hunt.io Open in urlscan Pro
52.223.52.2 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity
Submission: On December 11 via api (December 11th 2024, 8:57:32 am UTC) from IN — Scanned from DE

Summary HTTP 69 Redirects Links 7 Behaviour Indicators

Summary

This website contacted 9 IPs in 2 countries across 7 domains to perform 69 HTTP transactions. The main IP is 52.223.52.2, located in United States and belongs to AMAZON-02, US. The main domain is hunt.io.
TLS certificate: Issued by WR1 on December 1st 2024. Valid for: 3 months.

This is the only time hunt.io was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	52.223.52.2 52.223.52.2	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:80f::2008	15169 (GOOGLE) (GOOGLE)
34	2600:9000:249... 2600:9000:2490:3c00:d:ada1:a280:93a1	16509 (AMAZON-02) (AMAZON-02)
2	13.32.99.2 13.32.99.2	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:223... 2600:9000:223e:3000:d:6b42:4ec0:93a1	16509 (AMAZON-02) (AMAZON-02)
26	108.138.7.90 108.138.7.90	16509 (AMAZON-02) (AMAZON-02)
3	54.231.192.10 54.231.192.10	16509 (AMAZON-02) (AMAZON-02)
1	2001:4860:480... 2001:4860:4802:32::36	15169 (GOOGLE) (GOOGLE)
2 2	2600:9000:276... 2600:9000:2761:2400:10:9b9d:b9c0:93a1	16509 (AMAZON-02) (AMAZON-02)
69	9

1 52.223.52.2 (United States)

ASN16509 (AMAZON-02, US)
PTR: a0b1d980e1f2226c6.awsglobalaccelerator.com

hunt.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80f::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

34 2600:9000:2490:3c00:d:ada1:a280:93a1 (United States)

ASN16509 (AMAZON-02, US)

framerusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.32.99.2 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-2.fra60.r.cloudfront.net

events.framer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:223e:3000:d:6b42:4ec0:93a1 (United States)

ASN16509 (AMAZON-02, US)

app.framerstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

26 108.138.7.90 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-108-138-7-90.fra56.r.cloudfront.net

framerusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 54.231.192.10 (Ashburn, United States)

ASN16509 (AMAZON-02, US)
PTR: s3-us-east-1-r-w.amazonaws.com

public-hunt-static-blog-assets.s3.us-east-1.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2001:4860:4802:32::36 (United States)

ASN15169 (GOOGLE, US)

region1.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:2761:2400:10:9b9d:b9c0:93a1 (United States) 2 redirects

ASN16509 (AMAZON-02, US)

framer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
60	framerusercontent.com framerusercontent.com — Cisco Umbrella Rank: 25787	1 MB
4	framer.com 2 redirects events.framer.com — Cisco Umbrella Rank: 40059 framer.com — Cisco Umbrella Rank: 36284	8 KB
3	amazonaws.com public-hunt-static-blog-assets.s3.us-east-1.amazonaws.com	34 KB
1	google-analytics.com region1.google-analytics.com — Cisco Umbrella Rank: 3353
1	framerstatic.com app.framerstatic.com — Cisco Umbrella Rank: 206034	20 KB
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	108 KB
1	hunt.io hunt.io	46 KB
69	7

	Domain	Requested by
60	framerusercontent.com	hunt.io framerusercontent.com
3	public-hunt-static-blog-assets.s3.us-east-1.amazonaws.com	hunt.io
2	framer.com	2 redirects
2	events.framer.com	hunt.io events.framer.com
1	region1.google-analytics.com	www.googletagmanager.com
1	app.framerstatic.com	hunt.io
1	www.googletagmanager.com	hunt.io
1	hunt.io
69	8

This site contains links to these domains. Also see Links.

Domain
app.hunt.io
www.cobaltstrike.com
www.amnesty.org
x.com
www.linkedin.com

Subject Issuer	Validity	Valid
hunt.io WR1	`2024-12-01` - `2025-03-01`	3 months	crt.sh
*.google-analytics.com WR2	`2024-11-04` - `2025-01-27`	3 months	crt.sh
framerusercontent.com Amazon RSA 2048 M03	`2024-11-16` - `2025-12-14`	a year	crt.sh
events.framer.com Amazon RSA 2048 M03	`2024-04-09` - `2025-05-07`	a year	crt.sh
framerstatic.com Amazon RSA 2048 M02	`2024-09-22` - `2025-10-20`	a year	crt.sh
s3.amazonaws.com Amazon RSA 2048 M01	`2024-11-18` - `2025-11-07`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity
Frame ID: E0F6CF7E69E9F52642F3FAE2B053FC09
Requests: 69 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Rare Watermark Links Cobalt Strike 4.10 Team Servers to Ongoing Suspicious Activity

Detected technologies

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Page Statistics

69
Requests

97 %
HTTPS

56 %
IPv6

7
Domains

8
Subdomains

9
IPs

2
Countries

1560 kB
Transfer

5555 kB
Size

2
Cookies

7 Outgoing links

These are links going to different origins than the main page.

URL: https://app.hunt.io/dashboard
Title: Login

Search URL Search Domain Scan URL

URL: https://www.cobaltstrike.com/blog/cobalt-strike-410-through-the-beacongate
Title: Cobalt Strike 4.10

Search URL Search Domain Scan URL

URL: https://app.hunt.io/search/detail/44.203.181.185
Title: Hunt

Search URL Search Domain Scan URL

URL: https://app.hunt.io/assoc/44.203.181.185
Title: Hunt

Search URL Search Domain Scan URL

URL: https://www.amnesty.org/en/latest/research/2020/09/german-made-finspy-spyware-found-in-egypt-and-mac-and-linux-versions-revealed/
Title: Amnesty International

Search URL Search Domain Scan URL

URL: https://x.com/Huntio?t=tNAyMYy3rMSrq6u0XIpZRg&s=09

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/hunt-intelligence-inc/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 44

https://framer.com/m/phosphor-icons/Sun.js@0.0.53 HTTP 302
https://framerusercontent.com/modules/wp6xzA2QrHTqCWJAsoKa/Hyhw8DdNtDxDqd366SY7/Sun.js

Request Chain 45

https://framer.com/m/phosphor-icons/Moon.js@0.0.53 HTTP 302
https://framerusercontent.com/modules/qdFz1d7MF7d8Wsxrv3Ew/tbOlJ2GGWCCiI25KWvfU/Moon.js

69 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity Show response
hunt.io/blog/ 557 KB
46 KB 112ms
36ms Document
text/html 52.223.52.2
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

52.223.52.2 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

a0b1d980e1f2226c6.awsglobalaccelerator.com

Software

Framer/32b700c /

Resource Hash

735103ff08357f02f897a41eaaddab0492f9962697b44c7d5937cd6fe999dd67

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000
cache-control: public, max-age=0, must-revalidate
content-encoding: br
content-length: 46687
content-type: text/html
date: Wed, 11 Dec 2024 08:57:26 GMT
etag: "51e2af52132b96eddccddd4ff0685171"
last-modified: Tue, 10 Dec 2024 16:52:44 GMT
link: <https://framerusercontent.com>; rel="preconnect", <https://framerusercontent.com>; rel="preconnect"; crossorigin=""
server: Framer/32b700c
server-timing: region;desc="eu-west-1", cache;desc="cached", ssg-status;desc="optimized", version;desc="32b700c"
strict-transport-security: max-age=31536000
vary: Accept-Encoding

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 323 KB
108 KB 146ms
53ms Script
application/javascript 2a00:1450:4001:80f::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-CKJY21YJ7N

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80f::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

fcfc9a59cc6a033a85f318216a774ececa52460fb9a71a427030fdee367b0396

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hunt.io/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Wed, 11 Dec 2024 08:57:27 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 11 Dec 2024 08:57:27 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 109901
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 chunk-7PZR57LV.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 657 KB
186 KB 27ms
11ms Script
text/javascript 2600:9000:2490:3c00:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-7PZR57LV.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2490:3c00:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

ca91ca3baad1db28d57e2e66c1636b41d0b1ebeec150cd744ed7612cfade3310

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://hunt.io/

Response headers

access-control-max-age: 0
content-encoding: br
etag: W/"d31ef3a1c75a5b9c5016323bad637661"
x-amz-version-id: 5TVHMCrEGuD1wgLyMDF.jFLyBKthoZZi
age: 59830
access-control-allow-methods: GET
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: 1OQE8Rdr1Q4JIwjflMIcbDxV-bZmo-5Bd6lriajikR54z1b8R52CUw==
date: Tue, 10 Dec 2024 16:20:17 GMT
content-type: text/javascript
last-modified: Tue, 10 Dec 2024 16:09:28 GMT
vary: Accept-Encoding,Origin
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-rid;desc="1OQE8Rdr1Q4JIwjflMIcbDxV-bZmo-5Bd6lriajikR54z1b8R52CUw==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=4
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 def5acc189db6e2856a956225d5cd100.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 chunk-JR5VT52U.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 1 KB
1 KB 41ms
34ms Script
text/javascript 2600:9000:2490:3c00:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-JR5VT52U.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2490:3c00:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

8b91ee4af78a9558d2bbbc889b190d7c47647405fabc8ae5be1c014d6c938228

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://hunt.io/

Response headers

access-control-max-age: 0
content-encoding: br
etag: W/"8dc2caa5dfa40c0964a44a081b0b17d9"
x-amz-version-id: _8xnJxoEpvTiFxGHHyvVZ85IFf3u.3cf
age: 2471228
access-control-allow-methods: GET
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: -RVZkFvsgupVtmdGKxTtvVU7iq4ze4AMiRIQ--cQ_BKIEKpz4U8OnA==
date: Tue, 12 Nov 2024 18:30:19 GMT
content-type: text/javascript
last-modified: Tue, 12 Nov 2024 18:22:56 GMT
vary: Accept-Encoding,Origin
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-rid;desc="-RVZkFvsgupVtmdGKxTtvVU7iq4ze4AMiRIQ--cQ_BKIEKpz4U8OnA==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=4
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 def5acc189db6e2856a956225d5cd100.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 chunk-DOOU7OF4.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 9 KB
4 KB 42ms
35ms Script
text/javascript 2600:9000:2490:3c00:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-DOOU7OF4.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2490:3c00:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

e7ded5e12508f728778cdc968bf945badfc120ce873943924e0a6dd516871c7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://hunt.io/

Response headers

access-control-max-age: 0
content-encoding: br
etag: W/"589ac5e5c1ef313d2dd8e35dc038ac21"
x-amz-version-id: OTwc.HV0ROYCSRSUiRgVFv3VuoeXbnK1
age: 59830
access-control-allow-methods: GET
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: IQKCF4r1d53jFY3sw0Hm4l0l5n1hN1nD5scpOmHu2cLiRvAPcs9CGw==
date: Tue, 10 Dec 2024 16:20:17 GMT
content-type: text/javascript
last-modified: Tue, 10 Dec 2024 16:09:28 GMT
vary: Accept-Encoding,Origin
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: PENDING
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-rid;desc="IQKCF4r1d53jFY3sw0Hm4l0l5n1hN1nD5scpOmHu2cLiRvAPcs9CGw==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=4
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 def5acc189db6e2856a956225d5cd100.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 chunk-RIUMFBNJ.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 447 B
1 KB 35ms
28ms Script
text/javascript 2600:9000:2490:3c00:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-RIUMFBNJ.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2490:3c00:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

a9428e5e5f6c5ede3339114a8be6230e2cc39a2190d03f1092ae93bdaf556891

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://hunt.io/

Response headers

access-control-max-age: 0
etag: "30ed32fa3444df726bb60d89113cf478"
x-amz-version-id: vYavs6UabxhB5PKPh4VT.q026xitGK6K
age: 7391608
access-control-allow-methods: GET
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: 2urEVZ2IldpYTxxXbuW2lxoQW4jhYY2a6LJSgfL04ADI1iziDKGdsg==
date: Mon, 16 Sep 2024 19:43:59 GMT
content-type: text/javascript
last-modified: Mon, 16 Sep 2024 15:39:52 GMT
vary: Origin
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-rid;desc="2urEVZ2IldpYTxxXbuW2lxoQW4jhYY2a6LJSgfL04ADI1iziDKGdsg==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=3
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 def5acc189db6e2856a956225d5cd100.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 447
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 3NOfmhLkro7nMnJ1Ukn9qft3G68X4tv5oy_-RbaqfP8.UDELJTMX.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 380 KB
51 KB 41ms
34ms Script
text/javascript 2600:9000:2490:3c00:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/3NOfmhLkro7nMnJ1Ukn9qft3G68X4tv5oy_-RbaqfP8.UDELJTMX.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2490:3c00:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

19d418a2f626fc1c0356c26eb11f3ee19295720ac760dc28463e75bfafabb1d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://hunt.io/

Response headers

access-control-max-age: 0
content-encoding: br
etag: W/"312965149b43745df19ebb3646a49187"
x-amz-version-id: CsiOZNoHMTcKkZkWhRweeo1PFjl80IgX
age: 57628
access-control-allow-methods: GET
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: MbgW3pNy_IkAS_1Q_FuP8Nwx2QWt_XiHsXfTBSRZZgZ13GrZQDWsvQ==
date: Tue, 10 Dec 2024 16:56:59 GMT
content-type: text/javascript
last-modified: Tue, 10 Dec 2024 16:52:32 GMT
vary: Accept-Encoding,Origin
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: PENDING
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-rid;desc="MbgW3pNy_IkAS_1Q_FuP8Nwx2QWt_XiHsXfTBSRZZgZ13GrZQDWsvQ==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=5
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 def5acc189db6e2856a956225d5cd100.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 chunk-2VZXA2FB.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 3 KB
2 KB 41ms
34ms Script
text/javascript 2600:9000:2490:3c00:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-2VZXA2FB.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2490:3c00:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

24bd03c6988e57312952d42ebbd11a362b0be97ff666d3d6ac8f3597174c56b6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://hunt.io/

