Submitted URL: https://click.email.sans.org/?qs=9f241915c68df8fae373b63603690bb7762de230761fd8067016efa13ec6f6528e61395f8590d7f845a4c2685b70...
Effective URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f...
Submission: On December 24 via api from AE — Scanned from US

Summary

This website contacted 69 IPs in 2 countries across 54 domains to perform 171 HTTP transactions. The main IP is 3.233.126.24, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is www.huntress.com. The Cisco Umbrella rank of the primary domain is 700540.
TLS certificate: Issued by R11 on November 4th 2024. Valid for: 3 months.
This is the only time www.huntress.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 1 136.147.189.155 14340 (SALESFORCE)
1 3.233.126.24 14618 (AMAZON-AES)
25 104.18.160.117 13335 (CLOUDFLAR...)
4 142.250.65.164 15169 (GOOGLE)
1 2607:f8b0:400... 15169 (GOOGLE)
1 151.101.193.91 54113 (FASTLY)
4 2a04:4e42:600... 54113 (FASTLY)
3 140.82.113.3 36459 (GITHUB)
5 2a04:4e42:600... 54113 (FASTLY)
1 13.33.251.183 16509 (AMAZON-02)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 151.101.67.52 54113 (FASTLY)
1 2607:f8b0:400... 15169 (GOOGLE)
4 2607:f8b0:400... 15169 (GOOGLE)
2 108.139.54.225 16509 (AMAZON-02)
1 185.199.111.154 54113 (FASTLY)
13 2600:1f18:24e... 14618 (AMAZON-AES)
6 2a04:4e42::644 54113 (FASTLY)
1 2606:4700:20:... 13335 (CLOUDFLAR...)
3 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
2 2606:4700::68... 13335 (CLOUDFLAR...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
3 2606:4700:440... 13335 (CLOUDFLAR...)
2 2600:141b:1c0... 20940 (AKAMAI-AS...)
2 2a04:4e42::396 54113 (FASTLY)
2 31.13.65.7 32934 (FACEBOOK)
12 23.200.88.71 20940 (AKAMAI-AS...)
1 13.33.252.127 16509 (AMAZON-02)
1 108.138.106.78 16509 (AMAZON-02)
1 2606:4700::68... 13335 (CLOUDFLAR...)
4 34.196.12.18 14618 (AMAZON-AES)
3 2620:1ec:33:1... 8075 (MICROSOFT...)
1 34.117.162.98 396982 (GOOGLE-CL...)
1 2606:4700::68... 13335 (CLOUDFLAR...)
1 146.75.36.157 54113 (FASTLY)
1 162.159.153.247 13335 (CLOUDFLAR...)
1 151.101.129.229 54113 (FASTLY)
1 2600:9000:21b... 16509 (AMAZON-02)
2 151.101.65.140 54113 (FASTLY)
1 2001:4860:480... 15169 (GOOGLE)
1 2607:f8b0:400... 15169 (GOOGLE)
1 2607:f8b0:400... 15169 (GOOGLE)
2 142.250.72.110 15169 (GOOGLE)
2 34.111.208.231 396982 (GOOGLE-CL...)
1 18.164.96.46 16509 (AMAZON-02)
1 44.198.96.243 14618 (AMAZON-AES)
1 54.145.131.117 14618 (AMAZON-AES)
2 2600:1901:1:7... 396982 (GOOGLE-CL...)
1 104.18.80.204 13335 (CLOUDFLAR...)
2 31.13.65.36 32934 (FACEBOOK)
1 104.19.175.188 13335 (CLOUDFLAR...)
1 172.66.0.227 13335 (CLOUDFLAR...)
1 104.244.42.195 13414 (TWITTER)
4 6 2620:1ec:21::14 8068 (MICROSOFT...)
1 13.107.42.14 8068 (MICROSOFT...)
1 68.67.181.103 29990 (ASN-APPNEX)
1 2600:141b:1c0... 20940 (AKAMAI-AS...)
1 18.238.55.7 16509 (AMAZON-02)
2 34.139.124.58 396982 (GOOGLE-CL...)
2 76.223.15.4 16509 (AMAZON-02)
3 172.64.150.44 13335 (CLOUDFLAR...)
3 2600:9000:266... 16509 (AMAZON-02)
1 13.225.63.24 16509 (AMAZON-02)
2 2a04:4e42:200... 54113 (FASTLY)
1 34.120.195.249 396982 (GOOGLE-CL...)
1 104.16.117.43 13335 (CLOUDFLAR...)
5 104.16.118.43 13335 (CLOUDFLAR...)
171 69
Apex Domain
Subdomains
Transfer
25 website-files.com
cdn.prod.website-files.com — Cisco Umbrella Rank: 6218
588 KB
13 6sc.co
j.6sc.co — Cisco Umbrella Rank: 5557
c.6sc.co — Cisco Umbrella Rank: 6739
ipv6.6sc.co — Cisco Umbrella Rank: 5633
b.6sc.co — Cisco Umbrella Rank: 3603
23 KB
13 browser-intake-datadoghq.com
browser-intake-datadoghq.com — Cisco Umbrella Rank: 542
2 KB
10 wistia.com
fast.wistia.com — Cisco Umbrella Rank: 4773
embed-ssl.wistia.com — Cisco Umbrella Rank: 9290
pipedream.wistia.com — Cisco Umbrella Rank: 8023
distillery.wistia.com — Cisco Umbrella Rank: 7932
283 KB
7 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 333
www.linkedin.com — Cisco Umbrella Rank: 676
px4.ads.linkedin.com — Cisco Umbrella Rank: 7032
5 KB
7 google.com
www.google.com — Cisco Umbrella Rank: 3
analytics.google.com — Cisco Umbrella Rank: 142
google.com — Cisco Umbrella Rank: 1
2 KB
6 zoominfo.com
ws-assets.zoominfo.com — Cisco Umbrella Rank: 11137
ws.zoominfo.com — Cisco Umbrella Rank: 4514
17 KB
6 wistia.net
fast.wistia.net — Cisco Umbrella Rank: 9224
179 KB
5 jsdelivr.net
cdn.jsdelivr.net — Cisco Umbrella Rank: 318
20 KB
4 stackadapt.com
tags.srv.stackadapt.com — Cisco Umbrella Rank: 2701
10 KB
4 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 39
356 KB
3 zi-scripts.com
js.zi-scripts.com — Cisco Umbrella Rank: 5643
4 KB
3 bing.com
bat.bing.com — Cisco Umbrella Rank: 359
15 KB
3 techtarget.com
trk.techtarget.com — Cisco Umbrella Rank: 27058
ibc-flow.techtarget.com — Cisco Umbrella Rank: 24542
2 KB
3 hs-banner.com
js.hs-banner.com — Cisco Umbrella Rank: 2343
19 KB
3 hubspot.com
js.hubspot.com — Cisco Umbrella Rank: 3653
cta-service-cms2.hubspot.com — Cisco Umbrella Rank: 3677
track.hubspot.com — Cisco Umbrella Rank: 2477
27 KB
3 github.com
gist.github.com — Cisco Umbrella Rank: 59767
21 KB
3 huntress.com
www.huntress.com — Cisco Umbrella Rank: 700540
t.huntress.com
43 KB
2 sentry-cdn.com
js.sentry-cdn.com — Cisco Umbrella Rank: 5415
browser.sentry-cdn.com — Cisco Umbrella Rank: 4270
31 KB
2 fivetran.com
webhooks.fivetran.com — Cisco Umbrella Rank: 121707
424 B
2 facebook.com
www.facebook.com — Cisco Umbrella Rank: 120
212 B
2 hsforms.com
perf-na1.hsforms.com — Cisco Umbrella Rank: 3819
forms.hsforms.com — Cisco Umbrella Rank: 4839
2 KB
2 spotify.com
pixels.spotify.com — Cisco Umbrella Rank: 3212
271 B
2 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 135
td.doubleclick.net — Cisco Umbrella Rank: 182
546 B
2 reddit.com
pixel-config.reddit.com — Cisco Umbrella Rank: 2010
alb.reddit.com — Cisco Umbrella Rank: 1418
761 B
2 neverbounce.com
cdn.neverbounce.com — Cisco Umbrella Rank: 64302
api.neverbounce.com — Cisco Umbrella Rank: 134401
29 KB
2 hotjar.com
static.hotjar.com — Cisco Umbrella Rank: 888
script.hotjar.com — Cisco Umbrella Rank: 1185
61 KB
2 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 192
77 KB
2 redditstatic.com
www.redditstatic.com — Cisco Umbrella Rank: 1095
13 KB
2 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 831
22 KB
2 hscollectedforms.net
js.hscollectedforms.net — Cisco Umbrella Rank: 4811
forms.hscollectedforms.net — Cisco Umbrella Rank: 4960
26 KB
2 datadoghq-browser-agent.com
www.datadoghq-browser-agent.com — Cisco Umbrella Rank: 1279
70 KB
1 sentry.io
o4505518331658240.ingest.us.sentry.io — Cisco Umbrella Rank: 76699
355 B
1 driftt.com
js.driftt.com — Cisco Umbrella Rank: 7118
60 KB
1 adnxs.com
secure.adnxs.com — Cisco Umbrella Rank: 495
702 B
1 twitter.com
analytics.twitter.com — Cisco Umbrella Rank: 991
724 B
1 t.co
t.co — Cisco Umbrella Rank: 904
627 B
1 g2.com
tracking-api.production.g2.com
1 ads-twitter.com
static.ads-twitter.com — Cisco Umbrella Rank: 1016
16 KB
1 g2crowd.com
tracking.g2crowd.com — Cisco Umbrella Rank: 8407
2 KB
1 byspotify.com
pixel.byspotify.com — Cisco Umbrella Rank: 6998
24 KB
1 quora.com
a.quora.com Failed
q.quora.com — Cisco Umbrella Rank: 5280
306 B
1 hsleadflows.net
js.hsleadflows.net — Cisco Umbrella Rank: 5955
92 KB
1 hs-analytics.net
js.hs-analytics.net — Cisco Umbrella Rank: 2358
25 KB
1 hsadspixel.net
js.hsadspixel.net — Cisco Umbrella Rank: 3341
4 KB
1 huntresscdn.com
static.huntresscdn.com — Cisco Umbrella Rank: 569561
27 KB
1 githubassets.com
github.githubassets.com — Cisco Umbrella Rank: 9764
13 KB
1 gstatic.com
www.gstatic.com
216 KB
1 refokus.com
tools.refokus.com — Cisco Umbrella Rank: 47997
1 KB
1 hs-scripts.com
js.hs-scripts.com — Cisco Umbrella Rank: 2580
1 KB
1 cloudfront.net
d3e54v103j8qbb.cloudfront.net
30 KB
1 mutinycdn.com
client-registry.mutinycdn.com — Cisco Umbrella Rank: 18070
20 KB
1 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 415
30 KB
1 sans.org
click.email.sans.org — Cisco Umbrella Rank: 433722
350 B
171 54
Domain Requested by
25 cdn.prod.website-files.com www.huntress.com
cdn.prod.website-files.com
13 browser-intake-datadoghq.com www.datadoghq-browser-agent.com
9 b.6sc.co www.huntress.com
6 fast.wistia.net www.datadoghq-browser-agent.com
fast.wistia.com
5 ws.zoominfo.com www.datadoghq-browser-agent.com
5 px.ads.linkedin.com 3 redirects www.datadoghq-browser-agent.com
5 fast.wistia.com www.huntress.com
fast.wistia.com
www.datadoghq-browser-agent.com
5 cdn.jsdelivr.net www.huntress.com
static.huntresscdn.com
4 tags.srv.stackadapt.com www.huntress.com
tags.srv.stackadapt.com
www.datadoghq-browser-agent.com
4 www.googletagmanager.com www.huntress.com
www.googletagmanager.com
4 www.google.com www.huntress.com
www.googletagmanager.com
www.gstatic.com
3 pipedream.wistia.com www.datadoghq-browser-agent.com
3 js.zi-scripts.com www.huntress.com
www.datadoghq-browser-agent.com
3 bat.bing.com www.huntress.com
bat.bing.com
3 js.hs-banner.com js.hs-scripts.com
www.datadoghq-browser-agent.com
3 gist.github.com www.huntress.com
2 t.huntress.com www.datadoghq-browser-agent.com
2 webhooks.fivetran.com www.datadoghq-browser-agent.com
2 www.facebook.com www.huntress.com
2 pixels.spotify.com www.datadoghq-browser-agent.com
2 ibc-flow.techtarget.com www.datadoghq-browser-agent.com
2 google.com www.googletagmanager.com
2 j.6sc.co www.googletagmanager.com
j.6sc.co
2 connect.facebook.net www.huntress.com
connect.facebook.net
2 www.redditstatic.com www.googletagmanager.com
www.datadoghq-browser-agent.com
2 snap.licdn.com www.googletagmanager.com
snap.licdn.com
2 www.datadoghq-browser-agent.com www.huntress.com
1 ws-assets.zoominfo.com js.zi-scripts.com
1 o4505518331658240.ingest.us.sentry.io
1 browser.sentry-cdn.com js.sentry-cdn.com
1 js.sentry-cdn.com fast.wistia.com
1 distillery.wistia.com www.datadoghq-browser-agent.com
1 track.hubspot.com
1 js.driftt.com www.huntress.com
1 ipv6.6sc.co www.datadoghq-browser-agent.com
1 c.6sc.co www.datadoghq-browser-agent.com
1 secure.adnxs.com www.datadoghq-browser-agent.com
1 px4.ads.linkedin.com www.huntress.com
1 www.linkedin.com 1 redirects
1 analytics.twitter.com www.huntress.com
1 t.co www.huntress.com
1 forms.hsforms.com www.huntress.com
1 perf-na1.hsforms.com www.huntress.com
1 tracking-api.production.g2.com tracking.g2crowd.com
1 api.neverbounce.com cdn.neverbounce.com
1 script.hotjar.com static.hotjar.com
1 forms.hscollectedforms.net www.datadoghq-browser-agent.com
1 td.doubleclick.net www.googletagmanager.com
1 stats.g.doubleclick.net www.googletagmanager.com
1 analytics.google.com www.datadoghq-browser-agent.com
1 alb.reddit.com www.huntress.com
1 pixel-config.reddit.com www.datadoghq-browser-agent.com
1 cta-service-cms2.hubspot.com www.datadoghq-browser-agent.com
1 embed-ssl.wistia.com www.huntress.com
1 q.quora.com www.huntress.com
1 static.ads-twitter.com www.huntress.com
1 tracking.g2crowd.com www.huntress.com
1 pixel.byspotify.com www.huntress.com
1 trk.techtarget.com www.huntress.com
1 cdn.neverbounce.com www.googletagmanager.com
1 static.hotjar.com www.huntress.com
1 js.hsleadflows.net js.hs-scripts.com
1 js.hscollectedforms.net js.hs-scripts.com
1 js.hs-analytics.net js.hs-scripts.com
1 js.hsadspixel.net js.hs-scripts.com
1 js.hubspot.com js.hs-scripts.com
1 static.huntresscdn.com www.huntress.com
1 github.githubassets.com gist.github.com
1 www.gstatic.com www.google.com
1 tools.refokus.com www.huntress.com
1 js.hs-scripts.com www.huntress.com
1 d3e54v103j8qbb.cloudfront.net www.huntress.com
1 client-registry.mutinycdn.com www.huntress.com
1 ajax.googleapis.com www.huntress.com
1 www.huntress.com
1 click.email.sans.org 1 redirects
0 a.quora.com Failed www.googletagmanager.com
171 77
Subject Issuer Validity Valid
www.huntress.com
R11
2024-11-04 -
2025-02-02
3 months crt.sh
prod.website-files.com
WE1
2024-12-19 -
2025-03-19
3 months crt.sh
*.google.com
WR2
2024-12-02 -
2025-02-24
3 months crt.sh
upload.video.google.com
WR2
2024-12-02 -
2025-02-24
3 months crt.sh
client-registry.mutinycdn.com
GlobalSign Atlas R3 DV TLS CA 2024 Q1
2024-03-06 -
2025-04-07
a year crt.sh
jsdelivr.net
GlobalSign Atlas R3 DV TLS CA 2024 Q3
2024-07-30 -
2025-08-31
a year crt.sh
*.github.com
Sectigo ECC Domain Validation Secure Server CA
2024-03-07 -
2025-03-07
a year crt.sh
fast.wistia.com
GlobalSign Atlas R3 DV TLS CA 2024 Q1
2024-04-04 -
2025-05-06
a year crt.sh
*.cloudfront.net
Amazon RSA 2048 M01
2024-07-30 -
2025-07-03
a year crt.sh
hs-scripts.com
WE1
2024-11-24 -
2025-02-22
3 months crt.sh
tools.refokus.com
R10
2024-11-08 -
2025-02-06
3 months crt.sh
*.gstatic.com
WR2
2024-12-02 -
2025-02-24
3 months crt.sh
*.google-analytics.com
WR2
2024-12-02 -
2025-02-24
3 months crt.sh
*.datadoghq-browser-agent.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2024-07-30 -
2025-08-03
a year crt.sh
*.githubassets.com
Sectigo RSA Domain Validation Secure Server CA
2024-09-24 -
2025-09-24
a year crt.sh
*.browser-intake-datadoghq.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2024-05-14 -
2025-05-17
a year crt.sh
fast.wistia.net
GlobalSign Atlas R3 DV TLS CA 2024 Q1
2024-04-04 -
2025-05-06
a year crt.sh
static.huntresscdn.com
WE1
2024-11-11 -
2025-02-09
3 months crt.sh
hubspot.com
WE1
2024-12-01 -
2025-03-01
3 months crt.sh
hsadspixel.net
WE1
2024-12-08 -
2025-03-08
3 months crt.sh
hs-analytics.net
WE1
2024-12-05 -
2025-03-05
3 months crt.sh
hscollectedforms.net
WE1
2024-11-20 -
2025-02-18
3 months crt.sh
hsleadflows.net
WE1
2024-11-27 -
2025-02-25
3 months crt.sh
hs-banner.com
WE1
2024-11-22 -
2025-02-20
3 months crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA
2024-12-02 -
2025-12-01
a year crt.sh
www.redditstatic.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2024-10-06 -
2025-04-03
6 months crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2024-10-02 -
2024-12-31
3 months crt.sh
6sc.co
R11
2024-12-20 -
2025-03-20
3 months crt.sh
*.hotjar.com
Amazon RSA 2048 M03
2024-05-22 -
2025-06-20
a year crt.sh
neverbounce.com
Amazon RSA 2048 M03
2024-01-29 -
2025-02-25
a year crt.sh
trk.techtarget.com
WE1
2024-11-18 -
2025-02-16
3 months crt.sh
*.srv.stackadapt.com
Amazon RSA 2048 M03
2024-08-09 -
2025-09-06
a year crt.sh
www.bing.com
Microsoft Azure RSA TLS Issuing CA 08
2024-12-15 -
2025-06-13
6 months crt.sh
pixel.byspotify.com
WR3
2024-12-12 -
2025-03-12
3 months crt.sh
g2crowd.com
WE1
2024-12-17 -
2025-03-17
3 months crt.sh
ads-twitter.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2024-06-25 -
2025-06-24
a year crt.sh
quora.com
WR1
2024-12-13 -
2025-03-13
3 months crt.sh
*.wistia.com
Amazon RSA 2048 M02
2024-11-30 -
2025-12-28
a year crt.sh
*.reddit.com
DigiCert TLS RSA SHA256 2020 CA1
2024-10-13 -
2025-04-11
6 months crt.sh
*.g.doubleclick.net
WR2
2024-12-02 -
2025-02-24
3 months crt.sh
*.doubleclick.net
WR2
2024-12-02 -
2025-02-24
3 months crt.sh
ibc-flow.techtarget.com
WR3
2024-12-20 -
2025-03-20
3 months crt.sh
production.g2.com
Amazon RSA 2048 M03
2024-04-10 -
2025-05-09
a year crt.sh
*.spotify.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2024-02-05 -
2025-02-04
a year crt.sh
hsforms.com
WE1
2024-12-08 -
2025-03-08
3 months crt.sh
t.co
E6
2024-11-26 -
2025-02-24
3 months crt.sh
*.twitter.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2024-10-07 -
2025-10-06
a year crt.sh
www.linkedin.com
DigiCert SHA2 Secure Server CA
2024-10-14 -
2025-04-14
6 months crt.sh
*.adnxs.com
GeoTrust ECC CA 2018
2024-02-14 -
2025-03-16
a year crt.sh
drift.com
Amazon RSA 2048 M03
2024-07-30 -
2025-08-27
a year crt.sh
webhooks.fivetran.com
R10
2024-11-22 -
2025-02-20
3 months crt.sh
t.huntress.com
Amazon RSA 2048 M03
2024-09-16 -
2025-10-15
a year crt.sh
zi-scripts.com
WE1
2024-11-20 -
2025-02-18
3 months crt.sh
pipedream-production-cloudfront-app-cname.wistia.com
Amazon RSA 2048 M03
2024-08-11 -
2025-09-09
a year crt.sh
stats-tap-production-cloudfront-app-cname.wistia.com
Amazon RSA 2048 M02
2024-08-13 -
2025-09-11
a year crt.sh
*.sentry-cdn.com
GlobalSign Atlas R3 DV TLS CA 2024 Q2
2024-06-04 -
2025-07-06
a year crt.sh
ingest.sentry.io
DigiCert Global G2 TLS RSA SHA256 2020 CA1
2024-10-03 -
2025-07-29
10 months crt.sh
zoominfo.com
E5
2024-12-10 -
2025-03-10
3 months crt.sh

