hunt.io Open in urlscan Pro
35.71.142.77 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity
Submission: On December 11 via api (December 11th 2024, 8:57:53 am UTC) from IN — Scanned from US

Summary HTTP 60 Redirects Links 7 Behaviour Indicators

Summary

This website contacted 9 IPs in 1 countries across 7 domains to perform 60 HTTP transactions. The main IP is 35.71.142.77, located in United States and belongs to AMAZON-02, US. The main domain is hunt.io.
TLS certificate: Issued by WR1 on December 1st 2024. Valid for: 3 months.

This is the only time hunt.io was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1	35.71.142.77 35.71.142.77	16509 (AMAZON-02) (AMAZON-02)
1	2607:f8b0:400... 2607:f8b0:4006:81e::2008	15169 (GOOGLE) (GOOGLE)
28	2600:9000:266... 2600:9000:266a:2200:d:ada1:a280:93a1	16509 (AMAZON-02) (AMAZON-02)
2	13.226.94.26 13.226.94.26	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:261... 2600:9000:261f:fa00:d:6b42:4ec0:93a1	16509 (AMAZON-02) (AMAZON-02)
3	3.5.21.37 3.5.21.37	14618 (AMAZON-AES) (AMAZON-AES)
1	2607:f8b0:400... 2607:f8b0:4004:c1f::66	15169 (GOOGLE) (GOOGLE)
23	18.238.80.36 18.238.80.36	16509 (AMAZON-02) (AMAZON-02)
2 2	2600:9000:21d... 2600:9000:21da:f000:10:9b9d:b9c0:93a1	16509 (AMAZON-02) (AMAZON-02)
60	9

1 35.71.142.77 (United States)

ASN16509 (AMAZON-02, US)
PTR: a0b1d980e1f2226c6.awsglobalaccelerator.com

hunt.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4006:81e::2008 (United States)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

28 2600:9000:266a:2200:d:ada1:a280:93a1 (United States)

ASN16509 (AMAZON-02, US)

framerusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 13.226.94.26 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-226-94-26.jfk52.r.cloudfront.net

events.framer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:261f:fa00:d:6b42:4ec0:93a1 (United States)

ASN16509 (AMAZON-02, US)

app.framerstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 3.5.21.37 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: s3-r-w.us-east-1.amazonaws.com

public-hunt-static-blog-assets.s3.us-east-1.amazonaws.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2607:f8b0:4004:c1f::66 (Washington, United States)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

23 18.238.80.36 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-238-80-36.jfk52.r.cloudfront.net

framerusercontent.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2600:9000:21da:f000:10:9b9d:b9c0:93a1 (United States) 2 redirects

ASN16509 (AMAZON-02, US)

framer.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
51	framerusercontent.com framerusercontent.com — Cisco Umbrella Rank: 25787	1 MB
4	framer.com 2 redirects events.framer.com — Cisco Umbrella Rank: 40059 framer.com — Cisco Umbrella Rank: 36284	8 KB
3	amazonaws.com public-hunt-static-blog-assets.s3.us-east-1.amazonaws.com	34 KB
1	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 36
1	framerstatic.com app.framerstatic.com — Cisco Umbrella Rank: 206034	20 KB
1	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 39	108 KB
1	hunt.io hunt.io	46 KB
60	7

	Domain	Requested by
51	framerusercontent.com	hunt.io framerusercontent.com
3	public-hunt-static-blog-assets.s3.us-east-1.amazonaws.com	hunt.io
2	framer.com	2 redirects
2	events.framer.com	hunt.io events.framer.com
1	www.google-analytics.com	www.googletagmanager.com
1	app.framerstatic.com	hunt.io
1	www.googletagmanager.com	hunt.io
1	hunt.io
60	8

This site contains links to these domains. Also see Links.

Domain
app.hunt.io
www.cobaltstrike.com
www.amnesty.org
x.com
www.linkedin.com

Subject Issuer	Validity	Valid
hunt.io WR1	`2024-12-01` - `2025-03-01`	3 months	crt.sh
*.google-analytics.com WR2	`2024-11-04` - `2025-01-27`	3 months	crt.sh
framerusercontent.com Amazon RSA 2048 M03	`2024-11-16` - `2025-12-14`	a year	crt.sh
events.framer.com Amazon RSA 2048 M03	`2024-04-09` - `2025-05-07`	a year	crt.sh
framerstatic.com Amazon RSA 2048 M02	`2024-09-22` - `2025-10-20`	a year	crt.sh
s3.amazonaws.com Amazon RSA 2048 M01	`2024-11-18` - `2025-11-07`	a year	crt.sh

This page contains 1 frames:

Primary Page: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity
Frame ID: A241E6FBFF8D8C55763711027FA1E559
Requests: 60 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Rare Watermark Links Cobalt Strike 4.10 Team Servers to Ongoing Suspicious Activity

Detected technologies

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtag/js

Page Statistics

60
Requests

97 %
HTTPS

56 %
IPv6

7
Domains

8
Subdomains

9
IPs

1
Countries

1485 kB
Transfer

5301 kB
Size

2
Cookies

7 Outgoing links

These are links going to different origins than the main page.

URL: https://app.hunt.io/dashboard
Title: Login

Search URL Search Domain Scan URL

URL: https://www.cobaltstrike.com/blog/cobalt-strike-410-through-the-beacongate
Title: Cobalt Strike 4.10

Search URL Search Domain Scan URL

URL: https://app.hunt.io/search/detail/44.203.181.185
Title: Hunt

Search URL Search Domain Scan URL

URL: https://app.hunt.io/assoc/44.203.181.185
Title: Hunt

Search URL Search Domain Scan URL

URL: https://www.amnesty.org/en/latest/research/2020/09/german-made-finspy-spyware-found-in-egypt-and-mac-and-linux-versions-revealed/
Title: Amnesty International

Search URL Search Domain Scan URL

URL: https://x.com/Huntio?t=tNAyMYy3rMSrq6u0XIpZRg&s=09

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/hunt-intelligence-inc/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 39

https://framer.com/m/phosphor-icons/Sun.js@0.0.53 HTTP 302
https://framerusercontent.com/modules/wp6xzA2QrHTqCWJAsoKa/Hyhw8DdNtDxDqd366SY7/Sun.js

Request Chain 40

https://framer.com/m/phosphor-icons/Moon.js@0.0.53 HTTP 302
https://framerusercontent.com/modules/qdFz1d7MF7d8Wsxrv3Ew/tbOlJ2GGWCCiI25KWvfU/Moon.js

60 HTTP transactions
1 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity Show response
hunt.io/blog/ 557 KB
46 KB 268ms
100ms Document
text/html 35.71.142.77
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

35.71.142.77 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

a0b1d980e1f2226c6.awsglobalaccelerator.com

Software

Framer/32b700c /

Resource Hash

735103ff08357f02f897a41eaaddab0492f9962697b44c7d5937cd6fe999dd67

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc: h3=":443"; ma=2592000
cache-control: public, max-age=0, must-revalidate
content-encoding: br
content-length: 46687
content-type: text/html
date: Wed, 11 Dec 2024 08:57:46 GMT
etag: "51e2af52132b96eddccddd4ff0685171"
last-modified: Tue, 10 Dec 2024 16:52:44 GMT
link: <https://framerusercontent.com>; rel="preconnect", <https://framerusercontent.com>; rel="preconnect"; crossorigin=""
server: Framer/32b700c
server-timing: region;desc="us-west-2", cache;desc="cached", ssg-status;desc="optimized", version;desc="32b700c"
strict-transport-security: max-age=31536000
vary: Accept-Encoding

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 323 KB
108 KB 454ms
161ms Script
application/javascript 2607:f8b0:4006:81e::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-CKJY21YJ7N

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2607:f8b0:4006:81e::2008 , United States, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

9b262903031bac954a107f6aab50d7735135e7a946ab18e1351df9d49a9159ff

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hunt.io/

Response headers

content-encoding: br
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires: Wed, 11 Dec 2024 08:57:46 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 11 Dec 2024 08:57:46 GMT
content-type: application/javascript; charset=UTF-8
vary: Accept-Encoding
access-control-allow-headers: Cache-Control
strict-transport-security: max-age=31536000; includeSubDomains
cache-control: private, max-age=900
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin: *
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 109873
x-xss-protection: 0
server: Google Tag Manager

GET
H2 200 chunk-7PZR57LV.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 657 KB
186 KB 433ms
155ms Script
text/javascript 2600:9000:266a:2200:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-7PZR57LV.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:266a:2200:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

ca91ca3baad1db28d57e2e66c1636b41d0b1ebeec150cd744ed7612cfade3310

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://hunt.io/

Response headers

access-control-max-age: 0
content-encoding: br
etag: W/"d31ef3a1c75a5b9c5016323bad637661"
x-amz-version-id: ydn.bpnyqfYZCo8jDH6K0IQhWPSwzo6Y
age: 60825
access-control-allow-methods: GET
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: qNw60u1w7d18x2c_OQ4r5qCnUQWUCmAa3MeosUFg_QUv4SvfoDAsSw==
date: Tue, 10 Dec 2024 16:04:02 GMT
content-type: text/javascript
last-modified: Tue, 10 Dec 2024 15:58:53 GMT
vary: Accept-Encoding,Origin
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: PENDING
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-rid;desc="qNw60u1w7d18x2c_OQ4r5qCnUQWUCmAa3MeosUFg_QUv4SvfoDAsSw==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=3
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 9feee68c149ffc812d2a7f5683100dd2.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 chunk-JR5VT52U.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 1 KB
1 KB 867ms
615ms Script
text/javascript 2600:9000:266a:2200:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-JR5VT52U.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:266a:2200:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

8b91ee4af78a9558d2bbbc889b190d7c47647405fabc8ae5be1c014d6c938228

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://hunt.io/

Response headers

access-control-max-age: 0
content-encoding: br
etag: W/"8dc2caa5dfa40c0964a44a081b0b17d9"
x-amz-version-id: _8xnJxoEpvTiFxGHHyvVZ85IFf3u.3cf
age: 2471074
access-control-allow-methods: GET
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: z2FFoU70JGt3_o7e-yqbEQpgqvRihekzyI_OYEnDb4aN8BrK8Uwzag==
date: Tue, 12 Nov 2024 18:33:13 GMT
content-type: text/javascript
last-modified: Tue, 12 Nov 2024 18:22:56 GMT
vary: Accept-Encoding,Origin
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-rid;desc="z2FFoU70JGt3_o7e-yqbEQpgqvRihekzyI_OYEnDb4aN8BrK8Uwzag==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=1
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 9feee68c149ffc812d2a7f5683100dd2.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 chunk-DOOU7OF4.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 9 KB
4 KB 658ms
406ms Script
text/javascript 2600:9000:266a:2200:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-DOOU7OF4.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:266a:2200:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

e7ded5e12508f728778cdc968bf945badfc120ce873943924e0a6dd516871c7e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://hunt.io/

Response headers

access-control-max-age: 0
content-encoding: br
etag: W/"589ac5e5c1ef313d2dd8e35dc038ac21"
x-amz-version-id: oD73PY_Rt0C23.Tz9gMPqTn.Rn0UE9Rx
age: 60825
access-control-allow-methods: GET
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: OpUAwcIqDtQjfrrr94O0rfN1nFpOUK7tO5SIh1p8fGxmkyVW13hADQ==
date: Tue, 10 Dec 2024 16:04:02 GMT
content-type: text/javascript
last-modified: Tue, 10 Dec 2024 15:58:53 GMT
vary: Accept-Encoding,Origin
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: PENDING
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-rid;desc="OpUAwcIqDtQjfrrr94O0rfN1nFpOUK7tO5SIh1p8fGxmkyVW13hADQ==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=4
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 9feee68c149ffc812d2a7f5683100dd2.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 chunk-RIUMFBNJ.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 447 B
1 KB 864ms
613ms Script
text/javascript 2600:9000:266a:2200:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-RIUMFBNJ.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:266a:2200:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

a9428e5e5f6c5ede3339114a8be6230e2cc39a2190d03f1092ae93bdaf556891

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://hunt.io/

Response headers

access-control-max-age: 0
etag: "30ed32fa3444df726bb60d89113cf478"
x-amz-version-id: 7vfweQgXPw5HumsSi2rUSCmzIK1fKK7F
age: 4201512
access-control-allow-methods: GET
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: RJqqcN_JsPWOmGnA5OKw404cdsQpP7Q1zc9uF32-P8uBnMrOoMnoaQ==
date: Wed, 23 Oct 2024 17:52:35 GMT
content-type: text/javascript
last-modified: Tue, 22 Oct 2024 16:32:06 GMT
vary: Origin
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-rid;desc="RJqqcN_JsPWOmGnA5OKw404cdsQpP7Q1zc9uF32-P8uBnMrOoMnoaQ==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=5
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 9feee68c149ffc812d2a7f5683100dd2.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 447
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 3NOfmhLkro7nMnJ1Ukn9qft3G68X4tv5oy_-RbaqfP8.UDELJTMX.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 380 KB
50 KB 656ms
405ms Script
text/javascript 2600:9000:266a:2200:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/3NOfmhLkro7nMnJ1Ukn9qft3G68X4tv5oy_-RbaqfP8.UDELJTMX.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:266a:2200:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

