duo.com Open in urlscan Pro
143.204.202.59  Public Scan

11 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 27

• https://www.google-analytics.com/r/collect?v=1&_v=j83&a=777674357&t=pageview&_s=1&dl=https%3A%2F%2Fduo.com%2Fdecipher%2Fdhs-exposes-chinese-malware-tools&ul=en-us&de=UTF-8&dt=DHS%20Exposes%20Chinese%20Malware%20Tools%20%7C%20Decipher&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAAADQ~&jid=686286704&gjid=1660093640&cid=780642895.1596552794&tid=UA-20141016-1&_gid=980207450.1596552794&_r=1&gtm=2wg7m1MFPB9D&z=934540904 HTTP 302
• https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-20141016-1&cid=780642895.1596552794&jid=686286704&_gid=980207450.1596552794&gjid=1660093640&_v=j83&z=934540904 HTTP 302
• https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-20141016-1&cid=780642895.1596552794&jid=686286704&_v=j83&z=934540904 HTTP 302
• https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-20141016-1&cid=780642895.1596552794&jid=686286704&_v=j83&z=934540904&slf_rd=1&random=2228397019

Request Chain 35

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7540&url=https%3A%2F%2Fduo.com%2Fdecipher%2Fdhs-exposes-chinese-malware-tools&time=1596552794282 HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D7540%26url%3Dhttps%253A%252F%252Fduo.com%252Fdecipher%252Fdhs-exposes-chinese-malware-tools%26time%3D1596552794282%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7540&url=https%3A%2F%2Fduo.com%2Fdecipher%2Fdhs-exposes-chinese-malware-tools&time=1596552794282&liSync=true

Request Chain 44

• https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j83&tid=UA-20141016-1&cid=780642895.1596552794&jid=1368175670&gjid=1966973735&_gid=980207450.1596552794&_u=aGDAgAADQ~&z=1825311376 HTTP 302
• https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-20141016-1&cid=780642895.1596552794&jid=1368175670&_v=j83&z=1825311376 HTTP 302
• https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-20141016-1&cid=780642895.1596552794&jid=1368175670&_v=j83&z=1825311376&slf_rd=1&random=1091181512

Request Chain 57

• https://dpm.demdex.net/id?d_visid_ver=4.1.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=B8D07FF4520E94C10A490D4C%40AdobeOrg&d_nsid=0&ts=1596552795175 HTTP 302
• https://dpm.demdex.net/id/rd?d_visid_ver=4.1.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=B8D07FF4520E94C10A490D4C%40AdobeOrg&d_nsid=0&ts=1596552795175

Request Chain 71

• https://www.google-analytics.com/r/collect?v=1&_v=j83&a=777674357&t=event&ni=1&_s=1&dl=https%3A%2F%2Fduo.com%2Fdecipher%2Fdhs-exposes-chinese-malware-tools&ul=en-us&de=UTF-8&dt=DHS%20Exposes%20Chinese%20Malware%20Tools%20%7C%20Decipher&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=undefined&ea=undefined&_u=aHjAAAADQ~&jid=343156780&gjid=523905897&cid=780642895.1596552794&tid=UA-20141016-1&_gid=995260931.1596552796&_r=1&gtm=2wg7m1MFPB9D&cd2=780642895.1596552794&z=275364221 HTTP 302
• https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-20141016-1&cid=780642895.1596552794&jid=343156780&_gid=995260931.1596552796&gjid=523905897&_v=j83&z=275364221 HTTP 302
• https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-20141016-1&cid=780642895.1596552794&jid=343156780&_v=j83&z=275364221 HTTP 302
• https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-20141016-1&cid=780642895.1596552794&jid=343156780&_v=j83&z=275364221&slf_rd=1&random=3655258068

73 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
1 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	200	Primary Request dhs-exposes-chinese-malware-tools Show response duo.com/decipher/	29 KB 12 KB	85ms 30ms	Document text/html	143.204.202.59 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://duo.com/decipher/dhs-exposes-chinese-malware-tools Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 143.204.202.59 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-202-59.fra53.r.cloudfront.net Software Duo/1.0 / Resource Hash 91dcfa576f6340df9baac584202184ebbd546d97b5843afdb20fb2a1ab5962e1 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers :method GET :authority duo.com :scheme https :path /decipher/dhs-exposes-chinese-malware-tools pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site none sec-fetch-mode navigate sec-fetch-user ?1 sec-fetch-dest document accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 200 content-type text/html; charset=utf-8 content-length 11790 cache-control max-age=300 content-encoding gzip date Tue, 04 Aug 2020 14:51:37 GMT etag W/"5f295c6b-75b7" expires Tue, 04 Aug 2020 14:56:37 GMT last-modified Tue, 04 Aug 2020 13:02:35 GMT referrer-policy no-referrer-when-downgrade server Duo/1.0 strict-transport-security max-age=63072000; includeSubDomains; x-content-type-options nosniff x-frame-options SAMEORIGIN x-ua-compatible IE=Edge,chrome=1 x-xss-protection 1; mode=block vary Accept-Encoding x-cache Hit from cloudfront via 1.1 25ffb5a941b5a46b102cd385a9cdbb50.cloudfront.net (CloudFront) x-amz-cf-pop FRA53-C1 x-amz-cf-id rH6--GjC4IU67VTgcEeDm4tzZy4n-9SXrlDH71NP5QbfZyqdbkljxw== age 96
GET H2	200	production-2018.css duo.com/site/themes/duo/css/	504 KB 96 KB	31ms 30ms	Stylesheet text/css	143.204.202.59 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://duo.com/site/themes/duo/css/production-2018.css?v=1595859617 Requested by Host: duo.com URL: https://duo.com/decipher/dhs-exposes-chinese-malware-tools Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 143.204.202.59 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-202-59.fra53.r.cloudfront.net Software Duo/1.0 / Resource Hash f4c71a949d20a0bfd61278de1c84aba838cd297651351688a192c08f3bf5a145 Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 04 Aug 2020 14:51:38 GMT content-encoding gzip age 95 x-cache Hit from cloudfront status 200 pragma public last-modified Mon, 27 Jul 2020 14:20:17 GMT server Duo/1.0 etag W/"5f1ee2a1-7e0cf" vary Accept-Encoding content-type text/css via 1.1 25ffb5a941b5a46b102cd385a9cdbb50.cloudfront.net (CloudFront) cache-control max-age=31536000, public, must-revalidate, proxy-revalidate, max-age=31536000 x-amz-cf-pop FRA53-C1 x-amz-cf-id DsnM1Te0qpsby4aLa0KH44waPPL6l4SPZXm2M4C-YorsdIbQUpfdNg== expires Wed, 04 Aug 2021 14:51:38 GMT
GET H2	200	d-logo--dark.svg duo.com/assets/img/decipher/logos/	4 KB 2 KB	55ms 54ms	Image image/svg+xml	143.204.202.59 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://duo.com/assets/img/decipher/logos/d-logo--dark.svg Requested by Host: duo.com URL: https://duo.com/decipher/dhs-exposes-chinese-malware-tools Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 143.204.202.59 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-202-59.fra53.r.cloudfront.net Software Duo/1.0 / Resource Hash 431a961732e7d25ade3585946346fb7851946a1d8f4f4270b0b988914ba01520 Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 04 Aug 2020 14:51:37 GMT content-encoding gzip age 96 x-cache Hit from cloudfront status 200 pragma public last-modified Wed, 24 Oct 2018 13:44:56 GMT server Duo/1.0 etag W/"5bd07758-ff5" vary Accept-Encoding content-type image/svg+xml via 1.1 25ffb5a941b5a46b102cd385a9cdbb50.cloudfront.net (CloudFront) cache-control max-age=31536000, public, must-revalidate, proxy-revalidate, max-age=31536000 x-amz-cf-pop FRA53-C1 x-amz-cf-id FSfMtdkfM4cxDBRGlW6CSYRaYhuwnOJN0XBgc0yhgBz0v5MW0_IgsA== expires Wed, 04 Aug 2021 14:51:37 GMT
GET H2	200	aW1nL3Nlby1pbWFnZXMvY2hpbmFmbGFnLmpwZw== duo.com/img/asset/	50 KB 51 KB	52ms 50ms	Image image/jpeg	143.204.202.59 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://duo.com/img/asset/aW1nL3Nlby1pbWFnZXMvY2hpbmFmbGFnLmpwZw==?w=1000&h=470&fit=crop&s=e60fcf1ece075d4f863cc7ad4879dbe0 Requested by Host: duo.com URL: https://duo.com/decipher/dhs-exposes-chinese-malware-tools Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 143.204.202.59 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-202-59.fra53.r.cloudfront.net Software Duo/1.0 / Resource Hash 21743212cb89a70788039e9235d294dd6e8e364324a9c11f06e78a42e59df295 Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 04 Aug 2020 13:02:36 GMT via 1.1 25ffb5a941b5a46b102cd385a9cdbb50.cloudfront.net (CloudFront) x-content-type-options nosniff age 95 x-cache Hit from cloudfront status 200 content-length 51410 x-xss-protection 1; mode=block x-ua-compatible IE=Edge,chrome=1 referrer-policy no-referrer-when-downgrade last-modified Mon, 10 Feb 2020 22:59:05 GMT server Duo/1.0 x-frame-options SAMEORIGIN strict-transport-security max-age=63072000; includeSubDomains; content-type image/jpeg cache-control max-age=300 x-amz-cf-pop FRA53-C1 x-amz-cf-id g0KRS7y7RRvTX6pJ2GoxP00cF4LmQ3sGZOq_MKrtEOJ_d2XaltU-lw== expires Tue, 04 Aug 2020 14:56:38 GMT
GET H2	200	d-logo--footer.svg duo.com/assets/img/decipher/logos/	3 KB 2 KB	49ms 47ms	Image image/svg+xml	143.204.202.59 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://duo.com/assets/img/decipher/logos/d-logo--footer.svg Requested by Host: duo.com URL: https://duo.com/decipher/dhs-exposes-chinese-malware-tools Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 143.204.202.59 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-202-59.fra53.r.cloudfront.net Software Duo/1.0 / Resource Hash c33592c7a249c98164b3d533c58fae62ced2b403deab8f2d0cce4c4f1cbb285d Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 04 Aug 2020 14:51:38 GMT content-encoding gzip age 95 x-cache Hit from cloudfront status 200 pragma public last-modified Wed, 24 Oct 2018 13:44:56 GMT server Duo/1.0 etag W/"5bd07758-b5f" vary Accept-Encoding content-type image/svg+xml via 1.1 25ffb5a941b5a46b102cd385a9cdbb50.cloudfront.net (CloudFront) cache-control max-age=31536000, public, must-revalidate, proxy-revalidate, max-age=31536000 x-amz-cf-pop FRA53-C1 x-amz-cf-id iuHiAhihU5keSgYLtx-D9u8Z5SIjXW5QV71aH5KP-gKhEHOv8DYZoQ== expires Wed, 04 Aug 2021 14:51:38 GMT
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/2.1.4/	82 KB 29 KB	9ms 5ms	Script text/javascript	2a00:1450:4001:824::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/2.1.4/jquery.min.js Requested by Host: duo.com URL: https://duo.com/decipher/dhs-exposes-chinese-malware-tools Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:824::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Wed, 29 Jul 2020 21:48:42 GMT content-encoding gzip x-content-type-options nosniff age 493471 status 200 alt-svc h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 29725 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe vary Accept-Encoding content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Thu, 29 Jul 2021 21:48:42 GMT
GET H2	200	production-2018.min.js Show response duo.com/site/themes/duo/js/build/	730 KB 262 KB	59ms 55ms	Script application/javascript	143.204.202.59 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://duo.com/site/themes/duo/js/build/production-2018.min.js?v=1593630912 Requested by Host: duo.com URL: https://duo.com/decipher/dhs-exposes-chinese-malware-tools Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 143.204.202.59 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-202-59.fra53.r.cloudfront.net Software Duo/1.0 / Resource Hash fb1e33cc14bdcf13beda3468c30a718607be2f25707bb6ef832a12d6f80727b2 Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 04 Aug 2020 14:51:38 GMT content-encoding gzip age 95 x-cache Hit from cloudfront status 200 pragma public last-modified Wed, 01 Jul 2020 19:15:12 GMT server Duo/1.0 etag W/"5efce0c0-b687a" vary Accept-Encoding content-type application/javascript; charset=utf-8 via 1.1 25ffb5a941b5a46b102cd385a9cdbb50.cloudfront.net (CloudFront) cache-control max-age=31536000, public, must-revalidate, proxy-revalidate, max-age=31536000 x-amz-cf-pop FRA53-C1 x-amz-cf-id OZIMD8vB1LzhAaMlsoZevBor6a1VoNByqChZBSQB0fuGaWhllpqq6g== expires Wed, 04 Aug 2021 14:51:38 GMT