This page contains 5 frames:

Primary Page: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Frame ID: C1F880B254E722EF2E5D05363E6A2A7A
Requests: 158 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LchEywUAAAAAAdAXlscEm7Kcb3DJ38pngRCQJsC&co=aHR0cHM6Ly93d3cuaHVudHJlc3MuY29tOjQ0Mw..&hl=en&v=zIriijn3uj5Vpknvt_LnfNbF&theme=dark&size=normal&cb=in7wa7ba5h6y
Frame ID: 7AFA5151C69C1C58712528C9439CC562
Requests: 1 HTTP requests in this frame

Frame: https://www.googletagmanager.com/static/service_worker/4cc0/sw_iframe.html?origin=https%3A%2F%2Fwww.huntress.com
Frame ID: 473DC9A708806C336B84AA1050BDA42A
Requests: 1 HTTP requests in this frame

Frame: https://td.doubleclick.net/td/ga/rul?tid=G-GCTMBVFESS&gacid=1059849745.1735027601&gtm=45je4cc1v9122196611z89171248136za200zb9171248136&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101925629~102067555~102067808~102081485~102198178&z=1766909564
Frame ID: 16386AD71E39E7D8F980868A82186FE4
Requests: 1 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/api2/bframe?hl=en&v=zIriijn3uj5Vpknvt_LnfNbF&k=6LchEywUAAAAAAdAXlscEm7Kcb3DJ38pngRCQJsC
Frame ID: 9801900021ADC958415B1D2E6F56887C
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

Cleo Software Actively Being Exploited in the Wild CVE-2024-55956 | Huntress

Page URL History Show full URLs

  1. https://click.email.sans.org/?qs=9f241915c68df8fae373b63603690bb7762de230761fd8067016efa13ec6f6528e61395f... HTTP 302
    https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-th... Page URL

Detected technologies

Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)

Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Overall confidence: 100%
Detected patterns

Overall confidence: 100%
Detected patterns
  • <!-- (?:End )?Google Tag Manager -->
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js

Overall confidence: 100%
Detected patterns
  • //static\.hotjar\.com/

Overall confidence: 100%
Detected patterns
  • js\.hs-analytics\.net/analytics

Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Overall confidence: 100%
Detected patterns
  • (?:/([\d.]+))?/slick(?:\.min)?\.js

Overall confidence: 100%
Detected patterns
  • jquery[.-]([\d.]*\d)[^/]*\.js
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Overall confidence: 100%
Detected patterns
  • <link [^>]*?href="?[a-zA-Z]*?:?//cdn\.jsdelivr\.net/
  • //cdn\.jsdelivr\.net/

Overall confidence: 100%
Detected patterns
  • /recaptcha/api\.js

Page Statistics

171
Requests

96 %
HTTPS

42 %
IPv6

54
Domains

77
Subdomains

69
IPs

2
Countries

2511 kB
Transfer

8651 kB
Size

54
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. https://click.email.sans.org/?qs=9f241915c68df8fae373b63603690bb7762de230761fd8067016efa13ec6f6528e61395f8590d7f845a4c2685b70a3a486d9541ad5d47ea8 HTTP 302
    https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 115
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3281745&time=1735027601496&li_adsId=08578903-bc56-47ea-9361-2cd7bd12ad53&url=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fthreat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild%3Fis%3D3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2 HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3281745&time=1735027601496&li_adsId=08578903-bc56-47ea-9361-2cd7bd12ad53&url=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fthreat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild%3Fis%3D3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2&cookiesTest=true HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D3281745%26time%3D1735027601496%26li_adsId%3D08578903-bc56-47ea-9361-2cd7bd12ad53%26url%3Dhttps%253A%252F%252Fwww.huntress.com%252Fblog%252Fthreat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild%253Fis%253D3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3281745&time=1735027601496&li_adsId=08578903-bc56-47ea-9361-2cd7bd12ad53&url=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fthreat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild%3Fis%3D3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2&cookiesTest=true&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3281745&time=1735027601496&li_adsId=08578903-bc56-47ea-9361-2cd7bd12ad53&url=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fthreat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild%3Fis%3D3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2&cookiesTest=true&liSync=true&e_ipv6=AQIxi7AZKSxDsgAAAZP3tDNFfsut0viR8MMU-IsICcU3zSvWhcb653nr3EIM9bkNAQVV8Q

171 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild
www.huntress.com/blog/
Redirect Chain
  • https://click.email.sans.org/?qs=9f241915c68df8fae373b63603690bb7762de230761fd8067016efa13ec6f6528e61395f8590d7f845a4c2685b70a3a486d9541ad5d47ea8
  • https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
175 KB
43 KB
Document
General
Full URL
https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
3.233.126.24 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-3-233-126-24.compute-1.amazonaws.com
Software
/
Resource Hash
c821dd2f8d12eab5b584ed29a4075008d8defc15fc1090e59841330b9d8d10bd
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://hub.huntress.com https://huntress-new.webflow.io https://huntress.seismic.com;

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
MISS
cf-ray
8f6f17d0acf20821-IAD
content-encoding
gzip
content-security-policy
frame-ancestors 'self' https://hub.huntress.com https://huntress-new.webflow.io https://huntress.seismic.com;
content-type
text/html
date
Tue, 24 Dec 2024 08:06:39 GMT
last-modified
Tue, 24 Dec 2024 08:06:39 GMT
surrogate-control
max-age=432000
surrogate-key
www.huntress.com 6579dd0b5f9a54376d296915 pageId:65f3299e49a461b4b9c729ba 65f3299e49a461b4b9c728ba 66032c12697f973ea37e7e57 65f3299e49a461b4b9c728b8 65f3299e49a461b4b9c728ba
vary
Accept-Encoding
x-cluster-name
us-east-1-prod-hosting-red
x-lambda-id
353a3f97-ae35-41aa-88c6-f6e091b2987d

Redirect headers

Cache-Control
private
Connection
close
Content-Length
292
Content-Type
text/html; charset=utf-8
Date
Tue, 24 Dec 2024 08:06:35 GMT
Location
https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
huntress-new.48a4fcf31.min.css
cdn.prod.website-files.com/6579dd0b5f9a54376d296915/css/
583 KB
95 KB
Stylesheet
General
Full URL
https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.48a4fcf31.min.css
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f05c5f2c71c87a8fa8887410fd3cf4a32009caad461e0ac26f8f7190fd123d9e

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

content-encoding
gzip
cf-cache-status
HIT
etag
"41e2134f14592f4c91092ff88798a479"
x-amz-version-id
3Oh7XRZRzHM4Q_a6QjWXRyElXoj0kkhe
age
378773
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Tue, 24 Dec 2024 08:06:39 GMT
content-type
text/css
last-modified
Thu, 19 Dec 2024 22:31:46 GMT
vary
Accept-Encoding
priority
u=0,i=?0
x-amz-id-2
25F0YUIgFir8kZe8bH+AQ0P6hymqYGde+Ta/FICf7ARMjuSW3RkOHiAzB7VTXtChjTUhB1T7JQM=
cache-control
public, max-age=31536000, immutable
x-amz-request-id
RZJ02CFNQH06MD5J
cf-ray
8f6f17e3baca9abf-MIA
accept-ranges
bytes
access-control-allow-origin
*
content-length
96762
server
cloudflare
x-amz-server-side-encryption
AES256
api.js
www.google.com/recaptcha/
1 KB
968 B
Script
General
Full URL
https://www.google.com/recaptcha/api.js
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.65.164 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s71-in-f4.1e100.net
Software
ESF /
Resource Hash
652e8677aec33767d2a5f229384f79b4f526104bf7e94d7d258070f94743c3cc
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

cache-control
private, max-age=300
content-encoding
gzip
cross-origin-resource-policy
cross-origin
report-to
{"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
x-content-type-options
nosniff
expires
Tue, 24 Dec 2024 08:06:40 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cross-origin-opener-policy-report-only
same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
date
Tue, 24 Dec 2024 08:06:40 GMT
x-xss-protection
0
content-type
text/javascript; charset=utf-8
server
ESF
x-frame-options
SAMEORIGIN
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/3.7.1/
85 KB
30 KB
Script
General
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/3.7.1/jquery.min.js
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:81d::200a , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

content-encoding
gzip
age
329444
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
x-content-type-options
nosniff
expires
Sat, 20 Dec 2025 12:35:56 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Fri, 20 Dec 2024 12:35:56 GMT
last-modified
Tue, 12 Sep 2023 02:38:22 GMT
content-type
text/javascript; charset=UTF-8
vary
Accept-Encoding
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
accept-ranges
bytes
access-control-allow-origin
*
content-length
30462
x-xss-protection
0
server
sffe
c9c27905c1e445d6.js
client-registry.mutinycdn.com/personalize/client/
61 KB
20 KB
Script
General
Full URL
https://client-registry.mutinycdn.com/personalize/client/c9c27905c1e445d6.js
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.193.91 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
8d2f56691b3acbcde12b8d7f58a1130f0637a6e72dcb760aebaca0ff939db146