19d418a2f626fc1c0356c26eb11f3ee19295720ac760dc28463e75bfafabb1d4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://hunt.io/

Response headers

access-control-max-age: 0
content-encoding: br
etag: W/"312965149b43745df19ebb3646a49187"
x-amz-version-id: CsiOZNoHMTcKkZkWhRweeo1PFjl80IgX
age: 57826
access-control-allow-methods: GET
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: Wo0MV7cE-OaJdzUFvoXbgr4nAj8RxQ8HOiyeJR0Q2g0ii_5Zqgjevg==
date: Tue, 10 Dec 2024 16:54:01 GMT
content-type: text/javascript
last-modified: Tue, 10 Dec 2024 16:52:32 GMT
vary: Accept-Encoding,Origin
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: PENDING
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-rid;desc="Wo0MV7cE-OaJdzUFvoXbgr4nAj8RxQ8HOiyeJR0Q2g0ii_5Zqgjevg==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=4
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 9feee68c149ffc812d2a7f5683100dd2.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 chunk-2VZXA2FB.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 3 KB
2 KB 656ms
405ms Script
text/javascript 2600:9000:266a:2200:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-2VZXA2FB.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:266a:2200:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

24bd03c6988e57312952d42ebbd11a362b0be97ff666d3d6ac8f3597174c56b6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://hunt.io/

Response headers

access-control-max-age: 0
content-encoding: br
etag: W/"4b4dc1288d4d44143b9e6fe8df9e4b6e"
x-amz-version-id: hk8yEBKXPBLqOXukKKa845iu4h0Sc3Sv
age: 1095085
access-control-allow-methods: GET
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: w0DL0Nc6BQX83VpO2cwL3VJfUurJX-NY_qVPxq2Xoj3C70wlGHngMw==
date: Thu, 28 Nov 2024 16:46:22 GMT
content-type: text/javascript
last-modified: Thu, 28 Nov 2024 16:33:32 GMT
vary: Accept-Encoding,Origin
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-rid;desc="w0DL0Nc6BQX83VpO2cwL3VJfUurJX-NY_qVPxq2Xoj3C70wlGHngMw==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=4
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 9feee68c149ffc812d2a7f5683100dd2.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 chunk-6QJAY4QR.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 269 KB
66 KB 445ms
441ms Script
text/javascript 2600:9000:266a:2200:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-6QJAY4QR.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:266a:2200:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

d1964a0c53200006e756ef0d0e32cea07deff44d89075cf26ae2afe3d85f43e2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://hunt.io/

Response headers

access-control-max-age: 0
content-encoding: br
etag: W/"3afe3347ed0aec09439983af47904a6d"
x-amz-version-id: zyo9Vn24E.niqDg3AEyJtLy_CnlZx88n
age: 57826
access-control-allow-methods: GET
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: fTlN2PKK-pnjhCQCI3VnDAYv-JU1ZIF83D_-q3mVG-iyNVzB02er0g==
date: Tue, 10 Dec 2024 16:54:01 GMT
content-type: text/javascript
last-modified: Tue, 10 Dec 2024 16:52:32 GMT
vary: Accept-Encoding,Origin
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: PENDING
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-rid;desc="fTlN2PKK-pnjhCQCI3VnDAYv-JU1ZIF83D_-q3mVG-iyNVzB02er0g==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=5
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 9feee68c149ffc812d2a7f5683100dd2.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 chunk-IQJXJS56.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 2 MB
461 KB 445ms
443ms Script
text/javascript 2600:9000:266a:2200:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-IQJXJS56.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:266a:2200:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

0d483fb31b7baa932fb38d9e974bcca41a9ecfa605e0d540b66e54e39fe69f6b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://hunt.io/

Response headers

access-control-max-age: 0
content-encoding: br
etag: W/"31dd62f5e78dc021748cb2e226a1a631"
x-amz-version-id: ha0.ZQo2WOP80YQTROckWsD0vmO7dcYH
age: 4718543
access-control-allow-methods: GET
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: 2m0Lf68g12V_vrvZ4QDSpTEY6fCONsYB1U0_3aHEjrXaCvHLO7Fi5Q==
date: Thu, 17 Oct 2024 18:15:24 GMT
content-type: text/javascript
last-modified: Thu, 17 Oct 2024 17:21:59 GMT
vary: Accept-Encoding,Origin
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-rid;desc="2m0Lf68g12V_vrvZ4QDSpTEY6fCONsYB1U0_3aHEjrXaCvHLO7Fi5Q==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=5
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 9feee68c149ffc812d2a7f5683100dd2.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 chunk-FXENASNC.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 390 KB
57 KB 444ms
442ms Script
text/javascript 2600:9000:266a:2200:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-FXENASNC.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:266a:2200:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

6fa7b05626f316594c613602ef5bed9327ca1941725837795dfc47414fb05cb5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://hunt.io/

Response headers

access-control-max-age: 0
content-encoding: br
etag: W/"2696554a7eb9bf9e3747d04c0b5f0360"
x-amz-version-id: FRRe_bV5sWEgclmgU3Du1hlU5_3MgCsn
age: 60825
access-control-allow-methods: GET
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: W94cyrCDO_gy3Ap-ARZ2T4hu6eR6TAbAGdXHet_q0mc2Zglj8N-O6w==
date: Tue, 10 Dec 2024 16:04:02 GMT
content-type: text/javascript
last-modified: Tue, 10 Dec 2024 15:58:53 GMT
vary: Accept-Encoding,Origin
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: PENDING
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-rid;desc="W94cyrCDO_gy3Ap-ARZ2T4hu6eR6TAbAGdXHet_q0mc2Zglj8N-O6w==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=5
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 9feee68c149ffc812d2a7f5683100dd2.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 chunk-AIWW63AC.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 55 KB
18 KB 445ms
442ms Script
text/javascript 2600:9000:266a:2200:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-AIWW63AC.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:266a:2200:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

dcb6c51ec0458017b4fc8364df113fc4556a9346ce84daafda08bc73fcd27539

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://hunt.io/

Response headers

access-control-max-age: 0
content-encoding: br
etag: W/"c3cfe8d46f0f118acfe59b0243a8cba4"
x-amz-version-id: hZJ6hCAsaBZGQbUuC8DONqNM3KckUnHx
age: 60825
access-control-allow-methods: GET
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: T8E08Mxx7_pRlyytMzIXy4ewuHUyZMptTwwBE1QtTFXvJiyebqd-7w==
date: Tue, 10 Dec 2024 16:04:02 GMT
content-type: text/javascript
last-modified: Tue, 10 Dec 2024 15:58:53 GMT
vary: Accept-Encoding,Origin
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: PENDING
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-rid;desc="T8E08Mxx7_pRlyytMzIXy4ewuHUyZMptTwwBE1QtTFXvJiyebqd-7w==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=5
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 9feee68c149ffc812d2a7f5683100dd2.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 chunk-N24P5JZY.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 22 KB
5 KB 446ms
443ms Script
text/javascript 2600:9000:266a:2200:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-N24P5JZY.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:266a:2200:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

af7863f53048fe6d665e912eb1a7438502bcd90275756bd57746711efd07ad1e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://hunt.io/

Response headers

access-control-max-age: 0
content-encoding: br
etag: W/"ba9ae5ccd01ced4534b15ed639fe510a"
x-amz-version-id: L991hsuWUzV8BUCU9Rw0ZcqAUGDolfsL
age: 60825
access-control-allow-methods: GET
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: YI4MN8e150rQypCMDDctcmSvDkfRhCWp8aXy4Z_p5NJvhqFvOGXqqw==
date: Tue, 10 Dec 2024 16:04:02 GMT
content-type: text/javascript
last-modified: Tue, 10 Dec 2024 15:58:52 GMT
vary: Accept-Encoding,Origin
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: PENDING
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-rid;desc="YI4MN8e150rQypCMDDctcmSvDkfRhCWp8aXy4Z_p5NJvhqFvOGXqqw==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=5
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 9feee68c149ffc812d2a7f5683100dd2.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 chunk-WNOMLQKT.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 145 KB
21 KB 446ms
444ms Script
text/javascript 2600:9000:266a:2200:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-WNOMLQKT.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:266a:2200:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

bad9ed8e37d8d1aee7eacb1761e4bf4a7ac110eec89a7e92ff35545023c37cd7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://hunt.io/

Response headers

access-control-max-age: 0
content-encoding: br
etag: W/"2d1c59a942931206e7cfd493cbbcb555"
x-amz-version-id: TcEpfVxNfQMKuvNPEVW3buQUrbvv6J2b
age: 60825
access-control-allow-methods: GET
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: ILmC3dBde3a-9vgBZ74VQpsjyOqZYJK8kZ7j4KaMRxsh3837C3q2rA==
date: Tue, 10 Dec 2024 16:04:02 GMT
content-type: text/javascript
last-modified: Tue, 10 Dec 2024 15:58:52 GMT
vary: Accept-Encoding,Origin
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: PENDING
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-rid;desc="ILmC3dBde3a-9vgBZ74VQpsjyOqZYJK8kZ7j4KaMRxsh3837C3q2rA==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=5
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 9feee68c149ffc812d2a7f5683100dd2.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 chunk-PLBDR7DK.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 781 B
2 KB 447ms
444ms Script
text/javascript 2600:9000:266a:2200:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-PLBDR7DK.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:266a:2200:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

a1e9b3da59fa84c73948363f79bd0cef61cdb495511606fa4c2d8a06ddc954d8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://hunt.io/

Response headers

access-control-max-age: 0
etag: "d480024738b25adf2a7e816ed250f955"
x-amz-version-id: PovNP8byXwJyFWixVyLVFATDcSUX4b8U
age: 60825
access-control-allow-methods: GET
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: EvVvzuumKgDOSt1tSXob_ZmGFBkEERO919f7YKLjlRKsdltDlWlrQQ==
date: Tue, 10 Dec 2024 16:04:02 GMT
content-type: text/javascript
last-modified: Tue, 10 Dec 2024 15:58:52 GMT
vary: Origin
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: PENDING
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-rid;desc="EvVvzuumKgDOSt1tSXob_ZmGFBkEERO919f7YKLjlRKsdltDlWlrQQ==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=5
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 9feee68c149ffc812d2a7f5683100dd2.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 781
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 chunk-4DBXZSQR.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 10 KB
2 KB 447ms
445ms Script
text/javascript 2600:9000:266a:2200:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-4DBXZSQR.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:266a:2200:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

dda3ae667335cfd45ec00006177baa81cdcffd2584b76e84cbfe1819b7425484

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://hunt.io/

Response headers

access-control-max-age: 0
content-encoding: br
etag: W/"25f1dd66e1da9cb89702f7fd019e7878"
x-amz-version-id: FPXKCpIiSSwwBP8GrMSj6GOY5VrqeSxl
age: 60825
access-control-allow-methods: GET
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: _OFhLw6ZcgWGNKBgG5HbTKIWS7D-8UvRCUAf0AOlzK4F2ldpdMvIJA==
date: Tue, 10 Dec 2024 16:04:02 GMT
content-type: text/javascript
last-modified: Tue, 10 Dec 2024 15:58:52 GMT
vary: Accept-Encoding,Origin
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-rid;desc="_OFhLw6ZcgWGNKBgG5HbTKIWS7D-8UvRCUAf0AOlzK4F2ldpdMvIJA==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=6
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 9feee68c149ffc812d2a7f5683100dd2.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 chunk-MKDKQIQE.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 20 KB
5 KB 447ms
445ms Script
text/javascript 2600:9000:266a:2200:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-MKDKQIQE.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:266a:2200:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

a2cc6f4036b7ba96d44dc4a4489a50aad64157c4648bb10a37292575b85c02ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://hunt.io/

