www.quest.com Open in urlscan Pro
2600:9000:211e:2c00:14:56cf:b500:93a1 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://sharepointwow.msnd36.com/tracking/lc/30f6efbc-5544-472a-b437-ba445f450bfd/de22c13b-33aa-4a89-ab8f-a2ce989e6c9e/80e045f7-d...
Effective URL:
https://www.quest.com/event/tec-talk-abusing-group-policy-for-fun-and-profit-/?utm_source=eloqua10&utm_medium=direct-e...
Submission: On November 13 via api (November 13th 2023, 4:35:30 pm UTC) from US — Scanned from NL

Summary HTTP 84 Redirects Links 32 Behaviour Indicators

Summary

This website contacted 21 IPs in 4 countries across 17 domains to perform 84 HTTP transactions. The main IP is 2600:9000:211e:2c00:14:56cf:b500:93a1, located in United States and belongs to AMAZON-02, US. The main domain is www.quest.com. The Cisco Umbrella rank of the primary domain is 198905.
TLS certificate: Issued by Sectigo RSA Organization Validation S... on July 11th 2023. Valid for: a year.

This is the only time www.quest.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 1	212.32.243.39 212.32.243.39	60781 (LEASEWEB-...) (LEASEWEB-NL-AMS-01 Netherlands)
29	2600:9000:211... 2600:9000:211e:2c00:14:56cf:b500:93a1	16509 (AMAZON-02) (AMAZON-02)
11	2606:4700::68... 2606:4700::6812:83ec	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	65.9.95.98 65.9.95.98	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:811::2008	15169 (GOOGLE) (GOOGLE)
7	34.96.102.137 34.96.102.137	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
3	172.64.150.44 172.64.150.44	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:440... 2606:4700:4400::ac40:9b77	13335 (CLOUDFLAR...) (CLOUDFLARENET)
5	2a00:1450:400... 2a00:1450:4001:82a::2004	15169 (GOOGLE) (GOOGLE)
1	23.22.90.252 23.22.90.252	14618 (AMAZON-AES) (AMAZON-AES)
3	2001:4860:480... 2001:4860:4802:36::178	15169 (GOOGLE) (GOOGLE)
4	2a00:1450:400... 2a00:1450:4001:811::2003	15169 (GOOGLE) (GOOGLE)
1	23.201.242.231 23.201.242.231	16625 (AKAMAI-AS) (AKAMAI-AS)
3	2001:4860:480... 2001:4860:4802:34::36	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:400c:c0b::9d	15169 (GOOGLE) (GOOGLE)
2	2a00:1450:400... 2a00:1450:4001:800::2003	15169 (GOOGLE) (GOOGLE)
1 3	147.154.41.192 147.154.41.192	31898 (ORACLE-BM...) (ORACLE-BMC-31898)
2	2606:4700::68... 2606:4700::6810:880f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	13.32.27.69 13.32.27.69	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:831::2003	15169 (GOOGLE) (GOOGLE)
1	52.222.236.63 52.222.236.63	16509 (AMAZON-02) (AMAZON-02)
84	21

1 212.32.243.39 (Netherlands) 1 redirects

ASN60781 (LEASEWEB-NL-AMS-01 Netherlands, NL)

sharepointwow.msnd36.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

29 2600:9000:211e:2c00:14:56cf:b500:93a1 (United States)

ASN16509 (AMAZON-02, US)

www.quest.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

11 2606:4700::6812:83ec (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.cookielaw.org	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 65.9.95.98 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-65-9-95-98.prg50.r.cloudfront.net

static.oktopost.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:811::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 34.96.102.137 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 137.102.96.34.bc.googleusercontent.com

dev.visualwebsiteoptimizer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.64.150.44 (United States)

ASN13335 (CLOUDFLARENET, US)

js.zi-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:9b77 (United States)

ASN13335 (CLOUDFLARENET, US)

geolocation.onetrust.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 2a00:1450:4001:82a::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.22.90.252 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-23-22-90-252.compute-1.amazonaws.com

okt.to	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2001:4860:4802:36::178 (United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:811::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 23.201.242.231 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a23-201-242-231.deploy.static.akamaitechnologies.com

img04.en25.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2001:4860:4802:34::36 (United States)

ASN15169 (GOOGLE, US)

region1.analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c0b::9d (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:800::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.nl	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 147.154.41.192 (Ashburn, United States) 1 redirects

ASN31898 (ORACLE-BMC-31898, US)

eloqua.quest.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:880f (United States)

ASN13335 (CLOUDFLARENET, US)

ws-assets.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
ws.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.32.27.69 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-27-69.fra56.r.cloudfront.net

scripts.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:831::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.222.236.63 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-52-222-236-63.fra56.r.cloudfront.net

api.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
32	quest.com 1 redirects www.quest.com — Cisco Umbrella Rank: 198905 eloqua.quest.com — Cisco Umbrella Rank: 827425	563 KB
11	cookielaw.org cdn.cookielaw.org — Cisco Umbrella Rank: 342	173 KB
8	google.com www.google.com — Cisco Umbrella Rank: 2 region1.analytics.google.com — Cisco Umbrella Rank: 3040	56 KB
7	visualwebsiteoptimizer.com dev.visualwebsiteoptimizer.com — Cisco Umbrella Rank: 2958	125 KB
6	gstatic.com www.gstatic.com fonts.gstatic.com	432 KB
3	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 27	21 KB
3	zi-scripts.com js.zi-scripts.com — Cisco Umbrella Rank: 9225	3 KB
2	demandbase.com scripts.demandbase.com — Cisco Umbrella Rank: 9807 api.demandbase.com — Cisco Umbrella Rank: 10602	4 KB
2	zoominfo.com ws-assets.zoominfo.com — Cisco Umbrella Rank: 15113 ws.zoominfo.com — Cisco Umbrella Rank: 4272	27 KB
2	google.nl www.google.nl — Cisco Umbrella Rank: 10244	515 B
2	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 78	395 B
2	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 35	188 KB
1	en25.com img04.en25.com — Cisco Umbrella Rank: 20319	6 KB
1	okt.to okt.to — Cisco Umbrella Rank: 29607	100 B
1	onetrust.com geolocation.onetrust.com — Cisco Umbrella Rank: 590	295 B
1	oktopost.com static.oktopost.com — Cisco Umbrella Rank: 36317	4 KB
1	msnd36.com 1 redirects sharepointwow.msnd36.com	881 B
84	17

	Domain	Requested by
29	www.quest.com	www.quest.com
11	cdn.cookielaw.org	www.quest.com cdn.cookielaw.org
7	dev.visualwebsiteoptimizer.com	www.quest.com dev.visualwebsiteoptimizer.com
5	www.google.com	www.quest.com www.gstatic.com www.google.com
4	www.gstatic.com	www.google.com www.gstatic.com
3	eloqua.quest.com	1 redirects www.quest.com
3	region1.analytics.google.com	www.googletagmanager.com
3	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com www.quest.com
3	js.zi-scripts.com	www.quest.com js.zi-scripts.com
2	fonts.gstatic.com	www.google.com
2	www.google.nl	www.quest.com
2	stats.g.doubleclick.net	www.googletagmanager.com www.google-analytics.com
2	www.googletagmanager.com	www.quest.com www.googletagmanager.com
1	api.demandbase.com	www.quest.com
1	scripts.demandbase.com	www.quest.com
1	ws.zoominfo.com	ws-assets.zoominfo.com
1	ws-assets.zoominfo.com	js.zi-scripts.com
1	img04.en25.com	www.quest.com
1	okt.to	static.oktopost.com
1	geolocation.onetrust.com	cdn.cookielaw.org
1	static.oktopost.com	www.quest.com
1	sharepointwow.msnd36.com	1 redirects
84	22

This site contains links to these domains. Also see Links.

Domain
blog.quest.com
www.itninja.com
blog.toadworld.com
shop.quest.com
www.erwin.com
www.binarytree.com
www.quadrotech-it.com
www.oneidentity.com
support.quest.com
partners.quest.com
policies.google.com
www.linkedin.com
twitter.com
www.facebook.com
www.youtube.com
www.onetrust.com

Subject Issuer	Validity	Valid
*.quest.com Sectigo RSA Organization Validation Secure Server CA	`2023-07-11` - `2024-07-10`	a year	crt.sh
cookielaw.org Cloudflare Inc ECC CA-3	`2023-04-01` - `2024-03-31`	a year	crt.sh
*.oktopost.com Amazon RSA 2048 M01	`2023-08-29` - `2024-09-26`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2023-10-16` - `2024-01-08`	3 months	crt.sh
*.visualwebsiteoptimizer.com Starfield Secure Certificate Authority - G2	`2023-07-06` - `2024-07-06`	a year	crt.sh
zi-scripts.com GTS CA 1P5	`2023-10-04` - `2024-01-02`	3 months	crt.sh
onetrust.com Cloudflare Inc ECC CA-3	`2023-11-13` - `2024-11-12`	a year	crt.sh
www.google.com GTS CA 1C3	`2023-10-16` - `2024-01-08`	3 months	crt.sh
okt.to R3	`2023-10-07` - `2024-01-05`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2023-10-16` - `2024-01-08`	3 months	crt.sh
*.en25.com DigiCert TLS RSA SHA256 2020 CA1	`2023-05-21` - `2024-05-20`	a year	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2023-10-16` - `2024-01-08`	3 months	crt.sh
*.google.nl GTS CA 1C3	`2023-10-16` - `2024-01-08`	3 months	crt.sh
eloqua.quest.com Sectigo RSA Organization Validation Secure Server CA	`2023-09-15` - `2024-09-14`	a year	crt.sh
*.google.com GTS CA 1C3	`2023-10-16` - `2024-01-08`	3 months	crt.sh
zoominfo.com Cloudflare Inc ECC CA-3	`2023-04-04` - `2024-04-03`	a year	crt.sh
tag.demandbase.com Go Daddy Secure Certificate Authority - G2	`2023-08-23` - `2024-09-23`	a year	crt.sh
api.demandbase.com Go Daddy Secure Certificate Authority - G2	`2023-09-27` - `2024-09-26`	a year	crt.sh

This page contains 2 frames:

Primary Page: https://www.quest.com/event/tec-talk-abusing-group-policy-for-fun-and-profit-/?utm_source=eloqua10&utm_medium=direct-email&utm_campaign=ecard-83906-77941-5&utm_term=&utm_content=email_ecard&utm_source=share_point_wow&utm_medium=Direct-3rd%20Party%20Vendor&utm_campaign=FY2024_Q4_All_TEC_Talk_Series_AbusingGPO_SPWoW_12723&utm_term=&utm_content=email_ecard
Frame ID: A642DBD74E426E7680BE3E13D8032A2F
Requests: 74 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lcc7R8nAAAAAAFeO6kK-jyFD_FpG7szmyfvO46t&co=aHR0cHM6Ly93d3cucXVlc3QuY29tOjQ0Mw..&hl=nl&v=fGZmEzpfeSeqDJiApS_XZ4Y2&size=invisible&cb=fn6y8p8jnuyc
Frame ID: F4A08F1A2774A088E60A444182B32C5E
Requests: 8 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Identify and Counteract Group Policy Attackerstriangle-downcheckBack ButtonSearch IconFilter Icon

Page URL History Show full URLs

https://sharepointwow.msnd36.com/tracking/lc/30f6efbc-5544-472a-b437-ba445f450bfd/de22c13b-33aa-4a89-ab8f-a2c... HTTP 302
https://www.quest.com/event/tec-talk-abusing-group-policy-for-fun-and-profit-/?utm_source=eloqua10... Page URL

Detected technologies

Bootstrap (Web Frameworks) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]*?bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.css

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

OneTrust (Cookie compliance) Expand

Overall confidence: 100%
Detected patterns

cdn\.cookielaw\.org
otSDKStub\.js

VWO (Analytics) Expand

Overall confidence: 100%
Detected patterns

dev\.visualwebsiteoptimizer\.com/?([\d.]+)

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

reCAPTCHA (Captchas) Expand

Overall confidence: 100%
Detected patterns

/recaptcha/api\.js

Page Statistics

84
Requests

98 %
HTTPS

57 %
IPv6

17
Domains

22
Subdomains

21
IPs

4
Countries

1603 kB
Transfer

4507 kB
Size

25
Cookies

32 Outgoing links

These are links going to different origins than the main page.

URL: https://blog.quest.com/
Title: IT Industry Insights

Search URL Search Domain Scan URL

URL: https://www.itninja.com/blog
Title: IT Ninja

Search URL Search Domain Scan URL

URL: https://blog.toadworld.com/
Title: Toad World Blog

Search URL Search Domain Scan URL

URL: https://shop.quest.com/682/purl-quest-buy-home?x-adcode=NAV

Search URL Search Domain Scan URL

URL: https://www.erwin.com/
Title: Data Governance

Search URL Search Domain Scan URL

URL: https://www.erwin.com/products/erwin-data-modeler/
Title: erwin Data Modeler

Search URL Search Domain Scan URL

URL: https://www.erwin.com/products/erwin-data-intelligence/
Title: erwin Data Intelligence

Search URL Search Domain Scan URL

URL: https://www.erwin.com/products/erwin-evolve/
Title: erwin Evolve

Search URL Search Domain Scan URL

URL: https://www.erwin.com/products/
Title: View All

Search URL Search Domain Scan URL

URL: https://www.binarytree.com/products/binary-tree-migrator-pro-for-active-directory/
Title: Migrator Pro

Search URL Search Domain Scan URL

URL: https://www.quadrotech-it.com/products/quadrotech-pst-flight-deck/
Title: PST Flight Deck

Search URL Search Domain Scan URL

URL: https://www.quadrotech-it.com/products/quadrotech-archive-shuttle/
Title: Archive Shuttle

Search URL Search Domain Scan URL

URL: https://www.oneidentity.com/products/
Title: Unified Identity Security

Search URL Search Domain Scan URL

URL: https://www.oneidentity.com/products/identity-manager/
Title: Identity Manager

Search URL Search Domain Scan URL

URL: https://www.oneidentity.com/one-identity-safeguard/
Title: One Identity Safeguard

Search URL Search Domain Scan URL

URL: https://www.oneidentity.com/products/active-roles/
Title: Active Roles

Search URL Search Domain Scan URL

URL: https://www.oneidentity.com/products/authentication-services/
Title: Authentication Services

Search URL Search Domain Scan URL

URL: https://www.oneidentity.com/products/password-manager/
Title: Password Manager

Search URL Search Domain Scan URL

URL: https://www.oneidentity.com/solutions/
Title: Improve your cybersecurity posture Achieve identity-centric cybersecurity to protect the people, applications and data that are essential to business

Search URL Search Domain Scan URL

URL: https://support.quest.com/
Title: Support Portal

Search URL Search Domain Scan URL

URL: https://support.quest.com/contact-support/
Title: Contact Support

Search URL Search Domain Scan URL

URL: https://partners.quest.com/English/
Title: Partner Program

Search URL Search Domain Scan URL

URL: https://partners.quest.com/auth/oauth/v2/login.ashx
Title: Partner Portal Login

Search URL Search Domain Scan URL

URL: https://partners.quest.com/en-US/directory/search?type=msp
Title: Partner Locator

Search URL Search Domain Scan URL

URL: https://policies.google.com/privacy
Title: Privacy Policy

Search URL Search Domain Scan URL

URL: https://policies.google.com/terms
Title: Terms of Use

Search URL Search Domain Scan URL

URL: https://support.quest.com/contact-us/licensing/
Title: Licensing Assistance

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/quest-software

Search URL Search Domain Scan URL

URL: https://twitter.com/quest

Search URL Search Domain Scan URL

URL: https://www.facebook.com/questsoftware

Search URL Search Domain Scan URL

URL: https://www.youtube.com/user/questsoftware

Search URL Search Domain Scan URL

URL: https://www.onetrust.com/products/cookie-consent/

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://sharepointwow.msnd36.com/tracking/lc/30f6efbc-5544-472a-b437-ba445f450bfd/de22c13b-33aa-4a89-ab8f-a2ce989e6c9e/80e045f7-d43f-4478-845a-c799bcf9926f/ HTTP 302
https://www.quest.com/event/tec-talk-abusing-group-policy-for-fun-and-profit-/?utm_source=eloqua10&utm_medium=direct-email&utm_campaign=ecard-83906-77941-5&utm_term=&utm_content=email_ecard&utm_source=share_point_wow&utm_medium=Direct-3rd%20Party%20Vendor&utm_campaign=FY2024_Q4_All_TEC_Talk_Series_AbusingGPO_SPWoW_12723&utm_term=&utm_content=email_ecard Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 60

https://eloqua.quest.com/visitor/v200/svrGP?pps=50&siteid=1009272243&DLKey=9d29a2c2bdb94806b66d0347e569cc6d&DLLookup=&ms=57&firstPartyCookieDomain=eloqua.quest.com HTTP 302
https://eloqua.quest.com/visitor/v200/svrGP?pps=50&siteid=1009272243&DLKey=9d29a2c2bdb94806b66d0347e569cc6d&DLLookup=&ms=57&elq1pcGUID=3AF93E25CE364FCCBE5CDF5E079EA6F7

84 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request / Show response
www.quest.com/event/tec-talk-abusing-group-policy-for-fun-and-profit-/
Redirect Chain

https://sharepointwow.msnd36.com/tracking/lc/30f6efbc-5544-472a-b437-ba445f450bfd/de22c13b-33aa-4a89-ab8f-a2ce989e6c9e/80e045f7-d43f-4478-845a-c799bcf9926f/
https://www.quest.com/event/tec-talk-abusing-group-policy-for-fun-and-profit-/?utm_source=eloqua10&utm_medium=direct-email&utm_campaign=ecard-83906-77941-5&utm_term=&utm_content=email_ecard&utm_sou...