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

access-control-max-age
3000
content-encoding
gzip
etag
"14c6ac4b67da6adb5f7ba5ed560c9a25"
x-amz-version-id
LNW4DiAlqDZtq1T6lqjM_5IxwFk.aDh.
age
2572
access-control-allow-methods
GET, HEAD
x-cache
HIT
x-country-code
US
date
Tue, 24 Dec 2024 08:06:39 GMT
last-modified
Sun, 15 Dec 2024 19:46:03 GMT
content-type
application/javascript
x-served-by
cache-mia-kmia1760070-MIA
x-cache-hits
0
x-amz-id-2
EKGKL/Yo+U4ZCDc5BjaH4PjOjF4QIahLI6KmjpcVkYAYoxozm2zpK59dEA8ADJj3wt+nhw7pJ9M=
x-edge-datacenter
MIA
vary
X-Continent-Code, Accept-Encoding
cache-control
s-maxage=3600, max-age=0
x-continent-code
NA
x-connection-speed
broadband
via
1.1 varnish
x-amz-request-id
V02DGHT3BA1V56P3
accept-ranges
bytes
access-control-allow-origin
*
content-length
19757
x-edge-region
US-East
server
AmazonS3
x-amz-server-side-encryption
AES256
slick.min.css
cdn.jsdelivr.net/npm/slick-carousel@1.8.1/slick/
2 KB
1 KB
Stylesheet
General
Full URL
https://cdn.jsdelivr.net/npm/slick-carousel@1.8.1/slick/slick.min.css
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
ce54d767f01eb9114389e6ef95a27fe04211a98a4a7a0a4a6a56cb9274656e63
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

access-control-expose-headers
*
content-encoding
br
etag
W/"684-GF2HLIFihozHz5lQusuuoPZJs88"
age
2935043
x-content-type-options
nosniff
x-jsd-version-type
version
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache
HIT, HIT
date
Tue, 24 Dec 2024 08:06:39 GMT
content-type
text/css; charset=utf-8
x-served-by
cache-fra-eddf8230064-FRA, cache-mia-kmia1760069-MIA
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
content-length
619
x-jsd-version
1.8.1
richtext.js
cdn.jsdelivr.net/npm/@finsweet/attributes-richtext@1/
8 KB
4 KB
Script
General
Full URL
https://cdn.jsdelivr.net/npm/@finsweet/attributes-richtext@1/richtext.js
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
2c699eb55ae3fe61b3d783c8936ab1eb949c596a5c89118f703e328ede2b8308
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

access-control-expose-headers
*
content-encoding
br
etag
W/"2147-I41v+oq443LPQB6aPqMil27q9QY"
age
23594
x-content-type-options
nosniff
x-jsd-version-type
version
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache
HIT, HIT
date
Tue, 24 Dec 2024 08:06:40 GMT
content-type
application/javascript; charset=utf-8
x-served-by
cache-fra-eddf8230147-FRA, cache-mia-kmia1760069-MIA
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=604800, s-maxage=43200
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
content-length
3918
x-jsd-version
1.10.2
65f75020c99f25928927347f_banner-blue-halo.webp
cdn.prod.website-files.com/6579dd0b5f9a54376d296915/
23 KB
23 KB
Image
General
Full URL
https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/65f75020c99f25928927347f_banner-blue-halo.webp
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
889e4055351e629718cc9647a7f696cb4fb1e246bcf29bd25e2f8ce5105c27b5

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

cf-cache-status
HIT
etag
"cd3521a7574865352fcc31cd4d968864"
x-amz-version-id
VQxidV2D7M0v1MjkNARxPZzB4FkcrZg4
age
1148165
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Tue, 24 Dec 2024 08:06:39 GMT
content-type
image/webp
last-modified
Sun, 17 Mar 2024 20:18:41 GMT
vary
Accept-Encoding
priority
u=2,i
x-amz-id-2
6nOLN9fPKn5WApIjWTGxA0II0imTqOFbkh/qlkcSHCy4ypqnSoYoEKyOUT2RxN45YNKNtiN4lB2JBFyyDdJltPxd94ucOAFQ/reJqDrTJ/c=
cache-control
max-age=31536000, must-revalidate
x-amz-request-id
7NQQ5K1HCY8DAKTD
cf-ray
8f6f17e3bacc9abf-MIA
accept-ranges
bytes
access-control-allow-origin
*
content-length
23574
server
cloudflare
x-amz-server-side-encryption
AES256
66267cd1946bdc414612a045_banner-blue-halo-mobile.webp
cdn.prod.website-files.com/6579dd0b5f9a54376d296915/
11 KB
11 KB
Image
General
Full URL
https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/66267cd1946bdc414612a045_banner-blue-halo-mobile.webp
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
640d525f0c6d09a6cdc4c6f6b0d44c4d2d92ce5e35ae1a945ccac5da67071f9d

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

cf-cache-status
HIT
etag
"308d32f3c0dd65a14316ec46469ba463"
x-amz-version-id
5.DnT5LYsjXZnxPaoCXpF7pRsl7yIEO1
age
1148165
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Tue, 24 Dec 2024 08:06:39 GMT
content-type
image/webp
last-modified
Mon, 22 Apr 2024 15:05:55 GMT
vary
Accept-Encoding
priority
u=2,i
x-amz-id-2
0yzG+Qua0U4RB2oM2Wg2/aRjWmnVDOXHqjbgGpHhVTQtbRQP1/lz8BcqYh/JkBLBOMErTfOvFwlhBdwUm+uXHNZEQzgWfLH6h64kWk1GzNk=
cache-control
max-age=31536000, must-revalidate
x-amz-request-id
7NQGSVFEKNJ83RBK
cf-ray
8f6f17e3bacf9abf-MIA
accept-ranges
bytes
access-control-allow-origin
*
content-length
11112
server
cloudflare
x-amz-server-side-encryption
AES256
655d92689c415e9fefcf2400_Hero-grapic-right-02.png
cdn.prod.website-files.com/655d92689c415e9fefcf2368/
5 KB
5 KB
Image
General
Full URL
https://cdn.prod.website-files.com/655d92689c415e9fefcf2368/655d92689c415e9fefcf2400_Hero-grapic-right-02.png
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a1e79865576e220b93dfe34d011286a8335ee8ac4eb6450300fb45a4f15a600e

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

cf-cache-status
HIT
etag
"d360d7cfb07b3fdc3fbc56204caa4c06"
x-amz-version-id
ds4He9jpqLhVudpNkauPNw12aaYIjxRr
age
1148073
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Tue, 24 Dec 2024 08:06:40 GMT
content-type
image/png
last-modified
Wed, 22 Nov 2023 05:32:26 GMT
vary
Accept-Encoding
priority
u=2,i
x-amz-id-2
14Clh6tOUpYS5EiYfbNM1WmJSaSO5rQ0FTpAopkhuD3RTVNMQ9XWzcHFbhYLsr/egUif2qek1xE=
cache-control
max-age=31536000, must-revalidate
x-amz-request-id
F7P0ZEQSW33E4Y9Z
cf-ray
8f6f17e4bc609abf-MIA
accept-ranges
bytes
access-control-allow-origin
*
content-length
5002
server
cloudflare
x-amz-server-side-encryption
AES256
6579dd0b5f9a54376d296a87_Blog%20detail%20Banner%20Glitch%20Left%20Bottom.webp
cdn.prod.website-files.com/6579dd0b5f9a54376d296915/
7 KB
7 KB
Image
General
Full URL
https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a87_Blog%20detail%20Banner%20Glitch%20Left%20Bottom.webp
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6f3642cd8faa981a6b7f71cb0bd88a222ed7c92510100761c38f4bfd689853f2

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

cf-cache-status
HIT
etag
"2deea30793899f56a236f1ba505155ab"
x-amz-version-id
.9LTfep43eO88TqIHc3WnYAIb3vaJe3A
age
28370
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Tue, 24 Dec 2024 08:06:40 GMT
content-type
image/webp
last-modified
Thu, 21 Dec 2023 07:39:51 GMT
vary
Accept-Encoding
priority
u=2,i
x-amz-id-2
YAYCVMBIqEt/n6137rVkByqOxpu0Kair9amRooUXLVg9NiWvxVld3TAGBXfBd1jtMpVz65Y3HUs=
cache-control
max-age=84600, must-revalidate
x-amz-request-id
F7P5EA9QAT6KB5YA
cf-ray
8f6f17e4bc629abf-MIA
accept-ranges
bytes
access-control-allow-origin
*
content-length
6778
server
cloudflare
x-amz-server-side-encryption
AES256
6579dd0b5f9a54376d296a71_Blog%20banner%20Thumb%20Glitch%20Left.webp
cdn.prod.website-files.com/6579dd0b5f9a54376d296915/
2 KB
2 KB
Image
General
Full URL
https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a71_Blog%20banner%20Thumb%20Glitch%20Left.webp
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1402811141d6cf6956918acd3398468bd385081a50b90a5d251fe7a3312c0801

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

cf-cache-status
HIT
etag
"8a941746cf0b15b4b601f10dac732f1c"
x-amz-version-id
X1oARd.5yRkM1108eqnTnHXez5VJo2XZ
age
25273
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Tue, 24 Dec 2024 08:06:40 GMT
content-type
image/webp
last-modified
Thu, 21 Dec 2023 07:39:50 GMT
vary
Accept-Encoding
priority
u=2,i
x-amz-id-2
RVH2jEaLcnvGgsO6nF0MIDPUBeVBUeTtq756bZyVhqo3twpEg+wAE3Sk4RIjm7uolnrvIwaWiJ8=
cache-control
max-age=84600, must-revalidate
x-amz-request-id
F7PBNM5578A4H41T
cf-ray
8f6f17e50c939abf-MIA
accept-ranges
bytes
access-control-allow-origin
*
content-length
1996
server
cloudflare
x-amz-server-side-encryption
AES256
d918f0dae466df7eb9b57e608d9b26c0.js
gist.github.com/JohnHammond/
25 KB
7 KB
Script
General
Full URL
https://gist.github.com/JohnHammond/d918f0dae466df7eb9b57e608d9b26c0.js
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
140.82.113.3 , United States, ASN36459 (GITHUB, US),
Reverse DNS
lb-140-82-113-3-iad.github.com
Software
GitHub.com /
Resource Hash
bc8ab7e0b55fff2c3651c4d71964c7f9c46abf81ad2fbf64abeeab4084855718
Security Headers
Name Value
Content-Security-Policy default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/
Strict-Transport-Security max-age=31536000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

content-encoding
gzip
etag
W/"bc8ab7e0b55fff2c3651c4d71964c7f9"
x-content-type-options
nosniff
x-github-request-id
D29C:183D:FD9E99C:1675A58B:676A6B90
date
Tue, 24 Dec 2024 08:06:40 GMT
content-type
text/javascript; charset=utf-8
vary
X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
x-frame-options
deny
strict-transport-security
max-age=31536000; includeSubdomains; preload
content-security-policy
default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/
cache-control
max-age=0, private, must-revalidate
referrer-policy
origin-when-cross-origin, strict-origin-when-cross-origin
accept-ranges
bytes
content-length
2732
x-xss-protection
0
server
GitHub.com
77295e3fe3ea0cb1b8f38fb2e4f54924.js
gist.github.com/JohnHammond/
22 KB
7 KB
Script
General
Full URL
https://gist.github.com/JohnHammond/77295e3fe3ea0cb1b8f38fb2e4f54924.js
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
140.82.113.3 , United States, ASN36459 (GITHUB, US),
Reverse DNS
lb-140-82-113-3-iad.github.com
Software
GitHub.com /
Resource Hash
653267cc251288e709b21804225fe741c382fb14fe397e1005cb0b885083ba2e
Security Headers
Name Value
Content-Security-Policy default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/
Strict-Transport-Security max-age=31536000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

content-encoding
gzip
etag
W/"653267cc251288e709b21804225fe741"
x-content-type-options
nosniff
x-github-request-id
D29C:183D:FD9E99D:1675A58C:676A6B90
date
Tue, 24 Dec 2024 08:06:40 GMT
content-type
text/javascript; charset=utf-8
vary
X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
x-frame-options
deny
strict-transport-security
max-age=31536000; includeSubdomains; preload
content-security-policy
default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/
cache-control
max-age=0, private, must-revalidate
referrer-policy
origin-when-cross-origin, strict-origin-when-cross-origin
accept-ranges
bytes
content-length
2963
x-xss-protection
0
server
GitHub.com
06316b11bfa524c16ecd20962d75bb74.js
gist.github.com/JohnHammond/
16 KB
7 KB
Script
General
Full URL
https://gist.github.com/JohnHammond/06316b11bfa524c16ecd20962d75bb74.js
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
140.82.113.3 , United States, ASN36459 (GITHUB, US),
Reverse DNS
lb-140-82-113-3-iad.github.com
Software
GitHub.com /
Resource Hash
cd72aeb01656187cdb7dcb6e74fe11d38b23dc2a7bece84c723ad81ef56b581d
Security Headers
Name Value
Content-Security-Policy default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/
Strict-Transport-Security max-age=31536000; includeSubdomains; preload
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