Response headers

access-control-max-age: 0
content-encoding: br
etag: W/"a5a493f35b5ac2e85c369329993e4f36"
x-amz-version-id: R71EISFPpiR1jYMYNJisL2I0FlYMzgrv
age: 60825
access-control-allow-methods: GET
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: YFdvnl6aX2rHa8qKucdOkfqSxbB0MrBz0bR08WQGduBqUEhudzwLjw==
date: Tue, 10 Dec 2024 16:04:02 GMT
content-type: text/javascript
last-modified: Tue, 10 Dec 2024 15:58:53 GMT
vary: Accept-Encoding,Origin
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: PENDING
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-rid;desc="YFdvnl6aX2rHa8qKucdOkfqSxbB0MrBz0bR08WQGduBqUEhudzwLjw==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=5
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 9feee68c149ffc812d2a7f5683100dd2.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 chunk-LCEZCQRN.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 700 B
2 KB 448ms
445ms Script
text/javascript 2600:9000:266a:2200:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-LCEZCQRN.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:266a:2200:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

c56899f4291eff03eed62b752565556777823419de3f2b5c9020c02a883ea8ae

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://hunt.io/

Response headers

access-control-max-age: 0
etag: "f7f362a6b630f4f80759edc1e4b1ba32"
x-amz-version-id: 3SYtMtS7QA9FChiL179Z6sr7ywtZA0GM
age: 60825
access-control-allow-methods: GET
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: 0lmzeSqswzqOxyNFdZ1HiP8FTJJBZuHiR4lWQc8e2JGrfh8H6CNG2Q==
date: Tue, 10 Dec 2024 16:04:02 GMT
content-type: text/javascript
last-modified: Tue, 10 Dec 2024 15:58:53 GMT
vary: Origin
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: PENDING
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-rid;desc="0lmzeSqswzqOxyNFdZ1HiP8FTJJBZuHiR4lWQc8e2JGrfh8H6CNG2Q==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=6
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 9feee68c149ffc812d2a7f5683100dd2.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 700
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 chunk-Q2JEALBM.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 4 KB
3 KB 448ms
446ms Script
text/javascript 2600:9000:266a:2200:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-Q2JEALBM.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:266a:2200:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

449b30c2317c76c281158fa547bb61f301dd9f675b54699a8bfc5040648fda2d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://hunt.io/

Response headers

access-control-max-age: 0
content-encoding: br
etag: W/"85385ac97b505762e460a1f6ab0d821f"
x-amz-version-id: 3.jqbYAa1urwIhTE30p6Ac0pRSY55jI8
age: 60825
access-control-allow-methods: GET
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: UL64oC_A7R6373FHlkJ7VNf0YeqncLoa-IFl-3BKEHecM9XtUNXbbQ==
date: Tue, 10 Dec 2024 16:04:02 GMT
content-type: text/javascript
last-modified: Tue, 10 Dec 2024 15:58:53 GMT
vary: Accept-Encoding,Origin
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: PENDING
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-rid;desc="UL64oC_A7R6373FHlkJ7VNf0YeqncLoa-IFl-3BKEHecM9XtUNXbbQ==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=5
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 9feee68c149ffc812d2a7f5683100dd2.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 script_main.DVS43U5Q.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 13 KB
7 KB 526ms
524ms Script
text/javascript 2600:9000:266a:2200:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/script_main.DVS43U5Q.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:266a:2200:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

324a9989ddbb2f2467a735983838314194704fb724135401a55046f54e852cde

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://hunt.io/

Response headers

access-control-max-age: 0
content-encoding: br
etag: W/"ba762ee88aa0962ee71c2f469bb7e8c6"
x-amz-version-id: tVo24YqlM1fa1zfMef1tHpYucOnAnJ.g
age: 57826
access-control-allow-methods: GET
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: tl9epVeVvhnoJOzoAP-BFz1DoePlAGjvMLF8iBXKKH0n2MCIeiJ1-A==
date: Tue, 10 Dec 2024 16:54:01 GMT
content-type: text/javascript
last-modified: Tue, 10 Dec 2024 16:52:33 GMT
vary: Accept-Encoding,Origin
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: PENDING
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-rid;desc="tl9epVeVvhnoJOzoAP-BFz1DoePlAGjvMLF8iBXKKH0n2MCIeiJ1-A==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=6
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 9feee68c149ffc812d2a7f5683100dd2.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 script Show response
events.framer.com/ 18 KB
7 KB 434ms
154ms Script
text/javascript 13.226.94.26
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://events.framer.com/script

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.226.94.26 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-226-94-26.jfk52.r.cloudfront.net

Software

Resource Hash

89e61318afc569842f98ccd196ff7cfbb36ec69bad3af935dd5c7149b494fde4

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hunt.io/

Response headers

strict-transport-security: max-age=63072000; includeSubDomains; preload
x-amzn-remapped-content-length: 18177
timestamp: Wed, 11 Dec 2024 08:55:48 GMT
content-encoding: gzip
x-amz-apigw-id: CnoRtEBloAMETVg=
x-amzn-trace-id: Root=1-6759540a-570b440e26e464732a704f7e
x-amzn-requestid: 3cbe94e2-84b1-4446-9747-7e07cf52d49f
via: 1.1 b8e7e4d288487b86cfc6bcf59fb6d08c.cloudfront.net (CloudFront)
x-cache: Miss from cloudfront
content-length: 6204
x-amz-cf-id: zyiBeCxy5klXYlJn5CxhBdjr5rtlJBae3Dg_3Go1v8wDYdsajfu32Q==
date: Wed, 11 Dec 2024 08:57:46 GMT
content-type: text/javascript
x-amz-cf-pop: JFK52-P10

GET
H2 200 Wbt9vg2M3MLSUK6C8ZimtsouOws.webp
framerusercontent.com/images/ 52 KB
53 KB 275ms
155ms Image
image/avif 2600:9000:266a:2200:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://framerusercontent.com/images/Wbt9vg2M3MLSUK6C8ZimtsouOws.webp

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:266a:2200:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

af40af5e1469d7ef41aee9645556b634ada06969e8a9babf4d4e17c38aad2caf

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/enforce;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hunt.io/

Response headers

etag: "294afbee86a7b816bb58ca4b178d9a09"
age: 673464
x-content-type-options: nosniff
x-amzn-requestid: 0a40e9b2-0af7-4bf3-be26-e644a48199c7
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: p62UD1oZYsbDWnJmmW_Jr9ekOF7dKSJU6dcl5QJWoXbFKA9XuSv1JQ==
date: Tue, 03 Dec 2024 13:53:22 GMT
content-type: image/avif
vary: Accept
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/enforce;
cache-control: public, max-age=31536000, stale-while-revalidate=31536000
timing-allow-origin: *
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-rid;desc="p62UD1oZYsbDWnJmmW_Jr9ekOF7dKSJU6dcl5QJWoXbFKA9XuSv1JQ==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=2
cross-origin-resource-policy: cross-origin
x-amzn-trace-id: Root=1-674f0d51-557acc861003e14f1c9dff39;Sampled=1;Lineage=1:f456f256:0
referrer-policy: strict-origin-when-cross-origin
via: 1.1 0af5e765fd55daca373799903bc0acde.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5

GET
H2 200 yVA9Oy9wbaBjaChzIOH78YiSFE.webp
framerusercontent.com/images/ 8 KB
9 KB 150ms
148ms Image
image/avif 2600:9000:266a:2200:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://framerusercontent.com/images/yVA9Oy9wbaBjaChzIOH78YiSFE.webp?scale-down-to=512

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:266a:2200:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a741fd3317fed44c0f1c7b8161f1420298b044e564dfea131957c0e27982a66c

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/enforce;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hunt.io/

Response headers

etag: "7231b098b0757259dd2bbfd90a7fb0f9"
age: 671320
x-content-type-options: nosniff
x-amzn-requestid: 3de1bf36-0c6a-42e8-bf76-49da9ceef860
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: uHfrkfUTvg3iQ1-NAUBjGmgo3jdCkKFeJpd6Ke51aggHyWpLUF7JkQ==
date: Tue, 03 Dec 2024 14:29:06 GMT
content-type: image/avif
vary: Accept
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/enforce;
cache-control: public, max-age=31536000, stale-while-revalidate=31536000
timing-allow-origin: *
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-rid;desc="uHfrkfUTvg3iQ1-NAUBjGmgo3jdCkKFeJpd6Ke51aggHyWpLUF7JkQ==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=3
cross-origin-resource-policy: cross-origin
x-amzn-trace-id: Root=1-674f15b1-78bc758e7f872fa50e191290;Sampled=1;Lineage=1:f456f256:0
referrer-policy: strict-origin-when-cross-origin
via: 1.1 0af5e765fd55daca373799903bc0acde.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5

GET
H2 200 6odJFlTcHq1fzIBehjj2s4p9DY.webp
framerusercontent.com/images/ 7 KB
8 KB 161ms
160ms Image
image/avif 2600:9000:266a:2200:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://framerusercontent.com/images/6odJFlTcHq1fzIBehjj2s4p9DY.webp?scale-down-to=512

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:266a:2200:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

4dc2a5162f03c1768634a7d933f034a800807b5324368e398cdbfc038a06d395

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/enforce;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hunt.io/

Response headers

etag: "b3fc6d3f97ac740ee5904dc1c19ead8d"
age: 673463
x-content-type-options: nosniff
x-amzn-requestid: bcf9756b-a7f3-480e-9de4-39e71cd81437
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: 9ad36fdIwLa2WXy4imVu4Gr-zkFdGI4kGyImlAWG3lr1rXmOmB3kaA==
date: Tue, 03 Dec 2024 13:53:23 GMT
content-type: image/avif
vary: Accept
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/enforce;
cache-control: public, max-age=31536000, stale-while-revalidate=31536000
timing-allow-origin: *
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-rid;desc="9ad36fdIwLa2WXy4imVu4Gr-zkFdGI4kGyImlAWG3lr1rXmOmB3kaA==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=3
cross-origin-resource-policy: cross-origin
x-amzn-trace-id: Root=1-674f0d52-3771963431d7a22b4add2727;Parent=1f553ee76613da3a;Sampled=0;Lineage=1:f456f256:0
referrer-policy: strict-origin-when-cross-origin
via: 1.1 0af5e765fd55daca373799903bc0acde.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5

GET
H2 200 cJA8dVwYG5AXjO4aXVKQ9QdZFg.webp
framerusercontent.com/images/ 8 KB
9 KB 183ms
182ms Image
image/avif 2600:9000:266a:2200:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://framerusercontent.com/images/cJA8dVwYG5AXjO4aXVKQ9QdZFg.webp?scale-down-to=512

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:266a:2200:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

341f61d7c3838f9e303327f41376afcc21e5e7e5d5408b795be682dcd97cde43

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/enforce;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hunt.io/

Response headers

etag: "e1a9183cb012ee35efa98e49b5e794c7"
age: 673463
x-content-type-options: nosniff
x-amzn-requestid: ccc06360-8d94-47a9-b091-1b302a6ae954
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: 1JdygSBKYS1zQHc4bcGO3m69xfUif87yGi-rwdRwYBoQkdGJxag55w==
date: Tue, 03 Dec 2024 13:53:23 GMT
content-type: image/avif
vary: Accept
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/enforce;
cache-control: public, max-age=31536000, stale-while-revalidate=31536000
timing-allow-origin: *
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-rid;desc="1JdygSBKYS1zQHc4bcGO3m69xfUif87yGi-rwdRwYBoQkdGJxag55w==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=3
cross-origin-resource-policy: cross-origin
x-amzn-trace-id: Root=1-674f0d52-337d67ec3b1a02f00d068755;Sampled=1;Lineage=1:f456f256:0
referrer-policy: strict-origin-when-cross-origin
via: 1.1 0af5e765fd55daca373799903bc0acde.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5

GET
H2 200 fOXtYSvzsNlw0tzPVKMsf72n0.png
framerusercontent.com/images/ 24 KB
25 KB 225ms
224ms Image
image/avif 2600:9000:266a:2200:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://framerusercontent.com/images/fOXtYSvzsNlw0tzPVKMsf72n0.png?scale-down-to=2048

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:266a:2200:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

e1d4e429bec9bc36a28143018ae0400faee2ea7ffe9442942794e016a094220c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hunt.io/

Response headers

etag: "a5fd6921c78d186fd22e12abbea6a593"
age: 16491623
x-content-type-options: nosniff
x-amzn-requestid: 9df5ba47-2ec8-4bec-96e9-11a9fef30e48
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: -0qvPCZFR--DEwrfsJpo_3vWgpr5TgeJ42afZ0FyVPdvtZoUu-19Tg==
date: Mon, 03 Jun 2024 11:57:23 GMT
content-type: image/avif
vary: Accept
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-rid;desc="-0qvPCZFR--DEwrfsJpo_3vWgpr5TgeJ42afZ0FyVPdvtZoUu-19Tg==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=4
cache-control: public, max-age=31536000, stale-while-revalidate=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-amzn-trace-id: root=1-665dafa2-42d508f768a18ae373bdb131;sampled=1;lineage=f456f256:0
content-security-policy-report-only: default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/reportOnly;
referrer-policy: strict-origin-when-cross-origin
via: 1.1 0af5e765fd55daca373799903bc0acde.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5

GET
DATA 200
OK truncated
/ 248 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 1903ee47f38fb5a0b56ce197b51aa0e1be80b22ab3afcd1a466eb1ee536aa8b3

