claroty.com Open in urlscan Pro
138.197.228.97 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey
Submission: On August 23 via manual (August 23rd 2022, 6:08:30 am UTC) from SE — Scanned from SE

Summary HTTP 66 Redirects Links 20 Behaviour Indicators

Summary

This website contacted 25 IPs in 5 countries across 23 domains to perform 66 HTTP transactions. The main IP is 138.197.228.97, located in North Bergen, United States and belongs to DIGITALOCEAN-ASN, US. The main domain is claroty.com. The Cisco Umbrella rank of the primary domain is 379168.
TLS certificate: Issued by DigiCert TLS RSA SHA256 2020 CA1 on March 1st 2022. Valid for: a year.

This is the only time claroty.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
8	138.197.228.97 138.197.228.97	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
4	184.24.77.156 184.24.77.156	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	142.250.186.104 142.250.186.104	15169 (GOOGLE) (GOOGLE)
4	152.195.15.58 152.195.15.58	15133 (EDGECAST) (EDGECAST)
8	104.18.16.5 104.18.16.5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
10	104.18.22.52 104.18.22.52	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	104.103.72.171 104.103.72.171	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	104.16.101.12 104.16.101.12	13335 (CLOUDFLAR...) (CLOUDFLARENET)
4	162.243.189.2 162.243.189.2	14061 (DIGITALOC...) (DIGITALOCEAN-ASN)
5 5	3.209.185.106 3.209.185.106	14618 (AMAZON-AES) (AMAZON-AES)
3 3	34.247.103.17 34.247.103.17	16509 (AMAZON-02) (AMAZON-02)
2 2	3.124.33.5 3.124.33.5	16509 (AMAZON-02) (AMAZON-02)
2 2	52.57.93.199 52.57.93.199	16509 (AMAZON-02) (AMAZON-02)
1	104.111.215.191 104.111.215.191	16625 (AKAMAI-AS) (AKAMAI-AS)
1	2.21.20.160 2.21.20.160	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
4	104.19.147.8 104.19.147.8	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	15.197.193.217 15.197.193.217	16509 (AMAZON-02) (AMAZON-02)
2	142.250.185.238 142.250.185.238	15169 (GOOGLE) (GOOGLE)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	143.204.89.72 143.204.89.72	16509 (AMAZON-02) (AMAZON-02)
1	18.66.122.57 18.66.122.57	16509 (AMAZON-02) (AMAZON-02)
1	173.194.76.155 173.194.76.155	15169 (GOOGLE) (GOOGLE)
1	54.156.137.3 54.156.137.3	14618 (AMAZON-AES) (AMAZON-AES)
3	3.215.172.219 3.215.172.219	14618 (AMAZON-AES) (AMAZON-AES)
1	52.17.107.162 52.17.107.162	16509 (AMAZON-02) (AMAZON-02)
1	172.217.23.100 172.217.23.100	15169 (GOOGLE) (GOOGLE)
1	142.250.185.163 142.250.185.163	15169 (GOOGLE) (GOOGLE)
1	35.188.42.15 35.188.42.15	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
66	25

8 138.197.228.97 (North Bergen, United States)

ASN14061 (DIGITALOCEAN-ASN, US)

claroty.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 184.24.77.156 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a184-24-77-156.deploy.static.akamaitechnologies.com

use.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 142.250.186.104 (United States)

ASN15169 (GOOGLE, US)
PTR: fra24s06-in-f8.1e100.net

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 152.195.15.58 (United States)

ASN15133 (EDGECAST, US)

cdn.bizible.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.bizibly.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 104.18.16.5 (None, )

ASN13335 (CLOUDFLARENET, US)

js.qualified.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
assets.qualified.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 104.18.22.52 (None, )

ASN13335 (CLOUDFLARENET, US)

kit.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ka-p.fontawesome.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.103.72.171 (Vienna, Austria)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a104-103-72-171.deploy.static.akamaitechnologies.com

p.typekit.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.16.101.12 (None, )

ASN13335 (CLOUDFLARENET, US)

ws.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 162.243.189.2 (United States)

ASN14061 (DIGITALOCEAN-ASN, US)
PTR: nyc3.digitaloceanspaces.com

claroty-statamic-assets-cache.nyc3.digitaloceanspaces.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
claroty-statamic-assets.nyc3.digitaloceanspaces.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 3.209.185.106 (Ashburn, United States) 5 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-209-185-106.compute-1.amazonaws.com

aorta.clickagy.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 34.247.103.17 (Dublin, Ireland) 3 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-34-247-103-17.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 3.124.33.5 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-3-124-33-5.eu-central-1.compute.amazonaws.com

aa.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.57.93.199 (Frankfurt am Main, Germany) 2 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-57-93-199.eu-central-1.compute.amazonaws.com

d.agkn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.111.215.191 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-215-191.deploy.static.akamaitechnologies.com

stags.bluekai.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2.21.20.160 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)
PTR: a2-21-20-160.deploy.static.akamaitechnologies.com

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 104.19.147.8 (None, )

ASN13335 (CLOUDFLARENET, US)

script.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 15.197.193.217 (United States)

ASN16509 (AMAZON-02, US)
PTR: a12b7a488abeaa9e4.awsglobalaccelerator.com

insight.adsrvr.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 142.250.185.238 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s53-in-f14.1e100.net

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.89.72 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-89-72.fra50.r.cloudfront.net

pagestates-tracking.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.122.57 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-122-57.fra60.r.cloudfront.net

assets-tracking.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 173.194.76.155 (United States)

ASN15169 (GOOGLE, US)
PTR: ws-in-f155.1e100.net

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.156.137.3 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-156-137-3.compute-1.amazonaws.com

app.qualified.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 3.215.172.219 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-3-215-172-219.compute-1.amazonaws.com

security.claroty.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pi.pardot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.17.107.162 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-17-107-162.eu-west-1.compute.amazonaws.com

tracking.crazyegg.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 172.217.23.100 (United States)

ASN15169 (GOOGLE, US)
PTR: mil04s23-in-f4.1e100.net

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 142.250.185.163 (United States)

ASN15169 (GOOGLE, US)
PTR: fra16s51-in-f3.1e100.net

www.google.se	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.188.42.15 (Council Bluffs, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 15.42.188.35.bc.googleusercontent.com

sentry.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
10	fontawesome.com kit.fontawesome.com — Cisco Umbrella Rank: 1727 ka-p.fontawesome.com — Cisco Umbrella Rank: 3725	32 KB
9	qualified.com js.qualified.com — Cisco Umbrella Rank: 26623 app.qualified.com — Cisco Umbrella Rank: 25846 assets.qualified.com — Cisco Umbrella Rank: 28462	759 KB
9	claroty.com claroty.com — Cisco Umbrella Rank: 379168 security.claroty.com — Cisco Umbrella Rank: 865946	103 KB
7	crazyegg.com script.crazyegg.com — Cisco Umbrella Rank: 1822 pagestates-tracking.crazyegg.com — Cisco Umbrella Rank: 3673 assets-tracking.crazyegg.com — Cisco Umbrella Rank: 3674 tracking.crazyegg.com — Cisco Umbrella Rank: 3681	35 KB
5	clickagy.com 5 redirects aorta.clickagy.com — Cisco Umbrella Rank: 1572	2 KB
5	typekit.net use.typekit.net — Cisco Umbrella Rank: 507 p.typekit.net — Cisco Umbrella Rank: 625	90 KB
4	agkn.com 4 redirects aa.agkn.com — Cisco Umbrella Rank: 461 d.agkn.com — Cisco Umbrella Rank: 588	2 KB
4	digitaloceanspaces.com claroty-statamic-assets-cache.nyc3.digitaloceanspaces.com claroty-statamic-assets.nyc3.digitaloceanspaces.com	327 KB
3	demdex.net 3 redirects dpm.demdex.net — Cisco Umbrella Rank: 201	3 KB
3	bizible.com cdn.bizible.com — Cisco Umbrella Rank: 6879	33 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 78	135 KB
2	pardot.com pi.pardot.com — Cisco Umbrella Rank: 3602	4 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 45	20 KB
1	sentry.io sentry.io — Cisco Umbrella Rank: 368	407 B
1	google.se www.google.se — Cisco Umbrella Rank: 26583	501 B
1	google.com www.google.com — Cisco Umbrella Rank: 9	501 B
1	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 108	439 B
1	linkedin.com px.ads.linkedin.com — Cisco Umbrella Rank: 370	724 B
1	adsrvr.org insight.adsrvr.org — Cisco Umbrella Rank: 610	261 B
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 717	3 KB
1	bluekai.com stags.bluekai.com — Cisco Umbrella Rank: 509	227 B
1	bizibly.com cdn.bizibly.com — Cisco Umbrella Rank: 11033	202 B
1	zoominfo.com ws.zoominfo.com — Cisco Umbrella Rank: 5057	2 KB
66	23

	Domain	Requested by
9	ka-p.fontawesome.com	kit.fontawesome.com claroty.com
8	claroty.com	claroty.com
7	assets.qualified.com	claroty.com app.qualified.com
5	aorta.clickagy.com	5 redirects
4	script.crazyegg.com	www.googletagmanager.com script.crazyegg.com
4	use.typekit.net	claroty.com use.typekit.net
3	dpm.demdex.net	3 redirects
3	claroty-statamic-assets-cache.nyc3.digitaloceanspaces.com	claroty.com
3	cdn.bizible.com	claroty.com cdn.bizible.com
3	www.googletagmanager.com	claroty.com www.googletagmanager.com
2	pi.pardot.com	claroty.com pi.pardot.com
2	www.google-analytics.com	www.googletagmanager.com cdn.bizible.com
2	d.agkn.com	2 redirects
2	aa.agkn.com	2 redirects
1	sentry.io	assets.qualified.com
1	www.google.se	claroty.com
1	www.google.com	claroty.com
1	tracking.crazyegg.com	script.crazyegg.com
1	security.claroty.com	js.qualified.com
1	app.qualified.com	js.qualified.com
1	stats.g.doubleclick.net	cdn.bizible.com
1	assets-tracking.crazyegg.com	script.crazyegg.com
1	pagestates-tracking.crazyegg.com	script.crazyegg.com
1	px.ads.linkedin.com	claroty.com
1	insight.adsrvr.org	claroty.com
1	snap.licdn.com	www.googletagmanager.com
1	stags.bluekai.com	claroty.com
1	cdn.bizibly.com	claroty.com
1	claroty-statamic-assets.nyc3.digitaloceanspaces.com	claroty.com
1	ws.zoominfo.com	claroty.com
1	p.typekit.net	use.typekit.net
1	kit.fontawesome.com	claroty.com
1	js.qualified.com	claroty.com
66	33

This site contains links to these domains. Also see Links.

