Resource Hash
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Sat, 23 Jul 2022 14:21:24 GMT
content-encoding
br
last-modified
Tue, 24 May 2022 08:05:01 GMT
server
Apache
etag
"8e4064a-2bd8-5dfbd69e1928f-br"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
cache-control
max-age=2592000, public
accept-ranges
bytes
content-length
3998
expires
Mon, 22 Aug 2022 14:21:24 GMT
related-posts.min.js
niiconsulting.com/checkmate/wp-content/plugins/jetpack/_inc/build/related-posts/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://niiconsulting.com/checkmate/wp-content/plugins/jetpack/_inc/build/related-posts/related-posts.min.js?ver=20191011
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
166.62.10.188 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-10-188.ip.secureserver.net
Software
Apache /
Resource Hash
71275c06e498f0aa672ac51e995d317cf07f26295d9ec48adebb000df8b3e7f8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Sat, 23 Jul 2022 14:21:24 GMT
content-encoding
br
last-modified
Fri, 10 Sep 2021 10:51:10 GMT
server
Apache
etag
"8e26882-12a9-5cba1e4a8e380-br"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
cache-control
max-age=2592000, public
accept-ranges
bytes
content-length
1520
expires
Mon, 22 Aug 2022 14:21:24 GMT
core.min.js
niiconsulting.com/checkmate/wp-includes/js/jquery/ui/ 		20 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://niiconsulting.com/checkmate/wp-includes/js/jquery/ui/core.min.js?ver=1.13.1
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
166.62.10.188 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-10-188.ip.secureserver.net
Software
Apache /
Resource Hash
9d7da1b980a95ff3d31d0bb8733cbabd1d210ec601d15a1aac2b67394a33191d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Sat, 23 Jul 2022 14:21:24 GMT
content-encoding
br
last-modified
Tue, 24 May 2022 08:05:04 GMT
server
Apache
etag
"8e406b3-50ea-5dfbd6a0581d6-br"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
cache-control
max-age=2592000, public
accept-ranges
bytes
content-length
6609
expires
Mon, 22 Aug 2022 14:21:24 GMT
modernizr.custom.js
niiconsulting.com/checkmate/wp-content/plugins/gallery-videos/JS/ 		9 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://niiconsulting.com/checkmate/wp-content/plugins/gallery-videos/JS/modernizr.custom.js?ver=5.9.3
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
166.62.10.188 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-10-188.ip.secureserver.net
Software
Apache /
Resource Hash
ebb0c629fbe930efa5ad30f11a383fe3d87e7332b854ae3e607d8c9ea326789b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Sat, 23 Jul 2022 14:21:24 GMT
content-encoding
br
last-modified
Fri, 10 Sep 2021 10:51:49 GMT
server
Apache
etag
"8e01171-233b-5cba1e6fbfb40-br"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
cache-control
max-age=2592000, public
accept-ranges
bytes
content-length
3745
expires
Mon, 22 Aug 2022 14:21:24 GMT
Total-Soft-Gallery-Video-Widget.js
niiconsulting.com/checkmate/wp-content/plugins/gallery-videos/JS/ 		93 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://niiconsulting.com/checkmate/wp-content/plugins/gallery-videos/JS/Total-Soft-Gallery-Video-Widget.js?ver=5.9.3
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
166.62.10.188 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-10-188.ip.secureserver.net
Software
Apache /
Resource Hash
a30e56d61eca910f4e795e2920fc61671bd378f9a7a9f40a44e5869343a0bf89

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Sat, 23 Jul 2022 14:21:24 GMT
content-encoding
br
last-modified
Fri, 10 Sep 2021 10:51:49 GMT
server
Apache
etag
"8e0113b-173bd-5cba1e6fbfb40-br"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
cache-control
max-age=2592000, public
accept-ranges
bytes
content-length
3566
expires
Mon, 22 Aug 2022 14:21:24 GMT
scripts.js
niiconsulting.com/checkmate/wp-content/themes/mh-magazine-lite/js/ 		30 KB
10 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://niiconsulting.com/checkmate/wp-content/themes/mh-magazine-lite/js/scripts.js?ver=2.8.6
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
166.62.10.188 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-10-188.ip.secureserver.net
Software
Apache /
Resource Hash
9a6d5096068784e4493f9b3a5d4226b12c966fbcc43d7ab1007d9f0dd9025f49

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Sat, 23 Jul 2022 14:21:24 GMT
content-encoding
br
last-modified
Fri, 10 Sep 2021 10:46:19 GMT
server
Apache
etag
"8e4260c-78c8-5cba1d35094c0-br"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
cache-control
max-age=2592000, public
accept-ranges
bytes
content-length
9954
expires
Mon, 22 Aug 2022 14:21:24 GMT
sharethis.js
platform-api.sharethis.com/js/ 		188 KB
42 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform-api.sharethis.com/js/sharethis.js
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.157.4.87 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-157-4-87.dus51.r.cloudfront.net
Software
/
Resource Hash
c873718c2f520f4568851388561dc337aa6af0063b6d5b3bc94e7680fa7b7e61
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Frame-Options SAMEORIGIN