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type: image/svg+xml

GET
H2 200 1ZFS7N918ojhhd0nQWdj3jz4w.woff2
framerusercontent.com/assets/ 27 KB
28 KB 277ms
156ms Font
font/woff2 2600:9000:266a:2200:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/assets/1ZFS7N918ojhhd0nQWdj3jz4w.woff2

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:266a:2200:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

cc324555c1cd681a59c27be1eda61da587d17bf71cc1ed8aa3e4a51e77907685

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://hunt.io/

Response headers

access-control-max-age: 3000
etag: "9a2dbfafd3686aa72cb303a41be28527"
x-amz-version-id: FhKj_VGbf4ha4CqtjcCeHMQzi9fH8cVU
age: 12716569
access-control-allow-methods: GET, HEAD
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: sQr6LjKgVOhEazz1dg0j5UGx4UyksZf5tH-eVdj-IwlNdfUXHXQleg==
date: Wed, 17 Jul 2024 04:34:58 GMT
content-type: font/woff2
last-modified: Mon, 15 Jul 2024 14:12:44 GMT
x-amz-server-side-encryption-aws-kms-key-id: arn:aws:kms:us-east-1:946663360620:key/73540960-f9f6-40d6-b02a-3aa22f5f7459
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-rid;desc="sQr6LjKgVOhEazz1dg0j5UGx4UyksZf5tH-eVdj-IwlNdfUXHXQleg==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=4
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 9feee68c149ffc812d2a7f5683100dd2.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 28004
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5
server: CloudFront
x-amz-server-side-encryption: aws:kms

GET
H2 200 Inter-Medium.latin-Y3IVPL46.woff2
app.framerstatic.com/ 19 KB
20 KB 432ms
154ms Font
font/woff2 2600:9000:261f:fa00:d:6b42:4ec0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://app.framerstatic.com/Inter-Medium.latin-Y3IVPL46.woff2

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:261f:fa00:d:6b42:4ec0:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

c861d136456a64c9c5619e9fa7c37c80144ea5d8879d88554c1f8abaaae891bf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	1; mode=block

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://hunt.io/

Response headers

access-control-max-age: 3600
etag: "f366e7b832c6d0e8a2038665895c0762"
x-amz-version-id: null
age: 26199175
access-control-allow-methods: GET
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: Pp3V_3DPbAKiaPjvk__EONHYbWlezlRJ7_OkjIVhKYgDvOJ38jIIsQ==
date: Mon, 12 Feb 2024 03:24:52 GMT
content-type: font/woff2
last-modified: Sat, 10 Feb 2024 20:56:17 GMT
x-frame-options: deny
access-control-allow-headers: *
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000, immutable
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 90707ba4ec932f1b72abfb5c4f1add2e.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 19904
x-xss-protection: 1; mode=block
x-amz-cf-pop: JFK52-P3
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H2 200 vQyevYAyHtARFwPqUzQGpnDs.woff2
framerusercontent.com/assets/ 27 KB
28 KB 443ms
322ms Font
font/woff2 2600:9000:266a:2200:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/assets/vQyevYAyHtARFwPqUzQGpnDs.woff2

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:266a:2200:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

4107b11930c4eef1f6ae5a76d441562e6d21a601f1781f37fd085542cd87412b

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://hunt.io/

Response headers

access-control-max-age: 3000
etag: "a14a424239fd9cb2e305f2243b1f6177"
x-amz-version-id: SH9la86RvjI0NEj8MqfrPHVtgDnLUhAV
age: 12716569
access-control-allow-methods: GET, HEAD
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: BufmxkvE2dgkfaz4aRMhSZuZzOkR6WN0CXk6kbfz9NXlWt36n03Qkg==
date: Wed, 17 Jul 2024 04:34:58 GMT
content-type: font/woff2
last-modified: Mon, 15 Jul 2024 14:12:38 GMT
x-amz-server-side-encryption-aws-kms-key-id: arn:aws:kms:us-east-1:946663360620:key/73540960-f9f6-40d6-b02a-3aa22f5f7459
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-rid;desc="BufmxkvE2dgkfaz4aRMhSZuZzOkR6WN0CXk6kbfz9NXlWt36n03Qkg==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=4
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 9feee68c149ffc812d2a7f5683100dd2.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 27404
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5
server: CloudFront
x-amz-server-side-encryption: aws:kms

GET
H2 200 DXD0Q7LSl7HEvDzucnyLnGBHM.woff2
framerusercontent.com/assets/ 27 KB
28 KB 404ms
283ms Font
font/woff2 2600:9000:266a:2200:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/assets/DXD0Q7LSl7HEvDzucnyLnGBHM.woff2

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:266a:2200:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

CloudFront /

Resource Hash

2dc968863319a6f57e6428a7b4c292ae254d3e462b5f23f71bab492317067d5f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://hunt.io/

Response headers

access-control-max-age: 3000
etag: "757ca4a792b8c7bbe09f6e6cee76e727"
x-amz-version-id: bCCG3uSnAgT3MLzz1ZSQU2cVkYB4Lve.
age: 12771880
access-control-allow-methods: GET, HEAD
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: -ltU-q8AYFHmANk3ra5UdcKeDiBneN8BCPw8vVwRUsIGQOrSb5ckfQ==
date: Tue, 16 Jul 2024 13:13:07 GMT
content-type: font/woff2
last-modified: Mon, 15 Jul 2024 14:11:33 GMT
x-amz-server-side-encryption-aws-kms-key-id: arn:aws:kms:us-east-1:946663360620:key/73540960-f9f6-40d6-b02a-3aa22f5f7459
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-rid;desc="-ltU-q8AYFHmANk3ra5UdcKeDiBneN8BCPw8vVwRUsIGQOrSb5ckfQ==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=3
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 9feee68c149ffc812d2a7f5683100dd2.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 27992
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5
server: CloudFront
x-amz-server-side-encryption: aws:kms

GET
H/1.1 200
OK figure_1_screenshot_showing_the_i_button_which_allows_users_to_quickly_view_beacon_configurations_without_downloading_them_in_hunt__1x.webp
public-hunt-static-blog-assets.s3.us-east-1.amazonaws.com/12-2024/ 17 KB
18 KB 427ms
153ms Image
image/webp 3.5.21.37
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://public-hunt-static-blog-assets.s3.us-east-1.amazonaws.com/12-2024/figure_1_screenshot_showing_the_i_button_which_allows_users_to_quickly_view_beacon_configurations_without_downloading_them_in_hunt__1x.webp
Requested by: Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 3.5.21.37 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: s3-r-w.us-east-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 22e5cfd55973895f60a7f6bf877482dc964962f8dd778612fc149bed56112bc1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hunt.io/

Response headers

x-amz-id-2: wH6BHQ953+yZPwC99fAU2ZXAr/OHJE/Omyq4CvgdUmglhDEzaI8V6iJbwaA3Ll08J6KXl0067pjE2R3oU10nr7/yahBhBD9x
ETag: "5a63fbd9ea0b1ac71babd58c221894d8"
x-amz-request-id: G0WN4WMQCG1D51CB
Accept-Ranges: bytes
Content-Length: 17688
Date: Wed, 11 Dec 2024 08:57:47 GMT
Last-Modified: Tue, 03 Dec 2024 14:45:58 GMT
Content-Type: image/webp
Server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H/1.1 200
OK figure_2_associations_tab_showing_six_additional_ip_addresses_sharing_the_same_watermark_hunt__1x.webp
public-hunt-static-blog-assets.s3.us-east-1.amazonaws.com/12-2024/ 15 KB
16 KB 426ms
153ms Image
image/webp 3.5.21.37
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://public-hunt-static-blog-assets.s3.us-east-1.amazonaws.com/12-2024/figure_2_associations_tab_showing_six_additional_ip_addresses_sharing_the_same_watermark_hunt__1x.webp
Requested by: Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 3.5.21.37 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: s3-r-w.us-east-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 9753c83f61822ce350ea508e36e2ee9395589100a0b3afa9df41a4c1a0910408

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hunt.io/

Response headers

x-amz-id-2: 1/kYuyxjAduTa1y1unRypmGRJMG9Qxx40DvLZjBqDbPykK7G6zJMhxZt2sPQQiVf+kWi6a4dLSSimXjsKkD5n6pmR7tpaMmF
ETag: "0b70d4de7b2cec3732dfb1f26c2f4528"
x-amz-request-id: G0WVXSH1MMKV5D4M
Accept-Ranges: bytes
Content-Length: 15826
Date: Wed, 11 Dec 2024 08:57:47 GMT
Last-Modified: Tue, 03 Dec 2024 14:45:56 GMT
Content-Type: image/webp
Server: AmazonS3
x-amz-server-side-encryption: AES256

POST
H2 200 anonymous
events.framer.com/ 0
362 B 246ms
244ms Ping
application/json 13.226.94.26
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://events.framer.com/anonymous
Requested by: Host: events.framer.com
URL: https://events.framer.com/script
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.226.94.26 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-226-94-26.jfk52.r.cloudfront.net
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type: text/plain;charset=UTF-8
Referer: https://hunt.io/

Response headers

x-amz-apigw-id: CnoRvEeqoAMEfmQ=
x-amzn-trace-id: Root=1-6759540a-24b2be695f909c580e161278;Sampled=1;Lineage=1:c457ad49:0
x-amzn-requestid: f575dd75-0d58-445a-a92f-87c1f71271ad
via: 1.1 b8e7e4d288487b86cfc6bcf59fb6d08c.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-cache: Miss from cloudfront
content-length: 0
x-amz-cf-id: omnOtzuFkIqdr7c6GfNBdAvNPfSRfGAL8nOZEkilwvbBey4G3SHoSg==
date: Wed, 11 Dec 2024 08:57:46 GMT
content-type: application/json
x-amz-cf-pop: JFK52-P10

POST
H2 204 collect
www.google-analytics.com/g/ 0
0 553ms
151ms Fetch
text/plain 2607:f8b0:4004:c1f::66
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://www.google-analytics.com/g/collect?v=2&tid=G-CKJY21YJ7N&gtm=45je4ca0v9166211784za200&_p=1733907466185&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101925629~102067555~102067808~102081485&cid=2079786483.1733907467&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_s=1&sid=1733907467&sct=1&seg=0&dl=https%3A%2F%2Fhunt.io%2Fblog%2Frare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity&dt=Rare%20Watermark%20Links%20Cobalt%20Strike%204.10%20Team%20Servers%20to%20Ongoing%20Suspicious%20Activity&en=page_view&_fv=1&_nsi=1&_ss=1&_ee=1&tfd=1197
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-CKJY21YJ7N
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2607:f8b0:4004:c1f::66 Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hunt.io/

Response headers

cache-control: no-cache, no-store, must-revalidate
pragma: no-cache
cross-origin-resource-policy: cross-origin
access-control-allow-credentials: true
content-security-policy-report-only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:86:0
report-to: {"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:86:0"}],}
expires: Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin: https://hunt.io
cross-origin-opener-policy-report-only: same-origin; report-to=coop_reporting
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date: Wed, 11 Dec 2024 08:57:47 GMT
content-type: text/plain
server: Golfe2

GET
H3 200 psEar9BZHC3V1ST6mGHxVJQfBxc.png
framerusercontent.com/images/ 391 B
1 KB 139ms
139ms Other
image/png 18.238.80.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/images/psEar9BZHC3V1ST6mGHxVJQfBxc.png

Protocol

Security

QUIC, , AES_128_GCM

Server

18.238.80.36 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-238-80-36.jfk52.r.cloudfront.net

Software

Resource Hash

1444a7eaffad2eae4dd0999fb1fd4c308e51876b70db2c4f1181c8a038f1f859

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hunt.io/

Response headers

etag: "939ec6fdc5062f6529950c37ab817812"
age: 16914081
x-content-type-options: nosniff
x-amzn-requestid: b0ac55ce-81d8-4ec5-a63d-b4e0230c1b65
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-hit-layer;desc="EDGE",cdn-rid;desc="JdwyBDYOJ4GC-Z4PF6nSDbK_3dDeSScNJLELCE1Az1mn-ROhoOcdZA==",cdn-downstream-fbl=2
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Wed, 29 May 2024 14:36:26 GMT
content-type: image/png
vary: Accept
x-amz-cf-id: JdwyBDYOJ4GC-Z4PF6nSDbK_3dDeSScNJLELCE1Az1mn-ROhoOcdZA==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=31536000, stale-while-revalidate=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-amzn-trace-id: root=1-66573d6a-4e285cd21e7c73b36b481c52;sampled=1;lineage=f456f256:0
content-security-policy-report-only: default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/reportOnly;
referrer-policy: strict-origin-when-cross-origin
via: 1.1 4b70da48eda82f2df6875ba8bf8f89ba.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5

GET
H3 206 wvsIsx8BB-indexes-default.framercms Show response
framerusercontent.com/modules/drpNeVQopLY1P5khDike/dRsRwQIaLOAXxsU4RZSx/ 3 KB
4 KB 139ms
138ms Fetch
application/octet-stream 18.238.80.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/modules/drpNeVQopLY1P5khDike/dRsRwQIaLOAXxsU4RZSx/wvsIsx8BB-indexes-default.framercms

