urlscan.io logo urlscan.io
SecurityTrails logo

www.powershellmagazine.com Open in urlscan Pro
104.131.21.239  Public Scan

Go To Rescan Add Verdict Report
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Submission: On February 24 via api from US
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 30 IPs in 8 countries across 27 domains to perform 134 HTTP transactions. The main IP is 104.131.21.239, located in Clifton, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is www.powershellmagazine.com.
TLS certificate: Issued by R3 on January 14th 2021. Valid for: 3 months.
This is the only time www.powershellmagazine.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
43 104.131.21.239 14061 (DIGITALOC...)
2 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
2 2a04:fa87:fff... 2635 (AUTOMATTIC)
5 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
5 151.101.112.134 54113 (FASTLY)
13 2606:4700::68... 13335 (CLOUDFLAR...)
4 151.101.192.134 54113 (FASTLY)
1 2a00:1450:400... 15169 (GOOGLE)
4 151.101.112.64 54113 (FASTLY)
1 2a00:1450:400... 15169 (GOOGLE)
1 2a00:1450:400... 15169 (GOOGLE)
13 199.232.137.44 54113 (FASTLY)
1 3 184.25.115.49 16625 (AKAMAI-AS)
1 199.232.198.49 54113 (FASTLY)
2 2606:4700::68... 13335 (CLOUDFLAR...)
16 151.101.13.44 54113 (FASTLY)
2 2 18.185.46.229 16509 (AMAZON-02)
2 6 141.226.228.48 200478 (TABOOLA-AS)
1 1 69.173.144.138 26667 (RUBICONPR...)
1 2 198.148.27.140 19189 (PULSEPOINT)
1 37.252.173.38 29990 (ASN-APPNEX)
1 1 142.250.185.194 15169 (GOOGLE)
1 2 2a00:1450:400... 15169 (GOOGLE)
1 185.64.190.80 62713 (AS-PUBMATIC)
2 2 34.252.253.152 16509 (AMAZON-02)
1 2 216.52.2.48 29791 (VOXEL-DOT...)
1 185.86.138.114 201081 (SMARTADSE...)
1 174.137.133.49 27257 (WEBAIR-IN...)
1 18.195.155.181 16509 (AMAZON-02)
1 1 178.250.2.151 44788 (ASN-CRITE...)
1 1 139.162.84.221 63949 (LINODE-AP...)
1 192.132.33.46 18568 (BIDTELLECT)
1 141.226.224.32 200478 (TABOOLA-AS)
3 3 52.29.191.126 16509 (AMAZON-02)
2 2 18.192.249.156 16509 (AMAZON-02)
134 30
43    104.131.21.239 (Clifton, United States)

ASN14061 (DIGITALOCEAN-ASN, US)
www.powershellmagazine.com
2    2a00:1450:4001:829::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.googleapis.com
1    2a00:1450:4001:80e::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
apis.google.com
2    2a04:fa87:fffe::c000:4902 (Ireland)

ASN2635 (AUTOMATTIC, US)
secure.gravatar.com
5    2a00:1450:4001:82b::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
apis.google.com
3    2a00:1450:4001:810::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
fonts.gstatic.com
5    151.101.112.134 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
powershellmagazine.disqus.com
referrer.disqus.com
13    2606:4700::6812:a813 (United States)

ASN13335 (CLOUDFLARENET, US)
c.disquscdn.com
4    151.101.192.134 (United States)

ASN54113 (FASTLY, US)
disqus.com
1    2a00:1450:4001:809::200d (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
accounts.google.com
4    151.101.112.64 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
tempest.services.disqus.com
links.services.disqus.com
1    2a00:1450:4001:813::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
www.google.com
1    2a00:1450:4001:809::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
ssl.gstatic.com
13    199.232.137.44 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
cdn.taboola.com
trc.taboola.com
3    184.25.115.49 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a184-25-115-49.deploy.static.akamaitechnologies.com
sb.scorecardresearch.com
1    199.232.198.49 (United States)

ASN54113 (FASTLY, US)
a.disquscdn.com
2    2606:4700::6810:a10d (United States)

ASN13335 (CLOUDFLARENET, US)
cdn.viglink.com
16    151.101.13.44 (Frankfurt am Main, Germany)

ASN54113 (FASTLY, US)
15.taboola.com
match.taboola.com
images.taboola.com
vidstat.taboola.com
2    18.185.46.229 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-185-46-229.eu-central-1.compute.amazonaws.com
rtb.mfadsrvr.com
6    141.226.228.48 (Netherlands)

ASN200478 (TABOOLA-AS, IL)
sync.taboola.com
sync-t1.taboola.com
1    69.173.144.138 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)
pixel.rubiconproject.com
2    198.148.27.140 (New York, United States)

ASN19189 (PULSEPOINT, US)
bh.contextweb.com
1    37.252.173.38 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEX, US)
PTR: 537.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
ib.adnxs.com
1    142.250.185.194 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s52-in-f2.1e100.net
cm.g.doubleclick.net
2    2a00:1450:4001:82a::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)
cm.g.doubleclick.net
1    185.64.190.80 (United Kingdom)

ASN62713 (AS-PUBMATIC, US)
simage2.pubmatic.com
2    34.252.253.152 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
match.adsrvr.org
2    216.52.2.48 (United States)

ASN29791 (VOXEL-DOT-NET, US)
ce.lijit.com
1    185.86.138.114 (France)

ASN201081 (SMARTADSERVER, FR)
rtb-csync.smartadserver.com
1    174.137.133.49 (United States)

ASN27257 (WEBAIR-INTERNET, US)
dsp.adkernel.com
1    18.195.155.181 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
PTR: ec2-18-195-155-181.eu-central-1.compute.amazonaws.com
e1.emxdgt.com
1    178.250.2.151 (France)

ASN44788 (ASN-CRITEO-EUROPE, FR)
dis.criteo.com
1    139.162.84.221 (Tokyo, Japan)

ASN63949 (LINODE-AP Linode, LLC, US)
PTR: li1564-221.members.linode.com
s.c.appier.net
1    192.132.33.46 (United States)

ASN18568 (BIDTELLECT, US)
PTR: 46.bidtellect.com
bttrack.com
1    141.226.224.32 (United States)

ASN200478 (TABOOLA-AS, IL)
cds.taboola.com
3    52.29.191.126 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
x.bidswitch.net
2    18.192.249.156 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02, US)
prod.perf-serving.com
Apex Domain
Subdomains		 Transfer
43 powershellmagazine.com
www.powershellmagazine.com
312 KB
36 taboola.com
cdn.taboola.com
trc.taboola.com
15.taboola.com
sync.taboola.com
match.taboola.com
sync-t1.taboola.com
cds.taboola.com
images.taboola.com
vidstat.taboola.com
394 KB
14 disquscdn.com
c.disquscdn.com
a.disquscdn.com
528 KB
13 disqus.com
powershellmagazine.disqus.com
disqus.com
tempest.services.disqus.com
referrer.disqus.com
links.services.disqus.com
67 KB
8 google.com
apis.google.com
accounts.google.com
www.google.com
130 KB
4 gstatic.com
fonts.gstatic.com
ssl.gstatic.com
34 KB
3 bidswitch.net
x.bidswitch.net
1 KB
3 doubleclick.net
cm.g.doubleclick.net
2 KB
3 scorecardresearch.com
sb.scorecardresearch.com
3 KB
2 perf-serving.com
prod.perf-serving.com
1 KB
2 lijit.com
ce.lijit.com
1018 B
2 adsrvr.org
match.adsrvr.org
915 B
2 contextweb.com
bh.contextweb.com
1 KB
2 mfadsrvr.com
rtb.mfadsrvr.com
1 KB
2 viglink.com
cdn.viglink.com
696 B
2 gravatar.com
secure.gravatar.com
8 KB
2 googleapis.com
fonts.googleapis.com
1 KB
1 bttrack.com
bttrack.com
380 B
1 appier.net
s.c.appier.net
360 B
1 criteo.com
dis.criteo.com
525 B
1 emxdgt.com
e1.emxdgt.com
124 B
1 adkernel.com
dsp.adkernel.com
233 B
1 smartadserver.com
rtb-csync.smartadserver.com
715 B
1 pubmatic.com
simage2.pubmatic.com
1009 B
1 adnxs.com
ib.adnxs.com
695 B
1 rubiconproject.com
pixel.rubiconproject.com
782 B
0 id5-sync.com Failed
id5-sync.com Failed
134 27
Domain Requested by
43 www.powershellmagazine.com www.powershellmagazine.com
13 images.taboola.com tempest.services.disqus.com
13 c.disquscdn.com powershellmagazine.disqus.com
disqus.com
c.disquscdn.com
8 cdn.taboola.com tempest.services.disqus.com
cdn.taboola.com
6 apis.google.com www.powershellmagazine.com
apis.google.com
accounts.google.com
5 trc.taboola.com cdn.taboola.com
4 sync.taboola.com 2 redirects
4 disqus.com powershellmagazine.disqus.com
c.disquscdn.com
3 links.services.disqus.com c.disquscdn.com
3 x.bidswitch.net 3 redirects
3 cm.g.doubleclick.net 2 redirects
3 sb.scorecardresearch.com 1 redirects cdn.taboola.com
tempest.services.disqus.com
3 referrer.disqus.com www.powershellmagazine.com
3 fonts.gstatic.com fonts.googleapis.com
2 prod.perf-serving.com 2 redirects
2 sync-t1.taboola.com
2 ce.lijit.com 1 redirects
2 match.adsrvr.org 2 redirects
2 bh.contextweb.com 1 redirects
2 rtb.mfadsrvr.com 2 redirects
2 cdn.viglink.com www.powershellmagazine.com
2 powershellmagazine.disqus.com www.powershellmagazine.com
2 secure.gravatar.com www.powershellmagazine.com
2 fonts.googleapis.com www.powershellmagazine.com
1 vidstat.taboola.com cdn.taboola.com
1 cds.taboola.com
1 bttrack.com
1 s.c.appier.net 1 redirects
1 dis.criteo.com 1 redirects
1 e1.emxdgt.com
1 dsp.adkernel.com
1 rtb-csync.smartadserver.com
1 simage2.pubmatic.com
1 ib.adnxs.com
1 pixel.rubiconproject.com 1 redirects
1 match.taboola.com
1 15.taboola.com cdn.taboola.com
1 a.disquscdn.com www.powershellmagazine.com
1 ssl.gstatic.com accounts.google.com
1 www.google.com apis.google.com
1 tempest.services.disqus.com powershellmagazine.disqus.com
1 accounts.google.com apis.google.com
0 id5-sync.com Failed
134 43
Subject Issuer Validity Valid
powershellmagazine.com
R3		 2021-01-14 -
2021-04-14		 3 months crt.sh
upload.video.google.com
GTS CA 1O1		 2021-01-26 -
2021-04-20		 3 months crt.sh
*.apis.google.com
GTS CA 1O1		 2021-01-26 -
2021-04-20		 3 months crt.sh
*.gravatar.com
Sectigo RSA Domain Validation Secure Server CA		 2020-08-14 -
2022-11-16		 2 years crt.sh
*.google.com
GTS CA 1O1		 2021-01-26 -
2021-04-20		 3 months crt.sh
*.gstatic.com
GTS CA 1O1		 2021-01-26 -
2021-04-20		 3 months crt.sh
*.disqus.com
DigiCert SHA2 Secure Server CA		 2020-04-20 -
2022-05-09		 2 years crt.sh
sni.cloudflaressl.com
Cloudflare Inc ECC CA-3		 2020-08-15 -
2021-08-15		 a year crt.sh
accounts.google.com
GTS CA 1O1		 2021-01-26 -
2021-04-20		 3 months crt.sh
f.ssl.fastly.net
GlobalSign Organization Validation CA - SHA256 - G2		 2020-11-25 -
2021-12-27		 a year crt.sh
www.google.com
GTS CA 1O1		 2021-01-26 -
2021-04-20		 3 months crt.sh
*.taboola.com
DigiCert TLS RSA SHA256 2020 CA1		 2020-11-25 -
2021-12-26		 a year crt.sh
sb.scorecardresearch.com
DigiCert Secure Site ECC CA-1		 2020-07-17 -
2021-06-02		 a year crt.sh
l2.shared.global.fastly.net
GlobalSign CloudSSL CA - SHA256 - G3		 2021-02-11 -
2021-04-18		 2 months crt.sh
ssl418259.cloudflaressl.com
COMODO ECC Domain Validation Secure Server CA 2		 2020-10-27 -
2021-05-05		 6 months crt.sh
*.adnxs.com
DigiCert ECC Secure Server CA		 2019-01-23 -
2021-03-08		 2 years crt.sh
*.pubmatic.com
DigiCert Baltimore TLS RSA SHA256 2020 CA1		 2020-12-07 -
2021-12-14		 a year crt.sh
*.g.doubleclick.net
GTS CA 1O1		 2021-01-26 -
2021-04-20		 3 months crt.sh
*.lijit.com
Go Daddy Secure Certificate Authority - G2		 2020-03-11 -
2021-05-10		 a year crt.sh
*.contextweb.com
DigiCert SHA2 Secure Server CA		 2020-05-07 -
2022-05-12		 2 years crt.sh
*.smartadserver.com
DigiCert ECC Secure Server CA		 2020-01-30 -
2022-02-03		 2 years crt.sh
*.adkernel.com
Sectigo RSA Domain Validation Secure Server CA		 2020-12-22 -
2022-01-05		 a year crt.sh
*.emxdgt.com
Go Daddy Secure Certificate Authority - G2		 2020-05-18 -
2021-07-17		 a year crt.sh
*.bttrack.com
Sectigo RSA Domain Validation Secure Server CA		 2019-03-19 -
2021-04-13		 2 years crt.sh

This page contains 6 frames:

Primary Page: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Frame ID: 625438C520FB1C946532DCD91F01488E
Requests: 68 HTTP requests in this frame

Frame: https://apis.google.com/se/0/_/+1/fastbutton?usegapi=1&size=standard&count=true&hl=en-US&origin=https%3A%2F%2Fwww.powershellmagazine.com&url=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.3k1wIje1lec.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw%2Fm%3D__features__
Frame ID: 2B20BF53142880AB29D6064E9D92A00A
Requests: 2 HTTP requests in this frame

Frame: https://accounts.google.com/o/oauth2/postmessageRelay?parent=https%3A%2F%2Fwww.powershellmagazine.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.3k1wIje1lec.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw%2Fm%3D__features__
Frame ID: F9226C9364CB25DFC7426654A2A47BF2
Requests: 4 HTTP requests in this frame

Frame: https://disqus.com/embed/comments/?base=default&f=powershellmagazine&t_i=9869%20http%3A%2F%2Fwww.powershellmagazine.com%2F%3Fp%3D9869&t_u=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&t_e=Investigating%20PowerShell%20Attacks&t_d=Investigating%20PowerShell%20Attacks%20%E2%80%93%20PowerShell%20Magazine&t_t=Investigating%20PowerShell%20Attacks&s_o=default
Frame ID: 013BF7682110042584FD44E7EC8512EF
Requests: 15 HTTP requests in this frame

Frame: https://tempest.services.disqus.com/ads-iframe/taboola/?position=top&shortname=powershellmagazine&experiment=zetassp&variant=active&service=dynamic&anchorColor=%23222222&colorScheme=light&sourceUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&typeface=sans-serif&canonicalUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&disqus_version=4a68dd9
Frame ID: B1A9FD6F6A7433A7E53C404CF56790E5
Requests: 28 HTTP requests in this frame

Frame: https://match.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=a2e6335b-5424-4c69-8428-6b638a282fcc&tbid=1ae941ff-fb7a-481d-88fe-ad22973608bf-tuct72ff26a&query=taboola_hm%3Da2e6335b-5424-4c69-8428-6b638a282fcc&isDirect=0
Frame ID: 0C2BD33FF2826E9FC14BD95315BEABE8
Requests: 19 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Detected technologies

Overall confidence: 100%
Detected patterns
  • html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
  • script /\/wp-(?:content|includes)\//i
  • meta generator /^WordPress ?([\d.]+)?/i
  • headers link /rel="https:\/\/api\.w\.org\/"/i
Overall confidence: 100%
Detected patterns
  • html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
  • script /\/wp-(?:content|includes)\//i
  • meta generator /^WordPress ?([\d.]+)?/i
  • headers link /rel="https:\/\/api\.w\.org\/"/i
Overall confidence: 100%
Detected patterns
  • html /<link rel=["']stylesheet["'] [^>]+\/wp-(?:content|includes)\//i
  • script /\/wp-(?:content|includes)\//i
  • meta generator /^WordPress ?([\d.]+)?/i
  • headers link /rel="https:\/\/api\.w\.org\/"/i
Overall confidence: 100%
Detected patterns
  • headers server /Ubuntu/i
Overall confidence: 100%
Detected patterns
  • headers server /(?:Apache(?:$|\/([\d.]+)|[^/-])|(?:^|\b)HTTPD)/i
Overall confidence: 100%
Detected patterns
  • html /<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com/i
Overall confidence: 100%
Detected patterns
  • script /apis\.google\.com\/js\/[a-z]*\.js/i
Overall confidence: 100%
Detected patterns
  • html /<link [^>]*href="[^"]+lightbox(?:\.min)?\.css/i
Overall confidence: 100%
Detected patterns
  • script /tracker\.js/i
Overall confidence: 100%
Detected patterns
  • script /jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?/i
  • script /jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?/i
Overall confidence: 100%
Detected patterns
  • script /jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?/i

Page Statistics

134
Requests

99 %
HTTPS

30 %
IPv6

27
Domains

43
Subdomains

30
IPs

8
Countries

1494 kB
Transfer

3306 kB
Size

1
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 85
  • https://sb.scorecardresearch.com/b?c1=7&c2=34354936&c3=1&ns__t=1614179562438&ns_c=UTF-8&ns_if=1&cv=3.5&c8=&c7=https%3A%2F%2Ftempest.services.disqus.com%2Fads-iframe%2Ftaboola%2F%3Fposition%3Dtop%26shortname%3Dpowershellmagazine%26experiment%3Dzetassp%26variant%3Dactive%26service%3Ddynamic%26anchorColor%3D%2523222222%26colorScheme%3Dlight%26sourceUrl%3Dhttps%253A%252F%252Fwww.powershellmagazine.com%252F2014%252F07%252F16%252Finvestigating-powershell-attacks%252F%26typeface%3Dsans-serif%26canonicalUrl%3Dhttps%253A%252F%252Fwww.powershellmagazine.com%252F2014%252F07%252F16%252Finvestigating-powershell-attacks%252F%26disqus_version%3D4a68dd9&c9=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F HTTP 302
  • https://sb.scorecardresearch.com/b2?c1=7&c2=34354936&c3=1&ns__t=1614179562438&ns_c=UTF-8&ns_if=1&cv=3.5&c8=&c7=https%3A%2F%2Ftempest.services.disqus.com%2Fads-iframe%2Ftaboola%2F%3Fposition%3Dtop%26shortname%3Dpowershellmagazine%26experiment%3Dzetassp%26variant%3Dactive%26service%3Ddynamic%26anchorColor%3D%2523222222%26colorScheme%3Dlight%26sourceUrl%3Dhttps%253A%252F%252Fwww.powershellmagazine.com%252F2014%252F07%252F16%252Finvestigating-powershell-attacks%252F%26typeface%3Dsans-serif%26canonicalUrl%3Dhttps%253A%252F%252Fwww.powershellmagazine.com%252F2014%252F07%252F16%252Finvestigating-powershell-attacks%252F%26disqus_version%3D4a68dd9&c9=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&cs_ak_ss=1
Request Chain 96
  • https://rtb.mfadsrvr.com/sync?ssp=taboola HTTP 302
  • https://rtb.mfadsrvr.com/ul_cb/sync?ssp=taboola HTTP 302
  • https://sync.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=a2e6335b-5424-4c69-8428-6b638a282fcc HTTP 302
  • https://match.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=a2e6335b-5424-4c69-8428-6b638a282fcc&tbid=1ae941ff-fb7a-481d-88fe-ad22973608bf-tuct72ff26a&query=taboola_hm%3Da2e6335b-5424-4c69-8428-6b638a282fcc&isDirect=0
Request Chain 97
  • https://pixel.rubiconproject.com/exchange/sync.php?p=16698 HTTP 302
  • https://trc.taboola.com/sg/rubicon-network-display/1/rtb-h/?taboola_hm=KLJKU1XG-1M-6UNL
Request Chain 98
  • https://bh.contextweb.com/bh/rtset?pid=562107&ev=1&rurl=https%3A%2F%2Fsync.taboola.com/sg/pulsepointrtb-network/1/rtb-h/?taboola_hm=%%VGUID%%&orig=trc HTTP 302
  • https://sync.taboola.com/sg/pulsepointrtb-network/1/rtb-h/?taboola_hm=uOx7jIM5rdH1&ev=1&orig=trc&pid=562107
Request Chain 100
  • https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_cm&google_sc HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_cm=&google_sc=&google_tc= HTTP 302
  • https://trc.taboola.com/sg/google-network/1/rtb-h/?taboola_hm=CAESEMRVztQH8nInWI99CkzKRhM&google_cver=1
Request Chain 102
  • https://sync.taboola.com/sg/google-network/1/rtb?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dtaboola_dbm%26google_sc%26gdpr%3D0%26gdpr_consent%3D&orig=trc HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_sc&gdpr=0&gdpr_consent=&google_hm=1ae941ff-fb7a-481d-88fe-ad22973608bf-tuct72ff26a
Request Chain 103
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=054f32o&ttd_tpi=1 HTTP 302
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=054f32o&ttd_tpi=1 HTTP 302
  • https://trc.taboola.com/sg/thetradedesk-network/1/rtb-h/?taboola_hm=321e67d9-3295-4912-b9b9-290f7ce8d01e
Request Chain 104
  • https://ce.lijit.com/merge?pid=42&3pid=1ae941ff-fb7a-481d-88fe-ad22973608bf-tuct72ff26a&us_privacy=&gdpr=0&gdpr_consent= HTTP 302
  • https://ce.lijit.com/merge?pid=42&3pid=1ae941ff-fb7a-481d-88fe-ad22973608bf-tuct72ff26a&us_privacy=&gdpr=0&gdpr_consent=&dnr=1
Request Chain 109
  • https://dis.criteo.com/dis/usersync.aspx?r=29&p=282&cp=taboolaortb&cu=1&url=https%3A%2F%2Fsync-t1.taboola.com%2Fsg%2Fcriteortb-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D%40%40CRITEO_USERID%40%40 HTTP 302
  • https://sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/?taboola_hm=6635b05b-b6f9-4976-885f-7a233a48a7cf
Request Chain 110
  • https://id5-sync.com/s/464/9.gif?puid=1ae941ff-fb7a-481d-88fe-ad22973608bf-tuct72ff26a&gdpr=0&gdpr_consent=&callback=https%3A%2F%2Fsync.taboola.com%2Fsg%2Fid5-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D%7BID5UID%7D HTTP 302
  • https://id5-sync.com/c/464/464/7/1.gif?puid=1ae941ff-fb7a-481d-88fe-ad22973608bf-tuct72ff26a&gdpr=0&gdpr_consent= HTTP 302
  • https://ib.adnxs.com/getuid?https://id5-sync.com/c/464/2/6/2.gif?puid=$UID&gdpr=0&gdpr_consent= HTTP 307
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fid5-sync.com%2Fc%2F464%2F2%2F6%2F2.gif%3Fpuid%3D%24UID%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://id5-sync.com/c/464/2/6/2.gif?puid=7783359033985011083&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.mathtag.com/sync/img?mt_exid=10089&mt_exuid=ID5-ZHMOC83_XzAuhRxBpFQu8fOgrIVX3BjqbfjdAkx5Hg&redir=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F3%2F5%2F3.gif%3Fpuid%3D%5BUUID%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/c/464/3/5/3.gif?puid=e09b6036-6ceb-4300-b731-9ebe6cd6e8f1&gdpr=0&gdpr_consent= HTTP 302
  • https://ice.360yield.com/match?publisher_dsp_id=79&dsp_callback=1&external_user_id=ID5-ZHMOC83_XzAuhRxBpFQu8fOgrIVX3BjqbfjdAkx5Hg&r=https%3A%2F%2Fid5-sync.com%2Fcq%2F464%2F124%2F4%2F4.gif%3Fpuid%3D%7BPUB_USER_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://ice.360yield.com/ul_cb/match?publisher_dsp_id=79&dsp_callback=1&external_user_id=ID5-ZHMOC83_XzAuhRxBpFQu8fOgrIVX3BjqbfjdAkx5Hg&r=https%3A%2F%2Fid5-sync.com%2Fcq%2F464%2F124%2F4%2F4.gif%3Fpuid%3D%7BPUB_USER_ID%7D%26gdpr%3D0%26gdpr_consent%3D&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/cq/464/124/4/4.gif?puid=644debc3-a7ef-4ffd-b61a-70383ee009d1&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent= HTTP 302
  • https://dis.eu.criteo.com/dis/usersync.aspx?r=30&p=59&cp=id5&cu=1&url=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F203%2F3%2F5.gif%3Fpuid%3D%40%40CRITEO_USERID%40%40%26gdpr%3D0%26gdpr_consent%3D HTTP 302
  • https://id5-sync.com/c/464/203/3/5.gif?puid=6635b05b-b6f9-4976-885f-7a233a48a7cf&gdpr=0&gdpr_consent= HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/k/264.gif?puid=b318c63a-2e16-46b4-8c31-321ac289eeb6&ttl=%%TTL%% HTTP 302
  • https://c1.adform.net/serving/cookie/match?party=1135&callback=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F10%2F1%2F7.gif%3Fpuid%3D%5Badformuid%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr_consent=&gdpr=0 HTTP 302
  • https://c1.adform.net/serving/cookie/match?CC=1&party=1135&callback=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F10%2F1%2F7.gif%3Fpuid%3D%5Badformuid%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr_consent=&gdpr=0 HTTP 302
  • https://id5-sync.com/c/464/10/1/7.gif?puid=5169632322289409463&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.crwdcntrl.net/map/c=13953/tp=IDFI/gdpr=0/gdpr_consent=?https://id5-sync.com/c/464/19/0/8.gif?puid=${profile_id}&gdpr=0&gdpr_consent= HTTP 302
  • https://sync.crwdcntrl.net/map/ct=y/c=13953/tp=IDFI/gdpr=0/gdpr_consent=?https://id5-sync.com/c/464/19/0/8.gif?puid=${profile_id}&gdpr=0&gdpr_consent= HTTP 302
  • https://id5-sync.com/c/464/19/0/8.gif?puid=783ffced1486ce4c657f294e15fb23dc&gdpr=0&gdpr_consent=
Request Chain 111
  • https://s.c.appier.net/taboola HTTP 302
  • https://sync.taboola.com/sg/appierrtb-network/1/rtb-h?taboola_hm=_-rTRRd1Bny3y9ij62w2YA
Request Chain 114
  • https://x.bidswitch.net/sync?ssp=taboola&gdpr=0&gdpr_consent= HTTP 302
  • https://x.bidswitch.net/ul_cb/sync?ssp=taboola&gdpr=0&gdpr_consent= HTTP 302
  • https://prod.perf-serving.com/sync?ssp=bidswitch&bidswitch_ssp_id=taboola HTTP 302
  • https://prod.perf-serving.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=taboola HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=366&expires=14&user_id=76f07909-15e4-4b4e-b705-7f5d0ab049cc&ssp=taboola&user_group=1 HTTP 302
  • https://sync-t1.taboola.com/sg/bidswitch-network/1/rtb-h?taboola_hm=c71ae52a-094f-40f2-b573-d7ac4e42ce7c