164 KB
23 KB

944ms
844ms

Document
text/html

2600:9000:211e:2c00:14:56cf:b500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.quest.com/event/tec-talk-abusing-group-policy-for-fun-and-profit-/?utm_source=eloqua10&utm_medium=direct-email&utm_campaign=ecard-83906-77941-5&utm_term=&utm_content=email_ecard&utm_source=share_point_wow&utm_medium=Direct-3rd%20Party%20Vendor&utm_campaign=FY2024_Q4_All_TEC_Talk_Series_AbusingGPO_SPWoW_12723&utm_term=&utm_content=email_ecard

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:211e:2c00:14:56cf:b500:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

bbddcbb1662b13184f00cbaea3d7a200b22c4318bd8f7c99b09e314709e10bfa

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

cache-control: no-cache, no-store, must-revalidate
content-encoding: br
content-security-policy: upgrade-insecure-requests
content-type: text/html; charset=utf-8
date: Mon, 13 Nov 2023 16:35:23 GMT
expires: Mon, 13 Nov 2023 16:35:23 GMT
last-modified: Mon, 13 Nov 2023 16:35:23 GMT
permissions-policy: camera=(), microphone=(), payment=()
referrer-policy: strict-origin-when-cross-origin
server
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding,Cookie,User-Agent,CloudFront-Is-Android-Viewer,CloudFront-Is-Desktop-Viewer,CloudFront-Is-IOS-Viewer,CloudFront-Is-Mobile-Viewer,CloudFront-Is-SmartTV-Viewer,CloudFront-Is-Tablet-Viewer,CloudFront-Viewer-Country,Host,Referer
via: 1.1 c1e2423613b2dcb4230386a2b285734e.cloudfront.net (CloudFront)
x-amz-cf-id: VmwKaamdV6UOJL0EqichFIZwSuan2cCAFePAwoaxtU4o63OSuuBPxA==
x-amz-cf-pop: FRA56-C2
x-aspnet-version: 4.0.30319
x-cache: Miss from cloudfront
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: None
x-ua-compatible: IE=edge,chrome=1

Redirect headers

Access-Control-Allow-Headers: Content-Type
Access-Control-Allow-Methods: GET, POST, PUT, DELETE, PATCH, OPTIONS, HEAD
Access-Control-Allow-Origin: *
Access-Control-Max-Age: 600
Content-Length: 0
Date: Mon, 13 Nov 2023 16:35:23 GMT
Location: https://www.quest.com/event/tec-talk-abusing-group-policy-for-fun-and-profit-/?utm_source=eloqua10&utm_medium=direct-email&utm_campaign=ecard-83906-77941-5&utm_term=&utm_content=email_ecard&utm_source=share_point_wow&utm_medium=Direct-3rd%20Party%20Vendor&utm_campaign=FY2024_Q4_All_TEC_Talk_Series_AbusingGPO_SPWoW_12723&utm_term=&utm_content=email_ecard
Referrer-Policy: no-referrer
Server: Kestrel
Strict-Transport-Security: max-age=31536000; includeSubDomains
Vary: Accept
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-Permitted-Cross-Domain-Policies: none
X-XSS-Protection: 1; mode=block

GET
H2 200 cssquest
www.quest.com/static/bundles/ 292 KB
51 KB 22ms
21ms Stylesheet
text/css 2600:9000:211e:2c00:14:56cf:b500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.quest.com/static/bundles/cssquest?v=fnMNQBb8bXCn57VdzZ_Sh1QxyCDACaoVRzd96-93tGU1

Requested by

Host: www.quest.com
URL: https://www.quest.com/event/tec-talk-abusing-group-policy-for-fun-and-profit-/?utm_source=eloqua10&utm_medium=direct-email&utm_campaign=ecard-83906-77941-5&utm_term=&utm_content=email_ecard&utm_source=share_point_wow&utm_medium=Direct-3rd%20Party%20Vendor&utm_campaign=FY2024_Q4_All_TEC_Talk_Series_AbusingGPO_SPWoW_12723&utm_term=&utm_content=email_ecard

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:211e:2c00:14:56cf:b500:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

aedebd36988d261171d6556a9a007e2ef93492015830be8ff215492da6139850

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/event/tec-talk-abusing-group-policy-for-fun-and-profit-/?utm_source=eloqua10&utm_medium=direct-email&utm_campaign=ecard-83906-77941-5&utm_term=&utm_content=email_ecard&utm_source=share_point_wow&utm_medium=Direct-3rd%20Party%20Vendor&utm_campaign=FY2024_Q4_All_TEC_Talk_Series_AbusingGPO_SPWoW_12723&utm_term=&utm_content=email_ecard
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
date: Sat, 11 Nov 2023 01:23:33 GMT
content-encoding: gzip
x-permitted-cross-domain-policies: None
x-aspnet-version: 4.0.30319
via: 1.1 c1e2423613b2dcb4230386a2b285734e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C2
age: 227510
x-cache: Hit from cloudfront
x-ua-compatible: IE=edge,chrome=1
referrer-policy: strict-origin-when-cross-origin
last-modified: Sat, 11 Nov 2023 01:23:34 GMT
server
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css; charset=utf-8
cache-control: max-age=604800, s-maxage=5184000
permissions-policy: camera=(), microphone=(), payment=()
x-amz-cf-id: m0IxXrHqPTL6HB5_AE1y07ssmZbflGq7dCS58JbigkAlNigkdAwUCw==
expires: Sun, 10 Nov 2024 01:23:34 GMT

GET
H2 200 jsquest Show response
www.quest.com/static/bundles/ 470 KB
137 KB 22ms
22ms Script
text/javascript 2600:9000:211e:2c00:14:56cf:b500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.quest.com/static/bundles/jsquest?v=A_3VHy20cYkljM8kEHFAwmaPmbscoKdkhHW1b2Aa-4Q1

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:211e:2c00:14:56cf:b500:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

38a1b2e70e11dedc8b68368e3edbdcaac7bb7b1eb5772844adbe5f61f5b1ce1c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/event/tec-talk-abusing-group-policy-for-fun-and-profit-/?utm_source=eloqua10&utm_medium=direct-email&utm_campaign=ecard-83906-77941-5&utm_term=&utm_content=email_ecard&utm_source=share_point_wow&utm_medium=Direct-3rd%20Party%20Vendor&utm_campaign=FY2024_Q4_All_TEC_Talk_Series_AbusingGPO_SPWoW_12723&utm_term=&utm_content=email_ecard
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
date: Sat, 11 Nov 2023 01:23:34 GMT
content-encoding: gzip
x-permitted-cross-domain-policies: None
x-aspnet-version: 4.0.30319
via: 1.1 c1e2423613b2dcb4230386a2b285734e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C2
age: 227509
x-cache: Hit from cloudfront
x-ua-compatible: IE=edge,chrome=1
referrer-policy: strict-origin-when-cross-origin
last-modified: Sat, 11 Nov 2023 01:23:34 GMT
server
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/javascript; charset=utf-8
cache-control: max-age=604800, s-maxage=5184000
permissions-policy: camera=(), microphone=(), payment=()
x-amz-cf-id: w0YH6OpJjAKJuqIwODCUD1EBLWEZJJwC5KSPU3XxcLaS4oYhIXYkaQ==
expires: Sun, 10 Nov 2024 01:23:34 GMT

GET
H2 200 OtAutoBlock.js Show response
cdn.cookielaw.org/consent/e57654ce-cc55-4c0e-8ea5-4c3fe25a8902/ 75 KB
11 KB 79ms
36ms Script
application/x-javascript 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/e57654ce-cc55-4c0e-8ea5-4c3fe25a8902/OtAutoBlock.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6bffdf625fd550bff5346031cd658873315c5de1a71bc31e422ba2c48b15924a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 13 Nov 2023 16:35:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 31233
content-md5: avhXoAVbwOlrGe7qcL6VVg==
content-length: 10725
x-ms-lease-status: unlocked
last-modified: Tue, 31 Oct 2023 20:49:18 GMT
server: cloudflare
etag: 0x8DBDA52D9FEEAF5
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: f1f26ce0-301e-009d-4fea-11cb39000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 82586d7e687892a1-FRA
expires: Tue, 14 Nov 2023 16:35:24 GMT

GET
H2 200 otSDKStub.js Show response
cdn.cookielaw.org/scripttemplates/ 21 KB
7 KB 72ms
29ms Script
application/javascript 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6b1fc966c38b12c845f9fd8bdb76027106b776783fd44eeed917663942b5fd16

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 13 Nov 2023 16:35:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: R1P6TtSHAQZyvOSI/KawHw==
age: 38477
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 6821
x-ms-lease-status: unlocked
last-modified: Thu, 09 Nov 2023 14:41:49 GMT
server: cloudflare
etag: 0x8DBE13201873ECE
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 615f4d5d-701e-0057-437a-1397b0000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 82586d7e687792a1-FRA

GET
H2 200 NotoSans-Bold.woff2
www.quest.com/fonts/ 20 KB
20 KB 467ms
466ms Font
application/font-woff2 2600:9000:211e:2c00:14:56cf:b500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.quest.com/fonts/NotoSans-Bold.woff2
Requested by: Host: www.quest.com
URL: https://www.quest.com/event/tec-talk-abusing-group-policy-for-fun-and-profit-/?utm_source=eloqua10&utm_medium=direct-email&utm_campaign=ecard-83906-77941-5&utm_term=&utm_content=email_ecard&utm_source=share_point_wow&utm_medium=Direct-3rd%20Party%20Vendor&utm_campaign=FY2024_Q4_All_TEC_Talk_Series_AbusingGPO_SPWoW_12723&utm_term=&utm_content=email_ecard
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:2c00:14:56cf:b500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 7e59fa377da48ee63c13d7cdf7562615936e6d23a79b7d39db24bca08185bd23

Request headers

Referer: https://www.quest.com/event/tec-talk-abusing-group-policy-for-fun-and-profit-/?utm_source=eloqua10&utm_medium=direct-email&utm_campaign=ecard-83906-77941-5&utm_term=&utm_content=email_ecard&utm_source=share_point_wow&utm_medium=Direct-3rd%20Party%20Vendor&utm_campaign=FY2024_Q4_All_TEC_Talk_Series_AbusingGPO_SPWoW_12723&utm_term=&utm_content=email_ecard
Origin: https://www.quest.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Mon, 13 Nov 2023 16:35:23 GMT
via: 1.1 c1e2423613b2dcb4230386a2b285734e.cloudfront.net (CloudFront)
last-modified: Sat, 11 Nov 2023 00:18:24 GMT
server: Microsoft-IIS/10.0
x-amz-cf-pop: FRA56-C2
etag: "08881953414da1:0"
x-powered-by: ASP.NET
x-cache: Miss from cloudfront
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
content-length: 20380
x-amz-cf-id: TfyNcjg-dMNXw61vzr3lRxU1uRsx1deFXT0aPCVPp3QDs0xwKlkHYA==

GET
H2 200 NotoSans-Regular.woff2
www.quest.com/fonts/ 20 KB
21 KB 467ms
466ms Font
application/font-woff2 2600:9000:211e:2c00:14:56cf:b500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://www.quest.com/fonts/NotoSans-Regular.woff2
Requested by: Host: www.quest.com
URL: https://www.quest.com/event/tec-talk-abusing-group-policy-for-fun-and-profit-/?utm_source=eloqua10&utm_medium=direct-email&utm_campaign=ecard-83906-77941-5&utm_term=&utm_content=email_ecard&utm_source=share_point_wow&utm_medium=Direct-3rd%20Party%20Vendor&utm_campaign=FY2024_Q4_All_TEC_Talk_Series_AbusingGPO_SPWoW_12723&utm_term=&utm_content=email_ecard
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:211e:2c00:14:56cf:b500:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 8a97f240d4dd9e15bca1452da19e61acb55e38a7d1f2793251966c5d8630d42e

Request headers

Referer: https://www.quest.com/event/tec-talk-abusing-group-policy-for-fun-and-profit-/?utm_source=eloqua10&utm_medium=direct-email&utm_campaign=ecard-83906-77941-5&utm_term=&utm_content=email_ecard&utm_source=share_point_wow&utm_medium=Direct-3rd%20Party%20Vendor&utm_campaign=FY2024_Q4_All_TEC_Talk_Series_AbusingGPO_SPWoW_12723&utm_term=&utm_content=email_ecard
Origin: https://www.quest.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Mon, 13 Nov 2023 16:35:23 GMT
via: 1.1 c1e2423613b2dcb4230386a2b285734e.cloudfront.net (CloudFront)
last-modified: Sat, 11 Nov 2023 00:18:24 GMT
server: Microsoft-IIS/10.0
x-amz-cf-pop: FRA56-C2
etag: "08881953414da1:0"
x-powered-by: ASP.NET
x-cache: Miss from cloudfront
content-type: application/font-woff2
access-control-allow-origin: *
cache-control: max-age=14400
accept-ranges: bytes
content-length: 20620
x-amz-cf-id: mKVkdkQtLTEwWwmZTP5_68r4O4_2p0jCrTfavv-joWv1TIeebd7-NQ==

GET
H2 200 icomoon.woff2
www.quest.com/static/css/icomoon/fonts/ 78 KB
79 KB 27ms
26ms Font
application/font-woff2 2600:9000:211e:2c00:14:56cf:b500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.quest.com/static/css/icomoon/fonts/icomoon.woff2?01102023

Requested by

Host: www.quest.com
URL: https://www.quest.com/static/bundles/cssquest?v=fnMNQBb8bXCn57VdzZ_Sh1QxyCDACaoVRzd96-93tGU1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:211e:2c00:14:56cf:b500:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

7586b3b324be0c43f20efefbd4f77808c33a3e6bc96628ce2555236a44a2a3c7

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.quest.com/static/bundles/cssquest?v=fnMNQBb8bXCn57VdzZ_Sh1QxyCDACaoVRzd96-93tGU1
Origin: https://www.quest.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
date: Sat, 11 Nov 2023 01:23:34 GMT
via: 1.1 c1e2423613b2dcb4230386a2b285734e.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: None
x-amz-cf-pop: FRA56-C2
age: 227509
x-cache: Hit from cloudfront
content-length: 79840
x-ua-compatible: IE=edge,chrome=1
referrer-policy: strict-origin-when-cross-origin
last-modified: Sat, 11 Nov 2023 00:18:16 GMT
server
etag: "0d4bc903414da1:0"
x-frame-options: SAMEORIGIN
content-type: application/font-woff2
cache-control: max-age=14400, s-maxage=5184000
permissions-policy: camera=(), microphone=(), payment=()
accept-ranges: bytes
x-amz-cf-id: g1PYYO3-uVXJGtqMYfrk7oSD7PDADYvfhc-Eq_we2JUtNG2NcSoxsg==

GET
H2 200 header-footer.min.css
www.quest.com/static/css/v3/ 64 KB
8 KB 24ms
23ms Stylesheet
text/css 2600:9000:211e:2c00:14:56cf:b500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.quest.com/static/css/v3/header-footer.min.css?06012023

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:211e:2c00:14:56cf:b500:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

8ab6beaf3bad6beda71e7f3224691a978ab47f93b96191316982ddbed78f3994

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/event/tec-talk-abusing-group-policy-for-fun-and-profit-/?utm_source=eloqua10&utm_medium=direct-email&utm_campaign=ecard-83906-77941-5&utm_term=&utm_content=email_ecard&utm_source=share_point_wow&utm_medium=Direct-3rd%20Party%20Vendor&utm_campaign=FY2024_Q4_All_TEC_Talk_Series_AbusingGPO_SPWoW_12723&utm_term=&utm_content=email_ecard
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
date: Sat, 11 Nov 2023 01:23:34 GMT
content-encoding: gzip
x-permitted-cross-domain-policies: None
via: 1.1 c1e2423613b2dcb4230386a2b285734e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C2
age: 227509
x-cache: Hit from cloudfront
x-ua-compatible: IE=edge,chrome=1
referrer-policy: strict-origin-when-cross-origin
last-modified: Sat, 11 Nov 2023 00:18:14 GMT
server
etag: W/"0a78b8f3414da1:0"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=604800, s-maxage=5184000
permissions-policy: camera=(), microphone=(), payment=()
x-amz-cf-id: I_MGyAKnfLkj0ggroygfG-gtb7et_Oj90MrLvsZIDnP5daNJdJ5fbg==

GET
H2 200 header-footer.min.js Show response
www.quest.com/static/js/v3/ 8 KB
3 KB 27ms
26ms Script
application/javascript 2600:9000:211e:2c00:14:56cf:b500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.quest.com/static/js/v3/header-footer.min.js?06012023

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:211e:2c00:14:56cf:b500:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