Requested by

Host: framerusercontent.com
URL: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-AIWW63AC.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

18.238.80.36 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-238-80-36.jfk52.r.cloudfront.net

Software

Resource Hash

f5b8526bb0e6c1a53d014fca1808aebfb9abaa825ba0e7f54c32562023e255b4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Range: bytes=6919-10110
Referer: https://hunt.io/

Response headers

access-control-expose-headers: Content-Range
age: 61137
access-control-allow-methods: GET, HEAD, OPTIONS
x-content-type-options: nosniff
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-hit-layer;desc="EDGE",cdn-rid;desc="1W3UfwNcHNdGE2hON95V5zgkZgDuwDbwurC05-nqQDL9kXapGW6gyg==",cdn-downstream-fbl=1
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Tue, 10 Dec 2024 15:58:50 GMT
content-type: application/octet-stream
x-amz-cf-id: 1W3UfwNcHNdGE2hON95V5zgkZgDuwDbwurC05-nqQDL9kXapGW6gyg==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, immutable
timing-allow-origin: *
Content-Range: bytes 6919-10110/276280
referrer-policy: strict-origin-when-cross-origin
via: 1.1 e3b3138ab681fdbb8fab7bde9e330642.cloudfront.net (CloudFront)
access-control-allow-origin: *
Content-Length: 3192
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5

GET
H3 206 wvsIsx8BB-chunk-default-0.framercms Show response
framerusercontent.com/modules/drpNeVQopLY1P5khDike/dRsRwQIaLOAXxsU4RZSx/ 3 KB
4 KB 143ms
142ms Fetch
application/octet-stream 18.238.80.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/modules/drpNeVQopLY1P5khDike/dRsRwQIaLOAXxsU4RZSx/wvsIsx8BB-chunk-default-0.framercms

Requested by

Host: framerusercontent.com
URL: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-AIWW63AC.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

18.238.80.36 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-238-80-36.jfk52.r.cloudfront.net

Software

Resource Hash

22b07807afbc388ecd51abfcbecb67055935c2e3b93ac4283a5becedd5e70621

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Range: bytes=235-3430
Referer: https://hunt.io/

Response headers

access-control-expose-headers: Content-Range
age: 61137
access-control-allow-methods: GET, HEAD, OPTIONS
x-content-type-options: nosniff
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-hit-layer;desc="EDGE",cdn-rid;desc="E_XTpeLqUSzJcGc0BWv4eWi8W8xrF9Vo_6lojSy1t7SEs8y9cB23Lw==",cdn-downstream-fbl=1
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Tue, 10 Dec 2024 15:58:51 GMT
content-type: application/octet-stream
x-amz-cf-id: E_XTpeLqUSzJcGc0BWv4eWi8W8xrF9Vo_6lojSy1t7SEs8y9cB23Lw==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, immutable
timing-allow-origin: *
Content-Range: bytes 235-3430/245022
referrer-policy: strict-origin-when-cross-origin
via: 1.1 e3b3138ab681fdbb8fab7bde9e330642.cloudfront.net (CloudFront)
access-control-allow-origin: *
Content-Length: 3196
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5

GET
H3 200 wvsIsx8BB-chunk-default-dict.framercms Show response
framerusercontent.com/modules/drpNeVQopLY1P5khDike/dRsRwQIaLOAXxsU4RZSx/ 31 KB
32 KB 140ms
139ms Fetch
application/octet-stream 18.238.80.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/modules/drpNeVQopLY1P5khDike/dRsRwQIaLOAXxsU4RZSx/wvsIsx8BB-chunk-default-dict.framercms

Requested by

Host: framerusercontent.com
URL: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-AIWW63AC.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

18.238.80.36 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-238-80-36.jfk52.r.cloudfront.net

Software

Resource Hash

25aeb8cf020d602895b80560676fabfa34b3c350195a0660572b6c87d8c0c37d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hunt.io/

Response headers

access-control-expose-headers: Content-Range
age: 61137
access-control-allow-methods: GET, HEAD, OPTIONS
x-content-type-options: nosniff
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-hit-layer;desc="EDGE",cdn-rid;desc="XBtQenMQw_NZNRG1RFJ-26IjD7FXDiT_AQOJgXBaBS68UkkmtIlwFA==",cdn-downstream-fbl=1
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Tue, 10 Dec 2024 15:58:51 GMT
content-type: application/octet-stream
x-amz-cf-id: XBtQenMQw_NZNRG1RFJ-26IjD7FXDiT_AQOJgXBaBS68UkkmtIlwFA==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, immutable
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
via: 1.1 e3b3138ab681fdbb8fab7bde9e330642.cloudfront.net (CloudFront)
access-control-allow-origin: *
content-length: 32000
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5

GET
H3 206 wvsIsx8BB-indexes-default.framercms Show response
framerusercontent.com/modules/drpNeVQopLY1P5khDike/dRsRwQIaLOAXxsU4RZSx/ 1 KB
2 KB 142ms
139ms Fetch
application/octet-stream 18.238.80.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/modules/drpNeVQopLY1P5khDike/dRsRwQIaLOAXxsU4RZSx/wvsIsx8BB-indexes-default.framercms

Requested by

Host: framerusercontent.com
URL: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-AIWW63AC.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

18.238.80.36 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-238-80-36.jfk52.r.cloudfront.net

Software

Resource Hash

9cc352a4d050c98f080c4ab6550f54f4d383c9509c902b666e64548d83a62471

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Range: bytes=0-1241
Referer: https://hunt.io/

Response headers

access-control-expose-headers: Content-Range
age: 61138
access-control-allow-methods: GET, HEAD, OPTIONS
x-content-type-options: nosniff
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-hit-layer;desc="EDGE",cdn-rid;desc="f0Te69O2u2QfoEOfKGOpZ8FKjSxQ_y-djOYsdlZTW81OwRj_IULCEQ==",cdn-downstream-fbl=2
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Tue, 10 Dec 2024 15:58:50 GMT
content-type: application/octet-stream
x-amz-cf-id: f0Te69O2u2QfoEOfKGOpZ8FKjSxQ_y-djOYsdlZTW81OwRj_IULCEQ==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, immutable
timing-allow-origin: *
Content-Range: bytes 0-1241/276280
referrer-policy: strict-origin-when-cross-origin
via: 1.1 e3b3138ab681fdbb8fab7bde9e330642.cloudfront.net (CloudFront)
access-control-allow-origin: *
Content-Length: 1242
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5

GET
H3

200

Sun.js Show response
framerusercontent.com/modules/wp6xzA2QrHTqCWJAsoKa/Hyhw8DdNtDxDqd366SY7/
Redirect Chain

https://framer.com/m/phosphor-icons/Sun.js@0.0.53
https://framerusercontent.com/modules/wp6xzA2QrHTqCWJAsoKa/Hyhw8DdNtDxDqd366SY7/Sun.js

5 KB
2 KB

144ms
143ms

Script
text/javascript

18.238.80.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/modules/wp6xzA2QrHTqCWJAsoKa/Hyhw8DdNtDxDqd366SY7/Sun.js

Protocol

Server

18.238.80.36 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-238-80-36.jfk52.r.cloudfront.net

Software

Resource Hash

e77e2400288b5496592bb75f3d2c61871d947b1705f8a2d98c4bdea3a8ebbadd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://framerusercontent.com/

Response headers

access-control-expose-headers: Content-Range
content-encoding: gzip
age: 543464
access-control-allow-methods: GET, HEAD, OPTIONS
x-content-type-options: nosniff
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-hit-layer;desc="EDGE",cdn-rid;desc="l1XY0d6Q7tOBw4dW_fUjcJAux52Wo9O3wOQ1aupmOWes-Jvh4N-TCA==",cdn-downstream-fbl=1
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Thu, 05 Dec 2024 02:00:05 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
x-amz-cf-id: l1XY0d6Q7tOBw4dW_fUjcJAux52Wo9O3wOQ1aupmOWes-Jvh4N-TCA==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, immutable
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
via: 1.1 e3b3138ab681fdbb8fab7bde9e330642.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5

Redirect headers

access-control-expose-headers: Content-Range
age: 732
access-control-allow-methods: GET, HEAD, OPTIONS
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: _FvnuhLn4wanaPOfJMPgWbsWjxF4sQJz_gbmBpMp7Ku5kfk9BVf5Fg==
date: Wed, 11 Dec 2024 08:45:37 GMT
content-type: text/html; charset=utf-8
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=3600
location: https://framerusercontent.com/modules/wp6xzA2QrHTqCWJAsoKa/Hyhw8DdNtDxDqd366SY7/Sun.js
referrer-policy: strict-origin-when-cross-origin
via: 1.1 151ae48d84442f69dffa181fc68bc1da.cloudfront.net (CloudFront)
access-control-allow-origin: *
content-length: 109
x-xss-protection: 0
x-amz-cf-pop: EWR53-C1

GET
H3

200

Moon.js Show response
framerusercontent.com/modules/qdFz1d7MF7d8Wsxrv3Ew/tbOlJ2GGWCCiI25KWvfU/
Redirect Chain

https://framer.com/m/phosphor-icons/Moon.js@0.0.53
https://framerusercontent.com/modules/qdFz1d7MF7d8Wsxrv3Ew/tbOlJ2GGWCCiI25KWvfU/Moon.js

4 KB
2 KB

143ms
143ms

Script
text/javascript

18.238.80.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/modules/qdFz1d7MF7d8Wsxrv3Ew/tbOlJ2GGWCCiI25KWvfU/Moon.js

Protocol

Server

18.238.80.36 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-238-80-36.jfk52.r.cloudfront.net

Software

Resource Hash

cf51594b76c66c43206e9aa471baec6a92594ea6b8cbead1b40f445468de76e0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://framerusercontent.com/

Response headers

access-control-expose-headers: Content-Range
content-encoding: br
age: 300057
access-control-allow-methods: GET, HEAD, OPTIONS
x-content-type-options: nosniff
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-hit-layer;desc="EDGE",cdn-rid;desc="sbhV_GfwQo89KprqvF9kXB9Cz7dJHVEsv8jgoHgcqyKJHBtOOdSnrw==",cdn-downstream-fbl=2
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Sat, 07 Dec 2024 21:36:52 GMT
content-type: text/javascript; charset=UTF-8
vary: Accept-Encoding
x-amz-cf-id: sbhV_GfwQo89KprqvF9kXB9Cz7dJHVEsv8jgoHgcqyKJHBtOOdSnrw==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, immutable
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
via: 1.1 e3b3138ab681fdbb8fab7bde9e330642.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5

Redirect headers

access-control-expose-headers: Content-Range
age: 2610
access-control-allow-methods: GET, HEAD, OPTIONS
x-content-type-options: nosniff
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: zaZrS2l9AuEsuv3x8y33ty9PgTGGD99DjgG7u-gFan4u8F5XfeJ7dA==
date: Wed, 11 Dec 2024 08:14:19 GMT
content-type: text/html; charset=utf-8
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=3600
location: https://framerusercontent.com/modules/qdFz1d7MF7d8Wsxrv3Ew/tbOlJ2GGWCCiI25KWvfU/Moon.js
referrer-policy: strict-origin-when-cross-origin
via: 1.1 151ae48d84442f69dffa181fc68bc1da.cloudfront.net (CloudFront)
access-control-allow-origin: *
content-length: 110
x-xss-protection: 0
x-amz-cf-pop: EWR53-C1

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://public-hunt-static-blog-assets.s3.us-east-1.amazonaws.com/12-2024/figure_1_screenshot_showing_the_i_button_which_allows_users_to_quickly_view_beacon_configurations_without_downloading_them_in_hunt__1x.webp
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_128_GCM
Server: 3.5.21.37 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: s3-r-w.us-east-1.amazonaws.com
Software: AmazonS3 /
Resource Hash: 22e5cfd55973895f60a7f6bf877482dc964962f8dd778612fc149bed56112bc1

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hunt.io/

Response headers

x-amz-id-2: wH6BHQ953+yZPwC99fAU2ZXAr/OHJE/Omyq4CvgdUmglhDEzaI8V6iJbwaA3Ll08J6KXl0067pjE2R3oU10nr7/yahBhBD9x
ETag: "5a63fbd9ea0b1ac71babd58c221894d8"
x-amz-request-id: G0WN4WMQCG1D51CB
Accept-Ranges: bytes
Content-Length: 17688
Date: Wed, 11 Dec 2024 08:57:47 GMT
Last-Modified: Tue, 03 Dec 2024 14:45:58 GMT
Content-Type: image/webp
Server: AmazonS3
x-amz-server-side-encryption: AES256