GET H2	200	E-v1.js Show response fast.wistia.net/assets/external/	657 KB 119 KB	10ms 6ms	Script application/javascript	2a04:4e42:3::622 FASTLY
General Check archive.org Show headers Download Go to Full URL https://fast.wistia.net/assets/external/E-v1.js Requested by Host: duo.com URL: https://duo.com/decipher/dhs-exposes-chinese-malware-tools Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a04:4e42:3::622 , Ascension Island, ASN54113 (FASTLY, US), Reverse DNS Software / Resource Hash d9b8748f57a53cafafee9e4adaea253d14b26ea86fae5417223301230af5090f Security Headers Name Value Strict-Transport-Security max-age=0 Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 04 Aug 2020 14:53:13 GMT content-encoding br vary Accept-Encoding age 25 x-cache HIT, HIT status 200 content-length 121641 x-served-by cache-dca17780-DCA, cache-fra19183-FRA access-control-allow-origin * x-browser-version 83 last-modified Mon, 03 Aug 2020 17:27:15 GMT x-timer S1596552794.824349,VS0,VE0 etag "5f2848f3-1db29" strict-transport-security max-age=0 content-type application/javascript via 1.1 varnish, 1.1 varnish cache-control public, max-age=3600 x-browser chrome x-ecma-v modern accept-ranges bytes timing-allow-origin * x-cache-hits 1, 1
GET H2	200	8a2bfd38-d491-4dc6-93b9-0098fd7c78e7.js Show response cdn.cookielaw.org/consent/	103 KB 18 KB	32ms 6ms	Script application/x-javascript	2606:2800:233:1cb7:261b:1f9c:2074:3c EDGECAST
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/consent/8a2bfd38-d491-4dc6-93b9-0098fd7c78e7.js Requested by Host: duo.com URL: https://duo.com/decipher/dhs-exposes-chinese-malware-tools Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/8F55) / Resource Hash 699a43423f05c59907dd93bd459e53ca87e77084a88e26b1aa6b7b13e0ca63cb Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 04 Aug 2020 14:53:13 GMT content-encoding gzip content-md5 Al2fPfa3EtwjqBI37KX3kg== age 2133 x-cache HIT status 200 content-length 17533 x-ms-lease-status unlocked last-modified Mon, 20 Jul 2020 19:12:45 GMT server ECAcc (frc/8F55) etag 0x8D82CE0E29E3D9B vary Accept-Encoding content-type application/x-javascript access-control-allow-origin * x-ms-request-id a566318a-601e-0046-156a-6a0670000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding cache-control public, max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes expires Tue, 04 Aug 2020 18:53:13 GMT
GET H2	404	t.js vidassets.terminus.services/314d698d-5fa1-4001-9369-bd93b1ba8871/	0 0	67ms 20ms	Script application/json	99.86.7.51 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://vidassets.terminus.services/314d698d-5fa1-4001-9369-bd93b1ba8871/t.js Requested by Host: duo.com URL: https://duo.com/decipher/dhs-exposes-chinese-malware-tools Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 99.86.7.51 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-99-86-7-51.fra6.r.cloudfront.net Software / Resource Hash Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers
GET H/1.1	200 OK	up_loader.1.1.0.js Show response js.adsrvr.org/	4 KB 4 KB	90ms 20ms	Script application/x-javascript	143.204.206.235 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://js.adsrvr.org/up_loader.1.1.0.js Requested by Host: duo.com URL: https://duo.com/decipher/dhs-exposes-chinese-malware-tools Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 143.204.206.235 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-206-235.fra53.r.cloudfront.net Software AmazonS3 / Resource Hash 0615974c40d602afdbf9759533e352bc17b0458c85aad6694b1a1ad20659625b Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 04 Aug 2020 00:56:23 GMT Via 1.1 960a66a5b9d832814160983d391e997c.cloudfront.net (CloudFront) Last-Modified Mon, 13 Jan 2020 19:16:48 GMT Server AmazonS3 Age 50211 ETag "45bb7a1f2878be0c29077f7329fca766" Vary Accept-Encoding X-Cache Hit from cloudfront Content-Type application/x-javascript Connection keep-alive X-Amz-Cf-Pop FRA53-C1 Accept-Ranges bytes Content-Length 4091 X-Amz-Cf-Id Vk_LEW2qSMzb6XcRXlTkLK00hB61ePHPmdfpWLktDSljrvxXmbpP-Q==
GET H/1.1	200 OK	footer.js Show response tribl.io/	2 KB 1 KB	144ms 36ms	Script text/plain	52.49.91.78 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://tribl.io/footer.js?orgId=DoRXJqpaKEF9Mx4x07GY Requested by Host: duo.com URL: https://duo.com/decipher/dhs-exposes-chinese-malware-tools Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.49.91.78 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-49-91-78.eu-west-1.compute.amazonaws.com Software nginx/1.14.0 (Ubuntu) / Resource Hash d47e2db09930587cfeef73dbc31034c16b3bd2bc7bb77f0a138755b286954484 Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 04 Aug 2020 14:53:13 GMT Content-Encoding gzip Server nginx/1.14.0 (Ubuntu) ContentType text/javascript P3P CP="Triblio does not have a P3P policy." Cache-Control max-age=0, no-cache, no-store, must-revalidate Connection keep-alive Content-Length 802
GET H2	200	160504861.js Show response cdn.optimizely.com/js/	358 KB 94 KB	38ms 19ms	Script text/javascript	2a02:26f0:6c00:183::13b8 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://cdn.optimizely.com/js/160504861.js Requested by Host: duo.com URL: https://duo.com/decipher/dhs-exposes-chinese-malware-tools Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:6c00:183::13b8 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software AmazonS3 / Resource Hash b61ec3e3352bcaf0bb8d6333b2e1c02d29a138ac6bb86f2d54e52745c484f046 Security Headers Name Value Strict-Transport-Security max-age=15768000 Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-amz-version-id mWSaqZ33ykA.RLnpIGwAXVmo7wU1UrlV content-encoding gzip etag "c3ea2e303ccc33eced1d680e2dfe1282" x-amz-request-id 6FA137893C0E7E79 status 200 access-control-allow-methods GET, HEAD server-timing cdn;desc="AkamaiION";dur=0,rtt;desc="5";dur=0,cdnip;desc="2a02:26f0:6c00:183::13b8";dur=0,cdnmap;desc="a5048.dsca.akamaiedge.net";dur=0,proto;desc="h2";dur=0 vary Accept-Encoding content-length 95692 x-amz-id-2 MicQuFBBPHmxqjF5Roax4Gg/h/9HiX3b30IIvx6xl/caV4oRBUTyOsX6XMe+0TgbMY3RUQd5fXw= last-modified Tue, 23 May 2017 18:41:52 GMT server AmazonS3 date Tue, 04 Aug 2020 14:53:13 GMT access-control-max-age 86400 strict-transport-security max-age=15768000 content-type text/javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers x-amz-meta-revision cache-control max-age=120 x-amz-meta-revision 661 accept-ranges bytes timing-allow-origin * access-control-allow-headers *
GET H2	200	gtm.js Show response www.googletagmanager.com/	214 KB 57 KB	19ms 17ms	Script application/javascript	2a00:1450:4001:80b::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-MFPB9D Requested by Host: duo.com URL: https://duo.com/decipher/dhs-exposes-chinese-malware-tools Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash be11d1517efd4f4668b886863aa4653e1f66bd429ecddad1c2e80c3b82f8dc13 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 04 Aug 2020 14:53:13 GMT content-encoding br vary Accept-Encoding status 200 alt-svc h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 58523 x-xss-protection 0 last-modified Tue, 04 Aug 2020 12:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Tue, 04 Aug 2020 14:53:13 GMT
GET H2	200	analytics.js Show response www.google-analytics.com/	45 KB 18 KB	5ms 5ms	Script text/javascript	2a00:1450:4001:816::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MFPB9D Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:816::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash fd361b57998c76f86335afa28b8a62527d88a8200fb5c428d6f0fff73383e955 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Thu, 04 Jun 2020 23:38:14 GMT server Golfe2 age 2254 date Tue, 04 Aug 2020 14:15:39 GMT vary Accept-Encoding content-type text/javascript status 200 cache-control public, max-age=7200 alt-svc h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 18469 expires Tue, 04 Aug 2020 16:15:39 GMT
GET H/1.1	200 OK	insight.min.js Show response snap.licdn.com/li.lms-analytics/	3 KB 2 KB	20ms 20ms	Script application/x-javascript	2a02:26f0:10c:382::25ea AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MFPB9D Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:10c:382::25ea , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software / Resource Hash 41dd5e421fe221a7d2921d6fa2b36e8b01a9f2c054aaef5fad866fe896c1d1e0 Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 04 Aug 2020 14:53:13 GMT Content-Encoding gzip Last-Modified Mon, 07 Oct 2019 16:41:31 GMT X-CDN AKAM Vary Accept-Encoding Content-Type application/x-javascript;charset=utf-8 Cache-Control max-age=38186 Connection keep-alive Accept-Ranges bytes Content-Length 1576
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	134 KB 34 KB	23ms 5ms	Script application/x-javascript	2a03:2880:f01c:8012:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: duo.com URL: https://duo.com/decipher/dhs-exposes-chinese-malware-tools Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash f630c6ea4e44c35a93c0ee2950e68857311d9500d6025abe4a5db3ecaf270e3c Security Headers Name Value Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self'; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000; preload; includeSubDomains content-encoding gzip x-content-type-options nosniff status 200 alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 34220 x-xss-protection 0 pragma public x-fb-debug eYA7PAaCTkxhjfmpowNMJT10003RN4kDhbZkXn0Bx7OJCW+4IYOqJty2s1tGiOGxzHGyeh/H1h0c57LqGiN7Wg== x-fb-trip-id 664085054 x-frame-options DENY date Tue, 04 Aug 2020 14:53:13 GMT vary Accept-Encoding content-type application/x-javascript; charset=utf-8 cache-control public, max-age=1200 content-security-policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self'; expires Sat, 01 Jan 2000 00:00:00 GMT
GET H/1.1	200 OK	munchkin-beta.js Show response munchkin.marketo.net/	1 KB 1 KB	63ms 20ms	Script application/x-javascript	104.109.95.62 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/munchkin-beta.js Requested by Host: duo.com URL: https://duo.com/decipher/dhs-exposes-chinese-malware-tools Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.109.95.62 , Netherlands, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS a104-109-95-62.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash f290c4ac26bed883f51fa25799f9518640c3991e284f8aba7e7c634bb2c4c11e Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 04 Aug 2020 14:53:13 GMT Content-Encoding gzip Last-Modified Fri, 12 Jun 2020 07:18:23 GMT Server AkamaiNetStorage ETag "684cd68b394c01ff59493c6b7174d955:1591946303.052899" Vary Accept-Encoding P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Connection keep-alive Accept-Ranges bytes Content-Type application/x-javascript Content-Length 752
GET H2	200	bat.js Show response bat.bing.com/	26 KB 8 KB	105ms 85ms	Script application/javascript	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/bat.js Requested by Host: duo.com URL: https://duo.com/decipher/dhs-exposes-chinese-malware-tools Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 5c622f5433cbb6ea1df5c0dd8671e55ef7d1464366074730473c453de50a579b Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 04 Aug 2020 14:53:13 GMT content-encoding gzip last-modified Thu, 16 Jul 2020 20:00:00 GMT x-msedge-ref Ref A: FAEA8A208C4F43FC858281D973C0AC59 Ref B: FRAEDGE1307 Ref C: 2020-08-04T14:53:13Z status 200 etag "0e0bdafab5bd61:0" vary Accept-Encoding content-type application/javascript access-control-allow-origin * cache-control private,max-age=1800 accept-ranges bytes content-length 8022