1870049904b76677e993e47ea99edd2469da9cf297d08d5e5d76ee1bbe44041c

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/event/tec-talk-abusing-group-policy-for-fun-and-profit-/?utm_source=eloqua10&utm_medium=direct-email&utm_campaign=ecard-83906-77941-5&utm_term=&utm_content=email_ecard&utm_source=share_point_wow&utm_medium=Direct-3rd%20Party%20Vendor&utm_campaign=FY2024_Q4_All_TEC_Talk_Series_AbusingGPO_SPWoW_12723&utm_term=&utm_content=email_ecard
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
date: Sat, 11 Nov 2023 01:23:34 GMT
content-encoding: gzip
x-permitted-cross-domain-policies: None
via: 1.1 c1e2423613b2dcb4230386a2b285734e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C2
age: 227509
x-cache: Hit from cloudfront
x-ua-compatible: IE=edge,chrome=1
referrer-policy: strict-origin-when-cross-origin
last-modified: Sat, 11 Nov 2023 00:18:16 GMT
server
etag: W/"0d4bc903414da1:0"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800, s-maxage=5184000
permissions-policy: camera=(), microphone=(), payment=()
x-amz-cf-id: atHJvoWqJdRo54Rwf8P9tw-oYIo3ynAEs3P81eLPdJJe8wgHwOujVQ==

GET
H2 200 reghandler.min.js Show response
www.quest.com/viewscripts/ 24 KB
8 KB 30ms
28ms Script
application/javascript 2600:9000:211e:2c00:14:56cf:b500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.quest.com/viewscripts/reghandler.min.js?202311100718

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:211e:2c00:14:56cf:b500:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

183d12345b8b0d6e43da6af21a2304cda143c2f606930fce76cbaa9744d5690a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/event/tec-talk-abusing-group-policy-for-fun-and-profit-/?utm_source=eloqua10&utm_medium=direct-email&utm_campaign=ecard-83906-77941-5&utm_term=&utm_content=email_ecard&utm_source=share_point_wow&utm_medium=Direct-3rd%20Party%20Vendor&utm_campaign=FY2024_Q4_All_TEC_Talk_Series_AbusingGPO_SPWoW_12723&utm_term=&utm_content=email_ecard
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
date: Sat, 11 Nov 2023 02:28:42 GMT
content-encoding: gzip
x-permitted-cross-domain-policies: None
via: 1.1 c1e2423613b2dcb4230386a2b285734e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C2
age: 223601
x-cache: Hit from cloudfront
x-ua-compatible: IE=edge,chrome=1
referrer-policy: strict-origin-when-cross-origin
last-modified: Sat, 11 Nov 2023 00:18:24 GMT
server
etag: W/"08881953414da1:0"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800, s-maxage=5184000
permissions-policy: camera=(), microphone=(), payment=()
x-amz-cf-id: mt5P9gnQ741bqefCTxm-RGj8Mx9yts-SscqQHSUqpCdKuHb_bqfA2A==

GET
H2 200 reghandler.min.css
www.quest.com/static/css/form/ 33 KB
7 KB 24ms
24ms Stylesheet
text/css 2600:9000:211e:2c00:14:56cf:b500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.quest.com/static/css/form/reghandler.min.css?202311100718

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:211e:2c00:14:56cf:b500:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

0d53f77fff1259a2dfb79a2bf591c6d2d6ed83b1c3a641f870b95b2d63c5815a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/event/tec-talk-abusing-group-policy-for-fun-and-profit-/?utm_source=eloqua10&utm_medium=direct-email&utm_campaign=ecard-83906-77941-5&utm_term=&utm_content=email_ecard&utm_source=share_point_wow&utm_medium=Direct-3rd%20Party%20Vendor&utm_campaign=FY2024_Q4_All_TEC_Talk_Series_AbusingGPO_SPWoW_12723&utm_term=&utm_content=email_ecard
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
date: Sat, 11 Nov 2023 01:23:35 GMT
content-encoding: gzip
x-permitted-cross-domain-policies: None
via: 1.1 c1e2423613b2dcb4230386a2b285734e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C2
age: 227508
x-cache: Hit from cloudfront
x-ua-compatible: IE=edge,chrome=1
referrer-policy: strict-origin-when-cross-origin
last-modified: Sat, 11 Nov 2023 00:18:14 GMT
server
etag: W/"0a78b8f3414da1:0"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/css
cache-control: max-age=604800, s-maxage=5184000
permissions-policy: camera=(), microphone=(), payment=()
x-amz-cf-id: iFvOOxNA1sW4NR-KVT_VLVPRhyMoZty72SWYk0huj_hIdmRc5ruagA==

GET
H2 200 zoominfo.min.js Show response
www.quest.com/viewscripts/ 871 B
1 KB 24ms
23ms Script
application/javascript 2600:9000:211e:2c00:14:56cf:b500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.quest.com/viewscripts/zoominfo.min.js?202311100718

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:211e:2c00:14:56cf:b500:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

c75e7d6a05ce5c317f889eea71b543604642361219ea01da129d84c1f481aa87

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/event/tec-talk-abusing-group-policy-for-fun-and-profit-/?utm_source=eloqua10&utm_medium=direct-email&utm_campaign=ecard-83906-77941-5&utm_term=&utm_content=email_ecard&utm_source=share_point_wow&utm_medium=Direct-3rd%20Party%20Vendor&utm_campaign=FY2024_Q4_All_TEC_Talk_Series_AbusingGPO_SPWoW_12723&utm_term=&utm_content=email_ecard
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
date: Sat, 11 Nov 2023 01:23:35 GMT
via: 1.1 c1e2423613b2dcb4230386a2b285734e.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: None
x-amz-cf-pop: FRA56-C2
age: 227508
x-cache: Hit from cloudfront
content-length: 871
x-ua-compatible: IE=edge,chrome=1
referrer-policy: strict-origin-when-cross-origin
last-modified: Sat, 11 Nov 2023 00:18:24 GMT
server
etag: "08881953414da1:0"
x-frame-options: SAMEORIGIN
content-type: application/javascript
cache-control: max-age=604800, s-maxage=5184000
permissions-policy: camera=(), microphone=(), payment=()
accept-ranges: bytes
x-amz-cf-id: 4eM-LzPtRvQhSc4Mqw8W23mWdCnpJepIzsfKapiyrYZ9JOujAbEPSA==

GET
H2 200 selector-tool.min.js Show response
www.quest.com/static/js/ 2 KB
2 KB 23ms
22ms Script
application/javascript 2600:9000:211e:2c00:14:56cf:b500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.quest.com/static/js/selector-tool.min.js?202311100718

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:211e:2c00:14:56cf:b500:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

6007f6c321ab41085605eb0881da619dfbb9824dc8f1f9cbb0bc4d67a573cb90

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/event/tec-talk-abusing-group-policy-for-fun-and-profit-/?utm_source=eloqua10&utm_medium=direct-email&utm_campaign=ecard-83906-77941-5&utm_term=&utm_content=email_ecard&utm_source=share_point_wow&utm_medium=Direct-3rd%20Party%20Vendor&utm_campaign=FY2024_Q4_All_TEC_Talk_Series_AbusingGPO_SPWoW_12723&utm_term=&utm_content=email_ecard
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
date: Sat, 11 Nov 2023 02:28:42 GMT
content-encoding: gzip
x-permitted-cross-domain-policies: None
via: 1.1 c1e2423613b2dcb4230386a2b285734e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C2
age: 223601
x-cache: Hit from cloudfront
x-ua-compatible: IE=edge,chrome=1
referrer-policy: strict-origin-when-cross-origin
last-modified: Sat, 11 Nov 2023 00:18:18 GMT
server
etag: W/"01ee913414da1:0"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800, s-maxage=5184000
permissions-policy: camera=(), microphone=(), payment=()
x-amz-cf-id: IGIxd8kb02XUGsbjcmaSb3DzCNEaburwnWlgmxLiIlrrjSSeFg37tA==

GET
H2 200 quest-logo.svg
www.quest.com/images/shared/ 3 KB
2 KB 25ms
24ms Image
image/svg+xml 2600:9000:211e:2c00:14:56cf:b500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.quest.com/images/shared/quest-logo.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:211e:2c00:14:56cf:b500:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

b388a2a5b662ef675b2a403883281bffe19424c45f79516752a015e695b78850

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/event/tec-talk-abusing-group-policy-for-fun-and-profit-/?utm_source=eloqua10&utm_medium=direct-email&utm_campaign=ecard-83906-77941-5&utm_term=&utm_content=email_ecard&utm_source=share_point_wow&utm_medium=Direct-3rd%20Party%20Vendor&utm_campaign=FY2024_Q4_All_TEC_Talk_Series_AbusingGPO_SPWoW_12723&utm_term=&utm_content=email_ecard
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
date: Sat, 11 Nov 2023 01:23:35 GMT
content-encoding: gzip
x-permitted-cross-domain-policies: None
x-aspnet-version: 4.0.30319
via: 1.1 c1e2423613b2dcb4230386a2b285734e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C2
age: 227508
x-cache: Hit from cloudfront
x-ua-compatible: IE=edge,chrome=1
referrer-policy: strict-origin-when-cross-origin
server
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=604800
permissions-policy: camera=(), microphone=(), payment=()
x-amz-cf-id: sFXYezUi3RPxtOOjsYfS9awQ8-1u_VUC9fHWPvw-lzum7d4OhJ0qgA==

GET
H2 200 e57654ce-cc55-4c0e-8ea5-4c3fe25a8902.json Show response
cdn.cookielaw.org/consent/e57654ce-cc55-4c0e-8ea5-4c3fe25a8902/ 5 KB
2 KB 101ms
62ms XHR
application/x-javascript 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/e57654ce-cc55-4c0e-8ea5-4c3fe25a8902/e57654ce-cc55-4c0e-8ea5-4c3fe25a8902.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dd2727a5fc9720ac18b44ec82eb1a823416f1e48c6102cedfc9661beb88e5f8e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 13 Nov 2023 16:35:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 46852
content-md5: kORCe8L38ZZ7c4KHmZ68vw==
content-length: 1735
x-ms-lease-status: unlocked
last-modified: Tue, 31 Oct 2023 20:49:13 GMT
server: cloudflare
etag: 0x8DBDA52D7416A11
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 399bc294-b01e-0015-6b3b-0c2e30000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 82586d7eed874d89-FRA
expires: Tue, 14 Nov 2023 16:35:24 GMT

GET
H2 200 icomoon.woff2
www.quest.com/static/css/icomoon/fonts/ 78 KB
79 KB 24ms
24ms Font
application/font-woff2 2600:9000:211e:2c00:14:56cf:b500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.quest.com/static/css/icomoon/fonts/icomoon.woff2?01102023

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:211e:2c00:14:56cf:b500:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

7586b3b324be0c43f20efefbd4f77808c33a3e6bc96628ce2555236a44a2a3c7

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Referer: https://www.quest.com/event/tec-talk-abusing-group-policy-for-fun-and-profit-/?utm_source=eloqua10&utm_medium=direct-email&utm_campaign=ecard-83906-77941-5&utm_term=&utm_content=email_ecard&utm_source=share_point_wow&utm_medium=Direct-3rd%20Party%20Vendor&utm_campaign=FY2024_Q4_All_TEC_Talk_Series_AbusingGPO_SPWoW_12723&utm_term=&utm_content=email_ecard
Origin: https://www.quest.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
date: Sat, 11 Nov 2023 01:23:34 GMT
via: 1.1 c1e2423613b2dcb4230386a2b285734e.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: None
x-amz-cf-pop: FRA56-C2
age: 227509
x-cache: Hit from cloudfront
content-length: 79840
x-ua-compatible: IE=edge,chrome=1
referrer-policy: strict-origin-when-cross-origin
last-modified: Sat, 11 Nov 2023 00:18:16 GMT
server
etag: "0d4bc903414da1:0"
x-frame-options: SAMEORIGIN
content-type: application/font-woff2
cache-control: max-age=14400, s-maxage=5184000
permissions-policy: camera=(), microphone=(), payment=()
accept-ranges: bytes
x-amz-cf-id: PFJa5FMn6A9iuAF7_GEs2qvPhTX_D7XIJhr9uIbm0sSCjT-29f5p0A==

GET
H2 200 oktrk.js Show response
static.oktopost.com/ 9 KB
4 KB 178ms
34ms Script
application/javascript 65.9.95.98
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://static.oktopost.com/oktrk.js
Requested by: Host: www.quest.com
URL: https://www.quest.com/event/tec-talk-abusing-group-policy-for-fun-and-profit-/?utm_source=eloqua10&utm_medium=direct-email&utm_campaign=ecard-83906-77941-5&utm_term=&utm_content=email_ecard&utm_source=share_point_wow&utm_medium=Direct-3rd%20Party%20Vendor&utm_campaign=FY2024_Q4_All_TEC_Talk_Series_AbusingGPO_SPWoW_12723&utm_term=&utm_content=email_ecard
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 65.9.95.98 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-65-9-95-98.prg50.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 09016600a13dd4825b72516765a8da53d1ab896f7582c4619d014e8ee147ea84

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Sun, 12 Nov 2023 18:11:01 GMT
content-encoding: gzip
via: 1.1 ca6609f4a83e693c532f54c00146f5f8.cloudfront.net (CloudFront)
last-modified: Mon, 27 Jan 2020 09:47:41 GMT
server: AmazonS3
x-amz-cf-pop: PRG50-C1
age: 80664
etag: W/"57315c24d6fec75c4d46a8cc3fa6e0d5"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
x-amz-cf-id: Uq1YUg2K_mZXUNFmaw9kpTaCJk44VdzBxCTCw02qthmiPCQQeEn0dw==

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 335 KB
103 KB 141ms
69ms Script
application/javascript 2a00:1450:4001:811::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-M8J6VX&gtm_auth=jlc0VhasTaHuB1JSfC7_hg&gtm_preview=env-2&gtm_cookies_win=x

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

611d2ff08f41351a4c935f84ec2ae10b91409c24ae02aa30d9c7ac6401e04d2c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Mon, 13 Nov 2023 16:35:24 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 105458
x-xss-protection: 0
pragma: no-cache
server: Google Tag Manager
vary: *
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 j.php Show response
dev.visualwebsiteoptimizer.com/ 11 KB
4 KB 60ms
21ms Script
application/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/j.php?a=40342&u=https%3A%2F%2Fwww.quest.com%2Fevent%2Ftec-talk-abusing-group-policy-for-fun-and-profit-%2F%3Futm_source%3Deloqua10%26utm_medium%3Ddirect-email%26utm_campaign%3Decard-83906-77941-5%26utm_term%3D%26utm_content%3Demail_ecard%26utm_source%3Dshare_point_wow%26utm_medium%3DDirect-3rd%2520Party%2520Vendor%26utm_campaign%3DFY2024_Q4_All_TEC_Talk_Series_AbusingGPO_SPWoW_12723%26utm_term%3D%26utm_content%3Demail_ecard&f=1&r=0.5124534758899089
Requested by: Host: www.quest.com
URL: https://www.quest.com/event/tec-talk-abusing-group-policy-for-fun-and-profit-/?utm_source=eloqua10&utm_medium=direct-email&utm_campaign=ecard-83906-77941-5&utm_term=&utm_content=email_ecard&utm_source=share_point_wow&utm_medium=Direct-3rd%20Party%20Vendor&utm_campaign=FY2024_Q4_All_TEC_Talk_Series_AbusingGPO_SPWoW_12723&utm_term=&utm_content=email_ecard
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gams2 /
Resource Hash: 35875c8dae6618610b27ac6d33b8ee351418be07d035523002a82f4fee19f325

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Mon, 13 Nov 2023 16:35:24 GMT
content-encoding: gzip
via: 1.1 google
server: gams2
etag: W/"1699883219"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=0, no-cache, must-revalidate
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2 200 chevron-right-grey.svg
www.quest.com/images/icons/svg/ 277 B
842 B 22ms
21ms Image
image/svg+xml 2600:9000:211e:2c00:14:56cf:b500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.quest.com/images/icons/svg/chevron-right-grey.svg

Requested by

Host: www.quest.com
URL: https://www.quest.com/static/css/v3/header-footer.min.css?06012023

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:211e:2c00:14:56cf:b500:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

403909ce1feea6538db61ab128e2f9b3e8fe78edac67075f656bcc4a5b257de9

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/static/css/v3/header-footer.min.css?06012023
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
date: Sat, 11 Nov 2023 01:23:35 GMT
via: 1.1 c1e2423613b2dcb4230386a2b285734e.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: None
x-aspnet-version: 4.0.30319
x-amz-cf-pop: FRA56-C2
age: 227508
x-cache: Hit from cloudfront
content-length: 277
x-ua-compatible: IE=edge,chrome=1
referrer-policy: strict-origin-when-cross-origin
server
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
cache-control: public, max-age=604800
permissions-policy: camera=(), microphone=(), payment=()
x-amz-cf-id: 3qzM_uW49Vo28lozIbSDoesaWPXvP1qOSCmks8KACUCXtd4ht2A-1g==