GET
H3 206 wvsIsx8BB-indexes-default.framercms Show response
framerusercontent.com/modules/drpNeVQopLY1P5khDike/dRsRwQIaLOAXxsU4RZSx/ 596 B
1 KB 139ms
139ms Fetch
application/octet-stream 18.238.80.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/modules/drpNeVQopLY1P5khDike/dRsRwQIaLOAXxsU4RZSx/wvsIsx8BB-indexes-default.framercms

Requested by

Host: framerusercontent.com
URL: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-AIWW63AC.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

18.238.80.36 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-238-80-36.jfk52.r.cloudfront.net

Software

Resource Hash

f0f40885a14cd51f7d572952787c67b7c3e51399c2107171bb1bf741d22a6989

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Range: bytes=13806-14401
Referer: https://hunt.io/

Response headers

access-control-expose-headers: Content-Range
age: 61138
access-control-allow-methods: GET, HEAD, OPTIONS
x-content-type-options: nosniff
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-hit-layer;desc="EDGE",cdn-rid;desc="LXEgrD5ZQmXvVFtdURwxHtmhzsR_KthwZ8X8U0ngJ3-9PCgusq8zBw==",cdn-downstream-fbl=0
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Tue, 10 Dec 2024 15:58:50 GMT
content-type: application/octet-stream
x-amz-cf-id: LXEgrD5ZQmXvVFtdURwxHtmhzsR_KthwZ8X8U0ngJ3-9PCgusq8zBw==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, immutable
timing-allow-origin: *
Content-Range: bytes 13806-14401/276280
referrer-policy: strict-origin-when-cross-origin
via: 1.1 e3b3138ab681fdbb8fab7bde9e330642.cloudfront.net (CloudFront)
access-control-allow-origin: *
Content-Length: 596
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5

GET
H3 206 wvsIsx8BB-chunk-default-0.framercms Show response
framerusercontent.com/modules/drpNeVQopLY1P5khDike/dRsRwQIaLOAXxsU4RZSx/ 10 KB
11 KB 141ms
140ms Fetch
multipart/byteranges 18.238.80.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/modules/drpNeVQopLY1P5khDike/dRsRwQIaLOAXxsU4RZSx/wvsIsx8BB-chunk-default-0.framercms

Requested by

Host: framerusercontent.com
URL: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-AIWW63AC.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

18.238.80.36 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-238-80-36.jfk52.r.cloudfront.net

Software

Resource Hash

401ee53282cafd5b2ab218ad1b26ba6a3c71fc65886b4d81a3617f44bd5fa6ee

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Range: bytes=51476-56009,157655-160448,167285-170009
Referer: https://hunt.io/

Response headers

access-control-expose-headers: Content-Range
age: 61138
access-control-allow-methods: GET, HEAD, OPTIONS
x-content-type-options: nosniff
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-hit-layer;desc="EDGE",cdn-rid;desc="A64mJaX6a8S1zZRdVsN-idRuyK3vWBpHsVS1Bp5vLM5bpjaxXB_ixQ==",cdn-downstream-fbl=1
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Tue, 10 Dec 2024 15:58:51 GMT
content-type: multipart/byteranges; boundary=CloudFront:7F8549E274F7E4BDAB3C92DD1E539B06
x-amz-cf-id: A64mJaX6a8S1zZRdVsN-idRuyK3vWBpHsVS1Bp5vLM5bpjaxXB_ixQ==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, immutable
timing-allow-origin: *
referrer-policy: strict-origin-when-cross-origin
via: 1.1 e3b3138ab681fdbb8fab7bde9e330642.cloudfront.net (CloudFront)
access-control-allow-origin: *
content-length: 10504
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5

OPTIONS
H3 200 wvsIsx8BB-chunk-default-0.framercms
framerusercontent.com/modules/drpNeVQopLY1P5khDike/dRsRwQIaLOAXxsU4RZSx/ 0
0 138ms
137ms Preflight 18.238.80.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/modules/drpNeVQopLY1P5khDike/dRsRwQIaLOAXxsU4RZSx/wvsIsx8BB-chunk-default-0.framercms

Protocol

Security

QUIC, , AES_128_GCM

Server

18.238.80.36 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-238-80-36.jfk52.r.cloudfront.net

Software

Resource Hash

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

Accept: */*
Access-Control-Request-Headers: range
Access-Control-Request-Method: GET
Origin: https://hunt.io
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-headers: Range
access-control-allow-methods: GET, HEAD, OPTIONS
access-control-allow-origin: *
access-control-expose-headers: Content-Range
access-control-max-age: 600
age: 60824
alt-svc: h3=":443"; ma=86400
content-length: 0
date: Tue, 10 Dec 2024 16:04:04 GMT
referrer-policy: strict-origin-when-cross-origin
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-hit-layer;desc="EDGE",cdn-rid;desc="r3cKsq-eQd3mrdvahRtakyZQu8S5CsSeZPPUoS8h-BoSag-oiNsuWg==",cdn-downstream-fbl=1
strict-transport-security: max-age=31536000; includeSubDomains; preload
timing-allow-origin: *
via: 1.1 e3b3138ab681fdbb8fab7bde9e330642.cloudfront.net (CloudFront)
x-amz-cf-id: r3cKsq-eQd3mrdvahRtakyZQu8S5CsSeZPPUoS8h-BoSag-oiNsuWg==
x-amz-cf-pop: JFK52-P5
x-cache: Hit from cloudfront
x-content-type-options: nosniff
x-frame-options: deny
x-xss-protection: 0

GET
H3 206 wvsIsx8BB-chunk-default-0.framercms Show response
framerusercontent.com/modules/drpNeVQopLY1P5khDike/dRsRwQIaLOAXxsU4RZSx/ 231 B
762 B 140ms
139ms Fetch
application/octet-stream 18.238.80.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/modules/drpNeVQopLY1P5khDike/dRsRwQIaLOAXxsU4RZSx/wvsIsx8BB-chunk-default-0.framercms

Requested by

Host: framerusercontent.com
URL: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-AIWW63AC.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

18.238.80.36 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-238-80-36.jfk52.r.cloudfront.net

Software

Resource Hash

2f37e3fd569a267dad5ef4e47eed27d209397137fbe1be9eb9fb91e642f6400f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Range: bytes=4-234
Referer: https://hunt.io/

Response headers

access-control-expose-headers: Content-Range
age: 61138
access-control-allow-methods: GET, HEAD, OPTIONS
x-content-type-options: nosniff
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-hit-layer;desc="EDGE",cdn-rid;desc="O789HUkAdQz49aH0TrlPZuItxnlI82l_71JhVZOzpIiHp5E66EcJSQ==",cdn-downstream-fbl=2
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Tue, 10 Dec 2024 15:58:51 GMT
content-type: application/octet-stream
x-amz-cf-id: O789HUkAdQz49aH0TrlPZuItxnlI82l_71JhVZOzpIiHp5E66EcJSQ==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
cache-control: public, max-age=604800, immutable
timing-allow-origin: *
Content-Range: bytes 4-234/245022
referrer-policy: strict-origin-when-cross-origin
via: 1.1 e3b3138ab681fdbb8fab7bde9e330642.cloudfront.net (CloudFront)
access-control-allow-origin: *
Content-Length: 231
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5

GET
H3 200 XFsFr3Y6HDDfkPLgSPRuhldm2g.webp
framerusercontent.com/images/ 67 KB
68 KB 139ms
139ms Image
image/avif 18.238.80.36
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://framerusercontent.com/images/XFsFr3Y6HDDfkPLgSPRuhldm2g.webp

Requested by

Host: framerusercontent.com
URL: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-7PZR57LV.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

18.238.80.36 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-238-80-36.jfk52.r.cloudfront.net

Software

Resource Hash

baec8ef28ee7d04e84305e579a7a397af272c2b2694b3e2879ea01a14c16a76a

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/enforce;
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hunt.io/

Response headers

etag: "71eb302e38ef24d00d5643fd1bc5d3f7"
age: 416296
x-content-type-options: nosniff
x-amzn-requestid: c6d044ef-f595-45f2-b700-9b4097e2c470
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-hit-layer;desc="EDGE",cdn-rid;desc="P68MqIeJjIK0bwSfT2enB8cGn0AX0b9Jf2x0AQc6gU3vyR0Aa2wKLQ==",cdn-downstream-fbl=2
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Fri, 06 Dec 2024 13:19:33 GMT
content-type: image/avif
vary: Accept
x-amz-cf-id: P68MqIeJjIK0bwSfT2enB8cGn0AX0b9Jf2x0AQc6gU3vyR0Aa2wKLQ==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-security-policy: default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/enforce;
cache-control: public, max-age=31536000, stale-while-revalidate=31536000
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
x-amzn-trace-id: Root=1-6752f9e0-60292b0832e951d5426436f8;Sampled=1;Lineage=1:f456f256:0
referrer-policy: strict-origin-when-cross-origin
via: 1.1 4b70da48eda82f2df6875ba8bf8f89ba.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5

GET
H2 200 yVA9Oy9wbaBjaChzIOH78YiSFE.webp
framerusercontent.com/images/ 8 KB
0 0ms
0ms Image
image/avif 2600:9000:266a:2200:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://framerusercontent.com/images/yVA9Oy9wbaBjaChzIOH78YiSFE.webp?scale-down-to=512

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:266a:2200:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a741fd3317fed44c0f1c7b8161f1420298b044e564dfea131957c0e27982a66c

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/enforce;
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hunt.io/

Response headers

etag: "7231b098b0757259dd2bbfd90a7fb0f9"
age: 671320
x-content-type-options: nosniff
x-amzn-requestid: 3de1bf36-0c6a-42e8-bf76-49da9ceef860
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: uHfrkfUTvg3iQ1-NAUBjGmgo3jdCkKFeJpd6Ke51aggHyWpLUF7JkQ==
date: Tue, 03 Dec 2024 14:29:06 GMT
content-type: image/avif
vary: Accept
x-frame-options: deny
content-security-policy: default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/enforce;
cache-control: public, max-age=31536000, stale-while-revalidate=31536000
timing-allow-origin: *
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-rid;desc="uHfrkfUTvg3iQ1-NAUBjGmgo3jdCkKFeJpd6Ke51aggHyWpLUF7JkQ==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=3
cross-origin-resource-policy: cross-origin
x-amzn-trace-id: Root=1-674f15b1-78bc758e7f872fa50e191290;Sampled=1;Lineage=1:f456f256:0
referrer-policy: strict-origin-when-cross-origin
via: 1.1 0af5e765fd55daca373799903bc0acde.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5

GET
H2 200 cJA8dVwYG5AXjO4aXVKQ9QdZFg.webp
framerusercontent.com/images/ 8 KB
0 1ms
1ms Image
image/avif 2600:9000:266a:2200:d:ada1:a280:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://framerusercontent.com/images/cJA8dVwYG5AXjO4aXVKQ9QdZFg.webp?scale-down-to=512

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2600:9000:266a:2200:d:ada1:a280:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

341f61d7c3838f9e303327f41376afcc21e5e7e5d5408b795be682dcd97cde43

Security Headers

Name	Value
Content-Security-Policy	default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/enforce;
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer: https://hunt.io/

Response headers

etag: "e1a9183cb012ee35efa98e49b5e794c7"
age: 673463
x-content-type-options: nosniff
x-amzn-requestid: ccc06360-8d94-47a9-b091-1b302a6ae954
alt-svc: h3=":443"; ma=86400
x-cache: Hit from cloudfront
x-amz-cf-id: 1JdygSBKYS1zQHc4bcGO3m69xfUif87yGi-rwdRwYBoQkdGJxag55w==
date: Tue, 03 Dec 2024 13:53:23 GMT
content-type: image/avif
vary: Accept
x-frame-options: deny
content-security-policy: default-src 'none'; script-src 'none'; img-src 'self'; media-src 'self'; report-uri https://framer.report-uri.com/r/t/csp/enforce;
cache-control: public, max-age=31536000, stale-while-revalidate=31536000
timing-allow-origin: *
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-rid;desc="1JdygSBKYS1zQHc4bcGO3m69xfUif87yGi-rwdRwYBoQkdGJxag55w==",cdn-hit-layer;desc="EDGE",cdn-downstream-fbl;dur=3
cross-origin-resource-policy: cross-origin
x-amzn-trace-id: Root=1-674f0d52-337d67ec3b1a02f00d068755;Sampled=1;Lineage=1:f456f256:0
referrer-policy: strict-origin-when-cross-origin
via: 1.1 0af5e765fd55daca373799903bc0acde.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5

GET
H3 200 Jl3Kv7P-kDAXGrkG_Y3TePXcWEHsZdHVwzyhfgdi4S8.AXOWFRVS.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 97 KB
13 KB 149ms
147ms Script
text/javascript 18.238.80.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/Jl3Kv7P-kDAXGrkG_Y3TePXcWEHsZdHVwzyhfgdi4S8.AXOWFRVS.mjs