GET H2	200	aquant.js Show response secure.quantserve.com/	22 KB 8 KB	13ms 12ms	Script application/x-javascript	2620:116:800d:21:36a9:ecb:e518:b308 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://secure.quantserve.com/aquant.js?a=p-4CduNLZtPCAtp Requested by Host: duo.com URL: https://duo.com/decipher/dhs-exposes-chinese-malware-tools Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:116:800d:21:36a9:ecb:e518:b308 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash 8130c2c72afad9d94581ef93aaa00524093103c47c71fce52f606d5ff693c3ce Security Headers Name Value Strict-Transport-Security max-age=86400 Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 04 Aug 2020 14:53:13 GMT content-encoding gzip last-modified Tue, 04-Aug-2020 14:53:13 GMT etag M0-2a172724 vary Accept-Encoding content-type application/x-javascript status 200 cache-control private, no-transform, max-age=604800 strict-transport-security max-age=86400 content-length 8060 expires Tue, 11 Aug 2020 14:53:13 GMT
GET H/1.1	200 OK	6si.min.js Show response j.6sc.co/	15 KB 7 KB	118ms 36ms	Script application/javascript	23.10.73.123 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: duo.com URL: https://duo.com/decipher/dhs-exposes-chinese-malware-tools Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 23.10.73.123 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-10-73-123.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash f8e9b5bec9f48d639838d32b29d6713fece521a5d96913cc37a267a69b7e598b Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 04 Aug 2020 14:53:13 GMT Content-Encoding gzip Last-Modified Tue, 28 Jul 2020 17:10:34 GMT Server nginx/1.14.0 (Ubuntu) ETag "5f205c0a-3a07" Vary Accept-Encoding Access-Control-Allow-Methods GET,POST Content-Type application/javascript Access-Control-Allow-Origin Access-Control-Max-Age 86400 Access-Control-Allow-Credentials true Connection keep-alive Accept-Ranges bytes Access-Control-Allow-Headers * Content-Length 6080
GET H2	200	ctm.js Show response www.cisco.com/c/dam/cdc/t/	121 KB 29 KB	35ms 15ms	Script application/x-javascript	2a02:26f0:6c00:197::b33 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://www.cisco.com/c/dam/cdc/t/ctm.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MFPB9D Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2a02:26f0:6c00:197::b33 , Ascension Island, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS Software Apache / Resource Hash 6daf48afbbe07870121c54a21a9659299c3871e1124442f03537cb501d138814 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; frame-ancestors *.cisco.com *.jasper.com *.ciscospark.com *.ciscolive.com http://cisco.lookbookhq.com https://cisco.lookbookhq.com testcisco.marketing.adobe.com cisco.marketing.adobe.com ciscosales.my.salesforce.com test.salesforce.com zedo.com hindustantimes.com economictimes.indiatimes.com *.webex.com *.cdw.com *.cdwg.com *.cdw.ca *.meraki-go.com http://ciscopartners.lookbookhq.com https://ciscopartners.lookbookhq.com ciscolearningsystem.com ciscocustomer.lookbookhq.com cisco.lookbookhq.com ccsmedia.com *.itquotes.ie dteonline.com ampito-cisco.com arkphire.com *.insight.com *.ccsmedia.com *.ebuyer.com *.lambda-tek.com *.storm-technologies.com *.vohkus.com *.bechtle.com *.rainfocus.com *.broadbandbuyer.com *.hardware.com shop.redpontem.com; Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 04 Aug 2020 14:53:13 GMT content-encoding gzip x-content-type-options nosniff status 200 vary Accept-Encoding content-length 28835 x-xss-protection 1; mode=block pragma no-cache cdchost wemxweb-publish-prod1-03 x-test-debug nURL=www.cisco.com,realm=0,isRealm=0,realmDomain=0,shortrealm=0 server Apache x-frame-options SAMEORIGIN etag "1e37d-5abc28bda13cc" strict-transport-security max-age=31536000 content-type application/x-javascript cache-control max-age=0, no-cache, no-store content-security-policy upgrade-insecure-requests; frame-ancestors *.cisco.com *.jasper.com *.ciscospark.com *.ciscolive.com http://cisco.lookbookhq.com https://cisco.lookbookhq.com testcisco.marketing.adobe.com cisco.marketing.adobe.com ciscosales.my.salesforce.com test.salesforce.com zedo.com hindustantimes.com economictimes.indiatimes.com *.webex.com *.cdw.com *.cdwg.com *.cdw.ca *.meraki-go.com http://ciscopartners.lookbookhq.com https://ciscopartners.lookbookhq.com ciscolearningsystem.com ciscocustomer.lookbookhq.com cisco.lookbookhq.com ccsmedia.com *.itquotes.ie dteonline.com ampito-cisco.com arkphire.com *.insight.com *.ccsmedia.com *.ebuyer.com *.lambda-tek.com *.storm-technologies.com *.vohkus.com *.bechtle.com *.rainfocus.com *.broadbandbuyer.com *.hardware.com shop.redpontem.com; accept-ranges bytes expires Tue, 04 Aug 2020 14:53:13 GMT
GET H/1.1	200 OK	lp.js Show response metadata-static-files.sfo2.cdn.digitaloceanspaces.com/pixel/	3 KB 4 KB	105ms 26ms	Script text/javascript	205.185.216.42 HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://metadata-static-files.sfo2.cdn.digitaloceanspaces.com/pixel/lp.js Requested by Host: duo.com URL: https://duo.com/decipher/dhs-exposes-chinese-malware-tools Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 205.185.216.42 Phoenix, United States, ASN20446 (HIGHWINDS3, US), Reverse DNS map2.hwcdn.net Software / Resource Hash ec272871253cef70abb2b9876d0173c86584937aff72f9638a0c59b6b2a0e5cf Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 04 Aug 2020 14:53:13 GMT Connection Keep-Alive Last-Modified Tue, 14 Jul 2020 15:46:21 GMT x-amz-request-id tx00000000000008c013b87-005f28b4d1-972547-sfo2a ETag "27c20fefbcbf3d71291f138f0cb3f84c" Vary Access-Control-Request-Headers,Access-Control-Request-Method,Origin X-HW 1596552793.dop037.pa1.t,1596552793.cds019.pa1.shn,1596552793.dop037.pa1.t,1596552793.cds222.pa1.c Content-Type text/javascript Cache-Control max-age=555256 Strict-Transport-Security max-age=15552000; includeSubDomains; preload Accept-Ranges bytes Content-Length 3576
GET H2	200	bizible.js Show response cdn.bizible.com/scripts/	87 KB 34 KB	84ms 17ms	Script application/x-javascript	68.232.35.12 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://cdn.bizible.com/scripts/bizible.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MFPB9D Protocol H2 Security TLS 1.3, , AES_256_GCM Server 68.232.35.12 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (amb/6BA7) / Resource Hash c30ede13d1ed02fbefa969b1cea64c73635512dd7002057581f5db52ee817cee Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 04 Aug 2020 14:53:13 GMT content-encoding gzip last-modified Thu, 30 Jul 2020 22:23:54 GMT server ECS (amb/6BA7) age 317608 etag "e644e81bc066d61:0" vary Accept-Encoding x-cache HIT content-type application/x-javascript status 200 accept-ranges bytes content-length 34195
GET H2	200	din1451alt-webfont.woff2 duo.com/site/themes/duo/fonts/din1451alt/	17 KB 18 KB	45ms 45ms	Font application/octet-stream	143.204.202.59 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://duo.com/site/themes/duo/fonts/din1451alt/din1451alt-webfont.woff2 Requested by Host: duo.com URL: https://duo.com/decipher/dhs-exposes-chinese-malware-tools Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 143.204.202.59 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-202-59.fra53.r.cloudfront.net Software Duo/1.0 / Resource Hash e9f76eabead93f85fc4dc190dca4b1419dcd76b57b1c22649856b01d3ac2536e Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://duo.com/site/themes/duo/css/production-2018.css?v=1595859617 Origin https://duo.com Response headers date Tue, 04 Aug 2020 14:51:38 GMT via 1.1 25ffb5a941b5a46b102cd385a9cdbb50.cloudfront.net (CloudFront) x-content-type-options nosniff age 95 x-cache Hit from cloudfront status 200 content-length 17424 x-xss-protection 1; mode=block x-ua-compatible IE=Edge,chrome=1 referrer-policy no-referrer-when-downgrade last-modified Wed, 24 Oct 2018 13:45:04 GMT server Duo/1.0 x-frame-options SAMEORIGIN etag "5bd07760-4410" strict-transport-security max-age=63072000; includeSubDomains; content-type application/octet-stream cache-control max-age=300 x-amz-cf-pop FRA53-C1 accept-ranges bytes x-amz-cf-id eF_QjOaSHXYcu8v7kjdyTaNWHxOVLowlFZUkv711hKo1CM4LCBaObw== expires Tue, 04 Aug 2020 14:56:38 GMT
GET H2	200	diamond.svg duo.com/assets/img/decipher/svg/	187 B 622 B	35ms 34ms	Image image/svg+xml	143.204.202.59 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://duo.com/assets/img/decipher/svg/diamond.svg Requested by Host: duo.com URL: https://duo.com/decipher/dhs-exposes-chinese-malware-tools Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 143.204.202.59 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-202-59.fra53.r.cloudfront.net Software Duo/1.0 / Resource Hash 45f9c9efb71fae4c333607520017c544fb9dc13100dd260f6148eb179b919d68 Request headers Referer https://duo.com/site/themes/duo/css/production-2018.css?v=1595859617 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 04 Aug 2020 14:51:38 GMT via 1.1 25ffb5a941b5a46b102cd385a9cdbb50.cloudfront.net (CloudFront) age 95 x-cache Hit from cloudfront status 200 content-length 187 pragma public last-modified Wed, 24 Oct 2018 13:44:56 GMT server Duo/1.0 etag "5bd07758-bb" content-type image/svg+xml cache-control max-age=31536000, public, must-revalidate, proxy-revalidate, max-age=31536000 x-amz-cf-pop FRA53-C1 accept-ranges bytes x-amz-cf-id KsiTU4fCzz2cHICKE3oHfLRGJpoAMYiHTIkLnMAthLCGz_d6JnRJSw== expires Wed, 04 Aug 2021 14:51:38 GMT
GET H2	200	din1451alt_g-webfont.woff2 duo.com/site/themes/duo/fonts/din1451alt/	22 KB 23 KB	38ms 38ms	Font application/octet-stream	143.204.202.59 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://duo.com/site/themes/duo/fonts/din1451alt/din1451alt_g-webfont.woff2 Requested by Host: duo.com URL: https://duo.com/decipher/dhs-exposes-chinese-malware-tools Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 143.204.202.59 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-202-59.fra53.r.cloudfront.net Software Duo/1.0 / Resource Hash ede067783c02098828dfe0bda385a9913ff79006eb2cd1a406bcc18e66cd7bad Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://duo.com/site/themes/duo/css/production-2018.css?v=1595859617 Origin https://duo.com Response headers date Tue, 04 Aug 2020 14:51:38 GMT via 1.1 25ffb5a941b5a46b102cd385a9cdbb50.cloudfront.net (CloudFront) x-content-type-options nosniff age 95 x-cache Hit from cloudfront status 200 content-length 22668 x-xss-protection 1; mode=block x-ua-compatible IE=Edge,chrome=1 referrer-policy no-referrer-when-downgrade last-modified Wed, 24 Oct 2018 13:45:04 GMT server Duo/1.0 x-frame-options SAMEORIGIN etag "5bd07760-588c" strict-transport-security max-age=63072000; includeSubDomains; content-type application/octet-stream cache-control max-age=300 x-amz-cf-pop FRA53-C1 accept-ranges bytes x-amz-cf-id HkJSIT2KKF85jpPKCH6Eqn-S9b5ssyXNveQkcQFFXULFgEUCZXA2Uw== expires Tue, 04 Aug 2020 14:56:38 GMT
GET H2	200	js Show response www.google-analytics.com/gtm/	70 KB 27 KB	17ms 17ms	Script application/javascript	2a00:1450:4001:816::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/gtm/js?id=GTM-WV3KTWL&t=gtm3&cid=780642895.1596552794 Requested by Host: www.google-analytics.com URL: https://www.google-analytics.com/analytics.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:816::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 566aa6da238a5c452282bbc1966a43ff92239f346b3cac9006d8f613034715d3 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 04 Aug 2020 14:53:14 GMT content-encoding br vary Accept-Encoding status 200 alt-svc h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 28048 x-xss-protection 0 last-modified Tue, 04 Aug 2020 12:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Tue, 04 Aug 2020 14:53:14 GMT