Response headers

access-control-max-age: 0
content-encoding: br
etag: W/"4b4dc1288d4d44143b9e6fe8df9e4b6e"
x-amz-version-id: 41pteK7V_zPtSrEwZLvWYdmJq3AlRdkr
age: 1097055
access-control-allow-methods: GET
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: MBYI0B-ucGvPwc-CmP3O0_UVSlGj-iuXXjCFvjR1rlUiX9tA0eyyfA==
date: Thu, 28 Nov 2024 16:13:12 GMT
content-type: text/javascript
last-modified: Thu, 28 Nov 2024 15:59:29 GMT
vary: Accept-Encoding,Origin
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-rid;desc="MBYI0B-ucGvPwc-CmP3O0_UVSlGj-iuXXjCFvjR1rlUiX9tA0eyyfA==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=4
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 def5acc189db6e2856a956225d5cd100.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 chunk-6QJAY4QR.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 269 KB
66 KB 20ms
18ms Script
text/javascript 2600:9000:2490:3c00:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-6QJAY4QR.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2490:3c00:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

d1964a0c53200006e756ef0d0e32cea07deff44d89075cf26ae2afe3d85f43e2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://hunt.io/

Response headers

access-control-max-age: 0
content-encoding: br
etag: W/"3afe3347ed0aec09439983af47904a6d"
x-amz-version-id: zyo9Vn24E.niqDg3AEyJtLy_CnlZx88n
age: 57629
access-control-allow-methods: GET
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: BuAo-IGb5s8qKjQyHTk-L2bsxmIyhoMofI_uBw_2bIPfItzCDPkBHg==
date: Tue, 10 Dec 2024 16:56:59 GMT
content-type: text/javascript
last-modified: Tue, 10 Dec 2024 16:52:32 GMT
vary: Accept-Encoding,Origin
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: PENDING
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-rid;desc="BuAo-IGb5s8qKjQyHTk-L2bsxmIyhoMofI_uBw_2bIPfItzCDPkBHg==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=6
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 def5acc189db6e2856a956225d5cd100.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 chunk-IQJXJS56.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 2 MB
462 KB 25ms
24ms Script
text/javascript 2600:9000:2490:3c00:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-IQJXJS56.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2490:3c00:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

0d483fb31b7baa932fb38d9e974bcca41a9ecfa605e0d540b66e54e39fe69f6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://hunt.io/

Response headers

access-control-max-age: 0
content-encoding: br
etag: W/"31dd62f5e78dc021748cb2e226a1a631"
x-amz-version-id: ha0.ZQo2WOP80YQTROckWsD0vmO7dcYH
age: 4718183
access-control-allow-methods: GET
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: ZZ_D5xs0-sHreRDmiL9AKBEF6WR1mxXPO-BCX8De36fewQXNAWGQLw==
date: Thu, 17 Oct 2024 18:21:05 GMT
content-type: text/javascript
last-modified: Thu, 17 Oct 2024 17:21:59 GMT
vary: Accept-Encoding,Origin
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-rid;desc="ZZ_D5xs0-sHreRDmiL9AKBEF6WR1mxXPO-BCX8De36fewQXNAWGQLw==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=7
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 def5acc189db6e2856a956225d5cd100.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 chunk-FXENASNC.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 390 KB
57 KB 39ms
38ms Script
text/javascript 2600:9000:2490:3c00:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-FXENASNC.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2490:3c00:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

6fa7b05626f316594c613602ef5bed9327ca1941725837795dfc47414fb05cb5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://hunt.io/

Response headers

access-control-max-age: 0
content-encoding: br
etag: W/"2696554a7eb9bf9e3747d04c0b5f0360"
x-amz-version-id: znlHgDLDddBQnSMvUwmv55NemzXZy.AO
age: 59831
access-control-allow-methods: GET
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: 5WAnRQPEJmgjkPjUNwZvxeXlKXKeaAF0Jawl8rwWj-_cjiaSasmYpg==
date: Tue, 10 Dec 2024 16:20:17 GMT
content-type: text/javascript
last-modified: Tue, 10 Dec 2024 16:09:28 GMT
vary: Accept-Encoding,Origin
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: PENDING
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-rid;desc="5WAnRQPEJmgjkPjUNwZvxeXlKXKeaAF0Jawl8rwWj-_cjiaSasmYpg==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=9
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 def5acc189db6e2856a956225d5cd100.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 chunk-AIWW63AC.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 55 KB
18 KB 39ms
39ms Script
text/javascript 2600:9000:2490:3c00:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-AIWW63AC.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2490:3c00:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

dcb6c51ec0458017b4fc8364df113fc4556a9346ce84daafda08bc73fcd27539

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://hunt.io/

Response headers

access-control-max-age: 0
content-encoding: br
etag: W/"c3cfe8d46f0f118acfe59b0243a8cba4"
x-amz-version-id: ahONgdqL50swsg9dM..A9MBV_QnpoPl7
age: 59831
access-control-allow-methods: GET
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: GkO4bagLZusI3lCLRH7zTn3KWuzLzVNKR0D9RKkFPk6h3CxzoZq_Gg==
date: Tue, 10 Dec 2024 16:20:17 GMT
content-type: text/javascript
last-modified: Tue, 10 Dec 2024 16:09:28 GMT
vary: Accept-Encoding,Origin
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-rid;desc="GkO4bagLZusI3lCLRH7zTn3KWuzLzVNKR0D9RKkFPk6h3CxzoZq_Gg==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=8
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 def5acc189db6e2856a956225d5cd100.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 chunk-N24P5JZY.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 22 KB
5 KB 38ms
38ms Script
text/javascript 2600:9000:2490:3c00:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-N24P5JZY.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2490:3c00:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

af7863f53048fe6d665e912eb1a7438502bcd90275756bd57746711efd07ad1e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://hunt.io/

Response headers

access-control-max-age: 0
content-encoding: br
etag: W/"ba9ae5ccd01ced4534b15ed639fe510a"
x-amz-version-id: 24WB6WJjuF9AhPnBlGKpPJQ1iyRPlZaV
age: 58967
access-control-allow-methods: GET
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: WsnhKRHBtlDsRwUyUsLDTlGOmG4AOvt3cnxrx6m7zltumzZlOfb_XA==
date: Tue, 10 Dec 2024 16:34:41 GMT
content-type: text/javascript
last-modified: Tue, 10 Dec 2024 16:09:27 GMT
vary: Accept-Encoding,Origin
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-rid;desc="WsnhKRHBtlDsRwUyUsLDTlGOmG4AOvt3cnxrx6m7zltumzZlOfb_XA==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=9
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 def5acc189db6e2856a956225d5cd100.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 chunk-WNOMLQKT.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 145 KB
21 KB 42ms
41ms Script
text/javascript 2600:9000:2490:3c00:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-WNOMLQKT.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2490:3c00:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

bad9ed8e37d8d1aee7eacb1761e4bf4a7ac110eec89a7e92ff35545023c37cd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://hunt.io/

Response headers

access-control-max-age: 0
content-encoding: br
etag: W/"2d1c59a942931206e7cfd493cbbcb555"
x-amz-version-id: oSBH9BR_0DA1FjBTiBNPNaDzhvqohcl2
age: 58967
access-control-allow-methods: GET
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: ZGA4a6WQBXewqtGom8_EbGcC3JZ7eSfVzEP54DHlyVhNxgX6Xn4Q8A==
date: Tue, 10 Dec 2024 16:34:41 GMT
content-type: text/javascript
last-modified: Tue, 10 Dec 2024 16:09:28 GMT
vary: Accept-Encoding,Origin
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-rid;desc="ZGA4a6WQBXewqtGom8_EbGcC3JZ7eSfVzEP54DHlyVhNxgX6Xn4Q8A==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=10
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 def5acc189db6e2856a956225d5cd100.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 chunk-PLBDR7DK.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 781 B
2 KB 44ms
43ms Script
text/javascript 2600:9000:2490:3c00:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-PLBDR7DK.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2490:3c00:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

a1e9b3da59fa84c73948363f79bd0cef61cdb495511606fa4c2d8a06ddc954d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://hunt.io/

Response headers

access-control-max-age: 0
etag: "d480024738b25adf2a7e816ed250f955"
x-amz-version-id: Z7pWqGV2dzKFOSyjcA5bS9niESfREDhj
age: 24446
access-control-allow-methods: GET
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: blgoA4hib-cgFY9mJBDbbW2iPklDlYvWsfuMtMGIhNG6mrRw-iztrA==
date: Wed, 11 Dec 2024 02:10:02 GMT
content-type: text/javascript
last-modified: Tue, 10 Dec 2024 16:52:32 GMT
vary: Origin
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-rid;desc="blgoA4hib-cgFY9mJBDbbW2iPklDlYvWsfuMtMGIhNG6mrRw-iztrA==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=13
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 def5acc189db6e2856a956225d5cd100.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 781
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 chunk-4DBXZSQR.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 10 KB
2 KB 42ms
41ms Script
text/javascript 2600:9000:2490:3c00:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-4DBXZSQR.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2490:3c00:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

dda3ae667335cfd45ec00006177baa81cdcffd2584b76e84cbfe1819b7425484

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://hunt.io/

Response headers

access-control-max-age: 0
content-encoding: br
etag: W/"25f1dd66e1da9cb89702f7fd019e7878"
x-amz-version-id: zb1h5oSo2qz43GdSiNusHNZgez_qMOWl
age: 58967
access-control-allow-methods: GET
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: u34afL0xe4-wcqZo3gFNCpj9Lrt7M-ODBfeF4LmUE_yphxVbJLMQ1w==
date: Tue, 10 Dec 2024 16:34:41 GMT
content-type: text/javascript
last-modified: Tue, 10 Dec 2024 16:09:28 GMT
vary: Accept-Encoding,Origin
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-rid;desc="u34afL0xe4-wcqZo3gFNCpj9Lrt7M-ODBfeF4LmUE_yphxVbJLMQ1w==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=11
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 def5acc189db6e2856a956225d5cd100.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 chunk-MKDKQIQE.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 20 KB
5 KB 45ms
44ms Script
text/javascript 2600:9000:2490:3c00:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-MKDKQIQE.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2490:3c00:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

a2cc6f4036b7ba96d44dc4a4489a50aad64157c4648bb10a37292575b85c02ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://hunt.io/

Response headers

access-control-max-age: 0
content-encoding: br
etag: W/"a5a493f35b5ac2e85c369329993e4f36"
x-amz-version-id: YmJ7TLOSspR.QEbKNVwELoRz2kXQ0d5s
age: 59831
access-control-allow-methods: GET
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: ZTYNbw5VTSxEyP5oItoUEmFKtd7h46g-S6DxArbQjT27R8g8pwgmcw==
date: Tue, 10 Dec 2024 16:20:17 GMT
content-type: text/javascript
last-modified: Tue, 10 Dec 2024 16:09:28 GMT
vary: Accept-Encoding,Origin
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: PENDING
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-rid;desc="ZTYNbw5VTSxEyP5oItoUEmFKtd7h46g-S6DxArbQjT27R8g8pwgmcw==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=14
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 def5acc189db6e2856a956225d5cd100.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 chunk-LCEZCQRN.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 700 B
2 KB 43ms
42ms Script
text/javascript 2600:9000:2490:3c00:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-LCEZCQRN.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2490:3c00:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

c56899f4291eff03eed62b752565556777823419de3f2b5c9020c02a883ea8ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://hunt.io/

Response headers

access-control-max-age: 0
etag: "f7f362a6b630f4f80759edc1e4b1ba32"
x-amz-version-id: pEE5MA4PuDjscD93PK1iHgo9617sClk9
age: 24381
access-control-allow-methods: GET
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: gto8SutaaTYYNmBuXs6wtTNxDhyFGvD8gLWJ88bNE83Ibdo3zMTHxg==
date: Wed, 11 Dec 2024 02:11:07 GMT
content-type: text/javascript
last-modified: Tue, 10 Dec 2024 16:52:34 GMT
vary: Origin
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-rid;desc="gto8SutaaTYYNmBuXs6wtTNxDhyFGvD8gLWJ88bNE83Ibdo3zMTHxg==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=13
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 def5acc189db6e2856a956225d5cd100.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 700
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 chunk-Q2JEALBM.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 4 KB
3 KB 42ms
42ms Script
text/javascript 2600:9000:2490:3c00:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-Q2JEALBM.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2490:3c00:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

449b30c2317c76c281158fa547bb61f301dd9f675b54699a8bfc5040648fda2d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://hunt.io/

Response headers

access-control-max-age: 0
content-encoding: br
etag: W/"85385ac97b505762e460a1f6ab0d821f"
x-amz-version-id: 7ykTzZrRqKmFEWzuhs5LaEC47pDR4Zvg
age: 59831
access-control-allow-methods: GET
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: _-2NJI0FuoqJVl33m9POqh_OR9Eg4LmG4Qq0Wznewzwins9A7qlErw==
date: Tue, 10 Dec 2024 16:20:17 GMT
content-type: text/javascript
last-modified: Tue, 10 Dec 2024 16:09:28 GMT
vary: Accept-Encoding,Origin
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-rid;desc="_-2NJI0FuoqJVl33m9POqh_OR9Eg4LmG4Qq0Wznewzwins9A7qlErw==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=12
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 def5acc189db6e2856a956225d5cd100.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 script_main.DVS43U5Q.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 13 KB
7 KB 46ms
46ms Script
text/javascript 2600:9000:2490:3c00:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/script_main.DVS43U5Q.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2490:3c00:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

324a9989ddbb2f2467a735983838314194704fb724135401a55046f54e852cde

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://hunt.io/

Response headers

access-control-max-age: 0
content-encoding: br
etag: W/"ba762ee88aa0962ee71c2f469bb7e8c6"
x-amz-version-id: tVo24YqlM1fa1zfMef1tHpYucOnAnJ.g
age: 57629
access-control-allow-methods: GET
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: dRMfQZB3isVu9yy9hMXpaIj7O32ZAa2NJHyk8yZ1kffvQZm3n799Sg==
date: Tue, 10 Dec 2024 16:56:59 GMT
content-type: text/javascript
last-modified: Tue, 10 Dec 2024 16:52:33 GMT
vary: Accept-Encoding,Origin
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: PENDING
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-rid;desc="dRMfQZB3isVu9yy9hMXpaIj7O32ZAa2NJHyk8yZ1kffvQZm3n799Sg==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=15
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 def5acc189db6e2856a956225d5cd100.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 script Show response
events.framer.com/ 18 KB
7 KB 151ms
102ms Script
text/javascript 13.32.99.2
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://events.framer.com/script

