unit42.paloaltonetworks.com Open in urlscan Pro
104.69.54.68 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://goo.gl/uAic1X
Effective URL:
https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Submission: On June 11 via manual (June 11th 2024, 9:22:58 pm UTC) from CA — Scanned from CA

Summary HTTP 86 Redirects Links 85 Behaviour Indicators

Summary

This website contacted 12 IPs in 2 countries across 10 domains to perform 86 HTTP transactions. The main IP is 104.69.54.68, located in New York, United States and belongs to AKAMAI-AS, US. The main domain is unit42.paloaltonetworks.com. The Cisco Umbrella rank of the primary domain is 802642.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on May 17th 2024. Valid for: a year.

This is the only time unit42.paloaltonetworks.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	172.217.222.100 172.217.222.100	15169 (GOOGLE) (GOOGLE)
2 19	96.7.195.105 96.7.195.105	16625 (AKAMAI-AS) (AKAMAI-AS)
46	104.69.54.68 104.69.54.68	16625 (AKAMAI-AS) (AKAMAI-AS)
3	104.96.164.235 104.96.164.235	16625 (AKAMAI-AS) (AKAMAI-AS)
1	172.217.222.103 172.217.222.103	15169 (GOOGLE) (GOOGLE)
1	172.253.62.95 172.253.62.95	15169 (GOOGLE) (GOOGLE)
1	173.194.68.94 173.194.68.94	15169 (GOOGLE) (GOOGLE)
1 2	100.25.187.49 100.25.187.49	14618 (AMAZON-AES) (AMAZON-AES)
1	146.75.36.157 146.75.36.157	54113 (FASTLY) (FASTLY)
11	104.19.178.52 104.19.178.52	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	172.217.222.147 172.217.222.147	15169 (GOOGLE) (GOOGLE)
1	63.140.38.210 63.140.38.210	14618 (AMAZON-AES) (AMAZON-AES)
1	104.18.32.137 104.18.32.137	13335 (CLOUDFLAR...) (CLOUDFLARENET)
86	12

1 172.217.222.100 (United States) 1 redirects

ASN15169 (GOOGLE, US)
PTR: qi-in-f100.1e100.net

goo.gl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

19 96.7.195.105 (Miami, United States) 2 redirects

ASN16625 (AKAMAI-AS, US)
PTR: a96-7-195-105.deploy.static.akamaitechnologies.com

researchcenter.paloaltonetworks.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.paloaltonetworks.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

46 104.69.54.68 (New York, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a104-69-54-68.deploy.static.akamaitechnologies.com

unit42.paloaltonetworks.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 104.96.164.235 (Ashburn, United States)

ASN16625 (AKAMAI-AS, US)
PTR: a104-96-164-235.deploy.static.akamaitechnologies.com

assets.adobedtm.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.222.103 (United States)

ASN15169 (GOOGLE, US)
PTR: qi-in-f103.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.253.62.95 (United States)

ASN15169 (GOOGLE, US)
PTR: bc-in-f95.1e100.net

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 173.194.68.94 (United States)

ASN15169 (GOOGLE, US)
PTR: qr-in-f94.1e100.net

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 100.25.187.49 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-100-25-187-49.compute-1.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 146.75.36.157 (Reston, United States)

ASN54113 (FASTLY, US)

static.ads-twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 104.19.178.52 (None, )

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.222.147 (United States)

ASN15169 (GOOGLE, US)
PTR: qi-in-f147.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 63.140.38.210 (United States)

ASN14618 (AMAZON-AES, US)
PTR: ip-63-140-38-210.data.adobedc.net

sstats.paloaltonetworks.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.18.32.137 (None, )

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
66	paloaltonetworks.com 2 redirects researchcenter.paloaltonetworks.com www.paloaltonetworks.com — Cisco Umbrella Rank: 125244 unit42.paloaltonetworks.com — Cisco Umbrella Rank: 802642 sstats.paloaltonetworks.com — Cisco Umbrella Rank: 164866	1 MB
11	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 378	190 KB
3	google.com www.google.com — Cisco Umbrella Rank: 5	1 KB
3	adobedtm.com assets.adobedtm.com — Cisco Umbrella Rank: 440	164 KB
2	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 249	1 KB
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 638	306 B
1	ads-twitter.com static.ads-twitter.com — Cisco Umbrella Rank: 881	15 KB
1	gstatic.com www.gstatic.com	204 KB
1	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 77	1 KB
1	goo.gl 1 redirects goo.gl — Cisco Umbrella Rank: 12571	1 KB
86	10

	Domain	Requested by
46	unit42.paloaltonetworks.com	unit42.paloaltonetworks.com
18	www.paloaltonetworks.com	1 redirects unit42.paloaltonetworks.com www.paloaltonetworks.com
11	cdn.cookielaw.org	assets.adobedtm.com cdn.cookielaw.org
3	www.google.com	unit42.paloaltonetworks.com www.gstatic.com
3	assets.adobedtm.com	unit42.paloaltonetworks.com assets.adobedtm.com
2	dpm.demdex.net	1 redirects unit42.paloaltonetworks.com
1	geolocation.onetrust.com	cdn.cookielaw.org
1	sstats.paloaltonetworks.com	assets.adobedtm.com
1	static.ads-twitter.com	assets.adobedtm.com
1	www.gstatic.com	www.google.com
1	fonts.googleapis.com	unit42.paloaltonetworks.com
1	researchcenter.paloaltonetworks.com	1 redirects
1	goo.gl	1 redirects
86	13

This site contains links to these domains. Also see Links.

Domain
www.paloaltonetworks.com
start.paloaltonetworks.com
docs.paloaltonetworks.com
www.facebook.com
www.linkedin.com
www.reddit.com
unit42.paloaltonetworks.jp
twitter.com
www.exploit-monday.com
github.com
autofocus.paloaltonetworks.com
www.symantec.com
www.fireeye.com
blog.paloaltonetworks.com
subt0x10.blogspot.com
www.onetrust.com

Subject Issuer	Validity	Valid
www.paloaltonetworks.com DigiCert TLS RSA SHA256 2020 CA1	`2024-05-17` - `2025-05-16`	a year	crt.sh
*.paloaltonetworks.com DigiCert TLS RSA SHA256 2020 CA1	`2024-03-31` - `2025-04-02`	a year	crt.sh
assets.adobedtm.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-11` - `2024-08-10`	a year	crt.sh
www.google.com GTS CA 1C3	`2024-05-21` - `2024-08-13`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2024-05-21` - `2024-08-13`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2024-05-21` - `2024-08-13`	3 months	crt.sh
ads-twitter.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-21` - `2024-07-19`	a year	crt.sh
cookielaw.org Cloudflare Inc ECC CA-3	`2024-03-01` - `2024-12-31`	10 months	crt.sh
*.google.com GTS CA 1C3	`2024-05-21` - `2024-08-13`	3 months	crt.sh
sstats.paloaltonetworks.com DigiCert Global G2 TLS RSA SHA256 2020 CA1	`2023-07-19` - `2024-08-18`	a year	crt.sh
onetrust.com Cloudflare Inc ECC CA-3	`2023-11-13` - `2024-11-12`	a year	crt.sh

This page contains 3 frames:

Primary Page: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Frame ID: CDD30BD1505AC7FD73891D6E169DF764
Requests: 84 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lc5EhgTAAAAAJa-DzE7EeWABasWg4LKv-R3ao6o&co=aHR0cHM6Ly91bml0NDIucGFsb2FsdG9uZXR3b3Jrcy5jb206NDQz&hl=en&v=9pvHvq7kSOTqqZusUzJ6ewaF&size=normal&cb=7dng8auaub0p
Frame ID: DD492A1A61C996C2AA8670F3CE7B477F
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=en&v=9pvHvq7kSOTqqZusUzJ6ewaF&k=6Lc5EhgTAAAAAJa-DzE7EeWABasWg4LKv-R3ao6o
Frame ID: C342D930775371CD8BD50BCEF05D581E
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Pulling Back the Curtains on EncodedCommand PowerShell Attacks

Page URL History Show full URLs

https://goo.gl/uAic1X HTTP 302
http://researchcenter.paloaltonetworks.com/2017/03/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attack... HTTP 307
https://researchcenter.paloaltonetworks.com/2017/03/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attack... HTTP 301
https://www.paloaltonetworks.com/blog/2017/03/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-a... HTTP 301
https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/ Page URL

Detected technologies

Adobe Experience Manager (CMS) Expand

Overall confidence: 100%
Detected patterns

/etc/clientlibs/
/etc\.clientlibs/

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

/wp-(?:content|includes)/

Lightbox (JavaScript Libraries) Expand

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

Select2 (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

select2(?:\.min|\.full)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

/recaptcha/api\.js

Page Statistics

86
Requests

99 %
HTTPS

0 %
IPv6

10
Domains

13
Subdomains

12
IPs

2
Countries

1746 kB
Transfer

4736 kB
Size

7
Cookies

85 Outgoing links

These are links going to different origins than the main page.

URL: https://www.paloaltonetworks.com/

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/unit42
Title: Security Consulting

Search URL Search Domain Scan URL

URL: https://start.paloaltonetworks.com/contact-unit42.html
Title: Under Attack?

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/unit42/about
Title: About Unit 42

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/unit42/assess
Title: Assess and Test Your Security Controls

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/unit42/assess/ai-security-assessment
Title: AI Security Assessment

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/unit42/assess/attack-surface-assessment
Title: Attack Surface Assessment

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/unit42/assess/breach-readiness-review
Title: Breach Readiness Review

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/unit42/assess/business-email-compromise
Title: BEC Readiness Assessment

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/unit42/assess/compromise-assessment
Title: Compromise Assessment

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/unit42/assess/cyber-risk-assessment
Title: Cyber Risk Assessment

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/unit42/assess/mergers-acquisitions-cyber-due-dilligence
Title: M&A Cyber Due Diligence

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/unit42/assess/penetration-testing
Title: Penetration Testing

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/unit42/assess/purple-teaming
Title: Purple Team Exercises

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/unit42/assess/ransomware-readiness-assessment
Title: Ransomware Readiness Assessment

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/unit42/assess/soc-assessment
Title: SOC Assessment

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/unit42/assess/supply-chain-risk-assessment
Title: Supply Chain Risk Assessment

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/unit42/assess/tabletop-exercise
Title: Tabletop Exercises

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/unit42/retainer
Title: Unit 42 Retainer

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/unit42/transform
Title: Transform Your Security Strategy

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/unit42/transform/incident-response-plan-development-review
Title: IR Plan Development and Review

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/unit42/transform/security-program-design
Title: Security Program Design

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/unit42/transform/vciso
Title: Virtual CISO

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/unit42/respond
Title: Respond in Record Time

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/unit42/respond/cloud-incident-response
Title: Cloud Incident Response

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/unit42/respond/digital-forensics
Title: Digital Forensics

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/unit42/respond/incident-response
Title: Incident Response

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/unit42/respond/managed-detection-response
Title: Managed Detection and Response

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/unit42/respond/managed-threat-hunting
Title: Managed Threat Hunting

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/resources?q=*%3A*&_charset_=UTF-8&fq=PRODUCTS0_DFACET%3Apan%253Aresource-center%252Fproducts0%252Fcrypsis&fq=RC_TYPE_DFACET%3Apan%253Aresource-center%252Frc-type%252Fresearch
Title: Threat Reports Downloadable, in-depth research reports

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/resources/research/unit-42-incident-response-report
Title: THREAT REPORT 2024 Unit 42 Incident Response Report Read now

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/resources/research/unit-42-cloud-threat-report-volume-6
Title: THREAT REPORT Highlights from the Unit 42 Cloud Threat Report, Volume 6 Learn more

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/unit42/threat-intelligence-partners
Title: Threat Intelligence Sharing

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/unit42/incident-response-partners
Title: Law Firms and Insurance Providers

Search URL Search Domain Scan URL

URL: https://start.paloaltonetworks.com/unit42-threat-intel-bulletin.html
Title: Threat Intel Bulletin

Search URL Search Domain Scan URL

URL: https://start.paloaltonetworks.com/unit-42-ransomware-threat-report.html
Title: THREAT REPORT 2022 Unit 42 Ransomware Threat Report: Understand trends and tactics to bolster defenses Learn more

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/industry/unit42-financial-services
Title: Financial Services

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/industry/unit42-healthcare
Title: Healthcare

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/industry/unit42-manufacturing
Title: Manufacturing

Search URL Search Domain Scan URL

URL: https://start.paloaltonetworks.com/forrester-wave-incident-response
Title: ANALYST REPORT Unit 42® has been named a Leader in “The Forrester Wave™: Cybersecurity Incident Response Services, Q2 2024.” Read the Forrester report to learn why. Get the report

Search URL Search Domain Scan URL

URL: https://docs.paloaltonetworks.com/search#q=unit%2042&sort=relevancy&layout=card&numberOfResults=25
Title: Tech Docs

Search URL Search Domain Scan URL

URL: https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks%2F

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks%2F&title=Pulling+Back+the+Curtains+on+EncodedCommand+PowerShell+Attacks&summary=&source=

