duo.com Open in urlscan Pro
13.32.99.68 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Effective URL:
https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Submission: On May 08 via api (May 8th 2022, 8:32:35 pm UTC) from BR — Scanned from DE

Summary HTTP 103 Redirects Links 3 Behaviour Indicators

Summary

This website contacted 37 IPs in 7 countries across 30 domains to perform 103 HTTP transactions. The main IP is 13.32.99.68, located in United States and belongs to AMAZON-02, US. The main domain is duo.com. The Cisco Umbrella rank of the primary domain is 104691.
TLS certificate: Issued by Amazon on October 23rd 2021. Valid for: a year.

This is the only time duo.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
11	13.32.99.68 13.32.99.68	16509 (AMAZON-02) (AMAZON-02)
1	2a00:1450:400... 2a00:1450:4001:801::200a	15169 (GOOGLE) (GOOGLE)
2	2a02:26f0:6c0... 2a02:26f0:6c00:288::b33	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
3	2a00:1450:400... 2a00:1450:4001:813::2008	15169 (GOOGLE) (GOOGLE)
9	2a00:1450:400... 2a00:1450:4001:82a::200e	15169 (GOOGLE) (GOOGLE)
7	152.195.15.58 152.195.15.58	15133 (EDGECAST) (EDGECAST)
1	2a02:26f0:350... 2a02:26f0:3500:7::17d8:4dcd	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	18.66.112.26 18.66.112.26	16509 (AMAZON-02) (AMAZON-02)
3	2a03:2880:f00... 2a03:2880:f007:8:face:b00c:0:1	32934 (FACEBOOK) (FACEBOOK)
2	104.111.234.67 104.111.234.67	16625 (AKAMAI-AS) (AKAMAI-AS)
1 4	2620:1ec:c11:... 2620:1ec:c11::200	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
2	2620:116:800d... 2620:116:800d:21:3175:5196:e3fd:8c1d	16509 (AMAZON-02) (AMAZON-02)
12	96.16.137.162 96.16.137.162	16625 (AKAMAI-AS) (AKAMAI-AS)
1	205.185.216.10 205.185.216.10	20446 (STACKPATH...) (STACKPATH-CDN)
2	2606:4700:20:... 2606:4700:20::681a:527	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:811::200e	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:400c:c08::9a	15169 (GOOGLE) (GOOGLE)
3	2a00:1450:400... 2a00:1450:4001:829::2003	15169 (GOOGLE) (GOOGLE)
3 3	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2600:9000:223... 2600:9000:223c:8200:6:44e3:f8c0:93a1	16509 (AMAZON-02) (AMAZON-02)
5	104.75.88.194 104.75.88.194	16625 (AKAMAI-AS) (AKAMAI-AS)
1	192.28.147.68 192.28.147.68	15224 (OMNITURE) (OMNITURE)
4	52.224.31.34 52.224.31.34	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	2600:9000:225... 2600:9000:2250:5e00:1b:ed91:4680:93a1	16509 (AMAZON-02) (AMAZON-02)
2	2a00:1450:400... 2a00:1450:4001:801::2004	15169 (GOOGLE) (GOOGLE)
1 4	52.19.61.87 52.19.61.87	16509 (AMAZON-02) (AMAZON-02)
1	72.163.10.10 72.163.10.10	109 (CISCOSYSTEMS) (CISCOSYSTEMS)
2	34.248.131.147 34.248.131.147	16509 (AMAZON-02) (AMAZON-02)
1	52.213.194.249 52.213.194.249	16509 (AMAZON-02) (AMAZON-02)
2	15.188.95.229 15.188.95.229	16509 (AMAZON-02) (AMAZON-02)
2 2	172.217.18.98 172.217.18.98	15169 (GOOGLE) (GOOGLE)
1	104.244.42.3 104.244.42.3	13414 (TWITTER) (TWITTER)
1 1	212.82.100.182 212.82.100.182	34010 (YAHOO-IRD) (YAHOO-IRD)
1 1	54.166.21.101 54.166.21.101	14618 (AMAZON-AES) (AMAZON-AES)
1	52.16.172.200 52.16.172.200	16509 (AMAZON-02) (AMAZON-02)
4	2a03:2880:f10... 2a03:2880:f107:83:face:b00c:0:25de	32934 (FACEBOOK) (FACEBOOK)
1	185.33.221.88 185.33.221.88	29990 (ASN-APPNEX) (ASN-APPNEX)
1	2a02:26f0:6c0... 2a02:26f0:6c00:294::1c91	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1 2	52.142.114.2 52.142.114.2	8075 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
103	37

11 13.32.99.68 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-32-99-68.fra60.r.cloudfront.net

duo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:801::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

ajax.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a02:26f0:6c00:288::b33 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

www.cisco.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:813::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:82a::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

7 152.195.15.58 (United States)

ASN15133 (EDGECAST, US)

cdn.bizible.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn.bizibly.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3500:7::17d8:4dcd (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.112.26 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-112-26.fra56.r.cloudfront.net

t.contentsquare.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a03:2880:f007:8:face:b00c:0:1 (Vienna, Austria)

ASN32934 (FACEBOOK, US)

connect.facebook.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.111.234.67 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-111-234-67.deploy.static.akamaitechnologies.com

munchkin.marketo.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2620:1ec:c11::200 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

bat.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.bing.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2620:116:800d:21:3175:5196:e3fd:8c1d (United States)

ASN16509 (AMAZON-02, US)

secure.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.quantserve.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

12 96.16.137.162 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a96-16-137-162.deploy.static.akamaitechnologies.com

j.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
c.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
b.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 205.185.216.10 (United States)

ASN20446 (STACKPATH-CDN, US)
PTR: map2.hwcdn.net

metadata-static-files.sfo2.cdn.digitaloceanspaces.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700:20::681a:527 (United States)

ASN13335 (CLOUDFLARENET, US)

jscloud.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:811::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

analytics.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:400c:c08::9a (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2a00:1450:4001:829::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.de	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2620:1ec:21::14 (United States) 3 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
www.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:223c:8200:6:44e3:f8c0:93a1 (United States)

ASN16509 (AMAZON-02, US)

rules.quantcount.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

5 104.75.88.194 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS, US)
PTR: a104-75-88-194.deploy.static.akamaitechnologies.com

tags.tiqcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 192.28.147.68 (United States)

ASN15224 (OMNITURE, US)

074-uqx-410.mktoresp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.224.31.34 (Tappahannock, United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

h.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:2250:5e00:1b:ed91:4680:93a1 (United States)

ASN16509 (AMAZON-02, US)

csxd.contentsquare.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:801::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 52.19.61.87 (Dublin, Ireland) 1 redirects

ASN16509 (AMAZON-02, US)
PTR: ec2-52-19-61-87.eu-west-1.compute.amazonaws.com

dpm.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 72.163.10.10 (United States)

ASN109 (CISCOSYSTEMS, US)
PTR: cisco-tags.cisco.com

cisco-tags.cisco.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.248.131.147 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-34-248-131-147.eu-west-1.compute.amazonaws.com

c.contentsquare.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.213.194.249 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-213-194-249.eu-west-1.compute.amazonaws.com

cisco.demdex.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 15.188.95.229 (Paris, France)

ASN16509 (AMAZON-02, US)
PTR: ec2-15-188-95-229.eu-west-3.compute.amazonaws.com

smetrics.cisco.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 172.217.18.98 (United States) 2 redirects

ASN15169 (GOOGLE, US)
PTR: fra16s42-in-f2.1e100.net

cm.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 104.244.42.3 (United States)

ASN13414 (TWITTER, US)

analytics.twitter.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 212.82.100.182 (Dublin, Ireland) 1 redirects

ASN34010 (YAHOO-IRD, GB)
PTR: spcms.pbp.vip.ir2.yahoo.com

cms.analytics.yahoo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 54.166.21.101 (United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-54-166-21-101.compute-1.amazonaws.com

usermatch.krxd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 52.16.172.200 (Dublin, Ireland)

ASN16509 (AMAZON-02, US)
PTR: ec2-52-16-172-200.eu-west-1.compute.amazonaws.com

beacon.krxd.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a03:2880:f107:83:face:b00c:0:25de (Vienna, Austria)

ASN32934 (FACEBOOK, US)

www.facebook.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 185.33.221.88 (Amsterdam, Netherlands)

ASN29990 (ASN-APPNEX, US)
PTR: 726.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

secure.adnxs.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6c00:294::1c91 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

ipv6.6sc.co	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.142.114.2 (Dublin, Ireland) 1 redirects

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

c.clarity.ms	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
13	6sc.co j.6sc.co — Cisco Umbrella Rank: 14504 c.6sc.co — Cisco Umbrella Rank: 19087 ipv6.6sc.co b.6sc.co — Cisco Umbrella Rank: 8518	18 KB
11	duo.com duo.com — Cisco Umbrella Rank: 104691	623 KB
9	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 101	59 KB
6	clarity.ms 1 redirects h.clarity.ms — Cisco Umbrella Rank: 2443 c.clarity.ms — Cisco Umbrella Rank: 926	24 KB
6	bizible.com cdn.bizible.com — Cisco Umbrella Rank: 15177	64 KB
5	demdex.net 1 redirects dpm.demdex.net — Cisco Umbrella Rank: 283 cisco.demdex.net — Cisco Umbrella Rank: 47949	7 KB
5	tiqcdn.com tags.tiqcdn.com — Cisco Umbrella Rank: 1114	91 KB
5	doubleclick.net 2 redirects stats.g.doubleclick.net — Cisco Umbrella Rank: 175 cm.g.doubleclick.net — Cisco Umbrella Rank: 289	1 KB
5	cisco.com www.cisco.com — Cisco Umbrella Rank: 2207 cisco-tags.cisco.com — Cisco Umbrella Rank: 74823 smetrics.cisco.com — Cisco Umbrella Rank: 93696	64 KB
4	facebook.com www.facebook.com — Cisco Umbrella Rank: 100	731 B
4	linkedin.com 3 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 899 www.linkedin.com — Cisco Umbrella Rank: 787 px4.ads.linkedin.com — Cisco Umbrella Rank: 4880	3 KB
4	google.com analytics.google.com — Cisco Umbrella Rank: 892 www.google.com — Cisco Umbrella Rank: 20	1003 B
4	bing.com 1 redirects bat.bing.com — Cisco Umbrella Rank: 605 c.bing.com — Cisco Umbrella Rank: 379	13 KB
4	contentsquare.net t.contentsquare.net — Cisco Umbrella Rank: 4135 csxd.contentsquare.net — Cisco Umbrella Rank: 19530 c.contentsquare.net — Cisco Umbrella Rank: 4088	71 KB
3	google.de www.google.de — Cisco Umbrella Rank: 3632	671 B
3	facebook.net connect.facebook.net — Cisco Umbrella Rank: 195	200 KB
3	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 142	237 KB
2	krxd.net 1 redirects usermatch.krxd.net — Cisco Umbrella Rank: 1936 beacon.krxd.net — Cisco Umbrella Rank: 662	527 B
2	jscloud.net jscloud.net — Cisco Umbrella Rank: 91932	2 KB
2	quantserve.com secure.quantserve.com — Cisco Umbrella Rank: 1338 pixel.quantserve.com — Cisco Umbrella Rank: 653	10 KB
2	marketo.net munchkin.marketo.net — Cisco Umbrella Rank: 6945	6 KB
1	adnxs.com secure.adnxs.com — Cisco Umbrella Rank: 612	691 B
1	yahoo.com 1 redirects cms.analytics.yahoo.com — Cisco Umbrella Rank: 1597	674 B
1	twitter.com analytics.twitter.com — Cisco Umbrella Rank: 800	354 B
1	bizibly.com cdn.bizibly.com — Cisco Umbrella Rank: 17575	204 B
1	mktoresp.com 074-uqx-410.mktoresp.com — Cisco Umbrella Rank: 493822	311 B
1	quantcount.com rules.quantcount.com — Cisco Umbrella Rank: 1160	1 KB
1	digitaloceanspaces.com metadata-static-files.sfo2.cdn.digitaloceanspaces.com — Cisco Umbrella Rank: 32843	6 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 1589	3 KB
1	googleapis.com ajax.googleapis.com — Cisco Umbrella Rank: 432	30 KB
103	30

	Domain	Requested by
11	duo.com	duo.com
10	b.6sc.co
9	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com duo.com
6	cdn.bizible.com	www.googletagmanager.com duo.com cdn.bizible.com
5	tags.tiqcdn.com	www.cisco.com tags.tiqcdn.com
4	www.facebook.com	duo.com
4	dpm.demdex.net	1 redirects duo.com
4	h.clarity.ms	bat.bing.com cdn.bizible.com
3	www.google.de	duo.com
3	stats.g.doubleclick.net	www.googletagmanager.com www.google-analytics.com cdn.bizible.com
3	bat.bing.com	duo.com bat.bing.com
3	connect.facebook.net	duo.com connect.facebook.net
3	www.googletagmanager.com	duo.com www.googletagmanager.com tags.tiqcdn.com
2	c.clarity.ms	1 redirects
2	cm.g.doubleclick.net	2 redirects
2	smetrics.cisco.com	cdn.bizible.com tags.tiqcdn.com
2	c.contentsquare.net	duo.com
2	www.google.com	duo.com
2	px.ads.linkedin.com	2 redirects
2	analytics.google.com	www.googletagmanager.com
2	jscloud.net	www.googletagmanager.com cdn.bizible.com
2	munchkin.marketo.net	duo.com munchkin.marketo.net
2	www.cisco.com	duo.com
1	c.bing.com	1 redirects
1	ipv6.6sc.co	cdn.bizible.com
1	c.6sc.co	cdn.bizible.com
1	secure.adnxs.com	cdn.bizible.com
1	beacon.krxd.net	duo.com
1	usermatch.krxd.net	1 redirects
1	cms.analytics.yahoo.com	1 redirects
1	analytics.twitter.com	duo.com
1	cisco.demdex.net	tags.tiqcdn.com
1	cisco-tags.cisco.com	duo.com
1	pixel.quantserve.com	duo.com
1	csxd.contentsquare.net	t.contentsquare.net
1	cdn.bizibly.com	duo.com
1	074-uqx-410.mktoresp.com	munchkin.marketo.net
1	rules.quantcount.com	secure.quantserve.com
1	px4.ads.linkedin.com	duo.com
1	www.linkedin.com	1 redirects
1	metadata-static-files.sfo2.cdn.digitaloceanspaces.com	duo.com
1	j.6sc.co	duo.com
1	secure.quantserve.com	duo.com
1	t.contentsquare.net	www.googletagmanager.com
1	snap.licdn.com	www.googletagmanager.com
1	ajax.googleapis.com	duo.com
103	46

This site contains links to these domains. Also see Links.

Domain
twitter.com
www.facebook.com
www.youtube.com

Subject Issuer	Validity	Valid
www.duosecurity.com Amazon	`2021-10-23` - `2022-11-20`	a year	crt.sh
upload.video.google.com GTS CA 1C3	`2022-04-18` - `2022-07-11`	3 months	crt.sh
www.cisco.com HydrantID Server CA O1	`2021-11-16` - `2022-11-16`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2022-04-18` - `2022-07-11`	3 months	crt.sh
io.bizible.com DigiCert TLS RSA SHA256 2020 CA1	`2021-06-30` - `2022-07-05`	a year	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2022-03-01` - `2023-03-01`	a year	crt.sh
t.contentsquare.net Amazon	`2021-11-13` - `2022-12-11`	a year	crt.sh
*.facebook.com DigiCert SHA2 High Assurance Server CA	`2022-02-15` - `2022-05-16`	3 months	crt.sh
*.marketo.net DigiCert SHA2 Secure Server CA	`2022-02-06` - `2023-02-07`	a year	crt.sh
www.bing.com Microsoft RSA TLS CA 01	`2022-03-16` - `2022-09-16`	6 months	crt.sh
*.quantserve.com DigiCert TLS RSA SHA256 2020 CA1	`2021-09-22` - `2022-09-21`	a year	crt.sh
*.6sc.co DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-03-08` - `2023-03-11`	a year	crt.sh
*.sfo2.cdn.digitaloceanspaces.com DigiCert TLS RSA SHA256 2020 CA1	`2022-04-18` - `2023-05-03`	a year	crt.sh
*.jscloud.net E1	`2022-03-21` - `2022-06-19`	3 months	crt.sh
*.google.com GTS CA 1C3	`2022-04-18` - `2022-07-11`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2022-04-18` - `2022-07-11`	3 months	crt.sh
www.google.de GTS CA 1C3	`2022-04-18` - `2022-07-11`	3 months	crt.sh
*.tiqcdn.com DigiCert SHA2 Secure Server CA	`2022-02-27` - `2023-02-28`	a year	crt.sh
*.mktoresp.com DigiCert TLS RSA SHA256 2020 CA1	`2021-11-30` - `2022-11-30`	a year	crt.sh
a.clarity.ms Microsoft RSA TLS CA 01	`2021-07-27` - `2022-07-27`	a year	crt.sh
csxd-02.contentsquare.net Amazon	`2021-09-01` - `2022-09-30`	a year	crt.sh
www.google.com GTS CA 1C3	`2022-04-18` - `2022-07-11`	3 months	crt.sh
tagapp-prd-01.cisco.com HydrantID Server CA O1	`2021-08-04` - `2022-08-04`	a year	crt.sh
c.contentsquare.net Amazon	`2021-09-14` - `2022-10-13`	a year	crt.sh
*.google.de GTS CA 1C3	`2022-04-18` - `2022-07-11`	3 months	crt.sh
*.demdex.net DigiCert TLS RSA SHA256 2020 CA1	`2021-10-19` - `2022-11-19`	a year	crt.sh
smetrics.cisco.com DigiCert TLS RSA SHA256 2020 CA1	`2022-03-09` - `2023-04-09`	a year	crt.sh
*.twitter.com DigiCert TLS Hybrid ECC SHA384 2020 CA1	`2022-03-07` - `2023-03-06`	a year	crt.sh
*.adnxs.com GeoTrust ECC CA 2018	`2022-02-11` - `2023-03-14`	a year	crt.sh

This page contains 5 frames:

Primary Page: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Frame ID: 73183BFBF4A356AC89AC034FA104C835
Requests: 95 HTTP requests in this frame

Frame: https://csxd.contentsquare.net/uxa/xdframe-single-domain-1.1.1.html?pid=5637
Frame ID: 3C3A0C753E5B4464BFF8B0F6C434235C
Requests: 1 HTTP requests in this frame

Frame: https://cisco.demdex.net/dest5.html?d_nsid=0
Frame ID: 8C1F370ACEA9E6547B61D706CF8C3504
Requests: 5 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 5C5ECC9C5D8A0ECD7B72CC6EA0CFD5A7
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 9F90B9F01521B4D3994F70AB357BEA09
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

| Decipher

Detected technologies

AppNexus (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

adnxs\.(?:net|com)

Facebook (Widgets) Expand

Overall confidence: 100%
Detected patterns

//connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Marketo (Marketing Automation) Expand

Overall confidence: 100%
Detected patterns

munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

/([\d.]+)/jquery(?:\.min)?\.js
jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

103
Requests

92 %
HTTPS

45 %
IPv6

30
Domains

46
Subdomains

37
IPs

7
Countries

1534 kB
Transfer

4669 kB
Size

60
Cookies

3 Outgoing links

These are links going to different origins than the main page.