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.99.2 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-99-2.fra60.r.cloudfront.net

Software

Resource Hash

89e61318afc569842f98ccd196ff7cfbb36ec69bad3af935dd5c7149b494fde4

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hunt.io/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
x-amzn-remapped-content-length: 18177
timestamp: Wed, 11 Dec 2024 08:55:48 GMT
content-encoding: gzip
x-amz-apigw-id: CnoOqH8DIAMErCg=
x-amzn-trace-id: Root=1-675953f7-3204bbbc4936b13f6932ae18
x-amzn-requestid: e0fd2af5-8d8f-47f6-b8c3-af0695211155
via: 1.1 231be1c97cc722fa08b64d21072ebfac.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
content-length: 6204
x-amz-cf-id: b0pQVzd7Ntla4hJMWGZfii74j10oOqB-kMbm0Yoi_esEgoGUDx53BA==
date: Wed, 11 Dec 2024 08:57:27 GMT
content-type: text/javascript
x-amz-cf-pop: FRA60-P3

GET
DATA 200
OK truncated
/ 248 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1903ee47f38fb5a0b56ce197b51aa0e1be80b22ab3afcd1a466eb1ee536aa8b3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
H2 200 1ZFS7N918ojhhd0nQWdj3jz4w.woff2
framerusercontent.com/assets/ 27 KB
28 KB 43ms
43ms Font
font/woff2 2600:9000:2490:3c00:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/assets/1ZFS7N918ojhhd0nQWdj3jz4w.woff2

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2490:3c00:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

cc324555c1cd681a59c27be1eda61da587d17bf71cc1ed8aa3e4a51e77907685

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://hunt.io/

Response headers

access-control-max-age: 3000
etag: "9a2dbfafd3686aa72cb303a41be28527"
x-amz-version-id: FhKj_VGbf4ha4CqtjcCeHMQzi9fH8cVU
age: 7867599
access-control-allow-methods: GET, HEAD
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: 7ikAFh1QXNVsaFTag0T8di1GFdwJ27sLmS7nyiNdWVRv_DMolUTvCQ==
date: Wed, 11 Sep 2024 07:30:49 GMT
content-type: font/woff2
last-modified: Mon, 15 Jul 2024 14:12:44 GMT
x-amz-server-side-encryption-aws-kms-key-id: arn:aws:kms:us-east-1:946663360620:key/73540960-f9f6-40d6-b02a-3aa22f5f7459
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-rid;desc="7ikAFh1QXNVsaFTag0T8di1GFdwJ27sLmS7nyiNdWVRv_DMolUTvCQ==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=8
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 def5acc189db6e2856a956225d5cd100.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 28004
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6
server: CloudFront
x-amz-server-side-encryption: aws:kms

GET
H2 200 Inter-Medium.latin-Y3IVPL46.woff2
app.framerstatic.com/ 19 KB
20 KB 52ms
14ms Font
font/woff2 2600:9000:223e:3000:d:6b42:4ec0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://app.framerstatic.com/Inter-Medium.latin-Y3IVPL46.woff2

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:223e:3000:d:6b42:4ec0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

c861d136456a64c9c5619e9fa7c37c80144ea5d8879d88554c1f8abaaae891bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://hunt.io/

Response headers

access-control-max-age: 3600
etag: "f366e7b832c6d0e8a2038665895c0762"
x-amz-version-id: null
age: 26312509
access-control-allow-methods: GET
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: D8sZwzENa-m4cX_TMJ45VGpMw9yx7uUdFN6Q9eNnCjKnuVqwNPxDYg==
date: Sat, 10 Feb 2024 19:55:39 GMT
content-type: font/woff2
last-modified: Sat, 10 Feb 2024 12:18:59 GMT
x-frame-options: deny
access-control-allow-headers: *
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000, immutable
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 88f858f045c3909fad9cebbada511aee.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 19904
x-xss-protection: 1; mode=block
x-amz-cf-pop: FRA56-P4
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 Wbt9vg2M3MLSUK6C8ZimtsouOws.webp
framerusercontent.com/images/ 52 KB
53 KB 15ms
9ms Image
image/avif 2600:9000:2490:3c00:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://framerusercontent.com/images/Wbt9vg2M3MLSUK6C8ZimtsouOws.webp

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2490:3c00:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

af40af5e1469d7ef41aee9645556b634ada06969e8a9babf4d4e17c38aad2caf

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/enforce;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hunt.io/

Response headers

etag: "294afbee86a7b816bb58ca4b178d9a09"
age: 673445
x-content-type-options: nosniff
x-amzn-requestid: 0a40e9b2-0af7-4bf3-be26-e644a48199c7
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: FUmyzr87njPoeZ3WGO4b-BFe-xo7gfXY5eEeV50ES3SyCoFRO-1S2w==
date: Tue, 03 Dec 2024 13:53:22 GMT
content-type: image/avif
vary: Accept
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/enforce;
cache-control: public, max-age=31536000, stale-while-revalidate=31536000
timing-allow-origin: *
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-rid;desc="FUmyzr87njPoeZ3WGO4b-BFe-xo7gfXY5eEeV50ES3SyCoFRO-1S2w==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=2
cross-origin-resource-policy: cross-origin
x-amzn-trace-id: Root=1-674f0d51-557acc861003e14f1c9dff39;Sampled=1;Lineage=1:f456f256:0
referrer-policy: strict-origin-when-cross-origin
via: 1.1 1c7275102c069b3b4bff7bcc191ded2e.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6

GET
H2 200 yVA9Oy9wbaBjaChzIOH78YiSFE.webp
framerusercontent.com/images/ 8 KB
9 KB 17ms
6ms Image
image/avif 2600:9000:2490:3c00:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://framerusercontent.com/images/yVA9Oy9wbaBjaChzIOH78YiSFE.webp?scale-down-to=512

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2490:3c00:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a741fd3317fed44c0f1c7b8161f1420298b044e564dfea131957c0e27982a66c

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/enforce;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hunt.io/

Response headers

etag: "7231b098b0757259dd2bbfd90a7fb0f9"
age: 671301
x-content-type-options: nosniff
x-amzn-requestid: 3de1bf36-0c6a-42e8-bf76-49da9ceef860
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: MliSbB1zCQ8X9-F3_Y7QxNf9pZCHtY53lOZBKJRI-a7mTQhkDtBB0Q==
date: Tue, 03 Dec 2024 14:29:06 GMT
content-type: image/avif
vary: Accept
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/enforce;
cache-control: public, max-age=31536000, stale-while-revalidate=31536000
timing-allow-origin: *
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-rid;desc="MliSbB1zCQ8X9-F3_Y7QxNf9pZCHtY53lOZBKJRI-a7mTQhkDtBB0Q==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=4
cross-origin-resource-policy: cross-origin
x-amzn-trace-id: Root=1-674f15b1-78bc758e7f872fa50e191290;Sampled=1;Lineage=1:f456f256:0
referrer-policy: strict-origin-when-cross-origin
via: 1.1 1c7275102c069b3b4bff7bcc191ded2e.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6

GET
H2 200 6odJFlTcHq1fzIBehjj2s4p9DY.webp
framerusercontent.com/images/ 7 KB
8 KB 18ms
7ms Image
image/avif 2600:9000:2490:3c00:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://framerusercontent.com/images/6odJFlTcHq1fzIBehjj2s4p9DY.webp?scale-down-to=512

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2490:3c00:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

4dc2a5162f03c1768634a7d933f034a800807b5324368e398cdbfc038a06d395

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/enforce;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hunt.io/

Response headers

etag: "b3fc6d3f97ac740ee5904dc1c19ead8d"
age: 673444
x-content-type-options: nosniff
x-amzn-requestid: bcf9756b-a7f3-480e-9de4-39e71cd81437
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: s5XHUaNdZl5vtFCWMnA0EZm0-kpP8LQcCb97mn7N1Jxsk43i36_0bQ==
date: Tue, 03 Dec 2024 13:53:23 GMT
content-type: image/avif
vary: Accept
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/enforce;
cache-control: public, max-age=31536000, stale-while-revalidate=31536000
timing-allow-origin: *
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-rid;desc="s5XHUaNdZl5vtFCWMnA0EZm0-kpP8LQcCb97mn7N1Jxsk43i36_0bQ==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=4
cross-origin-resource-policy: cross-origin
x-amzn-trace-id: Root=1-674f0d52-3771963431d7a22b4add2727;Parent=1f553ee76613da3a;Sampled=0;Lineage=1:f456f256:0
referrer-policy: strict-origin-when-cross-origin
via: 1.1 1c7275102c069b3b4bff7bcc191ded2e.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6

GET
H2 200 cJA8dVwYG5AXjO4aXVKQ9QdZFg.webp
framerusercontent.com/images/ 8 KB
9 KB 20ms
9ms Image
image/avif 2600:9000:2490:3c00:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://framerusercontent.com/images/cJA8dVwYG5AXjO4aXVKQ9QdZFg.webp?scale-down-to=512

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2490:3c00:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

341f61d7c3838f9e303327f41376afcc21e5e7e5d5408b795be682dcd97cde43

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/enforce;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hunt.io/

Response headers

etag: "e1a9183cb012ee35efa98e49b5e794c7"
age: 673444
x-content-type-options: nosniff
x-amzn-requestid: ccc06360-8d94-47a9-b091-1b302a6ae954
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: hpU7RbOi7N96E-F7c64RTDzvcNys6yFOfUxcLMqAeemCHZ7IoVodbg==
date: Tue, 03 Dec 2024 13:53:23 GMT
content-type: image/avif
vary: Accept
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/enforce;
cache-control: public, max-age=31536000, stale-while-revalidate=31536000
timing-allow-origin: *
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-rid;desc="hpU7RbOi7N96E-F7c64RTDzvcNys6yFOfUxcLMqAeemCHZ7IoVodbg==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=5
cross-origin-resource-policy: cross-origin
x-amzn-trace-id: Root=1-674f0d52-337d67ec3b1a02f00d068755;Sampled=1;Lineage=1:f456f256:0
referrer-policy: strict-origin-when-cross-origin
via: 1.1 1c7275102c069b3b4bff7bcc191ded2e.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6

GET
H2 200 fOXtYSvzsNlw0tzPVKMsf72n0.png
framerusercontent.com/images/ 24 KB
25 KB 21ms
10ms Image
image/avif 2600:9000:2490:3c00:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://framerusercontent.com/images/fOXtYSvzsNlw0tzPVKMsf72n0.png?scale-down-to=2048

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2490:3c00:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

e1d4e429bec9bc36a28143018ae0400faee2ea7ffe9442942794e016a094220c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hunt.io/

Response headers

etag: "a5fd6921c78d186fd22e12abbea6a593"
age: 16491604
x-content-type-options: nosniff
x-amzn-requestid: 9df5ba47-2ec8-4bec-96e9-11a9fef30e48
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: zS8J6Cga8RLNPiSmclpN0xTrIw8SjgfVxx25nXDimEeLBMQxjwswLA==
date: Mon, 03 Jun 2024 11:57:23 GMT
content-type: image/avif
vary: Accept
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-rid;desc="zS8J6Cga8RLNPiSmclpN0xTrIw8SjgfVxx25nXDimEeLBMQxjwswLA==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=5
cache-control: public, max-age=31536000, stale-while-revalidate=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-amzn-trace-id: root=1-665dafa2-42d508f768a18ae373bdb131;sampled=1;lineage=f456f256:0
content-security-policy-report-only: default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/reportOnly;
referrer-policy: strict-origin-when-cross-origin
via: 1.1 1c7275102c069b3b4bff7bcc191ded2e.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6

GET
H3 200 vQyevYAyHtARFwPqUzQGpnDs.woff2
framerusercontent.com/assets/ 27 KB
28 KB 18ms
17ms Font
font/woff2 108.138.7.90
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/assets/vQyevYAyHtARFwPqUzQGpnDs.woff2

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

QUIC, , AES_128_GCM

Server

108.138.7.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-7-90.fra56.r.cloudfront.net

Software

CloudFront /

Resource Hash

4107b11930c4eef1f6ae5a76d441562e6d21a601f1781f37fd085542cd87412b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://hunt.io/

Response headers

access-control-max-age: 3000
etag: "a14a424239fd9cb2e305f2243b1f6177"
x-amz-version-id: SH9la86RvjI0NEj8MqfrPHVtgDnLUhAV
age: 10722716
access-control-allow-methods: GET, HEAD
x-content-type-options: nosniff
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-hit-layer;desc="EDGE",cdn-rid;desc="357JcHQaPMHBs0WrI5GU0jLQ-zMxHt1j6YQ9kMdKyakAz4otlBXz8w==",cdn-downstream-fbl=2
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Fri, 09 Aug 2024 06:25:32 GMT
content-type: font/woff2
last-modified: Mon, 15 Jul 2024 14:12:38 GMT
x-amz-server-side-encryption-aws-kms-key-id: arn:aws:kms:us-east-1:946663360620:key/73540960-f9f6-40d6-b02a-3aa22f5f7459
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-id: 357JcHQaPMHBs0WrI5GU0jLQ-zMxHt1j6YQ9kMdKyakAz4otlBXz8w==
x-amz-replication-status: COMPLETED
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 0e37105a96e87c22ff4981659a6dc176.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 27404
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6
server: CloudFront
x-amz-server-side-encryption: aws:kms

GET
H3 200 DXD0Q7LSl7HEvDzucnyLnGBHM.woff2
framerusercontent.com/assets/ 27 KB
28 KB 20ms
20ms Font
font/woff2 108.138.7.90
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/assets/DXD0Q7LSl7HEvDzucnyLnGBHM.woff2

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

QUIC, , AES_128_GCM

Server

108.138.7.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-7-90.fra56.r.cloudfront.net

Software

CloudFront /

Resource Hash

2dc968863319a6f57e6428a7b4c292ae254d3e462b5f23f71bab492317067d5f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://hunt.io/