Search URL Search Domain Scan URL

URL: https://www.reddit.com/submit?url=https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/

Search URL Search Domain Scan URL

URL: https://unit42.paloaltonetworks.jp/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Title: 日本語 (Japanese)

Search URL Search Domain Scan URL

URL: https://twitter.com/mattifestation
Title: Matthew Graeber

Search URL Search Domain Scan URL

URL: https://www.exploit-monday.com/2011/10/exploiting-powershells-features-not.html
Title: blog post

Search URL Search Domain Scan URL

URL: https://github.com/trustedsec/social-engineer-toolkit
Title: Social-Engineer Toolkit (SET)

Search URL Search Domain Scan URL

URL: https://github.com/trustedsec/unicorn
Title: Magic Unicorn

Search URL Search Domain Scan URL

URL: https://autofocus.paloaltonetworks.com/#/tag/Unit42.Odinaff
Title: Odinaff

Search URL Search Domain Scan URL

URL: https://www.symantec.com/connect/blogs/odinaff-new-trojan-used-high-level-financial-attacks
Title: blogged

Search URL Search Domain Scan URL

URL: https://www.fireeye.com/blog/threat-research/2016/04/ghosts_in_the_endpoi.html
Title: blog

Search URL Search Domain Scan URL

URL: https://github.com/EmpireProject/Empire/blob/master/data/agent/stager_hop.ps1
Title: script

Search URL Search Domain Scan URL

URL: https://blog.paloaltonetworks.com/2017/01/unit42-farming-malicious-documents-unravel-ransomware/
Title: blog

Search URL Search Domain Scan URL

URL: https://twitter.com/JohnLaTwC/status/831963320915685377
Title: tweeted

Search URL Search Domain Scan URL

URL: https://github.com/samratashok/nishang
Title: Nishang

Search URL Search Domain Scan URL

URL: https://subt0x10.blogspot.com/2016/04/bypass-application-whitelisting-script.html
Title: found

Search URL Search Domain Scan URL

URL: https://twitter.com/subTee
Title: @subTee

Search URL Search Domain Scan URL

URL: https://www.exploit-monday.com/2014/04/powerworm-analysis.html
Title: excellent job

Search URL Search Domain Scan URL

URL: https://github.com/Veil-Framework/Veil-Evasion/blob/master/modules/payloads/powershell/shellcode_inject/virtual.py
Title: Veil Framework

Search URL Search Domain Scan URL

URL: https://blog.paloaltonetworks.com/2015/08/retefe-banking-trojan-targets-sweden-switzerland-and-japan/
Title: Retefe banking trojan

Search URL Search Domain Scan URL

URL: https://github.com/PowerShellMafia/PowerSploit/commit/717950d00c7cc352efe8b05c3db84d0e6250474c#diff-8a834e13c96d5508df5ee11bc92c82dd
Title: Get-Keystrokes

Search URL Search Domain Scan URL

URL: https://twitter.com/mattifestation/status/735261120487772160
Title: tweet

Search URL Search Domain Scan URL

URL: https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Get-TimedScreenshot.ps1
Title: PowerSploit Get-TimedScreenshot

Search URL Search Domain Scan URL

URL: https://github.com/pan-unit42/iocs/tree/master/psencmds
Title: here

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/legal-notices/terms-of-use
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/legal-notices/privacy
Title: Privacy Statement

Search URL Search Domain Scan URL

URL: https://twitter.com/Unit42_Intel

Search URL Search Domain Scan URL

URL: https://github.com/pan-unit42

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/resources
Title: Resource Center

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/blog/
Title: Blog

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/communities
Title: Communities

Search URL Search Domain Scan URL

URL: https://docs.paloaltonetworks.com/
Title: Tech Docs

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/sitemap
Title: Sitemap

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/legal
Title: Documents

Search URL Search Domain Scan URL

URL: https://start.paloaltonetworks.com/preference-center
Title: Manage Subscriptions

Search URL Search Domain Scan URL

URL: https://www.paloaltonetworks.com/security-disclosure
Title: Report a Vulnerability

Search URL Search Domain Scan URL

URL: https://www.onetrust.com/products/cookie-consent/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://goo.gl/uAic1X HTTP 302
http://researchcenter.paloaltonetworks.com/2017/03/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/?adbsc=social70678766&adbid=840185525071826944&adbpl=tw&adbpr=4487645412 HTTP 307
https://researchcenter.paloaltonetworks.com/2017/03/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/?adbsc=social70678766&adbid=840185525071826944&adbpl=tw&adbpr=4487645412 HTTP 301
https://www.paloaltonetworks.com/blog/2017/03/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/?adbsc=social70678766&adbid=840185525071826944&adbpl=tw&adbpr=4487645412 HTTP 301
https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 64

https://dpm.demdex.net/id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=9A531C8B532965080A490D4D%40AdobeOrg&d_nsid=0&ts=1718140972988 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=9A531C8B532965080A490D4D%40AdobeOrg&d_nsid=0&ts=1718140972988

86 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H/1.1

200
OK

Primary Request / Show response
unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Redirect Chain

https://goo.gl/uAic1X
http://researchcenter.paloaltonetworks.com/2017/03/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/?adbsc=social70678766&adbid=840185525071826944&adbpl=tw&adbpr=4487645412
https://researchcenter.paloaltonetworks.com/2017/03/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/?adbsc=social70678766&adbid=840185525071826944&adbpl=tw&adbpr=4487645412
https://www.paloaltonetworks.com/blog/2017/03/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/?adbsc=social70678766&adbid=840185525071826944&adbpl=tw&adbpr=4487645412
https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/

806 KB
109 KB

123ms
50ms

Document
text/html

104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-69-54-68.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

1446f4bb5332929dacf22e36cfcbf40ce14be3c6c88b9efa339bf3f37c213346

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

Connection: keep-alive
Content-Encoding: gzip
Content-Length: 111380
Content-Type: text/html; charset=UTF-8
Date: Tue, 11 Jun 2024 21:22:52 GMT
Link: <https://unit42.paloaltonetworks.com/wp-json/>; rel="https://api.w.org/", <https://unit42.paloaltonetworks.com/wp-json/wp/v2/posts/25125>; rel="alternate"; type="application/json", <https://unit42.paloaltonetworks.com/?p=25125>; rel=shortlink
Server: Apache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept-Encoding
X-Pingback: https://unit42.paloaltonetworks.com/xmlrpc.php

Redirect headers

cache-control: private, proxy-revalidate, max-age=900
content-length: 0
content-security-policy: frame-ancestors 'self' *.paloaltonetworks.com:443 www.securityroundtable.org:443;
content-type: text/html; charset=UTF-8
date: Tue, 11 Jun 2024 21:22:52 GMT
expires: Tue, 11 Jun 2024 21:37:52 GMT
location: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
server: Apache
server-timing: cdn-cache; desc=MISS edge; dur=15 origin; dur=344 ak_p; desc="1718140971602_1749860490_251727454_35792_13027_40_63_255";dur=1
strict-transport-security: max-age=31536000
vary: X-Forwarded-Proto
x-frame-options: SAMEORIGIN
x-pingback: https://www.paloaltonetworks.com/blog/xmlrpc.php
x-redirect-by: WordPress
x-xss-protection: 1; mode=block

GET
H2 200 criticalTop.min.css
www.paloaltonetworks.com/etc.clientlibs/panClean/components/mainNavigationComp/clientlibs/panClean/ 58 KB
5 KB 75ms
74ms Stylesheet
text/css 96.7.195.105
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paloaltonetworks.com/etc.clientlibs/panClean/components/mainNavigationComp/clientlibs/panClean/criticalTop.min.css

Requested by

Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

96.7.195.105 Miami, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-7-195-105.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

2603910bd5da680dbb063e5772f2f9d722150e08f8a21d65dbd214810ed1e5f7

Security Headers

Name	Value
Content-Security-Policy	object-src 'none'
Strict-Transport-Security	max-age=15811200
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: object-src 'none'
content-encoding: br
strict-transport-security: max-age=15811200
last-modified: Sat, 08 Jun 2024 14:33:27 GMT
server: Akamai Resource Optimizer
date: Tue, 11 Jun 2024 21:22:52 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css;charset=utf-8
cache-control: public, max-age=259200
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1718140972235_1749860490_251730245_581_7453_40_0_255";dur=1
accept-ranges: bytes
x-robots-tag: noindex
content-length: 4694
expires: Fri, 14 Jun 2024 21:22:52 GMT

GET
H2 200 criticalTopProductNav.min.css
www.paloaltonetworks.com/etc.clientlibs/panClean/components/mainNavigationComp/clientlibs/panClean/ 37 KB
3 KB 76ms
75ms Stylesheet
text/css 96.7.195.105
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paloaltonetworks.com/etc.clientlibs/panClean/components/mainNavigationComp/clientlibs/panClean/criticalTopProductNav.min.css

Requested by

Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

96.7.195.105 Miami, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-7-195-105.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

351cb79f16546f26c862b782233ada0a5aec6366fb29dadcdb971f699b98bdd3

Security Headers

Name	Value
Content-Security-Policy	object-src 'none'
Strict-Transport-Security	max-age=15811200
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: object-src 'none'
content-encoding: br
strict-transport-security: max-age=15811200
last-modified: Mon, 27 May 2024 22:08:53 GMT
server: Akamai Resource Optimizer
date: Tue, 11 Jun 2024 21:22:52 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css;charset=utf-8
cache-control: public, max-age=259200
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1718140972230_1749860490_251730247_35_10563_40_0_255";dur=1
accept-ranges: bytes
x-robots-tag: noindex
content-length: 3140
expires: Fri, 14 Jun 2024 21:22:52 GMT

GET
H2 200 deferedProductNav.min.css
www.paloaltonetworks.com/etc.clientlibs/panClean/components/mainNavigationComp/clientlibs/panClean/ 133 KB
9 KB 78ms
77ms Stylesheet
text/css 96.7.195.105
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paloaltonetworks.com/etc.clientlibs/panClean/components/mainNavigationComp/clientlibs/panClean/deferedProductNav.min.css

Requested by

Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

96.7.195.105 Miami, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-7-195-105.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

df7f202668377b7013a8c879cd3929f0d916f69cda35f8c767250eafc491341b

Security Headers

Name	Value
Content-Security-Policy	object-src 'none'
Strict-Transport-Security	max-age=15811200
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: object-src 'none'
content-encoding: br
strict-transport-security: max-age=15811200
last-modified: Tue, 28 May 2024 01:28:07 GMT
server: Akamai Resource Optimizer
date: Tue, 11 Jun 2024 21:22:52 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: text/css;charset=utf-8
cache-control: public, max-age=259200
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1718140972230_1749860490_251730248_28_12014_40_0_255";dur=1
accept-ranges: bytes
x-robots-tag: noindex
content-length: 8672
expires: Fri, 14 Jun 2024 21:22:52 GMT

GET
H/1.1 200
OK crayon.min.css
unit42.paloaltonetworks.com/wp-content/plugins/crayon-syntax-highlighter/css/min/ 20 KB
4 KB 53ms
41ms Stylesheet
text/css 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://unit42.paloaltonetworks.com/wp-content/plugins/crayon-syntax-highlighter/css/min/crayon.min.css?ver=_2.7.2_beta
Requested by: Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-69-54-68.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e3d961493e244e06bf91a9857442891e2e2ad8d49cf8e0a7781c53f0707443d7

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 11 Jun 2024 21:22:52 GMT
Content-Encoding: gzip
Last-Modified: Fri, 16 Feb 2024 13:57:50 GMT
Server: Apache
ETag: "4ecc-6118021367da6"
Vary: Accept-Encoding
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3959

GET
H/1.1 200
OK classic.css
unit42.paloaltonetworks.com/wp-content/plugins/crayon-syntax-highlighter/themes/classic/ 4 KB
1011 B 101ms
44ms Stylesheet
text/css 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://unit42.paloaltonetworks.com/wp-content/plugins/crayon-syntax-highlighter/themes/classic/classic.css?ver=_2.7.2_beta
Requested by: Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-69-54-68.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 01e43870a4218fe731a3516dd76725698c3aadfb285465086849c6b52ef71719

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 11 Jun 2024 21:22:52 GMT
Content-Encoding: gzip
Last-Modified: Fri, 16 Feb 2024 13:57:50 GMT
Server: Apache
ETag: "1110-611802136eb06"
Vary: Accept-Encoding
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 727

GET
H/1.1 200
OK monaco.css
unit42.paloaltonetworks.com/wp-content/plugins/crayon-syntax-highlighter/fonts/ 529 B
765 B 106ms
41ms Stylesheet
text/css 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://unit42.paloaltonetworks.com/wp-content/plugins/crayon-syntax-highlighter/fonts/monaco.css?ver=_2.7.2_beta
Requested by: Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-69-54-68.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 8b33eebc11529672afc8f1ac6d5d4ef24bed8dfec1505a2510c805e0dd21565f

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 11 Jun 2024 21:22:52 GMT
Last-Modified: Fri, 16 Feb 2024 13:57:50 GMT
Server: Apache
ETag: "211-61180213698fe"
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 529