Requested by

Host: framerusercontent.com
URL: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/script_main.DVS43U5Q.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

18.238.80.36 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-238-80-36.jfk52.r.cloudfront.net

Software

CloudFront /

Resource Hash

bece75fc8837c8a539530ef23fa0597efe496fb7d07b7087ed78f7a4a6ea0ceb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/script_main.DVS43U5Q.mjs

Response headers

access-control-max-age: 0
content-encoding: br
etag: W/"e2db15eaef96000994d25addf69aa280"
x-amz-version-id: TuU0iBqXN12EcJ9rCUkddc1jDvyMs6Y6
age: 60823
access-control-allow-methods: GET
x-content-type-options: nosniff
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-hit-layer;desc="EDGE",cdn-rid;desc="B3Y3KieHX5WJ6yIeHwzOMhu2X_JVHpRdmqh7f4Cxx12L40TTUk5QLw==",cdn-downstream-fbl=2
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Tue, 10 Dec 2024 16:04:07 GMT
content-type: text/javascript
last-modified: Tue, 10 Dec 2024 15:58:53 GMT
vary: Accept-Encoding,Origin
x-amz-cf-id: B3Y3KieHX5WJ6yIeHwzOMhu2X_JVHpRdmqh7f4Cxx12L40TTUk5QLw==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: PENDING
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 e3b3138ab681fdbb8fab7bde9e330642.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H3 200 zhL8nU7XNNGFRlAIY2FM-h62K_VrrSiSRyTqnUBhnM8.REHR67NR.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 41 KB
8 KB 149ms
148ms Script
text/javascript 18.238.80.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/zhL8nU7XNNGFRlAIY2FM-h62K_VrrSiSRyTqnUBhnM8.REHR67NR.mjs

Requested by

Host: framerusercontent.com
URL: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/script_main.DVS43U5Q.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

18.238.80.36 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-238-80-36.jfk52.r.cloudfront.net

Software

CloudFront /

Resource Hash

e96570316195a9f6d9ae66ad55325d340e90ca1563bff1972640b2e0435002f2

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/script_main.DVS43U5Q.mjs

Response headers

access-control-max-age: 0
content-encoding: br
etag: W/"2a7526581ccd8f89b484d69b0f7f8c1c"
x-amz-version-id: fZbPqa9.hb2i.lXabIGLTFRAPE7YEmMp
age: 60823
access-control-allow-methods: GET
x-content-type-options: nosniff
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-hit-layer;desc="EDGE",cdn-rid;desc="bGeDDbb3Eqo3u4ln6ghNHQBJasqBbsOGOtMv2Gz2XlRo0O6gP1ENVA==",cdn-downstream-fbl=2
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Tue, 10 Dec 2024 16:04:07 GMT
content-type: text/javascript
last-modified: Tue, 10 Dec 2024 15:58:52 GMT
vary: Accept-Encoding,Origin
x-amz-cf-id: bGeDDbb3Eqo3u4ln6ghNHQBJasqBbsOGOtMv2Gz2XlRo0O6gP1ENVA==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: PENDING
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 e3b3138ab681fdbb8fab7bde9e330642.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H3 200 zf7oaQsVisvCUlpUMhEzxzxL1qwjjWU7pRoRegRYu8A.4QUJHPOE.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 45 KB
8 KB 151ms
149ms Script
text/javascript 18.238.80.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/zf7oaQsVisvCUlpUMhEzxzxL1qwjjWU7pRoRegRYu8A.4QUJHPOE.mjs

Requested by

Host: framerusercontent.com
URL: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/script_main.DVS43U5Q.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

18.238.80.36 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-238-80-36.jfk52.r.cloudfront.net

Software

CloudFront /

Resource Hash

831ed047a786cb3bd6a4a3ee93e8457242ee53207b0d04c3b66a3f9899dd78bb

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/script_main.DVS43U5Q.mjs

Response headers

access-control-max-age: 0
content-encoding: br
etag: W/"a8b232442f006891ea01135e0614294c"
x-amz-version-id: J12_kG32aYPIUpE0p2Bu8834nWBwkEFE
age: 60823
access-control-allow-methods: GET
x-content-type-options: nosniff
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-hit-layer;desc="EDGE",cdn-rid;desc="zdXKKVau4KRzT_KsriNxCFmST6yuekej3yVFbCG2f8GJYB5_mdxD7Q==",cdn-downstream-fbl=2
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Tue, 10 Dec 2024 16:04:07 GMT
content-type: text/javascript
last-modified: Tue, 10 Dec 2024 15:58:52 GMT
vary: Accept-Encoding,Origin
x-amz-cf-id: zdXKKVau4KRzT_KsriNxCFmST6yuekej3yVFbCG2f8GJYB5_mdxD7Q==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: PENDING
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 e3b3138ab681fdbb8fab7bde9e330642.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H3 200 uGlNsLGsxLbZSRZ1mvzu3m0ZuvxWi0UMM-zLyu4GSN4.ASBAZL5M.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 74 KB
11 KB 150ms
148ms Script
text/javascript 18.238.80.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/uGlNsLGsxLbZSRZ1mvzu3m0ZuvxWi0UMM-zLyu4GSN4.ASBAZL5M.mjs

Requested by

Host: framerusercontent.com
URL: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/script_main.DVS43U5Q.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

18.238.80.36 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-238-80-36.jfk52.r.cloudfront.net

Software

CloudFront /

Resource Hash

dae44b82855ff15075c37f13f6492e3407e86c9bf27bf8c06b5e7f6dc7739238

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/script_main.DVS43U5Q.mjs

Response headers

access-control-max-age: 0
content-encoding: br
etag: W/"035ebdba59ce6411283ae98079fa0855"
x-amz-version-id: RxPt1Gs1Cd39ubTDC1YGriLuRNXRYZyI
age: 60823
access-control-allow-methods: GET
x-content-type-options: nosniff
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-hit-layer;desc="EDGE",cdn-rid;desc="DiN-vy6JzWsO09Rx48OgdvoD_RngPBHosPhEw4kuwVmP2FYKQD0M3g==",cdn-downstream-fbl=2
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Tue, 10 Dec 2024 16:04:07 GMT
content-type: text/javascript
last-modified: Tue, 10 Dec 2024 15:58:53 GMT
vary: Accept-Encoding,Origin
x-amz-cf-id: DiN-vy6JzWsO09Rx48OgdvoD_RngPBHosPhEw4kuwVmP2FYKQD0M3g==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: PENDING
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 e3b3138ab681fdbb8fab7bde9e330642.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H3 200 pRiwASxP9OJsmj9eXZodYhMZRAVY5w9eI5HAcshw2Vw.BBMY7BTJ.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 91 KB
13 KB 152ms
150ms Script
text/javascript 18.238.80.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/pRiwASxP9OJsmj9eXZodYhMZRAVY5w9eI5HAcshw2Vw.BBMY7BTJ.mjs

Requested by

Host: framerusercontent.com
URL: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/script_main.DVS43U5Q.mjs

Protocol

Security

QUIC, , AES_128_GCM

Server

18.238.80.36 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-238-80-36.jfk52.r.cloudfront.net

Software

CloudFront /

Resource Hash

7734581c037aa18ef75406de8fe8447d0194e730d674fa4670495be8982f366d

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/script_main.DVS43U5Q.mjs

Response headers

access-control-max-age: 0
content-encoding: br
etag: W/"db314f045a5d16008ccacbbbd422ba78"
x-amz-version-id: J7iHWFMQExIuX0uZntwxdPDTrOSWE9I5
age: 60823
access-control-allow-methods: GET
x-content-type-options: nosniff
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-hit-layer;desc="EDGE",cdn-rid;desc="7ojjrHnP83vN0iSI0IFExfK9mssC0-agLgvTubOnnL7OGUvwE0Du0A==",cdn-downstream-fbl=3
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Tue, 10 Dec 2024 16:04:07 GMT
content-type: text/javascript
last-modified: Tue, 10 Dec 2024 15:58:52 GMT
vary: Accept-Encoding,Origin
x-amz-cf-id: 7ojjrHnP83vN0iSI0IFExfK9mssC0-agLgvTubOnnL7OGUvwE0Du0A==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: PENDING
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 e3b3138ab681fdbb8fab7bde9e330642.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H3 200 chunk-3OHOHP5K.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 1 KB
1 KB 139ms
138ms Script
text/javascript 18.238.80.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-3OHOHP5K.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

QUIC, , AES_128_GCM

Server

18.238.80.36 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-238-80-36.jfk52.r.cloudfront.net

Software

CloudFront /

Resource Hash

85423271cadc50e7a8873249d3ece6c62b3180112ac657e66347ce4241d31dc9

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/Jl3Kv7P-kDAXGrkG_Y3TePXcWEHsZdHVwzyhfgdi4S8.AXOWFRVS.mjs

Response headers

access-control-max-age: 0
content-encoding: br
etag: W/"0d3db3f4c9f52ed4383abbcc60719616"
x-amz-version-id: RGc_Ws_DDVt19gqO4V500uKpAg8wxHba
age: 3677515
access-control-allow-methods: GET
x-content-type-options: nosniff
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-hit-layer;desc="EDGE",cdn-rid;desc="Kaodf3Vy3yIAGkd9sLIniYlaeOCkg_nIu2wSQL1zHwFgKxXL_-d1kg==",cdn-downstream-fbl=1
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Tue, 29 Oct 2024 19:25:55 GMT
content-type: text/javascript
last-modified: Tue, 29 Oct 2024 18:16:43 GMT
vary: Accept-Encoding,Origin
x-amz-cf-id: Kaodf3Vy3yIAGkd9sLIniYlaeOCkg_nIu2wSQL1zHwFgKxXL_-d1kg==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 e3b3138ab681fdbb8fab7bde9e330642.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H3 200 chunk-75KC3OJW.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 999 B
2 KB 140ms
140ms Script
text/javascript 18.238.80.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-75KC3OJW.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

QUIC, , AES_128_GCM

Server

18.238.80.36 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-238-80-36.jfk52.r.cloudfront.net

Software

CloudFront /

Resource Hash

f8c7aece584727904d9ece558d571f0a745d505013a200a9e4382d293401e840

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/zhL8nU7XNNGFRlAIY2FM-h62K_VrrSiSRyTqnUBhnM8.REHR67NR.mjs

Response headers

access-control-max-age: 0
etag: "c8efc240356389f13cecc167c1012996"
x-amz-version-id: o4YHMjQ.oXSy6VZhcWaxh8uLt6h88EWw
age: 1095088
access-control-allow-methods: GET
x-content-type-options: nosniff
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-hit-layer;desc="EDGE",cdn-rid;desc="T5HSu-XWAMwch16D7_Pia2EIqRh1wGUX9b16rd2AFXGAApSd4bMkNw==",cdn-downstream-fbl=1
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Thu, 28 Nov 2024 16:46:22 GMT
content-type: text/javascript
last-modified: Thu, 28 Nov 2024 16:33:32 GMT
vary: Origin
x-amz-cf-id: T5HSu-XWAMwch16D7_Pia2EIqRh1wGUX9b16rd2AFXGAApSd4bMkNw==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 e3b3138ab681fdbb8fab7bde9e330642.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 999
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H3 200 chunk-W7PAJESI.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 997 B
2 KB 141ms
140ms Script
text/javascript 18.238.80.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-W7PAJESI.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

QUIC, , AES_128_GCM

Server

18.238.80.36 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-238-80-36.jfk52.r.cloudfront.net

Software

CloudFront /

Resource Hash

fd2c9f5458dff3221f07b1f32bb05b7d9fbf9e9f435448ed14ed1c273d0e493e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/zf7oaQsVisvCUlpUMhEzxzxL1qwjjWU7pRoRegRYu8A.4QUJHPOE.mjs

Response headers

access-control-max-age: 0
etag: "7840196577db9a0c47d25a45b1404bd5"
x-amz-version-id: rZzGzmQf2m1qGMZetHMM9Ni1D68QMvdt
age: 1095088
access-control-allow-methods: GET
x-content-type-options: nosniff
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-hit-layer;desc="EDGE",cdn-rid;desc="XqVUAlUuC6r5DKdfAYuawu8Y7TToJOMGl4llHwyp7jj5N3JJkOytJA==",cdn-downstream-fbl=1
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Thu, 28 Nov 2024 16:46:22 GMT
content-type: text/javascript
last-modified: Thu, 28 Nov 2024 16:33:32 GMT
vary: Origin
x-amz-cf-id: XqVUAlUuC6r5DKdfAYuawu8Y7TToJOMGl4llHwyp7jj5N3JJkOytJA==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 e3b3138ab681fdbb8fab7bde9e330642.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 997
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H3 200 chunk-2GYV7IVM.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 933 B
2 KB 139ms
139ms Script
text/javascript 18.238.80.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-2GYV7IVM.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