content-encoding
gzip
etag
W/"cd72aeb01656187cdb7dcb6e74fe11d3"
x-content-type-options
nosniff
x-github-request-id
D29C:183D:FD9E99E:1675A58D:676A6B90
date
Tue, 24 Dec 2024 08:06:40 GMT
content-type
text/javascript; charset=utf-8
vary
X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With
x-frame-options
deny
strict-transport-security
max-age=31536000; includeSubdomains; preload
content-security-policy
default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.com raw.githubusercontent.com api.github.com github-cloud.s3.amazonaws.com github-production-repository-file-5c1aeb.s3.amazonaws.com github-production-upload-manifest-file-7fdce7.s3.amazonaws.com github-production-user-asset-6210df.s3.amazonaws.com *.rel.tunnels.api.visualstudio.com wss://*.rel.tunnels.api.visualstudio.com objects-origin.githubusercontent.com copilot-proxy.githubusercontent.com proxy.individual.githubcopilot.com proxy.business.githubcopilot.com proxy.enterprise.githubcopilot.com *.actions.githubusercontent.com wss://*.actions.githubusercontent.com productionresultssa0.blob.core.windows.net/ productionresultssa1.blob.core.windows.net/ productionresultssa2.blob.core.windows.net/ productionresultssa3.blob.core.windows.net/ productionresultssa4.blob.core.windows.net/ productionresultssa5.blob.core.windows.net/ productionresultssa6.blob.core.windows.net/ productionresultssa7.blob.core.windows.net/ productionresultssa8.blob.core.windows.net/ productionresultssa9.blob.core.windows.net/ productionresultssa10.blob.core.windows.net/ productionresultssa11.blob.core.windows.net/ productionresultssa12.blob.core.windows.net/ productionresultssa13.blob.core.windows.net/ productionresultssa14.blob.core.windows.net/ productionresultssa15.blob.core.windows.net/ productionresultssa16.blob.core.windows.net/ productionresultssa17.blob.core.windows.net/ productionresultssa18.blob.core.windows.net/ productionresultssa19.blob.core.windows.net/ github-production-repository-image-32fea6.s3.amazonaws.com github-production-release-asset-2e65be.s3.amazonaws.com insights.github.com wss://alive.github.com api.githubcopilot.com api.individual.githubcopilot.com api.business.githubcopilot.com api.enterprise.githubcopilot.com; font-src github.githubassets.com; form-action 'self' github.com gist.github.com copilot-workspace.githubnext.com objects-origin.githubusercontent.com; frame-ancestors 'none'; frame-src viewscreen.githubusercontent.com notebooks.githubusercontent.com; img-src 'self' data: blob: github.githubassets.com media.githubusercontent.com camo.githubusercontent.com identicons.github.com avatars.githubusercontent.com private-avatars.githubusercontent.com github-cloud.s3.amazonaws.com objects.githubusercontent.com secured-user-images.githubusercontent.com/ user-images.githubusercontent.com/ private-user-images.githubusercontent.com opengraph.githubassets.com github-production-user-asset-6210df.s3.amazonaws.com customer-stories-feed.github.com spotlights-feed.github.com objects-origin.githubusercontent.com *.githubusercontent.com; manifest-src 'self'; media-src github.com user-images.githubusercontent.com/ secured-user-images.githubusercontent.com/ private-user-images.githubusercontent.com github-production-user-asset-6210df.s3.amazonaws.com gist.github.com; script-src github.githubassets.com; style-src 'unsafe-inline' github.githubassets.com; upgrade-insecure-requests; worker-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/
cache-control
max-age=0, private, must-revalidate
referrer-policy
origin-when-cross-origin, strict-origin-when-cross-origin
accept-ranges
bytes
content-length
2345
x-xss-protection
0
server
GitHub.com
player.js
fast.wistia.com/
218 KB
46 KB
Script
General
Full URL
https://fast.wistia.com/player.js
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::644 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
8c50c60c0a774b595ebca31a479693fc74066f6c55f904799790efd4f0642664
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

content-encoding
br
etag
"5768a146449a85170709042d640b5734"
age
1490
x-cache
HIT, HIT
date
Tue, 24 Dec 2024 08:06:40 GMT
last-modified
Fri, 20 Dec 2024 20:11:38 GMT
x-served-by
cache-iad-kjyo7100150-IAD, cache-mia-kmia1760033-MIA
x-cache-hits
27, 0
content-type
text/javascript
vary
Accept-Encoding
strict-transport-security
max-age=0
cache-control
public, max-age=3600
timing-allow-origin
*
x-timer
S1735027600.251613,VS0,VE1
via
1.1 varnish, 1.1 varnish
x-browser
chrome
x-ecma-v
modern
x-browser-version
131
accept-ranges
bytes
access-control-allow-origin
*
content-length
47031
asset-version
ea49143d3ad772007b2d472dbbb9c363df7c98a6
server
AmazonS3
x-amz-server-side-encryption
AES256
xjosbwtcdf.js
fast.wistia.com/embed/
10 KB
3 KB
Script
General
Full URL
https://fast.wistia.com/embed/xjosbwtcdf.js
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::644 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
envoy /
Resource Hash
009c517f25ca5b2dc84784a3433c905c83537f031c63c080ae1e02df75fc90a8
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://www.huntress.com
Referer
https://www.huntress.com/

Response headers

x-request-id
23682366-cd2c-4afd-97eb-65620c0444ca
content-encoding
br
etag
W/"009c517f25ca5b2dc84784a3433c905c"
age
80656
x-permitted-cross-domain-policies
none
x-content-type-options
nosniff
x-cache
Miss from cloudfront, HIT, HIT
x-amz-cf-id
T0RA6M3Cm07SjYmaJjdWRqLbeNayQrCWZw1IJ3H-iv_PnrYHEweqCQ==
date
Tue, 24 Dec 2024 08:06:39 GMT
content-type
text/javascript; charset=utf-8
x-served-by
cache-iad-kcgs7200113-IAD, cache-mia-kmia1760052-MIA
x-runtime
0.058961
x-cache-hits
35, 0
vary
Accept-Encoding,X-Forwarded-Proto,X-ECMA-Override
strict-transport-security
max-age=0
cache-control
public, no-cache
timing-allow-origin
*
x-envoy-upstream-service-time
61
x-timer
S1735027600.979960,VS0,VE1
via
1.1 5f7eb39e021e91c3b4f1188abbe23720.cloudfront.net (CloudFront), 1.1 varnish, 1.1 varnish
x-browser
chrome
x-ecma-v
modern
x-browser-version
131
accept-ranges
bytes
access-control-allow-origin
*
content-length
2105
x-amz-cf-pop
IAD61-P4
server
envoy
6579dd0b5f9a54376d296a5b_facebook.svg
cdn.prod.website-files.com/6579dd0b5f9a54376d296915/
368 B
679 B
Image
General
Full URL
https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a5b_facebook.svg
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
f2314da0b26cc727445f74c19d54f2f75944ea1a610497231ba6a5d9e541acf0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"b92a7c9703a268bda64464e9f8c245fd"
x-amz-version-id
RZplueeOMT9I2ezQMMUJ8cw13HoQeV5p
age
1148073
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Tue, 24 Dec 2024 08:06:40 GMT
content-type
image/svg+xml
last-modified
Wed, 13 Dec 2023 16:34:21 GMT
vary
Accept-Encoding
priority
u=3,i
x-amz-id-2
CcLrjcVvUc7tGurpAvSQu9Inj13INpoUB4CUhP1nM1GOnaoL4/NvywfNMOQ9oer4N5gOglrTkxs=
cache-control
max-age=31536000, must-revalidate
x-amz-request-id
F7P2T7ACS91V885F
cf-ray
8f6f17e52cb39abf-MIA
access-control-allow-origin
*
server
cloudflare
x-amz-server-side-encryption
AES256
6579dd0b5f9a54376d296a6f_twitter.svg
cdn.prod.website-files.com/6579dd0b5f9a54376d296915/
351 B
675 B
Image
General
Full URL
https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a6f_twitter.svg
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
553797b86e5516ebb3b4a6ffc794d7d9eca1fc1f3ca8ab0703e5eff9934e29c8

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"e0a4b7f37d6875804665234ecff1cb23"
x-amz-version-id
qTS56BoR0gVqfX6mJuOtV4Wu10z6D4RY
age
1148073
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Tue, 24 Dec 2024 08:06:40 GMT
content-type
image/svg+xml
last-modified
Wed, 13 Dec 2023 16:34:21 GMT
vary
Accept-Encoding
priority
u=3,i
x-amz-id-2
v3EiOcWcW3f/CNTvcwE2VzIEEH77YLKSTDNKdwb+NaU5qIo5ZnkJmMSDse41E+THO3qKo4SKxKg=
cache-control
max-age=31536000, must-revalidate
x-amz-request-id
F7P3C72YS6A5V3E0
cf-ray
8f6f17e52cb49abf-MIA
access-control-allow-origin
*
server
cloudflare
x-amz-server-side-encryption
AES256
6579dd0b5f9a54376d296a70_linkedin.svg
cdn.prod.website-files.com/6579dd0b5f9a54376d296915/
675 B
812 B
Image
General
Full URL
https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a70_linkedin.svg
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
8f0f089b8d2746c56340171bba62f027d4d2dc0f520588d9480432693381e14a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"67b0ebebe9b8817edbfa41bdfd2e8c6e"
x-amz-version-id
mMxIOUbXDP4hW6NdJCWI58VrmvAg.At1
age
1148073
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Tue, 24 Dec 2024 08:06:40 GMT
content-type
image/svg+xml
last-modified
Wed, 13 Dec 2023 16:34:21 GMT
vary
Accept-Encoding
priority
u=3,i
x-amz-id-2
lbHyg+HrS/X+tPUacInSK6vV0X8SUVbRhp8+3sn0s60mjWrXOPUft/ZRewagLI9T8W1DOrNDvgw=
cache-control
max-age=31536000, must-revalidate
x-amz-request-id
F7P06BWA4ZFBJD2Z
cf-ray
8f6f17e52cb59abf-MIA
access-control-allow-origin
*
server
cloudflare
x-amz-server-side-encryption
AES256
6579dd0b5f9a54376d296a5a_download.svg
cdn.prod.website-files.com/6579dd0b5f9a54376d296915/
820 B
804 B
Image
General
Full URL
https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a5a_download.svg
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
350cf9ff67297ce9f79b1a35fb7205326d21f149ab404f81ec875968f0b7d083

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"8d8c0614e1e224001d7c6dec535490b1"
x-amz-version-id
5Ss_XSS0A3iWbPuuBVg7J8jICwbGfHO4
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Tue, 24 Dec 2024 08:06:40 GMT
content-type
image/svg+xml
last-modified
Wed, 13 Dec 2023 16:34:21 GMT
vary
Accept-Encoding
priority
u=3,i
x-amz-id-2
xCfDNL7hKTdsmVw6wsAD37KNjf+0rNL4xSoezeh40GvOPB7dR6fWrY/PLJU6LiQHZwaFLM2i/6I=
cache-control
max-age=31536000, must-revalidate
x-amz-request-id
F7P1B9E5VVM2S8R3
cf-ray
8f6f17e52cb89abf-MIA
access-control-allow-origin
*
server
cloudflare
x-amz-server-side-encryption
AES256
jquery-3.5.1.min.dc5e7f18c8.js
d3e54v103j8qbb.cloudfront.net/js/
87 KB
30 KB
Script
General
Full URL
https://d3e54v103j8qbb.cloudfront.net/js/jquery-3.5.1.min.dc5e7f18c8.js?site=6579dd0b5f9a54376d296915
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.33.251.183 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-33-251-183.jfk50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://www.huntress.com
Referer
https://www.huntress.com/

Response headers

access-control-max-age
3000
content-encoding
br
etag
W/"dc5e7f18c8d36ac1d3d4753a87c98d0a"
age
17165
access-control-allow-methods
GET
x-cache
Hit from cloudfront
x-amz-cf-id
MPkKVIjJVJ0gOFW8l1UP4qN_ZIm_HN5O_T1bvvZfq9gdKnzPSsiJoQ==
date
Tue, 24 Dec 2024 03:20:36 GMT
content-type
application/javascript
last-modified
Mon, 20 Jul 2020 17:53:02 GMT
vary
accept-encoding
cache-control
max-age=84600, must-revalidate
via
1.1 873febfbd7f7ce5c5eb62e6dfaa2f102.cloudfront.net (CloudFront)
access-control-allow-origin
*
x-amz-cf-pop
JFK50-P10
server
AmazonS3
huntress-new.9b0a70f90a4fbde48bc5af3074b86c03.js
cdn.prod.website-files.com/6579dd0b5f9a54376d296915/js/
1 MB
197 KB
Script
General
Full URL
https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/js/huntress-new.9b0a70f90a4fbde48bc5af3074b86c03.js
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ef1598216ee946f370aaefb331a0d494d43d681d0972b348915b62c8a818233e

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"d9f6c4f924f7f7742bd94bb9c9e65450"
x-amz-version-id
zY5RER1mwKoktokI7dKPcFTPcOX.O66A
age
641413
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Tue, 24 Dec 2024 08:06:40 GMT
content-type
text/javascript
last-modified
Sun, 15 Dec 2024 21:43:25 GMT
vary
Accept-Encoding
priority
u=2,i=?0
x-amz-id-2
HhJqCPjIMgo/vqdpsZLySI7DzTy/FegG03rjI0voJ2ohkQRs46GM3LPpcEBx4oIiKh19KWk+xnAhiXY221hIRUhXQuohoXIe
cache-control
public, max-age=31536000, immutable
x-amz-request-id
JESAV1GEH02CSADQ
cf-ray
8f6f17e52cb19abf-MIA
access-control-allow-origin
*
server
cloudflare
x-amz-server-side-encryption
AES256
3911692.js
js.hs-scripts.com/
3 KB
1 KB
Script
General
Full URL
https://js.hs-scripts.com/3911692.js
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:89d1 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
410bc437980cd2bf8f388c099ea15a4a4e0e687341055adaafe0450f728981b6
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

access-control-max-age
3600
content-encoding
gzip
cf-cache-status
EXPIRED
x-content-type-options
nosniff
expires
Tue, 24 Dec 2024 08:08:10 GMT
date
Tue, 24 Dec 2024 08:06:40 GMT
x-hubspot-correlation-id
eef1835f-2ffb-4d50-8be9-393d5f619ab0
content-type
application/javascript;charset=utf-8
vary
origin, Accept-Encoding
last-modified
Tue, 24 Dec 2024 08:06:40 GMT
cache-control
public, max-age=90
access-control-allow-credentials
true
cf-ray
8f6f17e5aad4dab1-MIA
accept-ranges
bytes
access-control-allow-origin
https://www.huntress.com
content-length
701
server
cloudflare
slick.min.js
cdn.jsdelivr.net/npm/slick-carousel@1.8.1/slick/
42 KB
10 KB
Script
General
Full URL
https://cdn.jsdelivr.net/npm/slick-carousel@1.8.1/slick/slick.min.js
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
0c7178cc6ca34fb18e30f070a5e7a1c287b2d7ccfcba2cfdf06e0f46eda55740
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

access-control-expose-headers
*
content-encoding
br
etag
W/"a76f-O0GzvJVmhQFaNHoiOOcdsp36Dbs"
age
2468171
x-content-type-options
nosniff
x-jsd-version-type
version
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache
HIT, HIT
date
Tue, 24 Dec 2024 08:06:40 GMT
content-type
application/javascript; charset=utf-8
x-served-by
cache-fra-eddf8230159-FRA, cache-mia-kmia1760069-MIA
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
content-length
9994
x-jsd-version
1.8.1
bundle.v1.0.0.js
tools.refokus.com/rich-text-enhancer/
2 KB
1 KB
Script
General
Full URL
https://tools.refokus.com/rich-text-enhancer/bundle.v1.0.0.js
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.67.52 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Vercel /
Resource Hash
a577cc713533d7a1edbc5186c3f7b8788bbf317a857111150778d6a617220cec
Security Headers
Name Value
Strict-Transport-Security max-age=300