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Sat, 23 Jul 2022 14:18:30 GMT
content-encoding
gzip
vary
Accept-Encoding
age
174
etag
W/"2f0e2-60l42D+2FfpJ7EEx6R3Sj1Npl9Q"
x-frame-options
SAMEORIGIN
x-cache
Hit from cloudfront
content-type
text/javascript; charset=utf-8
via
1.1 c1c42e732809880dbf4b6deb496490ae.cloudfront.net (CloudFront)
edge-control
cache-maxage=60m,downstream-ttl=60m
cache-control
max-age=600, public
x-amz-cf-pop
DUS51-P2
strict-transport-security
max-age=31536000; includeSubDomains
x-amz-cf-id
a4LFLlrBrGjjX1zU59CX8bJZjWrHK-QLoXI7kGMolgzkvW9hb0HONQ==
md1.png
i1.wp.com/niiconsulting.com/checkmate/wp-content/uploads/2018/02/ 		838 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i1.wp.com/niiconsulting.com/checkmate/wp-content/uploads/2018/02/md1.png?fit=560%2C315&ssl=1&resize=40%2C40
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
aa921fb6024171c8f0a61ffa4413a8ed81dc6eaff2ac679e424b2e17c2aaa4f7
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-nc
HIT hhn 3
date
Sat, 23 Jul 2022 14:21:25 GMT
x-content-type-options
nosniff
last-modified
Sun, 11 Apr 2021 17:48:14 GMT
server
nginx
etag
"b56bae54346ebd1e"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://niiconsulting.com/checkmate/wp-content/uploads/2018/02/md1.png>; rel="canonical"
content-length
838
expires
Wed, 12 Apr 2023 05:48:14 GMT
OSCP.png
i0.wp.com/niiconsulting.com/checkmate/wp-content/uploads/2017/06/ 		726 B
903 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i0.wp.com/niiconsulting.com/checkmate/wp-content/uploads/2017/06/OSCP.png?fit=601%2C227&ssl=1&resize=40%2C40
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
394f9454b8a43a936c6b6a8f0eaf70a44510c528f0b074431600d1db851b998c
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-nc
HIT hhn 4
date
Sat, 23 Jul 2022 14:21:25 GMT
x-content-type-options
nosniff
last-modified
Sun, 11 Apr 2021 10:40:59 GMT
server
nginx
etag
"0a75f92ecd9cd538"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://niiconsulting.com/checkmate/wp-content/uploads/2017/06/OSCP.png>; rel="canonical"
content-length
726
expires
Tue, 11 Apr 2023 22:40:59 GMT
07d6540662f5e7e692a1f9163eb519e9
secure.gravatar.com/avatar/ 		983 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure.gravatar.com/avatar/07d6540662f5e7e692a1f9163eb519e9?s=40&d=mm&r=g
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
ca775cd8ab837239f9497e8afe90403d78cb37581c0adfe4003012d24bea020e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Sat, 23 Jul 2022 14:21:25 GMT
last-modified
Wed, 11 Jan 1984 08:00:00 GMT
server
nginx
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=300
content-disposition
inline; filename="07d6540662f5e7e692a1f9163eb519e9.png"
accept-ranges
bytes
link
<https://www.gravatar.com/avatar/07d6540662f5e7e692a1f9163eb519e9?s=40&d=mm&r=g>; rel="canonical"
content-length
983
expires
Sat, 23 Jul 2022 14:26:25 GMT
sql-injection-6.png
i2.wp.com/niiconsulting.com/checkmate/wp-content/uploads/2014/01/ 		506 B
829 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i2.wp.com/niiconsulting.com/checkmate/wp-content/uploads/2014/01/sql-injection-6.png?resize=40%2C40&ssl=1
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
d28fba61eab8451e00f6381079841111b9c8076602c19619aa03019c9690b7eb
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-nc
HIT hhn 3
date
Sat, 23 Jul 2022 14:21:25 GMT
x-content-type-options
nosniff
last-modified
Thu, 15 Apr 2021 19:18:06 GMT
server
nginx
etag
"8120fcefecdc0870"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://niiconsulting.com/checkmate/wp-content/uploads/2014/01/sql-injection-6.png>; rel="canonical"
content-length
506
expires
Sun, 16 Apr 2023 07:18:06 GMT
md2.png
i0.wp.com/niiconsulting.com/checkmate/wp-content/uploads/2018/02/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i0.wp.com/niiconsulting.com/checkmate/wp-content/uploads/2018/02/md2.png?fit=560%2C315&ssl=1&resize=40%2C40
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
cec99fc609bb4dee7c020a9d39740f81b79795f4d18458862f71d952f2f79041
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-nc
HIT hhn 3
date
Sat, 23 Jul 2022 14:21:25 GMT
x-content-type-options
nosniff
last-modified
Tue, 21 Jun 2022 22:47:22 GMT
server
nginx
etag
"7a92bcc6603e3087"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://niiconsulting.com/checkmate/wp-content/uploads/2018/02/md2.png>; rel="canonical"
content-length
2730
expires
Fri, 21 Jun 2024 10:47:22 GMT
image-1.png
i1.wp.com/niiconsulting.com/checkmate/wp-content/uploads/2022/02/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i1.wp.com/niiconsulting.com/checkmate/wp-content/uploads/2022/02/image-1.png?resize=40%2C40&ssl=1
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
dfb7cbbc8d0dbbc9f6a29058c0d4d1f5761c16114868b5e9f68cdd62bd73c462
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Sat, 23 Jul 2022 14:21:25 GMT
x-content-type-options
nosniff
last-modified
Sat, 14 May 2022 10:08:32 GMT
server
nginx
etag
"ecb94bad98ed5f69"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://niiconsulting.com/checkmate/wp-content/uploads/2022/02/image-1.png>; rel="canonical"
content-length
1890
expires
Mon, 13 May 2024 22:08:32 GMT
Blog-Banner-1.png
i1.wp.com/niiconsulting.com/checkmate/wp-content/uploads/2022/02/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i1.wp.com/niiconsulting.com/checkmate/wp-content/uploads/2022/02/Blog-Banner-1.png?fit=560%2C315&ssl=1&resize=40%2C40
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
5f11d760b95996de434261d5da9df76778ac14fbf41ba2bcba128d910208a726
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-nc
HIT hhn 4
date
Sat, 23 Jul 2022 14:21:25 GMT
x-content-type-options
nosniff
last-modified
Thu, 19 May 2022 19:20:54 GMT
server
nginx
etag
"a2ee2778f56462d0"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://niiconsulting.com/checkmate/wp-content/uploads/2022/02/Blog-Banner-1.png>; rel="canonical"
content-length
2942
expires
Sun, 19 May 2024 07:20:54 GMT
Screenshot_1.png
i2.wp.com/niiconsulting.com/checkmate/wp-content/uploads/2021/08/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i2.wp.com/niiconsulting.com/checkmate/wp-content/uploads/2021/08/Screenshot_1.png?fit=530%2C305&ssl=1&resize=40%2C40
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
256bc98392b0add1fa36e5103e7b00332e2cefbc7810c6f8713f59ac7ecdbd14
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Sat, 23 Jul 2022 14:21:25 GMT
x-content-type-options
nosniff
last-modified
Sat, 26 Feb 2022 16:30:18 GMT
server
nginx
etag
"0debd4d400fa3720"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://niiconsulting.com/checkmate/wp-content/uploads/2021/08/Screenshot_1.png>; rel="canonical"
content-length
2728
expires
Tue, 27 Feb 2024 04:30:18 GMT
image.png
i0.wp.com/niiconsulting.com/checkmate/wp-content/uploads/2022/02/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i0.wp.com/niiconsulting.com/checkmate/wp-content/uploads/2022/02/image.png?resize=40%2C40&ssl=1
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
a46f378dd4dbc81f508eae0dfcd2a404491dd8c757d8c982370bc6002f4b7fff
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-nc
HIT hhn 4
date
Sat, 23 Jul 2022 14:21:25 GMT
x-content-type-options
nosniff
last-modified
Fri, 06 May 2022 12:21:14 GMT
server
nginx
etag
"5518312d0b53bedf"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://niiconsulting.com/checkmate/wp-content/uploads/2022/02/image.png>; rel="canonical"
content-length
2272
expires
Mon, 06 May 2024 00:21:14 GMT
Picture7.jpg
i2.wp.com/niiconsulting.com/checkmate/wp-content/uploads/2021/12/ 		900 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i2.wp.com/niiconsulting.com/checkmate/wp-content/uploads/2021/12/Picture7.jpg?fit=1200%2C802&ssl=1&resize=40%2C40
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
9b916efba0b8f57387c719705638df1b083ebfc41a965eac2dce051f9ec78dfa
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Sat, 23 Jul 2022 14:21:25 GMT
x-content-type-options
nosniff
last-modified
Sun, 20 Mar 2022 18:12:08 GMT
server
nginx
etag
"7a2fe3e30fbc55b1"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://niiconsulting.com/checkmate/wp-content/uploads/2021/12/Picture7.jpg>; rel="canonical"
content-length
900
expires
Wed, 20 Mar 2024 06:12:08 GMT
photon.min.js
niiconsulting.com/checkmate/wp-content/plugins/jetpack/_inc/build/photon/ 		758 B
476 B 		Script
General
Check archive.org
Download Go to
Full URL
https://niiconsulting.com/checkmate/wp-content/plugins/jetpack/_inc/build/photon/photon.min.js?ver=20191001
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
166.62.10.188 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-10-188.ip.secureserver.net
Software
Apache /
Resource Hash
e1b0066bc1972444c0a15e1778be06ed7bf36c55d597c065b5e79041bcda291e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Sat, 23 Jul 2022 14:21:25 GMT
content-encoding
br
last-modified
Fri, 10 Sep 2021 10:51:10 GMT
server
Apache
etag
"8e26877-2f6-5cba1e4a8e380-br"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
cache-control
max-age=2592000, public
accept-ranges
bytes
content-length
370
expires
Mon, 22 Aug 2022 14:21:25 GMT
gprofiles.js
secure.gravatar.com/js/ 		23 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://secure.gravatar.com/js/gprofiles.js?ver=202229
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
b8ddfe2786718750e37a2a7d2841e4e6a110a1877e21a03675d47c591d4a7f03

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Sat, 23 Jul 2022 14:21:25 GMT
content-encoding
br
last-modified
Fri, 25 Feb 2022 16:03:16 GMT
server
nginx
etag
W/"6218fdc4-5df8"
content-type
application/javascript
cache-control
max-age=604800
expires
Sat, 30 Jul 2022 14:21:25 GMT
wpgroho.js
niiconsulting.com/checkmate/wp-content/plugins/jetpack/modules/ 		2 KB
814 B 		Script
General
Check archive.org
Download Go to
Full URL
https://niiconsulting.com/checkmate/wp-content/plugins/jetpack/modules/wpgroho.js?ver=5.9.3
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
166.62.10.188 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-10-188.ip.secureserver.net
Software
Apache /
Resource Hash
506a05dfe581727e7be2d16e58aa23d53c01f8ed599d6722b2e31da690467521

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Sat, 23 Jul 2022 14:21:25 GMT
content-encoding
br
last-modified
Fri, 10 Sep 2021 10:51:20 GMT
server
Apache
etag
"8e26d75-79b-5cba1e5417a00-br"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
cache-control
max-age=2592000, public
accept-ranges
bytes
content-length
731
expires
Mon, 22 Aug 2022 14:21:25 GMT
comment-reply.min.js
niiconsulting.com/checkmate/wp-includes/js/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://niiconsulting.com/checkmate/wp-includes/js/comment-reply.min.js?ver=5.9.3
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
166.62.10.188 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-10-188.ip.secureserver.net
Software
Apache /
Resource Hash
a10b9570a1c7858442b42f1cd48b69a191638269f37e4046607bf5fe188e38bf

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Sat, 23 Jul 2022 14:21:25 GMT
content-encoding
br
last-modified
Tue, 24 May 2022 08:05:16 GMT
server
Apache
etag
"8e40032-ba3-5dfbd6abbc649-br"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
cache-control
max-age=2592000, public
accept-ranges
bytes
content-length
1223
expires
Mon, 22 Aug 2022 14:21:25 GMT
twitter-timeline.min.js
niiconsulting.com/checkmate/wp-content/plugins/jetpack/_inc/build/ 		331 B
259 B 		Script
General
Check archive.org
Download Go to
Full URL
https://niiconsulting.com/checkmate/wp-content/plugins/jetpack/_inc/build/twitter-timeline.min.js?ver=4.0.0
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
166.62.10.188 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-10-188.ip.secureserver.net
Software
Apache /
Resource Hash
291b553dee180f838e513bf2580c9af27f8312320581e3c91029a7c4d5eb2fbc