GET
H2 200 hero-750x231-80422_168402.jpg
www.quest.com/images/events/hero/ 72 KB
73 KB 27ms
27ms Image
image/jpeg 2600:9000:211e:2c00:14:56cf:b500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.quest.com/images/events/hero/hero-750x231-80422_168402.jpg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:211e:2c00:14:56cf:b500:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

dd5f763eb2c421967419542a7a6de031d46e4d46b3b1c1743efbb707c7a02766

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/event/tec-talk-abusing-group-policy-for-fun-and-profit-/?utm_source=eloqua10&utm_medium=direct-email&utm_campaign=ecard-83906-77941-5&utm_term=&utm_content=email_ecard&utm_source=share_point_wow&utm_medium=Direct-3rd%20Party%20Vendor&utm_campaign=FY2024_Q4_All_TEC_Talk_Series_AbusingGPO_SPWoW_12723&utm_term=&utm_content=email_ecard
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
date: Mon, 13 Nov 2023 16:25:12 GMT
via: 1.1 c1e2423613b2dcb4230386a2b285734e.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: None
x-aspnet-version: 4.0.30319
x-amz-cf-pop: FRA56-C2
age: 611
x-cache: Hit from cloudfront
content-length: 73786
x-ua-compatible: IE=edge,chrome=1
referrer-policy: strict-origin-when-cross-origin
server
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: public, max-age=604800
permissions-policy: camera=(), microphone=(), payment=()
x-amz-cf-id: 0MfywYky1t8ELKnVbG4yD8YNWl5hzf-stqIdFwfzLY-aCnkCOCHrfw==

GET
H2 200 zi-tag.js Show response
js.zi-scripts.com/ 8 KB
3 KB 69ms
29ms Script
application/javascript 172.64.150.44
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/zi-tag.js
Requested by: Host: www.quest.com
URL: https://www.quest.com/viewscripts/zoominfo.min.js?202311100718
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.150.44 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: f9a144d016db30ba861af6f2464d3df7bd55240b2c1b9635d6e2527320ec81ea

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Mon, 13 Nov 2023 16:35:24 GMT
x-amz-version-id: E1WmCtCijJ51e17CdkS6A0kAshBxGSzY
content-encoding: gzip
cf-cache-status: DYNAMIC
last-modified: Thu, 19 Oct 2023 07:00:40 GMT
server: cloudflare
via: 1.1 7d2716fe283418b87c2df69e15b55944.cloudfront.net (CloudFront)
x-amz-cf-pop: AMS58-P3
etag: W/"d08bc8c5ca973ebe8c18a64c74607654"
age: 84219
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cf-ray: 82586d7f2eb00e24-AMS
x-amz-cf-id: GC7_zU6mCRTjBw4xr0ZWknhcv5llUiQn08Zt9WMWt8yeh-yT_tkT7A==

GET
H3 200 va-f8b68fedbbecfe4b4f0e0c48b8d0dc59.js Show response
dev.visualwebsiteoptimizer.com/7.0/ 235 KB
66 KB 43ms
27ms Script
text/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/7.0/va-f8b68fedbbecfe4b4f0e0c48b8d0dc59.js
Requested by: Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/j.php?a=40342&u=https%3A%2F%2Fwww.quest.com%2Fevent%2Ftec-talk-abusing-group-policy-for-fun-and-profit-%2F%3Futm_source%3Deloqua10%26utm_medium%3Ddirect-email%26utm_campaign%3Decard-83906-77941-5%26utm_term%3D%26utm_content%3Demail_ecard%26utm_source%3Dshare_point_wow%26utm_medium%3DDirect-3rd%2520Party%2520Vendor%26utm_campaign%3DFY2024_Q4_All_TEC_Talk_Series_AbusingGPO_SPWoW_12723%26utm_term%3D%26utm_content%3Demail_ecard&f=1&r=0.5124534758899089
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gams2 /
Resource Hash: f890541721cc0577aea2bc3a0553fd1bba2479f6955f943cd5a4de1cb6966ec5

Request headers

Referer: https://www.quest.com/
Origin: https://www.quest.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Mon, 13 Nov 2023 16:35:24 GMT
content-encoding: br
via: 1.1 google
last-modified: Mon, 13 Nov 2023 13:46:43 GMT
server: gams2
etag: "655228c3-108ca"
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 67786

GET
H3 200 track-f8b68fedbbecfe4b4f0e0c48b8d0dc59.js Show response
dev.visualwebsiteoptimizer.com/7.0/ 13 KB
4 KB 36ms
20ms Script
text/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/7.0/track-f8b68fedbbecfe4b4f0e0c48b8d0dc59.js
Requested by: Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/j.php?a=40342&u=https%3A%2F%2Fwww.quest.com%2Fevent%2Ftec-talk-abusing-group-policy-for-fun-and-profit-%2F%3Futm_source%3Deloqua10%26utm_medium%3Ddirect-email%26utm_campaign%3Decard-83906-77941-5%26utm_term%3D%26utm_content%3Demail_ecard%26utm_source%3Dshare_point_wow%26utm_medium%3DDirect-3rd%2520Party%2520Vendor%26utm_campaign%3DFY2024_Q4_All_TEC_Talk_Series_AbusingGPO_SPWoW_12723%26utm_term%3D%26utm_content%3Demail_ecard&f=1&r=0.5124534758899089
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gams2 /
Resource Hash: 85b6e9042d49f69fcda9dc01f6ae2ca66ae5266eb48a1cfc2f8cc0eab07ffefd

Request headers

Referer: https://www.quest.com/
Origin: https://www.quest.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Mon, 13 Nov 2023 16:35:24 GMT
content-encoding: br
via: 1.1 google
last-modified: Mon, 13 Nov 2023 13:46:43 GMT
server: gams2
etag: "655228c3-fcb"
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4043

GET
H3 200 opa-7cd5cd3f575372866c3eb4ee10eb042a.js Show response
dev.visualwebsiteoptimizer.com/analysis/4.0/ 129 KB
32 KB 36ms
21ms Script
application/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/analysis/4.0/opa-7cd5cd3f575372866c3eb4ee10eb042a.js
Requested by: Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/j.php?a=40342&u=https%3A%2F%2Fwww.quest.com%2Fevent%2Ftec-talk-abusing-group-policy-for-fun-and-profit-%2F%3Futm_source%3Deloqua10%26utm_medium%3Ddirect-email%26utm_campaign%3Decard-83906-77941-5%26utm_term%3D%26utm_content%3Demail_ecard%26utm_source%3Dshare_point_wow%26utm_medium%3DDirect-3rd%2520Party%2520Vendor%26utm_campaign%3DFY2024_Q4_All_TEC_Talk_Series_AbusingGPO_SPWoW_12723%26utm_term%3D%26utm_content%3Demail_ecard&f=1&r=0.5124534758899089
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gams2 /
Resource Hash: a466104bed9332c7688d4ce819fc6176d9feb8a477ec2e9e0fc26fb04f8e363f

Request headers

Referer: https://www.quest.com/
Origin: https://www.quest.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Mon, 13 Nov 2023 16:35:24 GMT
content-encoding: br
via: 1.1 google
last-modified: Mon, 13 Nov 2023 13:46:31 GMT
server: gams2
etag: "655228b7-81e4"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 33252

GET
H2 200 v.gif
dev.visualwebsiteoptimizer.com/ 35 B
142 B 164ms
163ms Image
image/gif 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dev.visualwebsiteoptimizer.com/v.gif?cd=0&a=40342&d=quest.com&u=D8352B3AFECE3C2C54892A35A184D3338&h=245770ffafea800a2a68eb24b34d0a69&t=false

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

137.102.96.34.bc.googleusercontent.com

Software

gnv3c /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Mon, 13 Nov 2023 16:35:24 GMT
via: 1.1 google
x-content-type-options: nosniff
server: gnv3c
content-type: image/gif
cache-control: public, max-age=43200
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35

GET
H2 200 location Show response
geolocation.onetrust.com/cookieconsentpub/v1/geo/ 59 B
295 B 88ms
44ms XHR
application/json 2606:4700:4400::ac40:9b77
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://geolocation.onetrust.com/cookieconsentpub/v1/geo/location

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:4400::ac40:9b77 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

33110d24cbb506c398f40acebf7e9b4314b3644bda60332a7c993637c957bef1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept: application/json
Referer: https://www.quest.com/
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Mon, 13 Nov 2023 16:35:24 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS
content-type: application/json
access-control-allow-origin: *
cf-ray: 82586d7f9e874d89-FRA
access-control-allow-headers: Content-Type

GET
H2 200 getSubscriptions Show response
js.zi-scripts.com/unified/v1/master/ 203 B
463 B 209ms
209ms Fetch
application/json 172.64.150.44
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Requested by: Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.150.44 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: f25057b2fb07064ac77c7eb014a3c45100b80acfce3bc91c0dec2b74912a749c

Request headers

Content-Type: application/json
Referer: https://www.quest.com/
accept-language: nl-NL,nl;q=0.9
Authorization: Bearer 6d6bb1b9661672858948
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
visited_url: https://www.quest.com/event/tec-talk-abusing-group-policy-for-fun-and-profit-/?utm_source=eloqua10&utm_medium=direct-email&utm_campaign=ecard-83906-77941-5&utm_term=&utm_content=email_ecard&utm_source=share_point_wow&utm_medium=Direct-3rd%20Party%20Vendor&utm_campaign=FY2024_Q4_All_TEC_Talk_Series_AbusingGPO_SPWoW_12723&utm_term=&utm_content=email_ecard

Response headers

date: Mon, 13 Nov 2023 16:35:25 GMT
via: 1.1 9ac192ffc1203361ea1141b56df84966.cloudfront.net (CloudFront)
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
x-amz-cf-pop: AMS58-P3
x-powered-by: Express
etag: W/"cb-toM9sNVykwAz5FzhJYTvg197TKw"
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cf-ray: 82586d80cc7bb8e8-AMS
x-amz-cf-id: akwaCMHxbQn44yvZr3L6DP4f9N9Lzmzcs07FSBhZrHXH6uuKUw6LKQ==
apigw-requestid: OWF8Fiz0PHcEMOQ=

OPTIONS
H2 204 getSubscriptions
js.zi-scripts.com/unified/v1/master/ Frame 0
0 223ms
180ms Preflight 172.64.150.44
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.150.44 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type,visited_url
Access-Control-Request-Method: GET
Origin: https://www.quest.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

access-control-allow-headers: *
access-control-allow-methods: *
access-control-allow-origin: *
access-control-max-age: 0
apigw-requestid: OWF8DgiWPHcEMGQ=
cf-cache-status: DYNAMIC
cf-ray: 82586d7fab56b8e8-AMS
date: Mon, 13 Nov 2023 16:35:24 GMT
server: cloudflare
vary: Access-Control-Request-Headers
via: 1.1 c2c44e18165da827386e0ed36aeea344.cloudfront.net (CloudFront)
x-amz-cf-id: TKlQeNZXRe_mgdxkPk_Y5vOIVZOpQresNBR2KHVmTMRsnxvzscPx7Q==
x-amz-cf-pop: AMS58-P3
x-cache: Miss from cloudfront
x-powered-by: Express

GET
H3 200 settings.js Show response
dev.visualwebsiteoptimizer.com/ 18 KB
5 KB 23ms
22ms Script
application/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/settings.js?a=40342&settings_type=1&vn=7.0&exc=591|594|920
Requested by: Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/7.0/va-f8b68fedbbecfe4b4f0e0c48b8d0dc59.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gams2 /
Resource Hash: a00b55dccdbe3a82e7fffbd3d0a4cfff5b52e013dec83d3fe8ad778abd1e0493

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Mon, 13 Nov 2023 16:35:24 GMT
content-encoding: gzip
via: 1.1 google
server: gams2
etag: W/"1699883219"
content-type: application/javascript; charset=UTF-8
cache-control: public, max-age=0, no-cache, must-revalidate
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000

GET
H2 200 api.js Show response
www.google.com/recaptcha/ 1 KB
1 KB 86ms
33ms Script
text/javascript 2a00:1450:4001:82a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api.js?onload=V3RCExecute&render=6Lcc7R8nAAAAAAFeO6kK-jyFD_FpG7szmyfvO46t

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

d26af1e6471d22222ac7f2f41720b75297871daa99c0c414c3e5dd5e3627fa9d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Mon, 13 Nov 2023 16:35:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Mon, 13 Nov 2023 16:35:24 GMT

GET
H2 200 quest-logo-white.svg
www.quest.com/images/shared/ 4 KB
2 KB 27ms
26ms Image
image/svg+xml 2600:9000:211e:2c00:14:56cf:b500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.quest.com/images/shared/quest-logo-white.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:211e:2c00:14:56cf:b500:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

94dbba0af4069efc778e6a959e67eda7125b0dc78cff69d626d711b7f8774931

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/event/tec-talk-abusing-group-policy-for-fun-and-profit-/?utm_source=eloqua10&utm_medium=direct-email&utm_campaign=ecard-83906-77941-5&utm_term=&utm_content=email_ecard&utm_source=share_point_wow&utm_medium=Direct-3rd%20Party%20Vendor&utm_campaign=FY2024_Q4_All_TEC_Talk_Series_AbusingGPO_SPWoW_12723&utm_term=&utm_content=email_ecard
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
date: Sat, 11 Nov 2023 01:23:35 GMT
content-encoding: gzip
x-permitted-cross-domain-policies: None
x-aspnet-version: 4.0.30319
via: 1.1 c1e2423613b2dcb4230386a2b285734e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C2
age: 227508
x-cache: Hit from cloudfront
x-ua-compatible: IE=edge,chrome=1
referrer-policy: strict-origin-when-cross-origin
server
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=604800
permissions-policy: camera=(), microphone=(), payment=()
x-amz-cf-id: Ghg4S_Zo8Z3ULa4fNuEPHJlI29Au6OQl0AlY4B6c3JULkqINe_NxoA==

GET
H2 200 ping Show response
okt.to/ 0
100 B 375ms
130ms Script
text/javascript 23.22.90.252
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://okt.to/ping?uri=%2Fevent%2Ftec-talk-abusing-group-policy-for-fun-and-profit-%2F%3Futm_source%3Deloqua10%26utm_medium%3Ddirect-email%26utm_campaign%3Decard-83906-77941-5%26utm_term%3D%26utm_content%3Demail_ecard%26utm_source%3Dshare_point_wow%26utm_medium%3DDirect-3rd%2520Party%2520Vendor%26utm_campaign%3DFY2024_Q4_All_TEC_Talk_Series_AbusingGPO_SPWoW_12723%26utm_term%3D%26utm_content%3Demail_ecard&aid=001m48enoy0exsu&ts=1699893324763

Requested by

Host: static.oktopost.com
URL: https://static.oktopost.com/oktrk.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

23.22.90.252 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-23-22-90-252.compute-1.amazonaws.com

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000;

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Mon, 13 Nov 2023 16:35:25 GMT
strict-transport-security: max-age=31536000;
content-type: text/javascript;charset=UTF-8

GET
H2 200 otBannerSdk.js Show response
cdn.cookielaw.org/scripttemplates/202210.1.0/ 381 KB
91 KB 28ms
28ms Script
application/javascript 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202210.1.0/otBannerSdk.js

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/otSDKStub.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f97354a4659e6fc1cf05e27b59d333c697c1b0fd6fcaaceaa9af1f6886abe0af

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 13 Nov 2023 16:35:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: DjzI+HdyHvhC2OCs+qd+pw==
age: 50289
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 93164
x-ms-lease-status: unlocked
last-modified: Fri, 16 Dec 2022 04:11:44 GMT
server: cloudflare
etag: 0x8DADF1BA4D9E9D9
vary: Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
x-ms-request-id: 80c4b5fc-e01e-007a-0e6d-1424c3000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 82586d8009ba92a1-FRA

GET
H3 200 worker-70faafffa0475802f5ee03ca5ff74179.js Show response
dev.visualwebsiteoptimizer.com/analysis/ 47 KB
13 KB 23ms
23ms XHR
application/javascript 34.96.102.137
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://dev.visualwebsiteoptimizer.com/analysis/worker-70faafffa0475802f5ee03ca5ff74179.js
Requested by: Host: dev.visualwebsiteoptimizer.com
URL: https://dev.visualwebsiteoptimizer.com/analysis/4.0/opa-7cd5cd3f575372866c3eb4ee10eb042a.js
Protocol: H3
Security: QUIC, , AES_128_GCM
Server: 34.96.102.137 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 137.102.96.34.bc.googleusercontent.com
Software: gams2 /
Resource Hash: e916478d94814b1a0c2680424c323db0514f4a022d16835cd7bcc754722308f4

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Mon, 13 Nov 2023 16:35:24 GMT
content-encoding: br
via: 1.1 google
last-modified: Mon, 13 Nov 2023 13:46:31 GMT
server: gams2
etag: "655228b7-351f"
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 13599

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 247 KB
85 KB 50ms
49ms Script
application/javascript 2a00:1450:4001:811::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-LEL9V2KCH0&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M8J6VX&gtm_auth=jlc0VhasTaHuB1JSfC7_hg&gtm_preview=env-2&gtm_cookies_win=x

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

1828d18b9d5682896c68b4d3f0ec44f0f7b4fa542d3f77fe3380f1f904379a19

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Mon, 13 Nov 2023 16:35:24 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 86390
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Mon, 13 Nov 2023 16:35:24 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 45ms
15ms Script
text/javascript 2001:4860:4802:36::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-M8J6VX&gtm_auth=jlc0VhasTaHuB1JSfC7_hg&gtm_preview=env-2&gtm_cookies_win=x