Domain
www.cisa.gov
www.se.com
www.br-automation.com
www.cve.org
www.ovarro.com
emerson-mas.force.com
ovarro.com
www.ge.com
www.rockwellautomation.com
www.emerson.com
en.xinje.com
portal.claroty.com
www.linkedin.com
twitter.com
www.facebook.com

Subject Issuer	Validity	Valid
*.claroty.com DigiCert TLS RSA SHA256 2020 CA1	`2022-03-01` - `2023-03-01`	a year	crt.sh
use.typekit.net DigiCert TLS RSA SHA256 2020 CA1	`2022-03-07` - `2023-04-07`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-08-01` - `2022-10-24`	3 months	crt.sh
io.bizible.com DigiCert TLS RSA SHA256 2020 CA1	`2022-06-30` - `2023-07-31`	a year	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2022-05-11` - `2023-05-11`	a year	crt.sh
*.fontawesome.com DigiCert TLS RSA SHA256 2020 CA1	`2021-12-01` - `2023-01-01`	a year	crt.sh
zoominfo.com Cloudflare Inc ECC CA-3	`2022-05-04` - `2023-05-04`	a year	crt.sh
*.nyc3.digitaloceanspaces.com DigiCert TLS RSA SHA256 2020 CA1	`2022-05-09` - `2023-05-26`	a year	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2022-03-01` - `2023-03-01`	a year	crt.sh
*.adsrvr.org GlobalSign GCC R3 DV TLS CA 2020	`2022-03-31` - `2023-05-02`	a year	crt.sh
www.linkedin.com DigiCert SHA2 Secure Server CA	`2022-08-03` - `2023-02-03`	6 months	crt.sh
crazyegg.com Amazon	`2022-06-27` - `2023-07-26`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-08-01` - `2022-10-24`	3 months	crt.sh
app.qualified.com R3	`2022-07-21` - `2022-10-19`	3 months	crt.sh
security.claroty.com R3	`2022-07-02` - `2022-09-30`	3 months	crt.sh
www.google.com GTS CA 1C3	`2022-08-01` - `2022-10-24`	3 months	crt.sh
*.google.se GTS CA 1C3	`2022-08-01` - `2022-10-24`	3 months	crt.sh
sentry.io DigiCert TLS RSA SHA256 2020 CA1	`2022-06-03` - `2023-07-04`	a year	crt.sh
pi.pardot.com DigiCert TLS RSA SHA256 2020 CA1	`2021-11-08` - `2022-11-07`	a year	crt.sh

This page contains 3 frames:

Primary Page: https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey
Frame ID: A1C391ED1DDAF9C90AC4F482103AE8F2
Requests: 59 HTTP requests in this frame

Frame: https://script.crazyegg.com/pages/data-scripts/0111/6563/site/claroty.com.json?t=1
Frame ID: 8F955FBA69A401315793564B7B5615B8
Requests: 5 HTTP requests in this frame

Frame: https://app.qualified.com/w/1/PaboXyMA4piyRkBp/messenger?uuid=d4275d1f-bd50-4030-ac8b-1d2bba0dfb46
Frame ID: 93DB2CDAB1352F83FEF71A81E869B92A
Requests: 9 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Evil PLC Attack: Hacking PLCs to Attack Engineering Workstations | Claroty

Detected technologies

Livewire (Web frameworks) Expand

Overall confidence: 100%
Detected patterns

livewire(?:\.min)?\.js

Crazy Egg (Analytics) Expand

Overall confidence: 100%
Detected patterns

script\.crazyegg\.com/pages/scripts/\d+/\d+\.js

Font Awesome (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

(?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
kit\.fontawesome\.com/([0-9a-z]+).js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Typekit (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link [^>]*href="[^"]+use\.typekit\.(?:net|com)

Page Statistics

66
Requests

95 %
HTTPS

0 %
IPv6

23
Domains

33
Subdomains

25
IPs

5
Countries

1546 kB
Transfer

4060 kB
Size

26
Cookies

20 Outgoing links

These are links going to different origins than the main page.

URL: https://www.cisa.gov/uscert/ics/advisories/icsa-21-133-01
Title: Rockwell Automation

Search URL Search Domain Scan URL

URL: https://www.se.com/ww/en/download/document/SEVD-2021-222-02/
Title: Schneider Electric

Search URL Search Domain Scan URL

URL: https://www.cisa.gov/uscert/ics/advisories/icsa-22-025-01
Title: GE

Search URL Search Domain Scan URL

URL: https://www.br-automation.com/downloads_br_productcatalogue/assets/1640529306294-en-original-1.0.pdf
Title: B&R

Search URL Search Domain Scan URL

URL: https://www.cve.org/CVERecord?id=CVE-2021-34605
Title: XINJE

Search URL Search Domain Scan URL

URL: https://www.ovarro.com/content-media/assigned/102049/TBOX-SA-2021-0009_1.1.pdf
Title: OVARRO

Search URL Search Domain Scan URL

URL: https://emerson-mas.force.com/communities/en_US/Article/Evil-PLC-Attack-Weaponizing-PLCs
Title: Emerson

Search URL Search Domain Scan URL

URL: https://ovarro.com/en/europe/solutions/monitoring--control-devices/rtus/tbox/
Title: TBox platform

Search URL Search Domain Scan URL

URL: https://www.br-automation.com/en/products/plc-systems/x20-system/
Title: X20 System platform

Search URL Search Domain Scan URL

URL: https://www.se.com/ww/en/work/products/master-ranges/modicon/
Title: Modicon platform

Search URL Search Domain Scan URL

URL: https://www.ge.com/gas-power/products/digital-and-controls/mark-vie-ecosystem
Title: Mark VIe platform

Search URL Search Domain Scan URL

URL: https://www.rockwellautomation.com/en-il/products/hardware/allen-bradley/programmable-controllers/micro-controllers/micro800-family/micro820-controllers.html
Title: Micro800 Control Systems platform

Search URL Search Domain Scan URL

URL: https://www.emerson.com/en-us/automation/control-and-safety-systems/pacsystems
Title: PACSystems platform

Search URL Search Domain Scan URL

URL: https://en.xinje.com/enxj_product_detail/enxj_xlxl.html
Title: XD Series platform

Search URL Search Domain Scan URL

URL: https://portal.claroty.com/English/directory/
Title: Find a Partner

Search URL Search Domain Scan URL

URL: https://portal.claroty.com/
Title: Partner Login

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/claroty/
Title: LinkedIn

Search URL Search Domain Scan URL

URL: https://twitter.com/claroty
Title: Twitter

Search URL Search Domain Scan URL

URL: https://www.facebook.com/ClarotyOT/
Title: Facebook

Search URL Search Domain Scan URL

URL: https://portal.claroty.com/English/
Title: Partner Login

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 42

https://aorta.clickagy.com/pixel.gif?ch=278&cm=ffa748f9b4fdb0570a4227f9fa348ec807fc42ffea1789af2b153679b79aaa75 HTTP 302
https://dpm.demdex.net/ibs:dpid=79908&dpuuid=c:86a2a9180a4b27a53f5bfd72ef010a07&redir=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D124%26cm%3D%24%7BDD_UUID%7D HTTP 302
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=79908&dpuuid=c:86a2a9180a4b27a53f5bfd72ef010a07&redir=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D124%26cm%3D%24%7BDD_UUID%7D HTTP 302
https://aorta.clickagy.com/pixel.gif?clkgypv=pxl&ch=124&cm=75088851258474672530604108102625485233 HTTP 302
https://aa.agkn.com/adscores/g.pixel?sid=9212289188&_puid=c:86a2a9180a4b27a53f5bfd72ef010a07&_redir=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D128%26cm%3D HTTP 302
https://d.agkn.com/pixel/10751/?che=1661234907040&ip=185.147.213.146&l1=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D128%26cm%3D216633104252000534145 HTTP 302
https://aorta.clickagy.com/pixel.gif?clkgypv=pxl&ch=128&cm=216633104252000534145 HTTP 302
https://dpm.demdex.net/ibs:dpid=79908&dpuuid=c:86a2a9180a4b27a53f5bfd72ef010a07&redir=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D124%26cm%3D%24%7BDD_UUID%7D HTTP 302
https://aorta.clickagy.com/pixel.gif?clkgypv=pxl&ch=124&cm=75088851258474672530604108102625485233 HTTP 302
https://aa.agkn.com/adscores/g.pixel?sid=9212289188&_puid=c:86a2a9180a4b27a53f5bfd72ef010a07&_redir=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D128%26cm%3D HTTP 302
https://d.agkn.com/pixel/10751/?che=1661234907715&ip=185.147.213.146&l1=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D128%26cm%3D216633104252000534145 HTTP 302
https://aorta.clickagy.com/pixel.gif?clkgypv=pxl&ch=128&cm=216633104252000534145 HTTP 302
https://stags.bluekai.com/site/51557?id=c:86a2a9180a4b27a53f5bfd72ef010a07&redir=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D122%26cm%3D$_BK_UUID&BKUUID=$_BK_UUID&limit=1

66 HTTP transactions
7 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request evil-plc-attack-using-a-controller-as-predator-rather-than-prey Show response
claroty.com/team82/research/ 79 KB
16 KB 498ms
243ms Document
text/html 138.197.228.97
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

138.197.228.97 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx / Statamic

Resource Hash

66ba7ee0b589c7d46d830850ec2263f06113a345ef072bcf1e92c143da2e7f65

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff nosniff
X-Frame-Options	sameorigin SAMEORIGIN
X-Xss-Protection	1; mode=block 1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: se-SE,se;q=0.9

Response headers

cache-control: no-cache, private
content-encoding: gzip
content-security-policy: frame-ancestors 'self'; upgrade-insecure-requests
content-type: text/html; charset=UTF-8
date: Tue, 23 Aug 2022 06:08:23 GMT
permissions-policy: accelerometer=(self), ambient-light-sensor=(self), autoplay=(self), battery=(self), camera=(self), cross-origin-isolated=(self), display-capture=(self), document-domain=*, encrypted-media=(self), execution-while-not-rendered=*, execution-while-out-of-viewport=*, fullscreen=(self), geolocation=(self), gyroscope=(self), magnetometer=(self), microphone=(self), midi=(self), navigation-override=(self), payment=(self), picture-in-picture=*, publickey-credentials-get=(self), screen-wake-lock=(self), sync-xhr=*, usb=(self), web-share=(self), xr-spatial-tracking=(self)
referrer-policy: no-referrer
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-content-type-options: nosniff nosniff
x-download-options: noopen
x-frame-options: sameorigin SAMEORIGIN
x-permitted-cross-domain-policies: none
x-powered-by: Statamic
x-xss-protection: 1; mode=block 1; mode=block

GET
H2 200 claroty.css
claroty.com/css/ 43 KB
9 KB 123ms
123ms Stylesheet
text/css 138.197.228.97
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://claroty.com/css/claroty.css?id=0e6fc3ed64ff07a4ec830835e7e01449

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

138.197.228.97 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

49c280ae279b8f3c7d2eaa0b470f9812539601013a2f6efa7aa0b41bbf7bc090

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 06:08:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 22 Aug 2022 21:48:06 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: W/"6303f996-ad90"
vary: Accept-Encoding
content-type: text/css
x-xss-protection: 1; mode=block

GET
H2 200 yty7mat.css
use.typekit.net/ 5 KB
1 KB 189ms
47ms Stylesheet
text/css 184.24.77.156
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://use.typekit.net/yty7mat.css

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

184.24.77.156 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

a184-24-77-156.deploy.static.akamaitechnologies.com

Software

nginx /

Resource Hash

39961d4c61d179baa0dbf39258390c27d3bc52330da365f9051c044d8715a898

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains;

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains;
content-encoding: gzip
server: nginx
date: Tue, 23 Aug 2022 06:08:24 GMT
vary: Accept-Encoding
content-type: text/css;charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=600, stale-while-revalidate=604800
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 805

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 106 KB
41 KB 196ms
69ms Script
application/javascript 142.250.186.104
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-23917942-3

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.104 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

5eb3bd3a2d811fe844032d8d648ca7be6864053077393e793f49ffa81275e556

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 06:08:24 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 41998
x-xss-protection: 0
expires: Tue, 23 Aug 2022 06:08:24 GMT

GET
H2 200 bizible.js Show response
cdn.bizible.com/scripts/ 83 KB
32 KB 217ms
51ms Script
application/x-javascript 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.bizible.com/scripts/bizible.js
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (amb/6BA7) /
Resource Hash: 4120c62c25cd2f9d7f5155aaf84f772c08e18dd1be19e39ed0d866d3916bedce

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 06:08:24 GMT
content-encoding: gzip
last-modified: Thu, 18 Aug 2022 22:51:38 GMT
server: ECS (amb/6BA7)
age: 17172
etag: "c821211355b3d81:0"
vary: Accept-Encoding
x-cache: HIT
content-type: application/x-javascript
cache-control: max-age=86400
accept-ranges: bytes
content-length: 32327

GET
H2 200 qualified.js Show response
js.qualified.com/ 232 KB
68 KB 111ms
40ms Script
text/javascript 104.18.16.5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.qualified.com/qualified.js?token=PaboXyMA4piyRkBp