GET H2	200	ga-audiences www.google.de/ads/ Redirect Chain https://www.google-analytics.com/r/collect?v=1&_v=j83&a=777674357&t=pageview&_s=1&dl=https%3A%2F%2Fduo.com%2Fdecipher%2Fdhs-exposes-chinese-malware-tools&ul=en-us&de=UTF-8&dt=DHS%20Exposes%20Chines... https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-20141016-1&cid=780642895.1596552794&jid=686286704&_gid=980207450.1596552794&gjid=1660093640&_v=j83&z=934540904 https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-20141016-1&cid=780642895.1596552794&jid=686286704&_v=j83&z=934540904 https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-20141016-1&cid=780642895.1596552794&jid=686286704&_v=j83&z=934540904&slf_rd=1&random=2228397019	42 B 106 B	19ms 18ms	Image image/gif	2a00:1450:4001:80b::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-20141016-1&cid=780642895.1596552794&jid=686286704&_v=j83&z=934540904&slf_rd=1&random=2228397019 Requested by Host: duo.com URL: https://duo.com/decipher/dhs-exposes-chinese-malware-tools Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Tue, 04 Aug 2020 14:53:14 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers pragma no-cache date Tue, 04 Aug 2020 14:53:14 GMT x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 302 content-type text/html; charset=UTF-8 location https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-20141016-1&cid=780642895.1596552794&jid=686286704&_v=j83&z=934540904&slf_rd=1&random=2228397019 cache-control no-cache, no-store, must-revalidate timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	widgets.js Show response platform.twitter.com/	95 KB 29 KB	7ms 7ms	Script application/javascript	2606:2800:234:46c:e8b:1e2f:2bd:694 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://platform.twitter.com/widgets.js Requested by Host: duo.com URL: https://duo.com/site/themes/duo/js/build/production-2018.min.js?v=1593630912 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (fcn/4195) / Resource Hash 6adaf62612623c674af2f597baf83ffa56f157a9ab69346be7c11a9569fdebbc Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 04 Aug 2020 14:53:14 GMT Content-Encoding gzip Last-Modified Thu, 30 Jul 2020 22:04:50 GMT Server ECS (fcn/4195) Age 906 Etag "1dc37899f984d453c1d3d8179829f041+gzip" Vary Accept-Encoding Access-Control-Allow-Methods GET P3P CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Access-Control-Allow-Origin * Cache-Control public, max-age=1800 X-Cache HIT Content-Type application/javascript; charset=utf-8 Content-Length 28825
GET H2	200	sdk.js Show response connect.facebook.net/en_US/	3 KB 2 KB	6ms 6ms	Script application/x-javascript	2a03:2880:f01c:8012:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/sdk.js Requested by Host: duo.com URL: https://duo.com/site/themes/duo/js/build/production-2018.min.js?v=1593630912 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash f4de2aa24845da6d1bbf58de32fff7736baa889426ef447e1b07242f97c76064 Security Headers Name Value Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000; preload; includeSubDomains content-encoding gzip x-content-type-options nosniff content-md5 oeJRa14asVqxmE5OWgvIMw== status 200 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 1780 etag "d9b3ca2cb986ef323d5d07b168f109e7" x-fb-debug 7EwLMHGpqeLoHOSqnzactGPjSVxIsoRvVHsy8DbjEA4NBu2HEaTEYKUMl7zPsv8A8eJWn1wODaxb0p0Ty9IzTQ== x-fb-trip-id 664085054 x-fb-content-md5 b5122220e8d02b7b3b1166de26d8794f x-frame-options DENY date Tue, 04 Aug 2020 14:53:14 GMT vary Accept-Encoding content-type application/x-javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers X-FB-Content-MD5 cache-control public,max-age=1200,stale-while-revalidate=3600 timing-allow-origin * expires Tue, 04 Aug 2020 15:00:55 GMT
GET H2	200	1503001237.svg Show response duo.com/site/themes/duo/fonts/	234 KB 78 KB	28ms 28ms	XHR image/svg+xml	143.204.202.59 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://duo.com/site/themes/duo/fonts/1503001237.svg Requested by Host: duo.com URL: https://duo.com/site/themes/duo/js/build/production-2018.min.js?v=1593630912 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 143.204.202.59 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-202-59.fra53.r.cloudfront.net Software Duo/1.0 / Resource Hash b3c0882061ddabcb5c700356d4cf9ca8233b423328cd8cf28e6d4421bf8630da Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 04 Aug 2020 14:51:39 GMT content-encoding gzip age 95 x-cache Hit from cloudfront status 200 pragma public last-modified Wed, 08 Apr 2020 14:05:13 GMT server Duo/1.0 etag W/"5e8dda19-3a9a2" vary Accept-Encoding content-type image/svg+xml via 1.1 25ffb5a941b5a46b102cd385a9cdbb50.cloudfront.net (CloudFront) cache-control max-age=31536000, public, must-revalidate, proxy-revalidate, max-age=31536000 x-amz-cf-pop FRA53-C1 x-amz-cf-id efU7ljhloxVrXEY0IvpG1oTWZv5nKaOfE0f6cYxK2oTYyVAuxASiYg== expires Wed, 04 Aug 2021 14:51:39 GMT
GET H2	200	optanon.css cdn.cookielaw.org/skins/6.0.0/default_flat_bottom_two_button_white/v2/css/	23 KB 6 KB	7ms 6ms	Stylesheet text/css	2606:2800:233:1cb7:261b:1f9c:2074:3c EDGECAST
General Check archive.org Show headers Download Go to Full URL https://cdn.cookielaw.org/skins/6.0.0/default_flat_bottom_two_button_white/v2/css/optanon.css Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/consent/8a2bfd38-d491-4dc6-93b9-0098fd7c78e7.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 2606:2800:233:1cb7:261b:1f9c:2074:3c , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECAcc (frc/8F8A) / Resource Hash 8c20518cd7e51066b82e8a8a1e8035210741cf808c02268915747960f531061c Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-ms-blob-type BlockBlob date Tue, 04 Aug 2020 14:53:14 GMT content-encoding gzip content-md5 IBzNmBYUFDAoeR6lu0vQEA== age 10821 x-cache HIT status 200 content-length 5561 x-ms-lease-status unlocked last-modified Thu, 07 May 2020 17:15:05 GMT server ECAcc (frc/8F8A) etag 0x8D7F2AA2FB63320 vary Accept-Encoding content-type text/css access-control-allow-origin * x-ms-request-id 1c2c132e-101e-00e8-3e55-6a251d000000 access-control-expose-headers x-ms-request-id,Server,x-ms-version,Content-Length,Date,Transfer-Encoding cache-control max-age=14400 x-ms-version 2009-09-19 accept-ranges bytes expires Tue, 04 Aug 2020 18:53:14 GMT
GET H2	200	jquery-3.3.1.min.js Show response code.jquery.com/	85 KB 30 KB	27ms 9ms	Script application/javascript	2001:4de0:ac19::1:b:2b HIGHWINDS3
General Check archive.org Show headers Download Go to Full URL https://code.jquery.com/jquery-3.3.1.min.js Requested by Host: cdn.cookielaw.org URL: https://cdn.cookielaw.org/consent/8a2bfd38-d491-4dc6-93b9-0098fd7c78e7.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2001:4de0:ac19::1:b:2b , Netherlands, ASN20446 (HIGHWINDS3, US), Reverse DNS Software nginx / Resource Hash 160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools Origin https://duo.com Response headers date Tue, 04 Aug 2020 14:53:14 GMT content-encoding gzip last-modified Sat, 20 Jan 2018 17:26:44 GMT server nginx status 200 etag W/"5a637bd4-1538f" vary Accept-Encoding x-hw 1596552794.dop220.fr8.t,1596552794.cds277.fr8.hc,1596552794.cds057.fr8.c content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control max-age=315360000, public accept-ranges bytes content-length 30288
GET H2	404	t.js vidassets.terminus.services/314d698d-5fa1-4001-9369-bd93b1ba8871/	0 0	19ms 19ms	Script application/json	99.86.7.51 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://vidassets.terminus.services/314d698d-5fa1-4001-9369-bd93b1ba8871/t.js Requested by Host: duo.com URL: https://duo.com/decipher/dhs-exposes-chinese-malware-tools Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 99.86.7.51 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-99-86-7-51.fra6.r.cloudfront.net Software / Resource Hash Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers
GET H2	200	rules-p-4CduNLZtPCAtp.js Show response rules.quantcount.com/	1 KB 969 B	9ms 7ms	Script application/x-javascript	2600:9000:2057:dc00:6:44e3:f8c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://rules.quantcount.com/rules-p-4CduNLZtPCAtp.js Requested by Host: secure.quantserve.com URL: https://secure.quantserve.com/aquant.js?a=p-4CduNLZtPCAtp Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2600:9000:2057:dc00:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash eeb58a09a292bdf0861692eb655fd1fb04cb5d950ee242c21fc5c574eabcc623 Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 04 Aug 2020 14:42:18 GMT content-encoding gzip last-modified Tue, 11 Apr 2017 00:01:23 GMT server AmazonS3 age 657 vary Accept-Encoding x-cache Hit from cloudfront content-type application/x-javascript status 200 cache-control max-age=3600 x-amz-cf-pop FRA6-C1 x-amz-cf-id Fnzg0-j7NXKpeHUk7_hh3Eq0eaeEh5ZHHkIc4IHSfcaV0Dfzd75_-w== via 1.1 c1fb60e38be5022a78e4b52bedded7c2.cloudfront.net (CloudFront)
GET H2	200	collect px.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7540&url=https%3A%2F%2Fduo.com%2Fdecipher%2Fdhs-exposes-chinese-malware-tools&time=1596552794282 https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D7540%26url%3Dhttps%253A%252F%252Fduo.com%252Fdecipher%252Fdhs-exposes-chinese-mal... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7540&url=https%3A%2F%2Fduo.com%2Fdecipher%2Fdhs-exposes-chinese-malware-tools&time=1596552794282&liSync=true	0 437 B	131ms 131ms	Image application/javascript	2a05:f500:10:101::b93f:9105 LINKEDIN
General Check archive.org Show headers Download Go to Show image Full URL https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7540&url=https%3A%2F%2Fduo.com%2Fdecipher%2Fdhs-exposes-chinese-malware-tools&time=1596552794282&liSync=true Requested by Host: duo.com URL: https://duo.com/decipher/dhs-exposes-chinese-malware-tools Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2a05:f500:10:101::b93f:9105 , Ireland, ASN14413 (LINKEDIN, US), Reverse DNS Software Play / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 04 Aug 2020 14:53:15 GMT nel {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true} server Play linkedin-action 1 report-to {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true} x-li-fabric prod-lva1 status 200 x-li-proto http/2 x-li-pop prod-efr5 content-type application/javascript content-length 0 x-li-uuid bDK25k4YKBYwhen0cCsAAA== Redirect headers content-security-policy default-src *; connect-src 'self' https://media-src.linkedin.com/media/ www.linkedin.com s.c.lnkd.licdn.com m.c.lnkd.licdn.com s.c.exp1.licdn.com s.c.exp2.licdn.com m.c.exp1.licdn.com m.c.exp2.licdn.com wss://*.linkedin.com dms.licdn.com https://dpm.demdex.net/id https://lnkd.demdex.net/event blob: https://accounts.google.com/gsi/status https://linkedin.sc.omtrdc.net/b/ss/ static.licdn.com static-exp1.licdn.com static-exp2.licdn.com static-exp3.licdn.com media.licdn.com media-exp1.licdn.com media-exp2.licdn.com media-exp3.licdn.com; img-src data: blob: *; font-src data: *; style-src 'unsafe-inline' 'self' static-src.linkedin.com *.licdn.com; script-src 'report-sample' 'unsafe-inline' 'unsafe-eval' 'self' spdy.linkedin.com static-src.linkedin.com *.ads.linkedin.com *.licdn.com static.chartbeat.com www.google-analytics.com ssl.google-analytics.com bcvipva02.rightnowtech.com www.bizographics.com sjs.bizographics.com js.bizographics.com d.la4-c1-was.salesforceliveagent.com slideshare.www.linkedin.com https://snap.licdn.com/li.lms-analytics/insight.min.js platform.linkedin.com platform-akam.linkedin.com platform-ecst.linkedin.com platform-azur.linkedin.com; object-src 'none'; media-src blob: *; child-src blob: lnkd-communities: voyager: *; frame-ancestors 'self' x-content-type-options nosniff nel {"report_to":"network-errors","max_age":1296000,"success_fraction":0.00066,"failure_fraction":1,"include_subdomains":true} linkedin-action 1 status 302 content-length 0 x-li-uuid 9VbZ204YKBZwe4yfVisAAA== pragma no-cache x-li-pop afd-prod-lva1 x-msedge-ref Ref A: 7FAC802F707146DFBFEF39D328B8F2FC Ref B: FRAEDGE0911 Ref C: 2020-08-04T14:53:14Z x-frame-options sameorigin date Tue, 04 Aug 2020 14:53:14 GMT expect-ct max-age=86400, report-uri="https://www.linkedin.com/platform-telemetry/ct" strict-transport-security max-age=2592000 report-to {"group":"network-errors","max_age":2592000,"endpoints":[{"url":"https://www.linkedin.com/li/rep"}],"include_subdomains":true} x-li-fabric prod-lva1 location https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7540&url=https%3A%2F%2Fduo.com%2Fdecipher%2Fdhs-exposes-chinese-malware-tools&time=1596552794282&liSync=true x-xss-protection 1; mode=block cache-control no-cache, no-store x-li-proto http/2 expires Thu, 01 Jan 1970 00:00:00 GMT