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Sat, 23 Jul 2022 14:21:25 GMT
content-encoding
br
last-modified
Fri, 10 Sep 2021 10:51:10 GMT
server
Apache
etag
"8e2681d-14b-5cba1e4a8e380-br"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
cache-control
max-age=2592000, public
accept-ranges
bytes
content-length
200
expires
Mon, 22 Aug 2022 14:21:25 GMT
sassy-social-share-public.js
niiconsulting.com/checkmate/wp-content/plugins/sassy-social-share/public/js/ 		43 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://niiconsulting.com/checkmate/wp-content/plugins/sassy-social-share/public/js/sassy-social-share-public.js?ver=3.3.20
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
166.62.10.188 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-10-188.ip.secureserver.net
Software
Apache /
Resource Hash
04e107d701fdd6867cb72ba7ceaf313bd068ae7959ec429cab8449d96c30beff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Sat, 23 Jul 2022 14:21:25 GMT
content-encoding
br
last-modified
Fri, 10 Sep 2021 10:51:41 GMT
server
Apache
etag
"8e40286-ac76-5cba1e681e940-br"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
cache-control
max-age=2592000, public
accept-ranges
bytes
content-length
10669
expires
Mon, 22 Aug 2022 14:21:25 GMT
lazy-images.min.js
niiconsulting.com/checkmate/wp-content/plugins/jetpack/_inc/build/lazy-images/js/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://niiconsulting.com/checkmate/wp-content/plugins/jetpack/_inc/build/lazy-images/js/lazy-images.min.js?ver=8.4.3
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
166.62.10.188 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-10-188.ip.secureserver.net
Software
Apache /
Resource Hash
a23dec87ea93f923ebe233e63f7c43d1a130ccf1578d97ea758157aae6d108e3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Sat, 23 Jul 2022 14:21:25 GMT
content-encoding
br
last-modified
Fri, 10 Sep 2021 10:51:10 GMT
server
Apache
etag
"8e26862-2452-5cba1e4a8e380-br"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
cache-control
max-age=2592000, public
accept-ranges
bytes
content-length
2980
expires
Mon, 22 Aug 2022 14:21:25 GMT
postmessage.min.js
niiconsulting.com/checkmate/wp-content/plugins/jetpack/_inc/build/ 		9 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://niiconsulting.com/checkmate/wp-content/plugins/jetpack/_inc/build/postmessage.min.js?ver=8.4.3
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
166.62.10.188 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-10-188.ip.secureserver.net
Software
Apache /
Resource Hash
96cae96a73c65ceed190aa0b4a9a86f0233798e9a17f27ca57855f4f79ebf678

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Sat, 23 Jul 2022 14:21:25 GMT
content-encoding
br
last-modified
Fri, 10 Sep 2021 10:51:10 GMT
server
Apache
etag
"8e267e9-23c4-5cba1e4a8e380-br"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
cache-control
max-age=2592000, public
accept-ranges
bytes
content-length
3649
expires
Mon, 22 Aug 2022 14:21:25 GMT
jquery.jetpack-resize.min.js
niiconsulting.com/checkmate/wp-content/plugins/jetpack/_inc/build/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://niiconsulting.com/checkmate/wp-content/plugins/jetpack/_inc/build/jquery.jetpack-resize.min.js?ver=8.4.3
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
166.62.10.188 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-10-188.ip.secureserver.net
Software
Apache /
Resource Hash
265c34f4c62e6423e270cecb0c422b735dfb0f18cea04c2ac343b6f22106661e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Sat, 23 Jul 2022 14:21:25 GMT
content-encoding
br
last-modified
Fri, 10 Sep 2021 10:51:10 GMT
server
Apache
etag
"8e267e0-aea-5cba1e4a8e380-br"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
cache-control
max-age=2592000, public
accept-ranges
bytes
content-length
992
expires
Mon, 22 Aug 2022 14:21:25 GMT
queuehandler.js
niiconsulting.com/checkmate/wp-content/plugins/jetpack/modules/likes/ 		11 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://niiconsulting.com/checkmate/wp-content/plugins/jetpack/modules/likes/queuehandler.js?ver=8.4.3
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
166.62.10.188 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-10-188.ip.secureserver.net
Software
Apache /
Resource Hash
73da6615c62f187dc1afd7bf6eb024917b20d5848ffeef08863aa7ef2ce8164f

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Sat, 23 Jul 2022 14:21:25 GMT
content-encoding
br
last-modified
Fri, 10 Sep 2021 10:51:16 GMT
server
Apache
etag
"8e27300-2c3e-5cba1e5047100-br"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
cache-control
max-age=2592000, public
accept-ranges
bytes
content-length
3220
expires
Mon, 22 Aug 2022 14:21:25 GMT
form.js
niiconsulting.com/checkmate/wp-content/plugins/akismet/_inc/ 		700 B
332 B 		Script
General
Check archive.org
Download Go to
Full URL
https://niiconsulting.com/checkmate/wp-content/plugins/akismet/_inc/form.js?ver=4.1.5
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
166.62.10.188 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-10-188.ip.secureserver.net
Software
Apache /
Resource Hash
0515cbd1f8aee97e1c8e0d1d015ca96c86def13e90d2e73bf813072ccc23d531

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Sat, 23 Jul 2022 14:21:25 GMT
content-encoding
br
last-modified
Fri, 10 Sep 2021 10:51:08 GMT
server
Apache
etag
"8e00c40-2bc-5cba1e48a5f00-br"
vary
Accept-Encoding,User-Agent
content-type
application/javascript
cache-control
max-age=2592000, public
accept-ranges
bytes
content-length
251
expires
Mon, 22 Aug 2022 14:21:25 GMT
e-202229.js
stats.wp.com/ 		9 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://stats.wp.com/e-202229.js
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
82d0aae1e7b8cfc0574d6548d1f35096f5e4310321aa964ff3fdb46c4d12e302

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-nc
HIT hhn
date
Sat, 23 Jul 2022 14:21:25 GMT
content-encoding
br
server
nginx
etag
W/"6197c5cf-3508"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
expires
Sun, 09 Jul 2023 21:39:50 GMT
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v29/ 		44 KB
44 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v29/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:400,400italic,700,600
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:828::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
a658b2be7323c57d4bd5c4197b657e1f5360d1b950131dc377efec1d5111ffd0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://fonts.googleapis.com/
Origin
https://niiconsulting.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Mon, 18 Jul 2022 23:10:25 GMT
x-content-type-options
nosniff
age
400260
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
44800
x-xss-protection
0
last-modified
Wed, 11 May 2022 19:25:14 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="apps-themes"
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
expires
Tue, 18 Jul 2023 23:10:25 GMT
60d04237bfdf8e00190a2073.js
buttons-config.sharethis.com/js/ 		30 B
470 B 		Script
General
Check archive.org
Download Go to
Full URL
https://buttons-config.sharethis.com/js/60d04237bfdf8e00190a2073.js
Requested by
Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:e200:c:abe:f440:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2c29defe29114d0e8b948e78d50ebb281035df53a9167089deb1e77e801bbd2f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Sat, 23 Jul 2022 14:21:26 GMT
via
1.1 baaf38f0a0d54e4834bf934fa5189cea.cloudfront.net (CloudFront)
last-modified
Mon, 21 Jun 2021 07:39:36 GMT
server
AmazonS3
x-amz-cf-pop
FRA50-C1
etag
"e6e1643313740711175f51662a65b42f"
vary
Accept-Encoding
x-cache
RefreshHit from cloudfront
content-type
text/javascript
cache-control
max-age=60,public
strict-transport-security
max-age=31536000; includeSubDomains
accept-ranges
bytes
content-length
30
x-amz-cf-id
lgs-og1lVbZMi7cnXmL_sAf3OPqo1KahYzZuWsjQgbYL7oQm3fmzAQ==
pview
l.sharethis.com/ 		0
404 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://l.sharethis.com/pview?event=pview&hostname=niiconsulting.com&location=%2Fcheckmate%2F2022%2F02%2Fthreat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities%2F&product=ga&url=https%3A%2F%2Fniiconsulting.com%2Fcheckmate%2F2022%2F02%2Fthreat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities%2F&source=sharethis.js&fcmp=false&fcmpv2=false&has_segmentio=false&title=Threat%20actor%20groups%20are%20targeting%20VMware%20Horizon%20servers%20running%20versions%20affected%20by%20Log4Shell%20vulnerabilities%20-%20Checkmate&cms=unknown&publisher=60d04237bfdf8e00190a2073&sop=true&version=st_sop.js&lang=en&description=Severity%3A%20High%20Initial%20Access%20Broker%20(IAB)%20group%20Prophet%20Spider%20and%20an%20unknown%20threat%20group%20are%20actively%20attempting%20to%20exploit%20the%20Log4j%20vulnerability%20in%20VMware%20Horizon.%20Attack%20Chain%3A%E2%80%A2%20In%20ongoing%20threat%20%5Bmore%5D
Requested by
Host: platform-api.sharethis.com
URL: https://platform-api.sharethis.com/js/sharethis.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.196.212.55 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-196-212-55.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains;