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.16.5 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

a0b359e395dbe239d6ea324bab073321acdf6af9ec378f647da9eeca5860fe8c

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 06:08:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
x-permitted-cross-domain-policies: none
age: 1110
strict-transport-security: max-age=63072000; includeSubDomains
x-xss-protection: 1; mode=block
x-request-id: f734c49d-f377-c29f-d26e-d2a4969a2a85
x-runtime: 0.019036
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
x-frame-options: SAMEORIGIN
etag: W/"a0b359e395dbe239d6ea324bab073321"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept,Accept-Encoding
x-download-options: noopen
content-type: text/javascript; charset=utf-8
via: 1.1 spaces-router (a302eeabfffb)
cache-control: public, max-age=14400
cf-ray: 73f1ac6a5cb498ee-ARN
expires: Tue, 23 Aug 2022 10:08:24 GMT

GET
H2 200 banner-watermark.svg
claroty.com/img/ 599 B
603 B 123ms
122ms Image
image/svg+xml 138.197.228.97
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://claroty.com/img/banner-watermark.svg

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

138.197.228.97 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

ed9f9832970709be6f68186f423d4d983d21ad62d3bee7db6d30c7bc3e01e20f

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 06:08:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 27 Jul 2022 14:31:27 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: W/"62e14c3f-257"
vary: Accept-Encoding
content-type: image/svg+xml
x-xss-protection: 1; mode=block

GET
H2 200 team82-logo.svg
claroty.com/img/ 9 KB
4 KB 124ms
122ms Image
image/svg+xml 138.197.228.97
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://claroty.com/img/team82-logo.svg

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

138.197.228.97 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

15318489f738027dd0096a2041613173aa128360c2e0903ef879c36fa7ecd18b

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 06:08:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 27 Jul 2022 14:31:27 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: W/"62e14c3f-24b0"
vary: Accept-Encoding
content-type: image/svg+xml
x-xss-protection: 1; mode=block

GET
H2 200 logo-solid-white.svg
claroty.com/img/ 2 KB
1 KB 124ms
123ms Image
image/svg+xml 138.197.228.97
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://claroty.com/img/logo-solid-white.svg

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

138.197.228.97 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

60bdc532cad265a116b2b590c86a9679ed86fe5a1ac3764e08c521cf6ccb1784

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 06:08:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 27 Jul 2022 14:31:27 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: W/"62e14c3f-9cb"
vary: Accept-Encoding
content-type: image/svg+xml
x-xss-protection: 1; mode=block

GET
H2 200 logo-white.svg
claroty.com/img/ 2 KB
1 KB 124ms
123ms Image
image/svg+xml 138.197.228.97
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://claroty.com/img/logo-white.svg

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

138.197.228.97 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

95cbdd8d48ccc73ee5d0c5aba8bca4485b7fc0b58713923e92b97a325fc68538

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 06:08:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 27 Jul 2022 14:31:27 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: W/"62e14c3f-9d1"
vary: Accept-Encoding
content-type: image/svg+xml
x-xss-protection: 1; mode=block

GET
H2 200 livewire.js Show response
claroty.com/livewire/ 156 KB
42 KB 143ms
143ms Script
application/javascript 138.197.228.97
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://claroty.com/livewire/livewire.js?id=de3fca26689cb5a39af4

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

138.197.228.97 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

db7fc4a5fe60fb79b594ddd13b6839a6c688b65fbe73421698194f67841fce2b

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff, nosniff
X-Frame-Options	sameorigin, SAMEORIGIN
X-Xss-Protection	1; mode=block, 1; mode=block

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 06:08:24 GMT
content-encoding: gzip
x-content-type-options: nosniff, nosniff
x-permitted-cross-domain-policies: none
vary: Accept-Encoding
x-xss-protection: 1; mode=block, 1; mode=block
referrer-policy: no-referrer
last-modified: Mon, 08 Aug 2022 13:52:53 GMT
server: nginx
x-frame-options: sameorigin, SAMEORIGIN
x-download-options: noopen
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-type: application/javascript; charset=utf-8
cache-control: max-age=31536000, public
permissions-policy: accelerometer=(self), ambient-light-sensor=(self), autoplay=(self), battery=(self), camera=(self), cross-origin-isolated=(self), display-capture=(self), document-domain=*, encrypted-media=(self), execution-while-not-rendered=*, execution-while-out-of-viewport=*, fullscreen=(self), geolocation=(self), gyroscope=(self), magnetometer=(self), microphone=(self), midi=(self), navigation-override=(self), payment=(self), picture-in-picture=*, publickey-credentials-get=(self), screen-wake-lock=(self), sync-xhr=*, usb=(self), web-share=(self), xr-spatial-tracking=(self)
content-security-policy: frame-ancestors 'self'; upgrade-insecure-requests
expires: Wed, 23 Aug 2023 06:08:24 GMT

GET
H2 200 claroty.js Show response
claroty.com/js/ 92 KB
28 KB 199ms
199ms Script
application/javascript 138.197.228.97
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://claroty.com/js/claroty.js?id=860d0bf89e9a4ea74e2b700ed6cb3476

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

138.197.228.97 North Bergen, United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

Software

nginx /

Resource Hash

81863eabfebdb05c037a231699218e32ee0af1559d74c750cdcc6836dc64aca5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 06:08:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 03 Aug 2022 21:14:05 GMT
server: nginx
x-frame-options: SAMEORIGIN
etag: W/"62eae51d-16fb2"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
x-xss-protection: 1; mode=block

GET
H2 200 8175422aa5.js Show response
kit.fontawesome.com/ 11 KB
4 KB 139ms
75ms Script
text/javascript 104.18.22.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://kit.fontawesome.com/8175422aa5.js

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.18.22.52 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f11577c300771f3e1a16c608b5c713e0b5b47807d68ad8e69e92e1ad8cd767fa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; preload

Request headers

Referer
Origin: https://claroty.com
accept-language: se-SE,se;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 06:08:24 GMT
content-encoding: gzip
cf-cache-status: REVALIDATED
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: origin, accept-encoding, access-control-request-headers, access-control-request-method
access-control-allow-methods: GET, OPTIONS
content-type: text/javascript
access-control-allow-origin: *
access-control-max-age: 3000
cache-control: max-age=60, public, must-revalidate
strict-transport-security: max-age=31536000; preload
cf-ray: 73f1ac69eb09f142-ARN
access-control-allow-headers: accept, accept-langauge, content-language, content-type, fa-kit-token
x-request-id: FwYZ0MxFql6Ngaslp2UC

GET
H2 200 p.css
p.typekit.net/ 5 B
195 B 263ms
66ms Stylesheet
text/css 104.103.72.171
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://p.typekit.net/p.css?s=1&k=yty7mat&ht=tk&f=139.173.175.176.25136.25137&a=18291&app=typekit&e=css
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/yty7mat.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 104.103.72.171 Vienna, Austria, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a104-103-72-171.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

unused62: 8096267
date: Tue, 23 Aug 2022 06:08:24 GMT
last-modified: Sat, 16 Oct 2021 05:50:56 GMT
server: nginx
etag: "616a6840-5"
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
content-length: 5

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 146 KB
52 KB 264ms
139ms Script
application/javascript 142.250.186.104
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MWHFVG2

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.104 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

0f0291fb4e3d655a693871e6cdcc579bed567da9fb38f950536971bf1716cf02

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 06:08:24 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 53273
x-xss-protection: 0
expires: Tue, 23 Aug 2022 06:08:24 GMT

GET
H2 200 jilEnH5CqVK0j3M3GHR5 Show response
ws.zoominfo.com/pixel/ 3 KB
2 KB 303ms
238ms Script
text/javascript 104.16.101.12
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/jilEnH5CqVK0j3M3GHR5

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.16.101.12 -, , ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

f99b44a7372761254ca165b00e289bd64562afc987f84c65e67c88de0bd5d2cf

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 06:08:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
server: cloudflare
x-powered-by: Express
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
access-control-allow-credentials: true
cf-ray: 73f1ac6a583798eb-ARN
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type
via: 1.1 google

GET
H2 200 l
use.typekit.net/af/78aca8/00000000000000007735e60d/30/ 29 KB
29 KB 187ms
48ms Font
application/font-woff2 184.24.77.156
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/78aca8/00000000000000007735e60d/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n6&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/yty7mat.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.24.77.156 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a184-24-77-156.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: b07871da02311868c31ab6ac5a4e78cc877f118acd854857f6f51519f3ddbbc9

Request headers

Referer: https://use.typekit.net/yty7mat.css
Origin: https://claroty.com
accept-language: se-SE,se;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 06:08:24 GMT
server: nginx
etag: "1d1aed9a298449b26ef6d57c78caa88b6b5de306"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 29764

GET
H2 200 l
use.typekit.net/af/efe4a5/00000000000000007735e609/30/ 29 KB
29 KB 195ms
56ms Font
application/font-woff2 184.24.77.156
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/efe4a5/00000000000000007735e609/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n4&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/yty7mat.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.24.77.156 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a184-24-77-156.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: 0c1feaca092d398ce830ae475be7ea16f8b02a87dbefe37f532051d688a3868d

Request headers

Referer: https://use.typekit.net/yty7mat.css
Origin: https://claroty.com
accept-language: se-SE,se;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 06:08:24 GMT
server: nginx
etag: "6aeae62b893768150f3460329dc461358e8ab2f5"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 29820

GET
H2 200 53f1716ce4411888944af2934558f084.webp
claroty-statamic-assets-cache.nyc3.digitaloceanspaces.com/containers/assets/evil-plc-1660431196.jpg/ 20 KB
20 KB 869ms
614ms Image
image/webp 162.243.189.2
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://claroty-statamic-assets-cache.nyc3.digitaloceanspaces.com/containers/assets/evil-plc-1660431196.jpg/53f1716ce4411888944af2934558f084.webp

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.243.189.2 , United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

nyc3.digitaloceanspaces.com

Software

Resource Hash

6e4dc3626e6d244e1d9eee8335e70769ed41b27f76271ab18b010ab1e538fec0

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 06:08:24 GMT
last-modified: Sat, 13 Aug 2022 22:53:30 GMT
x-amz-request-id: tx0000000000000328483bb-0063046ed8-3f2aaee4-nyc3c
etag: "15121b969da3641fe46e6cafddcb7cd6"
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: image/webp
x-rgw-object-type: Normal
strict-transport-security: max-age=15552000; includeSubDomains; preload
accept-ranges: bytes
content-length: 20830

GET
H2 206 evil_plc_attack_with_logo.mov
claroty-statamic-assets.nyc3.digitaloceanspaces.com/ 424 KB
0 513ms
259ms Media
video/quicktime 162.243.189.2
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to

Full URL

https://claroty-statamic-assets.nyc3.digitaloceanspaces.com/evil_plc_attack_with_logo.mov

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.243.189.2 , United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

nyc3.digitaloceanspaces.com

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

Referer
Accept-Encoding: identity;q=1, *;q=0
accept-language: se-SE,se;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Range: bytes=0-

Response headers

date: Tue, 23 Aug 2022 06:08:24 GMT
last-modified: Wed, 03 Aug 2022 14:53:36 GMT
x-amz-request-id: tx0000000000000328483bc-0063046ed8-3f2aaee4-nyc3c
etag: "18da810da9bda664d56183ee619b5ee6-5"
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: video/quicktime
Content-Range: bytes 0-25630508/25630509
x-rgw-object-type: Normal
strict-transport-security: max-age=15552000; includeSubDomains; preload
accept-ranges: bytes
Content-Length: 25630509

GET
DATA 200
OK truncated
/ 547 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: eb14baeac955bb11e33cd7fd3fd2f698cf20db1b450325f45ea843b6cdc82366

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 552 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 62f3f809487194fcc55a3ebd88811a604ae496027bb425d4ebd15d9ae1921945

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 715 B
0 Image
image/png

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/png

GET
DATA 200
OK truncated
/ 380 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 717f6bb5f6cc69c444f54376a72dee0ca7968b2a12e7c9475247ec85c0e75a53