GET H2	200	216127175396154 Show response connect.facebook.net/signals/config/	522 KB 132 KB	10ms 10ms	Script application/x-javascript	2a03:2880:f01c:8012:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/216127175396154?v=2.9.22&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 40c4c12ad97589e401e970e8b1d4c40c0f13019db2b14b4f186ffbb8d54ed207 Security Headers Name Value Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000; preload; includeSubDomains content-encoding gzip x-content-type-options nosniff status 200 alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 134594 x-xss-protection 0 pragma public x-fb-debug 927Z9J5HFCI2InFXNqcdHr1q0cerARR1JdjGmYx/sjM8CiOhc+TemYaCufff7dlu12+LDlzBMbM9EqbXkvY3ow== x-fb-trip-id 664085054 x-frame-options DENY date Tue, 04 Aug 2020 14:53:14 GMT vary Accept-Encoding content-type application/x-javascript; charset=utf-8 cache-control public, max-age=1200 content-security-policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm; expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	data.json Show response duo.com/site/themes/duo/json-bodymovin/d-logo-dark/	195 KB 23 KB	33ms 32ms	XHR application/json	143.204.202.59 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://duo.com/site/themes/duo/json-bodymovin/d-logo-dark/data.json Requested by Host: duo.com URL: https://duo.com/site/themes/duo/js/build/production-2018.min.js?v=1593630912 Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 143.204.202.59 Seattle, United States, ASN16509 (AMAZON-02, US), Reverse DNS server-143-204-202-59.fra53.r.cloudfront.net Software Duo/1.0 / Resource Hash 3876824c31a6ce8eb7d05c2e8c83ac54d557d91d32319903714ea5b9ec163a9c Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 04 Aug 2020 14:51:39 GMT content-encoding gzip x-content-type-options nosniff age 95 x-cache Hit from cloudfront status 200 vary Accept-Encoding content-length 22793 x-xss-protection 1; mode=block x-ua-compatible IE=Edge,chrome=1 referrer-policy no-referrer-when-downgrade last-modified Wed, 24 Oct 2018 13:45:04 GMT server Duo/1.0 x-frame-options SAMEORIGIN etag W/"5bd07760-30b9d" strict-transport-security max-age=63072000; includeSubDomains; content-type application/json via 1.1 25ffb5a941b5a46b102cd385a9cdbb50.cloudfront.net (CloudFront) cache-control max-age=300 x-amz-cf-pop FRA53-C1 x-amz-cf-id qSW6KC8YYtDq8p85wN26lfxM-JibRTkNUCNxOtEgKKDNCLuqj6rFBQ== expires Tue, 04 Aug 2020 14:56:39 GMT
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/159/	11 KB 5 KB	26ms 25ms	Script application/x-javascript	104.109.95.62 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/159/munchkin.js Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/munchkin-beta.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 104.109.95.62 , Netherlands, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS a104-109-95-62.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 459e23d23ffe65a86f3a1f67c07edc92e0c69461ff83fbd63764d7b36cac92fc Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 04 Aug 2020 14:53:14 GMT Content-Encoding gzip Last-Modified Fri, 08 May 2020 02:24:14 GMT Server AkamaiNetStorage ETag "79274ffc293e4f76fc372b953f780d16:1588904654.430334" Vary Accept-Encoding P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Cache-Control max-age=8640000 Connection keep-alive Accept-Ranges bytes Content-Type application/x-javascript Content-Length 4810 Expires Thu, 12 Nov 2020 14:53:14 GMT
GET H2	204	0 bat.bing.com/action/	0 148 B	62ms 62ms	Image text/plain	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://bat.bing.com/action/0?ti=4006052&Ver=2&mid=45ebfcf1-ca65-9c1e-267d-141a82464f5d&sid=862c6e7682896258815ec6b9216dc868&vid=361f3fb89a1d0f6a3b1a4d23b496d95a&vids=1&pi=0&lg=en-US&sw=1600&sh=1200&sc=24&tl=DHS%20Exposes%20Chinese%20Malware%20Tools%20%7C%20Decipher&p=https%3A%2F%2Fduo.com%2Fdecipher%2Fdhs-exposes-chinese-malware-tools&r=&lt=716&evt=pageLoad&msclkid=N&sv=1&rn=38433 Requested by Host: duo.com URL: https://duo.com/decipher/dhs-exposes-chinese-malware-tools Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers status 204 pragma no-cache date Tue, 04 Aug 2020 14:53:13 GMT cache-control no-cache, must-revalidate x-msedge-ref Ref A: A974FC5AD33440A1ADD06F78B5B59629 Ref B: FRAEDGE1307 Ref C: 2020-08-04T14:53:14Z access-control-allow-origin * expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	/ Show response c.6sc.co/	47 B 363 B	118ms 35ms	XHR text/plain	23.10.73.123 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 23.10.73.123 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-10-73-123.deploy.static.akamaitechnologies.com Software / Resource Hash d7023da3da38db91f0c25cd801a9993865db86df1ea21cc261f323d0e3e1a790 Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 04 Aug 2020 14:53:14 GMT Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type text/plain Access-Control-Allow-Origin https://duo.com Access-Control-Allow-Credentials true Connection keep-alive Access-Control-Allow-Headers * Content-Length 47
GET H/1.1	200 OK	getuidj Show response secure.adnxs.com/	11 B 694 B	93ms 35ms	XHR application/json	37.252.173.22 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://secure.adnxs.com/getuidj Requested by Host: j.6sc.co URL: https://j.6sc.co/6si.min.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 37.252.173.22 , Ascension Island, ASN29990 (ASN-APPNEX, US), Reverse DNS 536.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net Software nginx/1.13.4 / Resource Hash 31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d Security Headers Name Value X-Xss-Protection 0 Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Pragma no-cache Date Tue, 04 Aug 2020 14:53:14 GMT X-Proxy-Origin 82.102.19.136; 82.102.19.136; 536.bm-nginx-loadbalancer.mgmt.fra1; *.adnxs.com; 37.252.173.45:80 AN-X-Request-Uuid 55b8aa98-4e69-4a71-8ada-8915882867ec Server nginx/1.13.4 P3P policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://duo.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 11 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H2	200	sdk.js Show response connect.facebook.net/en_US/	199 KB 61 KB	17ms 6ms	Script application/x-javascript	2a03:2880:f01c:8012:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/sdk.js?hash=4d5ad1b746b6c409fff01d2328a01663&ua=modern_es6 Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/sdk.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 1c155e90bd99df74f608023bb31a10ef1c49e60d16459ac7f98cb9f658119f01 Security Headers Name Value Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY Request headers User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools Origin https://duo.com Response headers strict-transport-security max-age=31536000; preload; includeSubDomains content-encoding gzip x-content-type-options nosniff content-md5 Jx3/oxDeAM/qca8WKm2Eyw== status 200 cross-origin-resource-policy cross-origin alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 61457 etag "ad1f388b703857d7dd3d347621d8b56d" x-fb-debug j5IWavRI5XYcj4pSwZexzbNjjmF2QOF3ZqjbY8tRt5I+rIiFIA1PorC7VTmIU/MXsZ0aDe+foSIWgdSW1TcEmg== x-fb-trip-id 664085054 x-fb-content-md5 5e09de8fb0b4c8ad65727a406c781351 x-frame-options DENY date Tue, 04 Aug 2020 14:53:14 GMT vary Accept-Encoding content-type application/x-javascript; charset=utf-8 access-control-allow-origin * access-control-expose-headers X-FB-Content-MD5 cache-control public,max-age=31536000,stale-while-revalidate=3600,immutable timing-allow-origin * expires Wed, 04 Aug 2021 14:11:51 GMT
GET H2	200	collect www.google-analytics.com/	35 B 106 B	6ms 5ms	Image image/gif	2a00:1450:4001:816::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google-analytics.com/collect?v=1&_v=j83&a=777674357&t=pageview&_s=1&dl=https%3A%2F%2Fduo.com%2Fdecipher%2Fdhs-exposes-chinese-malware-tools&ul=en-us&de=UTF-8&dt=DHS%20Exposes%20Chinese%20Malware%20Tools%20%7C%20Decipher&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aGDAgAADQ~&jid=1368175670&gjid=1966973735&cid=780642895.1596552794&tid=UA-20141016-1&_gid=980207450.1596552794&gtm=2wg7m1MFPB9D&cg3=Decipher%20Traffic%20Only&z=89901833 Requested by Host: duo.com URL: https://duo.com/decipher/dhs-exposes-chinese-malware-tools Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:816::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Thu, 30 Jul 2020 03:14:40 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 age 473914 status 200 content-type image/gif access-control-allow-origin * cache-control no-cache, no-store, must-revalidate alt-svc h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 35 expires Mon, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.de/ads/ Redirect Chain https://stats.g.doubleclick.net/r/collect?t=dc&aip=1&_r=3&v=1&_v=j83&tid=UA-20141016-1&cid=780642895.1596552794&jid=1368175670&gjid=1966973735&_gid=980207450.1596552794&_u=aGDAgAADQ~&z=1825311376 https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-20141016-1&cid=780642895.1596552794&jid=1368175670&_v=j83&z=1825311376 https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-20141016-1&cid=780642895.1596552794&jid=1368175670&_v=j83&z=1825311376&slf_rd=1&random=1091181512	42 B 106 B	18ms 18ms	Image image/gif	2a00:1450:4001:80b::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-20141016-1&cid=780642895.1596552794&jid=1368175670&_v=j83&z=1825311376&slf_rd=1&random=1091181512 Requested by Host: duo.com URL: https://duo.com/decipher/dhs-exposes-chinese-malware-tools Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Tue, 04 Aug 2020 14:53:14 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers pragma no-cache date Tue, 04 Aug 2020 14:53:14 GMT x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 302 content-type text/html; charset=UTF-8 location https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-20141016-1&cid=780642895.1596552794&jid=1368175670&_v=j83&z=1825311376&slf_rd=1&random=1091181512 cache-control no-cache, no-store, must-revalidate timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	widget_iframe.3c5aa8e2a38bbbee4b6d88e6846fc657.html platform.twitter.com/widgets/ Frame 4E49	0 0	7ms 6ms	Document text/html	2606:2800:234:46c:e8b:1e2f:2bd:694 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://platform.twitter.com/widgets/widget_iframe.3c5aa8e2a38bbbee4b6d88e6846fc657.html?origin=https%3A%2F%2Fduo.com Requested by Host: platform.twitter.com URL: https://platform.twitter.com/widgets.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2606:2800:234:46c:e8b:1e2f:2bd:694 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (fcn/40B4) / Resource Hash Request headers Host platform.twitter.com Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Sec-Fetch-Dest iframe Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools Accept-Encoding gzip, deflate, br Accept-Language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools Response headers Content-Encoding gzip Access-Control-Allow-Methods GET Access-Control-Allow-Origin * Age 62710 Cache-Control public, max-age=315360000 Content-Type text/html; charset=utf-8 Date Tue, 04 Aug 2020 14:53:14 GMT Etag "9fa476ae827f556d5b037fe43632370d+gzip" Last-Modified Thu, 30 Jul 2020 21:53:52 GMT P3P CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Server ECS (fcn/40B4) Vary Accept-Encoding X-Cache HIT Content-Length 5825