134 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request /
www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/ 		62 KB
16 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.131.21.239 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.7 (Ubuntu) / PHP/5.5.9-1ubuntu4.14
Resource Hash
cbbeab87cce309e0cc83efaa27ee8d6d36645ee7b10e2cbdaf260ae34e2e561e

Request headers

Host
www.powershellmagazine.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
none
Sec-Fetch-Mode
navigate
Sec-Fetch-User
?1
Sec-Fetch-Dest
document
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:11:46 GMT
Server
Apache/2.4.7 (Ubuntu)
X-Powered-By
PHP/5.5.9-1ubuntu4.14
X-Pingback
https://www.powershellmagazine.com/xmlrpc.php
Link
<https://www.powershellmagazine.com/wp-json/>; rel="https://api.w.org/" <https://www.powershellmagazine.com/?p=9869>; rel=shortlink
Vary
Accept-Encoding
Content-Encoding
gzip
Content-Length
15816
Keep-Alive
timeout=5, max=100
Connection
Keep-Alive
Content-Type
text/html; charset=UTF-8
crayon.min.css
www.powershellmagazine.com/wp-content/plugins/crayon-syntax-highlighter/css/min/ 		20 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.powershellmagazine.com/wp-content/plugins/crayon-syntax-highlighter/css/min/crayon.min.css?ver=_2.7.2_beta
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.131.21.239 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.7 (Ubuntu) /
Resource Hash
e3d961493e244e06bf91a9857442891e2e2ad8d49cf8e0a7781c53f0707443d7

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:11:46 GMT
Content-Encoding
gzip
Last-Modified
Thu, 07 Jul 2016 17:02:44 GMT
Server
Apache/2.4.7 (Ubuntu)
ETag
"4ecc-5370ea7923500-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
3959
cv.css
www.powershellmagazine.com/wp-content/plugins/content-views-query-and-display-post-page/public/assets/css/ 		76 KB
12 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.powershellmagazine.com/wp-content/plugins/content-views-query-and-display-post-page/public/assets/css/cv.css?ver=2.3.1
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.131.21.239 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.7 (Ubuntu) /
Resource Hash
a8a91fef73b540d42b6b25f9e4d3446c4df9737fd3b8c41e73b2268683808cf2

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:11:46 GMT
Content-Encoding
gzip
Last-Modified
Thu, 30 Jan 2020 12:44:46 GMT
Server
Apache/2.4.7 (Ubuntu)
ETag
"13006-59d5ad2680d95-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
11727
style.css
www.powershellmagazine.com/wp-content/plugins/gutenberg/build/block-library/ 		40 KB
6 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.powershellmagazine.com/wp-content/plugins/gutenberg/build/block-library/style.css?ver=1570799996
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.131.21.239 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.7 (Ubuntu) /
Resource Hash
403961e8565d30e2af2a56d4eca31a9cc5b10b3146803f26acf015d3e9d55d88

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:11:46 GMT
Content-Encoding
gzip
Last-Modified
Fri, 11 Oct 2019 13:19:56 GMT
Server
Apache/2.4.7 (Ubuntu)
ETag
"9fbf-594a25fd129d5-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
6117
bbpress.min.css
www.powershellmagazine.com/wp-content/plugins/bbpress/templates/default/css/ 		29 KB
5 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.powershellmagazine.com/wp-content/plugins/bbpress/templates/default/css/bbpress.min.css?ver=2.6.4
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.131.21.239 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.7 (Ubuntu) /
Resource Hash
481bfa4292798eb15d056ff461dc1e90bbe9795fd99299b59c02970a0e710207

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:11:46 GMT
Content-Encoding
gzip
Last-Modified
Thu, 30 Jan 2020 12:44:38 GMT
Server
Apache/2.4.7 (Ubuntu)
ETag
"75bd-59d5ad1f55e35-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
5267
styles.css
www.powershellmagazine.com/wp-content/plugins/contact-form-7/includes/css/ 		2 KB
984 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.powershellmagazine.com/wp-content/plugins/contact-form-7/includes/css/styles.css?ver=5.1.6
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.131.21.239 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.7 (Ubuntu) /
Resource Hash
f774ddac3ffce309e5ff2659a59e8e7291da314d213f24c1aa04b9ea2bc46586

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:11:46 GMT
Content-Encoding
gzip
Last-Modified
Thu, 30 Jan 2020 12:44:44 GMT
Server
Apache/2.4.7 (Ubuntu)
ETag
"66d-59d5ad2480275-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
649
styles.css
www.powershellmagazine.com/wp-content/plugins/easy-post-series/assets/css/ 		445 B
578 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.powershellmagazine.com/wp-content/plugins/easy-post-series/assets/css/styles.css?ver=1.1.2
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.131.21.239 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.7 (Ubuntu) /
Resource Hash
26702bf4864c2f1c536cacdf1701e5e7d35b60398ef3c951749c0568727f89ec

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:11:46 GMT
Content-Encoding
gzip
Last-Modified
Mon, 15 May 2017 14:48:50 GMT
Server
Apache/2.4.7 (Ubuntu)
ETag
"1bd-54f912733993c-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
244
css
fonts.googleapis.com/ 		380 B
404 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Droid+Sans
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
9631deda28528b08e902706f1e501c7b27001ae28adff842a3f60fa924d9e9c8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Wed, 24 Feb 2021 13:17:44 GMT
server
ESF
date
Wed, 24 Feb 2021 15:12:40 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 24 Feb 2021 15:12:40 GMT
postratings-css.css
www.powershellmagazine.com/wp-content/plugins/wp-postratings/css/ 		1 KB
745 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.powershellmagazine.com/wp-content/plugins/wp-postratings/css/postratings-css.css?ver=1.87
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.131.21.239 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.7 (Ubuntu) /
Resource Hash
c56b566e17c62870ce139b3a57bfb94a9d785792bd6ac2220d52426b8590d87f

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:11:46 GMT
Content-Encoding
gzip
Last-Modified
Thu, 30 Jan 2020 12:44:57 GMT
Server
Apache/2.4.7 (Ubuntu)
ETag
"549-59d5ad318cf95-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=100
Content-Length
410
frontend.css
www.powershellmagazine.com/wp-content/plugins/download-monitor/assets/css/ 		5 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.powershellmagazine.com/wp-content/plugins/download-monitor/assets/css/frontend.css?ver=5.1.8
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.131.21.239 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.7 (Ubuntu) /
Resource Hash
b8e149178358873942c6a434f9ae62dd952769a87c2abdf7e659c129acd398fd

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:11:46 GMT
Content-Encoding
gzip
Last-Modified
Tue, 09 Apr 2019 05:42:30 GMT
Server
Apache/2.4.7 (Ubuntu)
ETag
"14a0-586126b3ee035-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
1238
wpp.css
www.powershellmagazine.com/wp-content/plugins/wordpress-popular-posts/assets/css/ 		2 KB
890 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.powershellmagazine.com/wp-content/plugins/wordpress-popular-posts/assets/css/wpp.css?ver=5.0.2
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.131.21.239 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.7 (Ubuntu) /
Resource Hash
f26d98c3973c7df12d78bbb4164589b59dc42d4797b58471b358364c1005b2d3

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:11:46 GMT
Content-Encoding
gzip
Last-Modified
Thu, 30 Jan 2020 12:44:55 GMT
Server
Apache/2.4.7 (Ubuntu)
ETag
"631-59d5ad2f931d5-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
556
lightbox.min.css
www.powershellmagazine.com/wp-content/plugins/wp-lightbox-2/styles/ 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.powershellmagazine.com/wp-content/plugins/wp-lightbox-2/styles/lightbox.min.css?ver=1.3.4
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.131.21.239 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.7 (Ubuntu) /
Resource Hash
187d198e60bed479c2c37f665666a66d37ca4084ff230ed320eca55fb4a66331

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:11:46 GMT
Content-Encoding
gzip
Last-Modified
Thu, 07 Jul 2016 17:02:52 GMT
Server
Apache/2.4.7 (Ubuntu)
ETag
"c1d-5370ea80c4700-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
1159
style.css
www.powershellmagazine.com/wp-content/themes/blognow/ 		54 KB
10 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.powershellmagazine.com/wp-content/themes/blognow/style.css?ver=20161209
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.131.21.239 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.7 (Ubuntu) /
Resource Hash
9dc3c82eda2956beda8e66549c710ccb234cf4589546277b5b5a218474007669

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:11:47 GMT
Content-Encoding
gzip
Last-Modified
Fri, 21 Jul 2017 02:25:05 GMT
Server
Apache/2.4.7 (Ubuntu)
ETag
"d81d-554ca92b9409c-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
9705
superfish.css
www.powershellmagazine.com/wp-content/themes/blognow/assets/css/ 		0
278 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.powershellmagazine.com/wp-content/themes/blognow/assets/css/superfish.css?ver=5.1.8
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.131.21.239 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.7 (Ubuntu) /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:11:47 GMT
Last-Modified
Fri, 21 Jul 2017 02:25:05 GMT
Server
Apache/2.4.7 (Ubuntu)
ETag
"0-554ca92b9409c"
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=99
Content-Length
0
genericons.css
www.powershellmagazine.com/wp-content/themes/blognow/genericons/ 		154 B
462 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.powershellmagazine.com/wp-content/themes/blognow/genericons/genericons.css?ver=5.1.8
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.131.21.239 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.7 (Ubuntu) /
Resource Hash
7e3559d6ffac7fc54d6edaa79b6e7330fab33fbdffc174a27c58b25e5b3952d2

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:11:47 GMT
Content-Encoding
gzip
Last-Modified
Fri, 21 Jul 2017 02:25:05 GMT
Server
Apache/2.4.7 (Ubuntu)
ETag
"9a-554ca92b9503c-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
129
responsive.css
www.powershellmagazine.com/wp-content/themes/blognow/ 		9 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.powershellmagazine.com/wp-content/themes/blognow/responsive.css?ver=20161209
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.131.21.239 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.7 (Ubuntu) /
Resource Hash
bec95673771eb5ec18b44719e5fab2dfd77bebb73e1d19a5c3fa38fb92a867e4

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:11:47 GMT
Content-Encoding
gzip
Last-Modified
Fri, 21 Jul 2017 02:25:05 GMT
Server
Apache/2.4.7 (Ubuntu)
ETag
"2412-554ca92b9503c-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
1641
widget.css
www.powershellmagazine.com/wp-content/plugins/author-avatars/css/ 		794 B
631 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.powershellmagazine.com/wp-content/plugins/author-avatars/css/widget.css?ver=1.18
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.131.21.239 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.7 (Ubuntu) /
Resource Hash
c0cbaf1a190df161bccd279676a5bf57067addcb1746a219cc19854a21cc863f

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:11:47 GMT
Content-Encoding
gzip
Last-Modified
Thu, 30 Jan 2020 12:44:36 GMT
Server
Apache/2.4.7 (Ubuntu)
ETag
"31a-59d5ad1d61e35-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
297
shortcode.css
www.powershellmagazine.com/wp-content/plugins/author-avatars/css/ 		1 KB
737 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.powershellmagazine.com/wp-content/plugins/author-avatars/css/shortcode.css?ver=1.18
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.131.21.239 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.7 (Ubuntu) /
Resource Hash
595116ae3e2ced5443bb6cfeea94e070bb9e79431ca4d90df39801343ae2c2e1

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:11:47 GMT
Content-Encoding
gzip
Last-Modified
Thu, 30 Jan 2020 12:44:36 GMT
Server
Apache/2.4.7 (Ubuntu)
ETag
"4d0-59d5ad1d61e35-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=95
Content-Length
403
plusone.js
apis.google.com/js/ 		49 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://apis.google.com/js/plusone.js
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80e::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
d54294a6014df645a307b1ddcc2647e902b58333bc92a30d65ea1786d77457d2
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-UK4oquKhGRavsnZd9tzODg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 15:12:40 GMT
content-encoding
gzip
x-content-type-options
nosniff
p3p
CP="This is not a P3P policy! See g.co/p3phelp for more info."
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
x-ua-compatible
IE=edge, chrome=1
server
ESF
x-frame-options
SAMEORIGIN
etag
"3c51cc543292f02d30879e16f46128be"
strict-transport-security
max-age=31536000
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=1800, stale-while-revalidate=1800
content-security-policy
script-src 'report-sample' 'nonce-UK4oquKhGRavsnZd9tzODg' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
timing-allow-origin
*
expires
Wed, 24 Feb 2021 15:12:40 GMT
jquery.js
www.powershellmagazine.com/wp-includes/js/jquery/ 		95 KB
33 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.powershellmagazine.com/wp-includes/js/jquery/jquery.js?ver=1.12.4
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.131.21.239 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.7 (Ubuntu) /
Resource Hash
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:11:47 GMT
Content-Encoding
gzip
Last-Modified
Thu, 05 Sep 2019 02:24:10 GMT
Server
Apache/2.4.7 (Ubuntu)
ETag
"17a69-591c50448ba95-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=98
Content-Length
33776
jquery-migrate.min.js
www.powershellmagazine.com/wp-includes/js/jquery/ 		10 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.powershellmagazine.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.131.21.239 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.7 (Ubuntu) /
Resource Hash
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:11:47 GMT
Content-Encoding
gzip
Last-Modified
Thu, 07 Jul 2016 17:05:18 GMT
Server
Apache/2.4.7 (Ubuntu)
ETag
"2748-5370eb0c00f80-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
4014
crayon.min.js
www.powershellmagazine.com/wp-content/plugins/crayon-syntax-highlighter/js/min/ 		22 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.powershellmagazine.com/wp-content/plugins/crayon-syntax-highlighter/js/min/crayon.min.js?ver=_2.7.2_beta
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.131.21.239 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.7 (Ubuntu) /
Resource Hash
193fbb968733b8a7049da19274546e6b80b76e9a8f1b837fee9a5fdeb8f97c7b

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:11:47 GMT
Content-Encoding
gzip
Last-Modified
Thu, 07 Jul 2016 17:02:42 GMT
Server
Apache/2.4.7 (Ubuntu)
ETag
"5741-5370ea773b080-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
6790
jquery.adrotate.clicktracker.js
www.powershellmagazine.com/wp-content/plugins/adrotate/library/ 		1 KB
885 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.powershellmagazine.com/wp-content/plugins/adrotate/library/jquery.adrotate.clicktracker.js
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.131.21.239 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.7 (Ubuntu) /
Resource Hash
2f64b025cec8c93dcb01fe88f0e79c134bc0a6c751787360153865dfa9f3a962

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:11:47 GMT
Content-Encoding
gzip
Last-Modified
Thu, 30 Jan 2020 12:44:33 GMT
Server
Apache/2.4.7 (Ubuntu)
ETag
"40b-59d5ad1a59855-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=94
Content-Length
537
scripts.js
www.powershellmagazine.com/wp-content/plugins/easy-post-series/assets/js/ 		910 B
648 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.powershellmagazine.com/wp-content/plugins/easy-post-series/assets/js/scripts.js?ver=1.1.2
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.131.21.239 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.7 (Ubuntu) /
Resource Hash
16e509e1da5e24910ac51ce9690f149c0fe6ad2818af9c447d12e59f474e4f36

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:11:47 GMT
Content-Encoding
gzip
Last-Modified
Mon, 15 May 2017 14:48:50 GMT
Server
Apache/2.4.7 (Ubuntu)
ETag
"38e-54f912733993c-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
300
wpp-5.0.0.min.js
www.powershellmagazine.com/wp-content/plugins/wordpress-popular-posts/assets/js/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.powershellmagazine.com/wp-content/plugins/wordpress-popular-posts/assets/js/wpp-5.0.0.min.js?ver=5.0.2
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.131.21.239 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.7 (Ubuntu) /
Resource Hash
191e2a2deb0b16b4e6c833685b15ab930c8eaeec228391f6b26bc1fcda208c7b

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:11:47 GMT
Content-Encoding
gzip
Last-Modified
Thu, 30 Jan 2020 12:44:55 GMT
Server
Apache/2.4.7 (Ubuntu)
ETag
"5bf-59d5ad2f92235-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
744
css
fonts.googleapis.com/ 		8 KB
843 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:400,400i,600,700
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:829::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
7c5720f29c433fbec0cb102b18803d7779a3de7bf2ee82024ad0787b68361ffc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=31536000
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
last-modified
Wed, 24 Feb 2021 13:22:57 GMT
server
ESF
date
Wed, 24 Feb 2021 15:12:40 GMT
x-frame-options
SAMEORIGIN
content-type
text/css; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires
Wed, 24 Feb 2021 15:12:40 GMT
header.jpg
www.powershellmagazine.com/wp-content/uploads/2018/08/ 		37 KB
38 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.powershellmagazine.com/wp-content/uploads/2018/08/header.jpg
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.131.21.239 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.7 (Ubuntu) /
Resource Hash
a9a914f6357829974ce2ace17203a622d05b1f601d3fb6a44f835a65c4196f69

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:11:47 GMT
Last-Modified
Mon, 20 Aug 2018 13:00:10 GMT
Server
Apache/2.4.7 (Ubuntu)
ETag
"9500-573dd7d449ff5"
Content-Type
image/jpeg
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=94
Content-Length
38144
f9d8f6a22b70a88ea458faebba10d112
secure.gravatar.com/avatar/ 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure.gravatar.com/avatar/f9d8f6a22b70a88ea458faebba10d112?s=48&d=mm&r=g
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
38008f61ad1135a39c008f1189829844bf110e0ffe2d0b5f3590e0002c42c6ac

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Wed, 24 Feb 2021 15:12:41 GMT
last-modified
Wed, 16 Jul 2014 16:43:30 GMT
server
nginx
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=300
content-disposition
inline; filename="f9d8f6a22b70a88ea458faebba10d112.jpeg"
accept-ranges
bytes
link
<https://www.gravatar.com/avatar/f9d8f6a22b70a88ea458faebba10d112?s=48&d=mm&r=g>; rel="canonical"
content-length
1930
expires
Wed, 24 Feb 2021 15:17:41 GMT
wp-emoji-release.min.js
www.powershellmagazine.com/wp-includes/js/ 		12 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.powershellmagazine.com/wp-includes/js/wp-emoji-release.min.js?ver=5.1.8
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.131.21.239 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.7 (Ubuntu) /
Resource Hash
c533b791a8eef65604f15d20433506e1614c693eeba9df749e8a7677e43b466c

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:11:47 GMT
Content-Encoding
gzip
Last-Modified
Sat, 09 Mar 2019 13:26:13 GMT
Server
Apache/2.4.7 (Ubuntu)
ETag
"2f02-583a948880f55-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=93
Content-Length
4388
f9d8f6a22b70a88ea458faebba10d112
secure.gravatar.com/avatar/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://secure.gravatar.com/avatar/f9d8f6a22b70a88ea458faebba10d112?s=120&d=mm&r=g
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:fa87:fffe::c000:4902 , Ireland, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software
nginx /
Resource Hash
d8cd52fe71bf1d9add0e6012a1fcc6fa9d6da13bf24914c26a6a1675e4157b08

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-nc
HIT hhn 1
date
Wed, 24 Feb 2021 15:12:41 GMT
last-modified
Wed, 16 Jul 2014 16:43:30 GMT
server
nginx
content-type
image/jpeg
access-control-allow-origin
*
cache-control
max-age=300
content-disposition
inline; filename="f9d8f6a22b70a88ea458faebba10d112.jpeg"
accept-ranges
bytes
link
<https://www.gravatar.com/avatar/f9d8f6a22b70a88ea458faebba10d112?s=120&d=mm&r=g>; rel="canonical"
content-length
6293
expires
Wed, 24 Feb 2021 15:17:41 GMT
logo-250x250.png
www.powershellmagazine.com/wp-content/uploads/2012/01/ 		13 KB
13 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.powershellmagazine.com/wp-content/uploads/2012/01/logo-250x250.png
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.131.21.239 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.7 (Ubuntu) /
Resource Hash
06840247318064a9638f17347f17e461b7c1984e809a7d41dc8cb71815750fef

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:11:47 GMT
Last-Modified
Thu, 07 Jul 2016 17:05:10 GMT
Server
Apache/2.4.7 (Ubuntu)
ETag
"3432-5370eb045fd80"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=91
Content-Length
13362
banner4-1-480x300.png
www.powershellmagazine.com/wp-content/uploads/2020/03/ 		87 KB
88 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.powershellmagazine.com/wp-content/uploads/2020/03/banner4-1-480x300.png
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.131.21.239 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.7 (Ubuntu) /
Resource Hash
fba0ded09d93aabe89ce5ff54f850953cd55090e670a83ed1b809dc7b60caf5c

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:11:47 GMT
Last-Modified
Thu, 12 Mar 2020 10:42:38 GMT
Server
Apache/2.4.7 (Ubuntu)
ETag
"15cec-5a0a602f4b9b5"
Content-Type
image/png
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=94
Content-Length
89324
scripts.js
www.powershellmagazine.com/wp-content/plugins/contact-form-7/includes/js/ 		14 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.powershellmagazine.com/wp-content/plugins/contact-form-7/includes/js/scripts.js?ver=5.1.6
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.131.21.239 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.7 (Ubuntu) /
Resource Hash
b7e17926b30342edecee8b3a93029ac51462e2b479277d8e077ba57173eb1900