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 l
use.typekit.net/af/2555e1/00000000000000007735e603/30/ 30 KB
30 KB 178ms
94ms Font
application/font-woff2 184.24.77.156
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://use.typekit.net/af/2555e1/00000000000000007735e603/30/l?primer=7cdcb44be4a7db8877ffa5c0007b8dd865b3bbc383831fe2ea177f62257a9191&fvd=n7&v=3
Requested by: Host: use.typekit.net
URL: https://use.typekit.net/yty7mat.css
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 184.24.77.156 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a184-24-77-156.deploy.static.akamaitechnologies.com
Software: nginx /
Resource Hash: a33128c94dd3c425bc3f4a9ba389a1f3d7a75233e8cb788ea80f8f43a3d68423

Request headers

Referer: https://use.typekit.net/yty7mat.css
Origin: https://claroty.com
accept-language: se-SE,se;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 06:08:24 GMT
server: nginx
etag: "09d1a94c81035c62708e0a513ee76d7886d15a25"
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
content-length: 30704

GET
H2 200 4d59b9f902e5b0dead08c5c61604dfc5.webp
claroty-statamic-assets-cache.nyc3.digitaloceanspaces.com/containers/assets/evilplc_screens.png/ 239 KB
240 KB 610ms
413ms Image
image/webp 162.243.189.2
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://claroty-statamic-assets-cache.nyc3.digitaloceanspaces.com/containers/assets/evilplc_screens.png/4d59b9f902e5b0dead08c5c61604dfc5.webp

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.243.189.2 , United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

nyc3.digitaloceanspaces.com

Software

Resource Hash

e1462a026bf4b85b7fdd56b24e6562ac53f07853195c7dc6a88ecf9709171bc3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 06:08:24 GMT
last-modified: Wed, 03 Aug 2022 14:55:51 GMT
x-amz-request-id: tx000000000000032775dc0-0063046ed8-3f1a061f-nyc3c
etag: "572955644ff40cbec799fbbb1ded69c9"
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: image/webp
x-rgw-object-type: Normal
strict-transport-security: max-age=15552000; includeSubDomains; preload
accept-ranges: bytes
content-length: 245150

GET
H2 200 2684dac8308718b8c3b9c1114265e2aa.webp
claroty-statamic-assets-cache.nyc3.digitaloceanspaces.com/containers/assets/evil-plc.jpg/ 67 KB
67 KB 446ms
249ms Image
image/webp 162.243.189.2
DIGITALOCEAN-ASN

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://claroty-statamic-assets-cache.nyc3.digitaloceanspaces.com/containers/assets/evil-plc.jpg/2684dac8308718b8c3b9c1114265e2aa.webp

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

162.243.189.2 , United States, ASN14061 (DIGITALOCEAN-ASN, US),

Reverse DNS

nyc3.digitaloceanspaces.com

Software

Resource Hash

a3838a757361c75c1a0bc6a57bdc2758b184f7d4c06166e7fe9284ee7a7bfbed

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 06:08:24 GMT
last-modified: Wed, 03 Aug 2022 20:43:06 GMT
x-amz-request-id: tx000000000000032900cd9-0063046ed8-3f19a6f7-nyc3c
etag: "25378bed7900d1911a433112e4a925f9"
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: image/webp
x-rgw-object-type: Normal
strict-transport-security: max-age=15552000; includeSubDomains; preload
accept-ranges: bytes
content-length: 68644

GET
DATA 200
OK truncated
/ 177 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: d692a67352a3dfa80010c86a62761cfff05c0b1086618106a8576cc45a6a8115

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 351 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 145287b36883dd3061ca7aa9229a8fa9ace2cccd50e0382b4b6201f3916b57c5

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
DATA 200
OK truncated
/ 242 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1f4513a435d6a3047d20a50c1e7d4263de42146c74be227f774b5e82e6357e75

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 pro-v4-shims.min.js Show response
ka-p.fontawesome.com/releases/v6.1.2/js/ 25 KB
7 KB 51ms
42ms Fetch
application/javascript 104.18.22.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.1.2/js/pro-v4-shims.min.js?token=8175422aa5
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/8175422aa5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.22.52 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 58563f3a2d9227336c9973a3f940620da1ad75f8a8788914c0d190eb7ecb4f7b

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 06:08:24 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 25 Jul 2022 14:58:25 GMT
server: cloudflare
age: 169567
etag: "62deaf91-1c62"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 73f1ac6a8b86f142-ARN
content-length: 7266

GET
H2 200 pro.min.js Show response
ka-p.fontawesome.com/releases/v6.1.2/js/ 58 KB
17 KB 49ms
40ms Fetch
application/javascript 104.18.22.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.1.2/js/pro.min.js?token=8175422aa5
Requested by: Host: kit.fontawesome.com
URL: https://kit.fontawesome.com/8175422aa5.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.22.52 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 9f207bc1ab70e67d814c0128d37f3fc4f4dd7222eacd9b4fd97c7af80011d90c

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 06:08:24 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 25 Jul 2022 14:58:26 GMT
server: cloudflare
age: 841713
etag: "62deaf92-42c5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: max-age=31556926
accept-ranges: bytes
cf-ray: 73f1ac6a8b84f142-ARN
content-length: 17093

GET
H2 200 plus.svg Show response
ka-p.fontawesome.com/releases/v6.1.2/svgs/regular/ 495 B
426 B 39ms
38ms Fetch
image/svg+xml 104.18.22.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.1.2/svgs/regular/plus.svg?token=8175422aa5
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.22.52 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 4983a880c232a7d83c7167b2c1283c92d4d1b4fee25a872ce5111020c4fc2129

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 06:08:24 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 25 Jul 2022 15:02:14 GMT
server: cloudflare
age: 169567
etag: W/"62deb076-1ef"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31556926
cf-ray: 73f1ac6aebd0f142-ARN

GET
H2 200 linkedin.svg Show response
ka-p.fontawesome.com/releases/v6.1.2/svgs/brands/ 672 B
515 B 38ms
38ms Fetch
image/svg+xml 104.18.22.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.1.2/svgs/brands/linkedin.svg?token=8175422aa5
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.22.52 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 20274ca1a875a2edadb3d303c4e38673eff024012cc2d4ee2d45d0f37c652de9

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 06:08:24 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 25 Jul 2022 14:58:31 GMT
server: cloudflare
age: 169567
etag: W/"62deaf97-2a0"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31556926
cf-ray: 73f1ac6aebd1f142-ARN

GET
H2 200 twitter.svg Show response
ka-p.fontawesome.com/releases/v6.1.2/svgs/brands/ 1 KB
692 B 42ms
42ms Fetch
image/svg+xml 104.18.22.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.1.2/svgs/brands/twitter.svg?token=8175422aa5
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.22.52 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 77267469725d55f196122b3cbbbc2dc91aa58b8ea540b919166b2af9a65f8811

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 06:08:24 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 25 Jul 2022 14:58:33 GMT
server: cloudflare
age: 169567
etag: W/"62deaf99-40f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31556926
cf-ray: 73f1ac6aebd2f142-ARN

GET
H2 200 facebook.svg Show response
ka-p.fontawesome.com/releases/v6.1.2/svgs/brands/ 512 B
439 B 40ms
39ms Fetch
image/svg+xml 104.18.22.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.1.2/svgs/brands/facebook.svg?token=8175422aa5
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.22.52 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c9d0305dc69f8bf6e6d41a78158a4d4a57adcc9c7e3119da094aecba8d8bb1ca

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 06:08:24 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 25 Jul 2022 14:58:29 GMT
server: cloudflare
age: 841713
etag: W/"62deaf95-200"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31556926
cf-ray: 73f1ac6aebd3f142-ARN

GET
H2 200 envelope.svg Show response
ka-p.fontawesome.com/releases/v6.1.2/svgs/regular/ 655 B
490 B 40ms
40ms Fetch
image/svg+xml 104.18.22.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.1.2/svgs/regular/envelope.svg?token=8175422aa5
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.22.52 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 19542126d3b50e54c33964b9ba55d73446f44a906a00890dcc11831fe6f7fbb9

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 06:08:24 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 25 Jul 2022 15:01:55 GMT
server: cloudflare
age: 169567
etag: W/"62deb063-28f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31556926
cf-ray: 73f1ac6aebd5f142-ARN

GET
H2 200 xmark-large.svg Show response
ka-p.fontawesome.com/releases/v6.1.2/svgs/regular/ 621 B
433 B 62ms
61ms Fetch
image/svg+xml 104.18.22.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.1.2/svgs/regular/xmark-large.svg?token=8175422aa5
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.22.52 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 23de1cb2230bf765758536a878a27d76a66aa2c17bc44df0543fbbbf2156b8a3

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 06:08:24 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 25 Jul 2022 15:03:15 GMT
server: cloudflare
age: 841713
etag: W/"62deb0b3-26d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31556926
cf-ray: 73f1ac6aebd6f142-ARN

GET
H2 200 angle-down.svg Show response
ka-p.fontawesome.com/releases/v6.1.2/svgs/solid/ 457 B
391 B 38ms
38ms Fetch
image/svg+xml 104.18.22.52
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ka-p.fontawesome.com/releases/v6.1.2/svgs/solid/angle-down.svg?token=8175422aa5
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.22.52 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 47ec670b2b053a1bf45b88f90e9473a11606c9f9261cc4addf5dceb4590afd3e

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 06:08:24 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 25 Jul 2022 15:03:16 GMT
server: cloudflare
age: 169567
etag: W/"62deb0b4-1c9"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Origin, Accept-Encoding, Access-Control-Request-Headers, Access-Control-Request-Method
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: max-age=31556926
cf-ray: 73f1ac6aebd8f142-ARN

GET
H2 200 ipv
cdn.bizible.com/m/ 43 B
304 B 54ms
54ms Image
image/gif 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.bizible.com/m/ipv?_biz_r=&_biz_h=-1906410348&_biz_u=0016b2d0acb44461d57d70314c4f5a6f&_biz_s=5a4e4a&_biz_l=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fevil-plc-attack-using-a-controller-as-predator-rather-than-prey&_biz_t=1661234904844&_biz_i=Evil%20PLC%20Attack%3A%20Hacking%20PLCs%20to%20Attack%20Engineering%20Workstations%20%7C%20Claroty&_biz_n=0&rnd=950360&cdn_o=a&_biz_z=1661234904845
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (amb/6B75) /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 23 Aug 2022 06:08:24 GMT
last-modified: Wed, 17 Aug 2022 18:20:06 GMT
server: ECS (amb/6B75)
age: 474498
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-cache, no-store
accept-ranges: bytes
content-type: Image/GIF
content-length: 43
expires: -1

GET
H2 200 u
cdn.bizibly.com/ 43 B
202 B 69ms
52ms Image
image/gif 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.bizibly.com/u?_biz_u=0016b2d0acb44461d57d70314c4f5a6f&_biz_s=5a4e4a&_biz_l=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fevil-plc-attack-using-a-controller-as-predator-rather-than-prey&_biz_t=1661234904847&_biz_i=Evil%20PLC%20Attack%3A%20Hacking%20PLCs%20to%20Attack%20Engineering%20Workstations%20%7C%20Claroty&rnd=755958&cdn_o=a&_biz_z=1661234904847
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (amb/6B97) /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 23 Aug 2022 06:08:24 GMT
last-modified: Sun, 21 Aug 2022 01:19:48 GMT
server: ECS (amb/6B97)
age: 190116
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-cache, no-store
accept-ranges: bytes
content-type: Image/GIF
content-length: 43
expires: -1

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 106 KB
41 KB 70ms
69ms Script
application/javascript 142.250.186.104
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=UA-84224451-1&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-23917942-3

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.186.104 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra24s06-in-f8.1e100.net