GET H2	200	pixel;r=899951007;labels=_fp.event.Default;rf=0;a=p-4CduNLZtPCAtp;url=https%3A%2F%2Fduo.com%2Fdecipher%2Fdhs-exposes-chinese-malware-tools;fpan=1;fpa=P0-329946772-1596552794795;ns=0;ce=1;qjs=1;qv=3... pixel.quantserve.com/	35 B 372 B	9ms 7ms	Image image/gif	2620:116:800d:21:36a9:ecb:e518:b308 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://pixel.quantserve.com/pixel;r=899951007;labels=_fp.event.Default;rf=0;a=p-4CduNLZtPCAtp;url=https%3A%2F%2Fduo.com%2Fdecipher%2Fdhs-exposes-chinese-malware-tools;fpan=1;fpa=P0-329946772-1596552794795;ns=0;ce=1;qjs=1;qv=35f667c6-20200713111428;cm=;gdpr=0;ref=;d=duo.com;je=0;sr=1600x1200x24;enc=n;dst=1;et=1596552794795;tzo=-120;ogl=site_name.Decipher%2Ctype.website%2Curl.https%3A%2F%2Fduo%252Ecom%2Fdecipher%2Fdhs-exposes-chinese-malware-tools%2Ctitle.DHS%20Exposes%20Chinese%20Malware%20Tools%2Cdescription.The%20US%20government%20has%20published%20a%20detailed%20analysis%20of%20the%20Taidoor%20trojan%20it%20say%2Cimage.https%3A%2F%2Fduo%252Ecom%2Fassets%2Fimg%2Fseo-images%2Fchinaflag%252Ejpg%2Cimage%3Awidth.1200%2Cimage%3Aheight.630 Requested by Host: duo.com URL: https://duo.com/decipher/dhs-exposes-chinese-malware-tools Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:116:800d:21:36a9:ecb:e518:b308 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8 Security Headers Name Value Strict-Transport-Security max-age=86400 Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Tue, 04 Aug 2020 14:53:14 GMT strict-transport-security max-age=86400 p3p CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV" status 200 cache-control private, no-cache, no-store, proxy-revalidate content-type image/gif content-length 35 expires Fri, 04 Aug 1978 12:00:00 GMT
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	346ms 270ms	Image image/gif	23.10.73.123 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=361da14e9cc9e3c3150a35780c1bec6b&svisitor=&visitor=99d5a8c3-9354-468f-8155-cd8666345a19&session=e3b2a552-35c9-4c5f-88f5-4c65d1b4d5c8&event=a_pageload&q=%7B%7D&isIframe=false&m=%7B%22description%22%3A%22The%20US%20government%20has%20published%20a%20detailed%20analysis%20of%20the%20Taidoor%20trojan%20it%20says%20is%20used%20by%20the%20Chinese%20government%20in%20network%20compromises.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22DHS%20Exposes%20Chinese%20Malware%20Tools%20%7C%20Decipher%22%7D&cb=52794827&r=&thirdParty=%7B%7D&pageURL=https://duo.com/decipher/dhs-exposes-chinese-malware-tools Requested by Host: duo.com URL: https://duo.com/decipher/dhs-exposes-chinese-malware-tools Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 23.10.73.123 , Netherlands, ASN16625 (AKAMAI-AS, US), Reverse DNS a23-10-73-123.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 04 Aug 2020 14:53:15 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Fri, 21 Feb 2020 18:57:20 GMT Server nginx/1.14.0 (Ubuntu) ETag "5e502810-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H2	200	inspectlet.js Show response cdn.inspectlet.com/	208 KB 69 KB	42ms 23ms	Script text/javascript	2606:4700:10::6816:38f5 CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://cdn.inspectlet.com/inspectlet.js Requested by Host: duo.com URL: https://duo.com/decipher/dhs-exposes-chinese-malware-tools Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:10::6816:38f5 , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 38e7e40f686e91d031023a33128bc8688555e601828a1366fb30e14c434c24f6 Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers cf-ray 5bd91b57dba3dfe7-FRA date Tue, 04 Aug 2020 14:53:14 GMT via 1.1 vegur cf-cache-status HIT server cloudflare age 29 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding content-type text/javascript;charset=UTF-8 status 200 cache-control s-maxage=60, max-age=14400 content-encoding gzip cf-request-id 045b8f6ae40000dfe78980b200000001
GET H2	200	120108061684670 Show response connect.facebook.net/signals/config/	522 KB 132 KB	8ms 7ms	Script application/x-javascript	2a03:2880:f01c:8012:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/120108061684670?v=2.9.22&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f01c:8012:face:b00c:0:3 , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash ee79b7bbbb82fbe7e8fc8a011090a5abb68cb85434f0c24b677009f86ed123f2 Security Headers Name Value Content-Security-Policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers strict-transport-security max-age=31536000; preload; includeSubDomains content-encoding gzip x-content-type-options nosniff status 200 alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 134594 x-xss-protection 0 pragma public x-fb-debug jiGogIe1s9KR6Pta6x8WfjB4d2Jm3DpO7oEGtyd0xhIJqY9dRirwbuw5JLGkaNW/uKe6PectjDHC/8xccERAug== x-fb-trip-id 664085054 x-frame-options DENY date Tue, 04 Aug 2020 14:53:14 GMT vary Accept-Encoding content-type application/x-javascript; charset=utf-8 cache-control public, max-age=1200 content-security-policy default-src * data: blob:;script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net *.spotilocal.com:* wss://*.facebook.com:* https://fb.scanandcleanlocal.com:* attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' chrome-extension://boadgeojelhgndaghljhdicfkmllpafd chrome-extension://dliochdbjfkdbacpmhlcpmleaejidimm; expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	/ www.facebook.com/tr/	44 B 376 B	19ms 6ms	Image image/gif	2a03:2880:f11c:8183:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=216127175396154&ev=PageView&dl=https%3A%2F%2Fduo.com%2Fdecipher%2Fdhs-exposes-chinese-malware-tools&rl=&if=false&ts=1596552794848&sw=1600&sh=1200&v=2.9.22&r=stable&ec=0&o=30&fbp=fb.1.1596552794847.1037908432&it=1596552794347&coo=false&rqm=GET Requested by Host: duo.com URL: https://duo.com/decipher/dhs-exposes-chinese-malware-tools Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 04 Aug 2020 14:53:14 GMT last-modified Fri, 21 Dec 2012 00:00:01 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains content-type image/gif status 200 cache-control no-cache, must-revalidate, max-age=0 alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 44 expires Tue, 04 Aug 2020 14:53:14 GMT
GET H/1.1	200 OK	visitWebPage Show response 074-uqx-410.mktoresp.com/webevents/	2 B 304 B	1046ms 377ms	XHR text/plain	192.28.147.68 MARKETO
General Check archive.org Show headers Download Go to Full URL https://074-uqx-410.mktoresp.com/webevents/visitWebPage?_mchNc=1596552794877&_mchCn=&_mchId=074-UQX-410&_mchTk=_mch-duo.com-1596552794876-62243&_mchHo=duo.com&_mchPo=&_mchRu=%2Fdecipher%2Fdhs-exposes-chinese-malware-tools&_mchPc=https%3A&_mchVr=159&_mchEcid=&_mchHa=&_mchRe=&_mchQp= Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/159/munchkin.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.28.147.68 , United States, ASN53580 (MARKETO, US), Reverse DNS Software akka-http/10.1.11 / Resource Hash 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3 Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Access-Control-Allow-Origin * Date Tue, 04 Aug 2020 14:53:15 GMT Content-Encoding gzip Server akka-http/10.1.11 Transfer-Encoding chunked X-Request-Id ffdfdcfa-8a3a-4bd6-87f0-b7310bdd07cd Content-Type text/plain; charset=UTF-8
GET H2	200	utag.js Show response tags.tiqcdn.com/utag/cisco/duo/prod/	199 KB 55 KB	109ms 67ms	Script application/x-javascript	23.8.6.251 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.js Requested by Host: www.cisco.com URL: https://www.cisco.com/c/dam/cdc/t/ctm.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.8.6.251 , Netherlands, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS a23-8-6-251.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash a6ceab88556449054136ede56f2a6fc95ac5eabea42c49ab12de0e86e94bf7bc Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 04 Aug 2020 14:53:15 GMT content-encoding gzip last-modified Thu, 30 Jul 2020 18:08:14 GMT server AkamaiNetStorage etag "9c063e8cc322f0a60293d19cbd08d7ef:1596132494.261235" vary Accept-Encoding content-type application/x-javascript status 200 cache-control max-age=300 accept-ranges bytes expires Tue, 04 Aug 2020 14:58:15 GMT
GET H2	200	ipv cdn.bizible.com/m/	43 B 326 B	18ms 18ms	Image image/gif	68.232.35.12 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.bizible.com/m/ipv?_biz_r=&_biz_h=-1906410348&_biz_u=e39185dedebf436893bb428886c8026e&_biz_s=6b8701&_biz_l=https%3A%2F%2Fduo.com%2Fdecipher%2Fdhs-exposes-chinese-malware-tools&_biz_t=1596552795045&_biz_i=DHS%20Exposes%20Chinese%20Malware%20Tools%20%7C%20Decipher&_biz_n=0&rnd=194005&cdn_o=a&_biz_z=1596552795048 Requested by Host: duo.com URL: https://duo.com/decipher/dhs-exposes-chinese-malware-tools Protocol H2 Security TLS 1.3, , AES_256_GCM Server 68.232.35.12 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (amb/6B75) / Resource Hash afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277 Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Tue, 04 Aug 2020 14:53:15 GMT last-modified Fri, 31 Jul 2020 01:56:13 GMT server ECS (amb/6B75) age 392222 x-cache HIT p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" status 200 cache-control no-cache, no-store accept-ranges bytes content-type Image/GIF content-length 43 expires -1
POST H/1.1	200 OK	679911470 Show response hn.inspectlet.com/ginit/	26 B 442 B	342ms 114ms	XHR application/json	52.21.101.90 AMAZON-AES
General Check archive.org Show headers Download Go to Full URL https://hn.inspectlet.com/ginit/679911470 Requested by Host: cdn.inspectlet.com URL: https://cdn.inspectlet.com/inspectlet.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.21.101.90 Ashburn, United States, ASN14618 (AMAZON-AES, US), Reverse DNS Software Cowboy / Express Resource Hash d0b1cb1455ecf8ab5a7eb203460cc7ff790df097c5907eb3d27ff7344282517e Request headers Accept application/json, text/javascript, */*; q=0.01 Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type application/x-www-form-urlencoded; charset=UTF-8 Response headers Date Tue, 04 Aug 2020 14:53:15 GMT Via 1.1 vegur Server Cowboy X-Powered-By Express Access-Control-Allow-Methods GET, POST Content-Type application/json; charset=utf-8 Access-Control-Allow-Origin https://duo.com Cache-Control no-cache Access-Control-Allow-Credentials true Connection keep-alive Access-Control-Allow-Headers X-Requested-With, Content-Type Content-Length 26