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Sat, 23 Jul 2022 14:21:25 GMT
Strict-Transport-Security
max-age=63072000; includeSubDomains;
Access-Control-Allow-Origin
https://niiconsulting.com
Access-Control-Expose-Headers
stid
Cache-Control
no-cache, no-store, must-revalidate
Access-Control-Allow-Credentials
true
Access-Control-Max-Age
1728000
Connection
keep-alive
Access-Control-Allow-Headers
*
analytics.js
google-analytics.com/ 		49 KB
20 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://google-analytics.com/analytics.js
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 13 Apr 2022 21:02:38 GMT
server
Golfe2
age
4523
date
Sat, 23 Jul 2022 13:06:02 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20006
expires
Sat, 23 Jul 2022 15:06:02 GMT
truncated
/ 		42 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type
image/gif
fontawesome-webfont.woff2
niiconsulting.com/checkmate/wp-content/themes/mh-magazine-lite/fonts/ 		75 KB
76 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://niiconsulting.com/checkmate/wp-content/themes/mh-magazine-lite/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/wp-content/themes/mh-magazine-lite/includes/font-awesome.min.css
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
166.62.10.188 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-10-188.ip.secureserver.net
Software
Apache /
Resource Hash
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

Referer
https://niiconsulting.com/checkmate/wp-content/themes/mh-magazine-lite/includes/font-awesome.min.css
Origin
https://niiconsulting.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Sat, 23 Jul 2022 14:21:25 GMT
content-encoding
br
last-modified
Fri, 10 Sep 2021 10:46:19 GMT
server
Apache
etag
"8e42564-12d68-5cba1d35094c0-br"
vary
Accept-Encoding,User-Agent
content-type
font/woff2
cache-control
max-age=2592000
accept-ranges
bytes
content-length
77165
expires
Mon, 22 Aug 2022 14:21:25 GMT
/
jetpack.wordpress.com/jetpack-comment/ Frame C210 		26 KB
8 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://jetpack.wordpress.com/jetpack-comment/?blogid=9704473&postid=4247&comment_registration=0&require_name_email=1&stc_enabled=1&stb_enabled=1&show_avatars=1&avatar_default=mystery&greeting=Leave+a+Comment&greeting_reply=Leave+a+Reply+to+%25s&color_scheme=light&lang=en_US&jetpack_version=8.4.3&show_cookie_consent=10&has_cookie_consent=0&token_key=%3Bnormal%3B&sig=2a3bbe85abe489da41e5444b763962a1d23486b4
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.78.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
c8d9e21627befeb273e3a2b0c1f59aa70037b7503dace354a6eadfea772c1952
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

Referer
https://niiconsulting.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
br
content-type
text/html; charset=UTF-8
date
Sat, 23 Jul 2022 14:21:25 GMT
host-header
WordPress.com
server
nginx
strict-transport-security
max-age=15552000
vary
Accept-Encoding
x-ac
2.hhn _dfw
x-hacker
If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header.
truncated
/ 		302 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b980f62a2d545d64f24e6f96902c8fbf5da0018569c369bc18f9e5b5fcf099ed

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf8
truncated
/ 		682 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
c2e8b4fba49f90cfca5a43371c09879aed7447e0ba2ed4abd75b81448776c4f7

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf8
truncated
/ 		425 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
54c9560cb0117d8d1f955aefe0f88b843517964e118512d8f1a224a8a9b662f4

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf8
truncated
/ 		300 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
42d8ef8ce6bdaa5296ac14f903b01a75f53d57c0fa97b1ef8e24c55ffd96c5f9

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf8
truncated
/ 		913 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
16f708e5165a9e2302fec421f8f9d341e3f66a0954a5b7c962460406c7f2be4e

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf8
truncated
/ 		440 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
6094c4966b779bf91e2461773e30cb0dc965642321826ba0a54c6ae8dbdf0d89

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf8
truncated
/ 		338 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
649efd3b18f3e9c03757831a8a192077b72fb32547f25d9746954c4348594aa8

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf8
collect
www.google-analytics.com/j/ 		4 B
409 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j96&a=460040168&t=pageview&_s=1&dl=https%3A%2F%2Fniiconsulting.com%2Fcheckmate%2F2022%2F02%2Fthreat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities%2F&ul=en-us&de=UTF-8&dt=Threat%20actor%20groups%20are%20targeting%20VMware%20Horizon%20servers%20running%20versions%20affected%20by%20Log4Shell%20vulnerabilities%20-%20Checkmate&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEABAAAAAC~&jid=1680824089&gjid=3004159&cid=406244357.1658586083&tid=UA-131749944-1&_gid=2000754838.1658586083&_r=1&_slc=1&z=2029179187
Requested by
Host: google-analytics.com
URL: https://google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://niiconsulting.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sat, 23 Jul 2022 14:21:25 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://niiconsulting.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
/
s0.wp.com/_static/ Frame C210 		20 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/_static/??/wp-content/js/mobile-useragent-info.js,/wp-content/js/rlt-proxy.js,/wp-content/mu-plugins/videopress/js/videopress-token-bridge.js?m=1652791886j
Requested by
Host: jetpack.wordpress.com
URL: https://jetpack.wordpress.com/jetpack-comment/?blogid=9704473&postid=4247&comment_registration=0&require_name_email=1&stc_enabled=1&stb_enabled=1&show_avatars=1&avatar_default=mystery&greeting=Leave+a+Comment&greeting_reply=Leave+a+Reply+to+%25s&color_scheme=light&lang=en_US&jetpack_version=8.4.3&show_cookie_consent=10&has_cookie_consent=0&token_key=%3Bnormal%3B&sig=2a3bbe85abe489da41e5444b763962a1d23486b4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
6d9a8dd8d00b628a69a5129ca4883616dc446dc855855147815060486b5a3964

Request headers

Referer
https://jetpack.wordpress.com/
Origin
https://jetpack.wordpress.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Sat, 23 Jul 2022 14:21:25 GMT
content-encoding
br
last-modified
Tue, 17 May 2022 12:51:39 GMT
server
nginx
etag
W/"62839a5b-5039"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
x-ac
2.hhn _dca
timing-allow-origin
*
expires
Wed, 17 May 2023 12:59:55 GMT
style.css
s0.wp.com/wp-content/mu-plugins/highlander-comments/ Frame C210 		17 KB
3 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/mu-plugins/highlander-comments/style.css?m=1650315457h&cssminify=yes
Requested by
Host: jetpack.wordpress.com
URL: https://jetpack.wordpress.com/jetpack-comment/?blogid=9704473&postid=4247&comment_registration=0&require_name_email=1&stc_enabled=1&stb_enabled=1&show_avatars=1&avatar_default=mystery&greeting=Leave+a+Comment&greeting_reply=Leave+a+Reply+to+%25s&color_scheme=light&lang=en_US&jetpack_version=8.4.3&show_cookie_consent=10&has_cookie_consent=0&token_key=%3Bnormal%3B&sig=2a3bbe85abe489da41e5444b763962a1d23486b4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
da6ea6515dc1993e6e9915f88decf7bf8ca37d088b315d795f09bfea48f8a760

Request headers

Referer
https://jetpack.wordpress.com/
Origin
https://jetpack.wordpress.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Sat, 23 Jul 2022 14:21:25 GMT
content-encoding
br
server
nginx
etag
W/"625dd0cd-54bf"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
text/css
access-control-allow-origin
*
cache-control
max-age=31536000
x-ac
2.hhn _dca
timing-allow-origin
*
expires
Tue, 18 Apr 2023 20:57:53 GMT
ad516503a11cd5ca435acc9bb6523536
1.gravatar.com/avatar/ Frame C210 		439 B
613 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://1.gravatar.com/avatar/ad516503a11cd5ca435acc9bb6523536?s=25
Requested by
Host: jetpack.wordpress.com
URL: https://jetpack.wordpress.com/jetpack-comment/?blogid=9704473&postid=4247&comment_registration=0&require_name_email=1&stc_enabled=1&stb_enabled=1&show_avatars=1&avatar_default=mystery&greeting=Leave+a+Comment&greeting_reply=Leave+a+Reply+to+%25s&color_scheme=light&lang=en_US&jetpack_version=8.4.3&show_cookie_consent=10&has_cookie_consent=0&token_key=%3Bnormal%3B&sig=2a3bbe85abe489da41e5444b763962a1d23486b4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
d3ddd29db765914b449b4573e5a3c24e1982838d9f55befd894cb73333f8149a