Software

Google Tag Manager /

Resource Hash

c283a11b65fbd08701549e53a54ec18a8b5570b0b024ba25bdc95ad9c53550e9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 06:08:24 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42011
x-xss-protection: 0
expires: Tue, 23 Aug 2022 06:08:24 GMT

GET
H2 200 xdc.js Show response
cdn.bizible.com/ 84 B
492 B 157ms
156ms Script
text/javascript 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.bizible.com/xdc.js?_biz_u=0016b2d0acb44461d57d70314c4f5a6f&_biz_h=-1906410348&cdn_o=a&jsVer=4.22.08.11
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (amb/6BBB) /
Resource Hash: 6d22e660ead72f14b0aa8e3dfc8de1da35f17e3559b489e00692f15f50faa1a6

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 06:08:24 GMT
content-encoding: gzip
server: ECS (amb/6BBB)
etag: EFEDFBC3
vary: Accept-Encoding
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: private, must-revalidate, max-age=21600
content-type: text/javascript; charset=utf-8
content-length: 186

GET
H2

200

51557
stags.bluekai.com/site/
Redirect Chain

https://aorta.clickagy.com/pixel.gif?ch=278&cm=ffa748f9b4fdb0570a4227f9fa348ec807fc42ffea1789af2b153679b79aaa75
https://dpm.demdex.net/ibs:dpid=79908&dpuuid=c:86a2a9180a4b27a53f5bfd72ef010a07&redir=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D124%26cm%3D%24%7BDD_UUID%7D
https://dpm.demdex.net/demconf.jpg?et:ibs%7cdata:dpid=79908&dpuuid=c:86a2a9180a4b27a53f5bfd72ef010a07&redir=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D124%26cm%3D%24%7BDD_U...
https://aorta.clickagy.com/pixel.gif?clkgypv=pxl&ch=124&cm=75088851258474672530604108102625485233
https://aa.agkn.com/adscores/g.pixel?sid=9212289188&_puid=c:86a2a9180a4b27a53f5bfd72ef010a07&_redir=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D128%26cm%3D
https://d.agkn.com/pixel/10751/?che=1661234907040&ip=185.147.213.146&l1=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D128%26cm%3D216633104252000534145
https://aorta.clickagy.com/pixel.gif?clkgypv=pxl&ch=128&cm=216633104252000534145
https://dpm.demdex.net/ibs:dpid=79908&dpuuid=c:86a2a9180a4b27a53f5bfd72ef010a07&redir=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D124%26cm%3D%24%7BDD_UUID%7D
https://aorta.clickagy.com/pixel.gif?clkgypv=pxl&ch=124&cm=75088851258474672530604108102625485233
https://aa.agkn.com/adscores/g.pixel?sid=9212289188&_puid=c:86a2a9180a4b27a53f5bfd72ef010a07&_redir=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D128%26cm%3D
https://d.agkn.com/pixel/10751/?che=1661234907715&ip=185.147.213.146&l1=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D128%26cm%3D216633104252000534145
https://aorta.clickagy.com/pixel.gif?clkgypv=pxl&ch=128&cm=216633104252000534145
https://stags.bluekai.com/site/51557?id=c:86a2a9180a4b27a53f5bfd72ef010a07&redir=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D122%26cm%3D$_BK_UUID&BKUUID=$_BK_UUID&limit=1

62 B
227 B

326ms
197ms

Image
image/gif

104.111.215.191
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://stags.bluekai.com/site/51557?id=c:86a2a9180a4b27a53f5bfd72ef010a07&redir=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D122%26cm%3D$_BK_UUID&BKUUID=$_BK_UUID&limit=1
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey
Protocol: H2
Server: 104.111.215.191 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-215-191.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: 0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 06:08:28 GMT
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV", policyref="http://tags.bluekai.com/w3c/p3p.xml"
content-length: 62
content-type: image/gif

Redirect headers

date: Tue, 23 Aug 2022 06:08:27 GMT
server: Aorta/20220823.10fb48f9
location: https://stags.bluekai.com/site/51557?id=c:86a2a9180a4b27a53f5bfd72ef010a07&redir=https%3A%2F%2Faorta.clickagy.com%2Fpixel.gif%3Fclkgypv%3Dpxl%26ch%3D122%26cm%3D$_BK_UUID&BKUUID=$_BK_UUID&limit=1
expect: 0
access-control-max-age: 31536000
access-control-allow-methods: POST, GET, OPTIONS
content-type: application/json
access-control-allow-origin
access-control-expose-headers: Set-Cookie
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
x-aorta-region: us-east-1
x-aorta-host: d5a2b255d7cb
access-control-allow-headers: Origin,cache-control,content-type,man,messagetype,soapaction
content-length: 0

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 8 KB
3 KB 174ms
49ms Script
application/x-javascript 2.21.20.160
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MWHFVG2
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2.21.20.160 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS: a2-21-20-160.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: b57839788686bf37d29f47bbe45ad8258085e3aebf54650ab389c0b515b977e1

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 06:08:25 GMT
content-encoding: gzip
last-modified: Fri, 12 Aug 2022 20:23:36 GMT
x-cdn: AKAM
vary: Accept-Encoding
content-type: application/x-javascript;charset=utf-8
cache-control: max-age=43297
accept-ranges: bytes
content-length: 3063

GET
H2 200 6563.js Show response
script.crazyegg.com/pages/scripts/0111/ 6 KB
2 KB 128ms
49ms Script
text/javascript 104.19.147.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/scripts/0111/6563.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MWHFVG2
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.147.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 19a1698d216fb83820dd96b6778f0095ba9b01744bf57343067ef7733b5f19be

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 06:08:25 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 59155
cf-polished: origSize=5637
cf-ray: 73f1ac6c6c3d168d-ARN
ce-version: 11.3.1
last-modified: Mon, 22 Aug 2022 13:42:30 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
access-control-expose-headers: CE-Version
cache-control: public, max-age=300, s-maxage=1209600
timing-allow-origin: *
cf-bgj: minify

GET
H2 200 /
insight.adsrvr.org/track/pxl/ 70 B
261 B 209ms
71ms Image
image/gif 15.197.193.217
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://insight.adsrvr.org/track/pxl/?adv=fmojdlh&ct=0:hz6aipu&fmt=3
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 15.197.193.217 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: a12b7a488abeaa9e4.awsglobalaccelerator.com
Software: /
Resource Hash: 8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 23 Aug 2022 06:08:25 GMT
cache-control: private,no-cache, must-revalidate
x-aspnet-version: 4.0.30319
content-type: image/gif
p3p: CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 182ms
58ms Script
text/javascript 142.250.185.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=UA-84224451-1&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 Apr 2022 21:02:38 GMT
server: Golfe2
age: 3985
date: Tue, 23 Aug 2022 05:02:00 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Tue, 23 Aug 2022 07:02:00 GMT

GET
H2 200 claroty.com.json Show response
script.crazyegg.com/pages/data-scripts/0111/6563/site/ Frame 8F95 10 KB
2 KB 99ms
40ms XHR
application/json 104.19.147.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/data-scripts/0111/6563/site/claroty.com.json?t=1
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0111/6563.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.147.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d17a3a8281fa74c85bae46645b1bcff72992ca6324d66b1afb98a6bcd5230775

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 06:08:25 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 59155
ce-version: 11.3.1
content-length: 2064
timing-allow-origin: *
last-modified: Mon, 22 Aug 2022 13:42:30 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: CE-Version
cache-control: public, max-age=300, s-maxage=1209600
accept-ranges: bytes
cf-ray: 73f1ac6d3c9c98eb-ARN

GET
H2 200 collect
px.ads.linkedin.com/ 0
724 B 207ms
146ms Image
application/javascript 13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1162802&time=1661234905110&url=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fevil-plc-attack-using-a-controller-as-predator-rather-than-prey
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 06:08:24 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 948F00B45D224EF2A31A6453F9F9818B Ref B: STOEDGE1216 Ref C: 2022-08-23T06:08:25Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXm4mRqUC0e55cmhncMRA==
x-li-fabric: prod-lva1

GET
H2 200 f30431b605ce646bd8628da6029940c8.js Show response
script.crazyegg.com/pages/versioned/common-scripts/ 91 KB
29 KB 35ms
35ms Script
text/javascript 104.19.147.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/versioned/common-scripts/f30431b605ce646bd8628da6029940c8.js
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/scripts/0111/6563.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.147.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: c25c9c2ea873488e17a93c95c618a9f82aa7517ffc96cb26d2cf265c12b4dd85

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

timing-allow-origin: *
date: Tue, 23 Aug 2022 06:08:25 GMT
content-encoding: gzip
cf-cache-status: HIT
last-modified: Mon, 15 Aug 2022 18:07:26 GMT
server: cloudflare
age: 59293
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000, s-maxage=31536000
accept-ranges: bytes
cf-ray: 73f1ac6d7dca168d-ARN
content-length: 30003

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 182ms
65ms XHR
text/plain 142.250.185.238
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1111708385&t=pageview&_s=1&dl=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fevil-plc-attack-using-a-controller-as-predator-rather-than-prey&ul=en-us&de=UTF-8&dt=Evil%20PLC%20Attack%3A%20Hacking%20PLCs%20to%20Attack%20Engineering%20Workstations%20%7C%20Claroty&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAUABAAAAAC~&jid=1883798766&gjid=753737789&cid=2004486452.1661234905&tid=UA-84224451-1&_gid=1167781427.1661234905&_r=1&gtm=2ou8m0&z=1246202576

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js

Protocol

Security

QUIC, , AES_128_GCM

Server

142.250.185.238 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s53-in-f14.1e100.net

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer
accept-language: se-SE,se;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Tue, 23 Aug 2022 06:08:25 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://claroty.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 claroty.com.json Show response
script.crazyegg.com/pages/data-scripts/0111/6563/sampling/ Frame 8F95 154 B
209 B 43ms
43ms XHR
application/json 104.19.147.8
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://script.crazyegg.com/pages/data-scripts/0111/6563/sampling/claroty.com.json?t=461454
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/f30431b605ce646bd8628da6029940c8.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.19.147.8 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ed038587e2640b7201160586ba3c7a777286c39ec5a0f6b3f59d4008fcb4a4b0

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 06:08:25 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 59155
ce-version: 11.3.1
content-length: 143
timing-allow-origin: *
last-modified: Mon, 22 Aug 2022 13:42:30 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: CE-Version
cache-control: public, max-age=300, s-maxage=1209600
accept-ranges: bytes
cf-ray: 73f1ac6dcd7298eb-ARN

GET
H2 200 healthcheck Show response
pagestates-tracking.crazyegg.com/ Frame 8F95 19 B
461 B 168ms
52ms XHR
application/json 143.204.89.72
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://pagestates-tracking.crazyegg.com/healthcheck
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/f30431b605ce646bd8628da6029940c8.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 143.204.89.72 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-89-72.fra50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 830e67bda2532cd5880ee86e3b33e69721082f8458bb0df0cd4edbb1577fd375

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Thu, 14 Jul 2022 06:23:23 GMT
via: 1.1 0d37b2e69745cd9f0c5457fbf1a83128.cloudfront.net (CloudFront)
age: 3455103
x-cache: Hit from cloudfront
content-length: 19
last-modified: Fri, 08 Jul 2022 22:25:51 GMT
server: AmazonS3
etag: "d06f04fccf68d0b228a5923187ce1afd"
access-control-max-age: 31536000
access-control-allow-methods: GET, HEAD
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin
x-amz-cf-pop: FRA50-C1
accept-ranges: bytes
x-amz-cf-id: 7rxrysXHj9TUpw4CvXNWEpCceOquMXsSH1ZJvyoKXFzgqthMVi3sIw==

GET
H2 200 healthcheck Show response
assets-tracking.crazyegg.com/ Frame 8F95 19 B
459 B 166ms
51ms XHR
application/json 18.66.122.57
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://assets-tracking.crazyegg.com/healthcheck
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/f30431b605ce646bd8628da6029940c8.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.122.57 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-122-57.fra60.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 830e67bda2532cd5880ee86e3b33e69721082f8458bb0df0cd4edbb1577fd375