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

surrogate-control
max-age=31536000
content-encoding
gzip
etag
W/"bfd9ff53d0c1baa43dbb0f44751f23e9"
age
16043526
x-cache
HIT
date
Tue, 24 Dec 2024 08:06:40 GMT
content-disposition
inline; filename="bundle.v1.0.0.js"
x-served-by
cache-mia-kmia1760066-MIA
x-cache-hits
3
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
last-modified
Fri, 21 Jun 2024 15:34:34 GMT
strict-transport-security
max-age=300
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
x-vercel-cache
HIT
x-timer
S1735027600.276552,VS0,VE0
via
1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
x-debug-cache-control
Applied
content-length
830
server
Vercel
x-vercel-id
iad1::mrfkf-1733466836824-5d3c99639acf
medium-zoom.min.js
cdn.jsdelivr.net/npm/medium-zoom@1.0.3/dist/
9 KB
3 KB
Script
General
Full URL
https://cdn.jsdelivr.net/npm/medium-zoom@1.0.3/dist/medium-zoom.min.js
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::485 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
89aa43cb2db8717165e898b18806ad757585f8815f9f514bb0afbd3c390def95
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

access-control-expose-headers
*
content-encoding
br
etag
W/"2408-5ck9kUxd8AglB+1wj1aqAh/vLDs"
age
1243013
x-content-type-options
nosniff
x-jsd-version-type
version
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache
HIT, HIT
date
Tue, 24 Dec 2024 08:06:40 GMT
content-type
application/javascript; charset=utf-8
x-served-by
cache-fra-etou8220020-FRA, cache-mia-kmia1760069-MIA
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=31536000, s-maxage=31536000, immutable
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
content-length
3091
x-jsd-version
1.0.3
recaptcha__en.js
www.gstatic.com/recaptcha/releases/zIriijn3uj5Vpknvt_LnfNbF/
547 KB
216 KB
Script
General
Full URL
https://www.gstatic.com/recaptcha/releases/zIriijn3uj5Vpknvt_LnfNbF/recaptcha__en.js
Requested by
Host: www.google.com
URL: https://www.google.com/recaptcha/api.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:81c::2003 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
b261530f05e272e18b5b5c86d860c4979c82b5b6c538e1643b3c94fc9ba76dd6
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://www.huntress.com
Referer
https://www.huntress.com/

Response headers

content-encoding
gzip
age
19139
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
x-content-type-options
nosniff
expires
Wed, 24 Dec 2025 02:47:41 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 24 Dec 2024 02:47:41 GMT
last-modified
Tue, 10 Dec 2024 23:05:10 GMT
content-type
text/javascript
vary
Accept-Encoding
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups; report-to="recaptcha"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
accept-ranges
bytes
access-control-allow-origin
*
content-length
220882
x-xss-protection
0
server
sffe
gtm.js
www.googletagmanager.com/
409 KB
119 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-TXRTDGW4
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80d::2008 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
dd28ae51d0905b06265882747d25d114914193a3f14a6c7fed734153d7492b71
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

content-encoding
br
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:1080:0"}],}
expires
Tue, 24 Dec 2024 08:06:40 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 24 Dec 2024 08:06:40 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
last-modified
Tue, 24 Dec 2024 06:00:00 GMT
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:1080:0
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
121545
x-xss-protection
0
server
Google Tag Manager
datadog-logs.js
www.datadoghq-browser-agent.com/us1/v5/
56 KB
19 KB
Script
General
Full URL
https://www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.54.225 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-54-225.jfk50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
790dccf2671e2e84968bc73b3341078979eb93cc4a20e77f0454e0d8f7cc2d22

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

vary
accept-encoding
cache-control
max-age=14400, s-maxage=60
timing-allow-origin
*
content-encoding
br
etag
W/"be1347d560eba77de0a9866c709a9720"
age
22
via
1.1 667392b7601b2f20a44ef149f6859dae.cloudfront.net (CloudFront)
x-cache
Hit from cloudfront
x-amz-cf-id
HBiql3k9P03P_KR5Qr67PoRq2GFootbK3okg0iDif8XTfSRKz0hOYA==
date
Tue, 24 Dec 2024 08:06:19 GMT
content-type
text/javascript
last-modified
Thu, 19 Dec 2024 14:21:20 GMT
server
AmazonS3
x-amz-cf-pop
JFK50-P1
x-amz-server-side-encryption
AES256
datadog-rum.js
www.datadoghq-browser-agent.com/us1/v5/
161 KB
51 KB
Script
General
Full URL
https://www.datadoghq-browser-agent.com/us1/v5/datadog-rum.js
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.139.54.225 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-139-54-225.jfk50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
2418c9b2b788e3ea84865dbd1efe80567dc77be8523c4f5c9271df07c5139808

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

vary
accept-encoding
cache-control
max-age=14400, s-maxage=60
timing-allow-origin
*
content-encoding
br
etag
W/"7bf3087732da32a3f4889e7ad88b7d0f"
age
59
via
1.1 667392b7601b2f20a44ef149f6859dae.cloudfront.net (CloudFront)
x-cache
Hit from cloudfront
x-amz-cf-id
C8kmEzn98ZE97IbEH1U6L6FOrkPd6tFJzCgRzuTJjJ8QJxDexM1Neg==
date
Tue, 24 Dec 2024 08:05:41 GMT
content-type
text/javascript
last-modified
Thu, 19 Dec 2024 14:21:30 GMT
server
AmazonS3
x-amz-cf-pop
JFK50-P1
x-amz-server-side-encryption
AES256
6579dd0b5f9a54376d296a7c_search.svg
cdn.prod.website-files.com/6579dd0b5f9a54376d296915/
654 B
710 B
Image
General
Full URL
https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a7c_search.svg
Requested by
Host: cdn.prod.website-files.com
URL: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.48a4fcf31.min.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
442375f1dd6362e4a3e889f3f11e7d14aa686899a36f112ae73986a80475681b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.48a4fcf31.min.css

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"166c01555262c9617db663ec8a38364b"
x-amz-version-id
ZAs7majvHYt8oLX63btjRfdozrskAdOe
age
1147245
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Tue, 24 Dec 2024 08:06:40 GMT
content-type
image/svg+xml
last-modified
Wed, 13 Dec 2023 16:34:21 GMT
vary
Accept-Encoding
priority
u=3,i
x-amz-id-2
Mq8U1duzLKfpd6rv+Ln/TUqCI8viGLTmXGJBfiQ7TlRQ7ZMYPXRH2XG9+7sD/t1YcF/4lCJbLUU=
cache-control
max-age=31536000, must-revalidate
x-amz-request-id
94C5CSF4AHGVYZ1H
cf-ray
8f6f17e53cb99abf-MIA
access-control-allow-origin
*
server
cloudflare
x-amz-server-side-encryption
AES256
6579dd0b5f9a54376d296925_hknova-regular-webfont.woff2
cdn.prod.website-files.com/6579dd0b5f9a54376d296915/
17 KB
18 KB
Font
General
Full URL
https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296925_hknova-regular-webfont.woff2
Requested by
Host: cdn.prod.website-files.com
URL: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.48a4fcf31.min.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
71425f588c17edb9905c3ed73aee0404b58772b91c8154fe53d3157f58f0b2e2

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://www.huntress.com
Referer
https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.48a4fcf31.min.css

Response headers

access-control-max-age
3000
cf-cache-status
HIT
etag
"fd0185054945b2abe907dc7e524389c9"
x-amz-version-id
At.YFBHJO4EQclecPPM23aBnfk3j2h1H
age
1148164
access-control-allow-methods
GET, HEAD
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Tue, 24 Dec 2024 08:06:40 GMT
content-type
application/octet-stream
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
last-modified
Wed, 13 Dec 2023 16:34:20 GMT
x-amz-id-2
XQ/D7DPijxyzxZyNYsMWizOJBaYeRwpEvSJdx0E8sjhc1ZqLwPpoRTb4bczMtW5pJutOAyGO20U=
priority
u=0,i=?0
cache-control
max-age=31536000, must-revalidate
x-amz-request-id
0SX83HD4T7X2353Q
cf-ray
8f6f17e5586774b4-MIA
accept-ranges
bytes
access-control-allow-origin
*
content-length
17728
server
cloudflare
x-amz-server-side-encryption
AES256
6579dd0b5f9a54376d29691d_hknova-bold-webfont.woff2
cdn.prod.website-files.com/6579dd0b5f9a54376d296915/
18 KB
18 KB
Font
General
Full URL
https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d29691d_hknova-bold-webfont.woff2
Requested by
Host: cdn.prod.website-files.com
URL: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.48a4fcf31.min.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
a4aba4543a40b2e2d78e4006eb941a3a18cf95dc81041ad362321a3995bcc898

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://www.huntress.com
Referer
https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.48a4fcf31.min.css

Response headers

access-control-max-age
3000
cf-cache-status
HIT
etag
"5aec097021a58170197314c745d296db"
x-amz-version-id
4JksoGDTlz479HpJYtobtrz0YXSwp3Rx
age
1148164
access-control-allow-methods
GET, HEAD
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Tue, 24 Dec 2024 08:06:40 GMT
content-type
application/octet-stream
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
last-modified
Wed, 13 Dec 2023 16:34:20 GMT
x-amz-id-2
BESjmd4UGcKcXuJRfxGuwYFqj451LF9k43gzqX9EtZI1Tt4Ey5UUpRZt0WEuSlXmpj9bGCj/p+M=
priority
u=0,i=?0
cache-control
max-age=31536000, must-revalidate
x-amz-request-id
0SX10YD9GNMRTBK7
cf-ray
8f6f17e5586874b4-MIA
accept-ranges
bytes
access-control-allow-origin
*
content-length
18204
server
cloudflare
x-amz-server-side-encryption
AES256
6579dd0b5f9a54376d296961_visuelt-bold-webfont.woff2
cdn.prod.website-files.com/6579dd0b5f9a54376d296915/
21 KB
21 KB
Font
General
Full URL
https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296961_visuelt-bold-webfont.woff2
Requested by
Host: cdn.prod.website-files.com
URL: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.48a4fcf31.min.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
36b097a74149a547cc7fe1da7b5a9cacf6c36d2f91872f11874479e1d4fafee2

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://www.huntress.com
Referer
https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.48a4fcf31.min.css

Response headers

access-control-max-age
3000
cf-cache-status
HIT
etag
"4be3159e8cb3fb66b8e847dd0bedb2ed"
x-amz-version-id
6cft5KdwVHtlIu77Lo8AxPLF1V_1aCGv
age
93592
access-control-allow-methods
GET, HEAD
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Tue, 24 Dec 2024 08:06:40 GMT
content-type
application/octet-stream
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
last-modified
Wed, 13 Dec 2023 16:34:20 GMT
x-amz-id-2
9LAkCl2N47z2LwEKJSjeXqATA/NnVYGMihxvQwpEQIzUtqLk6oY87hHmKSZV4R6WbHrzDnYBHIM=
priority
u=0,i=?0
cache-control
max-age=31536000, must-revalidate
x-amz-request-id
0SX9YTH87RB1M8YT
cf-ray
8f6f17e5586974b4-MIA
accept-ranges
bytes
access-control-allow-origin
*
content-length
21280
server
cloudflare
x-amz-server-side-encryption
AES256
6579dd0b5f9a54376d296927_hknova-semibold-webfont.woff2
cdn.prod.website-files.com/6579dd0b5f9a54376d296915/
18 KB
18 KB
Font
General
Full URL
https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296927_hknova-semibold-webfont.woff2
Requested by
Host: cdn.prod.website-files.com
URL: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.48a4fcf31.min.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ace449f8c185f9f62716fd9998c8f4d09f6849ead77ec8c3849aa69f4c8c1d36

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://www.huntress.com
Referer
https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.48a4fcf31.min.css

Response headers

access-control-max-age
3000
cf-cache-status
HIT
etag
"b62b51b8a8a1c83c200a484a4149c151"
x-amz-version-id
SgNlIeK2CMt3IfgkJzcYPm6BQJFO8VdG
age
1148164
access-control-allow-methods
GET, HEAD
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Tue, 24 Dec 2024 08:06:40 GMT
content-type
application/octet-stream
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
last-modified
Wed, 13 Dec 2023 16:34:20 GMT
x-amz-id-2
OHj9FeccauWLDqTexuraMd/5rfBUs4ECRD4xTuocjCMbe/DvtAIoh5NvOaumVjFI8QNhL2thE6U=
priority
u=0,i=?0
cache-control
max-age=31536000, must-revalidate
x-amz-request-id
0SX7XNNETXFG5HAT
cf-ray
8f6f17e5586a74b4-MIA
accept-ranges
bytes
access-control-allow-origin
*
content-length
18124
server
cloudflare
x-amz-server-side-encryption
AES256
6579dd0b5f9a54376d29692b_hknova-medium-webfont.woff2
cdn.prod.website-files.com/6579dd0b5f9a54376d296915/
18 KB
18 KB
Font
General
Full URL
https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d29692b_hknova-medium-webfont.woff2
Requested by
Host: cdn.prod.website-files.com
URL: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.48a4fcf31.min.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c2894cd697b6e87cd89a195120ff37714770ecd37316ecb15515d54ff399a0a2

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://www.huntress.com
Referer
https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.48a4fcf31.min.css

Response headers

access-control-max-age
3000
cf-cache-status
HIT
etag
"c466e86303b3c30904406c29d30243d2"
x-amz-version-id
9Cgg6LGY6a4F_K5nV69zZKNZqEqKU0Ru
age
1138826
access-control-allow-methods
GET, HEAD
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Tue, 24 Dec 2024 08:06:40 GMT
content-type
application/octet-stream
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
last-modified
Wed, 13 Dec 2023 16:34:20 GMT
x-amz-id-2
rXjpVfLjbyyeishe0euQ1LYuPD4jQ4dBz9DjMFgd7Dfn2QbqpXnqJW4+hzsrTKH4Y0ShtslQoJ0=
priority
u=0,i=?0
cache-control
max-age=31536000, must-revalidate
x-amz-request-id
81RNT7M05RKZBX5M
cf-ray
8f6f17e5586b74b4-MIA
accept-ranges
bytes
access-control-allow-origin
*
content-length
18088
server
cloudflare
x-amz-server-side-encryption
AES256
66abcfee331da80089b29d7e_Huntress%20Logo%20Wide%20Teal.webp
cdn.prod.website-files.com/6579dd0b5f9a54376d296915/
9 KB
10 KB
Image
General
Full URL
https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/66abcfee331da80089b29d7e_Huntress%20Logo%20Wide%20Teal.webp
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7f8bc25ed93cda3b731e3fee0f426764de8cd21ba43f9557923cdd89cc2225c3

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

cf-cache-status
HIT
etag
"4d43f1ba43ff10e933af8c3cba746277"
x-amz-version-id
fAbeElApcA4jQlgHVcKv6DhyLXOyvQel
age
1148164
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Tue, 24 Dec 2024 08:06:40 GMT
content-type
image/webp
last-modified
Thu, 01 Aug 2024 18:11:59 GMT
vary
Accept-Encoding
priority
u=3,i
x-amz-id-2
aX+U+a3NfLXozy//lN+uLmqbORh7IBrw6LUPdHRB8a/KqVHanii7/3sK8R/djp31boOJSMdh/lYZD8Ry6+wFts4lOYQi2/Py
cache-control
max-age=31536000, must-revalidate
x-amz-request-id
3JXFGFVCTBYXARH6
cf-ray
8f6f17e55cc89abf-MIA
accept-ranges
bytes
access-control-allow-origin
*
content-length
9574
server
cloudflare
x-amz-server-side-encryption
AES256
656079b2a6c055ce7d368e61_Secondary%20Text%20CTA%20Black%20(1).svg
cdn.prod.website-files.com/655d92689c415e9fefcf2368/
407 B
689 B
Image
General
Full URL
https://cdn.prod.website-files.com/655d92689c415e9fefcf2368/656079b2a6c055ce7d368e61_Secondary%20Text%20CTA%20Black%20(1).svg
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ad1a0bf17b8433241806ec0b3cb9c17be616ea295df90068ab3e646de802e111