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://jetpack.wordpress.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Sat, 23 Jul 2022 14:21:25 GMT
last-modified
Sat, 01 Mar 2008 02:44:06 GMT
server
nginx
content-type
image/png
access-control-allow-origin
*
cache-control
max-age=300
content-disposition
inline; filename="ad516503a11cd5ca435acc9bb6523536.png"
accept-ranges
bytes
link
<https://www.gravatar.com/avatar/ad516503a11cd5ca435acc9bb6523536?s=25>; rel="canonical"
content-length
439
expires
Sat, 23 Jul 2022 14:26:25 GMT
gprofiles.js
0.gravatar.com/js/ Frame C210 		23 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://0.gravatar.com/js/gprofiles.js?ver=202229z
Requested by
Host: jetpack.wordpress.com
URL: https://jetpack.wordpress.com/jetpack-comment/?blogid=9704473&postid=4247&comment_registration=0&require_name_email=1&stc_enabled=1&stb_enabled=1&show_avatars=1&avatar_default=mystery&greeting=Leave+a+Comment&greeting_reply=Leave+a+Reply+to+%25s&color_scheme=light&lang=en_US&jetpack_version=8.4.3&show_cookie_consent=10&has_cookie_consent=0&token_key=%3Bnormal%3B&sig=2a3bbe85abe489da41e5444b763962a1d23486b4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
b8ddfe2786718750e37a2a7d2841e4e6a110a1877e21a03675d47c591d4a7f03

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://jetpack.wordpress.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Sat, 23 Jul 2022 14:21:25 GMT
content-encoding
br
last-modified
Fri, 25 Feb 2022 16:03:16 GMT
server
nginx
etag
W/"6218fdc4-5df8"
content-type
application/javascript
cache-control
max-age=604800
expires
Sat, 30 Jul 2022 14:21:25 GMT
wpgroho.js
s0.wp.com/wp-content/mu-plugins/gravatar-hovercards/ Frame C210 		868 B
452 B 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-content/mu-plugins/gravatar-hovercards/wpgroho.js?m=1610363240h
Requested by
Host: jetpack.wordpress.com
URL: https://jetpack.wordpress.com/jetpack-comment/?blogid=9704473&postid=4247&comment_registration=0&require_name_email=1&stc_enabled=1&stb_enabled=1&show_avatars=1&avatar_default=mystery&greeting=Leave+a+Comment&greeting_reply=Leave+a+Reply+to+%25s&color_scheme=light&lang=en_US&jetpack_version=8.4.3&show_cookie_consent=10&has_cookie_consent=0&token_key=%3Bnormal%3B&sig=2a3bbe85abe489da41e5444b763962a1d23486b4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
9a90398fe43db7f3effe146858ff7f8c16d1402a2d28090223edd0c50da27087

Request headers

Referer
https://jetpack.wordpress.com/
Origin
https://jetpack.wordpress.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Sat, 23 Jul 2022 14:21:25 GMT
content-encoding
br
server
nginx
etag
W/"5ffc31a9-465"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
x-ac
2.hhn _dca
timing-allow-origin
*
expires
Thu, 10 Nov 2022 15:12:13 GMT
/
s0.wp.com/_static/ Frame C210 		41 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/_static/??/wp-content/js/textarea-autosize.min.js,/wp-content/mu-plugins/highlander-comments/script.js?m=1649873911j
Requested by
Host: jetpack.wordpress.com
URL: https://jetpack.wordpress.com/jetpack-comment/?blogid=9704473&postid=4247&comment_registration=0&require_name_email=1&stc_enabled=1&stb_enabled=1&show_avatars=1&avatar_default=mystery&greeting=Leave+a+Comment&greeting_reply=Leave+a+Reply+to+%25s&color_scheme=light&lang=en_US&jetpack_version=8.4.3&show_cookie_consent=10&has_cookie_consent=0&token_key=%3Bnormal%3B&sig=2a3bbe85abe489da41e5444b763962a1d23486b4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
086d3d4f7c60faf9c9a1ee985ea35eca47e4542fe35db24754c26894639dc9a0

Request headers

Referer
https://jetpack.wordpress.com/
Origin
https://jetpack.wordpress.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Sat, 23 Jul 2022 14:21:25 GMT
content-encoding
br
last-modified
Wed, 13 Apr 2022 18:18:44 GMT
server
nginx
etag
W/"62571404-a4af"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
x-ac
2.hhn _dca
timing-allow-origin
*
expires
Thu, 13 Apr 2023 18:18:49 GMT
/
s0.wp.com/_static/ Frame C210 		28 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/_static/??-eJx9i0EOwjAMwD5Elo0xxAXxFBTaAFmbMJpWfJ+JAyfEzbJsfC0QHlbZKmqDJbebmGOWxI7Pxo3vZDFz6Wbf4O+YoorBhQoqeeWyEtRCIfm/KYkrVxi7Hs9i4Suu5RPH9T3pcdhP02449NtxfgOlcD5P
Requested by
Host: jetpack.wordpress.com
URL: https://jetpack.wordpress.com/jetpack-comment/?blogid=9704473&postid=4247&comment_registration=0&require_name_email=1&stc_enabled=1&stb_enabled=1&show_avatars=1&avatar_default=mystery&greeting=Leave+a+Comment&greeting_reply=Leave+a+Reply+to+%25s&color_scheme=light&lang=en_US&jetpack_version=8.4.3&show_cookie_consent=10&has_cookie_consent=0&token_key=%3Bnormal%3B&sig=2a3bbe85abe489da41e5444b763962a1d23486b4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
cc20c6122d25d078969c82fb58e39ed7d797d6fba046b699faf8844c7f1f008e

Request headers

Referer
https://jetpack.wordpress.com/
Origin
https://jetpack.wordpress.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Sat, 23 Jul 2022 14:21:25 GMT
content-encoding
br
last-modified
Thu, 16 Jun 2022 22:20:36 GMT
server
nginx
etag
W/"62abacb4-6eda"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
x-ac
2.hhn _dca
timing-allow-origin
*
expires
Fri, 16 Jun 2023 22:20:40 GMT
wp-emoji-release.min.js
s0.wp.com/wp-includes/js/ Frame C210 		18 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s0.wp.com/wp-includes/js/wp-emoji-release.min.js?m=1652185836h&ver=6.0.1-alpha-53658
Requested by
Host: jetpack.wordpress.com
URL: https://jetpack.wordpress.com/jetpack-comment/?blogid=9704473&postid=4247&comment_registration=0&require_name_email=1&stc_enabled=1&stb_enabled=1&show_avatars=1&avatar_default=mystery&greeting=Leave+a+Comment&greeting_reply=Leave+a+Reply+to+%25s&color_scheme=light&lang=en_US&jetpack_version=8.4.3&show_cookie_consent=10&has_cookie_consent=0&token_key=%3Bnormal%3B&sig=2a3bbe85abe489da41e5444b763962a1d23486b4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://jetpack.wordpress.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Sat, 23 Jul 2022 14:21:25 GMT
content-encoding
br
server
nginx
etag
W/"627a5af9-48b9"
vary
Accept-Encoding
access-control-allow-methods
GET, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=31536000
x-ac
2.hhn _dca
timing-allow-origin
*
expires
Wed, 12 Jul 2023 17:02:07 GMT
collect
stats.g.doubleclick.net/j/ 		4 B
443 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-131749944-1&cid=406244357.1658586083&jid=1680824089&gjid=3004159&_gid=2000754838.1658586083&_u=IEBAAEAAAAAAAC~&z=2086095920
Requested by
Host: google-analytics.com
URL: https://google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c07::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://niiconsulting.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Sat, 23 Jul 2022 14:21:25 GMT
content-type
text/plain
access-control-allow-origin
https://niiconsulting.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
button-back.gif
s0.wp.com/wp-content/mu-plugins/highlander-comments/images/ Frame C210 		1 KB
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://s0.wp.com/wp-content/mu-plugins/highlander-comments/images/button-back.gif
Requested by
Host: s0.wp.com
URL: https://s0.wp.com/wp-content/mu-plugins/highlander-comments/style.css?m=1650315457h&cssminify=yes
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.32 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
wordpress.com
Software
nginx /
Resource Hash
0dab369eac5fd3a06420395d02d292bc3e3ab0bf62add857c72804fd9f4edd35