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:36::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Mon, 13 Nov 2023 15:21:17 GMT
last-modified: Mon, 12 Jun 2023 18:23:07 GMT
server: Golfe2
age: 4447
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Mon, 13 Nov 2023 17:21:17 GMT

GET
H2 200 en.json Show response
cdn.cookielaw.org/consent/e57654ce-cc55-4c0e-8ea5-4c3fe25a8902/08ad57a2-303e-4d9c-9d1c-eef8840eb6a5/ 218 KB
37 KB 41ms
41ms Fetch
application/x-javascript 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/consent/e57654ce-cc55-4c0e-8ea5-4c3fe25a8902/08ad57a2-303e-4d9c-9d1c-eef8840eb6a5/en.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202210.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8abce91738362d8e5d6e833b02de38f63e4145dd13b962352f3f142e61b61a41

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 13 Nov 2023 16:35:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
strict-transport-security: max-age=31536000; includeSubDomains; preload
age: 5702
content-md5: /Bmj9SB4VA5S/EAqNrcspg==
content-length: 37796
x-ms-lease-status: unlocked
last-modified: Tue, 31 Oct 2023 20:49:39 GMT
server: cloudflare
etag: 0x8DBDA52E6E4B644
vary: Accept-Encoding
content-type: application/x-javascript
access-control-allow-origin: *
x-ms-request-id: 386ef053-601e-0016-293b-0ccf54000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Cache-Control,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: public, max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 82586d807fc44d89-FRA
expires: Tue, 14 Nov 2023 16:35:24 GMT

GET
H2 200 recaptcha__nl.js Show response
www.gstatic.com/recaptcha/releases/fGZmEzpfeSeqDJiApS_XZ4Y2/ 468 KB
188 KB 102ms
32ms Script
text/javascript 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/fGZmEzpfeSeqDJiApS_XZ4Y2/recaptcha__nl.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api.js?onload=V3RCExecute&render=6Lcc7R8nAAAAAAFeO6kK-jyFD_FpG7szmyfvO46t

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

82f0e1fb9a662917f52ca8afe5f6395a785586bfeb67d0211c95416c114c31e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.quest.com/
Origin: https://www.quest.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Sat, 11 Nov 2023 02:17:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 224270
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 191782
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 03:03:27 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 10 Nov 2024 02:17:34 GMT

GET
H2 200 icons-social-media.png
www.quest.com/images/email/ 23 KB
23 KB 26ms
26ms Image
image/png 2600:9000:211e:2c00:14:56cf:b500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.quest.com/images/email/icons-social-media.png

Requested by

Host: www.quest.com
URL: https://www.quest.com/static/bundles/cssquest?v=fnMNQBb8bXCn57VdzZ_Sh1QxyCDACaoVRzd96-93tGU1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:211e:2c00:14:56cf:b500:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

8427f81fd3164174d92821e69487b1f434cd4ce07272b7a24bb1a2e3c5fd2ea7

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/static/bundles/cssquest?v=fnMNQBb8bXCn57VdzZ_Sh1QxyCDACaoVRzd96-93tGU1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
date: Sat, 11 Nov 2023 02:34:47 GMT
via: 1.1 c1e2423613b2dcb4230386a2b285734e.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: None
x-aspnet-version: 4.0.30319
x-amz-cf-pop: FRA56-C2
age: 223237
x-cache: Hit from cloudfront
content-length: 23268
x-ua-compatible: IE=edge,chrome=1
referrer-policy: strict-origin-when-cross-origin
server
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: public, max-age=604800
permissions-policy: camera=(), microphone=(), payment=()
x-amz-cf-id: rA9_jVbyU4RoCsx9pNLcmi13eEowKJx5PN92GIwXcYLfIgf_iEaEgw==

GET
H2 200 linkedin-in-white.svg
www.quest.com/images/icons/svg/ 1 KB
1 KB 28ms
27ms Image
image/svg+xml 2600:9000:211e:2c00:14:56cf:b500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.quest.com/images/icons/svg/linkedin-in-white.svg

Requested by

Host: www.quest.com
URL: https://www.quest.com/static/css/v3/header-footer.min.css?06012023

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:211e:2c00:14:56cf:b500:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

2f1c8fc06e01de6f30b24981e471b1b953ac869fd90a7b4847a13964702bff7d

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/static/css/v3/header-footer.min.css?06012023
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
date: Sat, 11 Nov 2023 01:23:36 GMT
content-encoding: gzip
x-permitted-cross-domain-policies: None
x-aspnet-version: 4.0.30319
via: 1.1 c1e2423613b2dcb4230386a2b285734e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C2
age: 227508
x-cache: Hit from cloudfront
x-ua-compatible: IE=edge,chrome=1
referrer-policy: strict-origin-when-cross-origin
server
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=604800
permissions-policy: camera=(), microphone=(), payment=()
x-amz-cf-id: uUp0qjbhcCuWXLiRmTkh2ByD9ygrSdU37FKYqd8A7EnYXIHGbAbi3A==

GET
H2 200 twitter-white.svg
www.quest.com/images/icons/svg/ 2 KB
2 KB 26ms
25ms Image
image/svg+xml 2600:9000:211e:2c00:14:56cf:b500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.quest.com/images/icons/svg/twitter-white.svg

Requested by

Host: www.quest.com
URL: https://www.quest.com/static/css/v3/header-footer.min.css?06012023

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:211e:2c00:14:56cf:b500:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

1f36e93dde16f7500a098910959e72a23302f7035728620949e08bbae9e1362f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/static/css/v3/header-footer.min.css?06012023
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
date: Sat, 11 Nov 2023 01:23:36 GMT
content-encoding: gzip
x-permitted-cross-domain-policies: None
x-aspnet-version: 4.0.30319
via: 1.1 c1e2423613b2dcb4230386a2b285734e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C2
age: 227508
x-cache: Hit from cloudfront
x-ua-compatible: IE=edge,chrome=1
referrer-policy: strict-origin-when-cross-origin
server
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=604800
permissions-policy: camera=(), microphone=(), payment=()
x-amz-cf-id: gRxAX6eYIgkoL2lcu2GET2tidTOAP0vQI5qA8_YBixdLr5VapXQHcg==

GET
H2 200 facebook-white.svg
www.quest.com/images/icons/svg/ 1 KB
1 KB 26ms
26ms Image
image/svg+xml 2600:9000:211e:2c00:14:56cf:b500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.quest.com/images/icons/svg/facebook-white.svg

Requested by

Host: www.quest.com
URL: https://www.quest.com/static/css/v3/header-footer.min.css?06012023

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:211e:2c00:14:56cf:b500:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

251a75f73d214eeeaf404816367e701864ae1be30ee36e1ee8e3c309887bdb0f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/static/css/v3/header-footer.min.css?06012023
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
date: Sat, 11 Nov 2023 01:23:35 GMT
content-encoding: gzip
x-permitted-cross-domain-policies: None
x-aspnet-version: 4.0.30319
via: 1.1 c1e2423613b2dcb4230386a2b285734e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C2
age: 227508
x-cache: Hit from cloudfront
x-ua-compatible: IE=edge,chrome=1
referrer-policy: strict-origin-when-cross-origin
server
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: image/svg+xml
cache-control: public, max-age=604800
permissions-policy: camera=(), microphone=(), payment=()
x-amz-cf-id: lLdT8OU_Whh6XfkjYW9eSsdFI6Ow3a3TaY4MKy5jmNb3Szk7-6Hogw==

GET
H2 200 youtube-white.png
www.quest.com/images/icons/svg/ 6 KB
6 KB 26ms
26ms Image
image/png 2600:9000:211e:2c00:14:56cf:b500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.quest.com/images/icons/svg/youtube-white.png

Requested by

Host: www.quest.com
URL: https://www.quest.com/static/css/v3/header-footer.min.css?06012023

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:211e:2c00:14:56cf:b500:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

7b83a741bcf43cef6c32366cf7028170fbd169b3ecd567e1c094a1797505f3bf

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/static/css/v3/header-footer.min.css?06012023
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
date: Sat, 11 Nov 2023 01:23:35 GMT
via: 1.1 c1e2423613b2dcb4230386a2b285734e.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: None
x-aspnet-version: 4.0.30319
x-amz-cf-pop: FRA56-C2
age: 227508
x-cache: Hit from cloudfront
content-length: 6048
x-ua-compatible: IE=edge,chrome=1
referrer-policy: strict-origin-when-cross-origin
server
x-frame-options: SAMEORIGIN
content-type: image/png
cache-control: public, max-age=604800
permissions-policy: camera=(), microphone=(), payment=()
x-amz-cf-id: f6RZXuBxF5XOXSu824x9yeOfAeQc279J0jjkrZ0ssY0u4cu3XmTy1w==

GET
H/1.1 200
OK elqCfg.min.js Show response
img04.en25.com/i/ 6 KB
6 KB 98ms
25ms Script
application/x-javascript 23.201.242.231
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://img04.en25.com/i/elqCfg.min.js

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

23.201.242.231 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a23-201-242-231.deploy.static.akamaitechnologies.com

Software

Resource Hash

3346de8e2ae1bfde250c7ac5c06f79a0a60c7faef8e5e08a2c9e8fbf5ec2c9e8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Date: Mon, 13 Nov 2023 16:35:24 GMT
X-Content-Type-Options: nosniff
Last-Modified: Mon, 17 Jul 2023 19:34:32 GMT
ETag: "2d8b19b6e5b8d91:0"
P3P: CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Content-Type: application/x-javascript
Cache-Control: no-store
Connection: keep-alive
Accept-Ranges: bytes
X-Robots-Tag: noindex, nofollow
Content-Length: 6080
X-XSS-Protection: 1; mode=block
Expires: Mon, 13 Nov 2023 16:35:24 GMT

GET
H2 200 get Show response
www.quest.com/hidden/bitly.asmx/ 126 B
687 B 251ms
251ms XHR
text/xml 2600:9000:211e:2c00:14:56cf:b500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.quest.com/hidden/bitly.asmx/get?URI=https%3A%2F%2Fwww.quest.com%2Fevent%2Ftec-talk-abusing-group-policy-for-fun-and-profit-%2F

Requested by

Host: www.quest.com
URL: https://www.quest.com/static/bundles/jsquest?v=A_3VHy20cYkljM8kEHFAwmaPmbscoKdkhHW1b2Aa-4Q1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:211e:2c00:14:56cf:b500:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

b0347f63501270e20ec8ef517183e157570483a24194a2fa4bc1034eba06e8dc

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/event/tec-talk-abusing-group-policy-for-fun-and-profit-/?utm_source=eloqua10&utm_medium=direct-email&utm_campaign=ecard-83906-77941-5&utm_term=&utm_content=email_ecard&utm_source=share_point_wow&utm_medium=Direct-3rd%20Party%20Vendor&utm_campaign=FY2024_Q4_All_TEC_Talk_Series_AbusingGPO_SPWoW_12723&utm_term=&utm_content=email_ecard
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
date: Mon, 13 Nov 2023 16:35:23 GMT
via: 1.1 c1e2423613b2dcb4230386a2b285734e.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: None
x-aspnet-version: 4.0.30319
x-amz-cf-pop: FRA56-C2
x-cache: Miss from cloudfront
content-length: 126
x-ua-compatible: IE=edge,chrome=1
referrer-policy: strict-origin-when-cross-origin
server
x-frame-options: SAMEORIGIN
content-type: text/xml; charset=utf-8
cache-control: private, max-age=0
permissions-policy: camera=(), microphone=(), payment=()
x-amz-cf-id: dE0DDcnUBZ9iUOggyKx0roDCEFNErjPwkNuBfs_uBARP65XTQB-Dig==

GET
H2 200 / Show response
www.quest.com/sso/pageset/ 290 B
1 KB 537ms
537ms XHR
application/json 2600:9000:211e:2c00:14:56cf:b500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.quest.com/sso/pageset/?refer=&currentpage=https%3A%2F%2Fwww.quest.com%2Fevent%2Ftec-talk-abusing-group-policy-for-fun-and-profit-%2F%3Futm_source%3Deloqua10%26amp%3Butm_medium%3Ddirect-email%26amp%3Butm_campaign%3Decard-83906-77941-5%26amp%3Butm_term%3D%26amp%3Butm_content%3Demail_ecard%26amp%3Butm_source%3Dshare_point_wow%26amp%3Butm_medium%3DDirect-3rd%20Party%20Vendor%26amp%3Butm_campaign%3DFY2024_Q4_All_TEC_Talk_Series_AbusingGPO_SPWoW_12723%26amp%3Butm_term%3D%26amp%3Butm_content%3Demail_ecard&region=&localityItemId=113188&dsgLocalityItemId=3&prospectOrigin=

Requested by

Host: www.quest.com
URL: https://www.quest.com/static/bundles/jsquest?v=A_3VHy20cYkljM8kEHFAwmaPmbscoKdkhHW1b2Aa-4Q1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:211e:2c00:14:56cf:b500:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

e09a6456f1888624fff613819611bc406a3d6691403b5b14255cd2be909200a3

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Accept: */*
Referer: https://www.quest.com/event/tec-talk-abusing-group-policy-for-fun-and-profit-/?utm_source=eloqua10&utm_medium=direct-email&utm_campaign=ecard-83906-77941-5&utm_term=&utm_content=email_ecard&utm_source=share_point_wow&utm_medium=Direct-3rd%20Party%20Vendor&utm_campaign=FY2024_Q4_All_TEC_Talk_Series_AbusingGPO_SPWoW_12723&utm_term=&utm_content=email_ecard
X-Requested-With: XMLHttpRequest
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
Content-Type: application/json; charset=utf-8

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
date: Mon, 13 Nov 2023 16:35:24 GMT
via: 1.1 c1e2423613b2dcb4230386a2b285734e.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: None
x-aspnet-version: 4.0.30319
x-amz-cf-pop: FRA56-C2
x-cache: Miss from cloudfront
content-length: 290
x-ua-compatible: IE=edge,chrome=1
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 13 Nov 2023 16:35:24 GMT
server
x-frame-options: SAMEORIGIN
vary: Accept-Encoding,Cookie,User-Agent,CloudFront-Is-Android-Viewer,CloudFront-Is-Desktop-Viewer,CloudFront-Is-IOS-Viewer,CloudFront-Is-Mobile-Viewer,CloudFront-Is-SmartTV-Viewer,CloudFront-Is-Tablet-Viewer,CloudFront-Viewer-Country,Host,Referer
content-type: application/json; charset=utf-8
cache-control: no-cache, no-store, must-revalidate
permissions-policy: camera=(), microphone=(), payment=()
x-amz-cf-id: tsA2tN3AR15adbtTu0pK_GVGrjAAzVKZpqCOKKcCZkm7Oktw-UMKSg==
expires: Mon, 13 Nov 2023 16:35:24 GMT

GET
H2 200 otFlat.json Show response
cdn.cookielaw.org/scripttemplates/202210.1.0/assets/ 13 KB
3 KB 32ms
32ms Fetch
application/json 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202210.1.0/assets/otFlat.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202210.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

14e4d1596c6b58896dfce1fc1ec45372bab4d2259ba82828fa3f96cc4f859fc4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 13 Nov 2023 16:35:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: JuDKxv1jf1Hw0JXasvCaSg==
age: 50922
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 3007
x-ms-lease-status: unlocked
last-modified: Fri, 16 Dec 2022 04:11:35 GMT
server: cloudflare
etag: 0x8DADF1B9F221620
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: 2923bb09-701e-009c-7d78-1394e5000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 82586d80d8564d89-FRA

GET
H2 200 otPcPanel.json Show response
cdn.cookielaw.org/scripttemplates/202210.1.0/assets/v2/ 63 KB
12 KB 33ms
33ms Fetch
application/json 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202210.1.0/assets/v2/otPcPanel.json

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202210.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

1df9aee0014c1553fa6f462aa38714f3f35678bba639483b6141e42e52ec2951

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 13 Nov 2023 16:35:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: iFWm653zpCZXOB0KT4+Hvg==
age: 17759
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 12563
x-ms-lease-status: unlocked
last-modified: Fri, 16 Dec 2022 04:11:37 GMT
server: cloudflare
etag: 0x8DADF1BA09FC9E2
vary: Accept-Encoding
content-type: application/json
access-control-allow-origin: *
x-ms-request-id: a9344879-f01e-0059-74cc-0bbe00000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Content-Encoding,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 82586d80e85a4d89-FRA

GET
H2 200 otCommonStyles.css Show response
cdn.cookielaw.org/scripttemplates/202210.1.0/assets/ 21 KB
4 KB 31ms
31ms Fetch
text/css 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.cookielaw.org/scripttemplates/202210.1.0/assets/otCommonStyles.css

Requested by

Host: cdn.cookielaw.org
URL: https://cdn.cookielaw.org/scripttemplates/202210.1.0/otBannerSdk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