URL: https://twitter.com/deciphersec

Search URL Search Domain Scan URL

URL: https://www.facebook.com/decipherbyduo

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCszm81zKIPoF4ljkBJwmB2g/

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 26

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7540&time=1652041942476&url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS HTTP 302
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D7540%26time%3D1652041942476%26url%3Dhttps%253A%252F%252Fduo.com%252Fdecipher%252Ftrailblazer-hunts-compromised-credentials-in-aws%252FnAWS%26liSync%3Dtrue HTTP 302
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7540&time=1652041942476&url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&liSync=true HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7540&time=1652041942476&url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&liSync=true&e_ipv6=AQJCFwaG5yr3IAAAAYClX4qoq4RmarD4XR5ABThQ-e8OanSANDnEpNDElV3KYomkk__NPyCrBQ

Request Chain 53

https://dpm.demdex.net/id?d_visid_ver=4.1.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=B8D07FF4520E94C10A490D4C%40AdobeOrg&d_nsid=0&ts=1652041943353 HTTP 302
https://dpm.demdex.net/id/rd?d_visid_ver=4.1.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=B8D07FF4520E94C10A490D4C%40AdobeOrg&d_nsid=0&ts=1652041943353

Request Chain 70

https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=MjAyOTA4MDU0NDYzNjcxNTMyMTEwNDQzMDczODk1MDYyMDQxODc= HTTP 302
https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm=&gdpr=0&gdpr_consent=&google_hm=MjAyOTA4MDU0NDYzNjcxNTMyMTEwNDQzMDczODk1MDYyMDQxODc=&google_tc= HTTP 302
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEH5cT4j_IIYqvEVwgAeTefo&google_cver=1?gdpr=0&gdpr_consent=

Request Chain 72

https://cms.analytics.yahoo.com/cms?partner_id=ADOBE&_hosted_id=20290805446367153211044307389506204187&gdpr=0&gdpr_consent= HTTP 302
https://dpm.demdex.net/ibs:dpid=30646?dpuuid=y-oaBtDGdE2pGpqnlxqnoXxa47goPwK48MG5E-~A

Request Chain 73

https://usermatch.krxd.net/um/v2?partner=adobe&id=20290805446367153211044307389506204187 HTTP 302
https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=adobe&id=20290805446367153211044307389506204187

Request Chain 83

https://c.clarity.ms/c.gif HTTP 302
https://c.bing.com/c.gif?CtsSyncId=7ECA64E6BF474FE78179C827E6749A4F&RedC=c.clarity.ms&MXFR=0AC962C66A0C67D8356C73586E0C698D HTTP 302
https://c.clarity.ms/c.gif?CtsSyncId=7ECA64E6BF474FE78179C827E6749A4F&MUID=0A8B0D6411FA61393C061CFA102860C8

103 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 404 Primary Request nAWS Show response
duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/ 14 KB
5 KB 2387ms
2154ms Document
text/html 13.32.99.68
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.68 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-68.fra60.r.cloudfront.net
Software: Duo/1.0 /
Resource Hash: 27d6fba6ad31a91fa31d69869c76b901f4eab1b2d3daede85479097c04c605c0

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

content-encoding: gzip
content-length: 5185
content-type: text/html; charset=utf-8
date: Sun, 08 May 2022 20:32:20 GMT
etag: W/"6255da84-391f"
server: Duo/1.0
vary: Accept-Encoding
via: 1.1 8b889e35789d2b97f2ba8771acc9a008.cloudfront.net (CloudFront)
x-amz-cf-id: 8ZCNPL_D-UPsnosgsI3EQTexzhOdjXP70CBD-aRjW3IeGpzxuF32bQ==
x-amz-cf-pop: FRA60-P3
x-cache: Error from cloudfront

GET
H2 200 production-2021.css
duo.com/css/ 515 KB
99 KB 778ms
777ms Stylesheet
text/css 13.32.99.68
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://duo.com/css/production-2021.css?v=1647976353
Requested by: Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.68 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-68.fra60.r.cloudfront.net
Software: Duo/1.0 /
Resource Hash: b2021fe9b1f8b7e7bb44e57c5aed88f45cab8b7a0e84f39b7e472277361f1da5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: public
date: Sun, 08 May 2022 20:32:21 GMT
content-encoding: gzip
last-modified: Thu, 14 Apr 2022 16:20:39 GMT
server: Duo/1.0
x-amz-cf-pop: FRA60-P3
etag: W/"625849d7-80a86"
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: text/css
via: 1.1 8b889e35789d2b97f2ba8771acc9a008.cloudfront.net (CloudFront)
cache-control: max-age=31536000, public, must-revalidate, proxy-revalidate, max-age=31536000
x-amz-cf-id: feeSxr68gEIW_4ywhG9lBC3_85fWcGrvZLi4MHMf_qvfdxfYrd3QFw==
expires: Mon, 08 May 2023 20:32:21 GMT

GET
H2 200 d-logo--light.svg
duo.com/assets/img/decipher/logos/ 4 KB
2 KB 119ms
119ms Image
image/svg+xml 13.32.99.68
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://duo.com/assets/img/decipher/logos/d-logo--light.svg
Requested by: Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.68 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-68.fra60.r.cloudfront.net
Software: Duo/1.0 /
Resource Hash: 694b5d6220eb8a349b60ce749052c3b923c8449bbfb4ebfb68f4fc27f1b7e92b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: public
date: Wed, 27 Apr 2022 11:19:24 GMT
content-encoding: gzip
last-modified: Tue, 12 Apr 2022 20:00:42 GMT
server: Duo/1.0
age: 983577
etag: W/"6255da6a-ff2"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
via: 1.1 8b889e35789d2b97f2ba8771acc9a008.cloudfront.net (CloudFront)
cache-control: max-age=31536000, public, must-revalidate, proxy-revalidate, max-age=31536000
x-amz-cf-pop: FRA60-P3
x-amz-cf-id: j1Nbxj8-XI0BDUODCOsIr6-m6CzkBzesjK7xeJEYoRqR2gTvVJJR3g==
expires: Thu, 27 Apr 2023 11:19:24 GMT

GET
H2 200 aW1nL2RlY2lwaGVyLzQwNC5qcGc=
duo.com/img/asset/ 110 KB
111 KB 1590ms
1589ms Image
image/jpeg 13.32.99.68
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://duo.com/img/asset/aW1nL2RlY2lwaGVyLzQwNC5qcGc=?s=12378a2282d82a8f9f860cc85a068fe2

Requested by

Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.99.68 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-99-68.fra60.r.cloudfront.net

Software

Duo/1.0 /

Resource Hash

849b2ac11460487810a7132803d8680307e25126ba000a30b4775ed3e78201be

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Sun, 08 May 2022 20:32:22 GMT
via: 1.1 8b889e35789d2b97f2ba8771acc9a008.cloudfront.net (CloudFront)
x-content-type-options: nosniff
x-amz-cf-pop: FRA60-P3
x-cache: Miss from cloudfront
content-length: 112627
x-xss-protection: 1; mode=block
x-ua-compatible: IE=Edge,chrome=1
referrer-policy: no-referrer-when-downgrade
last-modified: Sun, 08 May 2022 20:32:22 GMT
server: Duo/1.0
x-frame-options: SAMEORIGIN
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: image/jpeg
cache-control: max-age=300
permissions-policy: interest-cohort=()
x-amz-cf-id: quiWa5eMV6u2c0wdx5gLvcvEeD4GTVdAYUvt05CYyHVW-vEvotRKEA==
expires: Sun, 08 May 2022 20:37:22 GMT

GET
H2 200 d-logo--footer.svg
duo.com/assets/img/decipher/logos/ 3 KB
2 KB 121ms
121ms Image
image/svg+xml 13.32.99.68
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://duo.com/assets/img/decipher/logos/d-logo--footer.svg
Requested by: Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.68 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-68.fra60.r.cloudfront.net
Software: Duo/1.0 /
Resource Hash: c33592c7a249c98164b3d533c58fae62ced2b403deab8f2d0cce4c4f1cbb285d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: public
date: Wed, 27 Apr 2022 11:19:25 GMT
content-encoding: gzip
last-modified: Tue, 12 Apr 2022 20:00:42 GMT
server: Duo/1.0
age: 983576
etag: W/"6255da6a-b5f"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
via: 1.1 8b889e35789d2b97f2ba8771acc9a008.cloudfront.net (CloudFront)
cache-control: max-age=31536000, public, must-revalidate, proxy-revalidate, max-age=31536000
x-amz-cf-pop: FRA60-P3
x-amz-cf-id: bwSwFJOJiZ7-QEQSFwcwbbZBkRWmrn2zF40N55OvVH6oiHlPTaGZDw==
expires: Thu, 27 Apr 2023 11:19:25 GMT

GET
H2 200 jquery.min.js Show response
ajax.googleapis.com/ajax/libs/jquery/2.1.4/ 82 KB
30 KB 689ms
221ms Script
text/javascript 2a00:1450:4001:801::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://ajax.googleapis.com/ajax/libs/jquery/2.1.4/jquery.min.js

Requested by

Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Mon, 02 May 2022 11:53:28 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 549533
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 29725
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 19:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="hosted-libraries-pushers"
vary: Accept-Encoding
report-to: {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type: text/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 02 May 2023 11:53:28 GMT

GET
H2 200 production-2021.min.js Show response
duo.com/js/build/ 760 KB
270 KB 750ms
749ms Script
application/javascript 13.32.99.68
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://duo.com/js/build/production-2021.min.js?v=1647976353
Requested by: Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.68 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-68.fra60.r.cloudfront.net
Software: Duo/1.0 /
Resource Hash: e8e74813d3382d7453da81f7037183bb926aa06ce68021ba6b55f01d20d0f205

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: public
date: Sun, 08 May 2022 20:32:21 GMT
content-encoding: gzip
last-modified: Thu, 14 Apr 2022 16:20:39 GMT
server: Duo/1.0
x-amz-cf-pop: FRA60-P3
etag: W/"625849d7-be0c2"
vary: Accept-Encoding
x-cache: Miss from cloudfront
content-type: application/javascript; charset=utf-8
via: 1.1 8b889e35789d2b97f2ba8771acc9a008.cloudfront.net (CloudFront)
cache-control: max-age=31536000, public, must-revalidate, proxy-revalidate, max-age=31536000
x-amz-cf-id: F0ZIQAs6gPuj5ygDTsgsG-uz3vDD_5aM09eG0e4rLh6uThM-YtHEsw==
expires: Mon, 08 May 2023 20:32:21 GMT

GET
H2 200 ctm.js Show response
www.cisco.com/c/dam/cdc/t/ 131 KB
31 KB 594ms
127ms Script
application/x-javascript 2a02:26f0:6c00:288::b33
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cisco.com/c/dam/cdc/t/ctm.js

Requested by

Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS

Protocol

Security

TLS 1.3, , CHACHA20_POLY1305

Server

2a02:26f0:6c00:288::b33 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Apache /

Resource Hash

4b1589731cab3cc03fa56b6e91e496162499ae05dc2e5f0a685dca5b2bc646a8

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors .cisco.com .jasper.com .ciscospark.com .ciscolive.com http://cisco.lookbookhq.com https://cisco.lookbookhq.com testcisco.marketing.adobe.com cisco.marketing.adobe.com ciscosales.my.salesforce.com test.salesforce.com zedo.com hindustantimes.com economictimes.indiatimes.com .webex.com .cdw.com .cdwg.com .cdw.ca .meraki-go.com http://ciscopartners.lookbookhq.com https://ciscopartners.lookbookhq.com ciscolearningsystem.com ciscocustomer.lookbookhq.com cisco.lookbookhq.com ccsmedia.com .itquotes.ie dteonline.com ampito-cisco.com arkphire.com .insight.com .ccsmedia.com .ebuyer.com .lambda-tek.com .storm-technologies.com .vohkus.com .bechtle.com .rainfocus.com .broadbandbuyer.com .hardware.com shop.redpontem.com cisco.techdatavendors.be;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Sun, 08 May 2022 20:32:21 GMT
content-encoding: gzip
x-content-type-options: nosniff
vary: Accept-Encoding
content-length: 30494
x-xss-protection: 1; mode=block
pragma: no-cache
cdchost: wemxweb-publish-prod1-01
x-test-debug: nURL=www.cisco.com,realm=0,isRealm=0,realmDomain=0,shortrealm=0,upgradeTest=1
server: Apache
x-frame-options: SAMEORIGIN
etag: "20d2f-5de451c03f976-gzip"
strict-transport-security: max-age=31536000
content-type: application/x-javascript
cache-control: max-age=0, no-cache, no-store
content-security-policy: upgrade-insecure-requests; frame-ancestors *.cisco.com *.jasper.com *.ciscospark.com *.ciscolive.com http://cisco.lookbookhq.com https://cisco.lookbookhq.com testcisco.marketing.adobe.com cisco.marketing.adobe.com ciscosales.my.salesforce.com test.salesforce.com zedo.com hindustantimes.com economictimes.indiatimes.com *.webex.com *.cdw.com *.cdwg.com *.cdw.ca *.meraki-go.com http://ciscopartners.lookbookhq.com https://ciscopartners.lookbookhq.com ciscolearningsystem.com ciscocustomer.lookbookhq.com cisco.lookbookhq.com ccsmedia.com *.itquotes.ie dteonline.com ampito-cisco.com arkphire.com *.insight.com *.ccsmedia.com *.ebuyer.com *.lambda-tek.com *.storm-technologies.com *.vohkus.com *.bechtle.com *.rainfocus.com *.broadbandbuyer.com *.hardware.com shop.redpontem.com cisco.techdatavendors.be;
accept-ranges: bytes
expires: Sun, 08 May 2022 20:32:21 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 287 KB
85 KB 495ms
254ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MFPB9D

Requested by

Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

6a1950ad21353f4dd382ed39e5205de0f61b1b65441b765f04eee31777657b69

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Sun, 08 May 2022 20:32:21 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 87016
x-xss-protection: 0
last-modified: Sun, 08 May 2022 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 08 May 2022 20:32:21 GMT

GET
H2 200 optimize.js Show response
www.google-analytics.com/gtm/ 100 KB
39 KB 447ms
229ms Script
application/javascript 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/gtm/optimize.js?id=GTM-WV3KTWL

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MFPB9D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

16c9dd6c54dfe7bd3ad953d44a2d5eb8169a34927b58c901e7c159bb1138138e

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Sun, 08 May 2022 20:32:22 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 39801
x-xss-protection: 0
last-modified: Sun, 08 May 2022 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 08 May 2022 20:32:22 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 182 KB
66 KB 126ms
126ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-95Z7P6PE75&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MFPB9D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

ef4a91c804c8dc985882cb7e84978cfc6710269ae91ef5dca9f1d489ee662f78

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Sun, 08 May 2022 20:32:22 GMT
content-encoding: br
server: Google Tag Manager
access-control-allow-headers: Cache-Control
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
strict-transport-security: max-age=31536000; includeSubDomains
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 67934
x-xss-protection: 0
expires: Sun, 08 May 2022 20:32:22 GMT

GET
H2 200 bizible.js Show response
cdn.bizible.com/scripts/ 83 KB
32 KB 508ms
130ms Script
application/x-javascript 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.bizible.com/scripts/bizible.js?account=duo.com
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MFPB9D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (lhb/6367) /
Resource Hash: cbda94666db24554bf77638fc059848d381c3c98f7f24641fa830abcd5793de7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Sun, 08 May 2022 20:32:22 GMT
content-encoding: gzip
last-modified: Thu, 05 May 2022 21:57:48 GMT
server: ECS (lhb/6367)
age: 63378
etag: "2d2f128cb60d81:0"
vary: Accept-Encoding
x-cache: HIT
content-type: application/x-javascript
cache-control: max-age=86400
accept-ranges: bytes
content-length: 32300

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 49 KB
20 KB 326ms
111ms Script
text/javascript 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MFPB9D

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Wed, 13 Apr 2022 21:02:38 GMT
server: Golfe2
age: 793
date: Sun, 08 May 2022 20:19:09 GMT
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 20006
expires: Sun, 08 May 2022 22:19:09 GMT

GET
H/1.1 200
OK insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 8 KB
3 KB 369ms
136ms Script
application/x-javascript 2a02:26f0:3500:7::17d8:4dcd
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MFPB9D
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:3500:7::17d8:4dcd Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Sun, 08 May 2022 20:32:22 GMT
Content-Encoding: gzip
Last-Modified: Wed, 13 Apr 2022 23:25:22 GMT
X-CDN: AKAM
Vary: Accept-Encoding
Content-Type: application/x-javascript;charset=utf-8
Cache-Control: max-age=26662
Connection: keep-alive
Accept-Ranges: bytes
Content-Length: 3085