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://s0.wp.com/wp-content/mu-plugins/highlander-comments/style.css?m=1650315457h&cssminify=yes
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Sat, 23 Jul 2022 14:21:25 GMT
x-ac
2.hhn _dca
last-modified
Thu, 29 Nov 2018 13:53:31 GMT
server
nginx
etag
"5bffef5b-4d0"
access-control-allow-methods
GET, HEAD
content-type
image/gif
access-control-allow-origin
*
cache-control
max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
content-length
1232
expires
Thu, 10 Nov 2022 15:12:13 GMT
hovercard.min.css
0.gravatar.com/dist/css/ Frame C210 		8 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://0.gravatar.com/dist/css/hovercard.min.css?ver=202229z
Requested by
Host: 0.gravatar.com
URL: https://0.gravatar.com/js/gprofiles.js?ver=202229z
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1a0b51af7ff79f11c0a779bf478304fa451ac5587675952b8378b47f0a97504d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://jetpack.wordpress.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Sat, 23 Jul 2022 14:21:25 GMT
content-encoding
br
last-modified
Wed, 11 Nov 2020 15:57:10 GMT
server
nginx
etag
W/"5fac09d6-1e86"
content-type
text/css
cache-control
max-age=604800
expires
Sat, 30 Jul 2022 14:21:25 GMT
services.min.css
0.gravatar.com/dist/css/ Frame C210 		3 KB
582 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://0.gravatar.com/dist/css/services.min.css?ver=202229z
Requested by
Host: 0.gravatar.com
URL: https://0.gravatar.com/js/gprofiles.js?ver=202229z
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e9fc9b1878db1b13b973252b048d19a17abb34a8da464a552c6d401728ed1e86

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://jetpack.wordpress.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Sat, 23 Jul 2022 14:21:25 GMT
content-encoding
br
last-modified
Thu, 22 Mar 2018 09:46:04 GMT
server
nginx
etag
W/"5ab37b5c-a54"
content-type
text/css
cache-control
max-age=604800
expires
Sat, 30 Jul 2022 14:21:25 GMT
ga-audiences
www.google.com/ads/ 		42 B
501 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-131749944-1&cid=406244357.1658586083&jid=1680824089&_u=IEBAAEAAAAAAAC~&z=2146750470
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:803::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 23 Jul 2022 14:21:25 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/ 		42 B
501 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-131749944-1&cid=406244357.1658586083&jid=1680824089&_u=IEBAAEAAAAAAAC~&z=2146750470
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 23 Jul 2022 14:21:25 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
widgets.js
platform.twitter.com/ 		96 KB
29 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/widgets.js
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/wp-content/plugins/jetpack/_inc/build/twitter-timeline.min.js?ver=4.0.0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/6727) /
Resource Hash
ccaf59e06eb4f607fdedb30b166d8ab31ae2f92eaf4a2f998504204f1a2bf526

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Date
Sat, 23 Jul 2022 14:21:26 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Age
162
X-Cache
HIT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server-Timing
x-cache;desc= HIT,x-tw-cdn;desc=,edge;dur=1
Content-Length
29212
x-tw-cdn
VZ
Last-Modified
Tue, 19 Jul 2022 20:07:06 GMT
Server
ECS (frb/6727)
Etag
"3b16e031477759af620cd0de990c6783+gzip"
Access-Control-Max-Age
3000
Access-Control-Allow-Methods
GET
Content-Type
application/javascript; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=1800
g.gif
pixel.wp.com/ 		50 B
116 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.wp.com/g.gif?v=ext&j=1%3A8.4.3&blog=9704473&post=4247&tz=5.5&srv=niiconsulting.com&host=niiconsulting.com&ref=&fcp=2987&rand=0.6354316053559523
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

access-control-allow-origin
*
date
Sat, 23 Jul 2022 14:21:26 GMT
cache-control
no-cache
server
nginx
content-length
50
content-type
image/gif
hovercard.min.css
secure.gravatar.com/dist/css/ 		8 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://secure.gravatar.com/dist/css/hovercard.min.css?ver=202229
Requested by
Host: secure.gravatar.com
URL: https://secure.gravatar.com/js/gprofiles.js?ver=202229
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
1a0b51af7ff79f11c0a779bf478304fa451ac5587675952b8378b47f0a97504d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Sat, 23 Jul 2022 14:21:26 GMT
content-encoding
br
last-modified
Wed, 11 Nov 2020 15:57:10 GMT
server
nginx
etag
W/"5fac09d6-1e86"
content-type
text/css
cache-control
max-age=604800
expires
Sat, 30 Jul 2022 14:21:26 GMT
services.min.css
secure.gravatar.com/dist/css/ 		3 KB
545 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://secure.gravatar.com/dist/css/services.min.css?ver=202229
Requested by
Host: secure.gravatar.com
URL: https://secure.gravatar.com/js/gprofiles.js?ver=202229
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
e9fc9b1878db1b13b973252b048d19a17abb34a8da464a552c6d401728ed1e86

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Sat, 23 Jul 2022 14:21:26 GMT
content-encoding
br
last-modified
Thu, 22 Mar 2018 09:46:04 GMT
server
nginx
etag
W/"5ab37b5c-a54"
content-type
text/css
cache-control
max-age=604800
expires
Sat, 30 Jul 2022 14:21:26 GMT
/
niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/ 		3 KB
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/?relatedposts=1
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
166.62.10.188 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-10-188.ip.secureserver.net
Software
Apache / PHP/5.6.40
Resource Hash
c67967f6124f29865457b6155203513d46327b5216dcaf0d0adce68603d938ae
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Sat, 23 Jul 2022 14:21:26 GMT
content-encoding
br
x-content-type-options
nosniff
server
Apache
x-powered-by
PHP/5.6.40
x-pingback
https://niiconsulting.com/checkmate/xmlrpc.php
content-type
application/json; charset=utf-8
cache-control
max-age=2592000
vary
Accept-Encoding,User-Agent
content-length
1128
expires
Mon, 22 Aug 2022 14:21:26 GMT
truncated
/ 		234 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
0d7cd639c89358f19d898c0f407c362e22f9f3efb8f419bb35ede15d184daa71

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

Content-Type
image/svg+xml;charset=utf8
NI-Logo-final-hori-clr-w-wht-1-e1650277669699.png
i1.wp.com/niiconsulting.com/checkmate/wp-content/uploads/2022/04/ 		8 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i1.wp.com/niiconsulting.com/checkmate/wp-content/uploads/2022/04/NI-Logo-final-hori-clr-w-wht-1-e1650277669699.png?w=479&ssl=1
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
b270a8d9569df0f6580c090525274e777efff6e866e9ec876596f73163d44f82
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Sat, 23 Jul 2022 14:21:26 GMT
x-content-type-options
nosniff
last-modified
Mon, 18 Apr 2022 13:48:20 GMT
server
nginx
etag
"6ae20bd0bcd79333"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://niiconsulting.com/checkmate/wp-content/uploads/2022/04/NI-Logo-final-hori-clr-w-wht-1-e1650277669699.png>; rel="canonical"
content-length
8508
expires
Thu, 18 Apr 2024 01:48:20 GMT
widget_iframe.dc05643fdb8d0e2b89e5cc3c1d26d1b5.html
platform.twitter.com/widgets/ Frame 534C 		320 KB
104 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://platform.twitter.com/widgets/widget_iframe.dc05643fdb8d0e2b89e5cc3c1d26d1b5.html?origin=https%3A%2F%2Fniiconsulting.com
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2606:2800:234:59:254c:406:2366:268c , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/67C0) /
Resource Hash
4002d65e95f94dc87ae8ad170eb8dbc3644921032ac76dcb376537d9304a6fbf

Request headers

Referer
https://niiconsulting.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Access-Control-Allow-Methods
GET
Access-Control-Allow-Origin
*
Age
324721
Cache-Control
public, max-age=315360000
Content-Encoding
gzip
Content-Length
105435
Content-Type
text/html; charset=utf-8
Date
Sat, 23 Jul 2022 14:21:26 GMT
Etag
"95e1b50b0c179aefb47b5b211bb347b5+gzip"
Last-Modified
Tue, 19 Jul 2022 20:05:03 GMT
P3P
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
Server
ECS (frb/67C0)
Server-Timing
x-cache;desc= HIT,x-tw-cdn;desc=,edge;dur=1
Vary
Accept-Encoding
X-Cache
HIT
x-tw-cdn
VZ
settings
syndication.twitter.com/ Frame 534C 		580 B
541 B 		Fetch
General
Check archive.org
Download Go to
Full URL
https://syndication.twitter.com/settings?session_id=04dfa06f115c533c6d076564bfc2a71a406f7a19
Requested by
Host: platform.twitter.com
URL: https://platform.twitter.com/widgets/widget_iframe.dc05643fdb8d0e2b89e5cc3c1d26d1b5.html?origin=https%3A%2F%2Fniiconsulting.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.8 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
a502f79cb5fa985d8b516eeb3b2ce66e500731cd1999e64b3bb1cb035e784f66
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://platform.twitter.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-response-time
118
date
Sat, 23 Jul 2022 14:21:26 GMT
content-encoding
gzip
last-modified
Sat, 23 Jul 2022 14:21:26 GMT
server
tsa_o
vary
Origin
strict-transport-security
max-age=631138519
content-type
application/json; charset=utf-8
access-control-allow-origin
https://platform.twitter.com
cache-control
must-revalidate, max-age=600
access-control-allow-credentials
true
x-connection-hash
b9231555eef8924cbe4e6b5b761d5c9f0af46c696623e598a6bf77ad00b32cbd
content-length
260
admin-ajax.php
niiconsulting.com/checkmate/wp-admin/ 		439 B
363 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://niiconsulting.com/checkmate/wp-admin/admin-ajax.php?action=heateor_sss_sharing_count&urls%5B%5D=https%3A%2F%2Fniiconsulting.com%2Fcheckmate%2F2022%2F02%2Fthreat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities%2F
Requested by
Host: niiconsulting.com
URL: https://niiconsulting.com/checkmate/wp-includes/js/jquery/jquery.min.js?ver=3.6.0
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
166.62.10.188 Singapore, Singapore, ASN26496 (AS-26496-GO-DADDY-COM-LLC, US),
Reverse DNS
ip-166-62-10-188.ip.secureserver.net
Software
Apache / PHP/5.6.40
Resource Hash
448a8d42cb6463e9ac7a29ff5ec7c2c1980b12c499d47f4831d48bffbe4df3cd
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