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:11:47 GMT
Content-Encoding
gzip
Last-Modified
Thu, 30 Jan 2020 12:44:44 GMT
Server
Apache/2.4.7 (Ubuntu)
ETag
"3868-59d5ad2480275-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=95
Content-Length
3993
cv.js
www.powershellmagazine.com/wp-content/plugins/content-views-query-and-display-post-page/public/assets/js/ 		23 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.powershellmagazine.com/wp-content/plugins/content-views-query-and-display-post-page/public/assets/js/cv.js?ver=2.3.1
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.131.21.239 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.7 (Ubuntu) /
Resource Hash
29f0ecaeca4bedd85012e269d18dc637feb1472d91f3a45fa8057c2ecbe88c43

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:11:47 GMT
Content-Encoding
gzip
Last-Modified
Thu, 30 Jan 2020 12:44:46 GMT
Server
Apache/2.4.7 (Ubuntu)
ETag
"5be9-59d5ad2680d95-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=95
Content-Length
6778
comment_count.js
www.powershellmagazine.com/wp-content/plugins/disqus-comment-system/public/js/ 		889 B
788 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.powershellmagazine.com/wp-content/plugins/disqus-comment-system/public/js/comment_count.js?ver=3.0.17
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.131.21.239 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.7 (Ubuntu) /
Resource Hash
cea0a05c5af6e21a409875328ed2e3dba79131b7c41f8ea07d0e0e02c7b7b59e

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:11:47 GMT
Content-Encoding
gzip
Last-Modified
Sat, 09 Mar 2019 13:27:03 GMT
Server
Apache/2.4.7 (Ubuntu)
ETag
"379-583a94b8d7f55-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
440
comment_embed.js
www.powershellmagazine.com/wp-content/plugins/disqus-comment-system/public/js/ 		1 KB
853 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.powershellmagazine.com/wp-content/plugins/disqus-comment-system/public/js/comment_embed.js?ver=3.0.17
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.131.21.239 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.7 (Ubuntu) /
Resource Hash
f055e217bde76d711bd8b42af773f9f99b8a29d81ad9ed10b6379cc7e6c60452

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:11:47 GMT
Content-Encoding
gzip
Last-Modified
Sat, 09 Mar 2019 13:27:03 GMT
Server
Apache/2.4.7 (Ubuntu)
ETag
"47e-583a94b8d7f55-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
505
postratings-js.js
www.powershellmagazine.com/wp-content/plugins/wp-postratings/js/ 		3 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.powershellmagazine.com/wp-content/plugins/wp-postratings/js/postratings-js.js?ver=1.87
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.131.21.239 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.7 (Ubuntu) /
Resource Hash
c42425f18923921089911e70f39c6dd462794df2e42ac0596abc3884da6471fc

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:11:47 GMT
Content-Encoding
gzip
Last-Modified
Thu, 30 Jan 2020 12:44:57 GMT
Server
Apache/2.4.7 (Ubuntu)
ETag
"d01-59d5ad318cf95-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=94
Content-Length
752
wp-lightbox-2.min.js
www.powershellmagazine.com/wp-content/plugins/wp-lightbox-2/ 		27 KB
7 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.powershellmagazine.com/wp-content/plugins/wp-lightbox-2/wp-lightbox-2.min.js?ver=1.3.4.1
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.131.21.239 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.7 (Ubuntu) /
Resource Hash
ed14dd3ac72169c520ea7bf06a500cf5d0e8ca08746dedc69bfd2ec995aa0000

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:11:47 GMT
Content-Encoding
gzip
Last-Modified
Thu, 07 Jul 2016 17:02:52 GMT
Server
Apache/2.4.7 (Ubuntu)
ETag
"6b9b-5370ea80c4700-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=95
Content-Length
6953
superfish.js
www.powershellmagazine.com/wp-content/themes/blognow/assets/js/ 		7 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.powershellmagazine.com/wp-content/themes/blognow/assets/js/superfish.js?ver=5.1.8
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.131.21.239 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.7 (Ubuntu) /
Resource Hash
4bd938863d8e473540c7300aec8fd156822f4701cee5fb6b3328a2cc9b0a012b

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:11:47 GMT
Content-Encoding
gzip
Last-Modified
Fri, 21 Jul 2017 02:25:05 GMT
Server
Apache/2.4.7 (Ubuntu)
ETag
"1d7c-554ca92b930fc-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=96
Content-Length
2414
jquery.slicknav.min.js
www.powershellmagazine.com/wp-content/themes/blognow/assets/js/ 		8 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.powershellmagazine.com/wp-content/themes/blognow/assets/js/jquery.slicknav.min.js?ver=5.1.8
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.131.21.239 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.7 (Ubuntu) /
Resource Hash
190402f488a1616b47304ae066078580059ca6a5958b7f217d2156d0a73931a9

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:11:47 GMT
Content-Encoding
gzip
Last-Modified
Fri, 21 Jul 2017 02:25:05 GMT
Server
Apache/2.4.7 (Ubuntu)
ETag
"20df-554ca92b930fc-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=93
Content-Length
2648
modernizr.min.js
www.powershellmagazine.com/wp-content/themes/blognow/assets/js/ 		15 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.powershellmagazine.com/wp-content/themes/blognow/assets/js/modernizr.min.js?ver=5.1.8
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.131.21.239 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.7 (Ubuntu) /
Resource Hash
cf25ec18f223f4c51ce1128a42e644cdc2244d88f89d1a51440d9dbe51f4efe8

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:11:47 GMT
Content-Encoding
gzip
Last-Modified
Fri, 21 Jul 2017 02:25:05 GMT
Server
Apache/2.4.7 (Ubuntu)
ETag
"3c36-554ca92b930fc-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=94
Content-Length
6246
html5.js
www.powershellmagazine.com/wp-content/themes/blognow/assets/js/ 		10 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.powershellmagazine.com/wp-content/themes/blognow/assets/js/html5.js?ver=5.1.8
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.131.21.239 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.7 (Ubuntu) /
Resource Hash
a4b3b91b775b356ac4b5c34ac94dbcc1212ef23b5e89bfa9bfcc92e285a4447a

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:11:47 GMT
Content-Encoding
gzip
Last-Modified
Fri, 21 Jul 2017 02:25:05 GMT
Server
Apache/2.4.7 (Ubuntu)
ETag
"285a-554ca92b930fc-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=95
Content-Length
3122
jquery.custom.js
www.powershellmagazine.com/wp-content/themes/blognow/assets/js/ 		4 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.powershellmagazine.com/wp-content/themes/blognow/assets/js/jquery.custom.js?ver=20161210
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.131.21.239 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.7 (Ubuntu) /
Resource Hash
3d3497226b92d0c8d702cffd4144da8ebcc3c2e2881d4a93da258d74b39d9e28

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:11:47 GMT
Content-Encoding
gzip
Last-Modified
Fri, 21 Jul 2017 02:25:05 GMT
Server
Apache/2.4.7 (Ubuntu)
ETag
"e70-554ca92b930fc-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=92
Content-Length
706
comment-reply.min.js
www.powershellmagazine.com/wp-includes/js/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.powershellmagazine.com/wp-includes/js/comment-reply.min.js?ver=5.1.8
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.131.21.239 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.7 (Ubuntu) /
Resource Hash
31cb76c05cbf5d71466f93078e8ba0f6e39cd92d0acc86d385b8cf2899963695

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:11:47 GMT
Content-Encoding
gzip
Last-Modified
Wed, 13 Mar 2019 02:24:06 GMT
Server
Apache/2.4.7 (Ubuntu)
ETag
"8ba-583f080011435-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=93
Content-Length
1093
wp-embed.min.js
www.powershellmagazine.com/wp-includes/js/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.powershellmagazine.com/wp-includes/js/wp-embed.min.js?ver=5.1.8
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.131.21.239 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.7 (Ubuntu) /
Resource Hash
2152557cac69e2bd7d6debef5037a9f554f9209cc305b8141b3329acb10c42b7

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:11:47 GMT
Content-Encoding
gzip
Last-Modified
Mon, 10 Dec 2018 05:57:05 GMT
Server
Apache/2.4.7 (Ubuntu)
ETag
"57b-57ca4a26c3075-gzip"
Vary
Accept-Encoding
Content-Type
application/javascript
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=92
Content-Length
753
genericons.css
www.powershellmagazine.com/wp-content/themes/blognow/genericons/genericons/ 		28 KB
16 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.powershellmagazine.com/wp-content/themes/blognow/genericons/genericons/genericons.css
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/wp-content/themes/blognow/genericons/genericons.css?ver=5.1.8
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.131.21.239 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.7 (Ubuntu) /
Resource Hash
4ed10d0d64bb1515397e8666a63f484d640dbc5678fa62574e077b7aef1c3af2

Request headers

Referer
https://www.powershellmagazine.com/wp-content/themes/blognow/genericons/genericons.css?ver=5.1.8
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:11:47 GMT
Content-Encoding
gzip
Last-Modified
Fri, 21 Jul 2017 02:25:05 GMT
Server
Apache/2.4.7 (Ubuntu)
ETag
"6e6a-554ca92b95fdc-gzip"
Vary
Accept-Encoding
Content-Type
text/css
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=97
Content-Length
16441
cb=gapi.loaded_0
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.3k1wIje1lec.O/m=plusone/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw/ 		141 KB
50 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.3k1wIje1lec.O/m=plusone/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw/cb=gapi.loaded_0
Requested by
Host: apis.google.com
URL: https://apis.google.com/js/plusone.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
1dbe94f24870455b60be49be9b72675f862260aa374086a786e893f59cb080b0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 18 Feb 2021 17:12:13 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 27 Jan 2021 20:08:03 GMT
server
sffe
age
511228
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, immutable, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
50334
x-xss-protection
0
expires
Fri, 18 Feb 2022 17:12:13 GMT
popular-posts
www.powershellmagazine.com/wp-json/wordpress-popular-posts/v1/ 		55 B
791 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.powershellmagazine.com/wp-json/wordpress-popular-posts/v1/popular-posts
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/wp-content/plugins/wordpress-popular-posts/assets/js/wpp-5.0.0.min.js?ver=5.0.2
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.131.21.239 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.7 (Ubuntu) / PHP/5.5.9-1ubuntu4.14
Resource Hash
59bcba7dbecdaf5d6650b054124c62ab0dce534f9ea9aa8c91260fe7f6f346ca
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-type
application/x-www-form-urlencoded

Response headers

Date
Wed, 24 Feb 2021 15:11:47 GMT
X-Content-Type-Options
nosniff
X-Powered-By
PHP/5.5.9-1ubuntu4.14
Connection
Keep-Alive
Content-Length
55
Keep-Alive
timeout=5, max=93
Link
<https://www.powershellmagazine.com/wp-json/>; rel="https://api.w.org/"
Allow
GET, POST
Server
Apache/2.4.7 (Ubuntu)
X-WP-Nonce
f10b5ffe61
Vary
Origin
Access-Control-Allow-Methods
OPTIONS, GET, POST, PUT, PATCH, DELETE
Content-Type
application/json; charset=UTF-8
Access-Control-Allow-Origin
https://www.powershellmagazine.com
Access-Control-Expose-Headers
X-WP-Total, X-WP-TotalPages
Access-Control-Allow-Credentials
true
X-Robots-Tag
noindex
Access-Control-Allow-Headers
Authorization, Content-Type
mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
fonts.gstatic.com/s/opensans/v18/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UNirkOUuhpKKSTjw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:400,400i,600,700
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.powershellmagazine.com
Referer
https://fonts.googleapis.com/css?family=Open+Sans:400,400i,600,700
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Feb 2021 13:55:06 GMT
x-content-type-options
nosniff
last-modified
Tue, 15 Sep 2020 18:09:49 GMT
server
sffe
age
91055
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9180
x-xss-protection
0
expires
Wed, 23 Feb 2022 13:55:06 GMT
SlGVmQWMvZQIdix7AFxXkHNSbRYXags.woff2
fonts.gstatic.com/s/droidsans/v12/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/droidsans/v12/SlGVmQWMvZQIdix7AFxXkHNSbRYXags.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Droid+Sans
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
c8cb742dbb60decab090cf738bfef2d8a780141573e9a2a3854bf3f78919faed
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.powershellmagazine.com
Referer
https://fonts.googleapis.com/css?family=Droid+Sans
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 18 Feb 2021 19:41:29 GMT
x-content-type-options
nosniff
last-modified
Thu, 20 Feb 2020 02:00:07 GMT
server
sffe
age
502272
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
11236
x-xss-protection
0
expires
Fri, 18 Feb 2022 19:41:29 GMT
mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
fonts.gstatic.com/s/opensans/v18/ 		9 KB
9 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v18/mem8YaGs126MiZpBA-UFVZ0bf8pkAg.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:400,400i,600,700
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:810::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Origin
https://www.powershellmagazine.com
Referer
https://fonts.googleapis.com/css?family=Open+Sans:400,400i,600,700
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Tue, 23 Feb 2021 20:46:55 GMT
x-content-type-options
nosniff
last-modified
Tue, 15 Sep 2020 18:09:28 GMT
server
sffe
age
66346
content-type
font/woff2
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
9132
x-xss-protection
0
expires
Wed, 23 Feb 2022 20:46:55 GMT
truncated
/ 		14 KB
14 KB 		Font
General
Check archive.org
Download Go to
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
1cfd32e37f8aba263101f06e8f702adfaef55a6601857cf5e2c6dd0b0388dcd6

Request headers

Origin
https://www.powershellmagazine.com
Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
application/x-font-woff;charset=utf-8
count.js
powershellmagazine.disqus.com/ 		1 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://powershellmagazine.disqus.com/count.js
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/wp-content/plugins/disqus-comment-system/public/js/comment_count.js?ver=3.0.17
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.112.134 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:12:41 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Age
2276174
P3P
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Connection
keep-alive
Content-Length
871
X-XSS-Protection
1; mode=block
Last-Modified
Thu, 28 Jan 2021 23:50:44 GMT
Server
nginx
ETag
"60134dd4-367"
Vary
Accept-Encoding
Strict-Transport-Security
max-age=300; includeSubdomains
Content-Type
application/javascript; charset=utf-8
Cache-Control
public, max-age=300
X-Amz-Cf-Pop
DFW3-C1
Link
<https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
X-Amz-Cf-Id
eqGT5SkgpFSvtvJxgQ5TkBsN-blSoz7iaumQNZ-2dR6b5Zv1ZK_0Nw==
embed.js
powershellmagazine.disqus.com/ 		72 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://powershellmagazine.disqus.com/embed.js
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/wp-content/plugins/disqus-comment-system/public/js/comment_embed.js?ver=3.0.17
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.112.134 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
openresty /
Resource Hash
8b33aee61f68c84d226b17df8c20b7007e14a521364339e684aacd1a54b79b55
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:12:41 GMT
Content-Encoding
gzip
Server
openresty
Age
0
Vary
Accept-Encoding
Connection
keep-alive
Content-Type
application/javascript; charset=utf-8
Cache-Control
private, max-age=60
X-Service
router
Strict-Transport-Security
max-age=300; includeSubdomains
Link
<https://disqus.com>; rel=preconnect, <https://c.disquscdn.com>; rel=preconnect
Content-Length
24063
rating_over.gif
www.powershellmagazine.com/wp-content/plugins/wp-postratings/images/stars/ 		523 B
806 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.powershellmagazine.com/wp-content/plugins/wp-postratings/images/stars/rating_over.gif
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
104.131.21.239 Clifton, United States, ASN14061 (DIGITALOCEAN-ASN, US),
Reverse DNS
Software
Apache/2.4.7 (Ubuntu) /
Resource Hash
71348f4f38512af6e6ba8062fe5545a783f91d1a07bcb300c246f1bad9b0d4b6

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:11:47 GMT
Last-Modified
Thu, 30 Jan 2020 12:44:57 GMT
Server
Apache/2.4.7 (Ubuntu)
ETag
"20b-59d5ad318eed5"
Content-Type
image/gif
Connection
Keep-Alive
Accept-Ranges
bytes
Keep-Alive
timeout=5, max=92
Content-Length
523
lounge.4a251b79c005f7a6da462eb85b7e7daf.css
c.disquscdn.com/next/embed/styles/ 		0
23 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://c.disquscdn.com/next/embed/styles/lounge.4a251b79c005f7a6da462eb85b7e7daf.css
Requested by
Host: powershellmagazine.disqus.com
URL: https://powershellmagazine.disqus.com/embed.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 15:12:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
1285220
strict-transport-security
max-age=300; includeSubdomains
content-length
22699
cf-request-id
08763289390000d711cc809000000001
timing-allow-origin
*
last-modified
Mon, 08 Feb 2021 23:35:56 GMT
server
cloudflare
etag
"6021cadc-58ab"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=31536000, public, immutable, no-transform
x-amz-cf-pop
FRA56-C1
accept-ranges
bytes
cf-ray
626a20552ce9d711-FRA
x-amz-cf-id
0t3-iFtqQBpeJK6Effg1ds9n1Q0rS4BiK4k874yNndYxKpuAs6D03A==
expires
Wed, 09 Feb 2022 18:12:20 GMT
common.bundle.38ea27189bdb723eae3dabf5bc7b8c0b.js
c.disquscdn.com/next/embed/ 		0
93 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://c.disquscdn.com/next/embed/common.bundle.38ea27189bdb723eae3dabf5bc7b8c0b.js
Requested by
Host: powershellmagazine.disqus.com
URL: https://powershellmagazine.disqus.com/embed.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 15:12:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
3772776
strict-transport-security
max-age=300; includeSubdomains
content-length
94778
cf-request-id
087632893a0000d711b20b6000000001
timing-allow-origin
*
last-modified
Mon, 11 Jan 2021 21:10:38 GMT
server
cloudflare
etag
"5ffcbece-1723a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=31536000, public, immutable, no-transform
x-amz-cf-pop
DFW55-C3
accept-ranges
bytes
cf-ray
626a20552cebd711-FRA
x-amz-cf-id
IPH2Ychi9ylfThDq4vOs9o2Rc8M0Ypdu-s2Q_SL2aA1yH56ait05kA==
expires
Tue, 11 Jan 2022 23:13:03 GMT
lounge.bundle.54cf549c270b597d5587d24486b38d71.js
c.disquscdn.com/next/embed/ 		0
114 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://c.disquscdn.com/next/embed/lounge.bundle.54cf549c270b597d5587d24486b38d71.js
Requested by
Host: powershellmagazine.disqus.com
URL: https://powershellmagazine.disqus.com/embed.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 15:12:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
498072
strict-transport-security
max-age=300; includeSubdomains
content-length
116865
cf-request-id
087632893a0000d711868c5000000001
timing-allow-origin
*
last-modified
Thu, 18 Feb 2021 19:12:14 GMT
server
cloudflare
etag
"602ebc0e-1c881"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=31536000, public, immutable, no-transform
x-amz-cf-pop
FRA6-C1
accept-ranges
bytes
cf-ray
626a20552cedd711-FRA
x-amz-cf-id
WY7hPbT8FAY3vQGA8Ifg_-yNBPcsGB2ConfpUDiOA5gZCEBegG4T4A==
expires
Fri, 18 Feb 2022 20:51:22 GMT
config.js
disqus.com/next/ 		0
11 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://disqus.com/next/config.js
Requested by
Host: powershellmagazine.disqus.com
URL: https://powershellmagazine.disqus.com/embed.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.192.134 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:12:41 GMT
X-Content-Type-Options
nosniff
Content-Type
application/javascript; charset=UTF-8
Server
nginx
Age
31
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=300; includeSubdomains
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Access-Control-Allow-Origin
*
Cache-Control
public, stale-while-revalidate=300, s-stalewhilerevalidate=3600, max-age=60
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
10947
X-XSS-Protection
1; mode=block
cb=gapi.loaded_1
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.3k1wIje1lec.O/m=auth/exm=plusone/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw/ 		97 KB
34 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.3k1wIje1lec.O/m=auth/exm=plusone/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw/cb=gapi.loaded_1
Requested by
Host: apis.google.com
URL: https://apis.google.com/js/plusone.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
274c5c962cd8ec53ac23d6d07978901972efd7b33e2eb0d1a7222c61fb7f907d
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 07:34:22 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 27 Jan 2021 20:08:03 GMT
server
sffe
age
27499
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, immutable, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
34392
x-xss-protection
0
expires
Thu, 24 Feb 2022 07:34:22 GMT
fastbutton
apis.google.com/se/0/_/+1/ Frame 2B20 		2 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://apis.google.com/se/0/_/+1/fastbutton?usegapi=1&size=standard&count=true&hl=en-US&origin=https%3A%2F%2Fwww.powershellmagazine.com&url=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.3k1wIje1lec.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw%2Fm%3D__features__
Requested by
Host: apis.google.com
URL: https://apis.google.com/js/plusone.js
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
b26b3d5904c7506bd94d42fcdc5b0963ecc0061d1cf7397b1afbcde50255897e
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-X4yGzp3lz+PGWmosD0+RxA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
apis.google.com
:scheme
https
:path
/se/0/_/+1/fastbutton?usegapi=1&size=standard&count=true&hl=en-US&origin=https%3A%2F%2Fwww.powershellmagazine.com&url=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.3k1wIje1lec.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw%2Fm%3D__features__
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
NID=210=aYOPotfy01ywRLDsf4h_2BIXs6oCU0VqUHkQr98RfezUhrpX5wNh7ZuBNr7KbJMJRyoz7TuHC4rGVwDnWP8rsyXeCk5OBQijHoWko1xXoXGL39v0qfLLzP3WutnQ169AtANQArEusmYsYr1s9GeQiQveWR-O6p26EmfiGAForVI
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/

Response headers

content-type
text/html; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
Mon, 01 Jan 1990 00:00:00 GMT
date
Wed, 24 Feb 2021 15:12:41 GMT
content-security-policy
script-src 'report-sample' 'nonce-X4yGzp3lz+PGWmosD0+RxA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
content-encoding
gzip
server
ESF
x-xss-protection
0
x-content-type-options
nosniff
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
postmessageRelay
accounts.google.com/o/oauth2/ Frame F922 		567 B
569 B 		Document
General
Check archive.org
Download Go to
Full URL
https://accounts.google.com/o/oauth2/postmessageRelay?parent=https%3A%2F%2Fwww.powershellmagazine.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.3k1wIje1lec.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw%2Fm%3D__features__
Requested by
Host: apis.google.com
URL: https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.3k1wIje1lec.O/m=auth/exm=plusone/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw/cb=gapi.loaded_1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::200d Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
6b43cfe89da4396cc379f50e586bc1cee619a1d1d8719e591cab9f6e8b3a4ea4
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-rddxsVEwufMN8L9HmrgpVA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

:method
GET
:authority
accounts.google.com
:scheme
https
:path
/o/oauth2/postmessageRelay?parent=https%3A%2F%2Fwww.powershellmagazine.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.3k1wIje1lec.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw%2Fm%3D__features__
pragma
no-cache
cache-control
no-cache
upgrade-insecure-requests
1
user-agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
sec-fetch-site
cross-site
sec-fetch-mode
navigate
sec-fetch-dest
iframe
referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
accept-encoding
gzip, deflate, br
accept-language
en-US
cookie
NID=210=aYOPotfy01ywRLDsf4h_2BIXs6oCU0VqUHkQr98RfezUhrpX5wNh7ZuBNr7KbJMJRyoz7TuHC4rGVwDnWP8rsyXeCk5OBQijHoWko1xXoXGL39v0qfLLzP3WutnQ169AtANQArEusmYsYr1s9GeQiQveWR-O6p26EmfiGAForVI
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/

Response headers

content-type
text/html; charset=utf-8
cache-control
no-cache, no-store, max-age=0, must-revalidate
pragma
no-cache
expires
Mon, 01 Jan 1990 00:00:00 GMT
date
Wed, 24 Feb 2021 15:12:41 GMT
content-security-policy
script-src 'report-sample' 'nonce-rddxsVEwufMN8L9HmrgpVA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /o/cspreport
content-encoding
gzip
server
ESF
x-xss-protection
0
x-content-type-options
nosniff
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
/
disqus.com/embed/comments/ Frame 013B 		6 KB
4 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://disqus.com/embed/comments/?base=default&f=powershellmagazine&t_i=9869%20http%3A%2F%2Fwww.powershellmagazine.com%2F%3Fp%3D9869&t_u=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&t_e=Investigating%20PowerShell%20Attacks&t_d=Investigating%20PowerShell%20Attacks%20%E2%80%93%20PowerShell%20Magazine&t_t=Investigating%20PowerShell%20Attacks&s_o=default
Requested by
Host: powershellmagazine.disqus.com
URL: https://powershellmagazine.disqus.com/embed.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.192.134 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
bdbceee15b322c6329c9707188c3e319237d5d2355b7be372861823ebdd76623
Security Headers
Name Value
Content-Security-Policy script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://apis.google.com https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ 'unsafe-inline' https://com-disqus.netmng.com:* https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Host
disqus.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/