GET H2	200	/ www.facebook.com/tr/	44 B 258 B	8ms 8ms	Image image/gif	2a03:2880:f11c:8183:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=120108061684670&ev=PageView&dl=https%3A%2F%2Fduo.com%2Fdecipher%2Fdhs-exposes-chinese-malware-tools&rl=&if=false&ts=1596552795125&sw=1600&sh=1200&v=2.9.22&r=stable&ec=0&o=30&fbp=fb.1.1596552795124.1480168565&it=1596552794347&coo=false&rqm=GET Requested by Host: duo.com URL: https://duo.com/decipher/dhs-exposes-chinese-malware-tools Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 04 Aug 2020 14:53:15 GMT last-modified Fri, 21 Dec 2012 00:00:01 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains content-type image/gif status 200 cache-control no-cache, must-revalidate, max-age=0 alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 44 expires Tue, 04 Aug 2020 14:53:15 GMT
GET H2	200	BizibleAcct.js Show response cdn.bizible.com/	367 B 536 B	126ms 125ms	Script text/javascript	68.232.35.12 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://cdn.bizible.com/BizibleAcct.js?_biz_u=e39185dedebf436893bb428886c8026e&_biz_h=-1906410348&cdn_o=a&jsVer=4.20.07.30 Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js Protocol H2 Security TLS 1.3, , AES_256_GCM Server 68.232.35.12 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (amb/6BA3) / Resource Hash a73353e8e5e1e40cb3e55c583447ca684c103a8b88cd412aea4efba1e29c8a9c Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 04 Aug 2020 14:53:14 GMT content-encoding gzip server ECS (amb/6BA3) etag C98A7294 vary Accept-Encoding p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" status 200 cache-control private, must-revalidate, max-age=21600 content-type text/javascript; charset=utf-8 content-length 321
GET H/1.1	200 OK	rd Show response dpm.demdex.net/id/ Redirect Chain https://dpm.demdex.net/id?d_visid_ver=4.1.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=B8D07FF4520E94C10A490D4C%40AdobeOrg&d_nsid=0&ts=1596552795175 https://dpm.demdex.net/id/rd?d_visid_ver=4.1.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=B8D07FF4520E94C10A490D4C%40AdobeOrg&d_nsid=0&ts=1596552795175	604 B 1 KB	36ms 36ms	XHR application/json	52.49.47.228 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://dpm.demdex.net/id/rd?d_visid_ver=4.1.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=B8D07FF4520E94C10A490D4C%40AdobeOrg&d_nsid=0&ts=1596552795175 Requested by Host: duo.com URL: https://duo.com/decipher/dhs-exposes-chinese-malware-tools Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.49.47.228 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash bdff94e31c921b32ba46abe8465ddf93582782820adf9b783d353796f15ee255 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers DCS dcs-prod-irl1-v077-04e51fca2.edge-irl1.demdex.com 5.75.3.20200728075420 3ms (+1ms) Pragma no-cache Strict-Transport-Security max-age=31536000; includeSubDomains Content-Encoding gzip X-TID fYfUtDEhSdE= Vary Origin, Accept-Encoding, User-Agent P3P policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Access-Control-Allow-Origin https://duo.com Cache-Control no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json;charset=utf-8 Content-Length 435 Expires Thu, 01 Jan 1970 00:00:00 GMT Redirect headers Pragma no-cache Strict-Transport-Security max-age=31536000; includeSubDomains Access-Control-Allow-Origin https://duo.com X-TID ZfvD50VRS0k= Vary Origin P3P policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Location https://dpm.demdex.net/id/rd?d_visid_ver=4.1.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=B8D07FF4520E94C10A490D4C%40AdobeOrg&d_nsid=0&ts=1596552795175 Cache-Control no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Access-Control-Allow-Credentials true Connection keep-alive Content-Length 0 Expires Thu, 01 Jan 1970 00:00:00 GMT
GET H2	200	utag.5.js Show response tags.tiqcdn.com/utag/cisco/duo/prod/	69 KB 24 KB	28ms 24ms	Script application/x-javascript	23.8.6.251 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.5.js?utv=ut4.46.202007301808 Requested by Host: tags.tiqcdn.com URL: https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.8.6.251 , Netherlands, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS a23-8-6-251.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 17e631a5d561f012aef1ff726e91fb9c6c7b218af9bc71e2327b75c095477e37 Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 04 Aug 2020 14:53:15 GMT content-encoding gzip last-modified Thu, 09 Jul 2020 18:09:54 GMT server AkamaiNetStorage etag "e4f15abc1b2d388edcd3276f1302f342:1594318194.233672" vary Accept-Encoding content-type application/x-javascript status 200 cache-control max-age=1296000 accept-ranges bytes content-length 24066 expires Wed, 19 Aug 2020 14:53:15 GMT
GET H2	200	utag.3.js Show response tags.tiqcdn.com/utag/cisco/duo/prod/	21 KB 7 KB	25ms 23ms	Script application/x-javascript	23.8.6.251 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.3.js?utv=ut4.46.202007301808 Requested by Host: tags.tiqcdn.com URL: https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.8.6.251 , Netherlands, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS a23-8-6-251.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 0152a39728f2a4b79a8b25f2dadee32c36c83686c08f3705cf5f66ac818ad760 Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 04 Aug 2020 14:53:15 GMT content-encoding gzip last-modified Thu, 02 Jul 2020 17:44:00 GMT server AkamaiNetStorage etag "86bff072605e0af60a70d93db394c25b:1593711840.621763" vary Accept-Encoding content-type application/x-javascript status 200 cache-control max-age=1296000 accept-ranges bytes content-length 7003 expires Wed, 19 Aug 2020 14:53:15 GMT
GET H2	200	utag.20.js Show response tags.tiqcdn.com/utag/cisco/duo/prod/	2 KB 1 KB	24ms 22ms	Script application/x-javascript	23.8.6.251 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.20.js?utv=ut4.46.202007301808 Requested by Host: tags.tiqcdn.com URL: https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.8.6.251 , Netherlands, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS a23-8-6-251.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 10ce4f4b462620e36773121d3d2810e77f496ea3bd16aa18fbfd34ba1c36a558 Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 04 Aug 2020 14:53:15 GMT content-encoding gzip last-modified Thu, 07 May 2020 18:11:28 GMT server AkamaiNetStorage etag "342fbf5a8237c176a09d3900737fbd03:1588875088.280384" vary Accept-Encoding content-type application/x-javascript status 200 cache-control max-age=1296000 accept-ranges bytes content-length 1056 expires Wed, 19 Aug 2020 14:53:15 GMT
GET H2	200	utag.26.js Show response tags.tiqcdn.com/utag/cisco/duo/prod/	2 KB 1 KB	24ms 22ms	Script application/x-javascript	23.8.6.251 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.26.js?utv=ut4.46.202007301808 Requested by Host: tags.tiqcdn.com URL: https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.8.6.251 , Netherlands, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS a23-8-6-251.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash b3f0b03ad5052111cdb07d6b8340ebba1c97a4ca103bbbeb8441866a4fe12d26 Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 04 Aug 2020 14:53:15 GMT content-encoding gzip last-modified Thu, 07 May 2020 18:11:29 GMT server AkamaiNetStorage etag "febd3c5202e04fc7dc67595fd705ae34:1588875089.069606" vary Accept-Encoding content-type application/x-javascript status 200 cache-control max-age=1296000 accept-ranges bytes content-length 1061 expires Wed, 19 Aug 2020 14:53:15 GMT
GET H/1.1	200 OK	ntpagetag.gif cisco-tags.cisco.com/tag/	85 B 598 B	669ms 139ms	Image image/gif	72.163.10.10 CISCOSYSTEMS
General Check archive.org Show headers Download Go to Show image Full URL https://cisco-tags.cisco.com/tag/ntpagetag.gif?js=1&ts=1596552795235.822&lc=https%3A%2F%2Fduo.com%2Fdecipher%2Fdhs-exposes-chinese-malware-tools&rs=1600x1200&cd=24&ln=en&tz=GMT%20%2B02%3A00&jv=0&utag_main_v_id=0173b9f6540f000a0788681475ef00078003a07000b08&meta.viewport=width%3Ddevice-width%2C%20initial-scale%3D1.0%2C%20user-scalable%3Dyes&title=dhs%20exposes%20chinese%20malware%20tools%20%7C%20decipher&url=https%3A%2F%2Fduo.com%2Fdecipher%2Fdhs-exposes-chinese-malware-tools&tag=ut4.46.202007301808&entitlement=undefined&locale=en-us&meta.country=us&meta.locale=us&breakpoint=unavailable&content_type=no%20contenttype&linktrack=linkpage&loc=http%3A%2F%2Fduo.com%2Fdecipher%2Fdhs-exposes-chinese-malware-tools&cookie_length=500&meta.iapath=no%20iapath&hier1=no%20iapath&meta.wm_reporting_category=no%20iapath&sa_source=meta.iapath&t_profile=cisco.duo&t_load=ctm&suite=cisco-complete&returnVisit=false&cookies=true&localstorage=true&dnt=false&conversion=event1&adobeVersions=AppMeasurement%3Dna%2CVisitorJS%3Dna%2CMbox%3Dna&meta.msapplication-tilecolor=%23000000&meta.msapplication-config=%2Fassets%2Fimg%2Fdecipher%2Ffavicons%2Fbrowserconfig.xml&meta.theme-color=%23ffffff&meta.robots=index%2Cfollow%2Carchive&meta.fb:app_id=2090208394329663&meta.og:site_name=decipher&meta.og:type=website&meta.og:url=https%3A%2F%2Fduo.com%2Fdecipher%2Fdhs-exposes-chinese-malware-tools&meta.twitter:card=summary_large_image&meta.twitter:site=%40deciphersec&meta.twitter:creator=%40deciphersec&meta.og:title=dhs%20exposes%20chinese%20malware%20tools&meta.twitter:title=dhs%20exposes%20chinese%20malware%20tools&meta.description=the%20us%20government%20has%20published%20a%20detailed%20analysis%20of%20the%20taidoor%20trojan%20it%20says%20is%20used%20by%20the%20chinese%20government%20in%20network%20compromises.&meta.og:description=the%20us%20government%20has%20published%20a%20detailed%20analysis%20of%20the%20taidoor%20trojan%20it%20says%20is%20used%20by%20the%20chinese%20government%20in%20network%20compromises.&meta.twitter:description=the%20us%20government%20has%20published%20a%20detailed%20analysis%20of%20the%20taidoor%20trojan%20it%20says%20is%20used%20by%20the%20chinese%20government%20in%20network%20compromises.&meta.twitter:image=https%3A%2F%2Fduo.com%2Fassets%2Fimg%2Fseo-images%2Fchinaflag.jpg&meta.og:image=https%3A%2F%2Fduo.com%2Fassets%2Fimg%2Fseo-images%2Fchinaflag.jpg&meta.og:image:width=1200&meta.og:image:height=630&meta.bitly-verification=040b99f315c6&meta.google-site-verification=svd8ahbyylsc2wljqdzwij1d2tnu8-u3fbldciehxdu&meta.twitter:widgets:csp=on&ets=1596552795237.592 Requested by Host: duo.com URL: https://duo.com/decipher/dhs-exposes-chinese-malware-tools Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 72.163.10.10 Richardson, United States, ASN109 (CISCOSYSTEMS, US), Reverse DNS cisco-tags.cisco.com Software Apache/2.2 / Resource Hash b96b64444f7d52c39b5716fe4d3e8d0433c67fb79731a4400188835d97b74bce Security Headers Name Value Content-Security-Policy script-src 'self'; object-src 'self' Strict-Transport-Security max-age=31536000; includeSubdomains; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Date Tue, 04 Aug 2020 14:53:15 GMT X-Content-Type-Options nosniff Last-Modified Fri, 12 Jun 2009 13:18:26 GMT Server Apache/2.2 ETag "55" X-Frame-Options SAMEORIGIN Content-Type image/gif Access-Control-Allow-Origin * Connection Keep-Alive Content-Security-Policy script-src 'self'; object-src 'self' Strict-Transport-Security max-age=31536000; includeSubdomains; Accept-Ranges bytes Keep-Alive timeout=2, max=1000 Content-Length 85 X-XSS-Protection 1; mode=block
GET H2	200	utag.v.js Show response tags.tiqcdn.com/utag/tiqapp/	2 B 202 B	20ms 20ms	Script application/x-javascript	23.8.6.251 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=cisco/duo/202007301808&cb=1596552795243 Requested by Host: tags.tiqcdn.com URL: https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 23.8.6.251 , Netherlands, ASN20940 (AKAMAI-ASN1, EU), Reverse DNS a23-8-6-251.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers date Tue, 04 Aug 2020 14:53:15 GMT last-modified Thu, 14 Apr 2016 16:57:51 GMT server AkamaiNetStorage etag "7bc0ee636b3b83484fc3b9348863bd22:1460653071" content-type application/x-javascript status 200 cache-control max-age=600 accept-ranges bytes content-length 2 expires Tue, 04 Aug 2020 15:03:15 GMT