GET
H2 200 ebdaa317731b0.js Show response
t.contentsquare.net/uxa/ 307 KB
69 KB 691ms
263ms Script
application/javascript 18.66.112.26
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://t.contentsquare.net/uxa/ebdaa317731b0.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MFPB9D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 18.66.112.26 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-18-66-112-26.fra56.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: 6733c75da005a9e5bcdf608a532666c2dfd12cb0d9a8753981a2e6bd8769ea9d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

x-amz-server-side-encryption: AES256
date: Sat, 07 May 2022 09:05:50 GMT
content-encoding: gzip
last-modified: Wed, 04 May 2022 09:05:15 GMT
server: AmazonS3
age: 127593
etag: "00a189dd0a191ff2b8dda3989f742505"
x-cache: Hit from cloudfront
content-type: application/javascript;charset=utf-8
via: 1.1 02d68f3a4f2a3f8967c5e021dcd7f96a.cloudfront.net (CloudFront)
cache-control: max-age=900
x-amz-cf-pop: FRA56-P5
accept-ranges: bytes
content-length: 69845
x-amz-cf-id: Gjx6801X0Oo5ntQPE2wAsr3taK49eTosp3fOFodEHTeXMlJ8CC14Iw==

GET
H2 200 fbevents.js Show response
connect.facebook.net/en_US/ 99 KB
27 KB 900ms
459ms Script
application/x-javascript 2a03:2880:f007:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/en_US/fbevents.js

Requested by

Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f007:8:face:b00c:0:1 Vienna, Austria, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

b819b3ac2fe5857b7026a609f9115f0d50a7d6e8085ba5987d70ed6baaa41f4e

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length: 26311
x-xss-protection: 0
pragma: public
x-fb-debug: 4BtmOxPBRzr7lgTyuq7wUTkrZB1k1BzJxlF3suyJiMTZDrmFQfwIiorbPCjehc1yoUt8i8P8FMQyilpm0EkTAw==
x-fb-trip-id: 720026100
x-frame-options: DENY
cross-origin-opener-policy: same-origin-allow-popups
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
date: Sun, 08 May 2022 20:32:22 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H/1.1 200
OK munchkin-beta.js Show response
munchkin.marketo.net/ 1 KB
1 KB 390ms
135ms Script
application/x-javascript 104.111.234.67
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/munchkin-beta.js
Requested by: Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.234.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-234-67.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: aaddb9b9a1d45c5de508e64c3dace01f450e4a7521229e99f03838f5067cc8f9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Sun, 08 May 2022 20:32:22 GMT
Content-Encoding: gzip
Last-Modified: Fri, 01 Oct 2021 01:04:09 GMT
Server: AkamaiNetStorage
ETag: "d2b1913e6438b06d03258094a8c365f8:1633050249.484514"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR", policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 752

GET
H2 200 bat.js Show response
bat.bing.com/ 38 KB
12 KB 367ms
137ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/bat.js

Requested by

Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

8540c5e2d2e85cc6c5d46b1b06b7f6642dce39e0314299a08976cfe6053c7c52

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
last-modified: Wed, 09 Feb 2022 23:54:49 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 8B0F53D4969140548F3C94E77D903D3C Ref B: FRAEDGE1212 Ref C: 2022-05-08T20:32:22Z
etag: "806a236c101ed81:0"
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript
access-control-allow-origin: *
cache-control: private,max-age=1800
date: Sun, 08 May 2022 20:32:21 GMT
accept-ranges: bytes
content-length: 11333

GET
H2 200 aquant.js Show response
secure.quantserve.com/ 24 KB
10 KB 369ms
135ms Script
application/javascript 2620:116:800d:21:3175:5196:e3fd:8c1d
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://secure.quantserve.com/aquant.js?a=p-4CduNLZtPCAtp
Requested by: Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2620:116:800d:21:3175:5196:e3fd:8c1d , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: /
Resource Hash: 8d6580af877387b05d9ffac3ebeacfe25a7728c77adef6d9b32fd72ccbe21468

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Sun, 08 May 2022 20:32:22 GMT
content-encoding: gzip
etag: "u2JtyZzqnTXwzBUswy2r+w=="
vary: Accept-Encoding
content-type: application/javascript
cache-control: private, max-age=604800
cross-origin-resource-policy: cross-origin
accept-ranges: bytes
expires: Sun, 15 May 2022 20:32:22 GMT

GET
H/1.1 200
OK 6si.min.js Show response
j.6sc.co/ 31 KB
10 KB 680ms
232ms Script
application/javascript 96.16.137.162
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL

https://j.6sc.co/6si.min.js

Requested by

Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-137-162.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

8e038b564510a45dc11799f74da367733f3db7f9c0a0434f1e90c44ec5168278

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Sun, 08 May 2022 20:32:22 GMT
Content-Encoding: gzip
X-Content-Type-Options: nosniff
Connection: keep-alive
Vary: Accept-Encoding
Content-Length: 9715
Pragma: no-cache
Last-Modified: Thu, 05 May 2022 03:45:17 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "6273484d-7b02"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: application/javascript
Access-Control-Allow-Origin
Cache-Control: private, no-cache, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Sun, 08 May 2022 20:32:22 GMT

GET
H/1.1 200
OK lp.js Show response
metadata-static-files.sfo2.cdn.digitaloceanspaces.com/pixel/ 6 KB
6 KB 576ms
143ms Script
application/x-javascript 205.185.216.10
STACKPATH-CDN

General

Check archive.org

Show headers Download Go to

Full URL

https://metadata-static-files.sfo2.cdn.digitaloceanspaces.com/pixel/lp.js

Requested by

Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

205.185.216.10 , United States, ASN20446 (STACKPATH-CDN, US),

Reverse DNS

map2.hwcdn.net

Software

Resource Hash

da5d487f1fe8c4f5bba93bab0b071aed1249cf770ffdbc0144a86a4c2bae3c2c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Sun, 08 May 2022 20:32:23 GMT
Connection: Keep-Alive
Last-Modified: Fri, 10 Dec 2021 19:19:18 GMT
x-amz-request-id: tx00000000000003f6df8d9-0062705d25-26d700f5-sfo2a
etag: "b407e44b8c40c183ae2c50df3bbcf151"
Vary: Access-Control-Request-Headers,Access-Control-Request-Method,Origin
X-HW: 1652041942.dop206.lo4.t,1652041943.cds273.lo4.shn,1652041943.dop206.lo4.t,1652041943.cds066.lo4.c
Content-Type: application/x-javascript
Cache-Control: max-age=93903
x-rgw-object-type: Normal
strict-transport-security: max-age=15552000; includeSubDomains; preload
Accept-Ranges: bytes
Content-Length: 5673

GET
H2 200 bizible.js Show response
cdn.bizible.com/scripts/ 83 KB
32 KB 133ms
131ms Script
application/x-javascript 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.bizible.com/scripts/bizible.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MFPB9D
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (lhb/6367) /
Resource Hash: cbda94666db24554bf77638fc059848d381c3c98f7f24641fa830abcd5793de7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Sun, 08 May 2022 20:32:22 GMT
content-encoding: gzip
last-modified: Thu, 05 May 2022 21:57:48 GMT
server: ECS (lhb/6367)
age: 63378
etag: "2d2f128cb60d81:0"
vary: Accept-Encoding
x-cache: HIT
content-type: application/x-javascript
cache-control: max-age=86400
accept-ranges: bytes
content-length: 32300

GET
H2 200 inlinks.js Show response
jscloud.net/x/12296/ 943 B
1012 B 561ms
184ms Script
application/javascript 2606:4700:20::681a:527
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://jscloud.net/x/12296/inlinks.js
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MFPB9D
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:527 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 96c5bfab045aceeb52ae2daa17605f436dd4ab9be43bbc87ac3debdbc9768ffb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Sun, 08 May 2022 20:32:23 GMT
content-encoding: br
cf-cache-status: HIT
last-modified: Thu, 15 Jul 2021 06:33:19 GMT
server: cloudflare
age: 4150
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FxFvYNIjP6AjA2JntzCoasKhVmzmcPlQjKj2qrwpsAdsXiYb5LvRe7oLl8YiYEjZBd0Jw3w5ex%2FjPe1LnTmRIqnTWwHHSKtgF2zUnkDxPoaSfXOWmtnj5N6bHgiDfr06jYGjUCKz%2B1fT"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=14400
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray: 7084f6dfde8741f7-MRS

POST
H2 204 collect
analytics.google.com/g/ 0
341 B 434ms
126ms Ping
text/plain 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-95Z7P6PE75&gtm=2oe540&_p=1311868780&_z=ccd.tbB&_gaz=1&cid=602281868.1652041942&ul=en-us&sr=1600x1200&_s=1&sid=1652041942&sct=1&seg=0&dl=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&dt=%7C%20Decipher&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-95Z7P6PE75&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 08 May 2022 20:32:23 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://duo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
341 B 399ms
131ms Ping
text/plain 2a00:1450:400c:c08::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-95Z7P6PE75&cid=602281868.1652041942&gtm=2oe540&aip=1
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-95Z7P6PE75&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c08::9a Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 08 May 2022 20:32:23 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://duo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
501 B 390ms
147ms Image
image/gif 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-95Z7P6PE75&cid=602281868.1652041942&gtm=2oe540&aip=1&z=1114668383

Requested by

Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 08 May 2022 20:32:22 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 4006052.js Show response
bat.bing.com/p/action/ 1 KB
1 KB 460ms
460ms Script
application/javascript 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL

https://bat.bing.com/p/action/4006052.js

Requested by

Host: bat.bing.com
URL: https://bat.bing.com/bat.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

3bd767b4869c1404fa4f7b0a592b991e1ee1bb7f920c9f4cd8558ecaec9a3779

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-encoding: gzip
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 1AB8B3696605430E967042200793990A Ref B: FRAEDGE1212 Ref C: 2022-05-08T20:32:22Z
date: Sun, 08 May 2022 20:32:21 GMT
vary: Accept-Encoding
x-cache: CONFIG_NOCACHE
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
cache-control: no-store,no-cache
content-length: 911

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7540&time=1652041942476&url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS
https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D7540%26time%3D1652041942476%26url%3Dhttps%253A%252F%252Fduo.com%252Fdecipher%252F...
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7540&time=1652041942476&url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&liSync=true
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7540&time=1652041942476&url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&liSync=true&e_ipv6=AQJCFwa...

0
264 B

480ms
284ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7540&time=1652041942476&url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&liSync=true&e_ipv6=AQJCFwaG5yr3IAAAAYClX4qoq4RmarD4XR5ABThQ-e8OanSANDnEpNDElV3KYomkk__NPyCrBQ
Requested by: Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Sun, 08 May 2022 20:32:23 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 55C7CD6C664949D19E9F46047E6C7549 Ref B: FRAEDGE1519 Ref C: 2022-05-08T20:32:24Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXehf08X9fKFeYy7VUcvg==
x-li-fabric: prod-ltx1

Redirect headers

date: Sun, 08 May 2022 20:32:23 GMT
x-li-pop: afd-prod-ltx1-x
x-msedge-ref: Ref A: 04D1E776924341B09B34A5B305CAC951 Ref B: FRAEDGE1506 Ref C: 2022-05-08T20:32:23Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-ltx1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7540&time=1652041942476&url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&liSync=true&e_ipv6=AQJCFwaG5yr3IAAAAYClX4qoq4RmarD4XR5ABThQ-e8OanSANDnEpNDElV3KYomkk__NPyCrBQ
x-li-proto: http/2
content-length: 0
x-li-uuid: AAXehf01Z7jJjxRZ6xku2g==

GET
H2 200 rules-p-4CduNLZtPCAtp.js Show response
rules.quantcount.com/ 2 KB
1 KB 378ms
124ms Script
application/javascript 2600:9000:223c:8200:6:44e3:f8c0:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://rules.quantcount.com/rules-p-4CduNLZtPCAtp.js
Requested by: Host: secure.quantserve.com
URL: https://secure.quantserve.com/aquant.js?a=p-4CduNLZtPCAtp
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:223c:8200:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: 1d48d4cabc9c195baa08e42be70679688d706970ddd862bd91b857109d2a8874

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Sun, 08 May 2022 20:30:35 GMT
content-encoding: gzip
age: 2570
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
cross-origin-resource-policy: cross-origin
access-control-allow-origin: *
last-modified: Wed, 03 Feb 2021 00:36:24 GMT
server: AmazonS3
etag: W/"7d60bb0c5a7bdaca5a9466f9ef246056"
vary: Accept-Encoding
access-control-allow-methods: GET
content-type: application/javascript
via: 1.1 bbd2abbdb134a9d53c0a12f6566e69fe.cloudfront.net (CloudFront)
cache-control: max-age=3600
x-amz-cf-pop: FRA56-P2
x-amz-cf-id: OHGfQGrhhkxFDk2M-oLhiIHr8DLt5tdqmHKWh0Zn20kRkTwXhY7VDw==

GET
H/1.1 200
OK munchkin.js Show response
munchkin.marketo.net/161/ 11 KB
5 KB 133ms
133ms Script
application/x-javascript 104.111.234.67
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://munchkin.marketo.net/161/munchkin.js
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin-beta.js
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 104.111.234.67 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-111-234-67.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: c2aee78040b4ed46c2377e6825db12a9691a2eb584adf338e77312c8978d8537

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Sun, 08 May 2022 20:32:22 GMT
Content-Encoding: gzip
Last-Modified: Wed, 08 Sep 2021 00:38:21 GMT
Server: AkamaiNetStorage
ETag: "0e0eefac8daf874e8b1aa34aeb160c52:1631061501.737429"
Vary: Accept-Encoding
P3P: policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control: max-age=8640000
Connection: keep-alive
Accept-Ranges: bytes
Content-Type: application/x-javascript
Content-Length: 4681
Expires: Tue, 16 Aug 2022 20:32:22 GMT

GET
H2 200 din1451alt-webfont.woff2
duo.com/fonts/din1451alt/ 17 KB
18 KB 291ms
291ms Font
application/octet-stream 13.32.99.68
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://duo.com/fonts/din1451alt/din1451alt-webfont.woff2

Requested by

Host: duo.com
URL: https://duo.com/css/production-2021.css?v=1647976353

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.99.68 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-99-68.fra60.r.cloudfront.net

Software

Duo/1.0 /

Resource Hash

e9f76eabead93f85fc4dc190dca4b1419dcd76b57b1c22649856b01d3ac2536e

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://duo.com/css/production-2021.css?v=1647976353
Origin: https://duo.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Sun, 08 May 2022 20:30:35 GMT
via: 1.1 8b889e35789d2b97f2ba8771acc9a008.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 107
x-cache: Hit from cloudfront
content-length: 17424
x-xss-protection: 1; mode=block
x-ua-compatible: IE=Edge,chrome=1
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 12 Apr 2022 20:01:08 GMT
server: Duo/1.0
x-frame-options: SAMEORIGIN
etag: "6255da84-4410"
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: application/octet-stream
cache-control: max-age=300
x-amz-cf-pop: FRA60-P3
accept-ranges: bytes
x-amz-cf-id: _lY_7kJl45XycfIVlCxc4473_tDztUoRNb-aBNx5a8Nuz6qHp_OZOQ==
expires: Sun, 08 May 2022 20:35:35 GMT

GET
H2 200 multi-squares-2.svg
duo.com/assets/img/decipher/svg/ 1 KB
974 B 316ms
316ms Image
image/svg+xml 13.32.99.68
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://duo.com/assets/img/decipher/svg/multi-squares-2.svg
Requested by: Host: duo.com
URL: https://duo.com/css/production-2021.css?v=1647976353
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.68 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-68.fra60.r.cloudfront.net
Software: Duo/1.0 /
Resource Hash: 4adefd63c0816744b24f5f7c63c2ab245eb000b310fe05fb998cfccb98bad0cb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/css/production-2021.css?v=1647976353
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: public
date: Wed, 27 Apr 2022 19:08:03 GMT
content-encoding: gzip
last-modified: Tue, 12 Apr 2022 20:00:42 GMT
server: Duo/1.0
age: 955459
etag: W/"6255da6a-5d4"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
via: 1.1 8b889e35789d2b97f2ba8771acc9a008.cloudfront.net (CloudFront)
cache-control: max-age=31536000, public, must-revalidate, proxy-revalidate, max-age=31536000
x-amz-cf-pop: FRA60-P3
x-amz-cf-id: c-B4RNSGabAWdRgZncTRT3afGcrZX1FGnpSslJ34IkUpJK0l6x3E-A==
expires: Thu, 27 Apr 2023 19:08:03 GMT

GET
H2 200 din1451alt_g-webfont.woff2
duo.com/fonts/din1451alt/ 22 KB
23 KB 343ms
343ms Font
application/octet-stream 13.32.99.68
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://duo.com/fonts/din1451alt/din1451alt_g-webfont.woff2

Requested by

Host: duo.com
URL: https://duo.com/css/production-2021.css?v=1647976353

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

13.32.99.68 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-13-32-99-68.fra60.r.cloudfront.net

Software

Duo/1.0 /

Resource Hash

ede067783c02098828dfe0bda385a9913ff79006eb2cd1a406bcc18e66cd7bad

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://duo.com/css/production-2021.css?v=1647976353
Origin: https://duo.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Sun, 08 May 2022 20:30:35 GMT
via: 1.1 8b889e35789d2b97f2ba8771acc9a008.cloudfront.net (CloudFront)
x-content-type-options: nosniff
age: 107
x-cache: Hit from cloudfront
content-length: 22668
x-xss-protection: 1; mode=block
x-ua-compatible: IE=Edge,chrome=1
referrer-policy: no-referrer-when-downgrade
last-modified: Tue, 12 Apr 2022 20:01:08 GMT
server: Duo/1.0
x-frame-options: SAMEORIGIN
etag: "6255da84-588c"
strict-transport-security: max-age=63072000; includeSubDomains; preload
content-type: application/octet-stream
cache-control: max-age=300
x-amz-cf-pop: FRA60-P3
accept-ranges: bytes
x-amz-cf-id: w_MTQAca0os_cWq5_w_EMmGNUmoKdWlaPt2I2DQJ07BQYRwtZtXZ6A==
expires: Sun, 08 May 2022 20:35:35 GMT