087d847ee64707e372f572145600ecbcb13f2dd2382fd8962326f2fed03dd85d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 13 Nov 2023 16:35:24 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: oQsmwuIlJWH4cKDxpI1ltA==
age: 17759
x-ms-lease-status: unlocked
last-modified: Fri, 16 Dec 2022 04:11:48 GMT
server: cloudflare
vary: Accept-Encoding
content-type: text/css
access-control-allow-origin: *
x-ms-request-id: 02f30c4e-f01e-0066-237f-eb76a3000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 82586d80e85c4d89-FRA

POST
H2 200 collect Show response
www.google-analytics.com/j/ 4 B
208 B 18ms
17ms XHR
text/plain 2001:4860:4802:36::178
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&aip=1&a=589160523&t=pageview&_s=1&dl=https%3A%2F%2Fwww.quest.com%2Fevent%2Ftec-talk-abusing-group-policy-for-fun-and-profit-%2F%3Futm_source%3Deloqua10%26utm_medium%3Ddirect-email%26utm_campaign%3Decard-83906-77941-5%26utm_term%3D%26utm_content%3Demail_ecard%26utm_source%3Dshare_point_wow%26utm_medium%3DDirect-3rd%2520Party%2520Vendor%26utm_campaign%3DFY2024_Q4_All_TEC_Talk_Series_AbusingGPO_SPWoW_12723%26utm_term%3D%26utm_content%3Demail_ecard&ul=en-us&de=UTF-8&dt=Identify%20and%20Counteract%20Group%20Policy%20Attackers&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YEBAAEABAAAAACAAI~&jid=833162341&gjid=759324288&cid=749778601.1699893325&tid=UA-84081903-1&_gid=705154382.1699893325&_r=1&_slc=1&gtm=45He3b81n71M8J6VXv72551518&cg1=Online&cg2=Platform%20Management&cg3=Microsoft%20Platform%20Management&cg4=GPOADmin&cg5=Active%20Directory&cd20=&cd34=www.quest.com&cd35=en-us&cd36=Platform%20Management&cd37=Active%20Directory&cd39=Quest%20Software&cd50=Microsoft%20Platform%20Management&cd51=GPOADmin&cd52=Online&cd53=null&cd54=English&cd55=1164172&cd56=Direct&cd57=&cd58=&cd59=Anonymous&cd60=no%20value&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&z=1132740755

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:36::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.quest.com/
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Mon, 13 Nov 2023 16:35:24 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.quest.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 collect
www.google-analytics.com/ 35 B
132 B 14ms
14ms Image
image/gif 2001:4860:4802:36::178
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j101&aip=1&a=589160523&t=event&ni=0&_s=1&dl=https%3A%2F%2Fwww.quest.com%2Fevent%2Ftec-talk-abusing-group-policy-for-fun-and-profit-%2F%3Futm_source%3Deloqua10%26utm_medium%3Ddirect-email%26utm_campaign%3Decard-83906-77941-5%26utm_term%3D%26utm_content%3Demail_ecard%26utm_source%3Dshare_point_wow%26utm_medium%3DDirect-3rd%2520Party%2520Vendor%26utm_campaign%3DFY2024_Q4_All_TEC_Talk_Series_AbusingGPO_SPWoW_12723%26utm_term%3D%26utm_content%3Demail_ecard&ul=en-us&de=UTF-8&dt=Identify%20and%20Counteract%20Group%20Policy%20Attackers&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=Form%20Impression&ea=Identify%20and%20Counteract%20Group%20Policy%20Attackers&el=Online&_u=YEDAAEABAAAAACAAI~&jid=&gjid=&cid=749778601.1699893325&tid=UA-84081903-1&_gid=705154382.1699893325&gtm=45He3b81n71M8J6VXv72551518&cg1=Online&cg2=Platform%20Management&cg3=Microsoft%20Platform%20Management&cg4=GPOADmin&cg5=Active%20Directory&cd20=&cd34=www.quest.com&cd35=en-us&cd36=Platform%20Management&cd37=Active%20Directory&cd39=Quest%20Software&cd50=Microsoft%20Platform%20Management&cd51=GPOADmin&cd52=Online&cd53=null&cd54=English&cd55=1164172&cd56=Direct&cd57=&cd58=&cd59=Anonymous&cd60=no%20value&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&z=1486782959

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2001:4860:4802:36::178 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Nov 2023 02:13:44 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 51700
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
244 B 49ms
19ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-LEL9V2KCH0&gtm=45je3b81v893017686z872551518&_p=1699893324578&_gaz=1&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=749778601.1699893325&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=1&sid=1699893324&sct=1&seg=0&dl=https%3A%2F%2Fwww.quest.com%2Fevent%2Ftec-talk-abusing-group-policy-for-fun-and-profit-%2F%3Futm_source%3Deloqua10%26utm_medium%3Ddirect-email%26utm_campaign%3Decard-83906-77941-5%26utm_term%3D%26utm_content%3Demail_ecard%26utm_source%3Dshare_point_wow%26utm_medium%3DDirect-3rd%2520Party%2520Vendor%26utm_campaign%3DFY2024_Q4_All_TEC_Talk_Series_AbusingGPO_SPWoW_12723%26utm_term%3D%26utm_content%3Demail_ecard&dt=Identify%20and%20Counteract%20Group%20Policy%20Attackers&en=page_view&_fv=1&_ss=1&ep.quest_domain=www.quest.com&ep.quest_locality=en-us&ep.quest_business_unit=Platform%20Management&ep.quest_portfolio=Active%20Directory&ep.quest_product_line=Quest%20Software&ep.quest_solution=Microsoft%20Platform%20Management&ep.quest_product=GPOADmin&ep.quest_page_template=Online&ep.quest_support_product=null&ep.quest_content_language=English&ep.quest_oasis_content_id=1164172&ep.quest_mrdb_id=&ep.debug_mode=true&ep.page_path_clean=https%3A%2F%2Fwww.quest.com%2Fevent%2Ftec-talk-abusing-group-policy-for-fun-and-profit-%2F&ep.quest_vwo_campaigns=none&up.quest_sso_id=&up.quest_support_account_id=&up.quest_user_type=Anonymous&tfd=1659
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-LEL9V2KCH0&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Nov 2023 16:35:25 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.quest.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
47 B 71ms
24ms Ping
text/plain 2a00:1450:400c:c0b::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-LEL9V2KCH0&cid=749778601.1699893325&gtm=45je3b81v893017686z872551518&aip=1&dma=1&dma_cps=sypham&gcd=11l1l1l1l1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-LEL9V2KCH0&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c0b::9d Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Nov 2023 16:35:25 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.quest.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.nl/ads/ 42 B
408 B 142ms
72ms Image
image/gif 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.nl/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-LEL9V2KCH0&cid=749778601.1699893325&gtm=45je3b81v893017686z872551518&aip=1&dma=1&dma_cps=sypham&gcd=11l1l1l1l1&z=1001388134

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Nov 2023 16:35:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
45 B 34ms
19ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-LEL9V2KCH0&gtm=45je3b81v893017686z872551518&_p=1699893324578&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=749778601.1699893325&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_s=2&sid=1699893324&sct=1&seg=0&dl=https%3A%2F%2Fwww.quest.com%2Fevent%2Ftec-talk-abusing-group-policy-for-fun-and-profit-%2F%3Futm_source%3Deloqua10%26utm_medium%3Ddirect-email%26utm_campaign%3Decard-83906-77941-5%26utm_term%3D%26utm_content%3Demail_ecard%26utm_source%3Dshare_point_wow%26utm_medium%3DDirect-3rd%2520Party%2520Vendor%26utm_campaign%3DFY2024_Q4_All_TEC_Talk_Series_AbusingGPO_SPWoW_12723%26utm_term%3D%26utm_content%3Demail_ecard&dt=Identify%20and%20Counteract%20Group%20Policy%20Attackers&en=form_engagement&ep.quest_domain=www.quest.com&ep.quest_locality=en-us&ep.quest_business_unit=Platform%20Management&ep.quest_portfolio=Active%20Directory&ep.quest_product_line=Quest%20Software&ep.quest_solution=Microsoft%20Platform%20Management&ep.quest_product=GPOADmin&ep.quest_page_template=Online&ep.quest_support_product=null&ep.quest_content_language=English&ep.quest_oasis_content_id=1164172&ep.quest_mrdb_id=&ep.debug_mode=true&ep.page_path_clean=https%3A%2F%2Fwww.quest.com%2Fevent%2Ftec-talk-abusing-group-policy-for-fun-and-profit-%2F&ep.quest_vwo_campaigns=none&ep.quest_category=Impression&_et=4&tfd=1675
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-LEL9V2KCH0&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Nov 2023 16:35:25 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.quest.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
348 B 49ms
23ms XHR
text/plain 2a00:1450:400c:c0b::9d
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-84081903-1&cid=749778601.1699893325&jid=833162341&gjid=759324288&_gid=705154382.1699893325&_u=YEBAAEAAAAAAACAAI~&z=2078640589

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c0b::9d Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

122fac0ffbb44fb8bba0388baa11afc67faec3b223a06871a40dbcab4c6cc787

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://www.quest.com/
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Mon, 13 Nov 2023 16:35:25 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.quest.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ot_close.svg
cdn.cookielaw.org/logos/static/ 651 B
624 B 30ms
30ms Image
image/svg+xml 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/ot_close.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 13 Nov 2023 16:35:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: pcXWFGpuVeSg/jVnYCseRg==
age: 40315
x-ms-lease-status: unlocked
last-modified: Thu, 09 Nov 2023 14:41:56 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 88e7c1fe-601e-0016-42ae-13cf54000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 82586d819aee92a1-FRA

GET
H2 200 quest-logo.png
cdn.cookielaw.org/logos/30ec3012-328d-409d-989c-d25ab77886c6/15e2aca6-d73e-4289-bb23-17c45da2441e/3224ce61-ccee-47d5-8bb2-cedc5587c667/ 2 KB
3 KB 33ms
33ms Image
image/png 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/30ec3012-328d-409d-989c-d25ab77886c6/15e2aca6-d73e-4289-bb23-17c45da2441e/3224ce61-ccee-47d5-8bb2-cedc5587c667/quest-logo.png

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ff6298370a197c5605edea3dafb812ec8b82ffbe14a99908f8d9f7b65afcfb81

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 13 Nov 2023 16:35:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-md5: 8CaNcgJ3JLUAycOnsi2dIw==
age: 47493
content-length: 2508
x-ms-lease-status: unlocked
last-modified: Fri, 21 Jul 2023 13:24:55 GMT
server: cloudflare
etag: 0x8DB89EDDFB0EE6A
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
x-ms-request-id: 1979f65a-701e-0078-4a49-149a7b000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
accept-ranges: bytes
cf-ray: 82586d81aaf992a1-FRA

GET
H2 200 powered_by_logo.svg
cdn.cookielaw.org/logos/static/ 5 KB
2 KB 28ms
28ms Image
image/svg+xml 2606:4700::6812:83ec
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cdn.cookielaw.org/logos/static/powered_by_logo.svg

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:83ec , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

x-ms-blob-type: BlockBlob
date: Mon, 13 Nov 2023 16:35:25 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
content-encoding: gzip
content-md5: Y+c301RBZNK39PvKQWrIBw==
age: 36050
x-ms-lease-status: unlocked
last-modified: Thu, 09 Nov 2023 14:41:56 GMT
server: cloudflare
vary: Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
x-ms-request-id: 6e028cbf-401e-0001-7189-13665f000000
access-control-expose-headers: x-ms-request-id,Server,x-ms-version,Content-Type,Last-Modified,ETag,Content-MD5,x-ms-lease-status,x-ms-blob-type,Content-Length,Date,Transfer-Encoding
cache-control: max-age=86400
x-ms-version: 2009-09-19
cf-ray: 82586d81aafb92a1-FRA

GET
H/1.1

200
OK

svrGP Show response
eloqua.quest.com/visitor/v200/
Redirect Chain

https://eloqua.quest.com/visitor/v200/svrGP?pps=50&siteid=1009272243&DLKey=9d29a2c2bdb94806b66d0347e569cc6d&DLLookup=&ms=57&firstPartyCookieDomain=eloqua.quest.com
https://eloqua.quest.com/visitor/v200/svrGP?pps=50&siteid=1009272243&DLKey=9d29a2c2bdb94806b66d0347e569cc6d&DLLookup=&ms=57&elq1pcGUID=3AF93E25CE364FCCBE5CDF5E079EA6F7

0
469 B

133ms
133ms

Script
application/javascript

147.154.41.192
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to

Full URL

https://eloqua.quest.com/visitor/v200/svrGP?pps=50&siteid=1009272243&DLKey=9d29a2c2bdb94806b66d0347e569cc6d&DLLookup=&ms=57&elq1pcGUID=3AF93E25CE364FCCBE5CDF5E079EA6F7

Requested by

Protocol

HTTP/1.1

Server

147.154.41.192 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 13 Nov 2023 16:35:25 GMT
X-Content-Type-Options: nosniff
Content-Type: application/javascript
P3P: CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Cache-Control: no-store
X-Robots-Tag: noindex, nofollow
Content-Length: 0
X-Xss-Protection: 1; mode=block
Expires: -1

Redirect headers

Pragma: no-cache
Date: Mon, 13 Nov 2023 16:35:25 GMT
X-Content-Type-Options: nosniff
Content-Type: text/html; charset=utf-8
P3P: CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Location: https://eloqua.quest.com/visitor/v200/svrGP?pps=50&siteid=1009272243&DLKey=9d29a2c2bdb94806b66d0347e569cc6d&DLLookup=&ms=57&elq1pcGUID=3AF93E25CE364FCCBE5CDF5E079EA6F7
Cache-Control: no-store
X-Robots-Tag: noindex, nofollow
Content-Length: 304
X-Xss-Protection: 1; mode=block
Expires: -1

GET
H/1.1 200
OK svrGP
eloqua.quest.com/visitor/v200/ 49 B
375 B 703ms
111ms Image
image/gif 147.154.41.192
ORACLE-BMC-31898

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://eloqua.quest.com/visitor/v200/svrGP?pps=3&siteid=1009272243&ref2=elqNone&tzo=-60&ms=57&optin=disabled&firstPartyCookieDomain=eloqua.quest.com

Requested by

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

147.154.41.192 Ashburn, United States, ASN31898 (ORACLE-BMC-31898, US),

Reverse DNS

Software

Resource Hash

f1ccea6b7204d9f7913ab45e1afa51d79f83bd4f0319de937b0132e6e02b1aab

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Pragma: no-cache
Date: Mon, 13 Nov 2023 16:35:25 GMT
X-Content-Type-Options: nosniff
Content-Type: image/gif
P3P: CP="IDC DSP COR DEVa TAIa OUR BUS PHY ONL UNI COM NAV CNT STA",
Cache-Control: no-store
X-Robots-Tag: noindex, nofollow
Content-Length: 49
X-Xss-Protection: 1; mode=block
Expires: -1

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
296 B 58ms
57ms Image
image/gif 2a00:1450:4001:82a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-84081903-1&cid=749778601.1699893325&jid=833162341&_u=YEBAAEAAAAAAACAAI~&z=2081594452

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Nov 2023 16:35:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.nl/ads/ 42 B
107 B 70ms
70ms Image
image/gif 2a00:1450:4001:800::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.nl/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-84081903-1&cid=749778601.1699893325&jid=833162341&_u=YEBAAEAAAAAAACAAI~&z=2081594452

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:800::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Nov 2023 16:35:25 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 anchor Show response
www.google.com/recaptcha/api2/ Frame F4A0 60 KB
33 KB 60ms
60ms Document
text/html 2a00:1450:4001:82a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lcc7R8nAAAAAAFeO6kK-jyFD_FpG7szmyfvO46t&co=aHR0cHM6Ly93d3cucXVlc3QuY29tOjQ0Mw..&hl=nl&v=fGZmEzpfeSeqDJiApS_XZ4Y2&size=invisible&cb=fn6y8p8jnuyc

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/fGZmEzpfeSeqDJiApS_XZ4Y2/recaptcha__nl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

aa57b27f80f2c82ec6bb1340b58281b10bacbbf544820f0aed97d564a6dc6990

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-33joVP1-gAuKaQnKcG7COA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.quest.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
accept-language: nl-NL,nl;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-33joVP1-gAuKaQnKcG7COA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Mon, 13 Nov 2023 16:35:25 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H2 200 formcomplete.js Show response
ws-assets.zoominfo.com/ 86 KB
27 KB 98ms
52ms Script
application/javascript 2606:4700::6810:880f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://ws-assets.zoominfo.com/formcomplete.js
Requested by: Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:880f , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: fe92edba1f5990d76e1817f250ee4aae144f4efa95b676733bdd4391f2b74cf1

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Mon, 13 Nov 2023 16:35:25 GMT
content-encoding: gzip
cf-cache-status: DYNAMIC
age: 1026
x-guploader-uploadid: ABPtcPrVECjY3DV-5f0ndizlwjYqSFmZv7IdQFv1pV2CY_0G_TrHxf0LVPunT67ZaCoXS-7zIAihocyoWw
x-goog-storage-class: STANDARD
x-goog-metageneration: 1
x-goog-stored-content-encoding: identity
alt-svc: h3=":443"; ma=86400
last-modified: Thu, 02 Nov 2023 11:05:05 GMT
server: cloudflare
etag: W/"bbabfd4493e8cf8aafea99a2f70825c0"
x-goog-hash: crc32c=4scEgA==, md5=u6v9RJPoz4qv6pmi9wglwA==
x-goog-generation: 1698923105172059
content-type: application/javascript
cache-control: public, max-age=3600
x-goog-stored-content-length: 87554
cf-ray: 82586d82bf3b65d6-FRA
expires: Mon, 13 Nov 2023 17:18:19 GMT