Accept
application/json, text/javascript, */*; q=0.01
Referer
https://niiconsulting.com/checkmate/2022/02/threat-actor-groups-are-targeting-vmware-horizon-servers-running-versions-affected-by-log4shell-vulnerabilities/
X-Requested-With
XMLHttpRequest
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

date
Sat, 23 Jul 2022 14:21:26 GMT
content-encoding
br
referrer-policy
strict-origin-when-cross-origin
server
Apache
x-powered-by
PHP/5.6.40
x-frame-options
SAMEORIGIN
content-type
application/json
cache-control
no-cache, must-revalidate, max-age=0
x-robots-tag
noindex
vary
Accept-Encoding,User-Agent
content-length
192
x-content-type-options
nosniff
expires
Wed, 11 Jan 1984 05:00:00 GMT
image.png
i0.wp.com/niiconsulting.com/checkmate/wp-content/uploads/2022/02/ 		68 KB
68 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i0.wp.com/niiconsulting.com/checkmate/wp-content/uploads/2022/02/image.png?resize=350%2C200&ssl=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
4378df79c30db8d8e135110545824475aee83d24eb0b144b5ac13273b98d59b2
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-nc
HIT hhn 4
date
Sat, 23 Jul 2022 14:21:27 GMT
x-content-type-options
nosniff
last-modified
Thu, 03 Feb 2022 10:40:30 GMT
server
nginx
etag
"e6cad8c0997105f9"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://niiconsulting.com/checkmate/wp-content/uploads/2022/02/image.png>; rel="canonical"
content-length
69166
expires
Sat, 03 Feb 2024 22:40:30 GMT
2018-03-01-WordPress-Supply-Chain-Attacks1.png
i1.wp.com/niiconsulting.com/checkmate/wp-content/uploads/2022/02/ 		6 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://i1.wp.com/niiconsulting.com/checkmate/wp-content/uploads/2022/02/2018-03-01-WordPress-Supply-Chain-Attacks1.png?fit=1200%2C628&ssl=1&resize=350%2C200
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
192.0.77.2 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
i1.wp.com
Software
nginx /
Resource Hash
9b58e5c4a804dab10721c28d3dbdd45c8e0daeb316022e5f04525583fffbf139
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://niiconsulting.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.134 Safari/537.36

Response headers

x-nc
HIT hhn 2
date
Sat, 23 Jul 2022 14:21:27 GMT
x-content-type-options
nosniff
last-modified
Tue, 01 Mar 2022 20:54:36 GMT
server
nginx
etag
"4e0ade7712bc53d0"
vary
Accept
access-control-allow-methods
GET, HEAD
content-type
image/webp
access-control-allow-origin
*
cache-control
public, max-age=63115200
timing-allow-origin
*
link
<https://niiconsulting.com/checkmate/wp-content/uploads/2022/02/2018-03-01-WordPress-Supply-Chain-Attacks1.png>; rel="canonical"
content-length
6560
expires
Fri, 01 Mar 2024 08:54:36 GMT

Verdicts & Comments Add Verdict or Comment

156 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| oncontextlost object| oncontextrestored function| structuredClone object| launchQueue object| onbeforematch function| getScreenDetails function| queryLocalFonts object| navigation undefined| $ function| jQuery object| related_posts_js_options object| html5 object| Modernizr function| yepnope object| object function| Total_Soft_GV_LVG_Page function| Total_Soft_GV_LVG_PageP function| Total_Soft_GV_LVG_PageN function| Total_Soft_GV_LVG_PageLM function| Total_Soft_GV_TV_Page function| Total_Soft_GV_TV_PageP function| Total_Soft_GV_TV_PageN function| Total_Soft_GV_TV_PageLM function| Total_Soft_GV_CP_Page function| Total_Soft_GV_CP_PageP function| Total_Soft_GV_CP_PageN function| Total_Soft_GV_CP_PageLM function| Total_Soft_GV_HLG_Page function| Total_Soft_GV_HLG_PageP function| Total_Soft_GV_HLG_PageN function| Total_Soft_GV_HLG_PageLM function| Total_Soft_GV_FG_Page function| Total_Soft_GV_FG_PageP function| Total_Soft_GV_FG_PageN function| Total_Soft_GV_FG_PageLM function| Total_Soft_GV_PE_Page function| Total_Soft_GV_PE_PageP function| Total_Soft_GV_PE_PageN function| Total_Soft_GV_PE_PageLM function| Total_Soft_GV_CG_Page function| Total_Soft_GV_CG_PageP function| Total_Soft_GV_CG_PageN function| Total_Soft_GV_CG_PageLM function| TS_GV_XG_Video_Play function| TS_GV_XG_PageP function| TS_GV_XG_PageN function| TS_GV_XG_Page function| TS_GV_XG_PageLM function| TS_GV_GA_PageP function| TS_GV_GA_PageN function| TS_GV_GA_Page function| TS_GV_GA_PageLM object| st object| __stdos__ boolean| tpcCookiesEnableCheckingDone boolean| tpcCookiesEnabledStatus function| __sharethis__docReady object| __sharethis__ string| GoogleAnalyticsObject function| ga object| google_tag_data object| gaplugins object| gaGlobal object| gaData object| Gravatar object| GProfile number| hexcase string| b64pad number| chrsz function| hex_md5 function| b64_md5 function| str_md5 function| hex_hmac_md5 function| b64_hmac_md5 function| str_hmac_md5 function| md5_vm_test function| core_md5 function| md5_cmn function| md5_ff function| md5_gg function| md5_hh function| md5_ii function| core_hmac_md5 function| safe_add function| bit_rol function| str2binl function| binl2str function| binl2hex function| binl2b64 object| WPGroHo object| addComment function| heateorSssLoadEvent string| heateorSssSharingAjaxUrl string| heateorSssCloseIconPath string| heateorSssPluginIconPath number| heateorSssHorizontalSharingCountEnable number| heateorSssVerticalSharingCountEnable number| heateorSssSharingOffset number| heateorSssMobileStickySharingEnabled string| heateorSssCopyLinkMessage boolean| heateorSssReduceVerticalSvgHeight object| heateorSssUrlCountFetched string| heateorSssSharesText string| heateorSssShareText function| heateorSssPopup string| heateorSssWhatsappShareAPI function| heateorSssCallAjax function| heateorSssGetScript function| heateorSssDetermineWhatsappShareAPI function| heateorSssMoreSharingPopup function| heateorSssFilterSharing object| heateorSssFacebookTargetUrls function| heateorSssGetSharingCounts function| heateorSssFetchFacebookShares function| heateorSssFBShareJSONCall function| heateorSssSaveFacebookShares function| heateorSssCalculateApproxCount function| heateorSssCalculateActualCount function| heateorSssCapitaliseFirstLetter function| heateorSssHideSharing function| ClipboardJS function| jetpackLazyImagesModule object| NO_JQUERY function| pm object| Jetpack object| jetpackLikesWidgetBatch boolean| jetpackLikesMasterReady number| jetpackLikesLookAhead object| jetpackCommentLikesLoadedWidgets function| JetpackLikesPostMessage function| JetpackLikesBatchHandler function| JetpackLikesMessageListener function| JetpackLikesWidgetQueueHandler function| jetpackLoadLikeWidgetIframe function| jetpackGetUnloadedWidgetsInView function| jetpackIsScrolledIntoView function| jetpackUnloadScrolledOutWidgets function| jetpackWidgetsDelayedExec function| jetpackOnScrollStopped object| _stq object| ak_js object| commentForm undefined| replyRowContainer undefined| children function| st_go function| linktracker_init object| wpcom string| hash string| new_css object| data object| __twttrll object| twttr object| __twttr