Response headers

access-control-max-age: 3000
etag: "757ca4a792b8c7bbe09f6e6cee76e727"
x-amz-version-id: bCCG3uSnAgT3MLzz1ZSQU2cVkYB4Lve.
age: 11549439
access-control-allow-methods: GET, HEAD
x-content-type-options: nosniff
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-hit-layer;desc="EDGE",cdn-rid;desc="_w9bXOLyCcWH2X8rqdwGegtjKkYlb9cTpbHTtTtv2CW5oy8NCt_NuA==",cdn-downstream-fbl=1
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Tue, 30 Jul 2024 16:46:48 GMT
content-type: font/woff2
last-modified: Mon, 15 Jul 2024 14:11:33 GMT
x-amz-server-side-encryption-aws-kms-key-id: arn:aws:kms:us-east-1:946663360620:key/73540960-f9f6-40d6-b02a-3aa22f5f7459
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-id: _w9bXOLyCcWH2X8rqdwGegtjKkYlb9cTpbHTtTtv2CW5oy8NCt_NuA==
x-amz-replication-status: COMPLETED
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 0e37105a96e87c22ff4981659a6dc176.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 27992
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6
server: CloudFront
x-amz-server-side-encryption: aws:kms

GET
H/1.1 200
OK figure_1_screenshot_showing_the_i_button_which_allows_users_to_quickly_view_beacon_configurations_without_downloading_them_in_hunt__1x.webp
public-hunt-static-blog-assets.s3.us-east-1.amazonaws.com/12-2024/ 17 KB
18 KB 355ms
139ms Image
image/webp 54.231.192.10
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://public-hunt-static-blog-assets.s3.us-east-1.amazonaws.com/12-2024/figure_1_screenshot_showing_the_i_button_which_allows_users_to_quickly_view_beacon_configurations_without_downloading_them_in_hunt__1x.webp
Requested by: Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.231.192.10 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-us-east-1-r-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 22e5cfd55973895f60a7f6bf877482dc964962f8dd778612fc149bed56112bc1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hunt.io/

Response headers

x-amz-id-2: Cw0v4oJi8v/5GvCfcpHVfpzW43oyhAHLRS/dUgVWXTys67NTuki5XIEV7jV2bhWwo2+j9dE6+RM=
ETag: "5a63fbd9ea0b1ac71babd58c221894d8"
x-amz-request-id: CF6221M7GG19JJ95
Accept-Ranges: bytes
Content-Length: 17688
Date: Wed, 11 Dec 2024 08:57:28 GMT
Last-Modified: Tue, 03 Dec 2024 14:45:58 GMT
Content-Type: image/webp
Server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H/1.1 200
OK figure_2_associations_tab_showing_six_additional_ip_addresses_sharing_the_same_watermark_hunt__1x.webp
public-hunt-static-blog-assets.s3.us-east-1.amazonaws.com/12-2024/ 15 KB
16 KB 337ms
121ms Image
image/webp 54.231.192.10
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://public-hunt-static-blog-assets.s3.us-east-1.amazonaws.com/12-2024/figure_2_associations_tab_showing_six_additional_ip_addresses_sharing_the_same_watermark_hunt__1x.webp
Requested by: Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.231.192.10 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-us-east-1-r-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 9753c83f61822ce350ea508e36e2ee9395589100a0b3afa9df41a4c1a0910408

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hunt.io/

Response headers

x-amz-id-2: 40e5JSxzP+sM87cUsYN95KRIxVQ4+6TIusCecTp4ahnpZ7aionakG5MgBRSkkm1UapF4NdtVtyE=
ETag: "0b70d4de7b2cec3732dfb1f26c2f4528"
x-amz-request-id: CF6B7ZDT00653QBN
Accept-Ranges: bytes
Content-Length: 15826
Date: Wed, 11 Dec 2024 08:57:28 GMT
Last-Modified: Tue, 03 Dec 2024 14:45:56 GMT
Content-Type: image/webp
Server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H2 200 Wbt9vg2M3MLSUK6C8ZimtsouOws.webp
framerusercontent.com/images/ 52 KB
0 0ms
0ms Image
image/avif 2600:9000:2490:3c00:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://framerusercontent.com/images/Wbt9vg2M3MLSUK6C8ZimtsouOws.webp

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2490:3c00:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

af40af5e1469d7ef41aee9645556b634ada06969e8a9babf4d4e17c38aad2caf

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/enforce;
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hunt.io/

Response headers

etag: "294afbee86a7b816bb58ca4b178d9a09"
age: 673445
x-content-type-options: nosniff
x-amzn-requestid: 0a40e9b2-0af7-4bf3-be26-e644a48199c7
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: FUmyzr87njPoeZ3WGO4b-BFe-xo7gfXY5eEeV50ES3SyCoFRO-1S2w==
date: Tue, 03 Dec 2024 13:53:22 GMT
content-type: image/avif
vary: Accept
x-frame-options: deny
content-security-policy: default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/enforce;
cache-control: public, max-age=31536000, stale-while-revalidate=31536000
timing-allow-origin: *
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-rid;desc="FUmyzr87njPoeZ3WGO4b-BFe-xo7gfXY5eEeV50ES3SyCoFRO-1S2w==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=2
cross-origin-resource-policy: cross-origin
x-amzn-trace-id: Root=1-674f0d51-557acc861003e14f1c9dff39;Sampled=1;Lineage=1:f456f256:0
referrer-policy: strict-origin-when-cross-origin
via: 1.1 1c7275102c069b3b4bff7bcc191ded2e.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6

GET
H2 200 yVA9Oy9wbaBjaChzIOH78YiSFE.webp
framerusercontent.com/images/ 8 KB
0 2ms
2ms Image
image/avif 2600:9000:2490:3c00:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://framerusercontent.com/images/yVA9Oy9wbaBjaChzIOH78YiSFE.webp?scale-down-to=512

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2490:3c00:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a741fd3317fed44c0f1c7b8161f1420298b044e564dfea131957c0e27982a66c

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/enforce;
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hunt.io/

Response headers

etag: "7231b098b0757259dd2bbfd90a7fb0f9"
age: 671301
x-content-type-options: nosniff
x-amzn-requestid: 3de1bf36-0c6a-42e8-bf76-49da9ceef860
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: MliSbB1zCQ8X9-F3_Y7QxNf9pZCHtY53lOZBKJRI-a7mTQhkDtBB0Q==
date: Tue, 03 Dec 2024 14:29:06 GMT
content-type: image/avif
vary: Accept
x-frame-options: deny
content-security-policy: default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/enforce;
cache-control: public, max-age=31536000, stale-while-revalidate=31536000
timing-allow-origin: *
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-rid;desc="MliSbB1zCQ8X9-F3_Y7QxNf9pZCHtY53lOZBKJRI-a7mTQhkDtBB0Q==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=4
cross-origin-resource-policy: cross-origin
x-amzn-trace-id: Root=1-674f15b1-78bc758e7f872fa50e191290;Sampled=1;Lineage=1:f456f256:0
referrer-policy: strict-origin-when-cross-origin
via: 1.1 1c7275102c069b3b4bff7bcc191ded2e.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6

GET
H2 200 6odJFlTcHq1fzIBehjj2s4p9DY.webp
framerusercontent.com/images/ 7 KB
0 4ms
4ms Image
image/avif 2600:9000:2490:3c00:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://framerusercontent.com/images/6odJFlTcHq1fzIBehjj2s4p9DY.webp?scale-down-to=512

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2490:3c00:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

4dc2a5162f03c1768634a7d933f034a800807b5324368e398cdbfc038a06d395

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/enforce;
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hunt.io/

Response headers

etag: "b3fc6d3f97ac740ee5904dc1c19ead8d"
age: 673444
x-content-type-options: nosniff
x-amzn-requestid: bcf9756b-a7f3-480e-9de4-39e71cd81437
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: s5XHUaNdZl5vtFCWMnA0EZm0-kpP8LQcCb97mn7N1Jxsk43i36_0bQ==
date: Tue, 03 Dec 2024 13:53:23 GMT
content-type: image/avif
vary: Accept
x-frame-options: deny
content-security-policy: default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/enforce;
cache-control: public, max-age=31536000, stale-while-revalidate=31536000
timing-allow-origin: *
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-rid;desc="s5XHUaNdZl5vtFCWMnA0EZm0-kpP8LQcCb97mn7N1Jxsk43i36_0bQ==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=4
cross-origin-resource-policy: cross-origin
x-amzn-trace-id: Root=1-674f0d52-3771963431d7a22b4add2727;Parent=1f553ee76613da3a;Sampled=0;Lineage=1:f456f256:0
referrer-policy: strict-origin-when-cross-origin
via: 1.1 1c7275102c069b3b4bff7bcc191ded2e.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6

GET
H2 200 cJA8dVwYG5AXjO4aXVKQ9QdZFg.webp
framerusercontent.com/images/ 8 KB
0 5ms
5ms Image
image/avif 2600:9000:2490:3c00:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://framerusercontent.com/images/cJA8dVwYG5AXjO4aXVKQ9QdZFg.webp?scale-down-to=512

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2490:3c00:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

341f61d7c3838f9e303327f41376afcc21e5e7e5d5408b795be682dcd97cde43

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/enforce;
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hunt.io/

Response headers

etag: "e1a9183cb012ee35efa98e49b5e794c7"
age: 673444
x-content-type-options: nosniff
x-amzn-requestid: ccc06360-8d94-47a9-b091-1b302a6ae954
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: hpU7RbOi7N96E-F7c64RTDzvcNys6yFOfUxcLMqAeemCHZ7IoVodbg==
date: Tue, 03 Dec 2024 13:53:23 GMT
content-type: image/avif
vary: Accept
x-frame-options: deny
content-security-policy: default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/enforce;
cache-control: public, max-age=31536000, stale-while-revalidate=31536000
timing-allow-origin: *
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-rid;desc="hpU7RbOi7N96E-F7c64RTDzvcNys6yFOfUxcLMqAeemCHZ7IoVodbg==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=5
cross-origin-resource-policy: cross-origin
x-amzn-trace-id: Root=1-674f0d52-337d67ec3b1a02f00d068755;Sampled=1;Lineage=1:f456f256:0
referrer-policy: strict-origin-when-cross-origin
via: 1.1 1c7275102c069b3b4bff7bcc191ded2e.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6

GET
H2 200 fOXtYSvzsNlw0tzPVKMsf72n0.png
framerusercontent.com/images/ 24 KB
0 6ms
6ms Image
image/avif 2600:9000:2490:3c00:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://framerusercontent.com/images/fOXtYSvzsNlw0tzPVKMsf72n0.png?scale-down-to=2048

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2490:3c00:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

e1d4e429bec9bc36a28143018ae0400faee2ea7ffe9442942794e016a094220c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hunt.io/

Response headers

etag: "a5fd6921c78d186fd22e12abbea6a593"
age: 16491604
x-content-type-options: nosniff
x-amzn-requestid: 9df5ba47-2ec8-4bec-96e9-11a9fef30e48
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: zS8J6Cga8RLNPiSmclpN0xTrIw8SjgfVxx25nXDimEeLBMQxjwswLA==
date: Mon, 03 Jun 2024 11:57:23 GMT
content-type: image/avif
vary: Accept
x-frame-options: deny
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-rid;desc="zS8J6Cga8RLNPiSmclpN0xTrIw8SjgfVxx25nXDimEeLBMQxjwswLA==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=5
cache-control: public, max-age=31536000, stale-while-revalidate=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-amzn-trace-id: root=1-665dafa2-42d508f768a18ae373bdb131;sampled=1;lineage=f456f256:0
content-security-policy-report-only: default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/reportOnly;
via: 1.1 1c7275102c069b3b4bff7bcc191ded2e.cloudfront.net (CloudFront)
referrer-policy: strict-origin-when-cross-origin
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6

POST
H2 200 anonymous
events.framer.com/ 0
381 B 170ms
170ms Ping
application/json 13.32.99.2
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://events.framer.com/anonymous
Requested by: Host: events.framer.com
URL: https://events.framer.com/script
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.2 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-2.fra60.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://hunt.io/

Response headers

x-amz-apigw-id: CnoOtGg1IAMEcvA=
x-amzn-trace-id: Root=1-675953f7-60eb19e03767286d5769ca09;Parent=1fcc10345dfdaf6a;Sampled=0;Lineage=1:c457ad49:0
x-amzn-requestid: fbbf6bc7-f4dc-40b0-81ba-30b848c414fd
via: 1.1 231be1c97cc722fa08b64d21072ebfac.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 0
x-amz-cf-id: QOUxUSZQhIKgm_x7WfUhcLvkqxBgOtMnGRUBWNSbHcl5YbPxgSq2Ew==
date: Wed, 11 Dec 2024 08:57:27 GMT
content-type: application/json
x-amz-cf-pop: FRA60-P3

GET
H3 206 wvsIsx8BB-indexes-default.framercms Show response
framerusercontent.com/modules/drpNeVQopLY1P5khDike/dRsRwQIaLOAXxsU4RZSx/ 3 KB
4 KB 10ms
10ms Fetch
application/octet-stream 108.138.7.90
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/modules/drpNeVQopLY1P5khDike/dRsRwQIaLOAXxsU4RZSx/wvsIsx8BB-indexes-default.framercms

Requested by

Host: framerusercontent.com
URL: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-AIWW63AC.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

108.138.7.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-7-90.fra56.r.cloudfront.net

Software

Resource Hash

f5b8526bb0e6c1a53d014fca1808aebfb9abaa825ba0e7f54c32562023e255b4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Range: bytes=6919-10110
Referer: https://hunt.io/

Response headers

access-control-expose-headers: Content-Range
age: 54849
access-control-allow-methods: GET, HEAD, OPTIONS
x-content-type-options: nosniff
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-hit-layer;desc="EDGE",cdn-rid;desc="cBg1LkB02kenEFHvC_EHLL1E7jDPf4RnqWrQgduS3Qs6yV1n_LtpoQ==",cdn-downstream-fbl=1
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Tue, 10 Dec 2024 17:43:18 GMT
content-type: application/octet-stream
x-amz-cf-id: cBg1LkB02kenEFHvC_EHLL1E7jDPf4RnqWrQgduS3Qs6yV1n_LtpoQ==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, immutable
timing-allow-origin: *
Content-Range: bytes 6919-10110/276280
referrer-policy: strict-origin-when-cross-origin
via: 1.1 0e37105a96e87c22ff4981659a6dc176.cloudfront.net (CloudFront)
access-control-allow-origin: *
Content-Length: 3192
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6