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"7b97da408ecd186da2775e85d3b5fc35"
x-amz-version-id
6MUyKzg7.UI2lqy3cc43_aNDTQO42ExF
age
1148164
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Tue, 24 Dec 2024 08:06:40 GMT
content-type
image/svg+xml
last-modified
Fri, 24 Nov 2023 10:23:48 GMT
vary
Accept-Encoding
priority
u=3,i
x-amz-id-2
S/+vWm3ccYIcmpRfy+bc9I5CQR6uMSJLUARMGmEVBp2ZEyP18XKdpYp5zkJ6I2vt1TuR32bLV9s=
cache-control
max-age=31536000, must-revalidate
x-amz-request-id
7NQWC41VWGJM24BW
cf-ray
8f6f17e55ccb9abf-MIA
access-control-allow-origin
*
server
cloudflare
x-amz-server-side-encryption
AES256
6757a472f81e70e0dd7a50a8_120924_Web_Blog_CLEO_Thumb_564x425.webp
cdn.prod.website-files.com/6579dd0b5f9a54376d296939/
37 KB
37 KB
Image
General
Full URL
https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/6757a472f81e70e0dd7a50a8_120924_Web_Blog_CLEO_Thumb_564x425.webp
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
ad9dea1ac2eb241166c18f9fa47c760e456171d9ebcc4ae40b4abf1b92fdc9d4

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

cf-cache-status
HIT
etag
"7e512f5eeff09a4fe9a6b260620dcff4"
x-amz-version-id
mmMZcFBBIC6I2yIYWuP8HbdAhAcUMuLl
age
1147855
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Tue, 24 Dec 2024 08:06:40 GMT
content-type
image/webp
last-modified
Tue, 10 Dec 2024 02:16:20 GMT
vary
Accept-Encoding
priority
u=3,i
x-amz-id-2
QRHTDkaVJeomSiizLNg2kTWHlcDpQ1ajMe0aMS6VQKYmaEA2vnKg+kOKHGJAzUekdJ1ITEA4nqg=
cache-control
max-age=31536000, must-revalidate
x-amz-request-id
RSKYETT15TNC1EWD
cf-ray
8f6f17e55ccc9abf-MIA
accept-ranges
bytes
access-control-allow-origin
*
content-length
37750
server
cloudflare
x-amz-server-side-encryption
AES256
671be6153efae5a8077227e0_Huntress%20Warrior%20-%20Teal.png
cdn.prod.website-files.com/6579dd0b5f9a54376d296939/
21 KB
22 KB
Image
General
Full URL
https://cdn.prod.website-files.com/6579dd0b5f9a54376d296939/671be6153efae5a8077227e0_Huntress%20Warrior%20-%20Teal.png
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
71ff609fb53e30a44f5b97eb292f1daeaae937fd18c8699ff4064d425a2f6210

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

cf-cache-status
HIT
etag
"b572e991b8f5145a30338ac8d82ba2f7"
x-amz-version-id
5mbcqNG3AKPE1StI23c5BciKUbae8k4e
age
1147890
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Tue, 24 Dec 2024 08:06:40 GMT
content-type
image/png
last-modified
Fri, 25 Oct 2024 18:40:23 GMT
vary
Accept-Encoding
priority
u=3,i
x-amz-id-2
zCPsAUieI6+WY+8P41koNP8ZAZq05CQ5/K7zXhPiC/Onwx8vMqw0GTV5++GnlVwVCuLwPdGGuLE=
cache-control
max-age=31536000, must-revalidate
x-amz-request-id
F7PEQ4HASQJPC77K
cf-ray
8f6f17e55ccd9abf-MIA
accept-ranges
bytes
access-control-allow-origin
*
content-length
21714
server
cloudflare
x-amz-server-side-encryption
AES256
6579dd0b5f9a54376d296a89_Landing%20WWW%20Glitch%20Right.webp
cdn.prod.website-files.com/6579dd0b5f9a54376d296915/
2 KB
3 KB
Image
General
Full URL
https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a89_Landing%20WWW%20Glitch%20Right.webp
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c99531b584c2990420c6cf8f267e27bca20375cf89d4afdcaa5b3afb7a9f35d2

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

cf-cache-status
HIT
etag
"3574559fb267295e5e44a4509e2e6e4f"
x-amz-version-id
0.i3tZnqpf4mpcjZIZI6k.PdzUSOLecT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Tue, 24 Dec 2024 08:06:40 GMT
content-type
image/webp
last-modified
Thu, 21 Dec 2023 07:39:51 GMT
vary
Accept-Encoding
priority
u=3,i
x-amz-id-2
heWev4aS+ZPxA6p1+QXsP9r4p3anMngtLWilv38pF2npP7jTe2lGAUEgNqJ4MOZzS60PeYiV1lG8K9uDb5xnMg==
cache-control
max-age=84600, must-revalidate
x-amz-request-id
SA4WYEWEHE0R20BG
cf-ray
8f6f17e55cce9abf-MIA
accept-ranges
bytes
access-control-allow-origin
*
content-length
2196
server
cloudflare
x-amz-server-side-encryption
AES256
gist-embed-9eb50564113f.css
github.githubassets.com/assets/
83 KB
13 KB
Stylesheet
General
Full URL
https://github.githubassets.com/assets/gist-embed-9eb50564113f.css
Requested by
Host: gist.github.com
URL: https://gist.github.com/JohnHammond/d918f0dae466df7eb9b57e608d9b26c0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
185.199.111.154 , United States, ASN54113 (FASTLY, US),
Reverse DNS
cdn-185-199-111-154.github.com
Software
Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0 /
Resource Hash
3d9093851b0b2347611090c65fa9583f0e7caf5b0fa712007f6638515fdc5603
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

x-fastly-request-id
6ed08cae6bd65cfba74627e1f44025695beaa028
content-encoding
br
etag
"0x8DD149C365BEAF2"
age
1667236
x-cache
HIT, HIT
date
Tue, 24 Dec 2024 08:06:40 GMT
content-type
text/css
vary
Accept-Encoding
x-cache-hits
55, 0
last-modified
Wed, 04 Dec 2024 19:45:31 GMT
x-served-by
cache-iad-kcgs7200025-IAD, cache-mia-kmia1760039-MIA
strict-transport-security
max-age=31536000
cache-control
public, max-age=31536000, immutable
cross-origin-resource-policy
cross-origin
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
12772
server
Windows-Azure-Web/1.0 Microsoft-HTTPAPI/2.0
rum
browser-intake-datadoghq.com/api/v2/
53 B
113 B
Fetch
General
Full URL
https://browser-intake-datadoghq.com/api/v2/rum?ddsource=browser&ddtags=sdk_version%3A5.34.1%2Capi%3Afetch%2Cenv%3Aproduction%2Cservice%3Ahuntress.com%2Cversion%3A1.0.0&dd-api-key=pub66bcc27a4e8914137e6493224fb92edb&dd-evp-origin-version=5.34.1&dd-evp-origin=browser&dd-request-id=9690af9d-7a1f-44cd-9809-7968e5898a25&batch_time=1735027600486
Requested by
Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1f18:24e6:b901:72e3:1bfe:b271:96b2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
01366f3e3bbc518168394ae3d84db2b7b96ad623562cf6baf0968e273defbf5e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8
Referer
https://www.huntress.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
access-control-allow-origin
*
content-length
53
accept-encoding
identity,gzip,x-gzip,deflate,x-deflate,zstd
date
Tue, 24 Dec 2024 08:06:40 GMT
content-type
application/json
dd-request-id
9690af9d-7a1f-44cd-9809-7968e5898a25
rum
browser-intake-datadoghq.com/api/v2/
53 B
287 B
Fetch
General
Full URL
https://browser-intake-datadoghq.com/api/v2/rum?ddsource=browser&ddtags=sdk_version%3A5.34.1%2Capi%3Afetch%2Cenv%3Aproduction%2Cservice%3Ahuntress.com%2Cversion%3A1.0.0&dd-api-key=pub66bcc27a4e8914137e6493224fb92edb&dd-evp-origin-version=5.34.1&dd-evp-origin=browser&dd-request-id=7a80896c-a5c6-4102-b44d-f3f23dec9e9e&batch_time=1735027600495
Requested by
Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1f18:24e6:b901:72e3:1bfe:b271:96b2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
cfeb21563fae9a04d315a4e6b1083b6bee877405ff0d29bb27503fc5499bccbd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8
Referer
https://www.huntress.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
access-control-allow-origin
*
content-length
53
accept-encoding
identity,gzip,x-gzip,deflate,x-deflate,zstd
date
Tue, 24 Dec 2024 08:06:40 GMT
content-type
application/json
dd-request-id
7a80896c-a5c6-4102-b44d-f3f23dec9e9e
publicApi.js
fast.wistia.com/assets/external/
733 KB
127 KB
Script
General
Full URL
https://fast.wistia.com/assets/external/publicApi.js
Requested by
Host: fast.wistia.com
URL: https://fast.wistia.com/player.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::644 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
93d4a7e5e9ddf6d92a8c155e8f402d0e6aada0b73eacdc2c4b9be337d308fbde
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

content-encoding
br
etag
"c3d31aeac2fb2bb05a22689db9a5461e"
age
523
x-cache
HIT, HIT
date
Tue, 24 Dec 2024 08:06:40 GMT
last-modified
Fri, 20 Dec 2024 20:11:38 GMT
x-served-by
cache-iad-kiad7000137-IAD, cache-mia-kmia1760033-MIA
x-cache-hits
28, 0
content-type
text/javascript
vary
Accept-Encoding
strict-transport-security
max-age=0
cache-control
public, max-age=3600
timing-allow-origin
*
x-timer
S1735027601.565245,VS0,VE1
via
1.1 varnish, 1.1 varnish
x-browser
chrome
x-ecma-v
modern
x-browser-version
131
accept-ranges
bytes
access-control-allow-origin
*
content-length
129402
asset-version
ea49143d3ad772007b2d472dbbb9c363df7c98a6
server
AmazonS3
x-amz-server-side-encryption
AES256
swatch
fast.wistia.com/embed/medias/xjosbwtcdf/
3 KB
4 KB
Image
General
Full URL
https://fast.wistia.com/embed/medias/xjosbwtcdf/swatch
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::644 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
envoy /
Resource Hash
99ad7afebc78c84be7097c53ec37782c23f13b78404673ca266b3290319cf990
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

access-control-expose-headers
Server,range,Content-Length,Content-Range,x-cdn
etag
gDLHGVshF1QwpmyRlnJKPP4DgYg=
age
97025
access-control-request-method
*
x-cache
Miss from cloudfront, HIT, HIT
x-amz-cf-id
Ny7CJmn7LlJv4VEEroYohjRgIzDXn4tG_-85dCIAVQphJMUdGFuKBA==
date
Tue, 24 Dec 2024 08:06:40 GMT
content-type
image/jpeg
content-disposition
inline
x-served-by
cache-iad-kjyo7100098-IAD, cache-mia-kmia1760033-MIA
last-modified
Tue, 10 Dec 2024 02:00:19 UTC
x-cache-hits
2393, 0
strict-transport-security
max-age=0
edge-cache-tag
a80de67cd3df6e48c1f5461985b686eabca45874
cache-control
public, no-cache,max-age=31536000
timing-allow-origin
*
x-envoy-upstream-service-time
52
x-timer
S1735027601.572829,VS0,VE1
x-cdn
cloudfront
via
1.1 e7017602a9625d2d0a22386cb8355050.cloudfront.net (CloudFront), 1.1 b9a9cc3569345411c251c3c7f27048e2.cloudfront.net (CloudFront), 1.1 varnish, 1.1 varnish
x-browser
chrome
x-ecma-v
modern
x-browser-version
131
accept-ranges
bytes
access-control-allow-origin
*,*
content-length
3189
x-amz-cf-pop
IAD61-P6, IAD61-P4
server
envoy
6579dd0b5f9a54376d29694d_roboto-regular-webfont.woff2
cdn.prod.website-files.com/6579dd0b5f9a54376d296915/
19 KB
19 KB
Font
General
Full URL
https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d29694d_roboto-regular-webfont.woff2
Requested by
Host: cdn.prod.website-files.com
URL: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.48a4fcf31.min.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7f62ee80b8c824f30ad6c278146632d25b7e159e0a9cd91a356068eb9340061c

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://www.huntress.com
Referer
https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.48a4fcf31.min.css

Response headers

access-control-max-age
3000
cf-cache-status
HIT
etag
"a0118c6d18835732ae0eb880babc7598"
x-amz-version-id
1upZc36cdk27x7Arg8l9thaL3L34ome5
age
1148164
access-control-allow-methods
GET, HEAD
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Tue, 24 Dec 2024 08:06:40 GMT
content-type
application/octet-stream
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
last-modified
Wed, 13 Dec 2023 16:34:20 GMT
x-amz-id-2
e0r2W//i/xhPiK20EJVozZLV+xGyYJ6xBr9yyy8dXFkn+YXi/K4IMDFk/6F8lVAogUwLN3FXe8o=
priority
u=0,i=?0
cache-control
max-age=31536000, must-revalidate
x-amz-request-id
CPYBBAYKYW83VCBF
cf-ray
8f6f17e7c9b874b4-MIA
accept-ranges
bytes
access-control-allow-origin
*
content-length
19348
server
cloudflare
x-amz-server-side-encryption
AES256
6579dd0b5f9a54376d296a6e_DMSans_24pt-Bold.ttf
cdn.prod.website-files.com/6579dd0b5f9a54376d296915/
55 KB
56 KB
Font
General
Full URL
https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/6579dd0b5f9a54376d296a6e_DMSans_24pt-Bold.ttf
Requested by
Host: cdn.prod.website-files.com
URL: https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.48a4fcf31.min.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0020be3f1555293342637940e02d32e0f0c3b1951f6a274c00a6e3afe91610d1

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://www.huntress.com
Referer
https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/css/huntress-new.48a4fcf31.min.css