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/fGZmEzpfeSeqDJiApS_XZ4Y2/ Frame F4A0 55 KB
24 KB 93ms
30ms Stylesheet
text/css 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/fGZmEzpfeSeqDJiApS_XZ4Y2/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lcc7R8nAAAAAAFeO6kK-jyFD_FpG7szmyfvO46t&co=aHR0cHM6Ly93d3cucXVlc3QuY29tOjQ0Mw..&hl=nl&v=fGZmEzpfeSeqDJiApS_XZ4Y2&size=invisible&cb=fn6y8p8jnuyc

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Mon, 13 Nov 2023 14:51:39 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 6226
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24606
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 03:03:27 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Tue, 12 Nov 2024 14:51:39 GMT

GET
H3 200 recaptcha__nl.js Show response
www.gstatic.com/recaptcha/releases/fGZmEzpfeSeqDJiApS_XZ4Y2/ Frame F4A0 468 KB
187 KB 95ms
46ms Script
text/javascript 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/fGZmEzpfeSeqDJiApS_XZ4Y2/recaptcha__nl.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

82f0e1fb9a662917f52ca8afe5f6395a785586bfeb67d0211c95416c114c31e6

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Sat, 11 Nov 2023 02:17:34 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 224271
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 191782
x-xss-protection: 0
last-modified: Mon, 06 Nov 2023 03:03:27 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Sun, 10 Nov 2024 02:17:34 GMT

OPTIONS
H2 200 forms
ws.zoominfo.com/formcomplete-v2/ Frame 0
0 199ms
158ms Preflight
text/html 2606:4700::6810:880f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/formcomplete-v2/forms

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:880f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type
Access-Control-Request-Method: POST
Origin: https://www.quest.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,Authorization,visitorId,_zitok
access-control-allow-origin: https://www.quest.com
allow: POST
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 82586d8358a31da2-FRA
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Mon, 13 Nov 2023 16:35:25 GMT
server: cloudflare
via: 1.1 google
x-content-type-options: nosniff
x-powered-by: Express

POST forms
ws.zoominfo.com/formcomplete-v2/ 0
0

GET
H2 200 54e04f32.min.js Show response
scripts.demandbase.com/adobeanalytics/ 5 KB
3 KB 90ms
21ms Script
application/javascript 13.32.27.69
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://scripts.demandbase.com/adobeanalytics/54e04f32.min.js?_=1699893324456

Requested by

Host: www.quest.com
URL: https://www.quest.com/static/bundles/jsquest?v=A_3VHy20cYkljM8kEHFAwmaPmbscoKdkhHW1b2Aa-4Q1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.27.69 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-27-69.fra56.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

03b631979e4747f7a6d7250c8ad592c29cd0b5b0a8f816bd70ed82d544778da1

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

x-amz-version-id: qeQZel75ZJ.ToA2q1_90exPG4ypZ42EQ
content-encoding: gzip
via: 1.1 f891d17fa862cc74a05434e03fa58dca.cloudfront.net (CloudFront)
date: Mon, 13 Nov 2023 05:44:34 GMT
last-modified: Tue, 29 May 2018 22:22:00 GMT
server: AmazonS3
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-amz-cf-pop: FRA56-C2
age: 40242
etag: W/"7cb93b9354b5a3aaf6031d46f4471d23"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-amz-cf-id: YLdUT0ujazgtShhjpXv0ofvKuCfJRJUIrl0li6JRqqkaaQtc26-KZA==

GET
H3 200 logo_48.png
www.gstatic.com/recaptcha/api2/ Frame F4A0 2 KB
2 KB 31ms
31ms Image
image/png 2a00:1450:4001:811::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/logo_48.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/fGZmEzpfeSeqDJiApS_XZ4Y2/styles__ltr.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.gstatic.com/recaptcha/releases/fGZmEzpfeSeqDJiApS_XZ4Y2/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Sun, 12 Nov 2023 06:30:11 GMT
x-content-type-options: nosniff
age: 122714
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2228
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
expires: Sun, 19 Nov 2023 06:30:11 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame F4A0 15 KB
16 KB 69ms
20ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Sat, 11 Nov 2023 02:58:03 GMT
x-content-type-options: nosniff
age: 221842
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 10 Nov 2024 02:58:03 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame F4A0 15 KB
15 KB 74ms
25ms Font
font/woff2 2a00:1450:4001:831::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:831::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Fri, 10 Nov 2023 18:52:48 GMT
x-content-type-options: nosniff
age: 250957
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15552
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:33:02 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sat, 09 Nov 2024 18:52:48 GMT

GET
H3 200 webworker.js
www.google.com/recaptcha/api2/ Frame F4A0 102 B
135 B 40ms
40ms Other
text/javascript 2a00:1450:4001:82a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/webworker.js?hl=nl&v=fGZmEzpfeSeqDJiApS_XZ4Y2

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

0d7cb42fd074be8583dba473c3039471501f5a50af7a8fdc646310603157a412

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lcc7R8nAAAAAAFeO6kK-jyFD_FpG7szmyfvO46t&co=aHR0cHM6Ly93d3cucXVlc3QuY29tOjQ0Mw..&hl=nl&v=fGZmEzpfeSeqDJiApS_XZ4Y2&size=invisible&cb=fn6y8p8jnuyc
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

date: Mon, 13 Nov 2023 16:35:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
cross-origin-embedder-policy: require-corp
x-frame-options: SAMEORIGIN
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript; charset=UTF-8
cache-control: private, max-age=300
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Mon, 13 Nov 2023 16:35:25 GMT

GET
H/1.1 200
OK ip.json Show response
api.demandbase.com/api/v2/ 479 B
1 KB 143ms
69ms Script
application/javascript 52.222.236.63
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.demandbase.com/api/v2/ip.json?key=RTU6T7uCr6WSA4mB3KEcCUVbS64AxctMwPhNrj2r&callback=Dmdbase_CDC.callback&_=1699893324457

Requested by

Host: www.quest.com
URL: https://www.quest.com/static/bundles/jsquest?v=A_3VHy20cYkljM8kEHFAwmaPmbscoKdkhHW1b2Aa-4Q1

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

52.222.236.63 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-52-222-236-63.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

041ed3fde22fb4ed48a56c4b5dbff4b3276efccc98e80a933d39e0fd7c51ddc8

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

Date: Mon, 13 Nov 2023 16:35:25 GMT
Identification-Source: CENTRAL
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Via: 1.1 71c4b07776e0b6812900664940c9d7a6.cloudfront.net (CloudFront)
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
X-Amz-Cf-Pop: FRA56-P4
Transfer-Encoding: chunked
X-Cache: Miss from cloudfront
Connection: keep-alive
Request-ID: 34d62fb5-4166-4b80-9aed-a2770152f61a
Pragma: no-cache
Server: nginx
Vary: Accept-Encoding, Origin
Content-Type: application/javascript;charset=utf-8
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
Api-Version: v2
X-Amz-Cf-Id: -F9F8mJoGUamtrHA4Q_TRMq6qmxSUXSx269W50xngGqVTEZwdaFcYA==
Expires: Sun, 12 Nov 2023 16:35:25 GMT

POST
H3 200 reload Show response
www.google.com/recaptcha/api2/ Frame F4A0 35 KB
20 KB 78ms
78ms XHR
application/json 2a00:1450:4001:82a::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/reload?k=6Lcc7R8nAAAAAAFeO6kK-jyFD_FpG7szmyfvO46t

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/fGZmEzpfeSeqDJiApS_XZ4Y2/recaptcha__nl.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

22f5a0ff312cd19b7aa59758896cb6d96fb97375b1d101fb708165913b5c1595

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Lcc7R8nAAAAAAFeO6kK-jyFD_FpG7szmyfvO46t&co=aHR0cHM6Ly93d3cucXVlc3QuY29tOjQ0Mw..&hl=nl&v=fGZmEzpfeSeqDJiApS_XZ4Y2&size=invisible&cb=fn6y8p8jnuyc
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
Content-Type: application/x-protobuffer

Response headers

date: Mon, 13 Nov 2023 16:35:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
cache-control: private, max-age=0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Mon, 13 Nov 2023 16:35:25 GMT

GET
H2 200 jquery.dotdotdot.min.js Show response
www.quest.com/static/library/jQuery/ 8 KB
3 KB 22ms
22ms Script
application/javascript 2600:9000:211e:2c00:14:56cf:b500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.quest.com/static/library/jQuery/jquery.dotdotdot.min.js

Requested by

Host: www.quest.com
URL: https://www.quest.com/static/bundles/jsquest?v=A_3VHy20cYkljM8kEHFAwmaPmbscoKdkhHW1b2Aa-4Q1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:211e:2c00:14:56cf:b500:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

80e0069c73a01f7232629192667d4ed248190184eda5c04661d2d1bead2fa6d4

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/event/tec-talk-abusing-group-policy-for-fun-and-profit-/?utm_source=eloqua10&utm_medium=direct-email&utm_campaign=ecard-83906-77941-5&utm_term=&utm_content=email_ecard&utm_source=share_point_wow&utm_medium=Direct-3rd%20Party%20Vendor&utm_campaign=FY2024_Q4_All_TEC_Talk_Series_AbusingGPO_SPWoW_12723&utm_term=&utm_content=email_ecard
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
date: Sat, 11 Nov 2023 01:28:38 GMT
content-encoding: gzip
x-permitted-cross-domain-policies: None
via: 1.1 c1e2423613b2dcb4230386a2b285734e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C2
age: 227207
x-cache: Hit from cloudfront
x-ua-compatible: IE=edge,chrome=1
referrer-policy: strict-origin-when-cross-origin
last-modified: Sat, 11 Nov 2023 00:18:20 GMT
server
etag: W/"02e1f933414da1:0"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800, s-maxage=5184000
permissions-policy: camera=(), microphone=(), payment=()
x-amz-cf-id: CP0su-dKoUJsr9cQVfUjC3QiJMD00_7jNEfVZeRRCKg8rGbwqmpzdw==

GET
H2 200 jquery.matchheight.min.js Show response
www.quest.com/static/library/jQuery/ 5 KB
2 KB 22ms
22ms Script
application/javascript 2600:9000:211e:2c00:14:56cf:b500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.quest.com/static/library/jQuery/jquery.matchheight.min.js

Requested by

Host: www.quest.com
URL: https://www.quest.com/static/bundles/jsquest?v=A_3VHy20cYkljM8kEHFAwmaPmbscoKdkhHW1b2Aa-4Q1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:211e:2c00:14:56cf:b500:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

7e7ad6073552062f980060a8b0503228cd8c91608f398912b2848a9b47a0dcbc

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/event/tec-talk-abusing-group-policy-for-fun-and-profit-/?utm_source=eloqua10&utm_medium=direct-email&utm_campaign=ecard-83906-77941-5&utm_term=&utm_content=email_ecard&utm_source=share_point_wow&utm_medium=Direct-3rd%20Party%20Vendor&utm_campaign=FY2024_Q4_All_TEC_Talk_Series_AbusingGPO_SPWoW_12723&utm_term=&utm_content=email_ecard
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
date: Sat, 11 Nov 2023 01:23:35 GMT
content-encoding: gzip
x-permitted-cross-domain-policies: None
via: 1.1 c1e2423613b2dcb4230386a2b285734e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C2
age: 227509
x-cache: Hit from cloudfront
x-ua-compatible: IE=edge,chrome=1
referrer-policy: strict-origin-when-cross-origin
last-modified: Sat, 11 Nov 2023 00:18:20 GMT
server
etag: W/"02e1f933414da1:0"
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: application/javascript
cache-control: max-age=604800, s-maxage=5184000
permissions-policy: camera=(), microphone=(), payment=()
x-amz-cf-id: 4F7gV9VqnZkd1djjeG2glV2GMiXSPwiCIDPprYz_ywcf_e8Wg8qimA==

POST
H2 200 / Show response
www.quest.com/jsonreq/event/ 549 B
1 KB 493ms
492ms XHR
application/json 2600:9000:211e:2c00:14:56cf:b500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.quest.com/jsonreq/event/

Requested by

Host: www.quest.com
URL: https://www.quest.com/static/bundles/jsquest?v=A_3VHy20cYkljM8kEHFAwmaPmbscoKdkhHW1b2Aa-4Q1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:211e:2c00:14:56cf:b500:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

ebd0f7d57b9c3772968723e4446c118d66b84d236340a12f089028b4c131236a

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Accept: application/json, text/javascript, */*; q=0.01
Referer: https://www.quest.com/event/tec-talk-abusing-group-policy-for-fun-and-profit-/?utm_source=eloqua10&utm_medium=direct-email&utm_campaign=ecard-83906-77941-5&utm_term=&utm_content=email_ecard&utm_source=share_point_wow&utm_medium=Direct-3rd%20Party%20Vendor&utm_campaign=FY2024_Q4_All_TEC_Talk_Series_AbusingGPO_SPWoW_12723&utm_term=&utm_content=email_ecard
X-Requested-With: XMLHttpRequest
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
date: Mon, 13 Nov 2023 16:35:25 GMT
via: 1.1 c1e2423613b2dcb4230386a2b285734e.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: None
x-aspnet-version: 4.0.30319
x-amz-cf-pop: FRA56-C2
x-cache: Miss from cloudfront
content-length: 549
x-ua-compatible: IE=edge,chrome=1
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 13 Nov 2023 16:35:25 GMT
server
vary: *
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
access-control-allow-origin: https://www.quest.com
access-control-allow-methods: GET
cache-control: no-cache, no-store, must-revalidate
permissions-policy: camera=(), microphone=(), payment=()
access-control-allow-headers: *
x-amz-cf-id: ma1THUl4Hwq_UCQS6CRUK8BWMIlTgW7dZBkhBtpb-vyu5YNzSu7h2g==
expires: Mon, 13 Nov 2023 16:35:25 GMT

GET
H2 200 form_attention-red-circle.svg
www.quest.com/images/icons/svg/ 677 B
1 KB 24ms
23ms Image
image/svg+xml 2600:9000:211e:2c00:14:56cf:b500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.quest.com/images/icons/svg/form_attention-red-circle.svg

Requested by

Host: www.quest.com
URL: https://www.quest.com/static/css/form/reghandler.min.css?202311100718

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:211e:2c00:14:56cf:b500:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

881f63064fddba08ce51bec18640f19dc0b01f086997005b0eab7d54a8cd340b

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/static/css/form/reghandler.min.css?202311100718
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
date: Sat, 11 Nov 2023 01:23:37 GMT
via: 1.1 c1e2423613b2dcb4230386a2b285734e.cloudfront.net (CloudFront)
x-permitted-cross-domain-policies: None
x-aspnet-version: 4.0.30319
x-amz-cf-pop: FRA56-C2
age: 227508
x-cache: Hit from cloudfront
content-length: 677
x-ua-compatible: IE=edge,chrome=1
referrer-policy: strict-origin-when-cross-origin
server
x-frame-options: SAMEORIGIN
content-type: image/svg+xml
cache-control: public, max-age=604800
permissions-policy: camera=(), microphone=(), payment=()
x-amz-cf-id: oLFB-A6-1q7yVZIYnPh2V09NpQCPtLBAfxWT4wVOWBxpa0Z-tOFfqw==

POST
H2 200 getformdata Show response
www.quest.com/sso/ 2 KB
3 KB 539ms
539ms XHR
application/json 2600:9000:211e:2c00:14:56cf:b500:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://www.quest.com/sso/getformdata

Requested by

Host: www.quest.com
URL: https://www.quest.com/static/bundles/jsquest?v=A_3VHy20cYkljM8kEHFAwmaPmbscoKdkhHW1b2Aa-4Q1

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:211e:2c00:14:56cf:b500:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

7d1eeff9be14af509e30ee7c4b9c42a8292c7bdd23d664fb8672d4eafd27651f

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Request headers

Accept: */*
Referer: https://www.quest.com/event/tec-talk-abusing-group-policy-for-fun-and-profit-/?utm_source=eloqua10&utm_medium=direct-email&utm_campaign=ecard-83906-77941-5&utm_term=&utm_content=email_ecard&utm_source=share_point_wow&utm_medium=Direct-3rd%20Party%20Vendor&utm_campaign=FY2024_Q4_All_TEC_Talk_Series_AbusingGPO_SPWoW_12723&utm_term=&utm_content=email_ecard
X-Requested-With: XMLHttpRequest
accept-language: nl-NL,nl;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36
Content-Type: application/json; charset=UTF-8

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: upgrade-insecure-requests
x-content-type-options: nosniff
date: Mon, 13 Nov 2023 16:35:25 GMT
content-encoding: br
x-permitted-cross-domain-policies: None
x-aspnet-version: 4.0.30319
via: 1.1 c1e2423613b2dcb4230386a2b285734e.cloudfront.net (CloudFront)
x-amz-cf-pop: FRA56-C2
x-cache: Miss from cloudfront
x-ua-compatible: IE=edge,chrome=1
referrer-policy: strict-origin-when-cross-origin
last-modified: Mon, 13 Nov 2023 16:35:26 GMT
server
vary: Accept-Encoding, *
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
cache-control: no-cache, no-store, must-revalidate
permissions-policy: camera=(), microphone=(), payment=()
x-amz-cf-id: wrJHHQy9gbT0RC5tJIX6bAs3yixxTNKIX3rQZaYfpq0SOHjOc8DR6g==
expires: Mon, 13 Nov 2023 16:35:26 GMT