POST
H2 204 collect
region1.google-analytics.com/g/ 0
0 51ms
21ms Fetch
text/plain 2001:4860:4802:32::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.google-analytics.com/g/collect?v=2&tid=G-CKJY21YJ7N&gtm=45je4ca0v9166211784za200&_p=1733907446979&gcd=13l3l3l2l1l1&npa=1&dma_cps=syphamo&dma=1&tag_exp=101925629~102067555~102067808~102081485&cid=1280647228.1733907447&ul=de-de&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1733907447&sct=1&seg=0&dl=https%3A%2F%2Fhunt.io%2Fblog%2Frare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity&dt=Rare%20Watermark%20Links%20Cobalt%20Strike%204.10%20Team%20Servers%20to%20Ongoing%20Suspicious%20Activity&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=523
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CKJY21YJ7N
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:32::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hunt.io/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://hunt.io
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 11 Dec 2024 08:57:27 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 psEar9BZHC3V1ST6mGHxVJQfBxc.png
framerusercontent.com/images/ 391 B
1 KB 11ms
11ms Other
image/png 108.138.7.90
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/images/psEar9BZHC3V1ST6mGHxVJQfBxc.png

Protocol

Security

QUIC, , AES_128_GCM

Server

108.138.7.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-7-90.fra56.r.cloudfront.net

Software

Resource Hash

1444a7eaffad2eae4dd0999fb1fd4c308e51876b70db2c4f1181c8a038f1f859

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hunt.io/

Response headers

etag: "939ec6fdc5062f6529950c37ab817812"
age: 16914061
x-content-type-options: nosniff
x-amzn-requestid: b0ac55ce-81d8-4ec5-a63d-b4e0230c1b65
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-hit-layer;desc="EDGE",cdn-rid;desc="WyZzvPJ_HtOsGJlswDv5Cvah1yOCsGs7VhXzH-G9lbeKsxmuDNm6aw==",cdn-downstream-fbl=2
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Wed, 29 May 2024 14:36:26 GMT
content-type: image/png
vary: Accept
x-amz-cf-id: WyZzvPJ_HtOsGJlswDv5Cvah1yOCsGs7VhXzH-G9lbeKsxmuDNm6aw==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000, stale-while-revalidate=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-amzn-trace-id: root=1-66573d6a-4e285cd21e7c73b36b481c52;sampled=1;lineage=f456f256:0
content-security-policy-report-only: default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/reportOnly;
referrer-policy: strict-origin-when-cross-origin
via: 1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6

GET
H3 206 wvsIsx8BB-chunk-default-0.framercms Show response
framerusercontent.com/modules/drpNeVQopLY1P5khDike/dRsRwQIaLOAXxsU4RZSx/ 3 KB
4 KB 10ms
10ms Fetch
application/octet-stream 108.138.7.90
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/modules/drpNeVQopLY1P5khDike/dRsRwQIaLOAXxsU4RZSx/wvsIsx8BB-chunk-default-0.framercms

Requested by

Host: framerusercontent.com
URL: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-AIWW63AC.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

108.138.7.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-7-90.fra56.r.cloudfront.net

Software

Resource Hash

22b07807afbc388ecd51abfcbecb67055935c2e3b93ac4283a5becedd5e70621

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Range: bytes=235-3430
Referer: https://hunt.io/

Response headers

access-control-expose-headers: Content-Range
age: 54848
access-control-allow-methods: GET, HEAD, OPTIONS
x-content-type-options: nosniff
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-hit-layer;desc="EDGE",cdn-rid;desc="U54vJW2c_AcAuifYOUmj5WS4Ohz8SSpdDCOB5tMZBsCCTOKikGYRDg==",cdn-downstream-fbl=1
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Tue, 10 Dec 2024 17:43:19 GMT
content-type: application/octet-stream
x-amz-cf-id: U54vJW2c_AcAuifYOUmj5WS4Ohz8SSpdDCOB5tMZBsCCTOKikGYRDg==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, immutable
timing-allow-origin: *
Content-Range: bytes 235-3430/245022
referrer-policy: strict-origin-when-cross-origin
via: 1.1 0e37105a96e87c22ff4981659a6dc176.cloudfront.net (CloudFront)
access-control-allow-origin: *
Content-Length: 3196
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6

GET
H3 200 wvsIsx8BB-chunk-default-dict.framercms Show response
framerusercontent.com/modules/drpNeVQopLY1P5khDike/dRsRwQIaLOAXxsU4RZSx/ 31 KB
32 KB 11ms
11ms Fetch
application/octet-stream 108.138.7.90
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/modules/drpNeVQopLY1P5khDike/dRsRwQIaLOAXxsU4RZSx/wvsIsx8BB-chunk-default-dict.framercms

Requested by

Host: framerusercontent.com
URL: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-AIWW63AC.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

108.138.7.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-7-90.fra56.r.cloudfront.net

Software

Resource Hash

25aeb8cf020d602895b80560676fabfa34b3c350195a0660572b6c87d8c0c37d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hunt.io/

Response headers

access-control-expose-headers: Content-Range
age: 24443
access-control-allow-methods: GET, HEAD, OPTIONS
x-content-type-options: nosniff
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-hit-layer;desc="EDGE",cdn-rid;desc="LhELWwkdPnRbpU5EhtEeqesxwffrBQifBixdtOwn52SZ8mJUBpZahw==",cdn-downstream-fbl=2
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Wed, 11 Dec 2024 02:10:04 GMT
content-type: application/octet-stream
x-amz-cf-id: LhELWwkdPnRbpU5EhtEeqesxwffrBQifBixdtOwn52SZ8mJUBpZahw==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, immutable
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
via: 1.1 0e37105a96e87c22ff4981659a6dc176.cloudfront.net (CloudFront)
access-control-allow-origin: *
content-length: 32000
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6

GET
H3 206 wvsIsx8BB-indexes-default.framercms Show response
framerusercontent.com/modules/drpNeVQopLY1P5khDike/dRsRwQIaLOAXxsU4RZSx/ 1 KB
2 KB 10ms
10ms Fetch
application/octet-stream 108.138.7.90
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/modules/drpNeVQopLY1P5khDike/dRsRwQIaLOAXxsU4RZSx/wvsIsx8BB-indexes-default.framercms

Requested by

Host: framerusercontent.com
URL: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-AIWW63AC.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

108.138.7.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-7-90.fra56.r.cloudfront.net

Software

Resource Hash

9cc352a4d050c98f080c4ab6550f54f4d383c9509c902b666e64548d83a62471

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Range: bytes=0-1241
Referer: https://hunt.io/

Response headers

access-control-expose-headers: Content-Range
age: 54849
access-control-allow-methods: GET, HEAD, OPTIONS
x-content-type-options: nosniff
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-hit-layer;desc="EDGE",cdn-rid;desc="o7Q0C4cHweJzPbA7ZyVlKY0psZTPpR1Lj4lltTVBOqStkFVWgI0-Zw==",cdn-downstream-fbl=1
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Tue, 10 Dec 2024 17:43:18 GMT
content-type: application/octet-stream
x-amz-cf-id: o7Q0C4cHweJzPbA7ZyVlKY0psZTPpR1Lj4lltTVBOqStkFVWgI0-Zw==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, immutable
timing-allow-origin: *
Content-Range: bytes 0-1241/276280
referrer-policy: strict-origin-when-cross-origin
via: 1.1 0e37105a96e87c22ff4981659a6dc176.cloudfront.net (CloudFront)
access-control-allow-origin: *
Content-Length: 1242
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6

GET
H3

200

Sun.js Show response
framerusercontent.com/modules/wp6xzA2QrHTqCWJAsoKa/Hyhw8DdNtDxDqd366SY7/
Redirect Chain

https://framer.com/m/phosphor-icons/Sun.js@0.0.53
https://framerusercontent.com/modules/wp6xzA2QrHTqCWJAsoKa/Hyhw8DdNtDxDqd366SY7/Sun.js

5 KB
2 KB

11ms
11ms

Script
text/javascript

108.138.7.90
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/modules/wp6xzA2QrHTqCWJAsoKa/Hyhw8DdNtDxDqd366SY7/Sun.js

Protocol

Server

108.138.7.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-7-90.fra56.r.cloudfront.net

Software

Resource Hash

e77e2400288b5496592bb75f3d2c61871d947b1705f8a2d98c4bdea3a8ebbadd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://framerusercontent.com/

Response headers

access-control-expose-headers: Content-Range
content-encoding: br
age: 264666
access-control-allow-methods: GET, HEAD, OPTIONS
x-content-type-options: nosniff
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-hit-layer;desc="EDGE",cdn-rid;desc="dBW3EA5QXaMJreKdDL1Gf3uB5nFIEGjhCN34S601LNZUMIw9dNkFvw==",cdn-downstream-fbl=1
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Sun, 08 Dec 2024 07:26:21 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
x-amz-cf-id: dBW3EA5QXaMJreKdDL1Gf3uB5nFIEGjhCN34S601LNZUMIw9dNkFvw==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, immutable
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
via: 1.1 0e37105a96e87c22ff4981659a6dc176.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6

Redirect headers

access-control-expose-headers: Content-Range
age: 1284
access-control-allow-methods: GET, HEAD, OPTIONS
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: zdki7WCIpaa5QQRHaXUYjiC-12U5evRixYcrYsZ6UD6GdsOHG8yQUw==
date: Wed, 11 Dec 2024 08:36:03 GMT
content-type: text/html; charset=utf-8
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=3600
location: https://framerusercontent.com/modules/wp6xzA2QrHTqCWJAsoKa/Hyhw8DdNtDxDqd366SY7/Sun.js
referrer-policy: strict-origin-when-cross-origin
via: 1.1 413634bfcacd752107ee361d53948cee.cloudfront.net (CloudFront)
access-control-allow-origin: *
content-length: 109
x-xss-protection: 0
x-amz-cf-pop: FRA60-P8

GET
H3

200

Moon.js Show response
framerusercontent.com/modules/qdFz1d7MF7d8Wsxrv3Ew/tbOlJ2GGWCCiI25KWvfU/
Redirect Chain

https://framer.com/m/phosphor-icons/Moon.js@0.0.53
https://framerusercontent.com/modules/qdFz1d7MF7d8Wsxrv3Ew/tbOlJ2GGWCCiI25KWvfU/Moon.js

4 KB
2 KB

11ms
10ms

Script
text/javascript

108.138.7.90
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/modules/qdFz1d7MF7d8Wsxrv3Ew/tbOlJ2GGWCCiI25KWvfU/Moon.js

Protocol

Server

108.138.7.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-7-90.fra56.r.cloudfront.net

Software

Resource Hash

cf51594b76c66c43206e9aa471baec6a92594ea6b8cbead1b40f445468de76e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://framerusercontent.com/

Response headers

access-control-expose-headers: Content-Range
content-encoding: br
age: 520872
access-control-allow-methods: GET, HEAD, OPTIONS
x-content-type-options: nosniff
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-hit-layer;desc="EDGE",cdn-rid;desc="IYmfCsPrZxPKBjGgw4xoMkJpT0wbf__7Qm1Yp5NvgblhorTB-6LkiA==",cdn-downstream-fbl=2
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Thu, 05 Dec 2024 08:16:15 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
x-amz-cf-id: IYmfCsPrZxPKBjGgw4xoMkJpT0wbf__7Qm1Yp5NvgblhorTB-6LkiA==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, immutable
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
via: 1.1 0e37105a96e87c22ff4981659a6dc176.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6

Redirect headers

access-control-expose-headers: Content-Range
age: 3155
access-control-allow-methods: GET, HEAD, OPTIONS
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: FCbLaJeNN2fPfzi67q-nh9B8MXCTSUdVlGBCyoiKAyTmVjIQ8TDn_w==
date: Wed, 11 Dec 2024 08:04:52 GMT
content-type: text/html; charset=utf-8
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=3600
location: https://framerusercontent.com/modules/qdFz1d7MF7d8Wsxrv3Ew/tbOlJ2GGWCCiI25KWvfU/Moon.js
referrer-policy: strict-origin-when-cross-origin
via: 1.1 413634bfcacd752107ee361d53948cee.cloudfront.net (CloudFront)
access-control-allow-origin: *
content-length: 110
x-xss-protection: 0
x-amz-cf-pop: FRA60-P8

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://public-hunt-static-blog-assets.s3.us-east-1.amazonaws.com/12-2024/figure_1_screenshot_showing_the_i_button_which_allows_users_to_quickly_view_beacon_configurations_without_downloading_them_in_hunt__1x.webp
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 54.231.192.10 Ashburn, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: s3-us-east-1-r-w.amazonaws.com
Software: AmazonS3 /
Resource Hash: 22e5cfd55973895f60a7f6bf877482dc964962f8dd778612fc149bed56112bc1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hunt.io/

Response headers

x-amz-id-2: Cw0v4oJi8v/5GvCfcpHVfpzW43oyhAHLRS/dUgVWXTys67NTuki5XIEV7jV2bhWwo2+j9dE6+RM=
ETag: "5a63fbd9ea0b1ac71babd58c221894d8"
x-amz-request-id: CF6221M7GG19JJ95
Accept-Ranges: bytes
Content-Length: 17688
Date: Wed, 11 Dec 2024 08:57:28 GMT
Last-Modified: Tue, 03 Dec 2024 14:45:58 GMT
Content-Type: image/webp
Server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H3 206 wvsIsx8BB-indexes-default.framercms Show response
framerusercontent.com/modules/drpNeVQopLY1P5khDike/dRsRwQIaLOAXxsU4RZSx/ 596 B
1 KB 10ms
9ms Fetch
application/octet-stream 108.138.7.90
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/modules/drpNeVQopLY1P5khDike/dRsRwQIaLOAXxsU4RZSx/wvsIsx8BB-indexes-default.framercms

Requested by

Host: framerusercontent.com
URL: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-AIWW63AC.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

108.138.7.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-7-90.fra56.r.cloudfront.net