Response headers

Connection
keep-alive
Content-Length
2709
Server
nginx
Content-Security-Policy
script-src https://*.twitter.com:* https://www.gstatic.com/recaptcha/ https://a.disquscdn.com https://c.disquscdn.com c.disquscdn.com https://*.services.disqus.com:* https://cdn.boomtrain.com/p13n/ https://apis.google.com https://cdn.syndication.twimg.com/tweets.json https://connect.facebook.net/en_US/sdk.js https://referrer.disqus.com/juggler/ 'unsafe-inline' https://com-disqus.netmng.com:* https://www.google.com/recaptcha/ https://cf.ignitionone.com:* https://disqus.com
Link
<https://c.disquscdn.com>;rel=preconnect,<https://c.disquscdn.com>;rel=dns-prefetch
Cache-Control
stale-if-error=3600, s-stalewhilerevalidate=3600, stale-while-revalidate=30, no-cache, must-revalidate, public, s-maxage=5
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Timing-Allow-Origin
*
X-Content-Type-Options
nosniff
X-XSS-Protection
1; mode=block
Content-Type
text/html; charset=utf-8
Last-Modified
Sun, 31 Jan 2021 12:45:31 GMT
ETag
W/"lounge:view:6570465252.9b9be3c2472f482805c041cf1e2cb179.2"
Referrer-Policy
no-referrer-when-downgrade
Content-Encoding
gzip
Date
Wed, 24 Feb 2021 15:12:42 GMT
Age
0
Vary
Accept-Encoding
Strict-Transport-Security
max-age=300; includeSubdomains
/
tempest.services.disqus.com/ads-iframe/taboola/ Frame B1A9 		28 KB
9 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://tempest.services.disqus.com/ads-iframe/taboola/?position=top&shortname=powershellmagazine&experiment=zetassp&variant=active&service=dynamic&anchorColor=%23222222&colorScheme=light&sourceUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&typeface=sans-serif&canonicalUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&disqus_version=4a68dd9
Requested by
Host: powershellmagazine.disqus.com
URL: https://powershellmagazine.disqus.com/embed.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.112.64 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
openresty /
Resource Hash
564d6c2ad1166839591902d6b1704d0b6ad967e3573fe26b40a580525b07e195

Request headers

Host
tempest.services.disqus.com
Connection
keep-alive
Pragma
no-cache
Cache-Control
no-cache
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Accept
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site
cross-site
Sec-Fetch-Mode
navigate
Sec-Fetch-Dest
iframe
Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Accept-Encoding
gzip, deflate, br
Accept-Language
en-US
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/

Response headers

Connection
keep-alive
Content-Length
9239
Server
openresty
Content-Type
text/html; charset=utf-8
Access-Control-Allow-Origin
*
Cache-Control
public, max-age=300
X-Service
router
Content-Encoding
gzip
Date
Wed, 24 Feb 2021 15:12:42 GMT
Age
0
Vary
Accept-Encoding,
event.gif
referrer.disqus.com/juggler/ 		43 B
295 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://referrer.disqus.com/juggler/event.gif?imp=3r60c6m33hpgvt&experiment=zetassp&variant=active&service=dynamic&area=top&product=embed&forum=powershellmagazine&zone=thread&version=4ce792797f4c10a96525509c741bcf5f&page_url=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&page_referrer=&object_type=provider&event=activity&ad_product_name=iab_display&ad_product_layout=iab_display&bin=embed%3Apromoted_discovery%3Adynamic%3Azetassp%3Aactive&section=default&verb=call&adjective=1&forum_id=953565
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.112.134 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:12:42 GMT
X-Content-Type-Options
nosniff
Last-Modified
Mon, 28 Sep 1970 06:00:00 GMT
Server
nginx
Content-Type
image/gif
Connection
keep-alive
Content-Length
43
X-XSS-Protection
1; mode=block
googlelogo_color_150x54dp.png
www.google.com/images/branding/googlelogo/1x/ Frame 2B20 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png
Requested by
Host: apis.google.com
URL: https://apis.google.com/se/0/_/+1/fastbutton?usegapi=1&size=standard&count=true&hl=en-US&origin=https%3A%2F%2Fwww.powershellmagazine.com&url=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.3k1wIje1lec.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw%2Fm%3D__features__
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:813::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
dbef5e5530003b7233e944856c23d1437902a2d3568cdfd2beaf2166e9ca9139
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://apis.google.com/se/0/_/+1/fastbutton?usegapi=1&size=standard&count=true&hl=en-US&origin=https%3A%2F%2Fwww.powershellmagazine.com&url=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&gsrc=3p&ic=1&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.3k1wIje1lec.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw%2Fm%3D__features__
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 15:12:41 GMT
x-content-type-options
nosniff
last-modified
Tue, 22 Oct 2019 18:30:00 GMT
server
sffe
content-type
image/png
cache-control
private, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
3170
x-xss-protection
0
expires
Wed, 24 Feb 2021 15:12:41 GMT
2038943760-postmessagerelay.js
ssl.gstatic.com/accounts/o/ Frame F922 		10 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ssl.gstatic.com/accounts/o/2038943760-postmessagerelay.js
Requested by
Host: accounts.google.com
URL: https://accounts.google.com/o/oauth2/postmessageRelay?parent=https%3A%2F%2Fwww.powershellmagazine.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.3k1wIje1lec.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw%2Fm%3D__features__
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:809::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
5bd9ca2f57b6c388332dd095d8c9be87dc71c2e1b78b843515ae758fe05a1223
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://accounts.google.com/o/oauth2/postmessageRelay?parent=https%3A%2F%2Fwww.powershellmagazine.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.3k1wIje1lec.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw%2Fm%3D__features__
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Mon, 22 Feb 2021 13:49:36 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Fri, 05 Feb 2021 03:27:24 GMT
server
sffe
age
177785
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4265
x-xss-protection
0
expires
Tue, 22 Feb 2022 13:49:36 GMT
rpc:shindig_random.js
apis.google.com/js/ Frame F922 		12 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://apis.google.com/js/rpc:shindig_random.js?onload=init
Requested by
Host: accounts.google.com
URL: https://accounts.google.com/o/oauth2/postmessageRelay?parent=https%3A%2F%2Fwww.powershellmagazine.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.3k1wIje1lec.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw%2Fm%3D__features__
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
ESF /
Resource Hash
38a622d903f3d196af226cd9f4081afc5e717465d8afc40f39b6a8319be4c786
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-0tWOYDzEoRiRL+xFSWm9Ig' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

Referer
https://accounts.google.com/o/oauth2/postmessageRelay?parent=https%3A%2F%2Fwww.powershellmagazine.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.3k1wIje1lec.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw%2Fm%3D__features__
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 15:12:41 GMT
content-encoding
gzip
x-content-type-options
nosniff
cross-origin-resource-policy
cross-origin
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
x-xss-protection
0
x-ua-compatible
IE=edge, chrome=1
server
ESF
x-frame-options
SAMEORIGIN
etag
"089674d94dca2bf44b47ebe0e4c3595b"
strict-transport-security
max-age=31536000
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
private, max-age=1800, stale-while-revalidate=1800
content-security-policy
script-src 'report-sample' 'nonce-0tWOYDzEoRiRL+xFSWm9Ig' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri /_/cspreport
timing-allow-origin
*
expires
Wed, 24 Feb 2021 15:12:41 GMT
cb=gapi.loaded_0
apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.3k1wIje1lec.O/m=rpc,shindig_random/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw/ Frame F922 		51 KB
18 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://apis.google.com/_/scs/apps-static/_/js/k=oz.gapi.en_US.3k1wIje1lec.O/m=rpc,shindig_random/rt=j/sv=1/d=1/ed=1/am=wQE/rs=AGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw/cb=gapi.loaded_0
Requested by
Host: apis.google.com
URL: https://apis.google.com/js/rpc:shindig_random.js?onload=init
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82b::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
614c628979413c313447557e9d90e9082ca8b9175d5c4a464bd6a9e6bc3a4aa7
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://accounts.google.com/o/oauth2/postmessageRelay?parent=https%3A%2F%2Fwww.powershellmagazine.com&jsh=m%3B%2F_%2Fscs%2Fapps-static%2F_%2Fjs%2Fk%3Doz.gapi.en_US.3k1wIje1lec.O%2Fam%3DwQE%2Fd%3D1%2Fct%3Dzgms%2Frs%3DAGLTcCNT4ir0QEJ6sXXAMZvqjav9vQSaLw%2Fm%3D__features__
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Thu, 18 Feb 2021 06:55:19 GMT
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 27 Jan 2021 20:08:03 GMT
server
sffe
age
548242
vary
Accept-Encoding, Origin
content-type
text/javascript; charset=UTF-8
cache-control
public, immutable, max-age=31536000
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
alt-svc
h3-29=":443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
18067
x-xss-protection
0
expires
Fri, 18 Feb 2022 06:55:19 GMT
lounge.load.4ce792797f4c10a96525509c741bcf5f.js
c.disquscdn.com/next/embed/ Frame 013B 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c.disquscdn.com/next/embed/lounge.load.4ce792797f4c10a96525509c741bcf5f.js
Requested by
Host: disqus.com
URL: https://disqus.com/embed/comments/?base=default&f=powershellmagazine&t_i=9869%20http%3A%2F%2Fwww.powershellmagazine.com%2F%3Fp%3D9869&t_u=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&t_e=Investigating%20PowerShell%20Attacks&t_d=Investigating%20PowerShell%20Attacks%20%E2%80%93%20PowerShell%20Magazine&t_t=Investigating%20PowerShell%20Attacks&s_o=default
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
fed106be3a8f4c9ba6465f809fccc7e1984735b50e81786fbd0de8d3c0ed04bd
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Origin
https://disqus.com
Referer
https://disqus.com/embed/comments/?base=default&f=powershellmagazine&t_i=9869%20http%3A%2F%2Fwww.powershellmagazine.com%2F%3Fp%3D9869&t_u=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&t_e=Investigating%20PowerShell%20Attacks&t_d=Investigating%20PowerShell%20Attacks%20%E2%80%93%20PowerShell%20Magazine&t_t=Investigating%20PowerShell%20Attacks&s_o=default
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 15:12:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
498073
strict-transport-security
max-age=300; includeSubdomains
content-length
533
cf-request-id
0876328a3c00001f55640a7000000001
timing-allow-origin
*
last-modified
Thu, 18 Feb 2021 19:12:14 GMT
server
cloudflare
etag
"602ebc0e-215"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=31536000, public, immutable, no-transform
x-amz-cf-pop
FRA6-C1
accept-ranges
bytes
cf-ray
626a2056cfcc1f55-FRA
x-amz-cf-id
I0n_jcjIIXEk6pIZ5nl_PQgQce_VgwRjeKs5kYNBlZvvFZ8rOp7hsg==
expires
Fri, 18 Feb 2022 20:51:23 GMT
common.bundle.38ea27189bdb723eae3dabf5bc7b8c0b.js
c.disquscdn.com/next/embed/ Frame 013B 		282 KB
93 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c.disquscdn.com/next/embed/common.bundle.38ea27189bdb723eae3dabf5bc7b8c0b.js
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/lounge.load.4ce792797f4c10a96525509c741bcf5f.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
013c268f90834ac7c8572fcb727d2280f2769b8fbf9ffe0fded9d10211b3ea66
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://disqus.com/embed/comments/?base=default&f=powershellmagazine&t_i=9869%20http%3A%2F%2Fwww.powershellmagazine.com%2F%3Fp%3D9869&t_u=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&t_e=Investigating%20PowerShell%20Attacks&t_d=Investigating%20PowerShell%20Attacks%20%E2%80%93%20PowerShell%20Magazine&t_t=Investigating%20PowerShell%20Attacks&s_o=default
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 15:12:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
3772777
strict-transport-security
max-age=300; includeSubdomains
content-length
94778
cf-request-id
0876328a510000d71167a68000000001
timing-allow-origin
*
last-modified
Mon, 11 Jan 2021 21:10:38 GMT
server
cloudflare
etag
"5ffcbece-1723a"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=31536000, public, immutable, no-transform
x-amz-cf-pop
DFW55-C3
accept-ranges
bytes
cf-ray
626a2056ef23d711-FRA
x-amz-cf-id
IPH2Ychi9ylfThDq4vOs9o2Rc8M0Ypdu-s2Q_SL2aA1yH56ait05kA==
expires
Tue, 11 Jan 2022 23:13:03 GMT
lounge.4a251b79c005f7a6da462eb85b7e7daf.css
c.disquscdn.com/next/embed/styles/ Frame 013B 		126 KB
22 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://c.disquscdn.com/next/embed/styles/lounge.4a251b79c005f7a6da462eb85b7e7daf.css
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.38ea27189bdb723eae3dabf5bc7b8c0b.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
901f2fe5c05bd0e15884682c8b6c7f81e7d2d016e8dbec5e902e6c37d71decb5
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://disqus.com/embed/comments/?base=default&f=powershellmagazine&t_i=9869%20http%3A%2F%2Fwww.powershellmagazine.com%2F%3Fp%3D9869&t_u=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&t_e=Investigating%20PowerShell%20Attacks&t_d=Investigating%20PowerShell%20Attacks%20%E2%80%93%20PowerShell%20Magazine&t_t=Investigating%20PowerShell%20Attacks&s_o=default
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 15:12:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
1285221
strict-transport-security
max-age=300; includeSubdomains
content-length
22699
cf-request-id
0876328a8c0000d711aea19000000001
timing-allow-origin
*
last-modified
Mon, 08 Feb 2021 23:35:56 GMT
server
cloudflare
etag
"6021cadc-58ab"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
text/css; charset=utf-8
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=31536000, public, immutable, no-transform
x-amz-cf-pop
FRA56-C1
accept-ranges
bytes
cf-ray
626a20574f94d711-FRA
x-amz-cf-id
0t3-iFtqQBpeJK6Effg1ds9n1Q0rS4BiK4k874yNndYxKpuAs6D03A==
expires
Wed, 09 Feb 2022 18:12:20 GMT
loader.js
cdn.taboola.com/libtrc/disqus-widget-safetylevel20longtail09/ Frame B1A9 		242 KB
37 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/disqus-widget-safetylevel20longtail09/loader.js
Requested by
Host: tempest.services.disqus.com
URL: https://tempest.services.disqus.com/ads-iframe/taboola/?position=top&shortname=powershellmagazine&experiment=zetassp&variant=active&service=dynamic&anchorColor=%23222222&colorScheme=light&sourceUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&typeface=sans-serif&canonicalUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&disqus_version=4a68dd9
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.232.137.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
038da771333be65b96b45697467edd0b625288ac61f6774beed3a921f1f26579

Request headers

Referer
https://tempest.services.disqus.com/ads-iframe/taboola/?position=top&shortname=powershellmagazine&experiment=zetassp&variant=active&service=dynamic&anchorColor=%23222222&colorScheme=light&sourceUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&typeface=sans-serif&canonicalUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&disqus_version=4a68dd9
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
lmUPl5gVlpD4SfGkhQjtaHIQLdkfn4jC
content-encoding
gzip
etag
"1ed5f98583c3a6d60f3f015225a02d84"
age
43
x-cache
HIT
content-length
36942
x-amz-id-2
F0wGYZGzlxEjSu6FM2bk+BDWZP60kzngH3P1CnLnZXbsLWo3RU9AFUEsnuPppXyLqtnH6OZGjC4=
x-served-by
cache-hhn11573-HHN
last-modified
Tue, 23 Feb 2021 16:01:32 GMT
server
AmazonS3
x-timer
S1614179562.206779,VS0,VE1
date
Wed, 24 Feb 2021 15:12:42 GMT
vary
Accept-Encoding
x-amz-request-id
763470A03993B104
via
1.1 varnish
cache-control
private,max-age=14401
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
abp
84
x-cache-hits
1
lounge.bundle.54cf549c270b597d5587d24486b38d71.js
c.disquscdn.com/next/embed/ Frame 013B 		452 KB
114 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c.disquscdn.com/next/embed/lounge.bundle.54cf549c270b597d5587d24486b38d71.js
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.38ea27189bdb723eae3dabf5bc7b8c0b.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
b484e8986a3a987e1d19988254ba48ad51b9adba23a2baff157b93fab401b7e7
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://disqus.com/embed/comments/?base=default&f=powershellmagazine&t_i=9869%20http%3A%2F%2Fwww.powershellmagazine.com%2F%3Fp%3D9869&t_u=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&t_e=Investigating%20PowerShell%20Attacks&t_d=Investigating%20PowerShell%20Attacks%20%E2%80%93%20PowerShell%20Magazine&t_t=Investigating%20PowerShell%20Attacks&s_o=default
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 15:12:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
498073
strict-transport-security
max-age=300; includeSubdomains
content-length
116865
cf-request-id
0876328a9b0000d711c9914000000001
timing-allow-origin
*
last-modified
Thu, 18 Feb 2021 19:12:14 GMT
server
cloudflare
etag
"602ebc0e-1c881"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=31536000, public, immutable, no-transform
x-amz-cf-pop
FRA6-C1
accept-ranges
bytes
cf-ray
626a20575fa9d711-FRA
x-amz-cf-id
WY7hPbT8FAY3vQGA8Ifg_-yNBPcsGB2ConfpUDiOA5gZCEBegG4T4A==
expires
Fri, 18 Feb 2022 20:51:22 GMT
config.js
disqus.com/next/ Frame 013B 		11 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://disqus.com/next/config.js
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.38ea27189bdb723eae3dabf5bc7b8c0b.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.192.134 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
7dd1fc4596ba859bcb3d431ac9600798ec05539c3b90b01bd3a024711e2882ea
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://disqus.com/embed/comments/?base=default&f=powershellmagazine&t_i=9869%20http%3A%2F%2Fwww.powershellmagazine.com%2F%3Fp%3D9869&t_u=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&t_e=Investigating%20PowerShell%20Attacks&t_d=Investigating%20PowerShell%20Attacks%20%E2%80%93%20PowerShell%20Magazine&t_t=Investigating%20PowerShell%20Attacks&s_o=default
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:12:42 GMT
X-Content-Type-Options
nosniff
Content-Type
application/javascript; charset=UTF-8
Server
nginx
Age
31
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=300; includeSubdomains
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Access-Control-Allow-Origin
*
Cache-Control
public, stale-while-revalidate=300, s-stalewhilerevalidate=3600, max-age=60
Connection
keep-alive
Timing-Allow-Origin
*
Content-Length
10947
X-XSS-Protection
1; mode=block
details
disqus.com/api/3.0/forums/ Frame 013B 		3 KB
3 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://disqus.com/api/3.0/forums/details?forum=powershellmagazine&attach=forumFeatures&api_key=E8Uh5l5fHZ6gD8U3KycjAIAk46f68Zw7C6eW8WSjZvCLXebZ7p0r1yrYDrLilk2F
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/common.bundle.38ea27189bdb723eae3dabf5bc7b8c0b.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.192.134 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
df32368ab844b0f5b9851a27d01f814c72b6d59338e7e1a5118b9410b4b76f34
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Accept
*/*
Referer
https://disqus.com/embed/comments/?base=default&f=powershellmagazine&t_i=9869%20http%3A%2F%2Fwww.powershellmagazine.com%2F%3Fp%3D9869&t_u=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&t_e=Investigating%20PowerShell%20Attacks&t_d=Investigating%20PowerShell%20Attacks%20%E2%80%93%20PowerShell%20Magazine&t_t=Investigating%20PowerShell%20Attacks&s_o=default
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:12:42 GMT
X-Content-Type-Options
nosniff
Server
nginx
Age
0
X-Frame-Options
SAMEORIGIN
Strict-Transport-Security
max-age=300; includeSubdomains
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
Connection
keep-alive
Content-Type
application/json
Vary
Origin, Cookie
Content-Length
2984
X-XSS-Protection
1; mode=block
impl.20210223-26-RELEASE.js
cdn.taboola.com/libtrc/ Frame B1A9 		468 KB
108 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/impl.20210223-26-RELEASE.js
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/disqus-widget-safetylevel20longtail09/loader.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.232.137.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3-br /
Resource Hash
6ebd7e553005f8b532c1d3f0c938fee31b9b8448b9f1185958e36220ba7adf41

Request headers

Referer
https://tempest.services.disqus.com/ads-iframe/taboola/?position=top&shortname=powershellmagazine&experiment=zetassp&variant=active&service=dynamic&anchorColor=%23222222&colorScheme=light&sourceUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&typeface=sans-serif&canonicalUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&disqus_version=4a68dd9
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
frqWw5r3FQMhAyub_aRooQikufVcQ1Um
content-encoding
br
etag
"37451effe3219ad0d8589672c27debc9"
age
26464
x-cache
HIT
content-length
110021
x-amz-id-2
FCuM9NUwCjNE1V72/H+UbvmijjAslmS2944tbEKtH7Atm79pliuHDFVU/2ggZEwtYlHMqzaRSQo=
x-served-by
cache-hhn11573-HHN
last-modified
Tue, 23 Feb 2021 15:47:10 GMT
server
AmazonS3-br
x-timer
S1614179562.283929,VS0,VE0
date
Wed, 24 Feb 2021 15:12:42 GMT
vary
Accept-Encoding
x-amz-request-id
FG4R5X4J3JDG9H5J
via
1.1 varnish
cache-control
private,max-age=31536000
accept-ranges
bytes
content-type
application/javascript
abp
92
x-cache-hits
182886
beacon.js
sb.scorecardresearch.com/ Frame B1A9 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sb.scorecardresearch.com/beacon.js
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/disqus-widget-safetylevel20longtail09/loader.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
184.25.115.49 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-25-115-49.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79