GET
H/1.1 200
OK style.min.css
unit42.paloaltonetworks.com/wp-includes/css/dist/block-library/ 111 KB
15 KB 124ms
58ms Stylesheet
text/css 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://unit42.paloaltonetworks.com/wp-includes/css/dist/block-library/style.min.css?ver=6.5.2

Requested by

Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-69-54-68.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

98cecf88a23542fa047ce46eedb650b5c5128761ed4386c0977b847094ddfa20

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
Date: Tue, 11 Jun 2024 21:22:52 GMT
Last-Modified: Tue, 23 Apr 2024 08:52:51 GMT
Server: Apache
ETag: "1bae5-616bfaddd0674-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 14991

GET
H/1.1 200
OK dashicons.min.css
unit42.paloaltonetworks.com/wp-includes/css/ 58 KB
35 KB 123ms
57ms Stylesheet
text/css 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://unit42.paloaltonetworks.com/wp-includes/css/dashicons.min.css?ver=6.5.2

Requested by

Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-69-54-68.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
Date: Tue, 11 Jun 2024 21:22:52 GMT
Last-Modified: Fri, 16 Feb 2024 13:57:52 GMT
Server: Apache
ETag: "e688-61180214867a8-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 35730

GET
H/1.1 200
OK frontend.min.css
unit42.paloaltonetworks.com/wp-content/plugins/post-views-counter/css/ 217 B
509 B 106ms
40ms Stylesheet
text/css 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://unit42.paloaltonetworks.com/wp-content/plugins/post-views-counter/css/frontend.min.css?ver=1.4.6

Requested by

Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-69-54-68.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

cc2a604a1e6f73444e8db5d749a64c62899943e68ad07feeee39050b4fdb32cb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
Date: Tue, 11 Jun 2024 21:22:52 GMT
Last-Modified: Mon, 22 Apr 2024 08:45:16 GMT
Server: Apache
ETag: "d9-616ab74e03548-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 158

GET
H/1.1 200
OK frontend.min.css
unit42.paloaltonetworks.com/wp-content/plugins/wp-user-avatar/assets/css/ 102 KB
15 KB 110ms
45ms Stylesheet
text/css 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://unit42.paloaltonetworks.com/wp-content/plugins/wp-user-avatar/assets/css/frontend.min.css?ver=4.15.6

Requested by

Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-69-54-68.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

8c0d1ddb17510639cc14e2f251206d5c8984d85e23b8e7dc13438c81bf5ce985

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
Date: Tue, 11 Jun 2024 21:22:52 GMT
Last-Modified: Tue, 23 Apr 2024 08:52:51 GMT
Server: Apache
ETag: "19624-616bfadd60d43-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 15220

GET
H/1.1 200
OK flatpickr.min.css
unit42.paloaltonetworks.com/wp-content/plugins/wp-user-avatar/assets/flatpickr/ 14 KB
3 KB 145ms
45ms Stylesheet
text/css 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://unit42.paloaltonetworks.com/wp-content/plugins/wp-user-avatar/assets/flatpickr/flatpickr.min.css?ver=4.15.6

Requested by

Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-69-54-68.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

3668f6d335416599574fb1f336cbd2b9bb2f8fcff63e63a9ca3b68df4d0c6165

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
Date: Tue, 11 Jun 2024 21:22:52 GMT
Last-Modified: Mon, 22 Apr 2024 08:45:25 GMT
Server: Apache
ETag: "3601-616ab7569da24-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2795

GET
H/1.1 200
OK select2.min.css
unit42.paloaltonetworks.com/wp-content/plugins/wp-user-avatar/assets/select2/ 15 KB
2 KB 148ms
41ms Stylesheet
text/css 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://unit42.paloaltonetworks.com/wp-content/plugins/wp-user-avatar/assets/select2/select2.min.css?ver=6.5.2

Requested by

Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-69-54-68.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

044efea78208376302aad3808aaabdf3c2f7bdd80ba9d55c9e0e4d3baa7a3908

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
Date: Tue, 11 Jun 2024 21:22:52 GMT
Last-Modified: Mon, 22 Apr 2024 08:45:25 GMT
Server: Apache
ETag: "3a75-616ab756a2845-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1995

GET
H/1.1 200
OK style.min.css
unit42.paloaltonetworks.com/wp-content/plugins/sitepress-multilingual-cms/templates/language-switchers/legacy-list-horizontal/ 908 B
670 B 147ms
40ms Stylesheet
text/css 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://unit42.paloaltonetworks.com/wp-content/plugins/sitepress-multilingual-cms/templates/language-switchers/legacy-list-horizontal/style.min.css?ver=1

Requested by

Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-69-54-68.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

22a79f1fbcc70373c7021bae2164d9232d1e9dd3c6a163df9f9f54070e5f6b50

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
Date: Tue, 11 Jun 2024 21:22:52 GMT
Last-Modified: Mon, 22 Apr 2024 08:45:56 GMT
Server: Apache
ETag: "38c-616ab77418104-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 318

GET
H/1.1 200
OK style.min.css
unit42.paloaltonetworks.com/wp-content/plugins/sitepress-multilingual-cms/templates/language-switchers/legacy-post-translations/ 563 B
568 B 151ms
41ms Stylesheet
text/css 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://unit42.paloaltonetworks.com/wp-content/plugins/sitepress-multilingual-cms/templates/language-switchers/legacy-post-translations/style.min.css?ver=1

Requested by

Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-69-54-68.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

2fff39fc60bd268cd34d270f80d39a61bd875100c73d7cfb3ac2c93166e8542d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
Date: Tue, 11 Jun 2024 21:22:52 GMT
Last-Modified: Mon, 22 Apr 2024 08:45:56 GMT
Server: Apache
ETag: "233-616ab77418104-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 216

GET
H/1.1 200
OK wpp.css
unit42.paloaltonetworks.com/wp-content/plugins/wordpress-popular-posts/assets/css/ 2 KB
853 B 165ms
41ms Stylesheet
text/css 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://unit42.paloaltonetworks.com/wp-content/plugins/wordpress-popular-posts/assets/css/wpp.css?ver=5.5.1
Requested by: Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-69-54-68.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 291cf581b824e88d8e5292c399d39fe9940cc6d50c1cfe21e0525a510e9e0b2a

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 11 Jun 2024 21:22:52 GMT
Content-Encoding: gzip
Last-Modified: Fri, 16 Feb 2024 13:57:51 GMT
Server: Apache
ETag: "688-61180213f8dff"
Vary: Accept-Encoding
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 570

GET
H/1.1 200
OK main.css
unit42.paloaltonetworks.com/wp-content/themes/unit42-v5/dist/styles/ 150 KB
25 KB 186ms
46ms Stylesheet
text/css 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v5/dist/styles/main.css?v3

Requested by

Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-69-54-68.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

b69d3e8f5f3218a4938de692d1a7adde67cf70b77f459721396d347119f953f5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
Date: Tue, 11 Jun 2024 21:22:52 GMT
Last-Modified: Tue, 14 May 2024 05:48:19 GMT
Server: Apache
ETag: "25820-618638c8d60a5-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 25398

GET
H/1.1 200
OK jquery.min.js Show response
unit42.paloaltonetworks.com/wp-includes/js/jquery/ 86 KB
30 KB 186ms
42ms Script
application/javascript 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://unit42.paloaltonetworks.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1

Requested by

Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-69-54-68.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
Date: Tue, 11 Jun 2024 21:22:52 GMT
Last-Modified: Tue, 23 Apr 2024 08:52:51 GMT
Server: Apache
ETag: "15601-616bfade013b7-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 30368

GET
H/1.1 200
OK jquery-migrate.min.js Show response
unit42.paloaltonetworks.com/wp-includes/js/jquery/ 13 KB
14 KB 194ms
46ms Script
application/javascript 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://unit42.paloaltonetworks.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1
Requested by: Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-69-54-68.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 11 Jun 2024 21:22:52 GMT
Last-Modified: Fri, 16 Feb 2024 13:57:52 GMT
Server: Apache
ETag: "3509-61180214ac522"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 13577

GET
H/1.1 200
OK crayon.min.js Show response
unit42.paloaltonetworks.com/wp-content/plugins/crayon-syntax-highlighter/js/min/ 22 KB
22 KB 198ms
50ms Script
application/javascript 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://unit42.paloaltonetworks.com/wp-content/plugins/crayon-syntax-highlighter/js/min/crayon.min.js?ver=_2.7.2_beta
Requested by: Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-69-54-68.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 193fbb968733b8a7049da19274546e6b80b76e9a8f1b837fee9a5fdeb8f97c7b

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 11 Jun 2024 21:22:52 GMT
Last-Modified: Fri, 16 Feb 2024 13:57:50 GMT
Server: Apache
ETag: "5741-611802136a89e"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 22337

GET
H/1.1 200
OK frontend.min.js Show response
unit42.paloaltonetworks.com/wp-content/plugins/post-views-counter/js/ 3 KB
2 KB 192ms
41ms Script
application/javascript 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://unit42.paloaltonetworks.com/wp-content/plugins/post-views-counter/js/frontend.min.js?ver=1.4.6

Requested by

Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-69-54-68.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

0ea483a3020f20467311f88198ac887d4c3032485b36f30ec83bfa93af6d12d2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
Date: Tue, 11 Jun 2024 21:22:52 GMT
Last-Modified: Tue, 23 Apr 2024 08:52:50 GMT
Server: Apache
ETag: "aec-616bfadcfe31c-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1341

GET
H/1.1 200
OK flatpickr.min.js Show response
unit42.paloaltonetworks.com/wp-content/plugins/wp-user-avatar/assets/flatpickr/ 49 KB
14 KB 212ms
47ms Script
application/javascript 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://unit42.paloaltonetworks.com/wp-content/plugins/wp-user-avatar/assets/flatpickr/flatpickr.min.js?ver=4.15.6

Requested by

Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-69-54-68.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

ddbda21655c0c2cb09913a9e33d856a8b8f3e1eae610cdbda8524def2dc71f7d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
Date: Tue, 11 Jun 2024 21:22:52 GMT
Last-Modified: Mon, 22 Apr 2024 08:45:25 GMT
Server: Apache
ETag: "c5a4-616ab7569da24-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 14441

GET
H/1.1 200
OK select2.min.js Show response
unit42.paloaltonetworks.com/wp-content/plugins/wp-user-avatar/assets/select2/ 69 KB
20 KB 234ms
46ms Script
application/javascript 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://unit42.paloaltonetworks.com/wp-content/plugins/wp-user-avatar/assets/select2/select2.min.js?ver=4.15.6

Requested by

Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-69-54-68.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

00501810e93307a8882a74d864e7547fd1458deea539361dc1124ac133799a4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
Date: Tue, 11 Jun 2024 21:22:52 GMT
Last-Modified: Mon, 22 Apr 2024 08:45:25 GMT
Server: Apache
ETag: "114c3-616ab756a2845-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 19904

GET
H/1.1 200
OK wpp.min.js Show response
unit42.paloaltonetworks.com/wp-content/plugins/wordpress-popular-posts/assets/js/ 3 KB
2 KB 229ms
41ms Script
application/javascript 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://unit42.paloaltonetworks.com/wp-content/plugins/wordpress-popular-posts/assets/js/wpp.min.js?ver=5.5.1
Requested by: Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-69-54-68.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 9a3d1f5824ad4bd991a67acab64088920e43d25545ca6b4cb78736dc35b696a3

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 11 Jun 2024 21:22:52 GMT
Content-Encoding: gzip
Last-Modified: Fri, 16 Feb 2024 13:57:51 GMT
Server: Apache
ETag: "bd7-61180213f99b7"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1377

GET
H/1.1 200
OK xdomain-data.js Show response
unit42.paloaltonetworks.com/wp-content/plugins/sitepress-multilingual-cms/res/js/ 3 KB
2 KB 45ms
45ms Script
application/javascript 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://unit42.paloaltonetworks.com/wp-content/plugins/sitepress-multilingual-cms/res/js/xdomain-data.js?ver=4.6.10

Requested by

Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-69-54-68.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

68b324a6179651d56917d3b1f3f5d0a1e71b08550b1468790826dde5e22b2b56

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
Date: Tue, 11 Jun 2024 21:22:52 GMT
Last-Modified: Mon, 22 Apr 2024 08:45:56 GMT
Server: Apache
ETag: "d2d-616ab773f2f39-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1307

GET
H2 200 launch-425c423d843b.min.js Show response
assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/ 637 KB
149 KB 109ms
34ms Script
application/x-javascript 104.96.164.235
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/launch-425c423d843b.min.js
Requested by: Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.96.164.235 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-96-164-235.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 7736c86f193c9d74521d86687f9357d2e8b33e1e5155e66ee512813c1cc3ab47

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 11 Jun 2024 21:22:52 GMT
content-encoding: gzip
last-modified: Thu, 06 Jun 2024 09:18:13 GMT
server: AkamaiNetStorage
etag: "72e50dbd6bc8b0d1901c7f50f35bf295:1717665493.026564"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://unit42.paloaltonetworks.com
cache-control: max-age=3600
accept-ranges: bytes
timing-allow-origin: *
content-length: 152651
expires: Tue, 11 Jun 2024 22:22:52 GMT