Software

Resource Hash

f0f40885a14cd51f7d572952787c67b7c3e51399c2107171bb1bf741d22a6989

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Range: bytes=13806-14401
Referer: https://hunt.io/

Response headers

access-control-expose-headers: Content-Range
age: 54849
access-control-allow-methods: GET, HEAD, OPTIONS
x-content-type-options: nosniff
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-hit-layer;desc="EDGE",cdn-rid;desc="evVlkvIQ7bjv_R4Mu_kLeyXZ-d3IQPfJW2x68CZwKM7zC2lmfSPSAg==",cdn-downstream-fbl=1
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Tue, 10 Dec 2024 17:43:18 GMT
content-type: application/octet-stream
x-amz-cf-id: evVlkvIQ7bjv_R4Mu_kLeyXZ-d3IQPfJW2x68CZwKM7zC2lmfSPSAg==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, immutable
timing-allow-origin: *
Content-Range: bytes 13806-14401/276280
referrer-policy: strict-origin-when-cross-origin
via: 1.1 0e37105a96e87c22ff4981659a6dc176.cloudfront.net (CloudFront)
access-control-allow-origin: *
Content-Length: 596
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6

GET
H3 206 wvsIsx8BB-chunk-default-0.framercms Show response
framerusercontent.com/modules/drpNeVQopLY1P5khDike/dRsRwQIaLOAXxsU4RZSx/ 10 KB
11 KB 10ms
10ms Fetch
multipart/byteranges 108.138.7.90
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/modules/drpNeVQopLY1P5khDike/dRsRwQIaLOAXxsU4RZSx/wvsIsx8BB-chunk-default-0.framercms

Requested by

Host: framerusercontent.com
URL: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-AIWW63AC.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

108.138.7.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-7-90.fra56.r.cloudfront.net

Software

Resource Hash

b2e327509e3ce6cf9c6d9b0bd8dd0a7e3c56719626807622bd85c9e7b5fd2dc9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Range: bytes=4-113,51476-56009,157655-160448,167285-170009
Referer: https://hunt.io/

Response headers

access-control-expose-headers: Content-Range
age: 54848
access-control-allow-methods: GET, HEAD, OPTIONS
x-content-type-options: nosniff
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-hit-layer;desc="EDGE",cdn-rid;desc="0EQc65KkZ6J0ycsrJ-zHpJpgeExxeeoqBnEmp7My4rI1X7RV50B4ZQ==",cdn-downstream-fbl=1
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Tue, 10 Dec 2024 17:43:19 GMT
content-type: multipart/byteranges; boundary=CloudFront:4381BAA570D92B17AF09862FBDD2DFEC
x-amz-cf-id: 0EQc65KkZ6J0ycsrJ-zHpJpgeExxeeoqBnEmp7My4rI1X7RV50B4ZQ==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, immutable
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
via: 1.1 0e37105a96e87c22ff4981659a6dc176.cloudfront.net (CloudFront)
access-control-allow-origin: *
content-length: 10740
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6

OPTIONS
H3 200 wvsIsx8BB-chunk-default-0.framercms
framerusercontent.com/modules/drpNeVQopLY1P5khDike/dRsRwQIaLOAXxsU4RZSx/ 0
0 10ms
9ms Preflight 108.138.7.90
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/modules/drpNeVQopLY1P5khDike/dRsRwQIaLOAXxsU4RZSx/wvsIsx8BB-chunk-default-0.framercms

Protocol

Security

QUIC, , AES_128_GCM

Server

108.138.7.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-7-90.fra56.r.cloudfront.net

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: range
Access-Control-Request-Method: GET
Origin: https://hunt.io
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Range
access-control-allow-methods: GET, HEAD, OPTIONS
access-control-allow-origin: *
access-control-expose-headers: Content-Range
access-control-max-age: 600
age: 24444
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Wed, 11 Dec 2024 02:10:03 GMT
referrer-policy: strict-origin-when-cross-origin
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-hit-layer;desc="EDGE",cdn-rid;desc="-UokWC4fBFP5c71JMiBS-mPlCsuqBeuHDVwcoT6JLqeqhS1CqFNyGw==",cdn-downstream-fbl=2
strict-transport-security: max-age=31536000; includeSubDomains; preload
timing-allow-origin: *
via: 1.1 0e37105a96e87c22ff4981659a6dc176.cloudfront.net (CloudFront)
x-amz-cf-id: -UokWC4fBFP5c71JMiBS-mPlCsuqBeuHDVwcoT6JLqeqhS1CqFNyGw==
x-amz-cf-pop: FRA56-P6
x-cache: Hit from cloudfront
x-content-type-options: nosniff
x-frame-options: deny
x-xss-protection: 0

GET
H2 200 fOXtYSvzsNlw0tzPVKMsf72n0.png
framerusercontent.com/images/ 24 KB
0 0ms
0ms Image
image/avif 2600:9000:2490:3c00:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://framerusercontent.com/images/fOXtYSvzsNlw0tzPVKMsf72n0.png?scale-down-to=2048

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2490:3c00:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

e1d4e429bec9bc36a28143018ae0400faee2ea7ffe9442942794e016a094220c

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hunt.io/

Response headers

etag: "a5fd6921c78d186fd22e12abbea6a593"
age: 16491604
x-content-type-options: nosniff
x-amzn-requestid: 9df5ba47-2ec8-4bec-96e9-11a9fef30e48
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: zS8J6Cga8RLNPiSmclpN0xTrIw8SjgfVxx25nXDimEeLBMQxjwswLA==
date: Mon, 03 Jun 2024 11:57:23 GMT
content-type: image/avif
vary: Accept
x-frame-options: deny
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-rid;desc="zS8J6Cga8RLNPiSmclpN0xTrIw8SjgfVxx25nXDimEeLBMQxjwswLA==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=5
cache-control: public, max-age=31536000, stale-while-revalidate=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-amzn-trace-id: root=1-665dafa2-42d508f768a18ae373bdb131;sampled=1;lineage=f456f256:0
content-security-policy-report-only: default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/reportOnly;
via: 1.1 1c7275102c069b3b4bff7bcc191ded2e.cloudfront.net (CloudFront)
referrer-policy: strict-origin-when-cross-origin
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6

GET
H3 206 wvsIsx8BB-chunk-default-0.framercms Show response
framerusercontent.com/modules/drpNeVQopLY1P5khDike/dRsRwQIaLOAXxsU4RZSx/ 121 B
653 B 10ms
10ms Fetch
application/octet-stream 108.138.7.90
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/modules/drpNeVQopLY1P5khDike/dRsRwQIaLOAXxsU4RZSx/wvsIsx8BB-chunk-default-0.framercms

Requested by

Host: framerusercontent.com
URL: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-AIWW63AC.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

108.138.7.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-7-90.fra56.r.cloudfront.net

Software

Resource Hash

b9f9ff04701407e5098517bed58cd91737b23cb35f8d9b2a9554b46dca8d8e13

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Range: bytes=114-234
Referer: https://hunt.io/

Response headers

access-control-expose-headers: Content-Range
age: 54848
access-control-allow-methods: GET, HEAD, OPTIONS
x-content-type-options: nosniff
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-hit-layer;desc="EDGE",cdn-rid;desc="IhlXS7gqaZR0gZx4MwpiGIEIbMRtURS1k5Pw3tx-RqoeraegHrsHmg==",cdn-downstream-fbl=2
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Tue, 10 Dec 2024 17:43:19 GMT
content-type: application/octet-stream
x-amz-cf-id: IhlXS7gqaZR0gZx4MwpiGIEIbMRtURS1k5Pw3tx-RqoeraegHrsHmg==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, immutable
timing-allow-origin: *
Content-Range: bytes 114-234/245022
referrer-policy: strict-origin-when-cross-origin
via: 1.1 0e37105a96e87c22ff4981659a6dc176.cloudfront.net (CloudFront)
access-control-allow-origin: *
Content-Length: 121
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6

GET
H2 200 yVA9Oy9wbaBjaChzIOH78YiSFE.webp
framerusercontent.com/images/ 8 KB
0 0ms
0ms Image
image/avif 2600:9000:2490:3c00:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://framerusercontent.com/images/yVA9Oy9wbaBjaChzIOH78YiSFE.webp?scale-down-to=512

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2490:3c00:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a741fd3317fed44c0f1c7b8161f1420298b044e564dfea131957c0e27982a66c

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/enforce;
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hunt.io/

Response headers

etag: "7231b098b0757259dd2bbfd90a7fb0f9"
age: 671301
x-content-type-options: nosniff
x-amzn-requestid: 3de1bf36-0c6a-42e8-bf76-49da9ceef860
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: MliSbB1zCQ8X9-F3_Y7QxNf9pZCHtY53lOZBKJRI-a7mTQhkDtBB0Q==
date: Tue, 03 Dec 2024 14:29:06 GMT
content-type: image/avif
vary: Accept
x-frame-options: deny
content-security-policy: default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/enforce;
cache-control: public, max-age=31536000, stale-while-revalidate=31536000
timing-allow-origin: *
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-rid;desc="MliSbB1zCQ8X9-F3_Y7QxNf9pZCHtY53lOZBKJRI-a7mTQhkDtBB0Q==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=4
cross-origin-resource-policy: cross-origin
x-amzn-trace-id: Root=1-674f15b1-78bc758e7f872fa50e191290;Sampled=1;Lineage=1:f456f256:0
referrer-policy: strict-origin-when-cross-origin
via: 1.1 1c7275102c069b3b4bff7bcc191ded2e.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6

GET
H2 200 6odJFlTcHq1fzIBehjj2s4p9DY.webp
framerusercontent.com/images/ 7 KB
0 0ms
0ms Image
image/avif 2600:9000:2490:3c00:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://framerusercontent.com/images/6odJFlTcHq1fzIBehjj2s4p9DY.webp?scale-down-to=512

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2490:3c00:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

4dc2a5162f03c1768634a7d933f034a800807b5324368e398cdbfc038a06d395

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/enforce;
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hunt.io/

Response headers

etag: "b3fc6d3f97ac740ee5904dc1c19ead8d"
age: 673444
x-content-type-options: nosniff
x-amzn-requestid: bcf9756b-a7f3-480e-9de4-39e71cd81437
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: s5XHUaNdZl5vtFCWMnA0EZm0-kpP8LQcCb97mn7N1Jxsk43i36_0bQ==
date: Tue, 03 Dec 2024 13:53:23 GMT
content-type: image/avif
vary: Accept
x-frame-options: deny
content-security-policy: default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/enforce;
cache-control: public, max-age=31536000, stale-while-revalidate=31536000
timing-allow-origin: *
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-rid;desc="s5XHUaNdZl5vtFCWMnA0EZm0-kpP8LQcCb97mn7N1Jxsk43i36_0bQ==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=4
cross-origin-resource-policy: cross-origin
x-amzn-trace-id: Root=1-674f0d52-3771963431d7a22b4add2727;Parent=1f553ee76613da3a;Sampled=0;Lineage=1:f456f256:0
referrer-policy: strict-origin-when-cross-origin
via: 1.1 1c7275102c069b3b4bff7bcc191ded2e.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6

GET
H2 200 cJA8dVwYG5AXjO4aXVKQ9QdZFg.webp
framerusercontent.com/images/ 8 KB
0 0ms
0ms Image
image/avif 2600:9000:2490:3c00:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://framerusercontent.com/images/cJA8dVwYG5AXjO4aXVKQ9QdZFg.webp?scale-down-to=512

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2490:3c00:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

341f61d7c3838f9e303327f41376afcc21e5e7e5d5408b795be682dcd97cde43

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/enforce;
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hunt.io/

Response headers

etag: "e1a9183cb012ee35efa98e49b5e794c7"
age: 673444
x-content-type-options: nosniff
x-amzn-requestid: ccc06360-8d94-47a9-b091-1b302a6ae954
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: hpU7RbOi7N96E-F7c64RTDzvcNys6yFOfUxcLMqAeemCHZ7IoVodbg==
date: Tue, 03 Dec 2024 13:53:23 GMT
content-type: image/avif
vary: Accept
x-frame-options: deny
content-security-policy: default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/enforce;
cache-control: public, max-age=31536000, stale-while-revalidate=31536000
timing-allow-origin: *
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-rid;desc="hpU7RbOi7N96E-F7c64RTDzvcNys6yFOfUxcLMqAeemCHZ7IoVodbg==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=5
cross-origin-resource-policy: cross-origin
x-amzn-trace-id: Root=1-674f0d52-337d67ec3b1a02f00d068755;Sampled=1;Lineage=1:f456f256:0
referrer-policy: strict-origin-when-cross-origin
via: 1.1 1c7275102c069b3b4bff7bcc191ded2e.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6

GET
H3 200 2iZKHFgbhhPbSXPJTCZSAjibSz0.webp
framerusercontent.com/images/ 72 KB
73 KB 10ms
10ms Image
image/avif 108.138.7.90
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://framerusercontent.com/images/2iZKHFgbhhPbSXPJTCZSAjibSz0.webp

Requested by

Host: framerusercontent.com
URL: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-7PZR57LV.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

108.138.7.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-7-90.fra56.r.cloudfront.net

Software

Resource Hash

f64db61461a61be895b05212054704844b4d20a9da93fc0349b2f0e8046002a8

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/enforce;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hunt.io/

Response headers

etag: "7ea5391ef5d57b06e20f5613414f4349"
age: 69026
x-content-type-options: nosniff
x-amzn-requestid: fe09f424-6c55-4446-8e37-76a364637f7e
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-hit-layer;desc="EDGE",cdn-rid;desc="oZI_Ng92HOUOPsK_HJOMdXTF2TilFIY0GnNCjagGVww3v9P6F-xxXw==",cdn-downstream-fbl=2
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Tue, 10 Dec 2024 13:47:01 GMT
content-type: image/avif
vary: Accept
x-amz-cf-id: oZI_Ng92HOUOPsK_HJOMdXTF2TilFIY0GnNCjagGVww3v9P6F-xxXw==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/enforce;
cache-control: public, max-age=31536000, stale-while-revalidate=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-amzn-trace-id: Root=1-67584651-01f645fe4ab0c3500efc6e41;Parent=57bba260d735a1c8;Sampled=0;Lineage=1:f456f256:0
referrer-policy: strict-origin-when-cross-origin
via: 1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6