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Mon, 11 Jul 2022 15:01:20 GMT
via: 1.1 935770605c74a80712059ba5b24d4162.cloudfront.net (CloudFront)
age: 3683226
x-cache: Hit from cloudfront
content-length: 19
last-modified: Fri, 08 Jul 2022 22:25:51 GMT
server: AmazonS3
etag: "d06f04fccf68d0b228a5923187ce1afd"
access-control-max-age: 31536000
access-control-allow-methods: GET, HEAD
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: Access-Control-Allow-Origin
x-amz-cf-pop: FRA60-P2
accept-ranges: bytes
x-amz-cf-id: C5Cesc7enDeD-Z_5fpJ8EWlc1N68nF8_XQAmfoJZaV4lyDrnVRhU0w==

GET
BLOB 200
OK fe5dc647-06c3-4c2e-879a-ac4c661275fc
https://claroty.com/ 53 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://claroty.com/fe5dc647-06c3-4c2e-879a-ac4c661275fc
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8ff09cd0ee012fe06ed1b67dc914858cde819f21bb479f629994d9e49f3c0049

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Length: 53
Content-Type: text/javascript

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
439 B 169ms
55ms XHR
text/plain 173.194.76.155
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-84224451-1&cid=2004486452.1661234905&jid=1883798766&gjid=753737789&_gid=1167781427.1661234905&_u=YEBAAUAAAAAAAC~&z=120025783

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

173.194.76.155 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

ws-in-f155.1e100.net

Software

Golfe2 /

Resource Hash

08f3d7de7aea50ee4f77098ffd4ecce4d803a35b21285f45e6b72e3a497d7122

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer
accept-language: se-SE,se;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Tue, 23 Aug 2022 06:08:25 GMT
content-type: text/plain
access-control-allow-origin: https://claroty.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK messenger Show response
app.qualified.com/w/1/PaboXyMA4piyRkBp/ Frame 93DB 4 KB
2 KB 487ms
179ms Document
text/html 54.156.137.3
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://app.qualified.com/w/1/PaboXyMA4piyRkBp/messenger?uuid=d4275d1f-bd50-4030-ac8b-1d2bba0dfb46

Requested by

Host: js.qualified.com
URL: https://js.qualified.com/qualified.js?token=PaboXyMA4piyRkBp

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

54.156.137.3 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-54-156-137-3.compute-1.amazonaws.com

Software

nginx /

Resource Hash

ca01226ef8770932285e0ad80f0eb25a8236e824d6e8116043a1a66db8873974

Security Headers

Name	Value
Content-Security-Policy
Strict-Transport-Security	max-age=63072000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
accept-language: se-SE,se;q=0.9

Response headers

Cache-Control: max-age=0, private, must-revalidate
Content-Encoding: gzip
Content-Length: 1385
Content-Security-Policy
Content-Type: text/html; charset=utf-8
Date: Tue, 23 Aug 2022 06:08:25 GMT
Etag: W/"ca01226ef8770932285e0ad80f0eb25a"
Link: <https://assets.qualified.com/packs/css/8-f971891a.chunk.css>; rel=preload; as=style; nopush,<https://assets.qualified.com/packs/css/widget/sandboxed/messenger-db0aac4f.chunk.css>; rel=preload; as=style; nopush
Referrer-Policy: strict-origin-when-cross-origin
Server: nginx
Strict-Transport-Security: max-age=63072000; includeSubDomains
Vary: Accept-Encoding
Via: 1.1 spaces-router (a302eeabfffb)
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Permitted-Cross-Domain-Policies: none
X-Request-Id: 956eb924-bc2d-6600-7a0f-62ae1b582fad
X-Runtime: 0.039073
X-Xss-Protection: 1; mode=block

GET
H/1.1 200
OK dc.js Show response
security.claroty.com/dcjs/902751/547/ 46 B
588 B 506ms
207ms Script
text/javascript 3.215.172.219
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://security.claroty.com/dcjs/902751/547/dc.js
Requested by: Host: js.qualified.com
URL: https://js.qualified.com/qualified.js?token=PaboXyMA4piyRkBp
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 3.215.172.219 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-215-172-219.compute-1.amazonaws.com
Software: PardotServer /
Resource Hash: 7bba17b490076798f613f9b01da8d6a2eb79808ae687d3e56543ba95fff3b16c

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
Date: Tue, 23 Aug 2022 06:08:25 GMT
X-Pardot-Route: e8229a0ff18ebffc83a98010d2521dd5
x-pardot-rsp: 0/0/1
vary: User-Agent
p3p: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml"
cache-control: no-store, no-cache, must-revalidate
Connection: keep-alive
Content-Type: text/javascript; charset=utf-8
Content-Length: 46
Server: PardotServer
expires: Thu, 19 Nov 1981 08:52:00 GMT

GET
H2 200 clock Show response
tracking.crazyegg.com/ Frame 8F95 29 B
136 B 219ms
74ms XHR
text/plain 52.17.107.162
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://tracking.crazyegg.com/clock?t=1661234905469
Requested by: Host: script.crazyegg.com
URL: https://script.crazyegg.com/pages/versioned/common-scripts/f30431b605ce646bd8628da6029940c8.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.17.107.162 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-17-107-162.eu-west-1.compute.amazonaws.com
Software: awselb/2.0 /
Resource Hash: 26e42ae4b6800e426c87a9ad7def357e67ce197c02a9e0672081272a040a1ce1

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

access-control-allow-origin: *
date: Tue, 23 Aug 2022 06:08:25 GMT
cache-control: no-store
server: awselb/2.0
content-length: 29
content-type: text/plain

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
501 B 188ms
67ms Image
image/gif 172.217.23.100
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-84224451-1&cid=2004486452.1661234905&jid=1883798766&_u=YEBAAUAAAAAAAC~&z=2026366373

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

172.217.23.100 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

mil04s23-in-f4.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 23 Aug 2022 06:08:25 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.se/ads/ 42 B
501 B 202ms
70ms Image
image/gif 142.250.185.163
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.se/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-84224451-1&cid=2004486452.1661234905&jid=1883798766&_u=YEBAAUAAAAAAAC~&z=2026366373

Requested by

Host: claroty.com
URL: https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

142.250.185.163 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

fra16s51-in-f3.1e100.net

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
date: Tue, 23 Aug 2022 06:08:25 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
BLOB 200
OK 199eaa7d-fc2d-482b-8a68-b453ed1366ab
https://claroty.com/ 266 B
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://claroty.com/199eaa7d-fc2d-482b-8a68-b453ed1366ab
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: e6c1bf5175900cc25cae3383d7ca8afa2c48ad649c1ef82ee728bbcda0c3f3d7

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Content-Length: 266
Content-Type: text/javascript

GET
H2 200 8-f971891a.chunk.css
assets.qualified.com/packs/css/ Frame 93DB 36 KB
7 KB 49ms
39ms Stylesheet
text/css 104.18.16.5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.qualified.com/packs/css/8-f971891a.chunk.css
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.16.5 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 14af2efd1ba7693a1cdcb26e6ac51d275fa524187d0bd42b3c908c969302d2b1

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://app.qualified.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 06:08:25 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 5466
x-amz-request-id: 3TY0Y01RP5RA9MCT
x-amz-id-2: rNUG0i0HSy4GeGEklH2j9F+7rMvxKE+ZzR/LxtP9iqOuS4iiyr1NHbcYUSviAHZN6f07N6e/AeY=
last-modified: Tue, 16 Aug 2022 21:40:07 GMT
server: cloudflare
etag: W/"c02a73c815c36eb663b1c6818ae4813e"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
x-amz-version-id: m1aDhOXHs0hBFRivb06Jqgo0YiJfUDbS
cf-ray: 73f1ac726fa198ee-ARN
expires: Tue, 23 Aug 2022 10:08:25 GMT

GET
H2 200 messenger-db0aac4f.chunk.css
assets.qualified.com/packs/css/widget/sandboxed/ Frame 93DB 5 KB
1 KB 57ms
48ms Stylesheet
text/css 104.18.16.5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.qualified.com/packs/css/widget/sandboxed/messenger-db0aac4f.chunk.css
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.16.5 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ccfdfabc7b73e52243d66188306a7c01551ee7bd91673d3817343421876e4ed3

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://app.qualified.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 06:08:26 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 5466
x-amz-request-id: APY9T8WF7RAM7WGG
x-amz-id-2: 7JpSF1WsqaVL2A2DQxiMT2OmxpHynuDzkNuqV3+CrGf0RiQSZWKb5c49ev8Ue/fs6Tx5Bv/Nrhw=
last-modified: Tue, 21 Jun 2022 21:59:03 GMT
server: cloudflare
etag: W/"8ca79772395d002f45d486899015216d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: text/css
cache-control: public, max-age=14400
x-amz-version-id: dd9TQgIpoCQ51hWdVTdjOVf2E3XDbAsO
cf-ray: 73f1ac726fa098ee-ARN
expires: Tue, 23 Aug 2022 10:08:25 GMT

GET
H2 200 messenger~runtime-7399d3560735b7e00052.js Show response
assets.qualified.com/packs/js/widget/sandboxed/ Frame 93DB 2 KB
2 KB 36ms
35ms Script
application/javascript 104.18.16.5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.qualified.com/packs/js/widget/sandboxed/messenger~runtime-7399d3560735b7e00052.js
Requested by: Host: app.qualified.com
URL: https://app.qualified.com/w/1/PaboXyMA4piyRkBp/messenger?uuid=d4275d1f-bd50-4030-ac8b-1d2bba0dfb46
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.16.5 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: a084f41c6193750c66470dc75e146a52b81a1f51e0a62d4cc06002d0d7456276

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://app.qualified.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 06:08:25 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 4350
x-amz-request-id: 5EH28BAEWB93129Y
x-amz-id-2: DN/xtf9/w9nT+7DE0T/D089DHhOcvOfqH2S3Bc4CrxCsG4Ezey3t6a7kHyW8rjZcR1NWJHTqK6E=
last-modified: Tue, 23 Aug 2022 00:50:14 GMT
server: cloudflare
etag: W/"b4c8d52169b8dcbc4de17dcd63405858"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=14400
x-amz-version-id: uZ9CF2KwTtkco_SIyaPucZ5DBn1w8HiM
cf-ray: 73f1ac726fa598ee-ARN
expires: Tue, 23 Aug 2022 10:08:25 GMT

GET
H2 200 8-7a010f76d6a2f432d6ab.chunk.js Show response
assets.qualified.com/packs/js/widget-sandboxed-chunks/ Frame 93DB 1 MB
316 KB 38ms
38ms Script
application/javascript 104.18.16.5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.qualified.com/packs/js/widget-sandboxed-chunks/8-7a010f76d6a2f432d6ab.chunk.js
Requested by: Host: app.qualified.com
URL: https://app.qualified.com/w/1/PaboXyMA4piyRkBp/messenger?uuid=d4275d1f-bd50-4030-ac8b-1d2bba0dfb46
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.16.5 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: d9c3dc6527a217c91ebd32b24a7b44ae077d21bf8d5cb237b5cf2f49bae7b41f

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://app.qualified.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 06:08:25 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 4350
x-amz-request-id: 5EH0CD5CH62N2D2E
x-amz-id-2: cUBy2z0QrmPVXGZVD6s/gBaO5/iNUk8uuAlT0ok0hXC2u4jYjWPa2RRnLFUIJ9bqtC6/Bwcr9Ak=
last-modified: Tue, 23 Aug 2022 00:50:14 GMT
server: cloudflare
etag: W/"8228213e6d614bc780a4d084fb732438"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=14400
x-amz-version-id: ZQBxOclr7EauG7aRVxPjwhojY5a.4VRW
cf-ray: 73f1ac726fa698ee-ARN
expires: Tue, 23 Aug 2022 10:08:25 GMT