GET
H2 200 attribution.js Show response
www.paloaltonetworks.com/content/dam/pan/en_US/includes/ 10 KB
3 KB 76ms
74ms Script
application/javascript 96.7.195.105
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paloaltonetworks.com/content/dam/pan/en_US/includes/attribution.js

Requested by

Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

96.7.195.105 Miami, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-7-195-105.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

3345e1d5601514a1fa98397e817d7c940715b82c438d16183ebc990b1904c052

Security Headers

Name	Value
Content-Security-Policy	object-src 'none'
Strict-Transport-Security	max-age=15811200
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: object-src 'none'
content-encoding: br
strict-transport-security: max-age=15811200
last-modified: Sun, 02 Jun 2024 14:09:23 GMT
server: Akamai Resource Optimizer
date: Tue, 11 Jun 2024 21:22:52 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=259200
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1718140972256_1749860490_251730380_30_12564_40_0_219";dur=1
accept-ranges: bytes
x-robots-tag: noindex
content-length: 2184
expires: Fri, 14 Jun 2024 21:22:52 GMT

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 1 KB
1 KB 149ms
58ms Script
text/javascript 172.217.222.103
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js

Requested by

Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.222.103 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

qi-in-f103.1e100.net

Software

GSE /

Resource Hash

2437b926f4178e441a5d7d99c900070912a94889035b2d7821022712f5ca689d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 11 Jun 2024 21:22:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Tue, 11 Jun 2024 21:22:52 GMT

GET
H/1.1 200
OK PANW_Parent.png
unit42.paloaltonetworks.com/wp-content/uploads/2021/07/ 9 KB
10 KB 45ms
45ms Image
image/png 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://unit42.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png
Requested by: Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-69-54-68.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 8ec11303a508ae99cfde8da8d8418863f5c44c6e4d9ad85d89b751711810ccbe

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 11 Jun 2024 21:22:52 GMT
Last-Modified: Mon, 14 Nov 2022 10:43:32 GMT
Server: Apache
ETag: "2583-5ed6be924f16c"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 9603

GET
H/1.1 200
OK unit42-logo-white.svg
unit42.paloaltonetworks.com/wp-content/themes/unit42-v5/dist/images/svg/ 3 KB
3 KB 41ms
40ms Image
image/svg+xml 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v5/dist/images/svg/unit42-logo-white.svg
Requested by: Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-69-54-68.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: ce8287c3e0aa69b9b84e99fefcd63c5aa3e5f91d59852efad2a446efb3f07595

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 11 Jun 2024 21:22:52 GMT
Last-Modified: Fri, 16 Feb 2024 13:57:52 GMT
Server: Apache
ETag: "b20-611802146cd7e"
Content-Type: image/svg+xml
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2848

GET
H/1.1 200
OK unit42-web-banner-650x300.jpg
unit42.paloaltonetworks.com/wp-content/uploads/2016/09/ 40 KB
40 KB 241ms
50ms Image
image/jpeg 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://unit42.paloaltonetworks.com/wp-content/uploads/2016/09/unit42-web-banner-650x300.jpg

Requested by

Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-69-54-68.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

e01385043cf0b49f44fba01d20ec12122309de224da894a29c559e9ca8b635dc

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' paloaltonetworks.com .paloaltonetworks.com paloaltonetworks.jp .paloaltonetworks.jp unit42.com *.unit42.com ;, object-src 'none'
Strict-Transport-Security	max-age=15811200
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Strict-Transport-Security: max-age=15811200
Content-Security-Policy: frame-ancestors 'self' paloaltonetworks.com *.paloaltonetworks.com paloaltonetworks.jp *.paloaltonetworks.jp unit42.com *.unit42.com ;, object-src 'none'
X-Content-Type-Options: nosniff
Date: Tue, 11 Jun 2024 21:22:52 GMT
Last-Modified: Mon, 14 Nov 2022 10:43:24 GMT
Server: Apache
ETag: "9ef0-5ed6be8a8ae93"
X-Frame-Options: SAMEORIGIN
Content-Type: image/jpeg
Cache-Control: public, max-age=17553
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 40688

GET
H/1.1 200
OK fig1.png
unit42.paloaltonetworks.com/wp-content/uploads/2017/03/ 87 KB
87 KB 47ms
47ms Image
image/png 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://unit42.paloaltonetworks.com/wp-content/uploads/2017/03/fig1.png

Requested by

Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-69-54-68.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

e8740a9c4cf277abdc68fe4fb953750244390818fa0f745c5f4fe14862c89cb5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Date: Tue, 11 Jun 2024 21:22:52 GMT
Last-Modified: Mon, 14 Nov 2022 10:43:24 GMT
Server: Apache
ETag: "15b9c-5ed6be8b1af6d"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 88988

GET
H/1.1 200
OK fig2.png
unit42.paloaltonetworks.com/wp-content/uploads/2017/03/ 86 KB
86 KB 53ms
53ms Image
image/png 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://unit42.paloaltonetworks.com/wp-content/uploads/2017/03/fig2.png

Requested by

Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-69-54-68.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

76bca5fd591b8221d4ef60699a5ce3757b4db7c1c4e9707c3bf2a1290b08dd72

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Date: Tue, 11 Jun 2024 21:22:52 GMT
Last-Modified: Mon, 14 Nov 2022 10:43:24 GMT
Server: Apache
ETag: "15649-5ed6be8b1af6d"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 87625

GET
H/1.1 200
OK wpdevart_lightbox_front.css
unit42.paloaltonetworks.com/wp-content/plugins/lightbox-popup/includes/style/ 1 KB
786 B 72ms
72ms Stylesheet
text/css 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://unit42.paloaltonetworks.com/wp-content/plugins/lightbox-popup/includes/style/wpdevart_lightbox_front.css?ver=6.5.2

Requested by

Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-69-54-68.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

a245df6da22f0700461deb2f6f840edce1f07613bab8e44eaa076f97bc40995f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
Date: Tue, 11 Jun 2024 21:22:52 GMT
Last-Modified: Fri, 16 Feb 2024 13:57:51 GMT
Server: Apache
ETag: "528-6118021378b2f-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 434

GET
H/1.1 200
OK effects_lightbox.css
unit42.paloaltonetworks.com/wp-content/plugins/lightbox-popup/includes/style/ 20 KB
2 KB 43ms
42ms Stylesheet
text/css 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://unit42.paloaltonetworks.com/wp-content/plugins/lightbox-popup/includes/style/effects_lightbox.css?ver=6.5.2

Requested by

Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-69-54-68.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

b350cde8333b78d909635b54c3f50fd72d38abcb67cf4ee1a3a212be1d775768

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
Date: Tue, 11 Jun 2024 21:22:52 GMT
Last-Modified: Fri, 16 Feb 2024 13:57:51 GMT
Server: Apache
ETag: "5017-6118021378747-gzip"
Vary: Accept-Encoding
Content-Type: text/css
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1364

GET
H/1.1 200
OK frontend.min.js Show response
unit42.paloaltonetworks.com/wp-content/plugins/wp-user-avatar/assets/js/ 19 KB
5 KB 62ms
60ms Script
application/javascript 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://unit42.paloaltonetworks.com/wp-content/plugins/wp-user-avatar/assets/js/frontend.min.js?ver=4.15.6

Requested by

Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-69-54-68.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

3bedfc6a1eccd45281b8c1a4b66af947f9944b7e750566c2268a4eb927ee2cdb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
Date: Tue, 11 Jun 2024 21:22:52 GMT
Last-Modified: Tue, 23 Apr 2024 08:52:51 GMT
Server: Apache
ETag: "4ae9-616bfadd6112b-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4478

GET
H/1.1 200
OK fancybox.js Show response
unit42.paloaltonetworks.com/wp-content/themes/unit42-v5/dist/scripts/ 140 KB
140 KB 44ms
42ms Script
application/javascript 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v5/dist/scripts/fancybox.js
Requested by: Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-69-54-68.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: b849ac9311853409dafdd2928bffaa5e78d9a3fbb3739080488b01c2a5788901

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 11 Jun 2024 21:22:52 GMT
Last-Modified: Fri, 16 Feb 2024 13:57:52 GMT
Server: Apache
ETag: "22f9e-611802146d54e"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 143262

GET
H/1.1 200
OK main.js Show response
unit42.paloaltonetworks.com/wp-content/themes/unit42-v5/dist/scripts/ 124 KB
124 KB 48ms
46ms Script
application/javascript 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v5/dist/scripts/main.js
Requested by: Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-69-54-68.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: cf10b8926160d5ac5e3e6fc235a7499e91f04b0097d37bac51efe1c5ed61d92b

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 11 Jun 2024 21:22:52 GMT
Last-Modified: Fri, 16 Feb 2024 13:57:52 GMT
Server: Apache
ETag: "1ee21-611802146e4ee"
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 126497

GET
H/1.1 200
OK wpdevart_lightbox_front.js Show response
unit42.paloaltonetworks.com/wp-content/plugins/lightbox-popup/includes/javascript/ 50 KB
9 KB 43ms
43ms Script
application/javascript 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://unit42.paloaltonetworks.com/wp-content/plugins/lightbox-popup/includes/javascript/wpdevart_lightbox_front.js?ver=1.0

Requested by

Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-69-54-68.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

964d556a74d8d77dbefdfc01e6aa74644aa082837d259442be8869d3440900a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
Date: Tue, 11 Jun 2024 21:22:52 GMT
Last-Modified: Tue, 23 Apr 2024 08:52:50 GMT
Server: Apache
ETag: "c991-616bfadcfb054-gzip"
Vary: Accept-Encoding
Content-Type: application/javascript
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 9002

GET
H2 200 css2
fonts.googleapis.com/ 32 KB
1 KB 131ms
54ms Stylesheet
text/css 172.253.62.95
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Montserrat:ital,wght@0,100;0,200;0,300;0,400;0,500;0,600;0,700;0,800;0,900;1,100;1,200;1,300;1,400;1,500;1,600;1,700;1,800;1,900&display=swap

Requested by

Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v5/dist/styles/main.css?v3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.253.62.95 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

bc-in-f95.1e100.net

Software

ESF /

Resource Hash

51698055502813cd29205292dfcb7517bd803cf9deb22e21d06bd24fb3bcdf4b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=31536000
date: Tue, 11 Jun 2024 21:22:52 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Tue, 11 Jun 2024 20:45:57 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Tue, 11 Jun 2024 21:22:52 GMT

POST
H/1.1 200
OK popular-posts Show response
unit42.paloaltonetworks.com/wp-json/wordpress-popular-posts/v1/ 0
219 B 262ms
262ms XHR
text/html 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://unit42.paloaltonetworks.com/wp-json/wordpress-popular-posts/v1/popular-posts

Requested by

Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/wp-content/plugins/wordpress-popular-posts/assets/js/wpp.min.js?ver=5.5.1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-69-54-68.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
X-Requested-With: XMLHttpRequest
sec-ch-ua-platform: "Win32"

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Date: Tue, 11 Jun 2024 21:22:52 GMT
Server: Apache
Connection: keep-alive
Content-Length: 0
Content-Type: text/html; charset=UTF-8

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/9pvHvq7kSOTqqZusUzJ6ewaF/ 512 KB
204 KB 134ms
44ms Script
text/javascript 173.194.68.94
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/9pvHvq7kSOTqqZusUzJ6ewaF/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

173.194.68.94 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

qr-in-f94.1e100.net

Software

sffe /

Resource Hash

5f12968474e2995c485a2c256a9819dde04e78b6a13aacadfba935ed7970234a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/
Origin: https://unit42.paloaltonetworks.com
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Sat, 08 Jun 2024 08:05:46 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 307026
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 207847
x-xss-protection: 0
last-modified: Mon, 03 Jun 2024 04:00:47 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 08 Jun 2025 08:05:46 GMT

GET
H/1.1 200
OK unit-nav-renderer.php Show response
unit42.paloaltonetworks.com/wp-content/themes/unit42-v5/ 34 KB
6 KB 64ms
59ms XHR
text/html 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v5/unit-nav-renderer.php

Requested by

Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-69-54-68.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

bffcc69c3362280e393774770ac39dd3ee2ee6fe0554792552750286183bce98

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
Date: Tue, 11 Jun 2024 21:22:52 GMT
Server: Apache
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Connection: keep-alive
Content-Length: 5655

GET
H2 200 x-black.svg
www.paloaltonetworks.com/etc/clientlibs/clean/imgs/ 268 B
521 B 76ms
73ms Image
image/svg+xml 96.7.195.105
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/x-black.svg

Requested by

Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

96.7.195.105 Miami, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-7-195-105.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

37c5694161fda223034cd9fe184f6801ce2564b8952482a67bdcb871431492d8

Security Headers

Name	Value
Content-Security-Policy	object-src 'none'
Strict-Transport-Security	max-age=15811200
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: object-src 'none'
content-encoding: br
strict-transport-security: max-age=15811200
last-modified: Tue, 14 May 2024 22:04:38 GMT
server: Akamai Resource Optimizer
date: Tue, 11 Jun 2024 21:22:52 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
cache-control: max-age=259200
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1718140972680_1749860490_251732246_34_13698_43_0_146";dur=1
accept-ranges: bytes
content-length: 160
expires: Fri, 14 Jun 2024 21:22:52 GMT