GET
H2 200 utag.js Show response
tags.tiqcdn.com/utag/cisco/duo/prod/ 209 KB
57 KB 417ms
134ms Script
application/x-javascript 104.75.88.194
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.js
Requested by: Host: www.cisco.com
URL: https://www.cisco.com/c/dam/cdc/t/ctm.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-88-194.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: d504e13e96657fb2614683621745a4efc249d2b00d05af8261f5ce4c25a56bdb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Sun, 08 May 2022 20:32:23 GMT
content-encoding: gzip
last-modified: Thu, 05 May 2022 16:35:08 GMT
server: AkamaiNetStorage
etag: "38460ffeb7ef5f067193c959b30696b4:1651768508.207175"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=300
accept-ranges: bytes
expires: Sun, 08 May 2022 20:37:23 GMT

GET
H2 200 icon-sprite.20210112.svg Show response
duo.com/fonts/ 240 KB
80 KB 236ms
236ms XHR
image/svg+xml 13.32.99.68
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://duo.com/fonts/icon-sprite.20210112.svg
Requested by: Host: duo.com
URL: https://duo.com/js/build/production-2021.min.js?v=1647976353
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.68 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-68.fra60.r.cloudfront.net
Software: Duo/1.0 /
Resource Hash: d9218d98cd999ad151e3b5ff5e2d7021b93f1c806c49ffc1f60a3f476d64747e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: public
date: Sun, 24 Apr 2022 18:17:43 GMT
content-encoding: gzip
last-modified: Tue, 12 Apr 2022 20:01:08 GMT
server: Duo/1.0
age: 1217679
etag: W/"6255da84-3c031"
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: image/svg+xml
via: 1.1 8b889e35789d2b97f2ba8771acc9a008.cloudfront.net (CloudFront)
cache-control: max-age=31536000, public, must-revalidate, proxy-revalidate, max-age=31536000
x-amz-cf-pop: FRA60-P3
x-amz-cf-id: daLhsHrrTjyb0f4EJbsA3vKPzaWBI2bYROCYzX_GreQepsZSleyUoQ==
expires: Mon, 24 Apr 2023 18:17:43 GMT

POST
H3 200 collect Show response
www.google-analytics.com/j/ 2 B
22 B 374ms
128ms XHR
text/plain 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j96&a=1311868780&t=pageview&_s=1&dl=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&ul=en-us&de=UTF-8&dt=%7C%20Decipher&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aADAAAABQAAAAC~&jid=656269897&gjid=1406644238&cid=602281868.1652041942&tid=UA-20141016-1&_gid=2110132185.1652041943&_r=1&gtm=2wg540MFPB9D&z=1306789542

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://duo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Sun, 08 May 2022 20:32:23 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://duo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 2
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
151 B 418ms
131ms XHR
text/plain 2a00:1450:400c:c08::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-20141016-1&cid=602281868.1652041942&jid=142278108&gjid=1177865356&_gid=2110132185.1652041943&_u=aCDAgAABQAAAAG~&z=710142152

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c08::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://duo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Sun, 08 May 2022 20:32:23 GMT
content-type: text/plain
access-control-allow-origin: https://duo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 363ms
121ms Image
image/gif 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1311868780&t=pageview&_s=1&dl=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&ul=en-us&de=UTF-8&dt=%7C%20Decipher&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aCDAgAABQAAAAC~&jid=142278108&gjid=1177865356&cid=602281868.1652041942&tid=UA-20141016-1&_gid=2110132185.1652041943&gtm=2wg540MFPB9D&cg3=Decipher%20Traffic%20Only&z=319263475

Requested by

Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 08 May 2022 19:30:53 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 3690
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ctm.js Show response
www.cisco.com/c/dam/cdc/t/ 131 KB
31 KB 143ms
143ms Script
application/x-javascript 2a02:26f0:6c00:288::b33
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://www.cisco.com/c/dam/cdc/t/ctm.js

Requested by

Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS

Protocol

Security

TLS 1.3, , CHACHA20_POLY1305

Server

2a02:26f0:6c00:288::b33 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Apache /

Resource Hash

4b1589731cab3cc03fa56b6e91e496162499ae05dc2e5f0a685dca5b2bc646a8

Security Headers

Name	Value
Content-Security-Policy	upgrade-insecure-requests; frame-ancestors .cisco.com .jasper.com .ciscospark.com .ciscolive.com http://cisco.lookbookhq.com https://cisco.lookbookhq.com testcisco.marketing.adobe.com cisco.marketing.adobe.com ciscosales.my.salesforce.com test.salesforce.com zedo.com hindustantimes.com economictimes.indiatimes.com .webex.com .cdw.com .cdwg.com .cdw.ca .meraki-go.com http://ciscopartners.lookbookhq.com https://ciscopartners.lookbookhq.com ciscolearningsystem.com ciscocustomer.lookbookhq.com cisco.lookbookhq.com ccsmedia.com .itquotes.ie dteonline.com ampito-cisco.com arkphire.com .insight.com .ccsmedia.com .ebuyer.com .lambda-tek.com .storm-technologies.com .vohkus.com .bechtle.com .rainfocus.com .broadbandbuyer.com .hardware.com shop.redpontem.com cisco.techdatavendors.be;
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Sun, 08 May 2022 20:32:22 GMT
content-encoding: gzip
x-content-type-options: nosniff
vary: Accept-Encoding
content-length: 30494
x-xss-protection: 1; mode=block
pragma: no-cache
cdchost: wemxweb-publish-prod1-01
x-test-debug: nURL=www.cisco.com,realm=0,isRealm=0,realmDomain=0,shortrealm=0,upgradeTest=1
server: Apache
x-frame-options: SAMEORIGIN
etag: "20d2f-5de451c03f976-gzip"
strict-transport-security: max-age=31536000
content-type: application/x-javascript
cache-control: max-age=0, no-cache, no-store
content-security-policy: upgrade-insecure-requests; frame-ancestors *.cisco.com *.jasper.com *.ciscospark.com *.ciscolive.com http://cisco.lookbookhq.com https://cisco.lookbookhq.com testcisco.marketing.adobe.com cisco.marketing.adobe.com ciscosales.my.salesforce.com test.salesforce.com zedo.com hindustantimes.com economictimes.indiatimes.com *.webex.com *.cdw.com *.cdwg.com *.cdw.ca *.meraki-go.com http://ciscopartners.lookbookhq.com https://ciscopartners.lookbookhq.com ciscolearningsystem.com ciscocustomer.lookbookhq.com cisco.lookbookhq.com ccsmedia.com *.itquotes.ie dteonline.com ampito-cisco.com arkphire.com *.insight.com *.ccsmedia.com *.ebuyer.com *.lambda-tek.com *.storm-technologies.com *.vohkus.com *.bechtle.com *.rainfocus.com *.broadbandbuyer.com *.hardware.com shop.redpontem.com cisco.techdatavendors.be;
accept-ranges: bytes
expires: Sun, 08 May 2022 20:32:22 GMT

POST
H/1.1 200
OK visitWebPage
074-uqx-410.mktoresp.com/webevents/ 2 B
311 B 1187ms
231ms Ping
text/plain 192.28.147.68
OMNITURE

General

Check archive.org

Show headers Download Go to

Full URL: https://074-uqx-410.mktoresp.com/webevents/visitWebPage?_mchNc=1652041942779&_mchCn=&_mchId=074-UQX-410&_mchTk=_mch-duo.com-1652041942779-33174&_mchHo=duo.com&_mchPo=&_mchRu=%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&_mchPc=https%3A&_mchVr=161&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by: Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/161/munchkin.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 192.28.147.68 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software: nginx /
Resource Hash: 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Sun, 08 May 2022 20:32:23 GMT
Content-Encoding: gzip
Server: nginx
Transfer-Encoding: chunked
Content-Type: text/plain; charset=UTF-8
Access-Control-Allow-Origin: *
Connection: keep-alive
X-Request-Id: 2fe3a0d0-1f4b-4ac2-b8f1-1b041517508c

GET
H2 200 clarity.js Show response
h.clarity.ms/s/0.6.34/ 53 KB
23 KB 625ms
180ms Script
application/javascript 52.224.31.34
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://h.clarity.ms/s/0.6.34/clarity.js
Requested by: Host: bat.bing.com
URL: https://bat.bing.com/p/action/4006052.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.224.31.34 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: ca63193ce799e4e00c9106349365981dc6e26cb77632ebf5df23dffba2aaccfa

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Sun, 08 May 2022 20:32:22 GMT
content-encoding: br
etag: "1d85e80e187b254"
last-modified: Tue, 03 May 2022 00:01:04 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: public,max-age=86400
accept-ranges: bytes
request-context: appId=cid-v1:b1d896b3-bec7-448b-b764-240152e813e8

GET
H2 404 data.json Show response
duo.com/public/json-bodymovin/d-logo-light/ 50 KB
12 KB 593ms
593ms XHR
text/html 13.32.99.68
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://duo.com/public/json-bodymovin/d-logo-light/data.json
Requested by: Host: duo.com
URL: https://duo.com/js/build/production-2021.min.js?v=1647976353
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 13.32.99.68 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-32-99-68.fra60.r.cloudfront.net
Software: Duo/1.0 /
Resource Hash: 6a6d2038fc6ca01db16d2c528375510be154e1214cc694a6332d85a798fb4711

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Sun, 08 May 2022 20:32:23 GMT
content-encoding: gzip
server: Duo/1.0
x-amz-cf-pop: FRA60-P3
etag: W/"6255da84-c905"
vary: Accept-Encoding
x-cache: Error from cloudfront
content-type: text/html; charset=utf-8
via: 1.1 8b889e35789d2b97f2ba8771acc9a008.cloudfront.net (CloudFront)
content-length: 11795
x-amz-cf-id: PWcI4LwtAtNG_2JKsjDFlEEuPWJfjjnsZ3SBBhCbYs-mBRrFHM81UA==

GET
H2 200 ipv
cdn.bizible.com/m/ 43 B
327 B 131ms
130ms Image
image/gif 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.bizible.com/m/ipv?_biz_r=&_biz_h=-1906410348&_biz_u=ce23af8d85ad4ac2a17788f34bb3bf16&_biz_s=418ff9&_biz_l=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&_biz_t=1652041942611&_biz_i=%20%7C%20Decipher&_biz_n=0&a=duo.com&rnd=840752&cdn_o=a&_biz_z=1652041943096
Requested by: Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (lhb/63A5) /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 08 May 2022 20:32:23 GMT
last-modified: Thu, 05 May 2022 02:54:56 GMT
server: ECS (lhb/63A5)
age: 322647
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-cache, no-store
accept-ranges: bytes
content-type: Image/GIF
content-length: 43
expires: -1

GET
H2 200 u
cdn.bizibly.com/ 43 B
204 B 131ms
130ms Image
image/gif 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.bizibly.com/u?_biz_u=ce23af8d85ad4ac2a17788f34bb3bf16&_biz_s=418ff9&_biz_l=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&_biz_t=1652041943101&_biz_i=%20%7C%20Decipher&a=duo.com&rnd=449594&cdn_o=a&_biz_z=1652041943101
Requested by: Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (lhb/62A2) /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 08 May 2022 20:32:23 GMT
last-modified: Thu, 05 May 2022 02:55:03 GMT
server: ECS (lhb/62A2)
age: 322640
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-cache, no-store
accept-ranges: bytes
content-type: Image/GIF
content-length: 43
expires: -1

GET
H2 204 0
bat.bing.com/action/ 0
161 B 144ms
144ms Image
text/plain 2620:1ec:c11::200
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://bat.bing.com/action/0?ti=4006052&Ver=2&mid=a1b8a44c-496d-4042-9a9b-0d40989041da&sid=f73f34f0cf0d11ec803f3306584a1339&vid=f73f74f0cf0d11ec907d45cae3d9187d&vids=1&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=%7C%20Decipher&p=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&r=&lt=4461&evt=pageLoad&msclkid=N&sv=1&rn=541657

Requested by

Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),

Reverse DNS

Software

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
strict-transport-security: max-age=31536000; includeSubDomains; preload
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: D20A03875AFB410B96881C180A65D99C Ref B: FRAEDGE1212 Ref C: 2022-05-08T20:32:23Z
date: Sun, 08 May 2022 20:32:22 GMT
x-cache: CONFIG_NOCACHE
access-control-allow-origin: *
cache-control: no-cache, must-revalidate
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 xdframe-single-domain-1.1.1.html Show response
csxd.contentsquare.net/uxa/ Frame 3C3A 2 KB
1 KB 325ms
91ms Document
text/html 2600:9000:2250:5e00:1b:ed91:4680:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://csxd.contentsquare.net/uxa/xdframe-single-domain-1.1.1.html?pid=5637
Requested by: Host: t.contentsquare.net
URL: https://t.contentsquare.net/uxa/ebdaa317731b0.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2600:9000:2250:5e00:1b:ed91:4680:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: AmazonS3 /
Resource Hash: d1a9abb0dc96d5a0fcc121a6de3a2c29c193a91d2f68939080e111b54d01d9e8

Request headers

Referer: https://duo.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

age: 4080868
cache-control: max-age=31536000
content-encoding: gzip
content-type: text/html
date: Tue, 22 Mar 2022 14:57:56 GMT
etag: W/"fbd0a9f9a63a143cf028aca21682b386"
last-modified: Mon, 07 Mar 2022 15:32:43 GMT
server: AmazonS3
vary: Accept-Encoding
via: 1.1 935770605c74a80712059ba5b24d4162.cloudfront.net (CloudFront)
x-amz-cf-id: QX1Ht-ATOvfrnwVJXhAN6sYF36-fz8lh6RjdDk4k7nSXsV_O_-eweQ==
x-amz-cf-pop: FRA60-P2
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront

POST
H3 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
25 B 328ms
104ms XHR
text/plain 2a00:1450:400c:c08::9a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-20141016-1&cid=602281868.1652041942&jid=656269897&gjid=1406644238&_gid=2110132185.1652041943&_u=aADAAAAAQAAAAC~&z=1846903093

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=duo.com

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:400c:c08::9a Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://duo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
date: Sun, 08 May 2022 20:32:23 GMT
content-type: text/plain
access-control-allow-origin: https://duo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
501 B 411ms
117ms Image
image/gif 2a00:1450:4001:801::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-20141016-1&cid=602281868.1652041942&jid=142278108&_u=aCDAgAABQAAAAG~&z=1012801440

Requested by

Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 08 May 2022 20:32:23 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.de/ads/ 42 B
107 B 416ms
115ms Image
image/gif 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-20141016-1&cid=602281868.1652041942&jid=142278108&_u=aCDAgAABQAAAAG~&z=1012801440

Requested by

Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 08 May 2022 20:32:23 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 pixel;r=1648333865;labels=_fp.event.Default;rf=0;a=p-4CduNLZtPCAtp;url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS;uht=2;fpan=1;fpa=P0-1820193584-1652...
pixel.quantserve.com/ 35 B
372 B 118ms
109ms Image
image/gif 2620:116:800d:21:3175:5196:e3fd:8c1d
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://pixel.quantserve.com/pixel;r=1648333865;labels=_fp.event.Default;rf=0;a=p-4CduNLZtPCAtp;url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS;uht=2;fpan=1;fpa=P0-1820193584-1652041943291;pbc=;ns=0;ce=1;qjs=1;qv=a98acd33-20220316110313;cm=;gdpr=0;ref=;d=duo.com;je=0;sr=1600x1200x24;dst=0;et=1652041943291;tzo=0;ogl=site_name.Decipher%2Ctype.website%2Curl.%2Cdescription.Security%20without%20fear%252E%20The%20web%20doesn%E2%80%99t%20have%20to%20be%20dark%252E%20Decipher%E2%80%99s%20goal%20is%20to%20br%2Cimage.http%3A%2F%2Fduo-www-v3-clean%252Etest%2Fassets%2Fimg%2Fseo-images%2Fmeta-decipher-default%252Ejpg%2Cimage%3Awidth.1200%2Cimage%3Aheight.630

Requested by

Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2620:116:800d:21:3175:5196:e3fd:8c1d , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

Resource Hash

a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8

Security Headers

Name	Value
Strict-Transport-Security	max-age=86400

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 08 May 2022 20:32:23 GMT
strict-transport-security: max-age=86400
p3p: CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control: private, no-cache, no-store, proxy-revalidate
content-type: image/gif
content-length: 35
expires: Fri, 04 Aug 1978 12:00:00 GMT

GET
H2 200 httpsduocomdeciphertrailblazerhuntscompromisedcredentialsinawsnAWS.json Show response
jscloud.net/x/13009/ 26 B
557 B 774ms
489ms XHR
application/json 2606:4700:20::681a:527
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://jscloud.net/x/13009/httpsduocomdeciphertrailblazerhuntscompromisedcredentialsinawsnAWS.json
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=duo.com
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:20::681a:527 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 0a998ab5472475c3418c7977b6214c566aad928094dceb86d2e9f53bdbdd26c0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Sun, 08 May 2022 20:32:24 GMT
cf-cache-status: DYNAMIC
last-modified: Thu, 16 Jan 2020 10:42:21 GMT
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary: Accept-Encoding,User-Agent
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7dkYvXeBKvN%2BZ0TZWcXb5YdLkV0B1NiSarg13r8bvAvVNfXy68vfWk5NqXW6XwByIr9IzlcWEknQjQRfqVJ%2F%2BM0azKtgZmf4SOWDeUflbmyOWXlUWKHtTCAj3e9RyGVhbyGXYwPV6G4e"}],"group":"cf-nel","max_age":604800}
content-type: application/json
access-control-allow-origin: *
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges: bytes
cf-ray: 7084f6e4298e5995-MXP
content-length: 26