GET
H2 200 messenger-40074239384f3bfdf408.chunk.js Show response
assets.qualified.com/packs/js/widget-sandboxed-chunks/widget/sandboxed/ Frame 93DB 569 KB
125 KB 43ms
42ms Script
application/javascript 104.18.16.5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.qualified.com/packs/js/widget-sandboxed-chunks/widget/sandboxed/messenger-40074239384f3bfdf408.chunk.js
Requested by: Host: app.qualified.com
URL: https://app.qualified.com/w/1/PaboXyMA4piyRkBp/messenger?uuid=d4275d1f-bd50-4030-ac8b-1d2bba0dfb46
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.16.5 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: ffd637f3040261ac8c666711cb009187db39cefad43e8f0cda25765ce03bc2c5

Request headers

accept-language: se-SE,se;q=0.9
Referer: https://app.qualified.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 06:08:26 GMT
content-encoding: gzip
cf-cache-status: HIT
age: 4351
x-amz-request-id: 5EH5SGYVRWF4VF3A
x-amz-id-2: DnBhWkpLJnYwZTXqWHS0Oy99F/QauypAZM8EodBVkIjphi0rjn+1HbQ3sGGG/KtTT34C4UlscPQ=
last-modified: Tue, 23 Aug 2022 00:50:14 GMT
server: cloudflare
etag: W/"67a05537945c797c65e5740e908fbf27"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding
content-type: application/javascript
cache-control: public, max-age=14400
x-amz-version-id: QGmsFgEQfySOYNpMtHbNJ7cbn6yRdO1i
cf-ray: 73f1ac72a80198ee-ARN
expires: Tue, 23 Aug 2022 10:08:26 GMT

GET
H2 200 Inter-Regular-cd3c302ecefb19f92003ef258645c37c.woff2
assets.qualified.com/packs/media/fonts/inter/ Frame 93DB 115 KB
115 KB 114ms
40ms Font
font/woff2 104.18.16.5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.qualified.com/packs/media/fonts/inter/Inter-Regular-cd3c302ecefb19f92003ef258645c37c.woff2
Requested by: Host: app.qualified.com
URL: https://app.qualified.com/w/1/PaboXyMA4piyRkBp/messenger?uuid=d4275d1f-bd50-4030-ac8b-1d2bba0dfb46
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.16.5 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bf1ffcb96984568b22f7a9029dd980abb5a4a47700f588a16b8ace0f7412977e

Request headers

Referer: https://app.qualified.com/
Origin: https://app.qualified.com
accept-language: se-SE,se;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 06:08:26 GMT
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
cf-cache-status: HIT
age: 5379127
content-length: 117248
x-amz-request-id: APY42GBYSDYB01Z7
x-amz-id-2: bwWIVryLVS0i/iz+jqnAhYtNOKpYyOYpVdOyeJY4muBe3OS42s8BWOIWAqS/tHwnXyTEBglRbH8=
last-modified: Tue, 21 Jun 2022 21:59:09 GMT
server: cloudflare
etag: "2ddfbbfd61fa41d24078763e3740d72f"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 3600
access-control-allow-methods: GET
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31557600
x-amz-version-id: HiAc8BRSgXQaTJStL3sFNz2gMEW3a_fM
accept-ranges: bytes
cf-ray: 73f1ac72db92990f-ARN
expires: Wed, 23 Aug 2023 12:08:26 GMT

GET
H2 200 Inter-SemiBold-c1b3bf01f912184899dbb6fbb4029910.woff2
assets.qualified.com/packs/media/fonts/inter/ Frame 93DB 123 KB
123 KB 147ms
72ms Font
font/woff2 104.18.16.5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://assets.qualified.com/packs/media/fonts/inter/Inter-SemiBold-c1b3bf01f912184899dbb6fbb4029910.woff2
Requested by: Host: app.qualified.com
URL: https://app.qualified.com/w/1/PaboXyMA4piyRkBp/messenger?uuid=d4275d1f-bd50-4030-ac8b-1d2bba0dfb46
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 104.18.16.5 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 41e5c059963bd8f9bc4097f78535c3d722f4d73e75c46b2df5cc74bf864af150

Request headers

Referer: https://app.qualified.com/
Origin: https://app.qualified.com
accept-language: se-SE,se;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

date: Tue, 23 Aug 2022 06:08:26 GMT
vary: Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
cf-cache-status: HIT
age: 5379127
content-length: 125644
x-amz-request-id: APYBPDVTMKFG1HN3
x-amz-id-2: fr4QbhNKY0+K7XFdYs1qxHl0W5UTGHwQwA6q1J+bIj8tv0r2ToV6uHIBxS5XlGo1sqXDTJ839bI=
last-modified: Tue, 21 Jun 2022 21:59:09 GMT
server: cloudflare
etag: "fa8b08c22a80fb7a4a31bcbb3898e719"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
access-control-max-age: 3600
access-control-allow-methods: GET
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31557600
x-amz-version-id: N1_fZOTf8w1whUurfXJA3MI8Rv4M1CD5
accept-ranges: bytes
cf-ray: 73f1ac72db94990f-ARN
expires: Wed, 23 Aug 2023 12:08:26 GMT

POST
H/1.1 200
OK / Show response
sentry.io/api/1332833/envelope/ Frame 93DB 2 B
407 B 591ms
147ms Fetch
application/json 35.188.42.15
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://sentry.io/api/1332833/envelope/?sentry_key=b5158ee3382d49b28a864fb2b91bcaaf&sentry_version=7&sentry_client=sentry.javascript.browser%2F7.11.1

Requested by

Host: assets.qualified.com
URL: https://assets.qualified.com/packs/js/widget-sandboxed-chunks/8-7a010f76d6a2f432d6ab.chunk.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

35.188.42.15 Council Bluffs, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

15.42.188.35.bc.googleusercontent.com

Software

nginx /

Resource Hash

44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

Referer: https://app.qualified.com/
accept-language: se-SE,se;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

Date: Tue, 23 Aug 2022 06:08:26 GMT
vary: Origin
Server: nginx
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Type: application/json
access-control-allow-origin: https://app.qualified.com
access-control-expose-headers: x-sentry-rate-limits, retry-after, x-sentry-error
x-envoy-upstream-service-time: 0
Connection: keep-alive
Content-Length: 2

GET
H/1.1 200
OK pd.js Show response
pi.pardot.com/ 5 KB
2 KB 517ms
136ms Script
application/javascript 3.215.172.219
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://pi.pardot.com/pd.js
Requested by: Host: claroty.com
URL: https://claroty.com/team82/research/evil-plc-attack-using-a-controller-as-predator-rather-than-prey
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 3.215.172.219 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-3-215-172-219.compute-1.amazonaws.com
Software: PardotServer /
Resource Hash: 3b91e6a4b14493d67f9660e6d4a2e27c1eea54d97ccb7c30acf3b89998b3be99

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

Date: Tue, 23 Aug 2022 06:08:28 GMT
content-encoding: gzip
X-Pardot-Route: 16b0ab393667a33fe86adedc3141e88c
last-modified: Mon, 22 Aug 2022 05:19:51 GMT
Server: PardotServer
etag: "1547-gzip"
vary: Accept-Encoding,User-Agent
Content-Type: application/javascript
cache-control: max-age=63072000
Connection: keep-alive
accept-ranges: bytes
Content-Length: 1946
expires: Thu, 22 Aug 2024 06:08:28 GMT

GET
H/1.1 200
OK analytics Show response
pi.pardot.com/ 2 KB
1 KB 202ms
202ms Script
text/javascript 3.215.172.219
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://pi.pardot.com/analytics?ver=3&visitor_id=&visitor_id_sign=&pi_opt_in=&campaign_id=5725&account_id=903751&title=Evil%20PLC%20Attack%3A%20Hacking%20PLCs%20to%20Attack%20Engineering%20Workstations%20%7C%20Claroty&url=https%3A%2F%2Fclaroty.com%2Fteam82%2Fresearch%2Fevil-plc-attack-using-a-controller-as-predator-rather-than-prey&referrer=

Requested by

Host: pi.pardot.com
URL: https://pi.pardot.com/pd.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

3.215.172.219 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-3-215-172-219.compute-1.amazonaws.com

Software

PardotServer /

Resource Hash

d7f0006485c76d46fc1a153846bbeb395302a26f20488094c935cdf55eb3c81e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: se-SE,se;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.101 Safari/537.36

Response headers

pragma: no-cache
Date: Tue, 23 Aug 2022 06:08:28 GMT
content-encoding: gzip
X-Pardot-Route: 9b06e8e2308c32c7bf9ba8adfb7be2e1
x-pardot-rsp: 0/0/1
vary: Accept-Encoding,User-Agent
Connection: keep-alive
p3p: CP="CAO DSP AND SO ON" policyref="/w3c/p3p.xml", CP="NOI DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT", policyref="/w3c/p3p.xml"
cache-control: no-store, no-cache, must-revalidate
strict-transport-security: max-age=31536000; includeSubDomains
Content-Type: text/javascript; charset=utf-8
Content-Length: 725
Server: PardotServer
expires: Thu, 19 Nov 1981 08:52:00 GMT

Verdicts & Comments Add Verdict or Comment

75 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

26 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
claroty.com/	1970-01-20 05:27:22	Name: XSRF-TOKEN Value: eyJpdiI6ImIxOE56VDdyMlM3SldySG5SSWZOMkE9PSIsInZhbHVlIjoic0EzYlovYlVjVjBBWGhucXAvUnhzbzRwYlNhaGhvOFl1YlRRZ2dQaWhsdmt6SGt3UHZKZlJoZHp0TWtXNlhIWFhrN3NvZWY4bEdrd0g5S3BRWTU4elVBR29CUW12bEZwUDRNcXJYa1dQSmtUdk1tQjEyZ2tCblo1MEMvRkFxc1oiLCJtYWMiOiI4MDg4ZWY0YTJkZWQ0NzI1ZjEzNGNjY2JhMzhhMTk5MDcxNjRiNmQ1ZTQ0ZWU1Zjk0NjdkYzkyNDkwYjg1ZjlmIiwidGFnIjoiIn0%3D
claroty.com/	1970-01-20 05:27:22	Name: claroty_session Value: eyJpdiI6IklxcGVMVENsRlNQVjNpVFlSdkliaUE9PSIsInZhbHVlIjoiUGNUZjYyc3EzVmVlTHNrV2lIWVdBbTVFT3I0ZWtrK1UxZnM2aGZDMjZjUWd5ak5rMXU4T3ZRUTBJUFAzVkRqbzJGRVdWNWFqdnhzajlhRGIzeW95OW81K1hENkJCVjB5d3pTMGd6d0t2NXljVWFNYXBIY0N1MCtlaWpMSExDRDEiLCJtYWMiOiIyOTg2NmFjOTNiYzg5ZTM4OTE5MTI5NTg2MjcyMTg1YTIyOTlhNjQwOGZjOTgyMDE2ZjgyYTM3ZGE3MjEzMjhhIiwidGFnIjoiIn0%3D
.claroty.com/	1970-01-20 15:03:14	Name: __q_state_PaboXyMA4piyRkBp Value: eyJ1dWlkIjoiZDQyNzVkMWYtYmQ1MC00MDMwLWFjOGItMWQyYmJhMGRmYjQ2IiwiY29va2llRG9tYWluIjoiY2xhcm90eS5jb20ifQ==
.claroty.com/	1970-01-20 14:12:50	Name: _biz_uid Value: 0016b2d0acb44461d57d70314c4f5a6f
.claroty.com/	1970-01-20 05:27:16	Name: _biz_sid Value: 5a4e4a
.claroty.com/	1970-01-20 14:12:50	Name: _biz_nA Value: 1
.bizible.com/	1970-01-20 14:12:50	Name: _BUID Value: 0016b2d0acb44461d57d70314c4f5a6f
.claroty.com/	1970-01-20 14:12:50	Name: _biz_pendingA Value: %5B%5D
.ws.zoominfo.com/	1970-01-20 14:12:50	Name: visitorId Value: ffa748f9b4fdb0570a4227f9fa348ec807fc42ffea1789af2b153679b79aaa75
.zoominfo.com/	1970-01-20 05:27:16	Name: __cf_bm Value: kVwOGdC4Bct2Wv5T9QVXTPBo70AI_0lPfNdYTCvZ3DY-1661234904-0-AXULifFOrTIk1DVE6QZ8NtJzzusMSkSh55jL1I9dzKWmREDbHvYqQgUApuoAdSvgsUr/hWxMadpPx36j1uLVsNk=
.bizibly.com/	1970-01-20 14:12:50	Name: _BUID Value: 88f42c8d82a5a75e575b5a0e15ec20b0
.claroty.com/	1970-01-20 14:12:50	Name: _biz_flagsA Value: %7B%22Version%22%3A1%2C%22ViewThrough%22%3A%221%22%2C%22XDomain%22%3A%221%22%7D
.claroty.com/	1970-01-20 15:03:14	Name: _ga Value: GA1.2.2004486452.1661234905
.claroty.com/	1970-01-20 05:28:41	Name: _gid Value: GA1.2.1167781427.1661234905
.claroty.com/	1970-01-20 05:27:14	Name: _gat_gtag_UA_84224451_1 Value: 1
.claroty.com/	1969-12-31 23:59:59	Name: cebs Value: 1
.ads.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=en-us
.linkedin.com/	1970-01-20 14:12:50	Name: bcookie Value: "v=2&2ad25d18-f3c7-4690-8c3b-fc678c6d7255"
.linkedin.com/	1970-01-20 09:46:26	Name: li_gc Value: MTswOzE2NjEyMzQ5MDU7MjswMjEGZdXk7/3tGrSTZi2YLvJY+1vYtRu9tBoGXf6G34Bqyw==
.linkedin.com/	1970-01-20 05:28:41	Name: lidc Value: "b=VGST08:s=V:r=V:a=V:p=V:g=2377:u=1:x=1:i=1661234905:t=1661321305:v=2:sig=AQE4rhSl3G5r0zGa3oF6C5OfrABoSqWo"
.demdex.net/	1970-01-20 09:46:26	Name: demdex Value: 75088851258474672530604108102625485233
.claroty.com/	1969-12-31 23:59:59	Name: cebsp Value: 1
.claroty.com/	1970-01-20 14:12:50	Name: _ce.s Value: v~2c8ddc1a53a900034d88d46bc8a92a80bfdc3523~vpv~0~v11.rlc~1661234905693
.dpm.demdex.net/	1970-01-20 09:46:26	Name: dpm Value: 75088851258474672530604108102625485233
.agkn.com/	1970-01-20 14:12:50	Name: ab Value: 0001%3AmjZgl%2FZD7cd4yLoWoZNTcx0bu8QO07zW
.agkn.com/	1970-01-20 14:12:50	Name: u Value: C\|0AAAAAAAAKpcrWwAAAAAB