GET
H3 200 XFsFr3Y6HDDfkPLgSPRuhldm2g.webp
framerusercontent.com/images/ 67 KB
68 KB 12ms
12ms Image
image/avif 108.138.7.90
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://framerusercontent.com/images/XFsFr3Y6HDDfkPLgSPRuhldm2g.webp

Requested by

Host: framerusercontent.com
URL: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-7PZR57LV.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

108.138.7.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-7-90.fra56.r.cloudfront.net

Software

Resource Hash

baec8ef28ee7d04e84305e579a7a397af272c2b2694b3e2879ea01a14c16a76a

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/enforce;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hunt.io/

Response headers

etag: "71eb302e38ef24d00d5643fd1bc5d3f7"
age: 416274
x-content-type-options: nosniff
x-amzn-requestid: c6d044ef-f595-45f2-b700-9b4097e2c470
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-hit-layer;desc="EDGE",cdn-rid;desc="ezfsNtE9l0KZJ5ELiLSIIR-0D7sg-S_fE9YVZzwSSsrjkV3Tiubx7w==",cdn-downstream-fbl=2
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Fri, 06 Dec 2024 13:19:33 GMT
content-type: image/avif
vary: Accept
x-amz-cf-id: ezfsNtE9l0KZJ5ELiLSIIR-0D7sg-S_fE9YVZzwSSsrjkV3Tiubx7w==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/enforce;
cache-control: public, max-age=31536000, stale-while-revalidate=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-amzn-trace-id: Root=1-6752f9e0-60292b0832e951d5426436f8;Sampled=1;Lineage=1:f456f256:0
referrer-policy: strict-origin-when-cross-origin
via: 1.1 d05d62f18b6532eb36f4d53b3337857c.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6

GET
H2 200 Wbt9vg2M3MLSUK6C8ZimtsouOws.webp
framerusercontent.com/images/ 52 KB
0 0ms
0ms Image
image/avif 2600:9000:2490:3c00:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://framerusercontent.com/images/Wbt9vg2M3MLSUK6C8ZimtsouOws.webp

Requested by

Host: framerusercontent.com
URL: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-7PZR57LV.mjs

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:2490:3c00:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

af40af5e1469d7ef41aee9645556b634ada06969e8a9babf4d4e17c38aad2caf

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/enforce;
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hunt.io/

Response headers

etag: "294afbee86a7b816bb58ca4b178d9a09"
age: 673445
x-content-type-options: nosniff
x-amzn-requestid: 0a40e9b2-0af7-4bf3-be26-e644a48199c7
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: FUmyzr87njPoeZ3WGO4b-BFe-xo7gfXY5eEeV50ES3SyCoFRO-1S2w==
date: Tue, 03 Dec 2024 13:53:22 GMT
content-type: image/avif
vary: Accept
x-frame-options: deny
content-security-policy: default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/enforce;
cache-control: public, max-age=31536000, stale-while-revalidate=31536000
timing-allow-origin: *
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-rid;desc="FUmyzr87njPoeZ3WGO4b-BFe-xo7gfXY5eEeV50ES3SyCoFRO-1S2w==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=2
cross-origin-resource-policy: cross-origin
x-amzn-trace-id: Root=1-674f0d51-557acc861003e14f1c9dff39;Sampled=1;Lineage=1:f456f256:0
referrer-policy: strict-origin-when-cross-origin
via: 1.1 1c7275102c069b3b4bff7bcc191ded2e.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6

GET
H3 200 Jl3Kv7P-kDAXGrkG_Y3TePXcWEHsZdHVwzyhfgdi4S8.AXOWFRVS.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 97 KB
13 KB 12ms
12ms Script
text/javascript 108.138.7.90
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/Jl3Kv7P-kDAXGrkG_Y3TePXcWEHsZdHVwzyhfgdi4S8.AXOWFRVS.mjs

Requested by

Host: framerusercontent.com
URL: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/script_main.DVS43U5Q.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

108.138.7.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-7-90.fra56.r.cloudfront.net

Software

CloudFront /

Resource Hash

bece75fc8837c8a539530ef23fa0597efe496fb7d07b7087ed78f7a4a6ea0ceb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/script_main.DVS43U5Q.mjs

Response headers

access-control-max-age: 0
content-encoding: br
etag: W/"e2db15eaef96000994d25addf69aa280"
x-amz-version-id: z7JXogl.eXjBn7hF50LEXSemQ.yPc_fu
age: 59832
access-control-allow-methods: GET
x-content-type-options: nosniff
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-hit-layer;desc="EDGE",cdn-rid;desc="2oGIh4f6v0C9bTfNm-APHl9DBAK1rV9RZ6quCR_FI648T2nDOStwgw==",cdn-downstream-fbl=3
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Tue, 10 Dec 2024 16:20:17 GMT
content-type: text/javascript
last-modified: Tue, 10 Dec 2024 16:09:28 GMT
vary: Accept-Encoding,Origin
x-amz-cf-id: 2oGIh4f6v0C9bTfNm-APHl9DBAK1rV9RZ6quCR_FI648T2nDOStwgw==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: PENDING
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 0e37105a96e87c22ff4981659a6dc176.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H3 200 zhL8nU7XNNGFRlAIY2FM-h62K_VrrSiSRyTqnUBhnM8.REHR67NR.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 41 KB
8 KB 16ms
15ms Script
text/javascript 108.138.7.90
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/zhL8nU7XNNGFRlAIY2FM-h62K_VrrSiSRyTqnUBhnM8.REHR67NR.mjs

Requested by

Host: framerusercontent.com
URL: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/script_main.DVS43U5Q.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

108.138.7.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-7-90.fra56.r.cloudfront.net

Software

CloudFront /

Resource Hash

e96570316195a9f6d9ae66ad55325d340e90ca1563bff1972640b2e0435002f2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/script_main.DVS43U5Q.mjs

Response headers

access-control-max-age: 0
content-encoding: br
etag: W/"2a7526581ccd8f89b484d69b0f7f8c1c"
x-amz-version-id: s5XJaIOc6aIR_U1IsAO504Wz.MLo_krr
age: 59066
access-control-allow-methods: GET
x-content-type-options: nosniff
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-hit-layer;desc="EDGE",cdn-rid;desc="G3ltr9o2MMqw2krP5olQVCcImvfFseYn7xqwyr9kvgEUi23oQU2zmA==",cdn-downstream-fbl=4
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Tue, 10 Dec 2024 16:33:03 GMT
content-type: text/javascript
last-modified: Tue, 10 Dec 2024 16:09:27 GMT
vary: Accept-Encoding,Origin
x-amz-cf-id: G3ltr9o2MMqw2krP5olQVCcImvfFseYn7xqwyr9kvgEUi23oQU2zmA==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 0e37105a96e87c22ff4981659a6dc176.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H3 200 zf7oaQsVisvCUlpUMhEzxzxL1qwjjWU7pRoRegRYu8A.4QUJHPOE.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 45 KB
8 KB 12ms
12ms Script
text/javascript 108.138.7.90
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/zf7oaQsVisvCUlpUMhEzxzxL1qwjjWU7pRoRegRYu8A.4QUJHPOE.mjs

Requested by

Host: framerusercontent.com
URL: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/script_main.DVS43U5Q.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

108.138.7.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-7-90.fra56.r.cloudfront.net

Software

CloudFront /

Resource Hash

831ed047a786cb3bd6a4a3ee93e8457242ee53207b0d04c3b66a3f9899dd78bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/script_main.DVS43U5Q.mjs

Response headers

access-control-max-age: 0
content-encoding: br
etag: W/"a8b232442f006891ea01135e0614294c"
x-amz-version-id: rRHUF1XfR3W7MbiJXLvdmoj6zH8UT8Cc
age: 59066
access-control-allow-methods: GET
x-content-type-options: nosniff
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-hit-layer;desc="EDGE",cdn-rid;desc="4myp0VxHzyl_bJruq6t_MqXCHJ_DB1IrBFJOLXTkxiDee2uzmjwnqQ==",cdn-downstream-fbl=3
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Tue, 10 Dec 2024 16:33:03 GMT
content-type: text/javascript
last-modified: Tue, 10 Dec 2024 16:09:27 GMT
vary: Accept-Encoding,Origin
x-amz-cf-id: 4myp0VxHzyl_bJruq6t_MqXCHJ_DB1IrBFJOLXTkxiDee2uzmjwnqQ==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 0e37105a96e87c22ff4981659a6dc176.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H3 200 uGlNsLGsxLbZSRZ1mvzu3m0ZuvxWi0UMM-zLyu4GSN4.ASBAZL5M.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 74 KB
11 KB 15ms
15ms Script
text/javascript 108.138.7.90
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/uGlNsLGsxLbZSRZ1mvzu3m0ZuvxWi0UMM-zLyu4GSN4.ASBAZL5M.mjs

Requested by

Host: framerusercontent.com
URL: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/script_main.DVS43U5Q.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

108.138.7.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-7-90.fra56.r.cloudfront.net

Software

CloudFront /

Resource Hash

dae44b82855ff15075c37f13f6492e3407e86c9bf27bf8c06b5e7f6dc7739238

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/script_main.DVS43U5Q.mjs

Response headers

access-control-max-age: 0
content-encoding: br
etag: W/"035ebdba59ce6411283ae98079fa0855"
x-amz-version-id: Z337c7i8vuZTkZNihwozhfw7558OJnO4
age: 59066
access-control-allow-methods: GET
x-content-type-options: nosniff
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-hit-layer;desc="EDGE",cdn-rid;desc="xQzFkUX0QAo3Y48JJt-kPz18QdoH3gtJCtq36A2tWNipXlsqiDIYOg==",cdn-downstream-fbl=3
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Tue, 10 Dec 2024 16:33:03 GMT
content-type: text/javascript
last-modified: Tue, 10 Dec 2024 16:09:28 GMT
vary: Accept-Encoding,Origin
x-amz-cf-id: xQzFkUX0QAo3Y48JJt-kPz18QdoH3gtJCtq36A2tWNipXlsqiDIYOg==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 0e37105a96e87c22ff4981659a6dc176.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H3 200 pRiwASxP9OJsmj9eXZodYhMZRAVY5w9eI5HAcshw2Vw.BBMY7BTJ.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 91 KB
13 KB 12ms
12ms Script
text/javascript 108.138.7.90
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/pRiwASxP9OJsmj9eXZodYhMZRAVY5w9eI5HAcshw2Vw.BBMY7BTJ.mjs

Requested by

Host: framerusercontent.com
URL: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/script_main.DVS43U5Q.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

108.138.7.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-7-90.fra56.r.cloudfront.net

Software

CloudFront /

Resource Hash

7734581c037aa18ef75406de8fe8447d0194e730d674fa4670495be8982f366d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/script_main.DVS43U5Q.mjs

Response headers

access-control-max-age: 0
content-encoding: br
etag: W/"db314f045a5d16008ccacbbbd422ba78"
x-amz-version-id: LknprcHoG9RIWtDgcrp.U4ud8fUJoXsL
age: 58965
access-control-allow-methods: GET
x-content-type-options: nosniff
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-hit-layer;desc="EDGE",cdn-rid;desc="DCUK9HNaXJmIRpkQFN64sbmQgv7YALjj3JNy_E8PZ4KV9cH3LvwkDA==",cdn-downstream-fbl=3
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Tue, 10 Dec 2024 16:34:43 GMT
content-type: text/javascript
last-modified: Tue, 10 Dec 2024 16:09:27 GMT
vary: Accept-Encoding,Origin
x-amz-cf-id: DCUK9HNaXJmIRpkQFN64sbmQgv7YALjj3JNy_E8PZ4KV9cH3LvwkDA==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 0e37105a96e87c22ff4981659a6dc176.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H3 200 chunk-W7PAJESI.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 997 B
2 KB 11ms
11ms Script
text/javascript 108.138.7.90
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-W7PAJESI.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

QUIC, , AES_128_GCM

Server

108.138.7.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-7-90.fra56.r.cloudfront.net

Software

CloudFront /

Resource Hash

fd2c9f5458dff3221f07b1f32bb05b7d9fbf9e9f435448ed14ed1c273d0e493e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/zf7oaQsVisvCUlpUMhEzxzxL1qwjjWU7pRoRegRYu8A.4QUJHPOE.mjs

Response headers

access-control-max-age: 0
etag: "7840196577db9a0c47d25a45b1404bd5"
x-amz-version-id: QgHE8RSGZjupsxwZfhUKEXtU06V8c9l9
age: 1097054
access-control-allow-methods: GET
x-content-type-options: nosniff
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-hit-layer;desc="EDGE",cdn-rid;desc="Y8KXmClW2Xyw78sJ7Ar03Z-ptxtHfGImFAJih_c0p_Pe5vCr0V0tqw==",cdn-downstream-fbl=2
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Thu, 28 Nov 2024 16:13:15 GMT
content-type: text/javascript
last-modified: Thu, 28 Nov 2024 15:59:29 GMT
vary: Origin
x-amz-cf-id: Y8KXmClW2Xyw78sJ7Ar03Z-ptxtHfGImFAJih_c0p_Pe5vCr0V0tqw==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 0e37105a96e87c22ff4981659a6dc176.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 997
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H3 200 chunk-3OHOHP5K.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 1 KB
1 KB 11ms
11ms Script
text/javascript 108.138.7.90
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-3OHOHP5K.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

QUIC, , AES_128_GCM

Server

108.138.7.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-7-90.fra56.r.cloudfront.net

Software

CloudFront /

Resource Hash

85423271cadc50e7a8873249d3ece6c62b3180112ac657e66347ce4241d31dc9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/Jl3Kv7P-kDAXGrkG_Y3TePXcWEHsZdHVwzyhfgdi4S8.AXOWFRVS.mjs