GET
BLOB 200
OK cd6262f2-c392-4719-930d-b0aa4c3d60b1
https://duo.com/ 6 KB
0 Other
application/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://duo.com/cd6262f2-c392-4719-930d-b0aa4c3d60b1
Requested by: Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 8254f2577a38c005e4ccbdb175fc8ba7b70992c89580d832736983c937ac9e78

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Content-Length: 6483
Content-Type: application/javascript

GET
H3 200 216127175396154 Show response
connect.facebook.net/signals/config/ 305 KB
87 KB 479ms
287ms Script
application/x-javascript 2a03:2880:f007:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/216127175396154?v=2.9.58&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f007:8:face:b00c:0:1 Vienna, Austria, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

4f54a3e7c7c1db37da7024007f26706ae068cd15b86a408c6660ca4363925b15

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
x-xss-protection: 0
pragma: public
x-fb-debug: xbbREHFqWgE0ioK0E2g29HZtmyBJzKrhjnztQktfr6ufyeObnj1zA/COnGtHR41hTr8Ddxlb3dKVTe1A3DRGiw==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Sun, 08 May 2022 20:32:23 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
x-content-cdn-origin-ts: 1652041943701
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 xdc.js Show response
cdn.bizible.com/ 116 B
522 B 214ms
213ms Script
text/javascript 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.bizible.com/xdc.js?_biz_u=ce23af8d85ad4ac2a17788f34bb3bf16&_biz_h=-1906410348&cdn_o=a&jsVer=4.22.02.16&a=duo.com
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=duo.com
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (lhb/6384) /
Resource Hash: 4e60f5f99798802066cc24adce5b8f06a5bbb48238eb60aee2309a1139bdacd4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Sun, 08 May 2022 20:32:23 GMT
content-encoding: gzip
server: ECS (lhb/6384)
etag: 1164FF4A
vary: Accept-Encoding
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: private, must-revalidate, max-age=21600
content-type: text/javascript; charset=utf-8
content-length: 217

GET
H/1.1

200
OK

rd Show response
dpm.demdex.net/id/
Redirect Chain

https://dpm.demdex.net/id?d_visid_ver=4.1.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=B8D07FF4520E94C10A490D4C%40AdobeOrg&d_nsid=0&ts=1652041943353
https://dpm.demdex.net/id/rd?d_visid_ver=4.1.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=B8D07FF4520E94C10A490D4C%40AdobeOrg&d_nsid=0&ts=1652041943353

973 B
1 KB

105ms
105ms

XHR
application/json

52.19.61.87
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://dpm.demdex.net/id/rd?d_visid_ver=4.1.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=B8D07FF4520E94C10A490D4C%40AdobeOrg&d_nsid=0&ts=1652041943353

Requested by

Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS

Protocol

HTTP/1.1

Server

52.19.61.87 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-19-61-87.eu-west-1.compute.amazonaws.com

Software

Resource Hash

a9b26df1158afa9371f427b2dfcca99e3c7a464795612e1dfdfbceee9d143603

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v031-08d815db4.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-TID: zabcsnc1SvM=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin: https://duo.com
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json;charset=utf-8
Content-Length: 532
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS: dcs-prod-irl1-1-v031-0d8a98783.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
Access-Control-Allow-Origin: https://duo.com
X-TID: gF7B3ncRRV8=
Vary: Origin
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location: https://dpm.demdex.net/id/rd?d_visid_ver=4.1.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=B8D07FF4520E94C10A490D4C%40AdobeOrg&d_nsid=0&ts=1652041943353
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Length: 0
Expires: Thu, 01 Jan 1970 00:00:00 UTC

GET
H2 200 utag.5.js Show response
tags.tiqcdn.com/utag/cisco/duo/prod/ 72 KB
26 KB 129ms
128ms Script
application/x-javascript 104.75.88.194
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.5.js?utv=ut4.46.202205051633
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-88-194.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: dce1fd8dcc41fdb21dd9e4abc562d66ff781c30add42fa3c7b1f9e9ff97aeab4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Sun, 08 May 2022 20:32:23 GMT
content-encoding: gzip
last-modified: Thu, 05 May 2022 16:35:07 GMT
server: AkamaiNetStorage
etag: "d948ed2398c7d970d00a7a459178ce34:1651768507.810473"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 25949
expires: Mon, 23 May 2022 20:32:23 GMT

GET
H2 200 utag.3.js Show response
tags.tiqcdn.com/utag/cisco/duo/prod/ 22 KB
7 KB 116ms
115ms Script
application/x-javascript 104.75.88.194
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.3.js?utv=ut4.46.202205051633
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-88-194.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: 6990ab63be215df2bb79078263c8ccb3d5b034682b8af9e2ff04fc3af4d040c3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Sun, 08 May 2022 20:32:23 GMT
content-encoding: gzip
last-modified: Thu, 05 May 2022 16:35:08 GMT
server: AkamaiNetStorage
etag: "df4dc5d8e845cd5674942a02ca27474f:1651768508.568245"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 7297
expires: Mon, 23 May 2022 20:32:23 GMT

GET
H2 200 utag.28.js Show response
tags.tiqcdn.com/utag/cisco/duo/prod/ 2 KB
1 KB 106ms
106ms Script
application/x-javascript 104.75.88.194
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.28.js?utv=ut4.46.202106171628
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-88-194.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: c72062a60866c674a25f2a5b5d8344e9509c7381a6472f2a484325ac14597ee8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Sun, 08 May 2022 20:32:23 GMT
content-encoding: gzip
last-modified: Thu, 17 Jun 2021 16:28:49 GMT
server: AkamaiNetStorage
etag: "097dc543fb3caec1bac670f2bd520652:1623947329.572906"
vary: Accept-Encoding
content-type: application/x-javascript
cache-control: max-age=1296000
accept-ranges: bytes
content-length: 999
expires: Mon, 23 May 2022 20:32:23 GMT

GET
H2 200 u
cdn.bizible.com/m/ 43 B
121 B 109ms
108ms Image
image/gif 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.bizible.com/m/u?mapType=mkto&mapValue=id%3A074-UQX-410%26token%3A_mch-duo.com-1652041942779-33174&_biz_u=ce23af8d85ad4ac2a17788f34bb3bf16&_biz_s=418ff9&_biz_l=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&_biz_t=1652041943102&_biz_i=%20%7C%20Decipher&_biz_n=1&a=duo.com&rnd=63102&cdn_o=a&_biz_z=1652041943390
Requested by: Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (lhb/6330) /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 08 May 2022 20:32:23 GMT
last-modified: Thu, 05 May 2022 02:55:15 GMT
server: ECS (lhb/6330)
age: 322628
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-cache, no-store
accept-ranges: bytes
content-type: Image/GIF
content-length: 43
expires: -1

GET
H3 200 gtm.js Show response
www.googletagmanager.com/ 287 KB
85 KB 125ms
124ms Script
application/javascript 2a00:1450:4001:813::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-MFPB9D&l=dataLayer

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:813::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

6a1950ad21353f4dd382ed39e5205de0f61b1b65441b765f04eee31777657b69

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Sun, 08 May 2022 20:32:23 GMT
content-encoding: br
vary: Accept-Encoding
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 87016
x-xss-protection: 0
last-modified: Sun, 08 May 2022 18:00:00 GMT
server: Google Tag Manager
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Sun, 08 May 2022 20:32:23 GMT

GET
H/1.1 200
OK ntpagetag.gif
cisco-tags.cisco.com/tag/ 85 B
598 B 1070ms
179ms Image
image/gif 72.163.10.10
CISCOSYSTEMS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://cisco-tags.cisco.com/tag/ntpagetag.gif?js=1&ts=1652041943488.815&lc=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&rs=1600x1200&cd=24&ln=en&tz=GMT&jv=0&utag_main_v_id=0180a55f8929002053930d28f89803073004e06b00b08&meta.viewport=width%3Ddevice-width%2C%20initial-scale%3D1.0%2C%20user-scalable%3Dyes&title=%7C%20decipher&url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&tag=ut4.46.202205051634&entitlement=undefined&locale=en-us&meta.country=us&meta.locale=us&breakpoint=unavailable&content_type=no%20contenttype&linktrack=linkpage&loc=http%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&cookie_length=1000&meta.iapath=no%20iapath&hier1=no%20iapath&meta.wm_reporting_category=no%20iapath&sa_source=meta.iapath&t_profile=cisco.duo&t_load=ctm&suite=cisco-complete&returnVisit=false&cookies=true&localstorage=true&dnt=false&_ga=GA1.2.602281868.1652041942&conversion=event1&adobeVersions=AppMeasurement%3Dna%2CVisitorJS%3Dna%2CMbox%3Dna&meta.msapplication-tilecolor=%23000000&meta.msapplication-config=%2Fassets%2Fimg%2Fdecipher%2Ffavicons%2Fbrowserconfig.xml&meta.theme-color=%23ffffff&meta.robots=index%2Cfollow%2Carchive&meta.fb:app_id=2090208394329663&meta.og:site_name=decipher&meta.og:type=website&meta.twitter:card=summary_large_image&meta.twitter:site=%40deciphersec&meta.twitter:creator=%40deciphersec&meta.description=security%20without%20fear.%20the%20web%20doesn%E2%80%99t%20have%20to%20be%20dark.%20decipher%E2%80%99s%20goal%20is%20to%20bring%20order%20to%20this%20unpredictable%20and%20often%20confusing%20landscape%20by%20providing%20fresh%20perspectives%20from%20trusted%20voices.&meta.og:description=security%20without%20fear.%20the%20web%20doesn%E2%80%99t%20have%20to%20be%20dark.%20decipher%E2%80%99s%20goal%20is%20to%20bring%20order%20to%20this%20unpredictable%20and%20often%20confusing%20landscape%20by%20providing%20fresh%20perspectives%20from%20trusted%20voices.&meta.twitter:description=security%20without%20fear.%20the%20web%20doesn%E2%80%99t%20have%20to%20be%20dark.%20decipher%E2%80%99s%20goal%20is%20to%20bring%20order%20to%20this%20unpredictable%20and%20often%20confusing%20landscape%20by%20providing%20fresh%20perspectives%20from%20trusted%20voices.&meta.twitter:image=http%3A%2F%2Fduo-www-v3-clean.test%2Fassets%2Fimg%2Fseo-images%2Fmeta-decipher-default.jpg&meta.og:image=http%3A%2F%2Fduo-www-v3-clean.test%2Fassets%2Fimg%2Fseo-images%2Fmeta-decipher-default.jpg&meta.og:image:width=1200&meta.og:image:height=630&meta.bitly-verification=040b99f315c6&meta.google-site-verification=svd8ahbyylsc2wljqdzwij1d2tnu8-u3fbldciehxdu&meta.twitter:widgets:csp=on&meta.msvalidate.01=27fb624dbd3f07315a4bf69f5d649c68&ets=1652041943499.932

Requested by

Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS

Protocol

HTTP/1.1

Security

TLS 1.2, RSA, AES_128_GCM

Server

72.163.10.10 , United States, ASN109 (CISCOSYSTEMS, US),

Reverse DNS

cisco-tags.cisco.com

Software

Apache/2.2 /

Resource Hash

b96b64444f7d52c39b5716fe4d3e8d0433c67fb79731a4400188835d97b74bce

Security Headers

Name	Value
Content-Security-Policy	script-src 'self'; object-src 'self'
Strict-Transport-Security	max-age=31536000; includeSubdomains;
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Sun, 08 May 2022 20:32:24 GMT
X-Content-Type-Options: nosniff
Last-Modified: Fri, 12 Jun 2009 13:25:52 GMT
Server: Apache/2.2
ETag: "55"
X-Frame-Options: SAMEORIGIN
Content-Type: image/gif
Access-Control-Allow-Origin: *
Connection: Keep-Alive
Content-Security-Policy: script-src 'self'; object-src 'self'
Strict-Transport-Security: max-age=31536000; includeSubdomains;
Accept-Ranges: bytes
Keep-Alive: timeout=2, max=1000
Content-Length: 85
X-XSS-Protection: 1; mode=block

GET
H2 200 utag.v.js Show response
tags.tiqcdn.com/utag/tiqapp/ 2 B
202 B 100ms
99ms Script
application/x-javascript 104.75.88.194
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=cisco/duo/202205051633&cb=1652041943521
Requested by: Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 104.75.88.194 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a104-75-88-194.deploy.static.akamaitechnologies.com
Software: AkamaiNetStorage /
Resource Hash: a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Sun, 08 May 2022 20:32:23 GMT
last-modified: Thu, 14 Apr 2016 16:57:51 GMT
server: AkamaiNetStorage
etag: "7bc0ee636b3b83484fc3b9348863bd22:1460653071"
content-type: application/x-javascript
cache-control: max-age=600
accept-ranges: bytes
content-length: 2
expires: Sun, 08 May 2022 20:42:23 GMT

GET
H2 204 pageview
c.contentsquare.net/ 0
320 B 356ms
109ms Image
text/plain 34.248.131.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.contentsquare.net/pageview?pid=5637&uu=cfa4349e-31aa-a474-e37b-c71df11502f3&sn=1&lv=1652041943&lhd=1652041943&hd=1652041943&pn=1&dw=1600&dh=1373&ww=1600&wh=1200&sw=1600&sh=1200&dr=&url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&uc=1&la=en-US&v=11.23.0&r=172665
Requested by: Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.248.131.147 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-248-131-147.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 08 May 2022 20:32:23 GMT
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
content-disposition: inline
timing-allow-origin: *
access-control-allow-headers: Access-Control-Expose-Headers, Content-Type, Content-Compression, X-Requested-With
expires: Sun, 24 Oct 1982 23:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
107 B 119ms
119ms Image
image/gif 2a00:1450:4001:801::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-20141016-1&cid=602281868.1652041942&jid=656269897&_u=aADAAAAAQAAAAC~&z=140804203

Requested by

Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:801::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 08 May 2022 20:32:23 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 ga-audiences
www.google.de/ads/ 42 B
63 B 237ms
199ms Image
image/gif 2a00:1450:4001:829::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-20141016-1&cid=602281868.1652041942&jid=656269897&_u=aADAAAAAQAAAAC~&z=140804203

Requested by

Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:829::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 08 May 2022 20:32:23 GMT
x-content-type-options: nosniff
server: cafe
timing-allow-origin: *
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: image/gif
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 collect Show response
h.clarity.ms/ 0
87 B 184ms
184ms XHR
text/plain 52.224.31.34
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://h.clarity.ms/collect
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=duo.com
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.224.31.34 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://duo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

access-control-allow-origin: https://duo.com
date: Sun, 08 May 2022 20:32:23 GMT
access-control-allow-credentials: true
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
request-context: appId=cid-v1:b1d896b3-bec7-448b-b764-240152e813e8

GET
H/1.1 200
OK dest5.html Show response
cisco.demdex.net/ Frame 8C1F 7 KB
3 KB 465ms
94ms Document
text/html 52.213.194.249
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://cisco.demdex.net/dest5.html?d_nsid=0

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

52.213.194.249 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-213-194-249.eu-west-1.compute.amazonaws.com

Software

Resource Hash

7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Referer: https://duo.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

Accept-Ranges: bytes
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Length: 2791
Content-Type: text/html;charset=UTF-8
DCS: dcs-prod-irl1-1-v031-0bc8e4ee4.edge-irl1.demdex.com UNKNOWN
Expires: Thu, 01 Jan 1970 00:00:00 UTC
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-TID: UK+Zh3roTBw=
content-encoding: gzip
date: Sun, 8 May 2022 20:32:24 GMT
last-modified: Wed, 27 Apr 2022 09:30:05 GMT
vary: accept-encoding

GET
H2 200 id Show response
smetrics.cisco.com/ 48 B
500 B 387ms
101ms XHR
application/x-javascript 15.188.95.229
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://smetrics.cisco.com/id?d_visid_ver=4.1.0&d_fieldgroup=A&mcorgid=B8D07FF4520E94C10A490D4C%40AdobeOrg&mid=15608206335044712240576381656895400858&ts=1652041943961

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=duo.com

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.188.95.229 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-188-95-229.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

56a1edc162b34c562e5c4512d470a1e2d6c1c919a1f8208feb2624e17ac2c8d6

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Referer: https://duo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Sun, 08 May 2022 20:32:24 GMT
x-content-type-options: nosniff
server: jag
xserver: anedge-b4b698fcd-cf42l
vary: Origin
x-c: main-1640.Id95fac.M0-564
p3p: CP="This is not a P3P policy"
access-control-allow-origin: https://duo.com
cache-control: no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials: true
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript;charset=utf-8
content-length: 48
x-xss-protection: 1; mode=block

GET
H2 204 dvar
c.contentsquare.net/ 0
319 B 115ms
115ms Image
text/plain 34.248.131.147
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.contentsquare.net/dvar?v=11.23.0&pid=5637&uu=cfa4349e-31aa-a474-e37b-c71df11502f3&sn=1&pn=1&dv=N4IgxgzgsghgLmAFgSwHYHMDSBTAniALhAAYA6ANgGZKBOY%2BgDgYCZmaqB9ARnIFZniAFi41BtGgxABfIAA%3D&r=483447
Requested by: Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.248.131.147 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-34-248-131-147.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 08 May 2022 20:32:24 GMT
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0
content-disposition: inline
timing-allow-origin: *
access-control-allow-headers: Access-Control-Expose-Headers, Content-Type, Content-Compression, X-Requested-With
expires: Sun, 24 Oct 1982 23:00:00 GMT

GET
H2 200 u
cdn.bizible.com/m/ 43 B
108 B 107ms
106ms Image
image/gif 152.195.15.58
EDGECAST