Response headers

access-control-max-age
3000
cf-cache-status
HIT
etag
"541d84af93ed55a92a75644198c26ca5"
x-amz-version-id
quM.7z1k_e9xiPUszqLumStS9j4JLmMp
access-control-allow-methods
GET, HEAD
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Tue, 24 Dec 2024 08:06:40 GMT
content-type
application/x-font-ttf
vary
Origin, Access-Control-Request-Headers, Access-Control-Request-Method, Accept-Encoding
priority
u=0,i=?0
x-amz-id-2
E77AMPP4bIRCfMRwdkRtXXY8Jv4PDRb80++P2jkpGQd0jRLOFj71ZNyH8KCu/LIY+ch6QD2OCno=
last-modified
Wed, 13 Dec 2023 16:34:21 GMT
cache-control
max-age=31536000, must-revalidate
x-amz-request-id
0SXE1DGG8GAHMGPE
cf-ray
8f6f17e7c9ba74b4-MIA
accept-ranges
bytes
access-control-allow-origin
*
content-length
56344
server
cloudflare
x-amz-server-side-encryption
AES256
xjosbwtcdf.json
fast.wistia.net/embed/medias/
10 KB
3 KB
Fetch
General
Full URL
https://fast.wistia.net/embed/medias/xjosbwtcdf.json
Requested by
Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42::644 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
envoy /
Resource Hash
b58912cc3bf0066c2e66dbde3b7881fcf87ad4948314b3e264511a0ee192fc90
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

x-request-id
52f06dd8-1285-4593-b794-e22683501923
content-encoding
br
etag
W/"b58912cc3bf0066c2e66dbde3b7881fc"
age
41901
x-permitted-cross-domain-policies
none
x-content-type-options
nosniff
x-cache
Miss from cloudfront, HIT, HIT
x-amz-cf-id
avKW-xJGESFYeGDYwoPBkEclWbX53B3jqHcPj-17hbMBz4vEIfmYDA==
date
Tue, 24 Dec 2024 08:06:40 GMT
content-type
application/json; charset=utf-8
x-served-by
cache-iad-kjyo7100113-IAD, cache-mia-kmia1760036-MIA
x-runtime
0.054997
x-cache-hits
34, 0
vary
Accept-Encoding,X-Forwarded-Proto,X-ECMA-Override
strict-transport-security
max-age=0
cache-control
public, no-cache
timing-allow-origin
*
x-envoy-upstream-service-time
57
x-timer
S1735027601.684022,VS0,VE1
via
1.1 3d0c14144ce4a7fd9b3fd5f94407ec7e.cloudfront.net (CloudFront), 1.1 varnish, 1.1 varnish
x-browser
chrome
x-ecma-v
modern
x-browser-version
131
accept-ranges
bytes
access-control-allow-origin
*
content-length
2098
x-amz-cf-pop
IAD61-P4
server
envoy
3_24_2_kzhk9kjvjzpzdnk61lg3.js
static.huntresscdn.com/
78 KB
27 KB
Script
General
Full URL
https://static.huntresscdn.com/3_24_2_kzhk9kjvjzpzdnk61lg3.js
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::681a:ad , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
269ae54dd73d89793323dd5814c9b382e9bcb8a1e8533bbd654e9478ce2f6d4d

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
content-encoding
br
cf-cache-status
HIT
etag
W/"eccf49ea3affa7d8ede265d518e6d439"
age
555
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rh52lL6Zn8uAMFW1CKDhbJh8cv5dnM48wis6l0fmbj7I%2Fjm9v6KAxsN0j3kk2jruKaKixzmxH%2FFxe623S2ynuV45nQTZe89o%2B5JNqqCmmSa5dA7NImPv%2FPwXu80gMCevnZQYeetXxmVRuIXmm24FHyussqQ%3D"}],"group":"cf-nel","max_age":604800}
cf-ray
8f6f17e8fc0edae9-MIA
alt-svc
h3=":443"; ma=86400
server-timing
cfL4;desc="?proto=TCP&rtt=29682&min_rtt=29572&rtt_var=6406&sent=7&recv=10&lost=0&retrans=0&sent_bytes=3993&recv_bytes=2164&delivery_rate=130025&cwnd=252&unsent_bytes=0&cid=3e2ff250a94c76e0&ts=48&x=0"
date
Tue, 24 Dec 2024 08:06:40 GMT
content-type
text/javascript
last-modified
Thu, 15 Aug 2024 19:33:40 GMT
vary
Accept-Encoding
server
cloudflare
web-interactives-embed.js
js.hubspot.com/
84 KB
25 KB
Script
General
Full URL
https://js.hubspot.com/web-interactives-embed.js
Requested by
Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/3911692.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
674d5ab1e2c5a783115e67fabc4805ac2e8a83d48eb6a1ad3535c23a959a1801
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://www.huntress.com
Referer
https://www.huntress.com/

Response headers

x-request-id
cd8d9774-0a39-40e0-8e2d-4fa42e6e31e2
content-encoding
gzip
cf-cache-status
HIT
etag
W/"03686003e4860757c17ae65c11ab8ea4"
x-amz-version-id
_83IngeMtzUuERab6QgcByX86005NyG0
age
203
cache-tag
staticjsapp-web-interactives-embed-web-prod,staticjsapp-prod
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Qeu2Dhw2Pkqd1lwKL53CsNC5fC0e3pOlGg7gPKG6g7HfVL9Eo9ovBpbp%2BR0V6kXqrRox98lh787svUUMvgl4b5%2Bpdc55tB8g2d33ct2U34u420iOMzoV4G5XkEcniRRA8GB6re%2BaqgH3gMLL"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
x-cache
Hit from cloudfront
x-evy-trace-listener
listener_https
x-amz-cf-id
bMg2HYUOdaTdEjE1KKrNO7MCvzLDsl9KOJnh90ihjifRO6DMntPpaA==
x-hubspot-correlation-id
cd8d9774-0a39-40e0-8e2d-4fa42e6e31e2
content-type
application/javascript; charset=utf-8
last-modified
Fri, 13 Dec 2024 12:10:35 UTC
x-amz-replication-status
COMPLETED
x-evy-trace-route-service-name
envoyset-translator
cache-control
max-age=600
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-856d8787d5-56k8s
x-envoy-upstream-service-time
1
x-hs-target-asset
web-interactives-embed/static-2.1996/bundles/project.js
server
cloudflare
x-evy-trace-virtual-host
all
x-amz-server-side-encryption
AES256
x-hs-cache-status
HIT
date
Tue, 24 Dec 2024 08:06:40 GMT
vary
accept-encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=web-interactives-embed/static-2.1996/bundles/project.js&cfRay=8f1d77042b1f9acc-MIA
via
1.1 caafbc8a9aa04b09dd564a3ddef60622.cloudfront.net (CloudFront)
cf-ray
8f6f17e9d943da53-MIA
access-control-allow-origin
*
x-evy-trace-route-configuration
listener_https/all
x-amz-cf-pop
IAD12-P3
fb.js
js.hsadspixel.net/
6 KB
4 KB
Script
General
Full URL
https://js.hsadspixel.net/fb.js
Requested by
Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/3911692.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6811:80ac , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
94c33d6b7a8a3ec1b2fa2f21d8d13e760f5a2b1d0bcd6bc79040eaf8fc3db99a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

x-evy-trace-virtual-host
all
x-request-id
6d4bafdf-9b22-4e2c-91a7-e6cb9a8675f3
content-encoding
gzip
cf-cache-status
HIT
etag
W/"ca248d7a7c6bd2f9377cb66156837d10"
x-amz-version-id
z1RV9ixsN0LmI92PbMVbn7sOiIZi0lq8
cache-tag
staticjsapp-AdsScriptLoaderCloudflare-web-prod,staticjsapp-prod
age
217
x-content-type-options
nosniff
x-cache
Hit from cloudfront
x-hs-cache-status
MISS
x-amz-cf-id
uaMuWbF5J5YMlNYWwuxx1vhmb7uqgCRUFL7pjkh-EcdEsjRJJTM7DQ==
date
Tue, 24 Dec 2024 08:06:40 GMT
x-hubspot-correlation-id
6d4bafdf-9b22-4e2c-91a7-e6cb9a8675f3
content-type
application/javascript; charset=utf-8
last-modified
Fri, 20 Dec 2024 17:34:20 UTC
vary
accept-encoding
x-evy-trace-listener
listener_https
x-amz-replication-status
COMPLETED
x-evy-trace-route-service-name
envoyset-translator
cache-control
max-age=600
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-856d8787d5-qg2kv
x-envoy-upstream-service-time
4
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=adsscriptloaderstatic/static-1.1043/bundles/pixels-release.js&cfRay=8f5170ba7da70a81-IAD
via
1.1 e8eec15d9551dd475d4c478f9fbb5f04.cloudfront.net (CloudFront)
cf-ray
8f6f17e9dde2a540-MIA
x-evy-trace-route-configuration
listener_https/all
x-hs-target-asset
adsscriptloaderstatic/static-1.1043/bundles/pixels-release.js
x-amz-cf-pop
IAD12-P3
server
cloudflare
x-amz-server-side-encryption
AES256
3911692.js
js.hs-analytics.net/analytics/1735027500000/
70 KB
25 KB
Script
General
Full URL
https://js.hs-analytics.net/analytics/1735027500000/3911692.js
Requested by
Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/3911692.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:a0a8 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
d0d8837abb30839d383fb8ec75c1d5f85aed4429fd949e5958a09be0d038a707

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

x-amz-server-side-encryption
AES256
x-request-id
581fd00f-55df-452d-98f5-9a8a99695580
content-encoding
gzip
cf-cache-status
MISS
etag
W/"75d256b18fc509bd725ed54a2bbc2439"
x-amz-version-id
null
expires
Tue, 24 Dec 2024 08:11:41 GMT
x-evy-trace-listener
listener_https
date
Tue, 24 Dec 2024 08:06:41 GMT
x-hubspot-correlation-id
581fd00f-55df-452d-98f5-9a8a99695580
content-type
text/javascript
last-modified
Wed, 11 Dec 2024 18:12:31 GMT
vary
origin, Accept-Encoding
x-amz-id-2
e+ynikLUjUpPY5+LprYlQx/kYU8581KO1G6x4RNb4Z2j9MFB69/+c8O/NwV+zqQmAXPfbgLzwmgn0hwlMpj7teRy4BoXf6qg
x-evy-trace-route-service-name
envoyset-translator
cache-control
max-age=300,public
x-evy-trace-served-by-pod
iad02/analytics-js-proxy-td/envoy-proxy-8586d94f84-2bzl2
x-envoy-upstream-service-time
103
access-control-allow-credentials
false
x-amz-request-id
9N8JV9E66JM4YRKW
cf-ray
8f6f17e9dc1e8ddf-MIA
x-evy-trace-route-configuration
listener_https/all
server
cloudflare
x-evy-trace-virtual-host
all
collectedforms.js
js.hscollectedforms.net/
70 KB
25 KB
Script
General
Full URL
https://js.hscollectedforms.net/collectedforms.js
Requested by
Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/3911692.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:6efe , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
1764bc84ea6abe91f1634b73a5a6c0ebff400461dfea6a4040bd0c03d86caa8b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://www.huntress.com
Referer
https://www.huntress.com/

Response headers

x-request-id
9d60a699-941d-42e9-a32c-5e7f6c98bbf9
content-encoding
gzip
cf-cache-status
HIT
x-amz-version-id
8IiNiFnnn0n9avBP.k8Mr32sZxpD8Dx_
etag
W/"ceb8bcb73e5536d8416735a3977d227a"
age
203
cache-tag
staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod
x-content-type-options
nosniff
x-cache
Hit from cloudfront
x-evy-trace-listener
listener_https
x-amz-cf-id
RdVGTcZozGQ-I7oEG0EcYjF6AZjwHlZJuVnN47IZk5q9SvkmmALSew==
x-hubspot-correlation-id
9d60a699-941d-42e9-a32c-5e7f6c98bbf9
content-type
application/javascript; charset=utf-8
last-modified
Mon, 09 Dec 2024 13:03:17 UTC
x-amz-replication-status
COMPLETED
x-evy-trace-route-service-name
envoyset-translator
cache-control
s-maxage=600, max-age=300
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-856d8787d5-fngld
x-envoy-upstream-service-time
7
x-hs-target-asset
collected-forms-embed-js/static-1.1112/bundles/project.js
server
cloudflare
x-evy-trace-virtual-host
all
x-amz-server-side-encryption
AES256
access-control-max-age
3000
access-control-allow-methods
GET
x-hs-cache-status
MISS
date
Tue, 24 Dec 2024 08:06:40 GMT
vary
Origin,Access-Control-Request-Headers,Access-Control-Request-Method,accept-encoding
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=collected-forms-embed-js/static-1.1112/bundles/project.js&cfRay=8f1d79284e01288c-MIA
via
1.1 3042bd56e0ca0a7910df89f6b5e95e9e.cloudfront.net (CloudFront)
cf-ray
8f6f17e9db347481-MIA
access-control-allow-origin
*
x-evy-trace-route-configuration
listener_https/all
x-amz-cf-pop
IAD12-P3
leadflows.js
js.hsleadflows.net/
550 KB
92 KB
Script
General
Full URL
https://js.hsleadflows.net/leadflows.js
Requested by
Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/3911692.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:8d11 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7da57a437a999e2503178063a85ca9557211686f50d7671db0142a2ceb3095d2
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://www.huntress.com
Referer
https://www.huntress.com/

Response headers

x-request-id
ced6db16-70a4-4882-ab0f-0ac331f1558b
content-encoding
gzip
cf-cache-status
HIT
etag
W/"e9829c28fae41e369bd948323746cc37"
x-amz-version-id
PqQn.3x38ZWRmSYb9J2u1wYA9Etnh36Z
cache-tag
staticjsapp-lead-flows-cloudflare-web-prod,staticjsapp-prod
age
54785
x-content-type-options
nosniff
x-cache
Miss from cloudfront
x-evy-trace-listener
listener_https
x-amz-cf-id
D8ILFy1iU3Jm84dZ9YQghUzRlXK0NMJzHlFiMXkywodiFwztU09c9Q==
x-hubspot-correlation-id
ced6db16-70a4-4882-ab0f-0ac331f1558b
content-type
application/javascript; charset=utf-8
last-modified
Thu, 12 Dec 2024 15:49:15 UTC
x-amz-replication-status
COMPLETED
x-evy-trace-route-service-name
envoyset-translator
cache-control
s-maxage=86400, max-age=0
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-856d8787d5-4wq5t
x-envoy-upstream-service-time
1
x-hs-target-asset
lead-flows-js/static-1.2121/bundle/main/lead-flows-release.js
server
cloudflare
x-evy-trace-virtual-host
all
x-amz-server-side-encryption
AES256
x-hs-cache-status
HIT
date
Tue, 24 Dec 2024 08:06:40 GMT
vary
accept-encoding
content-security-policy-report-only
frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=lead-flows-js/static-1.2121/bundle/main/lead-flows-release.js&cfRay=8f0edd948c23ac7e-IAD
via
1.1 a4f9ca051b97c1ac09e2af244690d376.cloudfront.net (CloudFront)
cf-ray
8f6f17e9dbbca548-MIA
access-control-allow-origin
*
x-evy-trace-route-configuration
listener_https/all
x-amz-cf-pop
IAD12-P3
3911692.js
js.hs-banner.com/
61 KB
19 KB
Script
General
Full URL
https://js.hs-banner.com/3911692.js
Requested by
Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/3911692.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::ac40:9310 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
7f48f3ce60332f4b98af436696611cd315285ad19d4468af784e80a8f073d4b7