GET
H2 200 unit42-logo-dark.svg
www.paloaltonetworks.com/etc/clientlibs/clean/imgs/ 4 KB
2 KB 73ms
70ms Image
image/svg+xml 96.7.195.105
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/unit42-logo-dark.svg

Requested by

Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

96.7.195.105 Miami, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-7-195-105.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

789094003d7990c9a6943bf5ea8a789ac2701810361a2c84a815ed08e277efdc

Security Headers

Name	Value
Content-Security-Policy	object-src 'none'
Strict-Transport-Security	max-age=15811200
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: object-src 'none'
content-encoding: br
strict-transport-security: max-age=15811200
last-modified: Sun, 02 Jun 2024 03:44:44 GMT
server: Akamai Resource Optimizer
date: Tue, 11 Jun 2024 21:22:52 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
cache-control: max-age=259200
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1718140972680_1749860490_251732247_31_11256_43_0_146";dur=1
accept-ranges: bytes
content-length: 1426
expires: Fri, 14 Jun 2024 21:22:52 GMT

GET
H2 200 search-black.svg
www.paloaltonetworks.com/etc/clientlibs/clean/imgs/ 328 B
570 B 108ms
106ms Image
image/svg+xml 96.7.195.105
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/search-black.svg

Requested by

Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

96.7.195.105 Miami, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-7-195-105.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

71f8892d3e3883e5fdf73032c7ab583e52fad50ce2d684084dbe6ded853c6b67

Security Headers

Name	Value
Content-Security-Policy	object-src 'none'
Strict-Transport-Security	max-age=15811200
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: object-src 'none'
content-encoding: br
strict-transport-security: max-age=15811200
last-modified: Mon, 20 May 2024 13:48:28 GMT
server: Akamai Resource Optimizer
date: Tue, 11 Jun 2024 21:22:52 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
cache-control: max-age=259200
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1718140972713_1749860490_251732334_2005_12620_43_0_146";dur=1
accept-ranges: bytes
content-length: 208
expires: Fri, 14 Jun 2024 21:22:52 GMT

GET
H2 200 arrow-right-black.svg
www.paloaltonetworks.com/etc/clientlibs/clean/imgs/ 218 B
507 B 88ms
86ms Image
image/svg+xml 96.7.195.105
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-black.svg

Requested by

Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

96.7.195.105 Miami, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-7-195-105.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

0f99161d83c288e754f5f7af3d0fc0e47e3e2289d5bf6f3df964d33785ec30a9

Security Headers

Name	Value
Content-Security-Policy	object-src 'none'
Strict-Transport-Security	max-age=15811200
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: object-src 'none'
content-encoding: br
strict-transport-security: max-age=15811200
last-modified: Sun, 02 Jun 2024 17:33:03 GMT
server: Akamai Resource Optimizer
date: Tue, 11 Jun 2024 21:22:52 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
cache-control: max-age=259200
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1718140972695_1749860490_251732336_195_11048_43_0_146";dur=1
accept-ranges: bytes
content-length: 145
expires: Fri, 14 Jun 2024 21:22:52 GMT

GET
H2 200 logo-default.svg
www.paloaltonetworks.com/etc/clientlibs/clean/imgs/ 452 B
611 B 85ms
83ms Image
image/svg+xml 96.7.195.105
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/logo-default.svg

Requested by

Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

96.7.195.105 Miami, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-7-195-105.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

9a0292e0cbc4b30386d1d5c106a5755e1fb924d7569d9a23f9e3e7162996becc

Security Headers

Name	Value
Content-Security-Policy	object-src 'none'
Strict-Transport-Security	max-age=15811200
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: object-src 'none'
content-encoding: br
strict-transport-security: max-age=15811200
last-modified: Wed, 05 Jun 2024 19:10:47 GMT
server: Akamai Resource Optimizer
date: Tue, 11 Jun 2024 21:22:52 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
cache-control: max-age=259200
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1718140972694_1749860490_251732337_142_9771_43_0_219";dur=1
accept-ranges: bytes
content-length: 250
expires: Fri, 14 Jun 2024 21:22:52 GMT

GET
H2 200 arrow-right-white.svg
www.paloaltonetworks.com/etc/clientlibs/clean/imgs/ 218 B
506 B 106ms
104ms Image
image/svg+xml 96.7.195.105
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/arrow-right-white.svg

Requested by

Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

96.7.195.105 Miami, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-7-195-105.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

92335224b64f5f098468fe62b305c351fa91bbe7ac8d25b20d82b599b9797d72

Security Headers

Name	Value
Content-Security-Policy	object-src 'none'
Strict-Transport-Security	max-age=15811200
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: object-src 'none'
content-encoding: br
strict-transport-security: max-age=15811200
last-modified: Wed, 15 May 2024 03:11:04 GMT
server: Akamai Resource Optimizer
date: Tue, 11 Jun 2024 21:22:52 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
cache-control: max-age=259200
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1718140972713_1749860490_251732338_1999_10226_43_0_219";dur=1
accept-ranges: bytes
content-length: 143
expires: Fri, 14 Jun 2024 21:22:52 GMT

GET
H2 200 unit42-logo-light.svg
www.paloaltonetworks.com/etc/clientlibs/clean/imgs/ 4 KB
2 KB 82ms
82ms Image
image/svg+xml 96.7.195.105
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/unit42-logo-light.svg

Requested by

Host: www.paloaltonetworks.com
URL: https://www.paloaltonetworks.com/etc.clientlibs/panClean/components/mainNavigationComp/clientlibs/panClean/criticalTopProductNav.min.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

96.7.195.105 Miami, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-7-195-105.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

6421dd8a8110c77dae085c2cbefa53caf58c82307e451fa3ac65718f3b36c232

Security Headers

Name	Value
Content-Security-Policy	object-src 'none'
Strict-Transport-Security	max-age=15811200
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.paloaltonetworks.com/etc.clientlibs/panClean/components/mainNavigationComp/clientlibs/panClean/criticalTopProductNav.min.css
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: object-src 'none'
content-encoding: br
strict-transport-security: max-age=15811200
last-modified: Sun, 02 Jun 2024 06:59:41 GMT
server: Akamai Resource Optimizer
date: Tue, 11 Jun 2024 21:22:52 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
cache-control: max-age=259200
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1718140972695_1749860490_251732339_188_9272_43_0_219";dur=1
accept-ranges: bytes
content-length: 1423
expires: Fri, 14 Jun 2024 21:22:52 GMT

GET
H2 200 search-white.svg
www.paloaltonetworks.com/etc/clientlibs/clean/imgs/ 328 B
571 B 82ms
81ms Image
image/svg+xml 96.7.195.105
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/search-white.svg

Requested by

Host: www.paloaltonetworks.com
URL: https://www.paloaltonetworks.com/etc.clientlibs/panClean/components/mainNavigationComp/clientlibs/panClean/criticalTopProductNav.min.css

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

96.7.195.105 Miami, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-7-195-105.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

4b098a83820406ee35112a0086bcbfaf8dfd357c06d5de16e34fd2c1b2c7d58a

Security Headers

Name	Value
Content-Security-Policy	object-src 'none'
Strict-Transport-Security	max-age=15811200
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://www.paloaltonetworks.com/etc.clientlibs/panClean/components/mainNavigationComp/clientlibs/panClean/criticalTopProductNav.min.css
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: object-src 'none'
content-encoding: br
strict-transport-security: max-age=15811200
last-modified: Sun, 02 Jun 2024 17:33:55 GMT
server: Akamai Resource Optimizer
date: Tue, 11 Jun 2024 21:22:52 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
cache-control: max-age=259200
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1718140972694_1749860490_251732340_153_9623_43_0_219";dur=1
accept-ranges: bytes
content-length: 209
expires: Fri, 14 Jun 2024 21:22:52 GMT

GET
H2 200 Decimal-Semibold-Pro_Web.woff2
www.paloaltonetworks.com/etc/clientlibs/clean/dependencies/fonts/decimal/ 47 KB
47 KB 227ms
107ms Font
application/octet-stream 96.7.195.105
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paloaltonetworks.com/etc/clientlibs/clean/dependencies/fonts/decimal/Decimal-Semibold-Pro_Web.woff2

Requested by

Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

96.7.195.105 Miami, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-7-195-105.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

c223ad34b1e80d587f2f26db6117a8f29e85e00e05b930e50770f97e245084dc

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' paloaltonetworks.com *.paloaltonetworks.com paloaltonetworks.hub.nexuscenter.io;, object-src 'none'
Strict-Transport-Security	max-age=15811200
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/
Origin: https://unit42.paloaltonetworks.com
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=15811200
content-security-policy: frame-ancestors 'self' paloaltonetworks.com *.paloaltonetworks.com paloaltonetworks.hub.nexuscenter.io;, object-src 'none'
date: Tue, 11 Jun 2024 21:22:52 GMT
last-modified: Thu, 06 Jun 2024 09:28:09 GMT
server: Apache
x-frame-options: SAMEORIGIN
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=604800
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1718140972768_1749860490_251733071_35_35997_40_0_255";dur=1
accept-ranges: bytes
content-length: 47819
expires: Tue, 18 Jun 2024 21:22:52 GMT

GET
H2 200 Decimal-Medium-Pro_Web.woff2
www.paloaltonetworks.com/etc/clientlibs/clean/dependencies/fonts/decimal/ 50 KB
50 KB 282ms
163ms Font
application/octet-stream 96.7.195.105
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paloaltonetworks.com/etc/clientlibs/clean/dependencies/fonts/decimal/Decimal-Medium-Pro_Web.woff2

Requested by

Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

96.7.195.105 Miami, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-7-195-105.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

9c1d6395615cae4aa62776a2acbe73a24819df1b1773845fa3e99fe828783961

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self' paloaltonetworks.com *.paloaltonetworks.com paloaltonetworks.hub.nexuscenter.io;, object-src 'none'
Strict-Transport-Security	max-age=15811200
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/
Origin: https://unit42.paloaltonetworks.com
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

strict-transport-security: max-age=15811200
content-security-policy: frame-ancestors 'self' paloaltonetworks.com *.paloaltonetworks.com paloaltonetworks.hub.nexuscenter.io;, object-src 'none'
date: Tue, 11 Jun 2024 21:22:52 GMT
last-modified: Thu, 06 Jun 2024 09:41:50 GMT
server: Apache
x-frame-options: SAMEORIGIN
content-type: application/octet-stream
access-control-allow-origin: *
cache-control: max-age=604800
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1718140972840_1749860490_251733072_33_34541_40_72_255";dur=1
accept-ranges: bytes
content-length: 50943
expires: Tue, 18 Jun 2024 21:22:52 GMT

GET
H/1.1 200
OK unit42-icon-grey.svg
unit42.paloaltonetworks.com/wp-content/themes/unit42-v5/dist/images/svg/ 793 B
1 KB 44ms
44ms Image
image/svg+xml 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v5/dist/images/svg/unit42-icon-grey.svg
Requested by: Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v5/dist/styles/main.css?v3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-69-54-68.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 18c14e773ddd0002e4da1176390b7cc121c2e753e216e7ce3467bd303ccfd3d9

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v5/dist/styles/main.css?v3
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 11 Jun 2024 21:22:52 GMT
Last-Modified: Fri, 16 Feb 2024 13:57:52 GMT
Server: Apache
ETag: "319-611802146cd7e"
Content-Type: image/svg+xml
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 793

GET
H/1.1 200
OK buttons.png
unit42.paloaltonetworks.com/wp-content/plugins/crayon-syntax-highlighter/css/images/toolbar/ 2 KB
2 KB 41ms
41ms Image
image/png 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://unit42.paloaltonetworks.com/wp-content/plugins/crayon-syntax-highlighter/css/images/toolbar/buttons.png
Requested by: Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/wp-content/plugins/crayon-syntax-highlighter/css/min/crayon.min.css?ver=_2.7.2_beta
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-69-54-68.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 630d0a3cc8f4c4aa7bf49b40ae6f59f3a137707e0d7bba46ba44e2e5f2c53aab

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/wp-content/plugins/crayon-syntax-highlighter/css/min/crayon.min.css?ver=_2.7.2_beta
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 11 Jun 2024 21:22:52 GMT
Last-Modified: Fri, 16 Feb 2024 13:57:50 GMT
Server: Apache
ETag: "8bc-6118021367da6"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 2236

GET
H/1.1 200
OK LatoLatin-Black.woff2
unit42.paloaltonetworks.com/wp-content/themes/unit42-v5/dist/fonts/ 42 KB
43 KB 46ms
45ms Font
application/octet-stream 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v5/dist/fonts/LatoLatin-Black.woff2
Requested by: Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v5/dist/styles/main.css?v3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-69-54-68.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: e2c997abb38ede2240d957b57a3216882e8416b1f757f26b92128a8875e00e73

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v5/dist/styles/main.css?v3
Origin: https://unit42.paloaltonetworks.com
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 11 Jun 2024 21:22:52 GMT
Last-Modified: Fri, 16 Feb 2024 13:57:51 GMT
Server: Apache
Connection: keep-alive
Accept-Ranges: bytes
ETag: "a9c0-611802145b825"
Content-Length: 43456