6 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'ambient-light-sensor'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'battery'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'execution-while-not-rendered'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'execution-while-out-of-viewport'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'navigation-override'.
security	warning	Message: Error with Permissions-Policy header: Unrecognized feature: 'web-share'.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	frame-ancestors 'self'; upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff nosniff
X-Frame-Options	sameorigin SAMEORIGIN
X-Xss-Protection	1; mode=block 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

aa.agkn.com
aorta.clickagy.com
app.qualified.com
assets-tracking.crazyegg.com
assets.qualified.com
cdn.bizible.com
cdn.bizibly.com
claroty-statamic-assets-cache.nyc3.digitaloceanspaces.com
claroty-statamic-assets.nyc3.digitaloceanspaces.com
claroty.com
d.agkn.com
dpm.demdex.net
insight.adsrvr.org
js.qualified.com
ka-p.fontawesome.com
kit.fontawesome.com
p.typekit.net
pagestates-tracking.crazyegg.com
pi.pardot.com
px.ads.linkedin.com
script.crazyegg.com
security.claroty.com
sentry.io
snap.licdn.com
stags.bluekai.com
stats.g.doubleclick.net
tracking.crazyegg.com
use.typekit.net
ws.zoominfo.com
www.google-analytics.com
www.google.com
www.google.se
www.googletagmanager.com
104.103.72.171
104.111.215.191
104.16.101.12
104.18.16.5
104.18.22.52
104.19.147.8
13.107.42.14
138.197.228.97
142.250.185.163
142.250.185.238
142.250.186.104
143.204.89.72
15.197.193.217
152.195.15.58
162.243.189.2
172.217.23.100
173.194.76.155
18.66.122.57
184.24.77.156
2.21.20.160
3.124.33.5
3.209.185.106
3.215.172.219
34.247.103.17
35.188.42.15
52.17.107.162
52.57.93.199
54.156.137.3
08f3d7de7aea50ee4f77098ffd4ecce4d803a35b21285f45e6b72e3a497d7122
0af3aae90b7de9fdceee2ab421378ea2f54c74be81ef43fc6c1790a032755d80
0c1feaca092d398ce830ae475be7ea16f8b02a87dbefe37f532051d688a3868d
0f0291fb4e3d655a693871e6cdcc579bed567da9fb38f950536971bf1716cf02
145287b36883dd3061ca7aa9229a8fa9ace2cccd50e0382b4b6201f3916b57c5
14af2efd1ba7693a1cdcb26e6ac51d275fa524187d0bd42b3c908c969302d2b1
15318489f738027dd0096a2041613173aa128360c2e0903ef879c36fa7ecd18b
19542126d3b50e54c33964b9ba55d73446f44a906a00890dcc11831fe6f7fbb9
19a1698d216fb83820dd96b6778f0095ba9b01744bf57343067ef7733b5f19be
1c0ff118a4290c99f39c90abb38703a866e47251b23cca20266c69c812ccafeb
1f4513a435d6a3047d20a50c1e7d4263de42146c74be227f774b5e82e6357e75
20274ca1a875a2edadb3d303c4e38673eff024012cc2d4ee2d45d0f37c652de9
23de1cb2230bf765758536a878a27d76a66aa2c17bc44df0543fbbbf2156b8a3
26e42ae4b6800e426c87a9ad7def357e67ce197c02a9e0672081272a040a1ce1
39961d4c61d179baa0dbf39258390c27d3bc52330da365f9051c044d8715a898
3b91e6a4b14493d67f9660e6d4a2e27c1eea54d97ccb7c30acf3b89998b3be99
4120c62c25cd2f9d7f5155aaf84f772c08e18dd1be19e39ed0d866d3916bedce
41e5c059963bd8f9bc4097f78535c3d722f4d73e75c46b2df5cc74bf864af150
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
47ec670b2b053a1bf45b88f90e9473a11606c9f9261cc4addf5dceb4590afd3e
4983a880c232a7d83c7167b2c1283c92d4d1b4fee25a872ce5111020c4fc2129
49c280ae279b8f3c7d2eaa0b470f9812539601013a2f6efa7aa0b41bbf7bc090
58563f3a2d9227336c9973a3f940620da1ad75f8a8788914c0d190eb7ecb4f7b
5a3f1dd74233f605e511f1b5b244bedf85ac88ba264caf4d6401bc7ec2017dcd
5eb3bd3a2d811fe844032d8d648ca7be6864053077393e793f49ffa81275e556
60bdc532cad265a116b2b590c86a9679ed86fe5a1ac3764e08c521cf6ccb1784
62f3f809487194fcc55a3ebd88811a604ae496027bb425d4ebd15d9ae1921945
66ba7ee0b589c7d46d830850ec2263f06113a345ef072bcf1e92c143da2e7f65
6d22e660ead72f14b0aa8e3dfc8de1da35f17e3559b489e00692f15f50faa1a6
6e4dc3626e6d244e1d9eee8335e70769ed41b27f76271ab18b010ab1e538fec0
717f6bb5f6cc69c444f54376a72dee0ca7968b2a12e7c9475247ec85c0e75a53
77267469725d55f196122b3cbbbc2dc91aa58b8ea540b919166b2af9a65f8811
7bba17b490076798f613f9b01da8d6a2eb79808ae687d3e56543ba95fff3b16c
81863eabfebdb05c037a231699218e32ee0af1559d74c750cdcc6836dc64aca5
830e67bda2532cd5880ee86e3b33e69721082f8458bb0df0cd4edbb1577fd375
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8ff09cd0ee012fe06ed1b67dc914858cde819f21bb479f629994d9e49f3c0049
95cbdd8d48ccc73ee5d0c5aba8bca4485b7fc0b58713923e92b97a325fc68538
9f207bc1ab70e67d814c0128d37f3fc4f4dd7222eacd9b4fd97c7af80011d90c
a084f41c6193750c66470dc75e146a52b81a1f51e0a62d4cc06002d0d7456276
a0b359e395dbe239d6ea324bab073321acdf6af9ec378f647da9eeca5860fe8c
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a33128c94dd3c425bc3f4a9ba389a1f3d7a75233e8cb788ea80f8f43a3d68423
a3838a757361c75c1a0bc6a57bdc2758b184f7d4c06166e7fe9284ee7a7bfbed
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
b07871da02311868c31ab6ac5a4e78cc877f118acd854857f6f51519f3ddbbc9
b57839788686bf37d29f47bbe45ad8258085e3aebf54650ab389c0b515b977e1
bf1ffcb96984568b22f7a9029dd980abb5a4a47700f588a16b8ace0f7412977e
c25c9c2ea873488e17a93c95c618a9f82aa7517ffc96cb26d2cf265c12b4dd85
c283a11b65fbd08701549e53a54ec18a8b5570b0b024ba25bdc95ad9c53550e9
c9d0305dc69f8bf6e6d41a78158a4d4a57adcc9c7e3119da094aecba8d8bb1ca
ca01226ef8770932285e0ad80f0eb25a8236e824d6e8116043a1a66db8873974
ccfdfabc7b73e52243d66188306a7c01551ee7bd91673d3817343421876e4ed3
d17a3a8281fa74c85bae46645b1bcff72992ca6324d66b1afb98a6bcd5230775
d692a67352a3dfa80010c86a62761cfff05c0b1086618106a8576cc45a6a8115
d7f0006485c76d46fc1a153846bbeb395302a26f20488094c935cdf55eb3c81e
d9c3dc6527a217c91ebd32b24a7b44ae077d21bf8d5cb237b5cf2f49bae7b41f
db7fc4a5fe60fb79b594ddd13b6839a6c688b65fbe73421698194f67841fce2b
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e1462a026bf4b85b7fdd56b24e6562ac53f07853195c7dc6a88ecf9709171bc3
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e6c1bf5175900cc25cae3383d7ca8afa2c48ad649c1ef82ee728bbcda0c3f3d7
eb14baeac955bb11e33cd7fd3fd2f698cf20db1b450325f45ea843b6cdc82366
ed038587e2640b7201160586ba3c7a777286c39ec5a0f6b3f59d4008fcb4a4b0
ed9f9832970709be6f68186f423d4d983d21ad62d3bee7db6d30c7bc3e01e20f
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f11577c300771f3e1a16c608b5c713e0b5b47807d68ad8e69e92e1ad8cd767fa
f99b44a7372761254ca165b00e289bd64562afc987f84c65e67c88de0bd5d2cf
ffd637f3040261ac8c666711cb009187db39cefad43e8f0cda25765ce03bc2c5

claroty.com Open in urlscan Pro 138.197.228.97 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

66 Requests

95 %HTTPS

0 %IPv6

23 Domains

33 Subdomains

25 IPs

5 Countries

1546 kBTransfer

4060 kBSize

26 Cookies

20 Outgoing links

Redirected requests

66 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 7 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

claroty.com Open in urlscan Pro
138.197.228.97 Public Scan

Screenshot
Live screenshot

Full Image

66
Requests

95 %
HTTPS

0 %
IPv6

23
Domains

33
Subdomains

25
IPs

5
Countries

1546 kB
Transfer

4060 kB
Size

26
Cookies

66 HTTP transactions
7 data transactions