Request headers

Referer
https://tempest.services.disqus.com/ads-iframe/taboola/?position=top&shortname=powershellmagazine&experiment=zetassp&variant=active&service=dynamic&anchorColor=%23222222&colorScheme=light&sourceUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&typeface=sans-serif&canonicalUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&disqus_version=4a68dd9
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:12:42 GMT
Content-Encoding
gzip
Vary
Accept-Encoding
Content-Type
application/x-javascript
Cache-Control
private, no-transform, max-age=86400
Connection
keep-alive
Content-Length
884
Expires
Thu, 25 Feb 2021 15:12:42 GMT
noavatar92.png
a.disquscdn.com/1613175430/images/ Frame 013B 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://a.disquscdn.com/1613175430/images/noavatar92.png
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
199.232.198.49 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
36ef66124133ca33c8b44c487293c3180e5ab681ff3cad3c728ea4f894ec3444
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://disqus.com/embed/comments/?base=default&f=powershellmagazine&t_i=9869%20http%3A%2F%2Fwww.powershellmagazine.com%2F%3Fp%3D9869&t_u=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&t_e=Investigating%20PowerShell%20Attacks&t_d=Investigating%20PowerShell%20Attacks%20%E2%80%93%20PowerShell%20Magazine&t_t=Investigating%20PowerShell%20Attacks&s_o=default
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 15:12:42 GMT
x-content-type-options
nosniff
last-modified
Tue, 16 Feb 2021 23:46:19 GMT
server
nginx
age
585627
etag
"602c594b-66c"
strict-transport-security
max-age=300; includeSubdomains
p3p
CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM"
x-xss-protection
1; mode=block
cache-control
max-age=2592000
x-amz-cf-pop
FRA50-C1
content-type
image/png
content-length
1644
x-amz-cf-id
ajKHRvEcRGfgHKLNfPL1eQg80-cbZmKF1zB33fuWI2-v2tlsid7KHQ==
expires
Fri, 19 Mar 2021 20:32:16 GMT
truncated
/ Frame 013B 		37 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Content-Type
image/gif
svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg
c.disquscdn.com/next/embed/assets/img/ Frame 013B 		13 KB
13 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c.disquscdn.com/next/embed/assets/img/svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.4a251b79c005f7a6da462eb85b7e7daf.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3270642c89180c12db93775e2a774b6dadd9bd98cffc963075c85afd2c17b6e4
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://c.disquscdn.com/next/embed/styles/lounge.4a251b79c005f7a6da462eb85b7e7daf.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 15:12:42 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
9719275
strict-transport-security
max-age=300; includeSubdomains
content-length
13079
cf-request-id
0876328b470000d71164bf2000000001
timing-allow-origin
*
last-modified
Mon, 19 Oct 2020 18:27:03 GMT
server
cloudflare
etag
"5f8dda77-3317"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml; charset=utf-8
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=31536000, public, immutable, no-transform
accept-ranges
bytes
cf-ray
626a20587931d711-FRA
expires
Tue, 19 Oct 2021 19:08:20 GMT
loader.ba7c86e8b4b6135bb668d05223f8f127.gif
c.disquscdn.com/next/embed/assets/img/ Frame 013B 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c.disquscdn.com/next/embed/assets/img/loader.ba7c86e8b4b6135bb668d05223f8f127.gif
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.4a251b79c005f7a6da462eb85b7e7daf.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
4c4491dcfa94cb46fb73742fc2caf49a1cd59027304af1830c7dc6ce1889857c
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://c.disquscdn.com/next/embed/styles/lounge.4a251b79c005f7a6da462eb85b7e7daf.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 15:12:42 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
716669
strict-transport-security
max-age=300; includeSubdomains
content-length
2971
cf-request-id
0876328b4b0000d711a52ac000000001
timing-allow-origin
*
last-modified
Mon, 14 Dec 2020 22:46:46 GMT
server
cloudflare
etag
"5fd7eb56-b9b"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/gif
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=31536000, public, immutable, no-transform
x-amz-cf-pop
DFW55-C3
accept-ranges
bytes
cf-ray
626a20587935d711-FRA
x-amz-cf-id
EvCMTWKCjvve0qmqQvWzwZWa75ce5tSol6Ycs2_dayHQ8JpFyq0ZUw==
expires
Fri, 17 Dec 2021 09:57:52 GMT
sprite.654110a9206fd22f08cca0798e34a65e.png
c.disquscdn.com/next/embed/assets/img/ Frame 013B 		2 KB
2 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c.disquscdn.com/next/embed/assets/img/sprite.654110a9206fd22f08cca0798e34a65e.png
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.4a251b79c005f7a6da462eb85b7e7daf.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
cdba739c28b41f39ce438f2bf204fe739dc81a26cf559a9394ceed56a0666bee
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://c.disquscdn.com/next/embed/styles/lounge.4a251b79c005f7a6da462eb85b7e7daf.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 15:12:42 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
716669
strict-transport-security
max-age=300; includeSubdomains
content-length
1862
cf-request-id
0876328b4b0000d711e00f9000000001
timing-allow-origin
*
last-modified
Mon, 18 Jan 2021 17:33:12 GMT
server
cloudflare
etag
"6005c658-746"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/png
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=31536000, public, immutable, no-transform
x-amz-cf-pop
DFW53-C1
accept-ranges
bytes
cf-ray
626a20587937d711-FRA
x-amz-cf-id
EgON8tp8Et0Hc79zmS9Vbrl1C9iZJkMbKnffWBuVEXPBZ0W_DSkg6Q==
expires
Fri, 21 Jan 2022 12:21:07 GMT
icons.4cc7a703d2fdfe684151ff8ac24d45f1.woff2
c.disquscdn.com/next/embed/assets/font/ Frame 013B 		8 KB
8 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://c.disquscdn.com/next/embed/assets/font/icons.4cc7a703d2fdfe684151ff8ac24d45f1.woff2
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.4a251b79c005f7a6da462eb85b7e7daf.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f2a341fc815d45c21da726d4c843c2c5d3e1f333465347c3c75d040d556df4e5
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Origin
https://disqus.com
Referer
https://c.disquscdn.com/next/embed/styles/lounge.4a251b79c005f7a6da462eb85b7e7daf.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 15:12:42 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
716668
strict-transport-security
max-age=300; includeSubdomains
content-length
7900
cf-request-id
0876328b4b00001f55553cf000000001
timing-allow-origin
*
last-modified
Wed, 03 Feb 2021 18:02:57 GMT
server
cloudflare
etag
"601ae551-1edc"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/octet-stream
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=31536000, public, immutable, no-transform
x-amz-cf-pop
FRA56-C1
accept-ranges
bytes
cf-ray
626a20587a371f55-FRA
x-amz-cf-id
Rgooauymwnrvp5ORnFt12m3Cagi0Qgi2D6GgELQK7gROkGCk4txtzw==
expires
Sun, 06 Feb 2022 07:54:37 GMT
alfie_v4.63f1ab6d6b9d5807dc0c94ef3fe0b851.js
c.disquscdn.com/next/embed/ 		78 KB
26 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://c.disquscdn.com/next/embed/alfie_v4.63f1ab6d6b9d5807dc0c94ef3fe0b851.js
Requested by
Host: powershellmagazine.disqus.com
URL: https://powershellmagazine.disqus.com/embed.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
9efb3d5e1b082a66bd94908b42afb4cf6fe0e8eb8f50b8d2a18f6a5da03e6a18
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 15:12:42 GMT
content-encoding
gzip
x-content-type-options
nosniff
cf-cache-status
HIT
age
5246998
strict-transport-security
max-age=300; includeSubdomains
content-length
26578
cf-request-id
0876328ba80000d711d8931000000001
timing-allow-origin
*
last-modified
Mon, 23 Nov 2020 17:22:41 GMT
server
cloudflare
etag
"5fbbefe1-67d2"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=31536000, public, immutable, no-transform
x-amz-cf-pop
DFW55-C3
accept-ranges
bytes
cf-ray
626a20590a1fd711-FRA
x-amz-cf-id
iwXvkWWneYUzTgpoGXrolZxBkoZQ2bfC3Qst_9vVPBWLaqb-vIiHXg==
expires
Mon, 29 Nov 2021 02:25:38 GMT
event.gif
referrer.disqus.com/juggler/ Frame 013B 		43 B
295 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://referrer.disqus.com/juggler/event.gif?abe=0&embed_hidden=0&integration=wordpress%203.0.17&load_time=183&event=init_embed&thread=6570465252&forum=powershellmagazine&forum_id=953565&imp=3r60c6m33hpgvt&thread_slug=investigating_powershell_attacks&user_type=anon&referrer=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&theme=next&dnt=0&tracking_enabled=0&experiment=zetassp&variant=active&service=dynamic&promoted_enabled=true&max_enabled=true
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.112.134 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://disqus.com/embed/comments/?base=default&f=powershellmagazine&t_i=9869%20http%3A%2F%2Fwww.powershellmagazine.com%2F%3Fp%3D9869&t_u=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&t_e=Investigating%20PowerShell%20Attacks&t_d=Investigating%20PowerShell%20Attacks%20%E2%80%93%20PowerShell%20Magazine&t_t=Investigating%20PowerShell%20Attacks&s_o=default
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:12:42 GMT
X-Content-Type-Options
nosniff
Last-Modified
Mon, 28 Sep 1970 06:00:00 GMT
Server
nginx
Content-Type
image/gif
Connection
keep-alive
Content-Length
43
X-XSS-Protection
1; mode=block
b2
sb.scorecardresearch.com/ Frame B1A9
Redirect Chain
  • https://sb.scorecardresearch.com/b?c1=7&c2=34354936&c3=1&ns__t=1614179562438&ns_c=UTF-8&ns_if=1&cv=3.5&c8=&c7=https%3A%2F%2Ftempest.services.disqus.com%2Fads-iframe%2Ftaboola%2F%3Fposition%3Dtop%26...
  • https://sb.scorecardresearch.com/b2?c1=7&c2=34354936&c3=1&ns__t=1614179562438&ns_c=UTF-8&ns_if=1&cv=3.5&c8=&c7=https%3A%2F%2Ftempest.services.disqus.com%2Fads-iframe%2Ftaboola%2F%3Fposition%3Dtop%2...
0
528 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sb.scorecardresearch.com/b2?c1=7&c2=34354936&c3=1&ns__t=1614179562438&ns_c=UTF-8&ns_if=1&cv=3.5&c8=&c7=https%3A%2F%2Ftempest.services.disqus.com%2Fads-iframe%2Ftaboola%2F%3Fposition%3Dtop%26shortname%3Dpowershellmagazine%26experiment%3Dzetassp%26variant%3Dactive%26service%3Ddynamic%26anchorColor%3D%2523222222%26colorScheme%3Dlight%26sourceUrl%3Dhttps%253A%252F%252Fwww.powershellmagazine.com%252F2014%252F07%252F16%252Finvestigating-powershell-attacks%252F%26typeface%3Dsans-serif%26canonicalUrl%3Dhttps%253A%252F%252Fwww.powershellmagazine.com%252F2014%252F07%252F16%252Finvestigating-powershell-attacks%252F%26disqus_version%3D4a68dd9&c9=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&cs_ak_ss=1
Requested by
Host: tempest.services.disqus.com
URL: https://tempest.services.disqus.com/ads-iframe/taboola/?position=top&shortname=powershellmagazine&experiment=zetassp&variant=active&service=dynamic&anchorColor=%23222222&colorScheme=light&sourceUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&typeface=sans-serif&canonicalUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&disqus_version=4a68dd9
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
184.25.115.49 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a184-25-115-49.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://tempest.services.disqus.com/ads-iframe/taboola/?position=top&shortname=powershellmagazine&experiment=zetassp&variant=active&service=dynamic&anchorColor=%23222222&colorScheme=light&sourceUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&typeface=sans-serif&canonicalUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&disqus_version=4a68dd9
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 24 Feb 2021 15:12:42 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT

Redirect headers

Location
https://sb.scorecardresearch.com/b2?c1=7&c2=34354936&c3=1&ns__t=1614179562438&ns_c=UTF-8&ns_if=1&cv=3.5&c8=&c7=https%3A%2F%2Ftempest.services.disqus.com%2Fads-iframe%2Ftaboola%2F%3Fposition%3Dtop%26shortname%3Dpowershellmagazine%26experiment%3Dzetassp%26variant%3Dactive%26service%3Ddynamic%26anchorColor%3D%2523222222%26colorScheme%3Dlight%26sourceUrl%3Dhttps%253A%252F%252Fwww.powershellmagazine.com%252F2014%252F07%252F16%252Finvestigating-powershell-attacks%252F%26typeface%3Dsans-serif%26canonicalUrl%3Dhttps%253A%252F%252Fwww.powershellmagazine.com%252F2014%252F07%252F16%252Finvestigating-powershell-attacks%252F%26disqus_version%3D4a68dd9&c9=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&cs_ak_ss=1
Pragma
no-cache
Date
Wed, 24 Feb 2021 15:12:42 GMT
Cache-Control
private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate
Connection
keep-alive
Content-Length
0
Expires
Mon, 01 Jan 1990 00:00:00 GMT
json
trc.taboola.com/disqus-widget-safetylevel20longtail09/trc/3/ Frame B1A9 		16 KB
6 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://trc.taboola.com/disqus-widget-safetylevel20longtail09/trc/3/json?tim=16%3A12%3A42.480&lti=deflated&data=%7B%22id%22%3A81%2C%22ii%22%3A%22%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%22%2C%22it%22%3A%22text%22%2C%22sd%22%3Anull%2C%22ui%22%3Anull%2C%22uifp%22%3Anull%2C%22lbt%22%3A1614096081101%2C%22vi%22%3A1614179562478%2C%22cv%22%3A%2220210223-26-RELEASE%22%2C%22uiv%22%3A%22default%22%2C%22u%22%3A%22https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F%22%2C%22bv%22%3A%220%22%2C%22ul%22%3A%5B%22en-US%22%5D%2C%22btv%22%3A%220%22%2C%22cos%22%3A%224g%22%2C%22plf%22%3A%7B%22ack_exm%22%3Atrue%7D%2C%22e%22%3A%22https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F%22%2C%22bad%22%3A-1%2C%22sw%22%3A1600%2C%22sh%22%3A1200%2C%22bw%22%3A760%2C%22sde%22%3A%221.000%22%2C%22bh%22%3A17%2C%22dw%22%3A760%2C%22dh%22%3A27%2C%22qs%22%3A%22%3Fposition%3Dtop%26shortname%3Dpowershellmagazine%26experiment%3Dzetassp%26variant%3Dactive%26service%3Ddynamic%26anchorColor%3D%2523222222%26colorScheme%3Dlight%26sourceUrl%3Dhttps%253A%252F%252Fwww.powershellmagazine.com%252F2014%252F07%252F16%252Finvestigating-powershell-attacks%252F%26typeface%3Dsans-serif%26canonicalUrl%3Dhttps%253A%252F%252Fwww.powershellmagazine.com%252F2014%252F07%252F16%252Finvestigating-powershell-attacks%252F%26disqus_version%3D4a68dd9%22%2C%22r%22%3A%5B%7B%22li%22%3A%22rbox-t2m%22%2C%22s%22%3A7%2C%22uim%22%3A%22thumbnails-a%3Aabp%3D0%22%2C%22uip%22%3A%22%7B%5C%22domain%5C%22%3A%20%5C%22https%3A%2F%2Fwww.powershellmagazine.com%5C%22%2C%20%5C%22experiment%5C%22%3A%20%5C%22zetassp%5C%22%2C%20%5C%22position%5C%22%3A%20%5C%22top%5C%22%2C%20%5C%22shortname%5C%22%3A%20%5C%22powershellmagazine%5C%22%2C%20%5C%22variant%5C%22%3A%20%5C%22active%5C%22%7D%22%2C%22orig_uip%22%3A%22%7B%5C%22domain%5C%22%3A%20%5C%22https%3A%2F%2Fwww.powershellmagazine.com%5C%22%2C%20%5C%22experiment%5C%22%3A%20%5C%22zetassp%5C%22%2C%20%5C%22position%5C%22%3A%20%5C%22top%5C%22%2C%20%5C%22shortname%5C%22%3A%20%5C%22powershellmagazine%5C%22%2C%20%5C%22variant%5C%22%3A%20%5C%22active%5C%22%7D%22%2C%22cd%22%3A27%2C%22mw%22%3A0%7D%5D%2C%22cb%22%3A%22TRC.callbacks.recommendations_1%22%2C%22lt%22%3A%22deflated%22%7D
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20210223-26-RELEASE.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.232.137.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
dc157f8c944e01aa2eb14721d5f55363142aec600845fff6e1bb6c5f0574c277

Request headers

Referer
https://tempest.services.disqus.com/ads-iframe/taboola/?position=top&shortname=powershellmagazine&experiment=zetassp&variant=active&service=dynamic&anchorColor=%23222222&colorScheme=light&sourceUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&typeface=sans-serif&canonicalUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&disqus_version=4a68dd9
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
text/plain

Response headers

x-vcl-time-ms
152
date
Wed, 24 Feb 2021 15:12:42 GMT
content-encoding
gzip
server
nginx
x-timer
S1614179562.498208,VS0,VE152
x-served-by
cache-hhn11573-HHN
vary
Accept-Encoding
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
https://tempest.services.disqus.com
access-control-allow-credentials
true
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
via
1.1 varnish
x-cache-hits
0
svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg
c.disquscdn.com/next/embed/assets/img/ Frame 013B 		13 KB
13 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://c.disquscdn.com/next/embed/assets/img/svg-sprite.4da5413f5086c5755b46094b813dbfcd.svg
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/styles/lounge.4a251b79c005f7a6da462eb85b7e7daf.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:a813 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
3270642c89180c12db93775e2a774b6dadd9bd98cffc963075c85afd2c17b6e4
Security Headers
Name Value
Strict-Transport-Security max-age=300; includeSubdomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://c.disquscdn.com/next/embed/styles/lounge.4a251b79c005f7a6da462eb85b7e7daf.css
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 15:12:42 GMT
x-content-type-options
nosniff
cf-cache-status
HIT
age
9719275
strict-transport-security
max-age=300; includeSubdomains
content-length
13079
cf-request-id
0876328bf50000d71192220000000001
timing-allow-origin
*
last-modified
Mon, 19 Oct 2020 18:27:03 GMT
server
cloudflare
etag
"5f8dda77-3317"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
content-type
image/svg+xml; charset=utf-8
access-control-allow-origin
*
x-xss-protection
1; mode=block
cache-control
max-age=31536000, public, immutable, no-transform
accept-ranges
bytes
cf-ray
626a20598ad3d711-FRA
expires
Tue, 19 Oct 2021 19:08:20 GMT
pixel.gif
cdn.viglink.com/images/ 		43 B
128 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.viglink.com/images/pixel.gif?ch=1&rn=1.0226513933964059
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:a10d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 15:12:42 GMT
cf-cache-status
HIT
age
15
cf-ray
626a2059c94f2c22-FRA
content-length
43
x-amz-id-2
mzDru86dDt8T8rpWHT13h2SNbSiSpJK8k//2szzRSUITKb0PQAjGbqO/S/LCp/ANXmNux7MdgQU=
last-modified
Tue, 10 Feb 2015 03:29:39 GMT
server
cloudflare
etag
"221d8352905f2c38b3cb2bd191d630b0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-request-id
E4C0983580EFFFBF
cache-control
max-age=15, must-revalidate
cf-request-id
0876328c2100002c22711ca000000001
accept-ranges
bytes
content-type
image/gif
pixel.gif
cdn.viglink.com/images/ 		43 B
568 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.viglink.com/images/pixel.gif?ch=2&rn=1.0226513933964059
Requested by
Host: www.powershellmagazine.com
URL: https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
2606:4700::6810:a10d , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 15:12:42 GMT
cf-cache-status
HIT
age
15
cf-ray
626a2059c9542c22-FRA
content-length
43
x-amz-id-2
mzDru86dDt8T8rpWHT13h2SNbSiSpJK8k//2szzRSUITKb0PQAjGbqO/S/LCp/ANXmNux7MdgQU=
last-modified
Tue, 10 Feb 2015 03:29:39 GMT
server
cloudflare
etag
"221d8352905f2c38b3cb2bd191d630b0"
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding
x-amz-request-id
E4C0983580EFFFBF
cache-control
max-age=15, must-revalidate
cf-request-id
0876328c2300002c221c890000000001
accept-ranges
bytes
content-type
image/gif
cta-branding.js
cdn.taboola.com/demand-formats/cta-branding/ Frame B1A9 		12 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/demand-formats/cta-branding/cta-branding.js
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20210223-26-RELEASE.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.232.137.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
2a569e43b24389b9697a803de3103eaf72c8ccc2211a03a150d8534b17ef472f

Request headers

Referer
https://tempest.services.disqus.com/ads-iframe/taboola/?position=top&shortname=powershellmagazine&experiment=zetassp&variant=active&service=dynamic&anchorColor=%23222222&colorScheme=light&sourceUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&typeface=sans-serif&canonicalUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&disqus_version=4a68dd9
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
PJTNhUsAtA76kDVIW4_glMsKEAJ5N4BL
content-encoding
gzip
etag
"f5adb57cfe2ebbaa5cb53914ddbf9ca2"
age
11236
x-cache
HIT
x-amz-replication-status
PENDING
content-length
3965
x-amz-id-2
BUFyZKtQjK/rmpPAli8qgDWpTIvkDopUtlfmNMrBVZXHNAGTjDS6r/lQE0+zE2FcMVpouxOf+QQ=
x-served-by
cache-hhn11573-HHN
last-modified
Wed, 24 Feb 2021 12:05:18 GMT
server
AmazonS3
x-timer
S1614179563.697506,VS0,VE0
date
Wed, 24 Feb 2021 15:12:42 GMT
vary
Accept-Encoding
x-amz-request-id
BF560BE84B42A5A4
via
1.1 varnish
cache-control
private,max-age=14400
accept-ranges
bytes
content-type
application/javascript
abp
34
x-cache-hits
119154
cta-branding.css
cdn.taboola.com/demand-formats/cta-branding/ Frame B1A9 		3 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/demand-formats/cta-branding/cta-branding.css
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20210223-26-RELEASE.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.232.137.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
b57eca495e606d6a5b71d039f54b48f95b24ecfab0e885f0834df9647988211f

Request headers

Referer
https://tempest.services.disqus.com/ads-iframe/taboola/?position=top&shortname=powershellmagazine&experiment=zetassp&variant=active&service=dynamic&anchorColor=%23222222&colorScheme=light&sourceUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&typeface=sans-serif&canonicalUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&disqus_version=4a68dd9
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
wesQ.pLLtqiqMPOAo87CHMJBm6LJzidh
content-encoding
gzip
etag
"a13f67361cd19b638bb3083cf688d732"
age
25684
x-cache
HIT
x-amz-replication-status
COMPLETED
content-length
748
x-amz-id-2
d9sTKfwYmrIxTcoVpriY4wrlu6eOUvKWrrpl65qsiLwWDWQW/Ptp5bNyeLbPGhGTsnPN36Iy2cM=
x-served-by
cache-hhn11573-HHN
last-modified
Tue, 09 Feb 2021 16:04:13 GMT
server
AmazonS3
x-timer
S1614179563.697500,VS0,VE0
date
Wed, 24 Feb 2021 15:12:42 GMT
vary
Accept-Encoding
x-amz-request-id
953558099170AD83
via
1.1 varnish
cache-control
private,max-age=14400
accept-ranges
bytes
content-type
text/css
abp
34
x-cache-hits
472720
tfa-eid.20210223-26-RELEASE.es6.js
cdn.taboola.com/libtrc/ Frame B1A9 		13 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/tfa-eid.20210223-26-RELEASE.es6.js
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/disqus-widget-safetylevel20longtail09/loader.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.232.137.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
841d1d2c94538a16f4a28e593a3c50da9d339c29576d665ac30c89a205226c19

Request headers

Referer
https://tempest.services.disqus.com/ads-iframe/taboola/?position=top&shortname=powershellmagazine&experiment=zetassp&variant=active&service=dynamic&anchorColor=%23222222&colorScheme=light&sourceUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&typeface=sans-serif&canonicalUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&disqus_version=4a68dd9
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
WgpdKRDQDquYeAwKTYanvDqFW_QS7z.B
content-encoding
gzip
etag
"f5aeec16091260528ee2c611b86a37ee"
age
26371
x-cache
HIT
x-amz-replication-status
PENDING
content-length
4857
x-amz-id-2
+cdoUz0lMY57VlEdq/MkNKsxXXbY5yf+OTrATMweqkqzwKryn6VNtipmePpjVyTXqrFiPQBfu1A=
x-served-by
cache-hhn11573-HHN
last-modified
Wed, 24 Feb 2021 07:53:09 GMT
server
AmazonS3
x-timer
S1614179563.699751,VS0,VE0
date
Wed, 24 Feb 2021 15:12:42 GMT
vary
Accept-Encoding
x-amz-request-id
09BC6F8BE6E16654
via
1.1 varnish
cache-control
private,max-age=14400
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
abp
34
x-cache-hits
503694
sha256.20210223-26-RELEASE.es6.js
cdn.taboola.com/libtrc/ Frame B1A9 		6 KB
3 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/sha256.20210223-26-RELEASE.es6.js
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/disqus-widget-safetylevel20longtail09/loader.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.232.137.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1a1b98c167ebd132ba72d97aa4de957459bd790759642eccd25910e83cb03ff6