GET
H/1.1 200
OK LatoLatin-Regular.woff2
unit42.paloaltonetworks.com/wp-content/themes/unit42-v5/dist/fonts/ 43 KB
43 KB 44ms
43ms Font
application/octet-stream 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v5/dist/fonts/LatoLatin-Regular.woff2
Requested by: Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v5/dist/styles/main.css?v3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-69-54-68.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: ddd4ef7f97f4361b60841d59753218a57134b0f99f5b46a9612234f1c2733ab0

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v5/dist/styles/main.css?v3
Origin: https://unit42.paloaltonetworks.com
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 11 Jun 2024 21:22:52 GMT
Last-Modified: Fri, 16 Feb 2024 13:57:51 GMT
Server: Apache
Connection: keep-alive
Accept-Ranges: bytes
ETag: "aaf0-6118021460a2d"
Content-Length: 43760

GET
H/1.1 200
OK unit42-scope.ttf
unit42.paloaltonetworks.com/wp-content/themes/unit42-v5/dist/fonts/ 4 KB
5 KB 42ms
41ms Font
application/font-sfnt 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v5/dist/fonts/unit42-scope.ttf?9e4c90
Requested by: Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v5/dist/styles/main.css?v3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-69-54-68.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: df35525390ccc434316ed0514469c12c622dd89e107148f71ab8b5256d06cc9b

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v5/dist/styles/main.css?v3
Origin: https://unit42.paloaltonetworks.com
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 11 Jun 2024 21:22:52 GMT
Last-Modified: Fri, 16 Feb 2024 13:57:51 GMT
Server: Apache
ETag: "1198-6118021462586"
Content-Type: application/font-sfnt
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 4504

GET
H/1.1 200
OK LatoLatin-Bold.woff2
unit42.paloaltonetworks.com/wp-content/themes/unit42-v5/dist/fonts/ 43 KB
44 KB 43ms
42ms Font
application/octet-stream 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v5/dist/fonts/LatoLatin-Bold.woff2
Requested by: Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v5/dist/styles/main.css?v3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-69-54-68.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 276401632a998400be8a5895038f4f72d3760d3c3d6aaf3cf445d109cb9d1540

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v5/dist/styles/main.css?v3
Origin: https://unit42.paloaltonetworks.com
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 11 Jun 2024 21:22:52 GMT
Last-Modified: Fri, 16 Feb 2024 13:57:51 GMT
Server: Apache
Connection: keep-alive
Accept-Ranges: bytes
ETag: "ad5c-611802145c3dd"
Content-Length: 44380

GET
H/1.1 200
OK LatoLatin-Italic.woff2
unit42.paloaltonetworks.com/wp-content/themes/unit42-v5/dist/fonts/ 44 KB
45 KB 52ms
52ms Font
application/octet-stream 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v5/dist/fonts/LatoLatin-Italic.woff2
Requested by: Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v5/dist/styles/main.css?v3
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-69-54-68.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 23d062b46761d2148b84ca93d72dfdf2f16833f2ebb54ebdafdf25f1e10afc50

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v5/dist/styles/main.css?v3
Origin: https://unit42.paloaltonetworks.com
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 11 Jun 2024 21:22:52 GMT
Last-Modified: Fri, 16 Feb 2024 13:57:51 GMT
Server: Apache
Connection: keep-alive
Accept-Ranges: bytes
ETag: "b14c-611802145eaed"
Content-Length: 45388

GET
H/1.1 200
OK monaco-webfont.woff
unit42.paloaltonetworks.com/wp-content/plugins/crayon-syntax-highlighter/fonts/monaco/ 21 KB
21 KB 60ms
59ms Font
application/font-woff 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://unit42.paloaltonetworks.com/wp-content/plugins/crayon-syntax-highlighter/fonts/monaco/monaco-webfont.woff
Requested by: Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/wp-content/plugins/crayon-syntax-highlighter/fonts/monaco.css?ver=_2.7.2_beta
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-69-54-68.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 9c2e1d2864f53c224d6542bed9a1ab1de620dae21a2146eb4ff982dd8fcd4567

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/wp-content/plugins/crayon-syntax-highlighter/fonts/monaco.css?ver=_2.7.2_beta
Origin: https://unit42.paloaltonetworks.com
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 11 Jun 2024 21:22:52 GMT
Last-Modified: Fri, 16 Feb 2024 13:57:50 GMT
Server: Apache
ETag: "537c-61180213698fe"
Content-Type: application/font-woff
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 21372

GET
H2 200 criticalTopBase.min.js Show response
www.paloaltonetworks.com/etc.clientlibs/panClean/components/mainNavigationComp/clientlibs/panClean/ 2 KB
995 B 119ms
118ms Script
application/javascript 96.7.195.105
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paloaltonetworks.com/etc.clientlibs/panClean/components/mainNavigationComp/clientlibs/panClean/criticalTopBase.min.js

Requested by

Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

96.7.195.105 Miami, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-7-195-105.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

013bba7b7113817ba1ad5219806cae1dcaa05e1a865f875b5abc303b874108fc

Security Headers

Name	Value
Content-Security-Policy	object-src 'none'
Strict-Transport-Security	max-age=15811200
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: object-src 'none'
content-encoding: br
strict-transport-security: max-age=15811200
last-modified: Wed, 15 May 2024 02:39:49 GMT
server: Akamai Resource Optimizer
date: Tue, 11 Jun 2024 21:22:52 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript;charset=utf-8
cache-control: public, max-age=259200
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1718140972919_1749860490_251733427_86_10913_41_0_146";dur=1
accept-ranges: bytes
x-robots-tag: noindex
content-length: 596
expires: Fri, 14 Jun 2024 21:22:52 GMT

GET
H2 200 criticalTopProductNav.min.js Show response
www.paloaltonetworks.com/etc.clientlibs/panClean/components/mainNavigationComp/clientlibs/panClean/ 7 KB
2 KB 129ms
128ms Script
application/javascript 96.7.195.105
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paloaltonetworks.com/etc.clientlibs/panClean/components/mainNavigationComp/clientlibs/panClean/criticalTopProductNav.min.js

Requested by

Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

96.7.195.105 Miami, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-7-195-105.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

45b46b7497d7aae8e48cd4972c5d78ddc05e72dd77c9ad30839bec3a5c33a674

Security Headers

Name	Value
Content-Security-Policy	object-src 'none'
Strict-Transport-Security	max-age=15811200
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: object-src 'none'
content-encoding: br
strict-transport-security: max-age=15811200
last-modified: Wed, 15 May 2024 07:51:29 GMT
server: Akamai Resource Optimizer
date: Tue, 11 Jun 2024 21:22:52 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript;charset=utf-8
cache-control: public, max-age=259200
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1718140972924_1749860490_251733428_543_10534_41_0_146";dur=1
accept-ranges: bytes
x-robots-tag: noindex
content-length: 1929
expires: Fri, 14 Jun 2024 21:22:52 GMT

GET
H2 200 defered.min.js Show response
www.paloaltonetworks.com/etc.clientlibs/panClean/components/mainNavigationComp/clientlibs/panClean/ 21 KB
6 KB 120ms
119ms Script
application/javascript 96.7.195.105
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://www.paloaltonetworks.com/etc.clientlibs/panClean/components/mainNavigationComp/clientlibs/panClean/defered.min.js

Requested by

Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

96.7.195.105 Miami, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-7-195-105.deploy.static.akamaitechnologies.com

Software

Akamai Resource Optimizer /

Resource Hash

6d455d957f6da8406bc1c9123512f104fa348800a0141fc0e5ada3fa332c0edf

Security Headers

Name	Value
Content-Security-Policy	object-src 'none'
Strict-Transport-Security	max-age=15811200
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

content-security-policy: object-src 'none'
content-encoding: br
strict-transport-security: max-age=15811200
last-modified: Sun, 02 Jun 2024 23:36:26 GMT
server: Akamai Resource Optimizer
date: Tue, 11 Jun 2024 21:22:52 GMT
vary: Accept-Encoding
x-frame-options: SAMEORIGIN
content-type: application/javascript;charset=utf-8
cache-control: public, max-age=259200
server-timing: cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1718140972919_1749860490_251733429_96_12781_41_0_146";dur=1
accept-ranges: bytes
x-robots-tag: noindex
content-length: 5609
expires: Fri, 14 Jun 2024 21:22:52 GMT

GET
H/1.1 200
OK twitter-x-black-new.svg
unit42.paloaltonetworks.com/wp-content/themes/unit42-v5/dist/images/svg/ 1008 B
1 KB 42ms
41ms Image
image/svg+xml 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v5/dist/images/svg/twitter-x-black-new.svg

Requested by

Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v5/dist/styles/main.css?v3

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-69-54-68.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

3771d42912a6896d0148299bfae4f5d30491f5b984e06c585eef4b856bf34a15

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v5/dist/styles/main.css?v3
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Date: Tue, 11 Jun 2024 21:22:52 GMT
Last-Modified: Tue, 26 Mar 2024 09:03:55 GMT
Server: Apache
ETag: "3f0-6148c91e2800b"
Content-Type: image/svg+xml
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 1008

GET
H2

200

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=9A531C8B532965080A490D4D%40AdobeOrg&d_nsid=0&ts=1718140972988
https://dpm.demdex.net/id/rd?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=9A531C8B532965080A490D4D%40AdobeOrg&d_nsid=0&ts=1718140972988

217 B
822 B

40ms
40ms

XHR
application/json

100.25.187.49
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=9A531C8B532965080A490D4D%40AdobeOrg&d_nsid=0&ts=1718140972988

Requested by

Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/

Protocol

Server

100.25.187.49 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-100-25-187-49.compute-1.amazonaws.com

Software

Resource Hash

207864166a62afda9617c33c60889cd342adac7882ebbd11dedc83819ea145b3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Accept-Language: en-CA,en;q=0.9;q=0.9
Referer: https://unit42.paloaltonetworks.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36

Response headers

dcs: dcs-prod-va6-2-v060-090358285.edge-va6.demdex.com 2 ms
pragma: no-cache
date: Tue, 11 Jun 2024 21:22:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
x-tid: fsWWtLHlSgs=
vary: Origin
content-type: application/json;charset=utf-8
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
access-control-allow-origin: https://unit42.paloaltonetworks.com
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
access-control-allow-credentials: true
content-length: 211
expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

dcs: dcs-prod-va6-2-v060-064b1e5ea.edge-va6.demdex.com 0 ms
pragma: no-cache
date: Tue, 11 Jun 2024 21:22:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-tid: y3ZHV9YRRoI=
vary: Origin
p3p: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
location: https://dpm.demdex.net/id/rd?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=9A531C8B532965080A490D4D%40AdobeOrg&d_nsid=0&ts=1718140972988
access-control-allow-origin: https://unit42.paloaltonetworks.com
cache-control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
access-control-allow-credentials: true
content-length: 0
expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 AppMeasurement.min.js Show response
assets.adobedtm.com/extensions/EPef068a8d6dd34a43866d9a80cc98baab/ 34 KB
13 KB 51ms
50ms Script
application/x-javascript 104.96.164.235
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EPef068a8d6dd34a43866d9a80cc98baab/AppMeasurement.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/launch-425c423d843b.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.96.164.235 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-96-164-235.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 6c789117a5f69b39293256e6899288c8317358589e20c6d08278223f948cd2cf

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 11 Jun 2024 21:22:53 GMT
content-encoding: gzip
last-modified: Tue, 12 Sep 2023 05:33:26 GMT
server: AkamaiNetStorage
etag: "208eb534ea01036a4fca64e6715ccf3f:1694496806.451282"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://unit42.paloaltonetworks.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 12687
expires: Tue, 11 Jun 2024 22:22:53 GMT

GET
H2 200 AppMeasurement_Module_ActivityMap.min.js Show response
assets.adobedtm.com/extensions/EPef068a8d6dd34a43866d9a80cc98baab/ 3 KB
2 KB 51ms
51ms Script
application/x-javascript 104.96.164.235
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.adobedtm.com/extensions/EPef068a8d6dd34a43866d9a80cc98baab/AppMeasurement_Module_ActivityMap.min.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/launch-425c423d843b.min.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.96.164.235 Ashburn, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-96-164-235.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: bc0bfc50d3ff4175132b7da1ef0adf7761ded5cb2782e55edb1948da3480abd8

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 11 Jun 2024 21:22:53 GMT
content-encoding: gzip
last-modified: Tue, 12 Sep 2023 05:33:26 GMT
server: AkamaiNetStorage
etag: "f1e098a5dd836ea5fc9726c429c8d71d:1694496806.740373"
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: https://unit42.paloaltonetworks.com
cache-control: no-cache
accept-ranges: bytes
timing-allow-origin: *
content-length: 1597
expires: Tue, 11 Jun 2024 22:22:53 GMT

GET
H2 200 uwt.js Show response
static.ads-twitter.com/ 56 KB
15 KB 116ms
36ms Script
application/javascript 146.75.36.157
FASTLY