POST H2	200	/ www.facebook.com/tr/	0 77 B	8ms 7ms	Other text/plain	2a03:2880:f11c:8183:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/tr/ Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type multipart/form-data; boundary=----WebKitFormBoundary3o6BUBqA3BOPYNqV Response headers strict-transport-security max-age=31536000; includeSubDomains server proxygen-bolt date Tue, 04 Aug 2020 14:53:15 GMT status 200 content-type text/plain access-control-allow-origin https://duo.com access-control-allow-credentials true alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 0
GET H/1.1	200 OK	Cookie set dest5.html cisco.demdex.net/ Frame 477F	0 0	135ms 33ms	Document text/html	34.248.119.134 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cisco.demdex.net/dest5.html?d_nsid=0 Requested by Host: tags.tiqcdn.com URL: https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 34.248.119.134 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Host cisco.demdex.net Connection keep-alive Pragma no-cache Cache-Control no-cache Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site cross-site Sec-Fetch-Mode navigate Sec-Fetch-Dest iframe Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools Accept-Encoding gzip, deflate, br Accept-Language en-US Cookie demdex=43973629628624589084534765726616698796 Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools Response headers Accept-Ranges bytes Cache-Control max-age=21600 Content-Encoding gzip Content-Type text/html Expires Thu, 01 Jan 1970 00:00:00 GMT Last-Modified Thu, 30 Jul 2020 09:55:56 GMT P3P policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Pragma no-cache Set-Cookie demdex=43973629628624589084534765726616698796;Path=/;Domain=.demdex.net;Expires=Sun, 31-Jan-2021 14:53:15 GMT;Max-Age=15552000;Secure;SameSite=None Strict-Transport-Security max-age=31536000; includeSubDomains Vary Accept-Encoding, User-Agent X-TID md+Ihoa8SqM= Content-Length 2785 Connection keep-alive
GET H2	200	id Show response smetrics.cisco.com/	48 B 474 B	116ms 30ms	XHR application/x-javascript	15.236.175.233 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://smetrics.cisco.com/id?d_visid_ver=4.1.0&d_fieldgroup=A&mcorgid=B8D07FF4520E94C10A490D4C%40AdobeOrg&mid=37850053184045920293994448225775035949&ts=1596552795366 Requested by Host: cdn.inspectlet.com URL: https://cdn.inspectlet.com/inspectlet.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 15.236.175.233 Paris, France, ASN16509 (AMAZON-02, US), Reverse DNS Software jag / Resource Hash de9cd7dde296b0f9f062d629ea5f75cdceab6b8569ec57a900483f564649afc6 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers status 200 date Tue, 04 Aug 2020 14:53:15 GMT x-content-type-options nosniff server jag xserver anedge-7447d85976-sq5wh vary Origin x-c master-1315.Ia06625.M0-426 p3p CP="This is not a P3P policy" access-control-allow-origin https://duo.com cache-control no-cache, no-store, max-age=0, no-transform, private access-control-allow-credentials true content-type application/x-javascript;charset=utf-8 content-length 48 x-xss-protection 1; mode=block
GET H2	200	s82757920814196 Show response smetrics.cisco.com/b/ss/cisco-complete/10/JS-2.12.0/	558 B 804 B	62ms 62ms	Script application/x-javascript	15.236.175.233 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://smetrics.cisco.com/b/ss/cisco-complete/10/JS-2.12.0/s82757920814196?AQB=1&ndh=1&pf=1&callback=s_c_il[1].doPostbacks&et=1&t=4%2F7%2F2020%2016%3A53%3A15%202%20-120&d.&nsid=0&jsonv=1&.d&sdid=4E96F07F52082C3A-32667729B492BA57&mid=37850053184045920293994448225775035949&aamlh=6&ce=UTF-8&ns=cisco&pageName=duo.com%2Fdecipher%2Fdhs-exposes-chinese-malware-tools&g=https%3A%2F%2Fduo.com%2Fdecipher%2Fdhs-exposes-chinese-malware-tools&cc=USD&events=event1&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&c1=dhs%20exposes%20chinese%20malware%20tools%20%7C%20decipher&h1=duo.com%3Adecipher%3Adhs-exposes-chinese-malware-tools&c2=undefined%3Ano%20iapath%3Adhs-exposes-chinese-malware-tools&c3=duo.com%2Fdecipher%2Fdhs-exposes-chinese-malware-tools&h3=no%20iapath&c10=6%3A53%20AM%7CTuesday&v10=6%3A53%20AM%7CTuesday&v25=duo.com%2Fdecipher%2Fdhs-exposes-chinese-malware-tools&v26=no%20contenttype&c28=no%20iapath&v28=no%20iapath&c33=en-us&v33=en-us&c41=duo.com%2Fdecipher%2Fdhs-exposes-chinese-malware-tools&c46=ut4.46.202007301808&v48=undefined&c50=cisco-complete&c51=unavailable&c53=no%20contenttype&c59=0173b9f6540f000a0788681475ef00078003a07000b08&v63=unavailable&v77=AppMeasurement%3D2.12.0%2CVisitorJS%3D4.1.0%2CMbox%3Dna&v78=dnt%3Dfalse%2Ccookies%3Dtrue%2Clocalstorage%3Dtrue&v92=0.1804694436615195_1596552795380&v98=cisco.duo&v106=37850053184045920293994448225775035949&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=B8D07FF4520E94C10A490D4C%40AdobeOrg&AQE=1 Requested by Host: tags.tiqcdn.com URL: https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.5.js?utv=ut4.46.202007301808 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 15.236.175.233 Paris, France, ASN16509 (AMAZON-02, US), Reverse DNS Software jag / Resource Hash 764000579def12cc61692039ecbdfcc36c138145614940b2d09adbc493c1520b Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers x-aam-tid WEL4msKQQB8= date Tue, 04 Aug 2020 14:53:15 GMT x-content-type-options nosniff x-c master-1315.Ia06625.M0-426 p3p CP="This is not a P3P policy" status 200 content-length 558 x-xss-protection 1; mode=block dcs dcs-prod-irl1-v077-07a45c0bc.edge-irl1.demdex.com 5.75.3.20200728075420 4ms (+0ms) pragma no-cache last-modified Wed, 05 Aug 2020 14:53:15 GMT server jag xserver anedge-7447d85976-llq7p etag 3428571020516491264-4614159572683105760 vary * content-type application/x-javascript;charset=utf-8 access-control-allow-origin * cache-control no-cache, no-store, max-age=0, no-transform, private expires Mon, 03 Aug 2020 14:53:15 GMT
POST H2	200	/ www.facebook.com/tr/	0 30 B	6ms 6ms	Other text/plain	2a03:2880:f11c:8183:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/tr/ Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f11c:8183:face:b00c:0:25de , Ireland, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Content-Type multipart/form-data; boundary=----WebKitFormBoundaryLHNyBuhCATCg1C0h Response headers strict-transport-security max-age=31536000; includeSubDomains server proxygen-bolt date Tue, 04 Aug 2020 14:53:15 GMT status 200 content-type text/plain access-control-allow-origin https://duo.com access-control-allow-credentials true alt-svc h3-29=":443"; ma=3600,h3-27=":443"; ma=3600 content-length 0
GET H2	200	up insight.adsrvr.org/track/ Frame 982F	0 0	110ms 40ms	Document text/html	63.34.37.82 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://insight.adsrvr.org/track/up?adv=xpu82zh&ref=https%3A%2F%2Fduo.com%2Fdecipher%2Fdhs-exposes-chinese-malware-tools&upid=3hrl2vs&upv=1.1.0 Requested by Host: js.adsrvr.org URL: https://js.adsrvr.org/up_loader.1.1.0.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 63.34.37.82 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-63-34-37-82.eu-west-1.compute.amazonaws.com Software / Resource Hash Request headers :method GET :authority insight.adsrvr.org :scheme https :path /track/up?adv=xpu82zh&ref=https%3A%2F%2Fduo.com%2Fdecipher%2Fdhs-exposes-chinese-malware-tools&upid=3hrl2vs&upv=1.1.0 pragma no-cache cache-control no-cache upgrade-insecure-requests 1 user-agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 accept text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 sec-fetch-site cross-site sec-fetch-mode navigate sec-fetch-dest iframe referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools accept-encoding gzip, deflate, br accept-language en-US Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools Response headers status 200 date Tue, 04 Aug 2020 14:53:16 GMT content-type text/html cache-control private,no-cache, must-revalidate pragma no-cache x-aspnet-version 4.0.30319 p3p CP="NOI DSP COR CUR ADMo DEVo PSAo PSDo OUR SAMo BUS UNI NAV"
GET DATA	200 OK	truncated /	1 KB 0		Image image/svg+xml
General Check archive.org Show headers Download Go to Show image Full URL data:truncated Protocol DATA Server -, , ASN (), Reverse DNS Software / Resource Hash 12ae01d498fd998263b555e99880c6838ef6acca33fcd2e1cb12367a99e928f4 Request headers Referer User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers Content-Type image/svg+xml
GET H2	200	ga-audiences www.google.de/ads/ Redirect Chain https://www.google-analytics.com/r/collect?v=1&_v=j83&a=777674357&t=event&ni=1&_s=1&dl=https%3A%2F%2Fduo.com%2Fdecipher%2Fdhs-exposes-chinese-malware-tools&ul=en-us&de=UTF-8&dt=DHS%20Exposes%20Chin... https://stats.g.doubleclick.net/r/collect?v=1&aip=1&t=dc&_r=3&tid=UA-20141016-1&cid=780642895.1596552794&jid=343156780&_gid=995260931.1596552796&gjid=523905897&_v=j83&z=275364221 https://www.google.com/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-20141016-1&cid=780642895.1596552794&jid=343156780&_v=j83&z=275364221 https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-20141016-1&cid=780642895.1596552794&jid=343156780&_v=j83&z=275364221&slf_rd=1&random=3655258068	42 B 106 B	18ms 18ms	Image image/gif	2a00:1450:4001:80b::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-20141016-1&cid=780642895.1596552794&jid=343156780&_v=j83&z=275364221&slf_rd=1&random=3655258068 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80b::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Tue, 04 Aug 2020 14:53:16 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 200 cache-control no-cache, no-store, must-revalidate content-type image/gif alt-svc h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT Redirect headers pragma no-cache date Tue, 04 Aug 2020 14:53:16 GMT x-content-type-options nosniff server cafe p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" status 302 content-type text/html; charset=UTF-8 location https://www.google.de/ads/ga-audiences?v=1&aip=1&t=sr&_r=4&tid=UA-20141016-1&cid=780642895.1596552794&jid=343156780&_v=j83&z=275364221&slf_rd=1&random=3655258068 cache-control no-cache, no-store, must-revalidate timing-allow-origin * alt-svc h3-29=":443"; ma=2592000,h3-27=":443"; ma=2592000,h3-T050=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	u cdn.bizible.com/m/	43 B 145 B	18ms 18ms	Image image/gif	68.232.35.12 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.bizible.com/m/u?mapType=ecid&mapValue=B8D07FF4520E94C10A490D4C%40AdobeOrg_37850053184045920293994448225775035949&_biz_u=e39185dedebf436893bb428886c8026e&_biz_s=6b8701&_biz_l=https%3A%2F%2Fduo.com%2Fdecipher%2Fdhs-exposes-chinese-malware-tools&_biz_t=1596552796053&_biz_i=DHS%20Exposes%20Chinese%20Malware%20Tools%20%7C%20Decipher&_biz_n=1&rnd=906282&cdn_o=a&_biz_z=1596552796054 Protocol H2 Security TLS 1.3, , AES_256_GCM Server 68.232.35.12 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (amb/6BBE) / Resource Hash afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277 Request headers Referer https://duo.com/decipher/dhs-exposes-chinese-malware-tools User-Agent Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36 Response headers pragma no-cache date Tue, 04 Aug 2020 14:53:16 GMT last-modified Fri, 31 Jul 2020 01:06:49 GMT server ECS (amb/6BBE) age 395188 x-cache HIT p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" status 200 cache-control no-cache, no-store accept-ranges bytes content-type Image/GIF content-length 43 expires -1