Request headers

Referer
https://tempest.services.disqus.com/ads-iframe/taboola/?position=top&shortname=powershellmagazine&experiment=zetassp&variant=active&service=dynamic&anchorColor=%23222222&colorScheme=light&sourceUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&typeface=sans-serif&canonicalUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&disqus_version=4a68dd9
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
MKxRQzBKDhQEkyevzmz6.mgSPyKKIHls
content-encoding
gzip
etag
"d21ce258030926f6ad5dc37faf556273"
age
26360
x-cache
HIT
x-amz-replication-status
PENDING
content-length
2596
x-amz-id-2
/HHIJWdeku1HamH2P5OtViRMxz6TBiU/Aj+g/lSB2N1sXGSQjUwDozgZEIeYaOz7eiMUwvoAGSU=
x-served-by
cache-hhn11573-HHN
last-modified
Wed, 24 Feb 2021 07:53:19 GMT
server
AmazonS3
x-timer
S1614179563.699732,VS0,VE0
date
Wed, 24 Feb 2021 15:12:42 GMT
vary
Accept-Encoding
x-amz-request-id
49CF24F1B3734531
via
1.1 varnish
cache-control
private,max-age=14400
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
abp
34
x-cache-hits
482239
tb
15.taboola.com/ Frame B1A9 		5 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://15.taboola.com/tb?oid=15&pubnm=disqus-widget-safetylevel20longtail09&unitType=226&tbloc=&pageType=text&pstn=%7B%22domain%22%3A%20%22https%3A%2F%2Fwww.powershellmagazine.com%22%2C%20%22experiment%22%3A%20%22zetassp%22%2C%20%22position%22%3A%20%22top%22%2C%20%22shortname%22%3A%20%22powershellmagazine%22%2C%20%22variant%22%3A%20%22active%22%7D&uuip=&cisrf=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&cirf=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&encoded=1&uid=1ae941ff-fb7a-481d-88fe-ad22973608bf-tuct72ff26a&variant=-100|478542&callback=TRC.videoTagCallbacks.videoCallback1&cb=1614179562704&tagid=&cntry=CH&platform=1&sesid=21d9f215dbceb09b4f0bafc05d321f26&itemid=/2014/07/16/investigating-powershell-attacks&viewid=1614179562478&geolat=&geoing=&deviceifa=&appid=&sd=v2_21d9f215dbceb09b4f0bafc05d321f26_1ae941ff-fb7a-481d-88fe-ad22973608bf-tuct72ff26a_1614179562_1614179562_CIi3jgYQktQ_GO7n5aT9LiABKAEwKziy0A1Aw4gQSLid2gNQ____________AVgAYABo4qaqkbKtl-Jw&ri=ab84122ce28382d837445a23bd198dd1&appname=&cdb=&gdprApplies=false&rid=&sii=&oee=true&tpubid=1042962&uis=2&fagg=1&ccpaDns=false&ccpaPrivacy=&region=NE&hasGDPRConsent=true&tcfVersion=&cmpStatus=&tnetid=1003147
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20210223-26-RELEASE.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
65fe4198a3e1b9295b94b3302c278749832f10cd8edd51b9363357f5c9d6cbe9

Request headers

Referer
https://tempest.services.disqus.com/ads-iframe/taboola/?position=top&shortname=powershellmagazine&experiment=zetassp&variant=active&service=dynamic&anchorColor=%23222222&colorScheme=light&sourceUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&typeface=sans-serif&canonicalUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&disqus_version=4a68dd9
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 15:12:42 GMT
content-encoding
gzip
machineid
1418
x-cache
MISS
x-cache-hits
0
x-served-by
cache-fra19132-FRA
pragma
no-cache
server
nginx
x-timer
S1614179563.776665,VS0,VE11
vary
Accept-Encoding
content-type
text/html;charset=ISO-8859-1
via
1.1 varnish
cache-control
no-cache,must-revalidate,no-store,max-age=0,s-maxage=0
accept-ranges
bytes
link
<https://am-wf.taboola.com>; rel=preconnect
expires
Sat, 26 Jul 1997 05:00:00 GMT
userx.20210223-26-RELEASE.es6.js
cdn.taboola.com/libtrc/ Frame B1A9 		22 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdn.taboola.com/libtrc/userx.20210223-26-RELEASE.es6.js
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/disqus-widget-safetylevel20longtail09/loader.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.232.137.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
68672538b7b4613bc0f6fae79641b8eb2d703a0385440589756a8b16a794ff0e

Request headers

Referer
https://tempest.services.disqus.com/ads-iframe/taboola/?position=top&shortname=powershellmagazine&experiment=zetassp&variant=active&service=dynamic&anchorColor=%23222222&colorScheme=light&sourceUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&typeface=sans-serif&canonicalUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&disqus_version=4a68dd9
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
OIoxpmyWf3aXCsNUXFy.xWkxbovL8mn4
content-encoding
gzip
etag
"0da626a9f00f83bc9327e3193fd76d13"
age
26374
x-cache
HIT
x-amz-replication-status
PENDING
content-length
7812
x-amz-id-2
g8xbr9tFvJ3AUX8TT9y4CY715JHpacldtEcJ6Umhoi+mviUdF6jw/9qfldviMtddcJgXy34wzSw=
x-served-by
cache-hhn11573-HHN
last-modified
Wed, 24 Feb 2021 07:53:04 GMT
server
AmazonS3
x-timer
S1614179563.722631,VS0,VE1
date
Wed, 24 Feb 2021 15:12:42 GMT
vary
Accept-Encoding
x-amz-request-id
2A36404C3488EFA0
via
1.1 varnish
cache-control
private,max-age=14400
accept-ranges
bytes
content-type
application/javascript; charset=utf-8
abp
34
x-cache-hits
191258
rtb-h
match.taboola.com/sg/mediaforcebidder-network/1/ Frame 0C2B
Redirect Chain
  • https://rtb.mfadsrvr.com/sync?ssp=taboola
  • https://rtb.mfadsrvr.com/ul_cb/sync?ssp=taboola
  • https://sync.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=a2e6335b-5424-4c69-8428-6b638a282fcc
  • https://match.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=a2e6335b-5424-4c69-8428-6b638a282fcc&tbid=1ae941ff-fb7a-481d-88fe-ad22973608bf-tuct72ff26a&query=taboola_hm%3Da2e6335b-5424-...
0
53 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=a2e6335b-5424-4c69-8428-6b638a282fcc&tbid=1ae941ff-fb7a-481d-88fe-ad22973608bf-tuct72ff26a&query=taboola_hm%3Da2e6335b-5424-4c69-8428-6b638a282fcc&isDirect=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 15:12:42 GMT
via
1.1 varnish
server
nginx
x-timer
S1614179563.920275,VS0,VE9
x-cache
MISS
x-cache-hits
0
accept-ranges
bytes
content-length
0
x-served-by
cache-fra19132-FRA

Redirect headers

location
https://match.taboola.com/sg/mediaforcebidder-network/1/rtb-h?taboola_hm=a2e6335b-5424-4c69-8428-6b638a282fcc&tbid=1ae941ff-fb7a-481d-88fe-ad22973608bf-tuct72ff26a&query=taboola_hm%3Da2e6335b-5424-4c69-8428-6b638a282fcc&isDirect=0
tbl-x-upstream
10.40.0.134:10213
date
Wed, 24 Feb 2021 15:12:42 GMT
server
nginx
x-fastly-to-nlb-rtt
12887
/
trc.taboola.com/sg/rubicon-network-display/1/rtb-h/ Frame 0C2B
Redirect Chain
  • https://pixel.rubiconproject.com/exchange/sync.php?p=16698
  • https://trc.taboola.com/sg/rubicon-network-display/1/rtb-h/?taboola_hm=KLJKU1XG-1M-6UNL
0
270 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trc.taboola.com/sg/rubicon-network-display/1/rtb-h/?taboola_hm=KLJKU1XG-1M-6UNL
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.232.137.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms
50
date
Wed, 24 Feb 2021 15:12:42 GMT
via
1.1 varnish
server
nginx
x-timer
S1614179563.853298,VS0,VE50
x-cache
MISS
x-cache-hits
0
accept-ranges
bytes
x-served-by
cache-hhn11573-HHN

Redirect headers

Pragma
no-cache
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
Location
https://trc.taboola.com/sg/rubicon-network-display/1/rtb-h/?taboola_hm=KLJKU1XG-1M-6UNL
Cache-Control
no-cache,no-store,must-revalidate
Content-Type
text/html
content-length
0
X-RPHost
de8527bfa1ccfd6c1590da0d3b6cff52
Expires
0
/
sync.taboola.com/sg/pulsepointrtb-network/1/rtb-h/ Frame 0C2B
Redirect Chain
  • https://bh.contextweb.com/bh/rtset?pid=562107&ev=1&rurl=https%3A%2F%2Fsync.taboola.com/sg/pulsepointrtb-network/1/rtb-h/?taboola_hm=%%VGUID%%&orig=trc
  • https://sync.taboola.com/sg/pulsepointrtb-network/1/rtb-h/?taboola_hm=uOx7jIM5rdH1&ev=1&orig=trc&pid=562107
0
218 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.taboola.com/sg/pulsepointrtb-network/1/rtb-h/?taboola_hm=uOx7jIM5rdH1&ev=1&orig=trc&pid=562107
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

tbl-x-upstream
10.40.0.175:10213
date
Wed, 24 Feb 2021 15:12:43 GMT
server
nginx
x-fastly-to-nlb-rtt
18666

Redirect headers

strict-transport-security
max-age=15768000
server
Jetty(9.4.14.v20181114)
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
content-language
en-US
location
https://sync.taboola.com/sg/pulsepointrtb-network/1/rtb-h/?taboola_hm=uOx7jIM5rdH1&ev=1&orig=trc&pid=562107
cache-control
private, max-age=0, no-cache, no-store
cw-server
bh-deployment-75d6d6d469-ttlxp
expires
-1
getuidnb
ib.adnxs.com/ Frame 0C2B 		43 B
695 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ib.adnxs.com/getuidnb?https://sync.taboola.com/sg/appnexus-network/1/rtb-h/?taboola_hm=$UID&orig=trc
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
37.252.173.38 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEX, US),
Reverse DNS
537.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.17.9 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 24 Feb 2021 15:12:42 GMT
X-Proxy-Origin
185.156.175.107; 185.156.175.107; 537.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.173.149:80
AN-X-Request-Uuid
97fef2d5-db07-4c9f-992b-40f95a5e8532
Server
nginx/1.17.9
P3P
policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
*
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
image/gif
Content-Length
43
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
/
trc.taboola.com/sg/google-network/1/rtb-h/ Frame 0C2B
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_cm&google_sc
  • https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_cm=&google_sc=&google_tc=
  • https://trc.taboola.com/sg/google-network/1/rtb-h/?taboola_hm=CAESEMRVztQH8nInWI99CkzKRhM&google_cver=1
0
60 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trc.taboola.com/sg/google-network/1/rtb-h/?taboola_hm=CAESEMRVztQH8nInWI99CkzKRhM&google_cver=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.232.137.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms
51
date
Wed, 24 Feb 2021 15:12:42 GMT
via
1.1 varnish
server
nginx
x-timer
S1614179563.874406,VS0,VE51
x-cache
MISS
x-cache-hits
0
accept-ranges
bytes
content-length
0
x-served-by
cache-hhn11573-HHN

Redirect headers

pragma
no-cache
date
Wed, 24 Feb 2021 15:12:42 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://trc.taboola.com/sg/google-network/1/rtb-h/?taboola_hm=CAESEMRVztQH8nInWI99CkzKRhM&google_cver=1
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
304
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
Pug
simage2.pubmatic.com/AdServer/ Frame 0C2B 		42 B
1009 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTM0MjcmdGw9MTI5NjAw&piggybackCookie=1ae941ff-fb7a-481d-88fe-ad22973608bf-tuct72ff26a:$UID
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
185.64.190.80 , United Kingdom, ASN62713 (AS-PUBMATIC, US),
Reverse DNS
Software
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6 /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-Cnection
close
Pragma
no-cache
Date
Wed, 24 Feb 2021 15:12:42 GMT
X-lat
Pug23010:0:301
Server
Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_fastcgi/2.4.6
P3P
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC", CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
Cache-Control
no-store, no-cache, private
Content-Type
image/gif; charset=utf-8
Content-Length
42
pixel
cm.g.doubleclick.net/ Frame 0C2B
Redirect Chain
  • https://sync.taboola.com/sg/google-network/1/rtb?redir=https%3A%2F%2Fcm.g.doubleclick.net%2Fpixel%3Fgoogle_nid%3Dtaboola_dbm%26google_sc%26gdpr%3D0%26gdpr_consent%3D&orig=trc
  • https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_sc&gdpr=0&gdpr_consent=&google_hm=1ae941ff-fb7a-481d-88fe-ad22973608bf-tuct72ff26a
170 B
730 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_sc&gdpr=0&gdpr_consent=&google_hm=1ae941ff-fb7a-481d-88fe-ad22973608bf-tuct72ff26a
Protocol
H3-Q050
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:82a::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
HTTP server (unknown) /
Resource Hash
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
Security Headers
Name Value
X-Xss-Protection 0

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 24 Feb 2021 15:12:42 GMT
server
HTTP server (unknown)
content-type
image/png
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3-29="googleads.g.doubleclick.net:443"; ma=2592000,h3-29=":443"; ma=2592000,h3-T051="googleads.g.doubleclick.net:443"; ma=2592000,h3-T051=":443"; ma=2592000,h3-Q050="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043="googleads.g.doubleclick.net:443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic="googleads.g.doubleclick.net:443"; ma=2592000; v="46,43",quic=":443"; ma=2592000; v="46,43"
content-length
170
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT

Redirect headers

location
https://cm.g.doubleclick.net/pixel?google_nid=taboola_dbm&google_sc&gdpr=0&gdpr_consent=&google_hm=1ae941ff-fb7a-481d-88fe-ad22973608bf-tuct72ff26a
tbl-x-upstream
10.40.0.134:10213
date
Wed, 24 Feb 2021 15:12:42 GMT
server
nginx
x-fastly-to-nlb-rtt
12712
/
trc.taboola.com/sg/thetradedesk-network/1/rtb-h/ Frame 0C2B
Redirect Chain
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=054f32o&ttd_tpi=1
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=054f32o&ttd_tpi=1
  • https://trc.taboola.com/sg/thetradedesk-network/1/rtb-h/?taboola_hm=321e67d9-3295-4912-b9b9-290f7ce8d01e
0
83 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://trc.taboola.com/sg/thetradedesk-network/1/rtb-h/?taboola_hm=321e67d9-3295-4912-b9b9-290f7ce8d01e
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.232.137.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms
66
date
Wed, 24 Feb 2021 15:12:43 GMT
via
1.1 varnish
server
nginx
x-timer
S1614179563.936166,VS0,VE66
x-cache
MISS
x-cache-hits
0
accept-ranges
bytes
content-length
0
x-served-by
cache-hhn11573-HHN

Redirect headers

pragma
no-cache
date
Wed, 24 Feb 2021 15:12:42 GMT
x-aspnet-version
4.0.30319
p3p
CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
location
https://trc.taboola.com/sg/thetradedesk-network/1/rtb-h/?taboola_hm=321e67d9-3295-4912-b9b9-290f7ce8d01e
cache-control
private,no-cache, must-revalidate
content-type
text/html
content-length
239
merge
ce.lijit.com/ Frame 0C2B
Redirect Chain
  • https://ce.lijit.com/merge?pid=42&3pid=1ae941ff-fb7a-481d-88fe-ad22973608bf-tuct72ff26a&us_privacy=&gdpr=0&gdpr_consent=
  • https://ce.lijit.com/merge?pid=42&3pid=1ae941ff-fb7a-481d-88fe-ad22973608bf-tuct72ff26a&us_privacy=&gdpr=0&gdpr_consent=&dnr=1
0
433 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=42&3pid=1ae941ff-fb7a-481d-88fe-ad22973608bf-tuct72ff26a&us_privacy=&gdpr=0&gdpr_consent=&dnr=1
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
216.52.2.48 , United States, ASN29791 (VOXEL-DOT-NET, US),
Reverse DNS
Software
nginx / raptor
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 24 Feb 2021 15:12:42 GMT
Server
nginx
X-Powered-By
raptor
P3P
CP="CUR ADM OUR NOR STA NID"
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap5ams1
Expires
Fri, 20 Mar 2009 00:00:00 GMT

Redirect headers

Pragma
no-cache
Date
Wed, 24 Feb 2021 15:12:42 GMT
Server
nginx
X-Powered-By
raptor
P3P
CP="CUR ADM OUR NOR STA NID"
Location
https://ce.lijit.com/merge?pid=42&3pid=1ae941ff-fb7a-481d-88fe-ad22973608bf-tuct72ff26a&us_privacy=&gdpr=0&gdpr_consent=&dnr=1
Cache-Control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
X-Sovrn-Pod
ad_ap5ams1
Content-Length
0
Expires
Fri, 20 Mar 2009 00:00:00 GMT
rtset
bh.contextweb.com/bh/ Frame 0C2B 		49 B
729 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bh.contextweb.com/bh/rtset?do=add&pid=553204&ev=1ae941ff-fb7a-481d-88fe-ad22973608bf-tuct72ff26a
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
198.148.27.140 New York, United States, ASN19189 (PULSEPOINT, US),
Reverse DNS
Software
Jetty(9.4.14.v20181114) /
Resource Hash
d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32
Security Headers
Name Value
Strict-Transport-Security max-age=15768000

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

strict-transport-security
max-age=15768000
server
Jetty(9.4.14.v20181114)
content-language
en-US
p3p
policyref="/bh/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
cache-control
private, max-age=0, no-cache, no-store
content-type
image/gif;charset=iso-8859-1
cw-server
bh-deployment-75d6d6d469-hx6h4
expires
-1
/
rtb-csync.smartadserver.com/redir/ Frame 0C2B 		43 B
715 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://rtb-csync.smartadserver.com/redir/?partnerid=107&partneruserid=1ae941ff-fb7a-481d-88fe-ad22973608bf-tuct72ff26a&gdpr=0&gdpr_consent=
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
185.86.138.114 , France, ASN201081 (SMARTADSERVER, FR),
Reverse DNS
Software
/
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

pragma
no-cache
date
Wed, 24 Feb 2021 15:12:42 GMT
cache-control
no-cache,no-store
x-smrt-reason
5
content-type
image/gif
transfer-encoding
chunked
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
sync
dsp.adkernel.com/ Frame 0C2B 		42 B
233 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsp.adkernel.com/sync?exchange=281&r=%2F%2Fsync.taboola.com%2Fsg%2Fadkernelrtb-network%2F1%2Frtb-h%3Ftaboola_hm%3D%7BUID%7D
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
174.137.133.49 , United States, ASN27257 (WEBAIR-INTERNET, US),
Reverse DNS
Software
nginx /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 24 Feb 2021 15:12:43 GMT
Server
nginx
Age
0
Content-Type
image/gif
Cache-Control
no-store
Connection
keep-alive
Content-Length
42
put
e1.emxdgt.com/ Frame 0C2B 		43 B
124 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://e1.emxdgt.com/put?d=d41&uid=1ae941ff-fb7a-481d-88fe-ad22973608bf-tuct72ff26a
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
18.195.155.181 Frankfurt am Main, Germany, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-18-195-155-181.eu-central-1.compute.amazonaws.com
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 15:12:42 GMT
content-length
43
x-nosync
emp
content-type
image/gif
/
sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/ Frame 0C2B
Redirect Chain
  • https://dis.criteo.com/dis/usersync.aspx?r=29&p=282&cp=taboolaortb&cu=1&url=https%3A%2F%2Fsync-t1.taboola.com%2Fsg%2Fcriteortb-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D%40%40CRITEO_USERID%40%40
  • https://sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/?taboola_hm=6635b05b-b6f9-4976-885f-7a233a48a7cf
0
227 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/?taboola_hm=6635b05b-b6f9-4976-885f-7a233a48a7cf
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

tbl-x-upstream
10.40.0.134:10213
date
Wed, 24 Feb 2021 15:12:43 GMT
server
nginx
x-fastly-to-nlb-rtt
12878

Redirect headers

pragma
no-cache
x-errorlevel
0
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
p3p
CP="NON DSP COR CURa PSA PSD OUR BUS NAV STA"
location
https://sync-t1.taboola.com/sg/criteortb-network/1/rtb-h/?taboola_hm=6635b05b-b6f9-4976-885f-7a233a48a7cf
cache-control
no-cache
date
Wed, 24 Feb 2021 15:12:42 GMT
server-processing-duration-in-ticks
3021
content-type
text/html; charset=utf-8
content-length
222
expires
Wed, 24 Feb 2021 00:00:00 GMT
8.gif
id5-sync.com/c/464/19/0/ Frame 0C2B
Redirect Chain
  • https://id5-sync.com/s/464/9.gif?puid=1ae941ff-fb7a-481d-88fe-ad22973608bf-tuct72ff26a&gdpr=0&gdpr_consent=&callback=https%3A%2F%2Fsync.taboola.com%2Fsg%2Fid5-network%2F1%2Frtb-h%2F%3Ftaboola_hm%3D...
  • https://id5-sync.com/c/464/464/7/1.gif?puid=1ae941ff-fb7a-481d-88fe-ad22973608bf-tuct72ff26a&gdpr=0&gdpr_consent=
  • https://ib.adnxs.com/getuid?https://id5-sync.com/c/464/2/6/2.gif?puid=$UID&gdpr=0&gdpr_consent=
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%3A%2F%2Fid5-sync.com%2Fc%2F464%2F2%2F6%2F2.gif%3Fpuid%3D%24UID%26gdpr%3D0%26gdpr_consent%3D
  • https://id5-sync.com/c/464/2/6/2.gif?puid=7783359033985011083&gdpr=0&gdpr_consent=
  • https://sync.mathtag.com/sync/img?mt_exid=10089&mt_exuid=ID5-ZHMOC83_XzAuhRxBpFQu8fOgrIVX3BjqbfjdAkx5Hg&redir=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F3%2F5%2F3.gif%3Fpuid%3D%5BUUID%5D%26gdpr%3D0%26g...
  • https://id5-sync.com/c/464/3/5/3.gif?puid=e09b6036-6ceb-4300-b731-9ebe6cd6e8f1&gdpr=0&gdpr_consent=
  • https://ice.360yield.com/match?publisher_dsp_id=79&dsp_callback=1&external_user_id=ID5-ZHMOC83_XzAuhRxBpFQu8fOgrIVX3BjqbfjdAkx5Hg&r=https%3A%2F%2Fid5-sync.com%2Fcq%2F464%2F124%2F4%2F4.gif%3Fpuid%3D...
  • https://ice.360yield.com/ul_cb/match?publisher_dsp_id=79&dsp_callback=1&external_user_id=ID5-ZHMOC83_XzAuhRxBpFQu8fOgrIVX3BjqbfjdAkx5Hg&r=https%3A%2F%2Fid5-sync.com%2Fcq%2F464%2F124%2F4%2F4.gif%3Fp...
  • https://id5-sync.com/cq/464/124/4/4.gif?puid=644debc3-a7ef-4ffd-b61a-70383ee009d1&gdpr=0&gdpr_consent=&gdpr=0&gdpr_consent=
  • https://dis.eu.criteo.com/dis/usersync.aspx?r=30&p=59&cp=id5&cu=1&url=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F203%2F3%2F5.gif%3Fpuid%3D%40%40CRITEO_USERID%40%40%26gdpr%3D0%26gdpr_consent%3D
  • https://id5-sync.com/c/464/203/3/5.gif?puid=6635b05b-b6f9-4976-885f-7a233a48a7cf&gdpr=0&gdpr_consent=
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://match.adsrvr.org/track/cmb/generic?ttd_pid=8h9u11h&ttd_tpi=1&gdpr=0&gdpr_consent=
  • https://id5-sync.com/k/264.gif?puid=b318c63a-2e16-46b4-8c31-321ac289eeb6&ttl=%%TTL%%
  • https://c1.adform.net/serving/cookie/match?party=1135&callback=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F10%2F1%2F7.gif%3Fpuid%3D%5Badformuid%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr_consent=&gdpr=0
  • https://c1.adform.net/serving/cookie/match?CC=1&party=1135&callback=https%3A%2F%2Fid5-sync.com%2Fc%2F464%2F10%2F1%2F7.gif%3Fpuid%3D%5Badformuid%5D%26gdpr%3D0%26gdpr_consent%3D&gdpr_consent=&gdpr=0
  • https://id5-sync.com/c/464/10/1/7.gif?puid=5169632322289409463&gdpr=0&gdpr_consent=
  • https://sync.crwdcntrl.net/map/c=13953/tp=IDFI/gdpr=0/gdpr_consent=?https://id5-sync.com/c/464/19/0/8.gif?puid=${profile_id}&gdpr=0&gdpr_consent=
  • https://sync.crwdcntrl.net/map/ct=y/c=13953/tp=IDFI/gdpr=0/gdpr_consent=?https://id5-sync.com/c/464/19/0/8.gif?puid=${profile_id}&gdpr=0&gdpr_consent=
  • https://id5-sync.com/c/464/19/0/8.gif?puid=783ffced1486ce4c657f294e15fb23dc&gdpr=0&gdpr_consent=
0
0
rtb-h
sync.taboola.com/sg/appierrtb-network/1/ Frame 0C2B
Redirect Chain
  • https://s.c.appier.net/taboola
  • https://sync.taboola.com/sg/appierrtb-network/1/rtb-h?taboola_hm=_-rTRRd1Bny3y9ij62w2YA
0
218 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.taboola.com/sg/appierrtb-network/1/rtb-h?taboola_hm=_-rTRRd1Bny3y9ij62w2YA
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

tbl-x-upstream
10.40.0.175:10213
date
Wed, 24 Feb 2021 15:12:43 GMT
server
nginx
x-fastly-to-nlb-rtt
17275