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://cdn.bizible.com/m/u?mapType=ecid&mapValue=B8D07FF4520E94C10A490D4C%40AdobeOrg_15608206335044712240576381656895400858&_biz_u=ce23af8d85ad4ac2a17788f34bb3bf16&_biz_s=418ff9&_biz_l=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&_biz_t=1652041944109&_biz_i=%20%7C%20Decipher&_biz_n=2&a=duo.com&rnd=686687&cdn_o=a&_biz_z=1652041944111
Requested by: Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software: ECS (lhb/6330) /
Resource Hash: afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 08 May 2022 20:32:24 GMT
last-modified: Thu, 05 May 2022 02:55:15 GMT
server: ECS (lhb/6330)
age: 322629
x-cache: HIT
p3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control: no-cache, no-store
accept-ranges: bytes
content-type: Image/GIF
content-length: 43
expires: -1

GET
H2 200 s61315026235020 Show response
smetrics.cisco.com/b/ss/cisco-complete/10/JS-2.12.0/ 927 B
1 KB 94ms
92ms Script
application/x-javascript 15.188.95.229
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://smetrics.cisco.com/b/ss/cisco-complete/10/JS-2.12.0/s61315026235020?AQB=1&ndh=1&pf=1&callback=s_c_il[1].doPostbacks&et=1&t=8%2F4%2F2022%2020%3A32%3A24%200%200&d.&nsid=0&jsonv=1&.d&sdid=3597C939CD9EBF92-115DBCAFF928D84B&mid=15608206335044712240576381656895400858&aamlh=6&ce=UTF-8&ns=cisco&pageName=duo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2Fnaws&g=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&cc=USD&events=event1&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&c1=%7C%20decipher&h1=duo.com%3Adecipher%3Atrailblazer-hunts-compromised-credentials-in-aws%3Anaws&c2=undefined%3Ano%20iapath%3Anaws&c3=duo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2Fnaws&h3=no%20iapath&c10=12%3A32%20PM%7CSunday&v10=12%3A32%20PM%7CSunday&v25=duo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2Fnaws&v26=no%20contenttype&c28=no%20iapath&v28=no%20iapath&c33=en-us&v33=en-us&c41=duo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2Fnaws&c46=ut4.46.202205051634&v48=undefined&c50=cisco-complete&c51=unavailable&c53=no%20contenttype&c59=0180a55f8929002053930d28f89803073004e06b00b08&v63=unavailable&v77=AppMeasurement%3D2.12.0%2CVisitorJS%3D4.1.0%2CMbox%3Dna&v78=dnt%3Dfalse%2Ccookies%3Dtrue%2Clocalstorage%3Dtrue&v92=0.63390008822963_1652041943998&v98=cisco.duo&v106=15608206335044712240576381656895400858&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=B8D07FF4520E94C10A490D4C%40AdobeOrg&AQE=1

Requested by

Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.5.js?utv=ut4.46.202205051633

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

15.188.95.229 Paris, France, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-15-188-95-229.eu-west-3.compute.amazonaws.com

Software

jag /

Resource Hash

645642cbfaa24dd60dcb8d4eb9f5ed68e845b7528c5cc8969f1e67149e754333

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

x-aam-tid: AwXM95xvTlY=
date: Sun, 08 May 2022 20:32:24 GMT
x-content-type-options: nosniff
x-c: main-1640.Id95fac.M0-564
p3p: CP="This is not a P3P policy"
vary: *
content-length: 927
x-xss-protection: 1; mode=block
dcs: dcs-prod-irl1-1-v031-0a9860664.edge-irl1.demdex.com UNKNOWN
pragma: no-cache
last-modified: Mon, 09 May 2022 20:32:24 GMT
server: jag
xserver: anedge-b4b698fcd-2wvjl
etag: 3547733060874895360-4619800435089344531
strict-transport-security: max-age=31536000; includeSubDomains
content-type: application/x-javascript;charset=utf-8
access-control-allow-origin: *
cache-control: no-cache, no-store, max-age=0, no-transform, private
expires: Sat, 07 May 2022 20:32:24 GMT

GET
H/1.1

200
OK

ibs:dpid=771&dpuuid=CAESEH5cT4j_IIYqvEVwgAeTefo&google_cver=1
dpm.demdex.net/ Frame 8C1F
Redirect Chain

https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=MjAyOTA4MDU0NDYzNjcxNTMyMTEwNDQzMDczODk1MDYyMDQxODc=
https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm=&gdpr=0&gdpr_consent=&google_hm=MjAyOTA4MDU0NDYzNjcxNTMyMTEwNDQzMDczODk1MDYyMDQxODc=&google_tc=
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEH5cT4j_IIYqvEVwgAeTefo&google_cver=1?gdpr=0&gdpr_consent=

42 B
945 B

129ms
128ms

Image
image/gif

52.19.61.87
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEH5cT4j_IIYqvEVwgAeTefo&google_cver=1?gdpr=0&gdpr_consent=

Requested by

Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS

Protocol

HTTP/1.1

Server

52.19.61.87 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-19-61-87.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cisco.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v031-01dd4a5ad.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: dKg4LSJxR0k=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma: no-cache
date: Sun, 08 May 2022 20:32:24 GMT
server: HTTP server (unknown)
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location: https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEH5cT4j_IIYqvEVwgAeTefo&google_cver=1?gdpr=0&gdpr_consent=
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-type: text/html; charset=UTF-8
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 314
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 adsct
analytics.twitter.com/i/ Frame 8C1F 43 B
354 B 369ms
190ms Image
image/gif 104.244.42.3
TWITTER

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://analytics.twitter.com/i/adsct?p_user_id=20290805446367153211044307389506204187&p_id=38594

Requested by

Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

104.244.42.3 , United States, ASN13414 (TWITTER, US),

Reverse DNS

Software

tsa_o /

Resource Hash

ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957

Security Headers

Name	Value
Strict-Transport-Security	max-age=631138519

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cisco.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

x-response-time: 115
date: Sun, 08 May 2022 20:32:24 GMT
server: tsa_o
strict-transport-security: max-age=631138519
content-type: image/gif;charset=utf-8
cache-control: no-cache, no-store, max-age=0
x-connection-hash: 46b16ac04031ccb647cad6afa13d244535a33e607b2282cdafe08b00a0de0852
content-length: 43

GET
H/1.1

200
OK

ibs:dpid=30646
dpm.demdex.net/ Frame 8C1F
Redirect Chain

https://cms.analytics.yahoo.com/cms?partner_id=ADOBE&_hosted_id=20290805446367153211044307389506204187&gdpr=0&gdpr_consent=
https://dpm.demdex.net/ibs:dpid=30646?dpuuid=y-oaBtDGdE2pGpqnlxqnoXxa47goPwK48MG5E-~A

42 B
945 B

223ms
131ms

Image
image/gif

52.19.61.87
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://dpm.demdex.net/ibs:dpid=30646?dpuuid=y-oaBtDGdE2pGpqnlxqnoXxa47goPwK48MG5E-~A

Requested by

Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS

Protocol

HTTP/1.1

Server

52.19.61.87 Dublin, Ireland, ASN16509 (AMAZON-02, US),

Reverse DNS

ec2-52-19-61-87.eu-west-1.compute.amazonaws.com

Software

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cisco.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

DCS: dcs-prod-irl1-1-v031-0e6e7a81c.edge-irl1.demdex.com UNKNOWN
Pragma: no-cache
Strict-Transport-Security: max-age=31536000; includeSubDomains
content-encoding: gzip
X-Content-Type-Options: nosniff
X-TID: aX6wc3bVSoo=
P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control: no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection: keep-alive
Content-Type: image/gif
Content-Length: 59
Expires: Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

date: Sun, 08 May 2022 20:32:24 GMT
via: http/1.1 spdc0101.pbp.ir2.yahoo.com (ApacheTrafficServer)
server: ATS
age: 0
strict-transport-security: max-age=31536000
content-type: text/html;charset=utf-8
location: https://dpm.demdex.net/ibs:dpid=30646?dpuuid=y-oaBtDGdE2pGpqnlxqnoXxa47goPwK48MG5E-~A
content-length: 0

GET
H2

204

usermatch.gif
beacon.krxd.net/ Frame 8C1F
Redirect Chain

https://usermatch.krxd.net/um/v2?partner=adobe&id=20290805446367153211044307389506204187
https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=adobe&id=20290805446367153211044307389506204187

0
337 B

313ms
97ms

Image
text/plain

52.16.172.200
AMAZON-02

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=adobe&id=20290805446367153211044307389506204187
Requested by: Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol: H2
Server: 52.16.172.200 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS: ec2-52-16-172-200.eu-west-1.compute.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://cisco.demdex.net/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Sun, 08 May 2022 20:32:25 GMT
cache-control: private, no-cache, no-store
x-request-time: D=38 t=1652041945
x-served-by: beacon-n011-dub-prod.krxd.net
p3p: policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location: https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=adobe&id=20290805446367153211044307389506204187
date: Sun, 08 May 2022 20:32:25 GMT
x-cache-hits: 0
x-age: 0
content-length: 0
x-cache: MISS
x-served-by: usermatch-a006-ash-prod.krxd.net

GET
H3 200 120108061684670 Show response
connect.facebook.net/signals/config/ 305 KB
87 KB 493ms
493ms Script
application/x-javascript 2a03:2880:f007:8:face:b00c:0:1
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://connect.facebook.net/signals/config/120108061684670?v=2.9.58&r=stable

Requested by

Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a03:2880:f007:8:face:b00c:0:1 Vienna, Austria, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

Resource Hash

726959cb48dcd73ec407fe30a403a4ff7cc80aaa792142cf068d116cba0c0771

Security Headers

Name	Value
Content-Security-Policy	default-src * data: blob: 'self';script-src .facebook.com .fbcdn.net .facebook.net .google-analytics.com .google.com 127.0.0.1: 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' ;connect-src .facebook.com facebook.com .fbcdn.net .facebook.net wss://.facebook.com: wss://.whatsapp.com: wss://.fbcdn.net attachment.fbsbx.com ws://localhost: blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security	max-age=31536000; preload; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	DENY
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

content-security-policy: default-src * data: blob: 'self';script-src *.facebook.com *.fbcdn.net *.facebook.net *.google-analytics.com *.google.com 127.0.0.1:* 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self';block-all-mixed-content;upgrade-insecure-requests;
content-encoding: gzip
x-content-type-options: nosniff
document-policy: force-load-at-top
report-to: {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400,h3-29=":443"; ma=86400
x-xss-protection: 0
pragma: public
x-fb-debug: IGCU0GS1a88EObg9ZZqtnpwk/CbMJBFGt/uQjt0vD8uMk5px0919OMxbfbO2Ww07+3h1RK6xFO+843vakgWAHA==
cross-origin-embedder-policy-report-only: require-corp;report-to="coep_report"
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: DENY
date: Sun, 08 May 2022 20:32:25 GMT
strict-transport-security: max-age=31536000; preload; includeSubDomains
x-content-cdn-origin-ts: 1652041945020
content-type: application/x-javascript; charset=utf-8
vary: Accept-Encoding
cache-control: public, max-age=1200
x-fb-rlafr: 0
priority: u=3,i
expires: Sat, 01 Jan 2000 00:00:00 GMT

GET
H2 200 /
www.facebook.com/tr/ 44 B
271 B 1497ms
351ms Image
image/gif 2a03:2880:f107:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=216127175396154&ev=PageView&dl=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&rl=&if=false&ts=1652041944802&sw=1600&sh=1200&v=2.9.58&r=stable&ec=0&o=30&fbp=fb.1.1652041944799.2111369750&it=1652041943303&coo=false&rqm=GET

Requested by

Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f107:83:face:b00c:0:25de Vienna, Austria, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Sun, 08 May 2022 20:32:26 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 44
expires: Sun, 08 May 2022 20:32:26 GMT

POST
H2 204 collect Show response
h.clarity.ms/ 0
48 B 190ms
189ms XHR
text/plain 52.224.31.34
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://h.clarity.ms/collect
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=duo.com
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.224.31.34 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://duo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

access-control-allow-origin: https://duo.com
date: Sun, 08 May 2022 20:32:24 GMT
access-control-allow-credentials: true
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
request-context: appId=cid-v1:b1d896b3-bec7-448b-b764-240152e813e8

GET
H2 200 /
www.facebook.com/tr/ 44 B
213 B 652ms
352ms Image
image/gif 2a03:2880:f107:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.facebook.com/tr/?id=120108061684670&ev=PageView&dl=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&rl=&if=false&ts=1652041945621&sw=1600&sh=1200&v=2.9.58&r=stable&ec=0&o=30&fbp=fb.1.1652041944799.2111369750&it=1652041943303&coo=false&rqm=GET

Requested by

Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f107:83:face:b00c:0:25de Vienna, Austria, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

date: Sun, 08 May 2022 20:32:26 GMT
last-modified: Fri, 21 Dec 2012 00:00:01 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains
content-type: image/gif
cache-control: no-cache, must-revalidate, max-age=0
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 44
expires: Sun, 08 May 2022 20:32:26 GMT

POST
H2 200 / Show response
www.facebook.com/tr/ Frame 5C5E 0
216 B 638ms
347ms Document
text/plain 2a03:2880:f107:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f107:83:face:b00c:0:25de Vienna, Austria, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://duo.com
Referer: https://duo.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: https://duo.com
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Sun, 08 May 2022 20:32:26 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

POST
H2 200 / Show response
www.facebook.com/tr/ Frame 9F90 0
31 B 299ms
299ms Document
text/plain 2a03:2880:f107:83:face:b00c:0:25de
FACEBOOK

General

Check archive.org

Show headers Download Go to

Full URL

https://www.facebook.com/tr/

Requested by

Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a03:2880:f107:83:face:b00c:0:25de Vienna, Austria, ASN32934 (FACEBOOK, US),

Reverse DNS

Software

proxygen-bolt /

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains

Request headers

Content-Type: application/x-www-form-urlencoded
Origin: https://duo.com
Referer: https://duo.com/
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-credentials: true
access-control-allow-origin: https://duo.com
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length: 0
content-type: text/plain
cross-origin-resource-policy: cross-origin
date: Sun, 08 May 2022 20:32:26 GMT
server: proxygen-bolt
strict-transport-security: max-age=31536000; includeSubDomains

GET
H/1.1 200
OK getuidj Show response
secure.adnxs.com/ 11 B
691 B 355ms
111ms XHR
application/json 185.33.221.88
ASN-APPNEX

General

Check archive.org

Show headers Download Go to

Full URL

https://secure.adnxs.com/getuidj

Requested by

Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=duo.com

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_ECDSA, AES_128_GCM

Server

185.33.221.88 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),

Reverse DNS

726.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net

Software

nginx/1.21.3 /

Resource Hash

31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d

Security Headers

Name	Value
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Pragma: no-cache
Date: Sun, 08 May 2022 20:32:26 GMT
X-Proxy-Origin: 193.27.14.24; 193.27.14.24; 726.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid: 73662673-36dd-4def-8122-03bcff208436
Server: nginx/1.21.3
P3P: policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin: https://duo.com
Cache-Control: no-store, no-cache, private
Access-Control-Allow-Credentials: true
Connection: keep-alive
Content-Type: application/json; charset=utf-8
Content-Length: 11
X-XSS-Protection: 0
Expires: Sat, 15 Nov 2008 16:00:00 GMT

GET
H/1.1 200
OK / Show response
c.6sc.co/ 47 B
363 B 375ms
110ms XHR
text/plain 96.16.137.162
AKAMAI-AS

General

Check archive.org

Show headers Download Go to

Full URL: https://c.6sc.co/
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=duo.com
Protocol: HTTP/1.1
Security: TLS 1.3, , AES_256_GCM
Server: 96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS: a96-16-137-162.deploy.static.akamaitechnologies.com
Software: /
Resource Hash: ca092189a090471583f58a526922ba148b98e0b6bc661aba0406208835299492

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Sun, 08 May 2022 20:32:26 GMT
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: text/plain
Access-Control-Allow-Origin: https://duo.com
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: *
Content-Length: 47

GET
H2 200 / Show response
ipv6.6sc.co/ 21 B
250 B 355ms
104ms XHR
text/html 2a02:26f0:6c00:294::1c91
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL: https://ipv6.6sc.co/
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=duo.com
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 2a02:26f0:6c00:294::1c91 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software: /
Resource Hash: 43a4925fbcf490aaf0729b14e51d0ecb95d549d4faff22dacd6d6d0ab481a846

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 08 May 2022 20:32:26 GMT
vary: Origin
content-type: text/html
access-control-allow-origin: https://duo.com
cache-control: max-age=0, no-cache, no-store
6si-ipv6: 2001:ac8:20:302::202e
server-timing: cdn-cache; desc=HIT, edge; dur=1
content-length: 21
expires: Sun, 08 May 2022 20:32:26 GMT

GET
H2

200

c.gif
c.clarity.ms/
Redirect Chain

https://c.clarity.ms/c.gif
https://c.bing.com/c.gif?CtsSyncId=7ECA64E6BF474FE78179C827E6749A4F&RedC=c.clarity.ms&MXFR=0AC962C66A0C67D8356C73586E0C698D
https://c.clarity.ms/c.gif?CtsSyncId=7ECA64E6BF474FE78179C827E6749A4F&MUID=0A8B0D6411FA61393C061CFA102860C8

42 B
391 B

123ms
122ms

Image
image/gif

52.142.114.2
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://c.clarity.ms/c.gif?CtsSyncId=7ECA64E6BF474FE78179C827E6749A4F&MUID=0A8B0D6411FA61393C061CFA102860C8
Protocol: H2
Server: 52.142.114.2 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 08 May 2022 20:32:26 GMT
last-modified: Fri, 18 Mar 2022 19:39:54 GMT
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
etag: "8120eaf0ff3ad81:0"
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control: private, no-cache, proxy-revalidate, no-store
accept-ranges: bytes
content-type: image/gif
content-length: 42