General

Check archive.org

Show headers Download Go to

Full URL: https://static.ads-twitter.com/uwt.js
Requested by: Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/launch-425c423d843b.min.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 146.75.36.157 Reston, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software: /
Resource Hash: 4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 11 Jun 2024 21:22:53 GMT
content-encoding: gzip
last-modified: Fri, 15 Mar 2024 03:07:08 GMT
x-amz-server-side-encryption: AES256
etag: "bbbcf811d8437a575d796a4c1e5d4fad+gzip"
vary: Accept-Encoding,Host
x-cache: HIT
content-type: application/javascript; charset=utf-8
p3p: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
x-tw-cdn: FT
cache-control: no-cache
accept-ranges: bytes
content-length: 15412
x-served-by: cache-iad-kcgs7200141-IAD

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 21 KB
7 KB 74ms
32ms Script
application/javascript 104.19.178.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/launch-425c423d843b.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.178.52 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

fdfea52427fb822bebdd32b325768e73b40637bd203c100827d4dece88e431c3

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 11 Jun 2024 21:22:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: YmFgVUTeB0lXZXM9YgX19A==
age: 22802
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 6882
x-ms-lease-status: unlocked
last-modified: Mon, 10 Jun 2024 15:43:59 GMT
server: cloudflare
etag: 0x8DC89642588AF95
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: eac4e9ff-e01e-004e-1c50-bb848c000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 8924a8b9cdf9ac60-YYZ
expires: Wed, 12 Jun 2024 15:02:51 GMT

POST
H/1.1 200
OK admin-ajax.php Show response
unit42.paloaltonetworks.com/wp-admin/ 134 B
739 B 501ms
501ms Fetch
text/html 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://unit42.paloaltonetworks.com/wp-admin/admin-ajax.php

Requested by

Host: unit42.paloaltonetworks.com
URL: https://unit42.paloaltonetworks.com/wp-content/plugins/post-views-counter/js/frontend.min.js?ver=1.4.6

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a104-69-54-68.deploy.static.akamaitechnologies.com

Software

Apache /

Resource Hash

73db81f6fdabaee64cdd0ded47300068f41e43524ea2c1f3ec3880dd3027df9c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-platform: "Win32"
Referer: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=utf-8

Response headers

Strict-Transport-Security: max-age=31536000; includeSubDomains
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Date: Tue, 11 Jun 2024 21:22:53 GMT
Connection: keep-alive
Content-Length: 126
Pragma: no-cache
Referrer-Policy: strict-origin-when-cross-origin
Server: Apache
X-Frame-Options: SAMEORIGIN
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Access-Control-Allow-Origin: https://unit42.paloaltonetworks.com
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: true
X-Robots-Tag: noindex
Expires: Tue, 11 Jun 2024 21:22:53 GMT

GET
H3 200 anchor
www.google.com/recaptcha/api2/ Frame DD49 0
0 159ms
72ms Document
text/html 172.217.222.147
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lc5EhgTAAAAAJa-DzE7EeWABasWg4LKv-R3ao6o&co=aHR0cHM6Ly91bml0NDIucGFsb2FsdG9uZXR3b3Jrcy5jb206NDQz&hl=en&v=9pvHvq7kSOTqqZusUzJ6ewaF&size=normal&cb=7dng8auaub0p

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/9pvHvq7kSOTqqZusUzJ6ewaF/recaptcha__en.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.222.147 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

qi-in-f147.1e100.net

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-Q7vuZCYTa1bBbV3IafoV1A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-CA,en;q=0.9;q=0.9
Referer: https://unit42.paloaltonetworks.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-Q7vuZCYTa1bBbV3IafoV1A' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 11 Jun 2024 21:22:53 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 8380accb-00d6-4b05-90ec-6d405f7310d6.json Show response
cdn.cookielaw.org/consent/8380accb-00d6-4b05-90ec-6d405f7310d6/ 5 KB
2 KB 79ms
39ms XHR
application/x-javascript 104.19.178.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/8380accb-00d6-4b05-90ec-6d405f7310d6/8380accb-00d6-4b05-90ec-6d405f7310d6.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.178.52 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ba436e29a2c0cc102db63b1405f3498fa01e28662e5413bbd460c7be1103bf2c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 11 Jun 2024 21:22:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 37682
content-md5: Gdu5pXKfQvcnYi1RzkO76A==
content-length: 1798
x-ms-lease-status: unlocked
last-modified: Mon, 18 Mar 2024 11:32:28 GMT
server: cloudflare
etag: 0x8DC473F17A7E2D4
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 888caf20-801e-001e-5128-79d55b000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 8924a8bc4f1ab409-YYZ
expires: Wed, 12 Jun 2024 21:22:53 GMT

GET
H2 200 id Show response
sstats.paloaltonetworks.com/ 48 B
478 B 123ms
41ms XHR
application/x-javascript 63.140.38.210
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://sstats.paloaltonetworks.com/id?d_visid_ver=5.5.0&d_fieldgroup=A&mcorgid=9A531C8B532965080A490D4D%40AdobeOrg&mid=41382693796588588851762894284114679203&ts=1718140973435

Requested by

Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/9273d4aedcd2/0d76ae0322d7/launch-425c423d843b.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

63.140.38.210 , United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ip-63-140-38-210.data.adobedc.net

Software

jag /

Resource Hash

6fa753571c15eef7a9ed66ecd7c87486934df6f0fe83b06a8455522e0d0dd02b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-platform: "Win32"
Referer: https://unit42.paloaltonetworks.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Tue, 11 Jun 2024 21:22:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains
x-content-type-options: nosniff
server: jag
vary: Origin
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: https://unit42.paloaltonetworks.com
p3p: CP="This is not a P3P policy"
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
content-length: 48
x-xss-protection: 1; mode=block

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 68 B
306 B 89ms
47ms XHR
application/json 104.18.32.137
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.32.137 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0a1309d2ccff026ab4dcf050977befc877505115e4777e240fa328b1781c63ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
accept: application/json
Referer: https://unit42.paloaltonetworks.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

date: Tue, 11 Jun 2024 21:22:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS
content-type: application/json
access-control-allow-origin: *
cf-ray: 8924a8bd1d80aae0-YYZ
access-control-allow-headers: Content-Type

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/202403.1.0/ 442 KB
107 KB 29ms
29ms Script
application/javascript 104.19.178.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202403.1.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.178.52 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

15de250a16ce58a10f84bebab59b9005ce36df4ec8e87c3bb1acc92726cfa971

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 11 Jun 2024 21:22:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: s7qm2vbmUNglr6Jt5k9KHA==
age: 21688
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 109676
x-ms-lease-status: unlocked
last-modified: Thu, 21 Mar 2024 07:04:35 GMT
server: cloudflare
etag: 0x8DC49752A75EB01
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: f463857b-001e-005d-3a08-7c3307000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 8924a8be3bddac60-YYZ

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/8380accb-00d6-4b05-90ec-6d405f7310d6/018df4a9-4a10-72a1-9981-772a67196b0e/ 148 KB
32 KB 40ms
39ms Fetch
application/x-javascript 104.19.178.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/8380accb-00d6-4b05-90ec-6d405f7310d6/018df4a9-4a10-72a1-9981-772a67196b0e/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202403.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.178.52 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

af6c6b528208aaa4f3f7491b4f309411a62f82f1ad9b989e4bae48933a40f8f1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 11 Jun 2024 21:22:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 36490
content-md5: K1SAoPCcQVs1gw6Oc0JN+w==
content-length: 32691
x-ms-lease-status: unlocked
last-modified: Mon, 18 Mar 2024 11:32:40 GMT
server: cloudflare
etag: 0x8DC473F1ED6E569
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 7e22a7ab-d01e-002c-1328-79d52c000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 8924a8bed97eb409-YYZ
expires: Wed, 12 Jun 2024 21:22:53 GMT

GET
H/1.1 200
OK icon-Unit42-32x32.png
unit42.paloaltonetworks.com/wp-content/themes/unit42-v5/favicon/ 780 B
1017 B 42ms
41ms Other
image/png 104.69.54.68
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v5/favicon/icon-Unit42-32x32.png
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.69.54.68 New York, United States, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-69-54-68.deploy.static.akamaitechnologies.com
Software: Apache /
Resource Hash: 0a4a89f730bfebb50c71064238ac11eb20fbb6233c7a814822e926e3b3df57fc

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

Date: Tue, 11 Jun 2024 21:22:53 GMT
Last-Modified: Fri, 16 Feb 2024 13:57:52 GMT
Server: Apache
ETag: "30c-6118021470046"
Content-Type: image/png
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 780

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/202403.1.0/assets/ 13 KB
3 KB 35ms
34ms Fetch
application/json 104.19.178.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202403.1.0/assets/otFlat.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202403.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.178.52 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f4aaa18c55c90588c5e828e56dcc6b2cb0acf9a4280494c7d1a53fc5e3669112

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 11 Jun 2024 21:22:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: KLWFssuowJEtDumTaVZD/A==
age: 13664
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 3041
x-ms-lease-status: unlocked
last-modified: Thu, 21 Mar 2024 07:04:28 GMT
server: cloudflare
etag: 0x8DC497526A04834
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 8bb68bd1-c01e-006d-2626-7c8dc8000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 8924a8bf59e3b409-YYZ

GET
H2 200 otPcCenter.json Show response
cdn.cookielaw.org/scripttemplates/202403.1.0/assets/v2/ 62 KB
13 KB 30ms
30ms Fetch
application/json 104.19.178.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202403.1.0/assets/v2/otPcCenter.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202403.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.178.52 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f40f57620246d052ea666f8f9d25dc6fcd93a7bbd6314077a2eb7213e98a4b5a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 11 Jun 2024 21:22:53 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: ZcF16z2xXnh51d4MuKhe/w==
age: 37681
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 12808
x-ms-lease-status: unlocked
last-modified: Thu, 21 Mar 2024 07:04:30 GMT
server: cloudflare
etag: 0x8DC497527F063BE
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 2642379d-a01e-008f-6ec3-7bb0e9000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 8924a8bf59e5b409-YYZ

GET
H2 200 otCommonStyles.css Show response
cdn.cookielaw.org/scripttemplates/202403.1.0/assets/ 24 KB
4 KB 33ms
33ms Fetch
text/css 104.19.178.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202403.1.0/assets/otCommonStyles.css

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202403.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.178.52 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

06c0edbfc1b871fb45195265f5faad3e23191305f6ff2125557a9fbc287c8992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 11 Jun 2024 21:22:53 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: 4ErYmXXFNbMLrnc9DrDTsg==
age: 24252
x-ms-lease-status: unlocked
last-modified: Thu, 21 Mar 2024 07:04:40 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 56fa205d-c01e-006d-6a60-7b8dc8000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 8924a8bf59e7b409-YYZ

GET
H2 200 ot_close.svg
cdn.cookielaw.org/logos/static/ 651 B
623 B 36ms
36ms Image
image/svg+xml 104.19.178.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/ot_close.svg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.178.52 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 11 Jun 2024 21:22:54 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: pcXWFGpuVeSg/jVnYCseRg==
age: 12592
x-ms-lease-status: unlocked
last-modified: Tue, 11 Jun 2024 01:45:21 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 89215259-f01e-0096-34ae-bb235d000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 8924a8bfae79ac60-YYZ

GET
H2 200 ot_guard_logo.svg Show response
cdn.cookielaw.org/logos/static/ 497 B
517 B 30ms
30ms Fetch
image/svg+xml 104.19.178.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/logos/static/ot_guard_logo.svg

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202403.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.178.52 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 11 Jun 2024 21:22:54 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: tXyZydHjxQshFMbbBT1/8A==
age: 24253
x-ms-lease-status: unlocked
last-modified: Mon, 10 Jun 2024 15:44:01 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: a4340e26-f01e-0051-415b-bb5f9c000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 8924a8bfaa39b409-YYZ

GET
H2 200 PANW_Parent_Brand_Primary_Logo_RGB_Red_White.png
cdn.cookielaw.org/logos/17444fe5-d1b7-4e74-91f7-54412bafd309/c96e4f44-29f1-4037-b8db-8926e9558ce1/fbdfdc34-f2b3-41d8-936a-a34060d48bd6/ 17 KB
17 KB 34ms
33ms Image
image/png 104.19.178.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/17444fe5-d1b7-4e74-91f7-54412bafd309/c96e4f44-29f1-4037-b8db-8926e9558ce1/fbdfdc34-f2b3-41d8-936a-a34060d48bd6/PANW_Parent_Brand_Primary_Logo_RGB_Red_White.png

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.178.52 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

2003684d0dca4a5838a3fa6c7f4a8bcb44f09e64e2758acc30e9b746263f6079

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 11 Jun 2024 21:22:54 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: gZJmTLN9lSoogPMyB90hRw==
age: 3101
content-length: 17455
x-ms-lease-status: unlocked
last-modified: Wed, 23 Jun 2021 11:56:03 GMT
server: cloudflare
etag: 0x8D9363DE041417F
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
x-ms-request-id: 147fd62a-101e-007e-6ecc-1ca9c4000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 8924a8bfbe90ac60-YYZ

GET
H2 200 powered_by_logo.svg
cdn.cookielaw.org/logos/static/ 5 KB
2 KB 30ms
30ms Image
image/svg+xml 104.19.178.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/powered_by_logo.svg