POST
H2 204 collect
region1.analytics.google.com/g/ 0
54 B 18ms
17ms Ping
text/plain 2001:4860:4802:34::36
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://region1.analytics.google.com/g/collect?v=2&tid=G-LEL9V2KCH0&gtm=45je3b81v893017686&_p=1699893324578&gcd=11l1l1l1l1&dma_cps=sypham&dma=1&cid=749778601.1699893325&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_eu=AEA&_s=3&sid=1699893324&sct=1&seg=0&dl=https%3A%2F%2Fwww.quest.com%2Fevent%2Ftec-talk-abusing-group-policy-for-fun-and-profit-%2F%3Futm_source%3Deloqua10%26utm_medium%3Ddirect-email%26utm_campaign%3Decard-83906-77941-5%26utm_term%3D%26utm_content%3Demail_ecard%26utm_source%3Dshare_point_wow%26utm_medium%3DDirect-3rd%2520Party%2520Vendor%26utm_campaign%3DFY2024_Q4_All_TEC_Talk_Series_AbusingGPO_SPWoW_12723%26utm_term%3D%26utm_content%3Demail_ecard&dt=Identify%20and%20Counteract%20Group%20Policy%20Attackers&en=scroll&ep.quest_domain=www.quest.com&ep.quest_locality=en-us&ep.quest_business_unit=Platform%20Management&ep.quest_portfolio=Active%20Directory&ep.quest_product_line=Quest%20Software&ep.quest_solution=Microsoft%20Platform%20Management&ep.quest_product=GPOADmin&ep.quest_page_template=Online&ep.quest_support_product=null&ep.quest_content_language=English&ep.quest_oasis_content_id=1164172&ep.quest_mrdb_id=&ep.debug_mode=true&ep.page_path_clean=https%3A%2F%2Fwww.quest.com%2Fevent%2Ftec-talk-abusing-group-policy-for-fun-and-profit-%2F&ep.quest_vwo_campaigns=none&epn.percent_scrolled=90&_et=9&tfd=6676
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-LEL9V2KCH0&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2001:4860:4802:34::36 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: nl-NL,nl;q=0.9
Referer: https://www.quest.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.6045.123 Safari/537.36

Response headers

pragma: no-cache
date: Mon, 13 Nov 2023 16:35:30 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.quest.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: ws.zoominfo.com
URL: https://ws.zoominfo.com/formcomplete-v2/forms

Verdicts & Comments Add Verdict or Comment

261 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

25 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.google.com/recaptcha	1970-01-20 20:30:45	Name: _GRECAPTCHA Value: 09AKFjXw5igo_tzM1a9uZ_b8XIVWgfKEIoMdszA8ULHsH9IB6VuOO9qOCBeZbOVExW1-SE4ViKJoWWd2ZcSPt4VwI
www.quest.com/	1969-12-31 23:59:59	Name: ASP.NET_SessionId Value: 13akipthiglldigfrmvo3btc
www.quest.com/	1970-01-20 16:11:47	Name: ipinfo Value: BiDobZQxomMfiYcxer7fN6iu5fzIsqWEb2pg79+XNSb2O5AFoTKk0uXb/CEQF7KcoUbkaK1L56p3SEpeDWaqV+C6YP4fstRyiFOLl05d4Kq3gRSQRWp51j5F9fZf7EUr9kPS0Pv3X+0kBDAsY3TYLMfxSTp0cw1DV8I+4Aic4ci84g8lcGfWjcVydSgnovzXAwjU3ACkPjWv+/gGi7afB7F7AhaWibXNUXFsw9AcpuM=
www.quest.com/	1970-01-20 16:11:47	Name: ccip Value: NL
.quest.com/	1970-01-21 00:58:35	Name: _vwo_uuid_v2 Value: D8352B3AFECE3C2C54892A35A184D3338\|245770ffafea800a2a68eb24b34d0a69
.quest.com/	1970-01-20 18:35:33	Name: _vis_opt_s Value: 1%7C
.quest.com/	1969-12-31 23:59:59	Name: _vis_opt_test_cookie Value: 1
.quest.com/	1970-01-21 01:47:33	Name: _vwo_uuid Value: D8352B3AFECE3C2C54892A35A184D3338
.quest.com/	1970-01-20 16:11:35	Name: _vwo_sn Value: 0%3A1
.quest.com/	1970-01-20 18:21:09	Name: _vwo_ds Value: 3%3At_0%2Ca_0%3A0%241699893324%3A61.37233461%3A%3A%3A920_0%2C594_0%2C591_0%3A0
.quest.com/	1970-01-20 16:12:59	Name: _gid Value: GA1.2.705154382.1699893325
.quest.com/	1970-01-20 16:11:33	Name: _gat_UA-84081903-1 Value: 1
.quest.com/	1970-01-21 01:47:33	Name: _ga Value: GA1.1.749778601.1699893325
.quest.com/	1970-01-21 01:47:33	Name: _ga_LEL9V2KCH0 Value: GS1.1.1699893324.1.0.1699893325.59.0.0
.quest.com/	1970-01-21 00:57:09	Name: OptanonConsent Value: isGpcEnabled=0&datestamp=Mon+Nov+13+2023+17%3A35%3A25+GMT%2B0100+(Central+European+Standard+Time)&version=202210.1.0&isIABGlobal=false&hosts=&consentId=3818fbde-0866-4409-98cc-36537bc201ad&interactionCount=0&landingPath=https%3A%2F%2Fwww.quest.com%2Fevent%2Ftec-talk-abusing-group-policy-for-fun-and-profit-%2F%3Futm_source%3Deloqua10%26utm_medium%3Ddirect-email%26utm_campaign%3Decard-83906-77941-5%26utm_term%3D%26utm_content%3Demail_ecard%26utm_source%3Dshare_point_wow%26utm_medium%3DDirect-3rd%2520Party%2520Vendor%26utm_campaign%3DFY2024_Q4_All_TEC_Talk_Series_AbusingGPO_SPWoW_12723%26utm_term%3D%26utm_content%3Demail_ecard&groups=C0001%3A1%2CC0002%3A0%2CC0003%3A0%2CC0004%3A0
.www.quest.com/	1970-01-21 01:47:33	Name: _zitok Value: 694f465b140203c6f5c51699893325
.zoominfo.com/	1970-01-20 16:11:35	Name: __cf_bm Value: pzdJgoBXDR0vq4VvAR.e2LLIk0UlX3RYSvTLD6vI0RY-1699893325-0-AbB+lHArAb02XbXjCYqZQ5zKM/4l7Tcf+yeYtDI7cLNHyBblu3p9hKINkpoPTiHR3iDSstc2tf7PTeM6iWIi35E=
.zoominfo.com/	1969-12-31 23:59:59	Name: _cfuvid Value: kGDdJiguR25xdAcweXhMDMrqqzqJWP_DdAPjiChgI7s-1699893325262-0-604800000
.quest.com/	1970-01-20 16:11:35	Name: dmdbase_cdc Value: DBSET
.quest.com/	1970-01-21 01:41:47	Name: ELOQUA Value: GUID=3AF93E25CE364FCCBE5CDF5E079EA6F7
www.quest.com/	1970-01-20 16:11:47	Name: CCountry Value: NL
www.quest.com/	1970-01-20 16:11:47	Name: CCity Value:
www.quest.com/	1970-01-20 16:11:47	Name: CState Value:
www.quest.com/	1970-01-20 16:11:47	Name: CZipCode Value:
www.quest.com/	1970-01-20 16:11:47	Name: CContinent Value: europe

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
javascript	error	URL: https://www.quest.com/event/tec-talk-abusing-group-policy-for-fun-and-profit-/?utm_source=eloqua10&utm_medium=direct-email&utm_campaign=ecard-83906-77941-5&utm_term=&utm_content=email_ecard&utm_source=share_point_wow&utm_medium=Direct-3rd%20Party%20Vendor&utm_campaign=FY2024_Q4_All_TEC_Talk_Series_AbusingGPO_SPWoW_12723&utm_term=&utm_content=email_ecard Message: Access to fetch at 'https://ws.zoominfo.com/formcomplete-v2/forms' from origin 'https://www.quest.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.
network	error	URL: https://ws.zoominfo.com/formcomplete-v2/forms Message: Failed to load resource: net::ERR_FAILED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	upgrade-insecure-requests
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api.demandbase.com
cdn.cookielaw.org
dev.visualwebsiteoptimizer.com
eloqua.quest.com
fonts.gstatic.com
geolocation.onetrust.com
img04.en25.com
js.zi-scripts.com
okt.to
region1.analytics.google.com
scripts.demandbase.com
sharepointwow.msnd36.com
static.oktopost.com
stats.g.doubleclick.net
ws-assets.zoominfo.com
ws.zoominfo.com
www.google-analytics.com
www.google.com
www.google.nl
www.googletagmanager.com
www.gstatic.com
www.quest.com
ws.zoominfo.com
13.32.27.69
147.154.41.192
172.64.150.44
2001:4860:4802:34::36
2001:4860:4802:36::178
212.32.243.39
23.201.242.231
23.22.90.252
2600:9000:211e:2c00:14:56cf:b500:93a1
2606:4700:4400::ac40:9b77
2606:4700::6810:880f
2606:4700::6812:83ec
2a00:1450:4001:800::2003
2a00:1450:4001:811::2003
2a00:1450:4001:811::2008
2a00:1450:4001:82a::2004
2a00:1450:4001:831::2003
2a00:1450:400c:c0b::9d
34.96.102.137
52.222.236.63
65.9.95.98
03b631979e4747f7a6d7250c8ad592c29cd0b5b0a8f816bd70ed82d544778da1
041ed3fde22fb4ed48a56c4b5dbff4b3276efccc98e80a933d39e0fd7c51ddc8
087d847ee64707e372f572145600ecbcb13f2dd2382fd8962326f2fed03dd85d
09016600a13dd4825b72516765a8da53d1ab896f7582c4619d014e8ee147ea84
0d53f77fff1259a2dfb79a2bf591c6d2d6ed83b1c3a641f870b95b2d63c5815a
0d7cb42fd074be8583dba473c3039471501f5a50af7a8fdc646310603157a412
122fac0ffbb44fb8bba0388baa11afc67faec3b223a06871a40dbcab4c6cc787
14e4d1596c6b58896dfce1fc1ec45372bab4d2259ba82828fa3f96cc4f859fc4
1828d18b9d5682896c68b4d3f0ec44f0f7b4fa542d3f77fe3380f1f904379a19
183d12345b8b0d6e43da6af21a2304cda143c2f606930fce76cbaa9744d5690a
1870049904b76677e993e47ea99edd2469da9cf297d08d5e5d76ee1bbe44041c
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
1df9aee0014c1553fa6f462aa38714f3f35678bba639483b6141e42e52ec2951
1f36e93dde16f7500a098910959e72a23302f7035728620949e08bbae9e1362f
22f5a0ff312cd19b7aa59758896cb6d96fb97375b1d101fb708165913b5c1595
251a75f73d214eeeaf404816367e701864ae1be30ee36e1ee8e3c309887bdb0f
2f1c8fc06e01de6f30b24981e471b1b953ac869fd90a7b4847a13964702bff7d
33110d24cbb506c398f40acebf7e9b4314b3644bda60332a7c993637c957bef1
3346de8e2ae1bfde250c7ac5c06f79a0a60c7faef8e5e08a2c9e8fbf5ec2c9e8
35875c8dae6618610b27ac6d33b8ee351418be07d035523002a82f4fee19f325
38a1b2e70e11dedc8b68368e3edbdcaac7bb7b1eb5772844adbe5f61f5b1ce1c
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
403909ce1feea6538db61ab128e2f9b3e8fe78edac67075f656bcc4a5b257de9
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
5fa00d047acd959697b9d7772c31dcd37bec33c70c6fbf80ab8316205d1d286d
6007f6c321ab41085605eb0881da619dfbb9824dc8f1f9cbb0bc4d67a573cb90
611d2ff08f41351a4c935f84ec2ae10b91409c24ae02aa30d9c7ac6401e04d2c
6b1fc966c38b12c845f9fd8bdb76027106b776783fd44eeed917663942b5fd16
6bffdf625fd550bff5346031cd658873315c5de1a71bc31e422ba2c48b15924a
7586b3b324be0c43f20efefbd4f77808c33a3e6bc96628ce2555236a44a2a3c7
7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050
7b83a741bcf43cef6c32366cf7028170fbd169b3ecd567e1c094a1797505f3bf
7d1eeff9be14af509e30ee7c4b9c42a8292c7bdd23d664fb8672d4eafd27651f
7e59fa377da48ee63c13d7cdf7562615936e6d23a79b7d39db24bca08185bd23
7e7ad6073552062f980060a8b0503228cd8c91608f398912b2848a9b47a0dcbc
80e0069c73a01f7232629192667d4ed248190184eda5c04661d2d1bead2fa6d4
82f0e1fb9a662917f52ca8afe5f6395a785586bfeb67d0211c95416c114c31e6
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
8427f81fd3164174d92821e69487b1f434cd4ce07272b7a24bb1a2e3c5fd2ea7
85b6e9042d49f69fcda9dc01f6ae2ca66ae5266eb48a1cfc2f8cc0eab07ffefd
881f63064fddba08ce51bec18640f19dc0b01f086997005b0eab7d54a8cd340b
8a97f240d4dd9e15bca1452da19e61acb55e38a7d1f2793251966c5d8630d42e
8ab6beaf3bad6beda71e7f3224691a978ab47f93b96191316982ddbed78f3994
8abce91738362d8e5d6e833b02de38f63e4145dd13b962352f3f142e61b61a41
901bb0e03b8c3c0a1cf4c487a177417328bb7d8c94106ecefceedd7d7f6c4ddc
94dbba0af4069efc778e6a959e67eda7125b0dc78cff69d626d711b7f8774931
a00b55dccdbe3a82e7fffbd3d0a4cfff5b52e013dec83d3fe8ad778abd1e0493
a466104bed9332c7688d4ce819fc6176d9feb8a477ec2e9e0fc26fb04f8e363f
aa57b27f80f2c82ec6bb1340b58281b10bacbbf544820f0aed97d564a6dc6990
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
aedebd36988d261171d6556a9a007e2ef93492015830be8ff215492da6139850
b0347f63501270e20ec8ef517183e157570483a24194a2fa4bc1034eba06e8dc
b388a2a5b662ef675b2a403883281bffe19424c45f79516752a015e695b78850
bbddcbb1662b13184f00cbaea3d7a200b22c4318bd8f7c99b09e314709e10bfa
c75e7d6a05ce5c317f889eea71b543604642361219ea01da129d84c1f481aa87
d26af1e6471d22222ac7f2f41720b75297871daa99c0c414c3e5dd5e3627fa9d
dd2727a5fc9720ac18b44ec82eb1a823416f1e48c6102cedfc9661beb88e5f8e
dd5f763eb2c421967419542a7a6de031d46e4d46b3b1c1743efbb707c7a02766
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e09a6456f1888624fff613819611bc406a3d6691403b5b14255cd2be909200a3
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e916478d94814b1a0c2680424c323db0514f4a022d16835cd7bcc754722308f4
ebd0f7d57b9c3772968723e4446c118d66b84d236340a12f089028b4c131236a
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f1ccea6b7204d9f7913ab45e1afa51d79f83bd4f0319de937b0132e6e02b1aab
f25057b2fb07064ac77c7eb014a3c45100b80acfce3bc91c0dec2b74912a749c
f890541721cc0577aea2bc3a0553fd1bba2479f6955f943cd5a4de1cb6966ec5
f97354a4659e6fc1cf05e27b59d333c697c1b0fd6fcaaceaa9af1f6886abe0af
f9a144d016db30ba861af6f2464d3df7bd55240b2c1b9635d6e2527320ec81ea
fe92edba1f5990d76e1817f250ee4aae144f4efa95b676733bdd4391f2b74cf1
ff6298370a197c5605edea3dafb812ec8b82ffbe14a99908f8d9f7b65afcfb81

www.quest.com Open in urlscan Pro 2600:9000:211e:2c00:14:56cf:b500:93a1 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Page URL History Show full URLs

Detected technologies

Page Statistics

84 Requests

98 %HTTPS

57 %IPv6

17 Domains

22 Subdomains

21 IPs

4 Countries

1603 kBTransfer

4507 kBSize

25 Cookies

32 Outgoing links

Page URL History

Redirected requests

84 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

www.quest.com Open in urlscan Pro
2600:9000:211e:2c00:14:56cf:b500:93a1 Public Scan

Screenshot
Live screenshot

Full Image

84
Requests

98 %
HTTPS

57 %
IPv6

17
Domains

22
Subdomains

21
IPs

4
Countries

1603 kB
Transfer

4507 kB
Size

25
Cookies

84 HTTP transactions
0 data transactions