Redirect headers

pragma: no-cache
date: Sun, 08 May 2022 20:32:26 GMT
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 701F503E1FEA4CF1B1E19307A267DE5C Ref B: FRAEDGE1212 Ref C: 2022-05-08T20:32:27Z
x-powered-by: ASP.NET
x-cache: CONFIG_NOCACHE
p3p: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location: https://c.clarity.ms/c.gif?CtsSyncId=7ECA64E6BF474FE78179C827E6749A4F&MUID=0A8B0D6411FA61393C061CFA102860C8
cache-control: private, no-cache, proxy-revalidate, no-store
content-length: 0

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 111ms
111ms Image
image/gif 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1311868780&t=event&ni=1&_s=1&dl=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&ul=en-us&de=UTF-8&dt=%7C%20Decipher&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=undefined&ea=undefined&_u=aDDAAAABQAAAAG~&jid=&gjid=&cid=602281868.1652041942&tid=UA-20141016-1&_gid=2110132185.1652041943&gtm=2wg540MFPB9D&cd2=602281868.1652041942&z=967908029

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 08 May 2022 19:30:53 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 3693
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 112ms
111ms Image
image/gif 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1311868780&t=timing&_s=2&dl=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&ul=en-us&de=UTF-8&dt=%7C%20Decipher&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&plt=7850&pdt=2&dns=9&rrt=0&srt=2154&tcp=224&dit=4324&clt=4324&_gst=3447&_gbt=3820&_cst=2443&_cbt=3434&_u=aDDAAAABQAAAAG~&jid=&gjid=&cid=602281868.1652041942&tid=UA-20141016-1&_gid=2110132185.1652041943&gtm=2wg540MFPB9D&z=230660300

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 08 May 2022 19:30:53 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 3693
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 113ms
113ms Image
image/gif 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1311868780&t=timing&_s=2&dl=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&ul=en-us&de=UTF-8&dt=%7C%20Decipher&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&plt=7850&pdt=2&dns=9&rrt=0&srt=2154&tcp=224&dit=4324&clt=4324&_gst=3447&_gbt=3820&_cst=2443&_cbt=3434&_u=aDDAgAABQAAAAG~&jid=&gjid=&cid=602281868.1652041942&tid=UA-20141016-1&_gid=2110132185.1652041943&gtm=2wg540MFPB9D&cg3=Decipher%20Traffic%20Only&z=2007127773

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 08 May 2022 19:30:53 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 3693
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 114ms
113ms Image
image/gif 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1311868780&t=event&ni=1&_s=1&dl=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&ul=en-us&de=UTF-8&dt=%7C%20Decipher&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=CRI%20-%20Scroll%20Tracking&ea=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&el=50%25&_u=aDDAAEABQAAAAG~&jid=&gjid=&cid=602281868.1652041942&tid=UA-20141016-1&_gid=2110132185.1652041943&gtm=2wg540MFPB9D&z=1560951812

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 08 May 2022 19:30:53 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 3693
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H3 200 collect
www.google-analytics.com/ 35 B
55 B 115ms
114ms Image
image/gif 2a00:1450:4001:82a::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/collect?v=1&_v=j96&a=1311868780&t=event&ni=1&_s=1&dl=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&ul=en-us&de=UTF-8&dt=%7C%20Decipher&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=CRI%20-%20Scroll%20Tracking&ea=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&el=75%25&_u=aDDAAEABQAAAAG~&jid=&gjid=&cid=602281868.1652041942&tid=UA-20141016-1&_gid=2110132185.1652041943&gtm=2wg540MFPB9D&z=188048110

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

pragma: no-cache
date: Sun, 08 May 2022 19:30:53 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
age: 3693
content-type: image/gif
access-control-allow-origin: *
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 35
expires: Mon, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 674ms
299ms Image
image/gif 96.16.137.162
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=361da14e9cc9e3c3150a35780c1bec6b&svisitor=null&session=2688b65a-dab5-4fbb-8efe-0fe091674b14&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Sun%2C%2008%20May%202022%2020%3A32%3A22%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Security%20without%20fear.%20The%20web%20doesn%E2%80%99t%20have%20to%20be%20dark.%20Decipher%E2%80%99s%20goal%20is%20to%20bring%20order%20to%20this%20unpredictable%20and%20often%20confusing%20landscape%20by%20providing%20fresh%20perspectives%20from%20trusted%20voices.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%20%7C%20Decipher%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&pageViewId=bf056438-fbd7-4e25-8727-381eeef4a1ad

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-137-162.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Sun, 08 May 2022 20:32:27 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Tue, 05 Oct 2021 22:17:52 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "615ccf10-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 636ms
387ms Image
image/gif 96.16.137.162
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=361da14e9cc9e3c3150a35780c1bec6b&svisitor=null&session=2688b65a-dab5-4fbb-8efe-0fe091674b14&event=ipv6&q=%7B%22address%22%3A%222001%3Aac8%3A20%3A302%3A%3A202e%22%7D&isIframe=false&m=%7B%22description%22%3A%22Security%20without%20fear.%20The%20web%20doesn%E2%80%99t%20have%20to%20be%20dark.%20Decipher%E2%80%99s%20goal%20is%20to%20bring%20order%20to%20this%20unpredictable%20and%20often%20confusing%20landscape%20by%20providing%20fresh%20perspectives%20from%20trusted%20voices.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%20%7C%20Decipher%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&pageViewId=bf056438-fbd7-4e25-8727-381eeef4a1ad&an_uid=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-137-162.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Sun, 08 May 2022 20:32:27 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Sat, 05 Jun 2021 07:56:05 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "60bb2e15-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 383ms
383ms Image
image/gif 96.16.137.162
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=361da14e9cc9e3c3150a35780c1bec6b&svisitor=cfd5ce17b6240000d62878629e02000089013600&session=2688b65a-dab5-4fbb-8efe-0fe091674b14&event=active_time_track&q=%7B%22currentTime%22%3A%22Sun%2C%2008%20May%202022%2020%3A32%3A27%20GMT%22%2C%22lastTrackTime%22%3A%22Sun%2C%2008%20May%202022%2020%3A32%3A22%20GMT%22%2C%22timeSpent%22%3A%224708%22%2C%22totalTimeSpent%22%3A%224708%22%7D&isIframe=false&m=%7B%22description%22%3A%22Security%20without%20fear.%20The%20web%20doesn%E2%80%99t%20have%20to%20be%20dark.%20Decipher%E2%80%99s%20goal%20is%20to%20bring%20order%20to%20this%20unpredictable%20and%20often%20confusing%20landscape%20by%20providing%20fresh%20perspectives%20from%20trusted%20voices.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%20%7C%20Decipher%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&pageViewId=bf056438-fbd7-4e25-8727-381eeef4a1ad&an_uid=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-137-162.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Sun, 08 May 2022 20:32:27 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Tue, 05 Oct 2021 22:17:52 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "615ccf10-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

POST
H2 204 collect Show response
h.clarity.ms/ 0
48 B 205ms
204ms XHR
text/plain 52.224.31.34
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to

Full URL: https://h.clarity.ms/collect
Requested by: Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=duo.com
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.224.31.34 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: Microsoft-IIS/10.0 / ASP.NET
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept: application/x-clarity-gzip
Referer: https://duo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

access-control-allow-origin: https://duo.com
date: Sun, 08 May 2022 20:32:26 GMT
access-control-allow-credentials: true
server: Microsoft-IIS/10.0
x-powered-by: ASP.NET
request-context: appId=cid-v1:b1d896b3-bec7-448b-b764-240152e813e8

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 375ms
374ms Image
image/gif 96.16.137.162
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=361da14e9cc9e3c3150a35780c1bec6b&svisitor=cfd5ce17b6240000d62878629e02000089013600&session=2688b65a-dab5-4fbb-8efe-0fe091674b14&event=active_time_track&q=%7B%22currentTime%22%3A%22Sun%2C%2008%20May%202022%2020%3A32%3A28%20GMT%22%2C%22lastTrackTime%22%3A%22Sun%2C%2008%20May%202022%2020%3A32%3A27%20GMT%22%2C%22timeSpent%22%3A%221006%22%2C%22totalTimeSpent%22%3A%225714%22%7D&isIframe=false&m=%7B%22description%22%3A%22Security%20without%20fear.%20The%20web%20doesn%E2%80%99t%20have%20to%20be%20dark.%20Decipher%E2%80%99s%20goal%20is%20to%20bring%20order%20to%20this%20unpredictable%20and%20often%20confusing%20landscape%20by%20providing%20fresh%20perspectives%20from%20trusted%20voices.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%20%7C%20Decipher%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&pageViewId=bf056438-fbd7-4e25-8727-381eeef4a1ad&an_uid=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-137-162.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Sun, 08 May 2022 20:32:28 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Sat, 05 Jun 2021 07:56:05 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "60bb2e15-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 412ms
412ms Image
image/gif 96.16.137.162
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=361da14e9cc9e3c3150a35780c1bec6b&svisitor=cfd5ce17b6240000d62878629e02000089013600&session=2688b65a-dab5-4fbb-8efe-0fe091674b14&event=active_time_track&q=%7B%22currentTime%22%3A%22Sun%2C%2008%20May%202022%2020%3A32%3A29%20GMT%22%2C%22lastTrackTime%22%3A%22Sun%2C%2008%20May%202022%2020%3A32%3A28%20GMT%22%2C%22timeSpent%22%3A%221005%22%2C%22totalTimeSpent%22%3A%226719%22%7D&isIframe=false&m=%7B%22description%22%3A%22Security%20without%20fear.%20The%20web%20doesn%E2%80%99t%20have%20to%20be%20dark.%20Decipher%E2%80%99s%20goal%20is%20to%20bring%20order%20to%20this%20unpredictable%20and%20often%20confusing%20landscape%20by%20providing%20fresh%20perspectives%20from%20trusted%20voices.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%20%7C%20Decipher%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&pageViewId=bf056438-fbd7-4e25-8727-381eeef4a1ad&an_uid=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-137-162.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Sun, 08 May 2022 20:32:29 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Fri, 21 Feb 2020 18:57:20 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "5e502810-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 372ms
371ms Image
image/gif 96.16.137.162
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=361da14e9cc9e3c3150a35780c1bec6b&svisitor=cfd5ce17b6240000d62878629e02000089013600&session=2688b65a-dab5-4fbb-8efe-0fe091674b14&event=active_time_track&q=%7B%22currentTime%22%3A%22Sun%2C%2008%20May%202022%2020%3A32%3A30%20GMT%22%2C%22lastTrackTime%22%3A%22Sun%2C%2008%20May%202022%2020%3A32%3A29%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%227721%22%7D&isIframe=false&m=%7B%22description%22%3A%22Security%20without%20fear.%20The%20web%20doesn%E2%80%99t%20have%20to%20be%20dark.%20Decipher%E2%80%99s%20goal%20is%20to%20bring%20order%20to%20this%20unpredictable%20and%20often%20confusing%20landscape%20by%20providing%20fresh%20perspectives%20from%20trusted%20voices.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%20%7C%20Decipher%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&pageViewId=bf056438-fbd7-4e25-8727-381eeef4a1ad&an_uid=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-137-162.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Sun, 08 May 2022 20:32:30 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Sat, 05 Jun 2021 07:56:05 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "60bb2e15-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 353ms
352ms Image
image/gif 96.16.137.162
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=361da14e9cc9e3c3150a35780c1bec6b&svisitor=cfd5ce17b6240000d62878629e02000089013600&session=2688b65a-dab5-4fbb-8efe-0fe091674b14&event=active_time_track&q=%7B%22currentTime%22%3A%22Sun%2C%2008%20May%202022%2020%3A32%3A31%20GMT%22%2C%22lastTrackTime%22%3A%22Sun%2C%2008%20May%202022%2020%3A32%3A30%20GMT%22%2C%22timeSpent%22%3A%221005%22%2C%22totalTimeSpent%22%3A%228726%22%7D&isIframe=false&m=%7B%22description%22%3A%22Security%20without%20fear.%20The%20web%20doesn%E2%80%99t%20have%20to%20be%20dark.%20Decipher%E2%80%99s%20goal%20is%20to%20bring%20order%20to%20this%20unpredictable%20and%20often%20confusing%20landscape%20by%20providing%20fresh%20perspectives%20from%20trusted%20voices.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%20%7C%20Decipher%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&pageViewId=bf056438-fbd7-4e25-8727-381eeef4a1ad&an_uid=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-137-162.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Sun, 08 May 2022 20:32:31 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Sat, 05 Jun 2021 07:56:05 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "60bb2e15-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

POST
H2 204 collect
analytics.google.com/g/ 0
54 B 386ms
84ms Ping
text/plain 2a00:1450:4001:811::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://analytics.google.com/g/collect?v=2&tid=G-95Z7P6PE75&gtm=2oe540&_p=1311868780&_z=ccd.tbB&cid=602281868.1652041942&ul=en-us&sr=1600x1200&sid=1652041942&sct=1&seg=0&dl=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&dt=%7C%20Decipher&_s=2
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-95Z7P6PE75&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:4001:811::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://duo.com/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

pragma: no-cache
date: Sun, 08 May 2022 20:32:31 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://duo.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 317ms
316ms Image
image/gif 96.16.137.162
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=361da14e9cc9e3c3150a35780c1bec6b&svisitor=cfd5ce17b6240000d62878629e02000089013600&session=2688b65a-dab5-4fbb-8efe-0fe091674b14&event=active_time_track&q=%7B%22currentTime%22%3A%22Sun%2C%2008%20May%202022%2020%3A32%3A32%20GMT%22%2C%22lastTrackTime%22%3A%22Sun%2C%2008%20May%202022%2020%3A32%3A31%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%229730%22%7D&isIframe=false&m=%7B%22description%22%3A%22Security%20without%20fear.%20The%20web%20doesn%E2%80%99t%20have%20to%20be%20dark.%20Decipher%E2%80%99s%20goal%20is%20to%20bring%20order%20to%20this%20unpredictable%20and%20often%20confusing%20landscape%20by%20providing%20fresh%20perspectives%20from%20trusted%20voices.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%20%7C%20Decipher%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&pageViewId=bf056438-fbd7-4e25-8727-381eeef4a1ad&an_uid=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-137-162.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Sun, 08 May 2022 20:32:32 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Fri, 21 Feb 2020 18:57:20 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "5e502810-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 333ms
332ms Image
image/gif 96.16.137.162
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=361da14e9cc9e3c3150a35780c1bec6b&svisitor=cfd5ce17b6240000d62878629e02000089013600&session=2688b65a-dab5-4fbb-8efe-0fe091674b14&event=active_time_track&q=%7B%22currentTime%22%3A%22Sun%2C%2008%20May%202022%2020%3A32%3A33%20GMT%22%2C%22lastTrackTime%22%3A%22Sun%2C%2008%20May%202022%2020%3A32%3A32%20GMT%22%2C%22timeSpent%22%3A%221005%22%2C%22totalTimeSpent%22%3A%2210735%22%7D&isIframe=false&m=%7B%22description%22%3A%22Security%20without%20fear.%20The%20web%20doesn%E2%80%99t%20have%20to%20be%20dark.%20Decipher%E2%80%99s%20goal%20is%20to%20bring%20order%20to%20this%20unpredictable%20and%20often%20confusing%20landscape%20by%20providing%20fresh%20perspectives%20from%20trusted%20voices.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%20%7C%20Decipher%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&pageViewId=bf056438-fbd7-4e25-8727-381eeef4a1ad&an_uid=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-137-162.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Sun, 08 May 2022 20:32:33 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Tue, 05 Oct 2021 22:17:52 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "615ccf10-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET
H/1.1 200
OK img.gif
b.6sc.co/v1/beacon/ 43 B
774 B 286ms
285ms Image
image/gif 96.16.137.162
AKAMAI-AS

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://b.6sc.co/v1/beacon/img.gif?token=361da14e9cc9e3c3150a35780c1bec6b&svisitor=cfd5ce17b6240000d62878629e02000089013600&session=2688b65a-dab5-4fbb-8efe-0fe091674b14&event=active_time_track&q=%7B%22currentTime%22%3A%22Sun%2C%2008%20May%202022%2020%3A32%3A34%20GMT%22%2C%22lastTrackTime%22%3A%22Sun%2C%2008%20May%202022%2020%3A32%3A33%20GMT%22%2C%22timeSpent%22%3A%221005%22%2C%22totalTimeSpent%22%3A%2211740%22%7D&isIframe=false&m=%7B%22description%22%3A%22Security%20without%20fear.%20The%20web%20doesn%E2%80%99t%20have%20to%20be%20dark.%20Decipher%E2%80%99s%20goal%20is%20to%20bring%20order%20to%20this%20unpredictable%20and%20often%20confusing%20landscape%20by%20providing%20fresh%20perspectives%20from%20trusted%20voices.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%20%7C%20Decipher%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&pageViewId=bf056438-fbd7-4e25-8727-381eeef4a1ad&an_uid=0

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_256_GCM

Server

96.16.137.162 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),

Reverse DNS

a96-16-137-162.deploy.static.akamaitechnologies.com

Software

nginx/1.14.0 (Ubuntu) /

Resource Hash

dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://duo.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.41 Safari/537.36

Response headers

Date: Sun, 08 May 2022 20:32:34 GMT
X-Content-Type-Options: nosniff
Connection: keep-alive
Content-Length: 43
Pragma: no-cache
Last-Modified: Sat, 05 Jun 2021 07:56:05 GMT
Server: nginx/1.14.0 (Ubuntu)
ETag: "60bb2e15-2b"
Access-Control-Max-Age: 86400
Access-Control-Allow-Methods: GET,POST
Content-Type: image/gif
Access-Control-Allow-Origin
Cache-Control: private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials: true
Accept-Ranges: bytes
Access-Control-Allow-Headers: *
Expires: Wed, 19 Apr 2000 11:43:00 GMT