QUIC, , AES_128_GCM

Server

18.238.80.36 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-238-80-36.jfk52.r.cloudfront.net

Software

CloudFront /

Resource Hash

195e5840ca8966eb3ab97a9eb1582e7375d49810416f043dd8378af918367b9f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/uGlNsLGsxLbZSRZ1mvzu3m0ZuvxWi0UMM-zLyu4GSN4.ASBAZL5M.mjs

Response headers

access-control-max-age: 0
etag: "24298ba8391c7d23a5170e0e38318a28"
x-amz-version-id: nM5DVGYiJT7UxUVYI7NEVyrlnbzS87ge
age: 9484846
access-control-allow-methods: GET
x-content-type-options: nosniff
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-hit-layer;desc="EDGE",cdn-rid;desc="onXWxaOX16aAQiEJpTTuyX5rgt9zPQ-PKQpb5O1NtRbPg70KnqwQdQ==",cdn-downstream-fbl=1
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Fri, 23 Aug 2024 14:17:04 GMT
content-type: text/javascript
last-modified: Fri, 23 Aug 2024 14:15:07 GMT
vary: Origin
x-amz-cf-id: onXWxaOX16aAQiEJpTTuyX5rgt9zPQ-PKQpb5O1NtRbPg70KnqwQdQ==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 e3b3138ab681fdbb8fab7bde9e330642.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 933
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H3 200 chunk-2MP2Z6KV.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 993 B
2 KB 145ms
145ms Script
text/javascript 18.238.80.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-2MP2Z6KV.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

QUIC, , AES_128_GCM

Server

18.238.80.36 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-238-80-36.jfk52.r.cloudfront.net

Software

CloudFront /

Resource Hash

20f16f669e39ddc2f4fce46463481ec43157c6d23258ec2f59f32a23c3d66a8a

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/pRiwASxP9OJsmj9eXZodYhMZRAVY5w9eI5HAcshw2Vw.BBMY7BTJ.mjs

Response headers

access-control-max-age: 0
etag: "a0270dad90dd051af03ad27f756ce88b"
x-amz-version-id: Xa6i0f68HFqGuYAYsjcBEL8VNbvS_6X7
age: 4115375
access-control-allow-methods: GET
x-content-type-options: nosniff
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-hit-layer;desc="EDGE",cdn-rid;desc="nwFAP0w2NArrwFsURDeb0SPiJOLcsEXapTOEhJpWtO0tgaLPe26qiw==",cdn-downstream-fbl=1
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Thu, 24 Oct 2024 17:48:15 GMT
content-type: text/javascript
last-modified: Thu, 24 Oct 2024 17:21:26 GMT
vary: Origin
x-amz-cf-id: nwFAP0w2NArrwFsURDeb0SPiJOLcsEXapTOEhJpWtO0tgaLPe26qiw==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 e3b3138ab681fdbb8fab7bde9e330642.cloudfront.net (CloudFront)
accept-ranges: bytes
access-control-allow-origin: *
content-length: 993
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5
server: CloudFront
x-amz-server-side-encryption: AES256

GET
H3 200 chunk-BLPGJRRP.mjs Show response
framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/ 16 KB
4 KB 139ms
138ms Script
text/javascript 18.238.80.36
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/chunk-BLPGJRRP.mjs

Requested by

Host: hunt.io
URL: https://hunt.io/blog/rare-watermark-links-cobalt-strike-team-servers-to-ongoing-suspicious-activity

Protocol

Security

QUIC, , AES_128_GCM

Server

18.238.80.36 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-238-80-36.jfk52.r.cloudfront.net

Software

CloudFront /

Resource Hash

2559a88e000cccc51219cf9871ce1762dad455a8a76d0cb1d13821e0664b39dd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	deny
X-Xss-Protection	0

Request headers

User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin: https://hunt.io
Referer: https://framerusercontent.com/sites/6JIWbys4J7luUrNMA4Ci7w/pRiwASxP9OJsmj9eXZodYhMZRAVY5w9eI5HAcshw2Vw.BBMY7BTJ.mjs

Response headers

access-control-max-age: 0
content-encoding: br
etag: W/"b00a0c4ceb4d020cc933396dce6edc73"
x-amz-version-id: whlBBe8CPrdLXcapmb6u3O2ZCaaaKoNX
age: 60823
access-control-allow-methods: GET
x-content-type-options: nosniff
server-timing: cdn-cache-hit,cdn-pop;desc="JFK52-P5",cdn-hit-layer;desc="EDGE",cdn-rid;desc="nBk7yFOqdK4-j5EMYlja-S4F3xbfycJ2_CXjaur1cOuvT-kUXdGM_A==",cdn-downstream-fbl=1
x-cache: Hit from cloudfront
alt-svc: h3=":443"; ma=86400
date: Tue, 10 Dec 2024 16:04:07 GMT
content-type: text/javascript
last-modified: Tue, 10 Dec 2024 15:58:52 GMT
vary: Accept-Encoding,Origin
x-amz-cf-id: nBk7yFOqdK4-j5EMYlja-S4F3xbfycJ2_CXjaur1cOuvT-kUXdGM_A==
x-frame-options: deny
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-replication-status: COMPLETED
cache-control: public, max-age=31536000, immutable
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
referrer-policy: strict-origin-when-cross-origin
via: 1.1 e3b3138ab681fdbb8fab7bde9e330642.cloudfront.net (CloudFront)
access-control-allow-origin: *
x-xss-protection: 0
x-amz-cf-pop: JFK52-P5
server: CloudFront
x-amz-server-side-encryption: AES256

Verdicts & Comments Add Verdict or Comment

13 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

2 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

			Domain/Path	Expires	Name / Value
			.hunt.io/	1970-01-21 11:14:27	Name: _ga_CKJY21YJ7N Value: GS1.1.1733907467.1.0.1733907467.0.0.0
			.hunt.io/	1970-01-21 11:14:27	Name: _ga Value: GA1.1.2079786483.1733907467

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Strict-Transport-Security	max-age=31536000

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

app.framerstatic.com
events.framer.com
framer.com
framerusercontent.com
hunt.io
public-hunt-static-blog-assets.s3.us-east-1.amazonaws.com
www.google-analytics.com
www.googletagmanager.com
13.226.94.26
18.238.80.36
2600:9000:21da:f000:10:9b9d:b9c0:93a1
2600:9000:261f:fa00:d:6b42:4ec0:93a1
2600:9000:266a:2200:d:ada1:a280:93a1
2607:f8b0:4004:c1f::66
2607:f8b0:4006:81e::2008
3.5.21.37
35.71.142.77
0d483fb31b7baa932fb38d9e974bcca41a9ecfa605e0d540b66e54e39fe69f6b
1444a7eaffad2eae4dd0999fb1fd4c308e51876b70db2c4f1181c8a038f1f859
1903ee47f38fb5a0b56ce197b51aa0e1be80b22ab3afcd1a466eb1ee536aa8b3
195e5840ca8966eb3ab97a9eb1582e7375d49810416f043dd8378af918367b9f
19d418a2f626fc1c0356c26eb11f3ee19295720ac760dc28463e75bfafabb1d4
20f16f669e39ddc2f4fce46463481ec43157c6d23258ec2f59f32a23c3d66a8a
22b07807afbc388ecd51abfcbecb67055935c2e3b93ac4283a5becedd5e70621
22e5cfd55973895f60a7f6bf877482dc964962f8dd778612fc149bed56112bc1
24bd03c6988e57312952d42ebbd11a362b0be97ff666d3d6ac8f3597174c56b6
2559a88e000cccc51219cf9871ce1762dad455a8a76d0cb1d13821e0664b39dd
25aeb8cf020d602895b80560676fabfa34b3c350195a0660572b6c87d8c0c37d
2dc968863319a6f57e6428a7b4c292ae254d3e462b5f23f71bab492317067d5f
2f37e3fd569a267dad5ef4e47eed27d209397137fbe1be9eb9fb91e642f6400f
324a9989ddbb2f2467a735983838314194704fb724135401a55046f54e852cde
341f61d7c3838f9e303327f41376afcc21e5e7e5d5408b795be682dcd97cde43
401ee53282cafd5b2ab218ad1b26ba6a3c71fc65886b4d81a3617f44bd5fa6ee
4107b11930c4eef1f6ae5a76d441562e6d21a601f1781f37fd085542cd87412b
449b30c2317c76c281158fa547bb61f301dd9f675b54699a8bfc5040648fda2d
4dc2a5162f03c1768634a7d933f034a800807b5324368e398cdbfc038a06d395
6fa7b05626f316594c613602ef5bed9327ca1941725837795dfc47414fb05cb5
735103ff08357f02f897a41eaaddab0492f9962697b44c7d5937cd6fe999dd67
7734581c037aa18ef75406de8fe8447d0194e730d674fa4670495be8982f366d
831ed047a786cb3bd6a4a3ee93e8457242ee53207b0d04c3b66a3f9899dd78bb
85423271cadc50e7a8873249d3ece6c62b3180112ac657e66347ce4241d31dc9
89e61318afc569842f98ccd196ff7cfbb36ec69bad3af935dd5c7149b494fde4
8b91ee4af78a9558d2bbbc889b190d7c47647405fabc8ae5be1c014d6c938228
9753c83f61822ce350ea508e36e2ee9395589100a0b3afa9df41a4c1a0910408
9b262903031bac954a107f6aab50d7735135e7a946ab18e1351df9d49a9159ff
9cc352a4d050c98f080c4ab6550f54f4d383c9509c902b666e64548d83a62471
a1e9b3da59fa84c73948363f79bd0cef61cdb495511606fa4c2d8a06ddc954d8
a2cc6f4036b7ba96d44dc4a4489a50aad64157c4648bb10a37292575b85c02ba
a741fd3317fed44c0f1c7b8161f1420298b044e564dfea131957c0e27982a66c
a9428e5e5f6c5ede3339114a8be6230e2cc39a2190d03f1092ae93bdaf556891
af40af5e1469d7ef41aee9645556b634ada06969e8a9babf4d4e17c38aad2caf
af7863f53048fe6d665e912eb1a7438502bcd90275756bd57746711efd07ad1e
bad9ed8e37d8d1aee7eacb1761e4bf4a7ac110eec89a7e92ff35545023c37cd7
baec8ef28ee7d04e84305e579a7a397af272c2b2694b3e2879ea01a14c16a76a
bece75fc8837c8a539530ef23fa0597efe496fb7d07b7087ed78f7a4a6ea0ceb
c56899f4291eff03eed62b752565556777823419de3f2b5c9020c02a883ea8ae
c861d136456a64c9c5619e9fa7c37c80144ea5d8879d88554c1f8abaaae891bf
ca91ca3baad1db28d57e2e66c1636b41d0b1ebeec150cd744ed7612cfade3310
cc324555c1cd681a59c27be1eda61da587d17bf71cc1ed8aa3e4a51e77907685
cf51594b76c66c43206e9aa471baec6a92594ea6b8cbead1b40f445468de76e0
d1964a0c53200006e756ef0d0e32cea07deff44d89075cf26ae2afe3d85f43e2
dae44b82855ff15075c37f13f6492e3407e86c9bf27bf8c06b5e7f6dc7739238
dcb6c51ec0458017b4fc8364df113fc4556a9346ce84daafda08bc73fcd27539
dda3ae667335cfd45ec00006177baa81cdcffd2584b76e84cbfe1819b7425484
e1d4e429bec9bc36a28143018ae0400faee2ea7ffe9442942794e016a094220c
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e77e2400288b5496592bb75f3d2c61871d947b1705f8a2d98c4bdea3a8ebbadd
e7ded5e12508f728778cdc968bf945badfc120ce873943924e0a6dd516871c7e
e96570316195a9f6d9ae66ad55325d340e90ca1563bff1972640b2e0435002f2
f0f40885a14cd51f7d572952787c67b7c3e51399c2107171bb1bf741d22a6989
f5b8526bb0e6c1a53d014fca1808aebfb9abaa825ba0e7f54c32562023e255b4
f8c7aece584727904d9ece558d571f0a745d505013a200a9e4382d293401e840
fd2c9f5458dff3221f07b1f32bb05b7d9fbf9e9f435448ed14ed1c273d0e493e

hunt.io Open in urlscan Pro 35.71.142.77 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

60 Requests

97 %HTTPS

56 %IPv6

7 Domains

8 Subdomains

9 IPs

1 Countries

1485 kBTransfer

5301 kBSize

2 Cookies

7 Outgoing links

Redirected requests

60 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 1 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

hunt.io Open in urlscan Pro
35.71.142.77 Public Scan

Screenshot
Live screenshot

Full Image

60
Requests

97 %
HTTPS

56 %
IPv6

7
Domains

8
Subdomains

9
IPs

1
Countries

1485 kB
Transfer

5301 kB
Size

2
Cookies

60 HTTP transactions
1 data transactions