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.19.178.52 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
Referer: https://unit42.paloaltonetworks.com/
Accept-Language: en-CA,en;q=0.9;q=0.9
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua-platform: "Win32"

Response headers

x-ms-blob-type: BlockBlob
date: Tue, 11 Jun 2024 21:22:54 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: Y+c301RBZNK39PvKQWrIBw==
age: 22946
x-ms-lease-status: unlocked
last-modified: Mon, 10 Jun 2024 15:44:02 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 5e9b8716-c01e-001d-5b69-bb9883000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 8924a8bfbe92ac60-YYZ

GET
H3 200 bframe
www.google.com/recaptcha/api2/ Frame C342 0
0 59ms
57ms Document
text/html 172.217.222.147
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/bframe?hl=en&v=9pvHvq7kSOTqqZusUzJ6ewaF&k=6Lc5EhgTAAAAAJa-DzE7EeWABasWg4LKv-R3ao6o

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/9pvHvq7kSOTqqZusUzJ6ewaF/recaptcha__en.js

Protocol

Security

QUIC, , AES_128_GCM

Server

172.217.222.147 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

qi-in-f147.1e100.net

Software

GSE /

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-BIMP8V8G05c8WkXAArMEbQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Accept-Language: en-CA,en;q=0.9;q=0.9
Referer: https://unit42.paloaltonetworks.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
sec-ch-ua: "Google Chrome";v="125", "Not:A-Brand";v="8", "Chromium";v="125"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Win32"

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-BIMP8V8G05c8WkXAArMEbQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Tue, 11 Jun 2024 21:22:54 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

Verdicts & Comments Add Verdict or Comment

133 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

7 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.paloaltonetworks.com/	1970-01-20 21:15:41	Name: _ec_aprov_notifications Value: eyJzIjpbXSwidyI6W10sImUiOltdfQ%3D%3D
.demdex.net/	1970-01-21 01:34:52	Name: demdex Value: 35664540986192879571182069604260371891
.paloaltonetworks.com/	1969-12-31 23:59:59	Name: AMCVS_9A531C8B532965080A490D4D%40AdobeOrg Value: 1
.paloaltonetworks.com/	1970-01-21 06:51:40	Name: s_ecid Value: MCMID%7C41382693796588588851762894284114679203
.paloaltonetworks.com/	1970-01-21 06:51:40	Name: AMCV_9A531C8B532965080A490D4D%40AdobeOrg Value: 179643557%7CMCIDTS%7C19886%7CMCMID%7C41382693796588588851762894284114679203%7CMCAAMLH-1718745773%7C7%7CMCAAMB-1718745773%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1718148173s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C5.5.0
unit42.paloaltonetworks.com/	1970-01-20 21:17:07	Name: pvc_visits[0] Value: 1718227373b25125
.paloaltonetworks.com/	1970-01-21 06:01:16	Name: OptanonConsent Value: isGpcEnabled=0&datestamp=Tue+Jun+11+2024+14%3A22%3A54+GMT-0700+(Pacific+Daylight+Saving+Time)&version=202403.1.0&browserGpcFlag=0&isIABGlobal=false&hosts=&consentId=7872ffbc-632b-47b8-8fc2-c6d4eb780ec7&interactionCount=0&isAnonUser=1&landingPath=https%3A%2F%2Funit42.paloaltonetworks.com%2Funit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks%2F&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0

3 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
other	warning	URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://unit42.paloaltonetworks.com/unit42-pulling-back-the-curtains-on-encodedcommand-powershell-attacks/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

assets.adobedtm.com
cdn.cookielaw.org
dpm.demdex.net
fonts.googleapis.com
geolocation.onetrust.com
goo.gl
researchcenter.paloaltonetworks.com
sstats.paloaltonetworks.com
static.ads-twitter.com
unit42.paloaltonetworks.com
www.google.com
www.gstatic.com
www.paloaltonetworks.com
100.25.187.49
104.18.32.137
104.19.178.52
104.69.54.68
104.96.164.235
146.75.36.157
172.217.222.100
172.217.222.103
172.217.222.147
172.253.62.95
173.194.68.94
63.140.38.210
96.7.195.105
00501810e93307a8882a74d864e7547fd1458deea539361dc1124ac133799a4b
013bba7b7113817ba1ad5219806cae1dcaa05e1a865f875b5abc303b874108fc
01e43870a4218fe731a3516dd76725698c3aadfb285465086849c6b52ef71719
044efea78208376302aad3808aaabdf3c2f7bdd80ba9d55c9e0e4d3baa7a3908
06c0edbfc1b871fb45195265f5faad3e23191305f6ff2125557a9fbc287c8992
0a1309d2ccff026ab4dcf050977befc877505115e4777e240fa328b1781c63ae
0a4a89f730bfebb50c71064238ac11eb20fbb6233c7a814822e926e3b3df57fc
0ea483a3020f20467311f88198ac887d4c3032485b36f30ec83bfa93af6d12d2
0f99161d83c288e754f5f7af3d0fc0e47e3e2289d5bf6f3df964d33785ec30a9
1446f4bb5332929dacf22e36cfcbf40ce14be3c6c88b9efa339bf3f37c213346
15de250a16ce58a10f84bebab59b9005ce36df4ec8e87c3bb1acc92726cfa971
18c14e773ddd0002e4da1176390b7cc121c2e753e216e7ce3467bd303ccfd3d9
193fbb968733b8a7049da19274546e6b80b76e9a8f1b837fee9a5fdeb8f97c7b
2003684d0dca4a5838a3fa6c7f4a8bcb44f09e64e2758acc30e9b746263f6079
207864166a62afda9617c33c60889cd342adac7882ebbd11dedc83819ea145b3
22a79f1fbcc70373c7021bae2164d9232d1e9dd3c6a163df9f9f54070e5f6b50
23d062b46761d2148b84ca93d72dfdf2f16833f2ebb54ebdafdf25f1e10afc50
2437b926f4178e441a5d7d99c900070912a94889035b2d7821022712f5ca689d
2603910bd5da680dbb063e5772f2f9d722150e08f8a21d65dbd214810ed1e5f7
276401632a998400be8a5895038f4f72d3760d3c3d6aaf3cf445d109cb9d1540
291cf581b824e88d8e5292c399d39fe9940cc6d50c1cfe21e0525a510e9e0b2a
2fff39fc60bd268cd34d270f80d39a61bd875100c73d7cfb3ac2c93166e8542d
3345e1d5601514a1fa98397e817d7c940715b82c438d16183ebc990b1904c052
351cb79f16546f26c862b782233ada0a5aec6366fb29dadcdb971f699b98bdd3
3668f6d335416599574fb1f336cbd2b9bb2f8fcff63e63a9ca3b68df4d0c6165
3771d42912a6896d0148299bfae4f5d30491f5b984e06c585eef4b856bf34a15
37c5694161fda223034cd9fe184f6801ce2564b8952482a67bdcb871431492d8
3bedfc6a1eccd45281b8c1a4b66af947f9944b7e750566c2268a4eb927ee2cdb
45b46b7497d7aae8e48cd4972c5d78ddc05e72dd77c9ad30839bec3a5c33a674
4b098a83820406ee35112a0086bcbfaf8dfd357c06d5de16e34fd2c1b2c7d58a
4d15ff2317e16ccd8ca1d3248fea7d91130e022369bb032824a84ad9967064df
51698055502813cd29205292dfcb7517bd803cf9deb22e21d06bd24fb3bcdf4b
5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89
5f12968474e2995c485a2c256a9819dde04e78b6a13aacadfba935ed7970234a
5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d
630d0a3cc8f4c4aa7bf49b40ae6f59f3a137707e0d7bba46ba44e2e5f2c53aab
6421dd8a8110c77dae085c2cbefa53caf58c82307e451fa3ac65718f3b36c232
68b324a6179651d56917d3b1f3f5d0a1e71b08550b1468790826dde5e22b2b56
691dcdb24853a0f5ce4e6597e5713dea66799b57ffe2c2a10f28f98e0b569b19
6c789117a5f69b39293256e6899288c8317358589e20c6d08278223f948cd2cf
6d455d957f6da8406bc1c9123512f104fa348800a0141fc0e5ada3fa332c0edf
6fa753571c15eef7a9ed66ecd7c87486934df6f0fe83b06a8455522e0d0dd02b
71f8892d3e3883e5fdf73032c7ab583e52fad50ce2d684084dbe6ded853c6b67
73db81f6fdabaee64cdd0ded47300068f41e43524ea2c1f3ec3880dd3027df9c
76bca5fd591b8221d4ef60699a5ce3757b4db7c1c4e9707c3bf2a1290b08dd72
7736c86f193c9d74521d86687f9357d2e8b33e1e5155e66ee512813c1cc3ab47
789094003d7990c9a6943bf5ea8a789ac2701810361a2c84a815ed08e277efdc
8b33eebc11529672afc8f1ac6d5d4ef24bed8dfec1505a2510c805e0dd21565f
8c0d1ddb17510639cc14e2f251206d5c8984d85e23b8e7dc13438c81bf5ce985
8ec11303a508ae99cfde8da8d8418863f5c44c6e4d9ad85d89b751711810ccbe
901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc
92335224b64f5f098468fe62b305c351fa91bbe7ac8d25b20d82b599b9797d72
964d556a74d8d77dbefdfc01e6aa74644aa082837d259442be8869d3440900a5
98cecf88a23542fa047ce46eedb650b5c5128761ed4386c0977b847094ddfa20
9a0292e0cbc4b30386d1d5c106a5755e1fb924d7569d9a23f9e3e7162996becc
9a3d1f5824ad4bd991a67acab64088920e43d25545ca6b4cb78736dc35b696a3
9c1d6395615cae4aa62776a2acbe73a24819df1b1773845fa3e99fe828783961
9c2e1d2864f53c224d6542bed9a1ab1de620dae21a2146eb4ff982dd8fcd4567
a245df6da22f0700461deb2f6f840edce1f07613bab8e44eaa076f97bc40995f
af6c6b528208aaa4f3f7491b4f309411a62f82f1ad9b989e4bae48933a40f8f1
b350cde8333b78d909635b54c3f50fd72d38abcb67cf4ee1a3a212be1d775768
b69d3e8f5f3218a4938de692d1a7adde67cf70b77f459721396d347119f953f5
b849ac9311853409dafdd2928bffaa5e78d9a3fbb3739080488b01c2a5788901
ba436e29a2c0cc102db63b1405f3498fa01e28662e5413bbd460c7be1103bf2c
bc0bfc50d3ff4175132b7da1ef0adf7761ded5cb2782e55edb1948da3480abd8
bffcc69c3362280e393774770ac39dd3ee2ee6fe0554792552750286183bce98
c21e5a2b32c47bc5f9d9efc97bc0e29fd081946d1d3ebffc5621cfafb1d3960e
c223ad34b1e80d587f2f26db6117a8f29e85e00e05b930e50770f97e245084dc
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf
cc2a604a1e6f73444e8db5d749a64c62899943e68ad07feeee39050b4fdb32cb
ce8287c3e0aa69b9b84e99fefcd63c5aa3e5f91d59852efad2a446efb3f07595
cf10b8926160d5ac5e3e6fc235a7499e91f04b0097d37bac51efe1c5ed61d92b
ddbda21655c0c2cb09913a9e33d856a8b8f3e1eae610cdbda8524def2dc71f7d
ddd4ef7f97f4361b60841d59753218a57134b0f99f5b46a9612234f1c2733ab0
df35525390ccc434316ed0514469c12c622dd89e107148f71ab8b5256d06cc9b
df7f202668377b7013a8c879cd3929f0d916f69cda35f8c767250eafc491341b
e01385043cf0b49f44fba01d20ec12122309de224da894a29c559e9ca8b635dc
e2c997abb38ede2240d957b57a3216882e8416b1f757f26b92128a8875e00e73
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3d961493e244e06bf91a9857442891e2e2ad8d49cf8e0a7781c53f0707443d7
e8740a9c4cf277abdc68fe4fb953750244390818fa0f745c5f4fe14862c89cb5
f40f57620246d052ea666f8f9d25dc6fcd93a7bbd6314077a2eb7213e98a4b5a
f4aaa18c55c90588c5e828e56dcc6b2cb0acf9a4280494c7d1a53fc5e3669112
fdfea52427fb822bebdd32b325768e73b40637bd203c100827d4dece88e431c3

unit42.paloaltonetworks.com Open in urlscan Pro 104.69.54.68 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

86 Requests

99 %HTTPS

0 %IPv6

10 Domains

13 Subdomains

12 IPs

2 Countries

1746 kBTransfer

4736 kBSize

7 Cookies

85 Outgoing links

Page URL History

Redirected requests

86 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

unit42.paloaltonetworks.com Open in urlscan Pro
104.69.54.68 Public Scan

Screenshot
Live screenshot

Full Image

86
Requests

99 %
HTTPS

0 %
IPv6

10
Domains

13
Subdomains

12
IPs

2
Countries

1746 kB
Transfer

4736 kB
Size

7
Cookies

86 HTTP transactions
0 data transactions