GET img.gif
b.6sc.co/v1/beacon/ 0
0

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: b.6sc.co
URL: https://b.6sc.co/v1/beacon/img.gif?token=361da14e9cc9e3c3150a35780c1bec6b&svisitor=cfd5ce17b6240000d62878629e02000089013600&session=2688b65a-dab5-4fbb-8efe-0fe091674b14&event=active_time_track&q=%7B%22currentTime%22%3A%22Sun%2C%2008%20May%202022%2020%3A32%3A35%20GMT%22%2C%22lastTrackTime%22%3A%22Sun%2C%2008%20May%202022%2020%3A32%3A34%20GMT%22%2C%22timeSpent%22%3A%221005%22%2C%22totalTimeSpent%22%3A%2212745%22%7D&isIframe=false&m=%7B%22description%22%3A%22Security%20without%20fear.%20The%20web%20doesn%E2%80%99t%20have%20to%20be%20dark.%20Decipher%E2%80%99s%20goal%20is%20to%20bring%20order%20to%20this%20unpredictable%20and%20often%20confusing%20landscape%20by%20providing%20fresh%20perspectives%20from%20trusted%20voices.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%20%7C%20Decipher%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&pageViewId=bf056438-fbd7-4e25-8727-381eeef4a1ad&an_uid=0

Verdicts & Comments Add Verdict or Comment

363 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

60 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.duo.com/	1970-01-20 05:03:37	Name: _gcl_au Value: 1.1.247139702.1652041942
.bing.com/	1970-01-20 12:15:37	Name: MUID Value: 0A8B0D6411FA61393C061CFA102860C8
.duo.com/	1970-01-20 11:39:37	Name: _biz_uid Value: ce23af8d85ad4ac2a17788f34bb3bf16
.duo.com/	1970-01-20 02:54:03	Name: _biz_sid Value: 418ff9
.duo.com/	1970-01-20 20:25:13	Name: _ga Value: GA1.2.602281868.1652041942
.duo.com/	1970-01-20 02:55:28	Name: _gid Value: GA1.2.2110132185.1652041943
.duo.com/	1970-01-20 02:54:02	Name: _gat_UA-20141016-1 Value: 1
.duo.com/	1970-01-20 02:54:02	Name: _dc_gtm_UA-20141016-1 Value: 1
.duo.com/	1970-01-20 20:25:13	Name: _mkto_trk Value: id:074-UQX-410&token:_mch-duo.com-1652041942779-33174
.6sc.co/	1970-01-20 20:25:13	Name: 6suuid Value: cfd5ce17b6240000d62878629e02000089013600
.duo.com/	1970-01-20 02:55:28	Name: _uetsid Value: f73f34f0cf0d11ec803f3306584a1339
.duo.com/	1970-01-20 12:15:37	Name: _uetvid Value: f73f74f0cf0d11ec907d45cae3d9187d
.linkedin.com/	1970-01-20 03:37:13	Name: UserMatchHistory Value: AQJWXjk8QG_pJwAAAYClX4egyaXflCkpnkaC8_cVpi5haoP__T89OYHCOgl-s-XatLHx-TpMTnOQOQ
.linkedin.com/	1970-01-20 03:37:13	Name: AnalyticsSyncHistory Value: AQKt-kGz_qbrnwAAAYClX4egQQuASgA9fA0PrgxBAA7igj2tcUkKikEc08RQtJi51AfRZnTgqC3tYvxPlOiUkw
.ads.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=en-us
.linkedin.com/	1970-01-20 20:25:55	Name: bcookie Value: "v=2&7fca379f-ee7e-467f-8f5c-929085853259"
.linkedin.com/	1970-01-20 02:55:28	Name: lidc Value: "b=TGST04:s=T:r=T:a=T:p=T:g=2715:u=1:x=1:i=1652041942:t=1652128342:v=2:sig=AQHO8Oi0RTcXUbq_oI7pAZE60cy7Xvg6"
.bizible.com/	1970-01-20 11:39:37	Name: _BUID Value: ce23af8d85ad4ac2a17788f34bb3bf16
.bizibly.com/	1970-01-20 11:39:37	Name: _BUID Value: 197d01b857796a36f5fbd6ba8d54fdb2
.quantserve.com/	1970-01-20 12:24:16	Name: mc Value: 627828d7-63579-d518d-cd877
.duo.com/	1970-01-20 12:18:30	Name: __qca Value: P0-1820193584-1652041943291
.duo.com/	1970-01-20 11:39:37	Name: utag_main Value: v_id:0180a55f8929002053930d28f89803073004e06b00b08$_sn:1$_se:1$_ss:1$_st:1652043743338$ses_id:1652041943338%3Bexp-session$_pn:1%3Bexp-session$vapi_domain:duo.com$ctm_ss:true%3Bexp-session
.linkedin.com/	1969-12-31 23:59:59	Name: lang Value: v=2&lang=de-de
.www.linkedin.com/	1970-01-20 20:25:55	Name: bscookie Value: "v=1&2022050820322303f251a1-04fc-495a-8176-afe42dda25a0AQEipCBdU1b7a0kUFuV82RBcRXsidq7J"
.linkedin.com/	1970-01-20 20:16:30	Name: li_gc Value: MTswOzE2NTIwNDE5NDM7MjswMjFEugNU4DEtCVPsT2GvMHx6ELGOlhrw50J4ZvrUx2t6pw==
.duo.com/	1970-01-20 12:23:25	Name: _cs_c Value: 1
.duo.com/	1970-01-20 12:23:25	Name: _cs_id Value: cfa4349e-31aa-a474-e37b-c71df11502f3.1652041943.1.1652041943.1652041943.1627413105.1686205943625
.duo.com/	1970-01-20 02:54:03	Name: _cs_s Value: 1.0.0.1652043743627
.csxd.contentsquare.net/	1970-01-20 12:23:25	Name: _cs_id___5637 Value: cfa4349e-31aa-a474-e37b-c71df11502f3.1652041943.1.1652041943.1652041943.1627413105.1686205943625
.csxd.contentsquare.net/	1970-01-20 02:54:03	Name: _cs_s___5637 Value: 1.0.0.1652043743627
.duo.com/	1970-01-20 11:39:37	Name: _clck Value: e2m6m7\|1\|f1a\|0
.demdex.net/	1970-01-20 07:13:13	Name: demdex Value: 20290805446367153211044307389506204187
.duo.com/	1969-12-31 23:59:59	Name: AMCVS_B8D07FF4520E94C10A490D4C%40AdobeOrg Value: 1
.duo.com/	1970-01-20 02:54:03	Name: _cs_mk Value: 0.63390008822963_1652041943998
.duo.com/	1970-01-20 02:55:28	Name: _clsk Value: 11jg7z7\|1652041944096\|1\|1\|h.clarity.ms/collect
.duo.com/	1970-01-20 11:39:37	Name: _biz_nA Value: 3
.duo.com/	1970-01-20 11:39:37	Name: _biz_flagsA Value: %7B%22Version%22%3A1%2C%22Mkto%22%3A%221%22%2C%22ViewThrough%22%3A%221%22%2C%22XDomain%22%3A%221%22%2C%22Ecid%22%3A%22-772682872%22%7D
.duo.com/	1970-01-20 11:39:37	Name: _biz_pendingA Value: %5B%5D
.duo.com/	1970-01-20 02:54:03	Name: gpv_v9 Value: duo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2Fnaws
.duo.com/	1969-12-31 23:59:59	Name: s_cc Value: true
.duo.com/	1970-01-20 20:26:40	Name: AMCV_B8D07FF4520E94C10A490D4C%40AdobeOrg Value: 281789898%7CMCIDTS%7C19121%7CMCMID%7C15608206335044712240576381656895400858%7CMCAAMLH-1652646743%7C6%7CMCAAMB-1652646743%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1652049144s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C4.1.0
.duo.com/	1970-01-20 03:37:13	Name: aam_uuid Value: 20290805446367153211044307389506204187
.demdex.net/	1970-01-20 07:13:13	Name: dextp Value: 771-1-1652041944454\|1123-1-1652041944557\|30646-1-1652041944660\|66757-1-1652041944763
.duo.com/	1970-01-20 05:03:37	Name: _fbp Value: fb.1.1652041944799.2111369750
.twitter.com/	1970-01-20 20:25:13	Name: personalization_id Value: "v1_su4DXDOW46BpnObNqVkyoA=="
.doubleclick.net/	1970-01-20 12:15:37	Name: IDE Value: AHWqTUkfM4aVLlo6rbTEREdq2A-7TtDkPi_eyHYd5ozZ4avWT7TctFvyOFR4lYAqhzY
.yahoo.com/	1970-01-20 11:39:59	Name: A3 Value: d=AQABBNgoeGICEMOTTeQdKP70WxVdweoBuf4&S=AQAAAqBYukMPwjFxEXuyy9Vc4Hg
.dpm.demdex.net/	1970-01-20 07:13:13	Name: dpm Value: 20290805446367153211044307389506204187
.krxd.net/	1970-01-20 07:13:13	Name: _kuid_ Value: O02I2tQb
.facebook.com/	1970-01-20 05:03:37	Name: fr Value: 02WCvUZSm8K1UmnJD..BieCja...1.0.BieCja.
.duo.com/	1970-01-20 20:25:13	Name: _ga_95Z7P6PE75 Value: GS1.1.1652041942.1.0.1652041946.56
.duo.com/	1969-12-31 23:59:59	Name: s_ptc Value: 0%5E%5E0%5E%5E9%5E%5E224%5E%5E2154%5E%5E2%5E%5E5454%5E%5E6%5E%5E7856
duo.com/	1970-01-20 20:25:13	Name: _gd_visitor Value: 8d72d683-74b6-46df-80d7-2be98fa7bda3
duo.com/	1970-01-20 02:54:16	Name: _gd_session Value: 2688b65a-dab5-4fbb-8efe-0fe091674b14
duo.com/	1970-01-20 03:04:06	Name: _an_uid Value: 0
duo.com/	1970-01-20 20:25:13	Name: _gd_svisitor Value: cfd5ce17b6240000d62878629e02000089013600
.c.bing.com/	1970-01-20 12:15:37	Name: SRM_B Value: 0A8B0D6411FA61393C061CFA102860C8
.c.clarity.ms/	1969-12-31 23:59:59	Name: SM Value: C
.clarity.ms/	1970-01-20 12:15:37	Name: MUID Value: 0A8B0D6411FA61393C061CFA102860C8
.c.clarity.ms/	1970-01-20 02:54:02	Name: ANONCHK Value: 0

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
network	error	URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS Message: Failed to load resource: the server responded with a status of 404 ()
network	error	URL: https://duo.com/public/json-bodymovin/d-logo-light/data.json Message: Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

074-uqx-410.mktoresp.com
ajax.googleapis.com
analytics.google.com
analytics.twitter.com
b.6sc.co
bat.bing.com
beacon.krxd.net
c.6sc.co
c.bing.com
c.clarity.ms
c.contentsquare.net
cdn.bizible.com
cdn.bizibly.com
cisco-tags.cisco.com
cisco.demdex.net
cm.g.doubleclick.net
cms.analytics.yahoo.com
connect.facebook.net
csxd.contentsquare.net
dpm.demdex.net
duo.com
h.clarity.ms
ipv6.6sc.co
j.6sc.co
jscloud.net
metadata-static-files.sfo2.cdn.digitaloceanspaces.com
munchkin.marketo.net
pixel.quantserve.com
px.ads.linkedin.com
px4.ads.linkedin.com
rules.quantcount.com
secure.adnxs.com
secure.quantserve.com
smetrics.cisco.com
snap.licdn.com
stats.g.doubleclick.net
t.contentsquare.net
tags.tiqcdn.com
usermatch.krxd.net
www.cisco.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.linkedin.com
b.6sc.co
104.111.234.67
104.244.42.3
104.75.88.194
13.107.42.14
13.32.99.68
15.188.95.229
152.195.15.58
172.217.18.98
18.66.112.26
185.33.221.88
192.28.147.68
205.185.216.10
212.82.100.182
2600:9000:223c:8200:6:44e3:f8c0:93a1
2600:9000:2250:5e00:1b:ed91:4680:93a1
2606:4700:20::681a:527
2620:116:800d:21:3175:5196:e3fd:8c1d
2620:1ec:21::14
2620:1ec:c11::200
2a00:1450:4001:801::2004
2a00:1450:4001:801::200a
2a00:1450:4001:811::200e
2a00:1450:4001:813::2008
2a00:1450:4001:829::2003
2a00:1450:4001:82a::200e
2a00:1450:400c:c08::9a
2a02:26f0:3500:7::17d8:4dcd
2a02:26f0:6c00:288::b33
2a02:26f0:6c00:294::1c91
2a03:2880:f007:8:face:b00c:0:1
2a03:2880:f107:83:face:b00c:0:25de
34.248.131.147
52.142.114.2
52.16.172.200
52.19.61.87
52.213.194.249
52.224.31.34
54.166.21.101
72.163.10.10
96.16.137.162
0a998ab5472475c3418c7977b6214c566aad928094dceb86d2e9f53bdbdd26c0
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c
16c9dd6c54dfe7bd3ad953d44a2d5eb8169a34927b58c901e7c159bb1138138e
1d48d4cabc9c195baa08e42be70679688d706970ddd862bd91b857109d2a8874
22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5
27d6fba6ad31a91fa31d69869c76b901f4eab1b2d3daede85479097c04c605c0
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
3bd767b4869c1404fa4f7b0a592b991e1ee1bb7f920c9f4cd8558ecaec9a3779
43a4925fbcf490aaf0729b14e51d0ecb95d549d4faff22dacd6d6d0ab481a846
4adefd63c0816744b24f5f7c63c2ab245eb000b310fe05fb998cfccb98bad0cb
4b1589731cab3cc03fa56b6e91e496162499ae05dc2e5f0a685dca5b2bc646a8
4e60f5f99798802066cc24adce5b8f06a5bbb48238eb60aee2309a1139bdacd4
4f54a3e7c7c1db37da7024007f26706ae068cd15b86a408c6660ca4363925b15
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
56a1edc162b34c562e5c4512d470a1e2d6c1c919a1f8208feb2624e17ac2c8d6
645642cbfaa24dd60dcb8d4eb9f5ed68e845b7528c5cc8969f1e67149e754333
6733c75da005a9e5bcdf608a532666c2dfd12cb0d9a8753981a2e6bd8769ea9d
694b5d6220eb8a349b60ce749052c3b923c8449bbfb4ebfb68f4fc27f1b7e92b
6990ab63be215df2bb79078263c8ccb3d5b034682b8af9e2ff04fc3af4d040c3
6a1950ad21353f4dd382ed39e5205de0f61b1b65441b765f04eee31777657b69
6a6d2038fc6ca01db16d2c528375510be154e1214cc694a6332d85a798fb4711
726959cb48dcd73ec407fe30a403a4ff7cc80aaa792142cf068d116cba0c0771
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
8254f2577a38c005e4ccbdb175fc8ba7b70992c89580d832736983c937ac9e78
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
849b2ac11460487810a7132803d8680307e25126ba000a30b4775ed3e78201be
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8540c5e2d2e85cc6c5d46b1b06b7f6642dce39e0314299a08976cfe6053c7c52
8d6580af877387b05d9ffac3ebeacfe25a7728c77adef6d9b32fd72ccbe21468
8e038b564510a45dc11799f74da367733f3db7f9c0a0434f1e90c44ec5168278
96c5bfab045aceeb52ae2daa17605f436dd4ab9be43bbc87ac3debdbc9768ffb
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
a9b26df1158afa9371f427b2dfcca99e3c7a464795612e1dfdfbceee9d143603
aaddb9b9a1d45c5de508e64c3dace01f450e4a7521229e99f03838f5067cc8f9
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
b2021fe9b1f8b7e7bb44e57c5aed88f45cab8b7a0e84f39b7e472277361f1da5
b819b3ac2fe5857b7026a609f9115f0d50a7d6e8085ba5987d70ed6baaa41f4e
b96b64444f7d52c39b5716fe4d3e8d0433c67fb79731a4400188835d97b74bce
c2aee78040b4ed46c2377e6825db12a9691a2eb584adf338e77312c8978d8537
c33592c7a249c98164b3d533c58fae62ced2b403deab8f2d0cce4c4f1cbb285d
c72062a60866c674a25f2a5b5d8344e9509c7381a6472f2a484325ac14597ee8
ca092189a090471583f58a526922ba148b98e0b6bc661aba0406208835299492
ca63193ce799e4e00c9106349365981dc6e26cb77632ebf5df23dffba2aaccfa
cbda94666db24554bf77638fc059848d381c3c98f7f24641fa830abcd5793de7
d1a9abb0dc96d5a0fcc121a6de3a2c29c193a91d2f68939080e111b54d01d9e8
d504e13e96657fb2614683621745a4efc249d2b00d05af8261f5ce4c25a56bdb
d9218d98cd999ad151e3b5ff5e2d7021b93f1c806c49ffc1f60a3f476d64747e
da5d487f1fe8c4f5bba93bab0b071aed1249cf770ffdbc0144a86a4c2bae3c2c
dce1fd8dcc41fdb21dd9e4abc562d66ff781c30add42fa3c7b1f9e9ff97aeab4
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e8e74813d3382d7453da81f7037183bb926aa06ce68021ba6b55f01d20d0f205
e9f76eabead93f85fc4dc190dca4b1419dcd76b57b1c22649856b01d3ac2536e
ede067783c02098828dfe0bda385a9913ff79006eb2cd1a406bcc18e66cd7bad
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
ef4a91c804c8dc985882cb7e84978cfc6710269ae91ef5dca9f1d489ee662f78

duo.com Open in urlscan Pro 13.32.99.68 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

103 Requests

92 %HTTPS

45 %IPv6

30 Domains

46 Subdomains

37 IPs

7 Countries

1534 kBTransfer

4669 kBSize

60 Cookies

3 Outgoing links

Redirected requests

103 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Redirect headers

Request headers

Response headers

duo.com Open in urlscan Pro
13.32.99.68 Public Scan

Screenshot
Live screenshot

Full Image

103
Requests

92 %
HTTPS

45 %
IPv6

30
Domains

46
Subdomains

37
IPs

7
Countries

1534 kB
Transfer

4669 kB
Size

60
Cookies

103 HTTP transactions
0 data transactions