Redirect headers

location
https://sync.taboola.com/sg/appierrtb-network/1/rtb-h?taboola_hm=_-rTRRd1Bny3y9ij62w2YA
date
Wed, 24 Feb 2021 15:12:43 GMT
cache-control
no-store
server
nginx
content-type
text/html; charset=utf-8
content-length
110
p3p
CP="CUR ADM DEV TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cookiesync
bttrack.com/pixel/ Frame 0C2B 		35 B
380 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bttrack.com/pixel/cookiesync?source=14b8c562-d12b-418b-b680-ad517d5839ec
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
192.132.33.46 , United States, ASN18568 (BIDTELLECT, US),
Reverse DNS
46.bidtellect.com
Software
Microsoft-IIS/8.5 /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

X-ServerName
Track004-dc3
Pragma
no-cache
Date
Wed, 24 Feb 2021 15:12:38 GMT
X-AspNetMvc-Version
5.2
Server
Microsoft-IIS/8.5
X-AspNet-Version
4.0.30319
P3P
CP="CAO DSP COR ADMo DEVo PSAo PSDo HISo IVAo IVDo OUR IND OTC"
Cache-Control
private,no-cache
Content-Type
image/gif
Content-Length
35
Expires
-1
/
cds.taboola.com/ Frame 0C2B 		0
155 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cds.taboola.com/?uid=1ae941ff-fb7a-481d-88fe-ad22973608bf-tuct72ff26a&_r=4900330
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.224.32 , United States, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Access-Control-Allow-Origin
*
Date
Wed, 24 Feb 2021 15:12:43 GMT
Cache-Control
no-store
Server
nginx
Connection
close
rtb-h
sync-t1.taboola.com/sg/bidswitch-network/1/ Frame 0C2B
Redirect Chain
  • https://x.bidswitch.net/sync?ssp=taboola&gdpr=0&gdpr_consent=
  • https://x.bidswitch.net/ul_cb/sync?ssp=taboola&gdpr=0&gdpr_consent=
  • https://prod.perf-serving.com/sync?ssp=bidswitch&bidswitch_ssp_id=taboola
  • https://prod.perf-serving.com/ul_cb/sync?ssp=bidswitch&bidswitch_ssp_id=taboola
  • https://x.bidswitch.net/sync?dsp_id=366&expires=14&user_id=76f07909-15e4-4b4e-b705-7f5d0ab049cc&ssp=taboola&user_group=1
  • https://sync-t1.taboola.com/sg/bidswitch-network/1/rtb-h?taboola_hm=c71ae52a-094f-40f2-b573-d7ac4e42ce7c
0
227 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync-t1.taboola.com/sg/bidswitch-network/1/rtb-h?taboola_hm=c71ae52a-094f-40f2-b573-d7ac4e42ce7c
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
141.226.228.48 , Netherlands, ASN200478 (TABOOLA-AS, IL),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

tbl-x-upstream
10.41.22.84:10213
date
Wed, 24 Feb 2021 15:12:43 GMT
server
nginx
x-fastly-to-nlb-rtt
17924

Redirect headers

location
//sync-t1.taboola.com/sg/bidswitch-network/1/rtb-h?taboola_hm=c71ae52a-094f-40f2-b573-d7ac4e42ce7c
date
Wed, 24 Feb 2021 15:12:43 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
0
ffd5d97951170f88daafcefbf250bafa.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ Frame B1A9 		21 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ffd5d97951170f88daafcefbf250bafa.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudinary /
Resource Hash
f822503fe76ea7f6eb5514db10ab960925e430d1f1126a64834f27aef163116a

Request headers

Referer
https://tempest.services.disqus.com/ads-iframe/taboola/?position=top&shortname=powershellmagazine&experiment=zetassp&variant=active&service=dynamic&anchorColor=%23222222&colorScheme=light&sourceUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&typeface=sans-serif&canonicalUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&disqus_version=4a68dd9
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Wed, 24 Feb 2021 15:12:43 GMT
via
1.1 varnish, 1.1 varnish, 1.1 varnish
age
3745620
edge-cache-tag
598416249666508201167743725582176060733,459052303457394366171479749282851127576,29ecf9b93bbf306179626feeda1fab70
expiration
expiry-date="Tue, 26 Jan 2021 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
HIT, HIT, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ffd5d97951170f88daafcefbf250bafa.png
content-length
21255
x-served-by
cache-dca17733-DCA, cache-dca17757-DCA, cache-fra19132-FRA
last-modified
Sat, 26 Dec 2020 11:51:00 GMT
server
cloudinary
x-timer
S1614179563.032728,VS0,VE0
etag
"24409dc72fa8cbadc7b5db56ee3383d7"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1, 1, 2
d149fdfd3ca8238eb2eaf9a63aa6af3a.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ Frame B1A9 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/d149fdfd3ca8238eb2eaf9a63aa6af3a.jpg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudinary /
Resource Hash
b97be70ded95cb53e9ca39d5e77ef3932e12df80e473c79d80eaf0ba08c9d9d5

Request headers

Referer
https://tempest.services.disqus.com/ads-iframe/taboola/?position=top&shortname=powershellmagazine&experiment=zetassp&variant=active&service=dynamic&anchorColor=%23222222&colorScheme=light&sourceUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&typeface=sans-serif&canonicalUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&disqus_version=4a68dd9
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Wed, 24 Feb 2021 15:12:43 GMT
via
1.1 varnish, 1.1 varnish, 1.1 varnish
age
1213068
edge-cache-tag
532990055932632983047813267003562044641,459052303457394366171479749282851127576,29ecf9b93bbf306179626feeda1fab70
expiration
expiry-date="Wed, 10 Mar 2021 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/d149fdfd3ca8238eb2eaf9a63aa6af3a.jpg
content-length
8054
x-served-by
cache-dca17742-DCA, cache-dca17737-DCA, cache-fra19132-FRA
last-modified
Sun, 07 Feb 2021 09:35:55 GMT
server
cloudinary
x-timer
S1614179563.069191,VS0,VE0
etag
"aea6b53c15ac9d020301decec5191d57"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1, 2
img_5fb29ac97ac849.13202511_26dZpnxC2etvUDQ5IjpAg9PkFaAJSC85A4yxxWWmVKtcySuPuT_ob-adp02-taboola-winning-image1.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//cdn.eam.pubocean.com/ Frame B1A9 		18 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//cdn.eam.pubocean.com/img_5fb29ac97ac849.13202511_26dZpnxC2etvUDQ5IjpAg9PkFaAJSC85A4yxxWWmVKtcySuPuT_ob-adp02-taboola-winning-image1.jpg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudinary /
Resource Hash
d2868186d53edf4f8483bd823fc6721267e043d342989cf297122d2883a17091

Request headers

Referer
https://tempest.services.disqus.com/ads-iframe/taboola/?position=top&shortname=powershellmagazine&experiment=zetassp&variant=active&service=dynamic&anchorColor=%23222222&colorScheme=light&sourceUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&typeface=sans-serif&canonicalUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&disqus_version=4a68dd9
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms
1
date
Wed, 24 Feb 2021 15:12:43 GMT
via
1.1 varnish, 1.1 varnish, 1.1 varnish
age
698569
edge-cache-tag
323942098999426061643707318020099242018,459052303457394366171479749282851127576,29ecf9b93bbf306179626feeda1fab70
expiration
expiry-date="Sun, 28 Feb 2021 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//cdn.eam.pubocean.com/img_5fb29ac97ac849.13202511_26dZpnxC2etvUDQ5IjpAg9PkFaAJSC85A4yxxWWmVKtcySuPuT_ob-adp02-taboola-winning-image1.jpg
content-length
18861
x-served-by
cache-dca17730-DCA, cache-dca17760-DCA, cache-fra19132-FRA
last-modified
Thu, 28 Jan 2021 22:11:33 GMT
server
cloudinary
x-timer
S1614179563.098518,VS0,VE1
etag
"0d8526fb68370da38d4083ab95b28e84"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1, 1
606910635__VqZNjsRU.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/GETTY_IMAGES/IBK/ Frame B1A9 		8 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/GETTY_IMAGES/IBK/606910635__VqZNjsRU.jpg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudinary /
Resource Hash
49e356da2a3af9b490195c074f311854162285e770c6b1a3cdbc74e863579d56

Request headers

Referer
https://tempest.services.disqus.com/ads-iframe/taboola/?position=top&shortname=powershellmagazine&experiment=zetassp&variant=active&service=dynamic&anchorColor=%23222222&colorScheme=light&sourceUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&typeface=sans-serif&canonicalUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&disqus_version=4a68dd9
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms
1
date
Wed, 24 Feb 2021 15:12:43 GMT
via
1.1 varnish, 1.1 varnish, 1.1 varnish
age
2010834
edge-cache-tag
593227507421149014215160316989775291877,459052303457394366171479749282851127576,29ecf9b93bbf306179626feeda1fab70
expiration
expiry-date="Fri, 26 Feb 2021 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/GETTY_IMAGES/IBK/606910635__VqZNjsRU.jpg
content-length
8240
x-served-by
cache-dca17763-DCA, cache-dca17729-DCA, cache-fra19132-FRA
last-modified
Tue, 26 Jan 2021 10:49:57 GMT
server
cloudinary
x-timer
S1614179563.101948,VS0,VE1
etag
"61fe3c07aa33a7d3413af2c3630e2806"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1, 1
1e82b6ce08a43a6c5447835aefdf3367.jpeg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ Frame B1A9 		16 KB
17 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/1e82b6ce08a43a6c5447835aefdf3367.jpeg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudinary /
Resource Hash
8708e346e1c19fb7d1c1bbed524f6e2990f04dfe1f3a8a13381fd76f8be07dc6

Request headers

Referer
https://tempest.services.disqus.com/ads-iframe/taboola/?position=top&shortname=powershellmagazine&experiment=zetassp&variant=active&service=dynamic&anchorColor=%23222222&colorScheme=light&sourceUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&typeface=sans-serif&canonicalUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&disqus_version=4a68dd9
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms
1
date
Wed, 24 Feb 2021 15:12:43 GMT
via
1.1 varnish, 1.1 varnish, 1.1 varnish
age
1294600
edge-cache-tag
399056264916934030843316684182527544172,459052303457394366171479749282851127576,29ecf9b93bbf306179626feeda1fab70
expiration
expiry-date="Mon, 08 Mar 2021 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/1e82b6ce08a43a6c5447835aefdf3367.jpeg
content-length
16665
x-served-by
cache-dca17722-DCA, cache-dca17782-DCA, cache-fra19132-FRA
last-modified
Fri, 05 Feb 2021 07:48:07 GMT
server
cloudinary
x-timer
S1614179563.130291,VS0,VE1
etag
"1a65841dd7b751ef0d07351d5b5b6401"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1, 1
bb571b6f5fb84c4fe412113aabea32d8.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ Frame B1A9 		17 KB
18 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/bb571b6f5fb84c4fe412113aabea32d8.png
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudinary /
Resource Hash
f3531336f49622a2a03f284a0b53074244790ea0573f410845505f951df50336

Request headers

Referer
https://tempest.services.disqus.com/ads-iframe/taboola/?position=top&shortname=powershellmagazine&experiment=zetassp&variant=active&service=dynamic&anchorColor=%23222222&colorScheme=light&sourceUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&typeface=sans-serif&canonicalUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&disqus_version=4a68dd9
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms
1
date
Wed, 24 Feb 2021 15:12:43 GMT
via
1.1 varnish, 1.1 varnish, 1.1 varnish
age
552953
edge-cache-tag
311250990980042902703296607562015715617,459052303457394366171479749282851127576,29ecf9b93bbf306179626feeda1fab70
expiration
expiry-date="Sat, 06 Mar 2021 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/bb571b6f5fb84c4fe412113aabea32d8.png
content-length
17774
x-served-by
cache-dca17765-DCA, cache-dca17771-DCA, cache-fra19132-FRA
last-modified
Wed, 03 Feb 2021 07:22:43 GMT
server
cloudinary
x-timer
S1614179563.135074,VS0,VE1
etag
"f221dd39f90b9a30f31753a0ade7f70c"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 1
d72e41c440dd1ef6fe80cb496256b5ec.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ Frame B1A9 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/d72e41c440dd1ef6fe80cb496256b5ec.jpg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudinary /
Resource Hash
c73fc67595ce16875a6bc039dff98522e48a1e97435355b62a9422f630634127

Request headers

Referer
https://tempest.services.disqus.com/ads-iframe/taboola/?position=top&shortname=powershellmagazine&experiment=zetassp&variant=active&service=dynamic&anchorColor=%23222222&colorScheme=light&sourceUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&typeface=sans-serif&canonicalUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&disqus_version=4a68dd9
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms
1
date
Wed, 24 Feb 2021 15:12:43 GMT
via
1.1 varnish, 1.1 varnish, 1.1 varnish
age
1147979
edge-cache-tag
550879868959710331600448269264199400759,459052303457394366171479749282851127576,29ecf9b93bbf306179626feeda1fab70
status
200 OK
x-cache
MISS, MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/d72e41c440dd1ef6fe80cb496256b5ec.jpg
content-length
7889
x-request-id
23d7d7d401909661f14604518b3147bb
x-served-by
cache-dca17774-DCA, cache-dca17727-DCA, cache-fra19132-FRA
last-modified
Wed, 10 Feb 2021 10:12:38 GMT
server
cloudinary
x-timer
S1614179563.137425,VS0,VE1
etag
"c281285208dbd0a6f4be12f3121a564d"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 1
event.gif
referrer.disqus.com/juggler/ 		43 B
295 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://referrer.disqus.com/juggler/event.gif?imp=3r60c6m33hpgvt&experiment=zetassp&variant=active&service=dynamic&area=top&product=embed&forum=powershellmagazine&zone=thread&version=4ce792797f4c10a96525509c741bcf5f&page_url=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&page_referrer=&object_type=advertisement&provider=taboola&event=activity&ad_product_name=iab_display&ad_product_layout=iab_display&bin=embed%3Apromoted_discovery%3Adynamic%3Azetassp%3Aactive&object_id=%5B184193%5D&section=default&verb=load&advertisement_id=184193&forum_id=953565
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.112.134 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Date
Wed, 24 Feb 2021 15:12:42 GMT
X-Content-Type-Options
nosniff
Last-Modified
Mon, 28 Sep 1970 06:00:00 GMT
Server
nginx
Content-Type
image/gif
Connection
keep-alive
Content-Length
43
X-XSS-Protection
1; mode=block
f539211219b796ffbb49949997c764f0.png
cdn.taboola.com/libtrc/static/thumbnails/ Frame B1A9 		254 B
634 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cdn.taboola.com/libtrc/static/thumbnails/f539211219b796ffbb49949997c764f0.png
Requested by
Host: tempest.services.disqus.com
URL: https://tempest.services.disqus.com/ads-iframe/taboola/?position=top&shortname=powershellmagazine&experiment=zetassp&variant=active&service=dynamic&anchorColor=%23222222&colorScheme=light&sourceUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&typeface=sans-serif&canonicalUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&disqus_version=4a68dd9
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.232.137.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
f68019eb4b4e5933301d4ee75969e0cb94ed8333bf514630fa749eb9c3e483c9

Request headers

Referer
https://tempest.services.disqus.com/ads-iframe/taboola/?position=top&shortname=powershellmagazine&experiment=zetassp&variant=active&service=dynamic&anchorColor=%23222222&colorScheme=light&sourceUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&typeface=sans-serif&canonicalUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&disqus_version=4a68dd9
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-amz-version-id
hL.cyLD7Q4TL5ceY.7JQwF9m5IYI8mkC
via
1.1 varnish
etag
"dfa7b52c86e56bd67fa4002f6ed19854"
age
27511
x-cache
HIT
x-amz-replication-status
COMPLETED
content-length
254
x-amz-id-2
grODyaFUyHwi27S6u2hd746yPHwUf+y1im5Wn93DxT7wozhn8KMFUP712WAAG3eD1t2rnF4k3Bs=
x-served-by
cache-hhn11573-HHN
last-modified
Wed, 24 Jun 2015 07:14:11 GMT
server
AmazonS3
x-amz-meta-s3cmd-attrs
uid:0/gname:root/uname:root/gid:0/mode:33188/mtime:1377415166/atime:1435052450/md5:dfa7b52c86e56bd67fa4002f6ed19854/ctime:1422381567
x-timer
S1614179563.763580,VS0,VE0
date
Wed, 24 Feb 2021 15:12:42 GMT
x-amz-request-id
29D722C296265892
cache-control
private,max-age=31536000
accept-ranges
bytes
content-type
image/png
abp
34
x-cache-hits
47594
UnitWidgetItemDesktop.min.js
vidstat.taboola.com/lite-unit/1.4.0/ Frame B1A9 		79 KB
24 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://vidstat.taboola.com/lite-unit/1.4.0/UnitWidgetItemDesktop.min.js
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20210223-26-RELEASE.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e92552bc193c8bae835c7b6db6eea8a39593fa14fb75a227f738c415330cc84e

Request headers

Referer
https://tempest.services.disqus.com/ads-iframe/taboola/?position=top&shortname=powershellmagazine&experiment=zetassp&variant=active&service=dynamic&anchorColor=%23222222&colorScheme=light&sourceUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&typeface=sans-serif&canonicalUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&disqus_version=4a68dd9
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

date
Wed, 24 Feb 2021 15:12:43 GMT
via
1.1 0c23bed0dc9f1c700b571cf55c540239.cloudfront.net (CloudFront), 1.1 varnish
age
719594
x-cache
Miss from cloudfront, HIT
content-encoding
gzip
content-length
23743
x-served-by
cache-fra19132-FRA
last-modified
Tue, 31 Mar 2020 13:14:35 GMT
server
AmazonS3
x-timer
S1614179563.163518,VS0,VE0
etag
"b683c290896a82c974838a04b4ea4aff"
vary
Accept-Encoding
access-control-allow-methods
GET, OPTIONS, HEAD
content-type
application/javascript
access-control-allow-origin
*
cache-control
public, max-age=2592000
x-amz-cf-pop
FRA53
accept-ranges
bytes
access-control-allow-headers
*
x-amz-cf-id
jfOjd2QN6EO6i28E9ovSU6HQhL2i_i2aF42T9-dGesCSYuPlIbIKpA==
x-cache-hits
8567
ping
links.services.disqus.com/api/ 		299 B
933 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://links.services.disqus.com/api/ping
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/alfie_v4.63f1ab6d6b9d5807dc0c94ef3fe0b851.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.112.64 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
b0a2e02cc88cccc73bf83bd733adc29b9e3ad01d9e3ed5c5c1ea1dc11501278d

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Wed, 24 Feb 2021 15:12:43 GMT
Server
Apache-Coyote/1.1
P3P
CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin
https://www.powershellmagazine.com
Cache-Control
no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript;charset=UTF-8
Content-Length
299
Expires
Thu, 01 Jan 1970 00:00:00 GMT
ffd5d97951170f88daafcefbf250bafa.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ Frame B1A9 		21 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ffd5d97951170f88daafcefbf250bafa.png
Requested by
Host: tempest.services.disqus.com
URL: https://tempest.services.disqus.com/ads-iframe/taboola/?position=top&shortname=powershellmagazine&experiment=zetassp&variant=active&service=dynamic&anchorColor=%23222222&colorScheme=light&sourceUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&typeface=sans-serif&canonicalUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&disqus_version=4a68dd9
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudinary /
Resource Hash
f822503fe76ea7f6eb5514db10ab960925e430d1f1126a64834f27aef163116a

Request headers

Referer
https://tempest.services.disqus.com/ads-iframe/taboola/?position=top&shortname=powershellmagazine&experiment=zetassp&variant=active&service=dynamic&anchorColor=%23222222&colorScheme=light&sourceUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&typeface=sans-serif&canonicalUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&disqus_version=4a68dd9
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Wed, 24 Feb 2021 15:12:43 GMT
via
1.1 varnish, 1.1 varnish, 1.1 varnish
age
3745620
edge-cache-tag
598416249666508201167743725582176060733,459052303457394366171479749282851127576,29ecf9b93bbf306179626feeda1fab70
expiration
expiry-date="Tue, 26 Jan 2021 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
HIT, HIT, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ffd5d97951170f88daafcefbf250bafa.png
content-length
21255
x-served-by
cache-dca17733-DCA, cache-dca17757-DCA, cache-fra19132-FRA
last-modified
Sat, 26 Dec 2020 11:51:00 GMT
server
cloudinary
x-timer
S1614179563.164993,VS0,VE0
etag
"24409dc72fa8cbadc7b5db56ee3383d7"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
1, 1, 3
d149fdfd3ca8238eb2eaf9a63aa6af3a.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ Frame B1A9 		8 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/d149fdfd3ca8238eb2eaf9a63aa6af3a.jpg
Requested by
Host: tempest.services.disqus.com
URL: https://tempest.services.disqus.com/ads-iframe/taboola/?position=top&shortname=powershellmagazine&experiment=zetassp&variant=active&service=dynamic&anchorColor=%23222222&colorScheme=light&sourceUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&typeface=sans-serif&canonicalUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&disqus_version=4a68dd9
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudinary /
Resource Hash
b97be70ded95cb53e9ca39d5e77ef3932e12df80e473c79d80eaf0ba08c9d9d5

Request headers

Referer
https://tempest.services.disqus.com/ads-iframe/taboola/?position=top&shortname=powershellmagazine&experiment=zetassp&variant=active&service=dynamic&anchorColor=%23222222&colorScheme=light&sourceUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&typeface=sans-serif&canonicalUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&disqus_version=4a68dd9
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Wed, 24 Feb 2021 15:12:43 GMT
via
1.1 varnish, 1.1 varnish, 1.1 varnish
age
1213068
edge-cache-tag
532990055932632983047813267003562044641,459052303457394366171479749282851127576,29ecf9b93bbf306179626feeda1fab70
expiration
expiry-date="Wed, 10 Mar 2021 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/d149fdfd3ca8238eb2eaf9a63aa6af3a.jpg
content-length
8054
x-served-by
cache-dca17742-DCA, cache-dca17737-DCA, cache-fra19132-FRA
last-modified
Sun, 07 Feb 2021 09:35:55 GMT
server
cloudinary
x-timer
S1614179563.170141,VS0,VE0
etag
"aea6b53c15ac9d020301decec5191d57"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1, 3
sync.gif
links.services.disqus.com/api/ 		43 B
565 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://links.services.disqus.com/api/sync.gif?key=cfdfcf52dffd0a702a61bad27507376d
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.112.64 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

Pragma
no-cache
Date
Wed, 24 Feb 2021 15:12:43 GMT
Server
Apache-Coyote/1.1
P3P
CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Cache-Control
no-cache, no-store
Connection
keep-alive
Content-Type
image/gif;charset=UTF-8
Content-Length
43
Expires
Thu, 01 Jan 1970 00:00:00 GMT
domains
links.services.disqus.com/api/ 		101 B
735 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://links.services.disqus.com/api/domains
Requested by
Host: c.disquscdn.com
URL: https://c.disquscdn.com/next/embed/alfie_v4.63f1ab6d6b9d5807dc0c94ef3fe0b851.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
151.101.112.64 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
Apache-Coyote/1.1 /
Resource Hash
29e37b6f7af3a56230137abd6f5d4bec9e765c2372f678ec157a7a6be4033f53

Request headers

Referer
https://www.powershellmagazine.com/2014/07/16/investigating-powershell-attacks/
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

Pragma
no-cache
Date
Wed, 24 Feb 2021 15:12:43 GMT
Server
Apache-Coyote/1.1
P3P
CP="ALL IND DSP COR CUR ADM TAIo PSDo OUR COM INT NAV PUR STA UNI"
Access-Control-Allow-Origin
https://www.powershellmagazine.com
Cache-Control
no-cache, no-store
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
text/javascript;charset=UTF-8
Content-Length
101
Expires
Thu, 01 Jan 1970 00:00:00 GMT
img_5fb29ac97ac849.13202511_26dZpnxC2etvUDQ5IjpAg9PkFaAJSC85A4yxxWWmVKtcySuPuT_ob-adp02-taboola-winning-image1.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//cdn.eam.pubocean.com/ Frame B1A9 		18 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//cdn.eam.pubocean.com/img_5fb29ac97ac849.13202511_26dZpnxC2etvUDQ5IjpAg9PkFaAJSC85A4yxxWWmVKtcySuPuT_ob-adp02-taboola-winning-image1.jpg
Requested by
Host: tempest.services.disqus.com
URL: https://tempest.services.disqus.com/ads-iframe/taboola/?position=top&shortname=powershellmagazine&experiment=zetassp&variant=active&service=dynamic&anchorColor=%23222222&colorScheme=light&sourceUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&typeface=sans-serif&canonicalUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&disqus_version=4a68dd9
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudinary /
Resource Hash
d2868186d53edf4f8483bd823fc6721267e043d342989cf297122d2883a17091