Response headers

access-control-max-age: 0
content-encoding: br
etag: W/"0d3db3f4c9f52ed4383abbcc60719616"
x-amz-version-id: RGc_Ws_DDVt19gqO4V500uKpAg8wxHba
age: 3676108
access-control-allow-methods: GET
x-content-type-options: nosniff
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-hit-layer;desc="EDGE",cdn-rid;desc="6kOrn_6_H8gbDxV2YLyFNZtSjRfhVV5W_o5vYd0n5hBZqQ1kH1qSqg==",cdn-downstream-fbl=2
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Tue, 29 Oct 2024 19:49:00 GMT
content-type: text/javascript
last-modified: Tue, 29 Oct 2024 18:16:43 GMT
vary: Accept-Encoding,Origin
x-amz-cf-id: 6kOrn_6_H8gbDxV2YLyFNZtSjRfhVV5W_o5vYd0n5hBZqQ1kH1qSqg==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 0e37105a96e87c22ff4981659a6dc176.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H3 200 chunk-2MP2Z6KV.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 993 B
2 KB 11ms
11ms Script
text/javascript 108.138.7.90
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-2MP2Z6KV.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

QUIC, , AES_128_GCM

Server

108.138.7.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-7-90.fra56.r.cloudfront.net

Software

CloudFront /

Resource Hash

20f16f669e39ddc2f4fce46463481ec43157c6d23258ec2f59f32a23c3d66a8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/pRiwASxP9OJsmj9eXZodYhMZRAVY5w9eI5HAcshw2Vw.BBMY7BTJ.mjs

Response headers

access-control-max-age: 0
etag: "a0270dad90dd051af03ad27f756ce88b"
x-amz-version-id: Xa6i0f68HFqGuYAYsjcBEL8VNbvS_6X7
age: 4084572
access-control-allow-methods: GET
x-content-type-options: nosniff
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-hit-layer;desc="EDGE",cdn-rid;desc="EQO9JAKgmSf0wV3lXXnHrmqU6mAgXYBgAfkZDmBQC-33jr1tSm5nAg==",cdn-downstream-fbl=3
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Fri, 25 Oct 2024 02:21:17 GMT
content-type: text/javascript
last-modified: Thu, 24 Oct 2024 17:21:26 GMT
vary: Origin
x-amz-cf-id: EQO9JAKgmSf0wV3lXXnHrmqU6mAgXYBgAfkZDmBQC-33jr1tSm5nAg==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 0e37105a96e87c22ff4981659a6dc176.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 993
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H3 200 chunk-BLPGJRRP.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 16 KB
4 KB 12ms
12ms Script
text/javascript 108.138.7.90
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-BLPGJRRP.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

QUIC, , AES_128_GCM

Server

108.138.7.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-7-90.fra56.r.cloudfront.net

Software

CloudFront /

Resource Hash

2559a88e000cccc51219cf9871ce1762dad455a8a76d0cb1d13821e0664b39dd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/pRiwASxP9OJsmj9eXZodYhMZRAVY5w9eI5HAcshw2Vw.BBMY7BTJ.mjs

Response headers

access-control-max-age: 0
content-encoding: br
etag: W/"b00a0c4ceb4d020cc933396dce6edc73"
x-amz-version-id: cPYhPK3VErO5rbUfXuZ2_cikxBRMYjUB
age: 59067
access-control-allow-methods: GET
x-content-type-options: nosniff
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-hit-layer;desc="EDGE",cdn-rid;desc="sHTLP2AzVRqyOYI3xRn5kcdY4Ka4piurdgNQgFv8IIwCdvn4NcVpgQ==",cdn-downstream-fbl=2
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Tue, 10 Dec 2024 16:33:02 GMT
content-type: text/javascript
last-modified: Tue, 10 Dec 2024 16:09:27 GMT
vary: Accept-Encoding,Origin
x-amz-cf-id: sHTLP2AzVRqyOYI3xRn5kcdY4Ka4piurdgNQgFv8IIwCdvn4NcVpgQ==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 0e37105a96e87c22ff4981659a6dc176.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H3 200 chunk-75KC3OJW.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 999 B
2 KB 11ms
11ms Script
text/javascript 108.138.7.90
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-75KC3OJW.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

QUIC, , AES_128_GCM

Server

108.138.7.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-7-90.fra56.r.cloudfront.net

Software

CloudFront /

Resource Hash

f8c7aece584727904d9ece558d571f0a745d505013a200a9e4382d293401e840

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/zhL8nU7XNNGFRlAIY2FM-h62K_VrrSiSRyTqnUBhnM8.REHR67NR.mjs

Response headers

access-control-max-age: 0
etag: "c8efc240356389f13cecc167c1012996"
x-amz-version-id: 384fSgCaLNTCw8vS0a1jU0vO3hVbg5BA
age: 1097054
access-control-allow-methods: GET
x-content-type-options: nosniff
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-hit-layer;desc="EDGE",cdn-rid;desc="j5PoA9B--7LPzFtfjZ9-2acUZ_VhGJ_VTFXSTqlKoSBJxRDjkIq6lA==",cdn-downstream-fbl=2
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Thu, 28 Nov 2024 16:13:15 GMT
content-type: text/javascript
last-modified: Thu, 28 Nov 2024 15:59:29 GMT
vary: Origin
x-amz-cf-id: j5PoA9B--7LPzFtfjZ9-2acUZ_VhGJ_VTFXSTqlKoSBJxRDjkIq6lA==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 0e37105a96e87c22ff4981659a6dc176.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 999
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H3 200 chunk-2GYV7IVM.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 933 B
2 KB 13ms
12ms Script
text/javascript 108.138.7.90
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-2GYV7IVM.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

QUIC, , AES_128_GCM

Server

108.138.7.90 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-108-138-7-90.fra56.r.cloudfront.net

Software

CloudFront /

Resource Hash

195e5840ca8966eb3ab97a9eb1582e7375d49810416f043dd8378af918367b9f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/uGlNsLGsxLbZSRZ1mvzu3m0ZuvxWi0UMM-zLyu4GSN4.ASBAZL5M.mjs

Response headers

access-control-max-age: 0
etag: "24298ba8391c7d23a5170e0e38318a28"
x-amz-version-id: 4vGIXYTq8ueJqN572Ig7jiu.3n5EU9ic
age: 7865400
access-control-allow-methods: GET
x-content-type-options: nosniff
server-timing: cdn-cache-hit,cdn-pop;desc="FRA56-P6",cdn-hit-layer;desc="EDGE",cdn-rid;desc="aygY0zy7rMxcymD5pqtJXTpCzAUn0TDFR3YdleNohMR93o6Y6u1FOw==",cdn-downstream-fbl=3
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Wed, 11 Sep 2024 08:07:29 GMT
content-type: text/javascript
last-modified: Tue, 10 Sep 2024 13:03:14 GMT
vary: Origin
x-amz-cf-id: aygY0zy7rMxcymD5pqtJXTpCzAUn0TDFR3YdleNohMR93o6Y6u1FOw==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 0e37105a96e87c22ff4981659a6dc176.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 933
x-xss-protection: 0
x-amz-cf-pop: FRA56-P6
server: CloudFront
x-amz-server-side-encryption: AES256

Verdicts & Comments Add Verdict or Comment

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.hunt.io/	1970-01-21 11:14:27	Name: _ga_CKJY21YJ7N Value: GS1.1.1733907447.1.0.1733907447.0.0.0
			.hunt.io/	1970-01-21 11:14:27	Name: _ga Value: GA1.1.1280647228.1733907447

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

app.framerstatic.com
events.framer.com
framer.com
framerusercontent.com
hunt.io
public-hunt-static-blog-assets.s3.us-east-1.amazonaws.com
region1.google-analytics.com
www.googletagmanager.com
108.138.7.90
13.32.99.2
2001:4860:4802:32::36
2600:9000:223e:3000:d:6b42:4ec0:93a1
2600:9000:2490:3c00:d:ada1:a280:93a1
2600:9000:2761:2400:10:9b9d:b9c0:93a1
2a00:1450:4001:80f::2008
52.223.52.2
54.231.192.10
0d483fb31b7baa932fb38d9e974bcca41a9ecfa605e0d540b66e54e39fe69f6b
1444a7eaffad2eae4dd0999fb1fd4c308e51876b70db2c4f1181c8a038f1f859
1903ee47f38fb5a0b56ce197b51aa0e1be80b22ab3afcd1a466eb1ee536aa8b3
195e5840ca8966eb3ab97a9eb1582e7375d49810416f043dd8378af918367b9f
19d418a2f626fc1c0356c26eb11f3ee19295720ac760dc28463e75bfafabb1d4
20f16f669e39ddc2f4fce46463481ec43157c6d23258ec2f59f32a23c3d66a8a
22b07807afbc388ecd51abfcbecb67055935c2e3b93ac4283a5becedd5e70621
22e5cfd55973895f60a7f6bf877482dc964962f8dd778612fc149bed56112bc1
24bd03c6988e57312952d42ebbd11a362b0be97ff666d3d6ac8f3597174c56b6
2559a88e000cccc51219cf9871ce1762dad455a8a76d0cb1d13821e0664b39dd
25aeb8cf020d602895b80560676fabfa34b3c350195a0660572b6c87d8c0c37d
2dc968863319a6f57e6428a7b4c292ae254d3e462b5f23f71bab492317067d5f
324a9989ddbb2f2467a735983838314194704fb724135401a55046f54e852cde
341f61d7c3838f9e303327f41376afcc21e5e7e5d5408b795be682dcd97cde43
4107b11930c4eef1f6ae5a76d441562e6d21a601f1781f37fd085542cd87412b
449b30c2317c76c281158fa547bb61f301dd9f675b54699a8bfc5040648fda2d
4dc2a5162f03c1768634a7d933f034a800807b5324368e398cdbfc038a06d395
6fa7b05626f316594c613602ef5bed9327ca1941725837795dfc47414fb05cb5
735103ff08357f02f897a41eaaddab0492f9962697b44c7d5937cd6fe999dd67
7734581c037aa18ef75406de8fe8447d0194e730d674fa4670495be8982f366d
831ed047a786cb3bd6a4a3ee93e8457242ee53207b0d04c3b66a3f9899dd78bb
85423271cadc50e7a8873249d3ece6c62b3180112ac657e66347ce4241d31dc9
89e61318afc569842f98ccd196ff7cfbb36ec69bad3af935dd5c7149b494fde4
8b91ee4af78a9558d2bbbc889b190d7c47647405fabc8ae5be1c014d6c938228
9753c83f61822ce350ea508e36e2ee9395589100a0b3afa9df41a4c1a0910408
9cc352a4d050c98f080c4ab6550f54f4d383c9509c902b666e64548d83a62471
a1e9b3da59fa84c73948363f79bd0cef61cdb495511606fa4c2d8a06ddc954d8
a2cc6f4036b7ba96d44dc4a4489a50aad64157c4648bb10a37292575b85c02ba
a741fd3317fed44c0f1c7b8161f1420298b044e564dfea131957c0e27982a66c
a9428e5e5f6c5ede3339114a8be6230e2cc39a2190d03f1092ae93bdaf556891
af40af5e1469d7ef41aee9645556b634ada06969e8a9babf4d4e17c38aad2caf
af7863f53048fe6d665e912eb1a7438502bcd90275756bd57746711efd07ad1e
b2e327509e3ce6cf9c6d9b0bd8dd0a7e3c56719626807622bd85c9e7b5fd2dc9
b9f9ff04701407e5098517bed58cd91737b23cb35f8d9b2a9554b46dca8d8e13
bad9ed8e37d8d1aee7eacb1761e4bf4a7ac110eec89a7e92ff35545023c37cd7
baec8ef28ee7d04e84305e579a7a397af272c2b2694b3e2879ea01a14c16a76a
bece75fc8837c8a539530ef23fa0597efe496fb7d07b7087ed78f7a4a6ea0ceb
c56899f4291eff03eed62b752565556777823419de3f2b5c9020c02a883ea8ae
c861d136456a64c9c5619e9fa7c37c80144ea5d8879d88554c1f8abaaae891bf
ca91ca3baad1db28d57e2e66c1636b41d0b1ebeec150cd744ed7612cfade3310
cc324555c1cd681a59c27be1eda61da587d17bf71cc1ed8aa3e4a51e77907685
cf51594b76c66c43206e9aa471baec6a92594ea6b8cbead1b40f445468de76e0
d1964a0c53200006e756ef0d0e32cea07deff44d89075cf26ae2afe3d85f43e2
dae44b82855ff15075c37f13f6492e3407e86c9bf27bf8c06b5e7f6dc7739238
dcb6c51ec0458017b4fc8364df113fc4556a9346ce84daafda08bc73fcd27539
dda3ae667335cfd45ec00006177baa81cdcffd2584b76e84cbfe1819b7425484
e1d4e429bec9bc36a28143018ae0400faee2ea7ffe9442942794e016a094220c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e77e2400288b5496592bb75f3d2c61871d947b1705f8a2d98c4bdea3a8ebbadd
e7ded5e12508f728778cdc968bf945badfc120ce873943924e0a6dd516871c7e
e96570316195a9f6d9ae66ad55325d340e90ca1563bff1972640b2e0435002f2
f0f40885a14cd51f7d572952787c67b7c3e51399c2107171bb1bf741d22a6989
f5b8526bb0e6c1a53d014fca1808aebfb9abaa825ba0e7f54c32562023e255b4
f64db61461a61be895b05212054704844b4d20a9da93fc0349b2f0e8046002a8
f8c7aece584727904d9ece558d571f0a745d505013a200a9e4382d293401e840
fcfc9a59cc6a033a85f318216a774ececa52460fb9a71a427030fdee367b0396
fd2c9f5458dff3221f07b1f32bb05b7d9fbf9e9f435448ed14ed1c273d0e493e

hunt.io Open in urlscan Pro 52.223.52.2 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

69 Requests

97 %HTTPS

56 %IPv6

7 Domains

8 Subdomains

9 IPs

2 Countries

1560 kBTransfer

5555 kBSize

2 Cookies

7 Outgoing links

Redirected requests

69 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

hunt.io Open in urlscan Pro
52.223.52.2 Public Scan

Screenshot
Live screenshot

Full Image

69
Requests

97 %
HTTPS

56 %
IPv6

7
Domains

8
Subdomains

9
IPs

2
Countries

1560 kB
Transfer

5555 kB
Size

2
Cookies

69 HTTP transactions
1 data transactions