4 Cookies

Domain/Path Name / Value
.niiconsulting.com/ Name: _ga
Value: GA1.2.406244357.1658586083
.niiconsulting.com/ Name: _gid
Value: GA1.2.2000754838.1658586083
.niiconsulting.com/ Name: _gat
Value: 1
.wordpress.com/ Name: wpcom_highlander_3pc_check
Value: 1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

0.gravatar.com
1.gravatar.com
buttons-config.sharethis.com
fonts.googleapis.com
fonts.gstatic.com
google-analytics.com
i0.wp.com
i1.wp.com
i2.wp.com
jetpack.wordpress.com
l.sharethis.com
niiconsulting.com
pixel.wp.com
platform-api.sharethis.com
platform.twitter.com
s0.wp.com
secure.gravatar.com
stats.g.doubleclick.net
stats.wp.com
syndication.twitter.com
www.google-analytics.com
www.google.com
www.google.de
104.244.42.8
108.157.4.87
166.62.10.188
18.196.212.55
192.0.76.3
192.0.77.2
192.0.77.32
192.0.78.32
2600:9000:2156:e200:c:abe:f440:93a1
2606:2800:234:59:254c:406:2366:268c
2a00:1450:4001:803::2004
2a00:1450:4001:80e::2004
2a00:1450:4001:812::200e
2a00:1450:4001:828::2003
2a00:1450:4001:82a::2003
2a00:1450:4001:82a::200a
2a00:1450:400c:c07::9c
2a04:fa87:fffe::c000:4902
0246217e13d0de5f14e4ff38a51761d8ab80698420ac6ead729c62cac07b4d32
029e0a2e809fd6b5dbe76abe8b7a74936be306c9a8c27c814c4d44aa54623300
034a3b4edad62ee67e2010cb81b06311e564d75d1fef29a256a6ab9b86000db9
04e107d701fdd6867cb72ba7ceaf313bd068ae7959ec429cab8449d96c30beff
0515cbd1f8aee97e1c8e0d1d015ca96c86def13e90d2e73bf813072ccc23d531
086d3d4f7c60faf9c9a1ee985ea35eca47e4542fe35db24754c26894639dc9a0
0d7cd639c89358f19d898c0f407c362e22f9f3efb8f419bb35ede15d184daa71
0dab369eac5fd3a06420395d02d292bc3e3ab0bf62add857c72804fd9f4edd35
16f708e5165a9e2302fec421f8f9d341e3f66a0954a5b7c962460406c7f2be4e
171b7dba0375ac8de65674eb83d3672316c431ef53491d2e2f25b2ffe40091ad
1a0b51af7ff79f11c0a779bf478304fa451ac5587675952b8378b47f0a97504d
256bc98392b0add1fa36e5103e7b00332e2cefbc7810c6f8713f59ac7ecdbd14
265c34f4c62e6423e270cecb0c422b735dfb0f18cea04c2ac343b6f22106661e
291b553dee180f838e513bf2580c9af27f8312320581e3c91029a7c4d5eb2fbc
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2c29defe29114d0e8b948e78d50ebb281035df53a9167089deb1e77e801bbd2f
2c5b024ac47363f4d7bb9f9ba156f11847254f45d37783068345e1217ce3fd25
394f9454b8a43a936c6b6a8f0eaf70a44510c528f0b074431600d1db851b998c
4002d65e95f94dc87ae8ad170eb8dbc3644921032ac76dcb376537d9304a6fbf
42d8ef8ce6bdaa5296ac14f903b01a75f53d57c0fa97b1ef8e24c55ffd96c5f9
4378df79c30db8d8e135110545824475aee83d24eb0b144b5ac13273b98d59b2
448a8d42cb6463e9ac7a29ff5ec7c2c1980b12c499d47f4831d48bffbe4df3cd
506a05dfe581727e7be2d16e58aa23d53c01f8ed599d6722b2e31da690467521
54c9560cb0117d8d1f955aefe0f88b843517964e118512d8f1a224a8a9b662f4
5aad5fbd4238981a9ff5e2772ff1353dfe1a801fb49542fe157418c1438f7782
5f11d760b95996de434261d5da9df76778ac14fbf41ba2bcba128d910208a726
6094c4966b779bf91e2461773e30cb0dc965642321826ba0a54c6ae8dbdf0d89
649efd3b18f3e9c03757831a8a192077b72fb32547f25d9746954c4348594aa8
6b50c38c85106ae73f87baf91c0daff52edb51447fcd4bf45e216bf59701360d
6d9a8dd8d00b628a69a5129ca4883616dc446dc855855147815060486b5a3964
71275c06e498f0aa672ac51e995d317cf07f26295d9ec48adebb000df8b3e7f8
73da6615c62f187dc1afd7bf6eb024917b20d5848ffeef08863aa7ef2ce8164f
799aeb25cc0373fdee0e1b1db7ad6c2f6a0e058dfadaa3379689f583213190bd
7f8fc2a8f340314b8c37cf2e52c17df22e0b6e756625c61dd87f650ee28fdb37
82d0aae1e7b8cfc0574d6548d1f35096f5e4310321aa964ff3fdb46c4d12e302
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
934dc3a005115ead8f70eada94b6cb246064ed87e8b8694f1531e1582b8e7136
96cae96a73c65ceed190aa0b4a9a86f0233798e9a17f27ca57855f4f79ebf678
9a6d5096068784e4493f9b3a5d4226b12c966fbcc43d7ab1007d9f0dd9025f49
9a90398fe43db7f3effe146858ff7f8c16d1402a2d28090223edd0c50da27087
9b58e5c4a804dab10721c28d3dbdd45c8e0daeb316022e5f04525583fffbf139
9b916efba0b8f57387c719705638df1b083ebfc41a965eac2dce051f9ec78dfa
9d7da1b980a95ff3d31d0bb8733cbabd1d210ec601d15a1aac2b67394a33191d
a10b9570a1c7858442b42f1cd48b69a191638269f37e4046607bf5fe188e38bf
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a23dec87ea93f923ebe233e63f7c43d1a130ccf1578d97ea758157aae6d108e3
a30e56d61eca910f4e795e2920fc61671bd378f9a7a9f40a44e5869343a0bf89
a46f378dd4dbc81f508eae0dfcd2a404491dd8c757d8c982370bc6002f4b7fff
a502f79cb5fa985d8b516eeb3b2ce66e500731cd1999e64b3bb1cb035e784f66
a658b2be7323c57d4bd5c4197b657e1f5360d1b950131dc377efec1d5111ffd0
aa921fb6024171c8f0a61ffa4413a8ed81dc6eaff2ac679e424b2e17c2aaa4f7
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b270a8d9569df0f6580c090525274e777efff6e866e9ec876596f73163d44f82
b8ddfe2786718750e37a2a7d2841e4e6a110a1877e21a03675d47c591d4a7f03
b980f62a2d545d64f24e6f96902c8fbf5da0018569c369bc18f9e5b5fcf099ed
bd4de6a3fc0fb68d6f76ba7b93514b96a92e585c295b5351c31ad92a4b0777ea
c2e8b4fba49f90cfca5a43371c09879aed7447e0ba2ed4abd75b81448776c4f7
c67967f6124f29865457b6155203513d46327b5216dcaf0d0adce68603d938ae
c873718c2f520f4568851388561dc337aa6af0063b6d5b3bc94e7680fa7b7e61
c8d9e21627befeb273e3a2b0c1f59aa70037b7503dace354a6eadfea772c1952
ca775cd8ab837239f9497e8afe90403d78cb37581c0adfe4003012d24bea020e
cc20c6122d25d078969c82fb58e39ed7d797d6fba046b699faf8844c7f1f008e
cc6254f5ea4094e192858c5ccea69459f0a60307a4658d9409b499450ab3a9e7
ccaf59e06eb4f607fdedb30b166d8ab31ae2f92eaf4a2f998504204f1a2bf526
cdbdaa122823601390c7dcbdd1afde33c2f1a432b8c5ff025c6137ee99ba541a
cec99fc609bb4dee7c020a9d39740f81b79795f4d18458862f71d952f2f79041
d28fba61eab8451e00f6381079841111b9c8076602c19619aa03019c9690b7eb
d3ddd29db765914b449b4573e5a3c24e1982838d9f55befd894cb73333f8149a
d6d7ea9ba6ef9165d09afe103e6804525c15cc8823b9409c7dfe3cd4af71605d
da6ea6515dc1993e6e9915f88decf7bf8ca37d088b315d795f09bfea48f8a760
dfb7cbbc8d0dbbc9f6a29058c0d4d1f5761c16114868b5e9f68cdd62bd73c462
e1b0066bc1972444c0a15e1778be06ed7bf36c55d597c065b5e79041bcda291e
e379a211e75642755c7b975859d84ebf76697490618e8a6127a41036ef82f2df
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e9fc9b1878db1b13b973252b048d19a17abb34a8da464a552c6d401728ed1e86
ebb0c629fbe930efa5ad30f11a383fe3d87e7332b854ae3e607d8c9ea326789b
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1