Request headers

Referer
https://tempest.services.disqus.com/ads-iframe/taboola/?position=top&shortname=powershellmagazine&experiment=zetassp&variant=active&service=dynamic&anchorColor=%23222222&colorScheme=light&sourceUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&typeface=sans-serif&canonicalUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&disqus_version=4a68dd9
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Wed, 24 Feb 2021 15:12:43 GMT
via
1.1 varnish, 1.1 varnish, 1.1 varnish
age
698569
edge-cache-tag
323942098999426061643707318020099242018,459052303457394366171479749282851127576,29ecf9b93bbf306179626feeda1fab70
expiration
expiry-date="Sun, 28 Feb 2021 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/https%3A//cdn.eam.pubocean.com/img_5fb29ac97ac849.13202511_26dZpnxC2etvUDQ5IjpAg9PkFaAJSC85A4yxxWWmVKtcySuPuT_ob-adp02-taboola-winning-image1.jpg
content-length
18861
x-served-by
cache-dca17730-DCA, cache-dca17760-DCA, cache-fra19132-FRA
last-modified
Thu, 28 Jan 2021 22:11:33 GMT
server
cloudinary
x-timer
S1614179563.233046,VS0,VE0
etag
"0d8526fb68370da38d4083ab95b28e84"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1, 2
606910635__VqZNjsRU.jpg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/GETTY_IMAGES/IBK/ Frame B1A9 		8 KB
9 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/GETTY_IMAGES/IBK/606910635__VqZNjsRU.jpg
Requested by
Host: tempest.services.disqus.com
URL: https://tempest.services.disqus.com/ads-iframe/taboola/?position=top&shortname=powershellmagazine&experiment=zetassp&variant=active&service=dynamic&anchorColor=%23222222&colorScheme=light&sourceUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&typeface=sans-serif&canonicalUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&disqus_version=4a68dd9
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudinary /
Resource Hash
49e356da2a3af9b490195c074f311854162285e770c6b1a3cdbc74e863579d56

Request headers

Referer
https://tempest.services.disqus.com/ads-iframe/taboola/?position=top&shortname=powershellmagazine&experiment=zetassp&variant=active&service=dynamic&anchorColor=%23222222&colorScheme=light&sourceUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&typeface=sans-serif&canonicalUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&disqus_version=4a68dd9
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Wed, 24 Feb 2021 15:12:43 GMT
via
1.1 varnish, 1.1 varnish, 1.1 varnish
age
2010834
edge-cache-tag
593227507421149014215160316989775291877,459052303457394366171479749282851127576,29ecf9b93bbf306179626feeda1fab70
expiration
expiry-date="Fri, 26 Feb 2021 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/GETTY_IMAGES/IBK/606910635__VqZNjsRU.jpg
content-length
8240
x-served-by
cache-dca17763-DCA, cache-dca17729-DCA, cache-fra19132-FRA
last-modified
Tue, 26 Jan 2021 10:49:57 GMT
server
cloudinary
x-timer
S1614179563.233010,VS0,VE0
etag
"61fe3c07aa33a7d3413af2c3630e2806"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1, 2
1e82b6ce08a43a6c5447835aefdf3367.jpeg
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ Frame B1A9 		16 KB
17 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/1e82b6ce08a43a6c5447835aefdf3367.jpeg
Requested by
Host: tempest.services.disqus.com
URL: https://tempest.services.disqus.com/ads-iframe/taboola/?position=top&shortname=powershellmagazine&experiment=zetassp&variant=active&service=dynamic&anchorColor=%23222222&colorScheme=light&sourceUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&typeface=sans-serif&canonicalUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&disqus_version=4a68dd9
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudinary /
Resource Hash
8708e346e1c19fb7d1c1bbed524f6e2990f04dfe1f3a8a13381fd76f8be07dc6

Request headers

Referer
https://tempest.services.disqus.com/ads-iframe/taboola/?position=top&shortname=powershellmagazine&experiment=zetassp&variant=active&service=dynamic&anchorColor=%23222222&colorScheme=light&sourceUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&typeface=sans-serif&canonicalUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&disqus_version=4a68dd9
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Wed, 24 Feb 2021 15:12:43 GMT
via
1.1 varnish, 1.1 varnish, 1.1 varnish
age
1294600
edge-cache-tag
399056264916934030843316684182527544172,459052303457394366171479749282851127576,29ecf9b93bbf306179626feeda1fab70
expiration
expiry-date="Mon, 08 Mar 2021 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, HIT, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/1e82b6ce08a43a6c5447835aefdf3367.jpeg
content-length
16665
x-served-by
cache-dca17722-DCA, cache-dca17782-DCA, cache-fra19132-FRA
last-modified
Fri, 05 Feb 2021 07:48:07 GMT
server
cloudinary
x-timer
S1614179563.232974,VS0,VE0
etag
"1a65841dd7b751ef0d07351d5b5b6401"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 1, 2
bb571b6f5fb84c4fe412113aabea32d8.png
images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/ Frame B1A9 		17 KB
18 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://images.taboola.com/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/bb571b6f5fb84c4fe412113aabea32d8.png
Requested by
Host: tempest.services.disqus.com
URL: https://tempest.services.disqus.com/ads-iframe/taboola/?position=top&shortname=powershellmagazine&experiment=zetassp&variant=active&service=dynamic&anchorColor=%23222222&colorScheme=light&sourceUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&typeface=sans-serif&canonicalUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&disqus_version=4a68dd9
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.13.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
cloudinary /
Resource Hash
f3531336f49622a2a03f284a0b53074244790ea0573f410845505f951df50336

Request headers

Referer
https://tempest.services.disqus.com/ads-iframe/taboola/?position=top&shortname=powershellmagazine&experiment=zetassp&variant=active&service=dynamic&anchorColor=%23222222&colorScheme=light&sourceUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&typeface=sans-serif&canonicalUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&disqus_version=4a68dd9
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36

Response headers

x-vcl-time-ms
0
date
Wed, 24 Feb 2021 15:12:43 GMT
via
1.1 varnish, 1.1 varnish, 1.1 varnish
age
552953
edge-cache-tag
311250990980042902703296607562015715617,459052303457394366171479749282851127576,29ecf9b93bbf306179626feeda1fab70
expiration
expiry-date="Sat, 06 Mar 2021 00:00:00 GMT", rule-id="delete fetch for taboola after 30 days"
x-cache
MISS, MISS, HIT
x-debug
/taboola/image/fetch/f_jpg%2Cq_auto%2Ch_234%2Cw_280%2Cc_fill%2Cg_faces:auto%2Ce_sharpen/http%3A//cdn.taboola.com/libtrc/static/thumbnails/bb571b6f5fb84c4fe412113aabea32d8.png
content-length
17774
x-served-by
cache-dca17765-DCA, cache-dca17771-DCA, cache-fra19132-FRA
last-modified
Wed, 03 Feb 2021 07:22:43 GMT
server
cloudinary
x-timer
S1614179563.232937,VS0,VE0
etag
"f221dd39f90b9a30f31753a0ade7f70c"
content-type
image/jpeg
access-control-allow-origin
*
cache-control
public, max-age=31536000
accept-ranges
bytes
timing-allow-origin
*
access-control-allow-headers
X-Requested-With
x-cache-hits
0, 0, 2
bulk
trc.taboola.com/disqus-widget-safetylevel20longtail09/log/3/ Frame B1A9 		0
397 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://trc.taboola.com/disqus-widget-safetylevel20longtail09/log/3/bulk?route=IL%3AIL%3AV&lti=deflated&bulkSize=1
Requested by
Host: cdn.taboola.com
URL: https://cdn.taboola.com/libtrc/impl.20210223-26-RELEASE.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
199.232.137.44 Frankfurt am Main, Germany, ASN54113 (FASTLY, US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://tempest.services.disqus.com/ads-iframe/taboola/?position=top&shortname=powershellmagazine&experiment=zetassp&variant=active&service=dynamic&anchorColor=%23222222&colorScheme=light&sourceUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&typeface=sans-serif&canonicalUrl=https%3A%2F%2Fwww.powershellmagazine.com%2F2014%2F07%2F16%2Finvestigating-powershell-attacks%2F&disqus_version=4a68dd9
User-Agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

x-vcl-time-ms
323
pragma
no-cache
date
Wed, 24 Feb 2021 15:12:44 GMT
via
1.1 varnish
server
nginx
x-timer
S1614179564.732151,VS0,VE323
x-served-by
cache-hhn11573-HHN
x-cache
MISS
p3p
policyref="http://trc.taboola.com/p3p.xml", CP="NOI DSP COR LAW NID CURa ADMa DEVa PSAa PSDa OUR BUS IND UNI COM NAV INT DEM"
access-control-allow-origin
https://tempest.services.disqus.com
cache-control
no-cache
access-control-allow-credentials
true
accept-ranges
bytes
content-type
image/gif
x-cache-hits
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
id5-sync.com
URL
https://id5-sync.com/c/464/19/0/8.gif?puid=783ffced1486ce4c657f294e15fb23dc&gdpr=0&gdpr_consent=

Verdicts & Comments Add Verdict or Comment

91 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| ontransitionrun object| ontransitionstart object| ontransitioncancel object| cookieStore function| showDirectoryPicker function| showOpenFilePicker function| showSaveFilePicker object| trustedTypes boolean| crossOriginIsolated object| _wpemojiSettings object| gapi object| ___jsl function| wdgpo_plusone_click undefined| $ function| jQuery object| CrayonSyntaxSettings object| CrayonSyntaxStrings function| jQueryCrayon object| CrayonUtil object| jqueryPopup function| popupWindow function| popdownWindow object| CrayonSyntax object| click_object object| wpp_params object| WordPressPopularPosts boolean| do_request undefined| num object| WPPImageObserver function| wpp_load_img function| wpp_observe_imgs object| wpcf7 object| PT_CV_PUBLIC object| PT_CV_PAGINATION object| jQuery11240010540316170297936 object| countVars object| gadgets object| osapi object| iframer object| __gapi_jstiming__ object| shindig function| ToolbarApi object| iframes function| IframeBase function| Iframe function| IframeProxy function| IframeWindow string| disqus_shortname object| embedVars string| disqus_url string| disqus_identifier string| disqus_container_id string| disqus_title undefined| disqus_config_custom function| disqus_config object| ratingsL10n object| ratings_mouseover_image number| post_id number| post_rating boolean| is_being_rated function| current_rating function| ratings_off function| set_is_being_rated function| rate_post_success function| rate_post object| JQLBSettings object| DISQUSWIDGETS undefined| disqus_domain object| html5 object| Modernizr function| yepnope object| DISQUS object| addComment object| wp string| currentURL string| currentDir object| GET object| twemoji object| oauth2 boolean| __v5k function| vl_cB function| vl_disable function| vglnk_16141795625086 object| vglnk undefined| vglnk_16141795630107 undefined| vglnk_16141795631449

1 Cookies

Domain/Path Name / Value
.google.com/ Name: NID
Value: 210=aYOPotfy01ywRLDsf4h_2BIXs6oCU0VqUHkQr98RfezUhrpX5wNh7ZuBNr7KbJMJRyoz7TuHC4rGVwDnWP8rsyXeCk5OBQijHoWko1xXoXGL39v0qfLLzP3WutnQ169AtANQArEusmYsYr1s9GeQiQveWR-O6p26EmfiGAForVI

1 Console Messages

Source Level URL
Text
console-api log URL: https://www.powershellmagazine.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=1.4.1(Line 2)
Message:
JQMIGRATE: Migrate is installed, version 1.4.1

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

15.taboola.com
a.disquscdn.com
accounts.google.com
apis.google.com
bh.contextweb.com
bttrack.com
c.disquscdn.com
cdn.taboola.com
cdn.viglink.com
cds.taboola.com
ce.lijit.com
cm.g.doubleclick.net
dis.criteo.com
disqus.com
dsp.adkernel.com
e1.emxdgt.com
fonts.googleapis.com
fonts.gstatic.com
ib.adnxs.com
id5-sync.com
images.taboola.com
links.services.disqus.com
match.adsrvr.org
match.taboola.com
pixel.rubiconproject.com
powershellmagazine.disqus.com
prod.perf-serving.com
referrer.disqus.com
rtb-csync.smartadserver.com
rtb.mfadsrvr.com
s.c.appier.net
sb.scorecardresearch.com
secure.gravatar.com
simage2.pubmatic.com
ssl.gstatic.com
sync-t1.taboola.com
sync.taboola.com
tempest.services.disqus.com
trc.taboola.com
vidstat.taboola.com
www.google.com
www.powershellmagazine.com
x.bidswitch.net
id5-sync.com
104.131.21.239
139.162.84.221
141.226.224.32
141.226.228.48
142.250.185.194
151.101.112.134
151.101.112.64
151.101.13.44
151.101.192.134
174.137.133.49
178.250.2.151
18.185.46.229
18.192.249.156
18.195.155.181
184.25.115.49
185.64.190.80
185.86.138.114
192.132.33.46
198.148.27.140
199.232.137.44
199.232.198.49
216.52.2.48
2606:4700::6810:a10d
2606:4700::6812:a813
2a00:1450:4001:809::2003
2a00:1450:4001:809::200d
2a00:1450:4001:80e::200e
2a00:1450:4001:810::2003
2a00:1450:4001:813::2004
2a00:1450:4001:829::200a
2a00:1450:4001:82a::2002
2a00:1450:4001:82b::200e
2a04:fa87:fffe::c000:4902
34.252.253.152
37.252.173.38
52.29.191.126
69.173.144.138
013c268f90834ac7c8572fcb727d2280f2769b8fbf9ffe0fded9d10211b3ea66
038da771333be65b96b45697467edd0b625288ac61f6774beed3a921f1f26579
06840247318064a9638f17347f17e461b7c1984e809a7d41dc8cb71815750fef
0b8a20373c6dd04e091902226d922b3688143a8938afb9d283d889de7b55ceb5
16e509e1da5e24910ac51ce9690f149c0fe6ad2818af9c447d12e59f474e4f36
187d198e60bed479c2c37f665666a66d37ca4084ff230ed320eca55fb4a66331
190402f488a1616b47304ae066078580059ca6a5958b7f217d2156d0a73931a9
191e2a2deb0b16b4e6c833685b15ab930c8eaeec228391f6b26bc1fcda208c7b
193fbb968733b8a7049da19274546e6b80b76e9a8f1b837fee9a5fdeb8f97c7b
1a1b98c167ebd132ba72d97aa4de957459bd790759642eccd25910e83cb03ff6
1cfd32e37f8aba263101f06e8f702adfaef55a6601857cf5e2c6dd0b0388dcd6
1db21d816296e6939ba1f42962496e4134ae2b0081e26970864c40c6d02bb1df
1dbe94f24870455b60be49be9b72675f862260aa374086a786e893f59cb080b0
2152557cac69e2bd7d6debef5037a9f554f9209cc305b8141b3329acb10c42b7
26702bf4864c2f1c536cacdf1701e5e7d35b60398ef3c951749c0568727f89ec
274c5c962cd8ec53ac23d6d07978901972efd7b33e2eb0d1a7222c61fb7f907d
29e37b6f7af3a56230137abd6f5d4bec9e765c2372f678ec157a7a6be4033f53
29f0ecaeca4bedd85012e269d18dc637feb1472d91f3a45fa8057c2ecbe88c43
2a569e43b24389b9697a803de3103eaf72c8ccc2211a03a150d8534b17ef472f
2f64b025cec8c93dcb01fe88f0e79c134bc0a6c751787360153865dfa9f3a962
31cb76c05cbf5d71466f93078e8ba0f6e39cd92d0acc86d385b8cf2899963695
3270642c89180c12db93775e2a774b6dadd9bd98cffc963075c85afd2c17b6e4
3487ef2baf0c08ba660a8a143cdeb8ebeec961eea04bccd7c49096b4eb26b875
36ef66124133ca33c8b44c487293c3180e5ab681ff3cad3c728ea4f894ec3444
38008f61ad1135a39c008f1189829844bf110e0ffe2d0b5f3590e0002c42c6ac
38a622d903f3d196af226cd9f4081afc5e717465d8afc40f39b6a8319be4c786
3d3497226b92d0c8d702cffd4144da8ebcc3c2e2881d4a93da258d74b39d9e28
403961e8565d30e2af2a56d4eca31a9cc5b10b3146803f26acf015d3e9d55d88
481bfa4292798eb15d056ff461dc1e90bbe9795fd99299b59c02970a0e710207
48eb8b500ae6a38617b5738d2b3faec481922a7782246e31d2755c034a45cd5d
49e356da2a3af9b490195c074f311854162285e770c6b1a3cdbc74e863579d56
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4bd938863d8e473540c7300aec8fd156822f4701cee5fb6b3328a2cc9b0a012b
4c4491dcfa94cb46fb73742fc2caf49a1cd59027304af1830c7dc6ce1889857c
4ed10d0d64bb1515397e8666a63f484d640dbc5678fa62574e077b7aef1c3af2
54c64f3c66372027154f01fc9f24b4e25fdfe405b70d1994c79abbc2576ff775
564d6c2ad1166839591902d6b1704d0b6ad967e3573fe26b40a580525b07e195
595116ae3e2ced5443bb6cfeea94e070bb9e79431ca4d90df39801343ae2c2e1
59bcba7dbecdaf5d6650b054124c62ab0dce534f9ea9aa8c91260fe7f6f346ca
5bd9ca2f57b6c388332dd095d8c9be87dc71c2e1b78b843515ae758fe05a1223
614c628979413c313447557e9d90e9082ca8b9175d5c4a464bd6a9e6bc3a4aa7
65fe4198a3e1b9295b94b3302c278749832f10cd8edd51b9363357f5c9d6cbe9
68672538b7b4613bc0f6fae79641b8eb2d703a0385440589756a8b16a794ff0e
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6b43cfe89da4396cc379f50e586bc1cee619a1d1d8719e591cab9f6e8b3a4ea4
6ebd7e553005f8b532c1d3f0c938fee31b9b8448b9f1185958e36220ba7adf41
71348f4f38512af6e6ba8062fe5545a783f91d1a07bcb300c246f1bad9b0d4b6
7c5720f29c433fbec0cb102b18803d7779a3de7bf2ee82024ad0787b68361ffc
7dd1fc4596ba859bcb3d431ac9600798ec05539c3b90b01bd3a024711e2882ea
7e3559d6ffac7fc54d6edaa79b6e7330fab33fbdffc174a27c58b25e5b3952d2
841d1d2c94538a16f4a28e593a3c50da9d339c29576d665ac30c89a205226c19
8708e346e1c19fb7d1c1bbed524f6e2990f04dfe1f3a8a13381fd76f8be07dc6
89fe0ee6020314794fc2cfeacf3d10c31050cfe56f8ebddf1ed0a33fbe941fa7
8b33aee61f68c84d226b17df8c20b7007e14a521364339e684aacd1a54b79b55
901f2fe5c05bd0e15884682c8b6c7f81e7d2d016e8dbec5e902e6c37d71decb5
9631deda28528b08e902706f1e501c7b27001ae28adff842a3f60fa924d9e9c8
9dc3c82eda2956beda8e66549c710ccb234cf4589546277b5b5a218474007669
9efb3d5e1b082a66bd94908b42afb4cf6fe0e8eb8f50b8d2a18f6a5da03e6a18
a256529bd5b1b8846f8d2536ce7581fb6cea4479992f222d01535903dff48d79
a4b3b91b775b356ac4b5c34ac94dbcc1212ef23b5e89bfa9bfcc92e285a4447a
a8a91fef73b540d42b6b25f9e4d3446c4df9737fd3b8c41e73b2268683808cf2
a9a914f6357829974ce2ace17203a622d05b1f601d3fb6a44f835a65c4196f69
b0a2e02cc88cccc73bf83bd733adc29b9e3ad01d9e3ed5c5c1ea1dc11501278d
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b26b3d5904c7506bd94d42fcdc5b0963ecc0061d1cf7397b1afbcde50255897e
b484e8986a3a987e1d19988254ba48ad51b9adba23a2baff157b93fab401b7e7
b57eca495e606d6a5b71d039f54b48f95b24ecfab0e885f0834df9647988211f
b7e17926b30342edecee8b3a93029ac51462e2b479277d8e077ba57173eb1900
b8e149178358873942c6a434f9ae62dd952769a87c2abdf7e659c129acd398fd
b8e23a845bc6b7fd417d29182e0e38d353e64b5e12e06bb1de2b5ce063db1dcc
b97be70ded95cb53e9ca39d5e77ef3932e12df80e473c79d80eaf0ba08c9d9d5
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bdbceee15b322c6329c9707188c3e319237d5d2355b7be372861823ebdd76623
bec95673771eb5ec18b44719e5fab2dfd77bebb73e1d19a5c3fa38fb92a867e4
c0cbaf1a190df161bccd279676a5bf57067addcb1746a219cc19854a21cc863f
c42425f18923921089911e70f39c6dd462794df2e42ac0596abc3884da6471fc
c533b791a8eef65604f15d20433506e1614c693eeba9df749e8a7677e43b466c
c56b566e17c62870ce139b3a57bfb94a9d785792bd6ac2220d52426b8590d87f
c73fc67595ce16875a6bc039dff98522e48a1e97435355b62a9422f630634127
c8cb742dbb60decab090cf738bfef2d8a780141573e9a2a3854bf3f78919faed
cbbeab87cce309e0cc83efaa27ee8d6d36645ee7b10e2cbdaf260ae34e2e561e
cdba739c28b41f39ce438f2bf204fe739dc81a26cf559a9394ceed56a0666bee
cea0a05c5af6e21a409875328ed2e3dba79131b7c41f8ea07d0e0e02c7b7b59e
cf25ec18f223f4c51ce1128a42e644cdc2244d88f89d1a51440d9dbe51f4efe8
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d0409a1b73dab4e29dc40f92fb431fa9133baa23b4a1ffae4897f39068110e32
d2868186d53edf4f8483bd823fc6721267e043d342989cf297122d2883a17091
d54294a6014df645a307b1ddcc2647e902b58333bc92a30d65ea1786d77457d2
d8cd52fe71bf1d9add0e6012a1fcc6fa9d6da13bf24914c26a6a1675e4157b08
dbef5e5530003b7233e944856c23d1437902a2d3568cdfd2beaf2166e9ca9139
dc157f8c944e01aa2eb14721d5f55363142aec600845fff6e1bb6c5f0574c277
df32368ab844b0f5b9851a27d01f814c72b6d59338e7e1a5118b9410b4b76f34
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e3d961493e244e06bf91a9857442891e2e2ad8d49cf8e0a7781c53f0707443d7
e92552bc193c8bae835c7b6db6eea8a39593fa14fb75a227f738c415330cc84e
ed14dd3ac72169c520ea7bf06a500cf5d0e8ca08746dedc69bfd2ec995aa0000
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f055e217bde76d711bd8b42af773f9f99b8a29d81ad9ed10b6379cc7e6c60452
f26d98c3973c7df12d78bbb4164589b59dc42d4797b58471b358364c1005b2d3
f2a341fc815d45c21da726d4c843c2c5d3e1f333465347c3c75d040d556df4e5
f3531336f49622a2a03f284a0b53074244790ea0573f410845505f951df50336
f68019eb4b4e5933301d4ee75969e0cb94ed8333bf514630fa749eb9c3e483c9
f774ddac3ffce309e5ff2659a59e8e7291da314d213f24c1aa04b9ea2bc46586
f822503fe76ea7f6eb5514db10ab960925e430d1f1126a64834f27aef163116a
fba0ded09d93aabe89ce5ff54f850953cd55090e670a83ed1b809dc7b60caf5c
fed106be3a8f4c9ba6465f809fccc7e1984735b50e81786fbd0de8d3c0ed04bd