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

x-evy-trace-virtual-host
all
access-control-max-age
604800
x-request-id
9b292a80-102a-4e0b-be58-11b523cc83e8
access-control-expose-headers
x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
content-encoding
gzip
cf-cache-status
HIT
etag
W/"b128bbf7c2234d4c57e04a5b6c8d9266"
x-amz-version-id
j9zyCm8TDW_34QTW1jG2qMusYlqumORs
age
202
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
expires
Tue, 24 Dec 2024 08:08:18 GMT
x-evy-trace-listener
listener_https
date
Tue, 24 Dec 2024 08:06:40 GMT
x-hubspot-correlation-id
9b292a80-102a-4e0b-be58-11b523cc83e8
content-type
text/javascript; charset=UTF-8
last-modified
Wed, 11 Dec 2024 18:12:30 GMT
vary
origin, Accept-Encoding
x-amz-id-2
/VTBN1t1r+xVI/XLnCLvMl0xqtCtjWdNyEArIxymeJIWWZEcog9oiqitBM5hrVA+yKlDP2J/YlL/oSobJJhPBvdwq/NcawVg
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
x-evy-trace-route-service-name
envoyset-translator
cache-control
max-age=300,public
timing-allow-origin
*
x-evy-trace-served-by-pod
iad02/analytics-js-proxy-td/envoy-proxy-8586d94f84-nm6jr
x-envoy-upstream-service-time
45
access-control-allow-credentials
true
x-amz-request-id
T1B4A7KBB22NV7Q7
cf-ray
8f6f17e9d942da53-MIA
access-control-allow-origin
https://www.huntress.com
x-evy-trace-route-configuration
listener_https/all
server
cloudflare
x-amz-server-side-encryption
AES256
collect
www.google.com/ccm/
0
0
Ping
General
Full URL
https://www.google.com/ccm/collect?en=page_view&dl=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fthreat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild&scrsrc=www.googletagmanager.com&frm=0&rnd=1727602689.1735027601&dt=Cleo%20Software%20Actively%20Being%20Exploited%20in%20the%20Wild%20CVE-2024-55956%20%7C%20Huntress&auid=1724909886.1735027601&navt=n&npa=0&gtm=45He4cc1v9171248136za200&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&tft=1735027600856&tfd=4503&apve=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXRTDGW4
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.65.164 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s71-in-f4.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

js
www.googletagmanager.com/gtag/
438 KB
137 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-GCTMBVFESS&l=dataLayer&cx=c&gtm=45He4cc1v9171248136za200
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXRTDGW4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80d::2008 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
ed9fa70145ee3f5fa23b5bb33c1a43771df4b18c2d52b921be3060dbb11855d9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

content-encoding
br
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcycc:838:0"}],}
expires
Tue, 24 Dec 2024 08:06:40 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 24 Dec 2024 08:06:40 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcycc:838:0
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
139734
x-xss-protection
0
server
Google Tag Manager
destination
www.googletagmanager.com/gtag/
289 KB
99 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/destination?id=AW-429191348&l=dataLayer&cx=c&gtm=45He4cc1v9171248136za200
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXRTDGW4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80d::2008 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
112cd29ef362c35c4c9ebe4806e6a678d5e62ec0d68d30b55ba584190b18d795
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

content-encoding
br
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgcysghrgc:42:0"}],}
expires
Tue, 24 Dec 2024 08:06:40 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 24 Dec 2024 08:06:40 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
last-modified
Tue, 24 Dec 2024 06:00:00 GMT
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgcysghrgc:42:0
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
101478
x-xss-protection
0
server
Google Tag Manager
insight.min.js
snap.licdn.com/li.lms-analytics/
19 KB
7 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXRTDGW4
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:1c00:6::17df:d105 Secaucus, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software
/
Resource Hash
6c0d4e3bd890a4bf01c9a301d3e3ff127af22636c4f94250cc230815eb701593
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

cache-control
max-age=15712
content-encoding
gzip
x-cdn
AKAM
x-content-type-options
nosniff
accept-ranges
bytes
content-length
7404
date
Tue, 24 Dec 2024 08:06:41 GMT
last-modified
Wed, 18 Dec 2024 08:42:17 GMT
content-type
application/javascript;charset=utf-8
vary
Accept-Encoding
x-amz-server-side-encryption
AES256
pixel.js
www.redditstatic.com/ads/
43 KB
13 KB
Script
General
Full URL
https://www.redditstatic.com/ads/pixel.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXRTDGW4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
snooserv /
Resource Hash
10429db431cbd2fc042c7397c8f1e62996d636ddeef2702c912d9fb7fc650c35

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

cache-control
public, max-age=60
nel
{"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
content-encoding
gzip
etag
"1a001f3a066bff47a766099b87253911"
report-to
{"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
content-length
12220
date
Tue, 24 Dec 2024 08:06:40 GMT
last-modified
Mon, 18 Nov 2024 21:16:35 GMT
content-type
application/javascript
vary
Accept-Encoding,Origin
server
snooserv
x-amz-server-side-encryption
AES256
qevents.js
a.quora.com/
0
0

fbevents.js
connect.facebook.net/en_US/
239 KB
61 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
31.13.65.7 Lithia Springs, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
xx-fbcdn-shv-01-atl3.fbcdn.net
Software
/
Resource Hash
24751cbae618f6fbeb532498fd1ceeda5350f30085086cd5426961a2695e3d9f
Security Headers
Name Value
Content-Security-Policy default-src 'self' data: blob: *;script-src 'nonce-rN0JIFZ4' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

content-encoding
gzip
report-to
{"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options
nosniff
expires
Sat, 01 Jan 2000 00:00:00 GMT
alt-svc
h3=":443"; ma=86400
date
Tue, 24 Dec 2024 08:06:40 GMT
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
priority
u=3,i
x-frame-options
DENY
strict-transport-security
max-age=31536000; preload; includeSubDomains
reporting-endpoints
coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy
default-src 'self' data: blob: *;script-src 'nonce-rN0JIFZ4' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control
public, max-age=1200
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
x-fb-connection-quality
EXCELLENT; q=0.9, rtt=42, rtx=0, c=23, mss=1232, tbw=4495, tp=9, tpl=0, uplat=0, ullat=-1
pragma
public
x-fb-debug
nsyylflQ6K+28oxmuqf9e3aV8K+GRD7QMb+mxL3b6sQSkGCgFWHyPqShS5IOteSqCehroepYLQZoyp9y/cKfVw==
cross-origin-resource-policy
cross-origin
permissions-policy
accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
x-fb-optimizer
0
document-policy
force-load-at-top
content-length
62282
x-xss-protection
0
origin-agent-cluster
?1
e666a54d-ff29-48f9-9baa-2be6ac05412e.js
j.6sc.co/j/
837 B
817 B
Script
General
Full URL
https://j.6sc.co/j/e666a54d-ff29-48f9-9baa-2be6ac05412e.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXRTDGW4
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.200.88.71 Secaucus, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
a23-200-88-71.deploy.static.akamaitechnologies.com
Software
AmazonS3 /
Resource Hash
82ba33778a6595a59baef6e6964c64d7c3e9888c2bbf74461f1948b295db28e2

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

content-encoding
gzip
etag
"29df5bb770be8e518fe2206581f712a6"
x-amz-version-id
iBgsOgE4Kr3Z0Ccj2rm1wK8VxmZ_A29h
expires
Tue, 24 Dec 2024 08:36:41 GMT
x-amz-cf-id
vCyzFzE25JCR309ox7AiDmm_BRxll9PE8EICCy-Lnpek5NcpQC2C2Q==
date
Tue, 24 Dec 2024 08:06:41 GMT
last-modified
Fri, 18 Aug 2023 17:22:32 GMT
vary
Accept-Encoding
content-type
application/javascript
x-amz-meta-content-type
application/json
cache-control
private, max-age=1800
accept-ranges
bytes
content-length
438
x-amz-cf-pop
JFK50-P6
server
AmazonS3
x-amz-server-side-encryption
AES256
hotjar-2159185.js
static.hotjar.com/c/
14 KB
6 KB
Script
General
Full URL
https://static.hotjar.com/c/hotjar-2159185.js?sv=6
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.33.252.127 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-33-252-127.jfk50.r.cloudfront.net
Software
/
Resource Hash
5932f75a425a9c8d1c5b8bfd25777b5ce5af01f596e925ee8c393a7dee1e3a5b
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

content-encoding
br
etag
W/fec8e523304b71381dda58461bf1eeb3
age
11
x-content-type-options
nosniff
x-cache-hit
1
x-cache
Hit from cloudfront
x-amz-cf-id
kEfj0ulfkgzjDFlftJdWQpJ6RVRKtxPdYTTuV8dq8tqVnNrCDrX6HA==
date
Tue, 24 Dec 2024 08:06:30 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
strict-transport-security
max-age=2592000; includeSubDomains
cache-control
max-age=60
cross-origin-resource-policy
cross-origin
via
1.1 7ea7b08f7e1d26433f5be7f6d4283d3c.cloudfront.net (CloudFront)
access-control-allow-origin
*
x-amz-cf-pop
JFK50-P10
NeverBounce.js
cdn.neverbounce.com/widget/dist/
96 KB
29 KB
Script
General
Full URL
https://cdn.neverbounce.com/widget/dist/NeverBounce.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXRTDGW4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.106.78 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-108-138-106-78.jfk50.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
c99d11cb4960d6e1918ed55d5bcbb316d38b51098e2efc1201904d7274d3273e

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

x-amz-cf-pop
JFK50-P3
content-encoding
gzip
x-amz-version-id
null
etag
W/"c1e06621030dfcba15b88abbcaa546eb"
age
75671
via
1.1 84fd743af5e8639c32332cec06beef46.cloudfront.net (CloudFront)
x-cache
Hit from cloudfront
x-amz-cf-id
AIL8VymvBYsU1zWVgEwBNKjdkKQiXiS_W-H3aBON6dcZhfbhKKDQbg==
date
Mon, 23 Dec 2024 11:05:31 GMT
content-type
application/javascript
vary
accept-encoding
server
AmazonS3
last-modified
Mon, 02 Mar 2020 18:37:33 GMT
tracking.js
trk.techtarget.com/
3 KB
2 KB
Script
General
Full URL
https://trk.techtarget.com/tracking.js
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1347 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e
Security Headers
Name Value
Strict-Transport-Security max-age=0; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

strict-transport-security
max-age=0; includeSubDomains; preload
cache-control
public, max-age=1200
content-encoding
br
cf-cache-status
HIT
age
83404
via
1.1 google
cf-ray
8f6f17eac84d7436-MIA
expires
Tue, 24 Dec 2024 08:26:41 GMT
date
Tue, 24 Dec 2024 08:06:41 GMT
content-type
text/javascript
last-modified
Tue, 13 Dec 2022 15:01:39 GMT
vary
Accept-Encoding
server
cloudflare
events.js
tags.srv.stackadapt.com/
22 KB
7 KB
Script
General
Full URL
https://tags.srv.stackadapt.com/events.js
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.196.12.18 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-196-12-18.compute-1.amazonaws.com
Software
/
Resource Hash
c82da715fa06b3537fad12eafa4ec2fd0031dc426b1d7cf10214786c8e629b60

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

access-control-allow-origin
*
cache-control
max-age=5
content-encoding
gzip
date
Tue, 24 Dec 2024 08:06:41 GMT
content-type
text/javascript
bat.js
bat.bing.com/
50 KB
15 KB
Script
General
Full URL
https://bat.bing.com/bat.js
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
aabc88a6db8b22022f96ca88e4f0a7be426abef2b35169a71515a2d55246402a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
private,max-age=1800
content-encoding
gzip
etag
"028e0691d20db1:0"
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: B4AD14A731A343A2A583A0358F203EE8 Ref B: MIAEDGE1820 Ref C: 2024-12-24T08:06:41Z
accept-ranges
bytes
x-cache
CONFIG_NOCACHE
content-length
14570
date
Tue, 24 Dec 2024 08:06:40 GMT
content-type
application/javascript
last-modified
Wed, 16 Oct 2024 22:47:44 GMT
vary
Accept-Encoding
ping.min.js
pixel.byspotify.com/
24 KB
24 KB
Script
General
Full URL
https://pixel.byspotify.com/ping.min.js
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.117.162.98 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
98.162.117.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
c68a273bf2b08c99c46ac43d1059b8067818b3b889fa890b068d942a957a000c

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

x-goog-metageneration
1
x-goog-hash
crc32c=NtYn9w==, md5=oynavh2gmdRzy/fdj9RC1Q==
etag
"a329dabe1da099d473cbf7dd8fd442d5"
age
728
x-goog-stored-content-encoding
identity
expires
Tue, 24 Dec 2024 08:54:33 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length
24187
date
Tue, 24 Dec 2024 07:54:33 GMT
last-modified
Wed, 04 Dec 2024 19:07:47 GMT
content-type
text/javascript
x-guploader-uploadid
AFiumC6u6fxgDlRx8HO83mLFdC6haR7HbGqKoI0nWcU6baoA3OqKTyzk4Wr39LHZcpELTJfD
cache-control
public, max-age=3600
x-goog-storage-class
STANDARD
via
1.1 google
accept-ranges
bytes
x-goog-generation
1733339267254009
content-length
24187
server
UploadServer
1006267.js
tracking.g2crowd.com/attribution_tracking/conversions/
2 KB
2 KB
Script
General
Full URL
https://tracking.g2crowd.com/attribution_tracking/conversions/1006267.js?p=https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2&e=
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6812:1fb0 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
51ca3efdd5899fe7cadf8a244b247ca13b89ff6b322b2ca12758322db8da042a
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

content-encoding
br
x-permitted-cross-domain-policies
none
x-content-type-options
nosniff
date
Tue, 24 Dec 2024 08:06:41 GMT
content-type
text/javascript;charset=UTF-8
content-disposition
inline
vary
Origin, Accept-Encoding
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=15552000; includeSubDomains
x-dns-prefetch-control
off
cross-origin-opener-policy
same-origin
cross-origin-resource-policy
cross-origin
referrer-policy
no-referrer
x-download-options
noopen
cf-ray
8f6f17eb2b2ddb0d-MIA
access-control-allow-origin
*
x-xss-protection
0
origin-agent-cluster
?1
server
cloudflare
uwt.js
static.ads-twitter.com/
57 KB
16 KB
Script
General
Full URL
https://static.ads-twitter.com/uwt.js
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
146.75.36.157 Reston, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
d4963b8afebfa0063b5d17b4c80f49bce702a37ea5c9b91bb3c996bb9dea4b60

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

vary
Accept-Encoding,Host
cache-control
no-cache
content-encoding
gzip
etag
"4328e910de583ad53b3a7a76455af005+gzip"
accept-ranges
bytes
x-cache
HIT
p3p
CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT"
content-length
15926
date
Tue, 24 Dec 2024 08:06:41 GMT
x-tw-cdn
FT
last-modified
Tue, 29 Oct 2024 01:22:31 GMT
content-type
application/javascript; charset=utf-8
x-served-by
cache-iad-kcgs7200136-IAD
x-amz-server-side-encryption
AES256
pixel
q.quora.com/_/ad/83f2d51fb0164c438fbdaa8c29ed2e5e/
43 B
306 B
Image
General
Full URL
https://q.quora.com/_/ad/83f2d51fb0164c438fbdaa8c29ed2e5e/pixel?tag=ViewContent&i=gtm&u=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fthreat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild%3Fis%3D3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
162.159.153.247 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
cf-cache-status
DYNAMIC
x-q-stat
,b5dd63804050f2f70a947dfc46f62adf,10.0.0.67,59924,38.132.118.70,,316410076341,1,1735027601.171,0.002,,.,0,0,0.000,0.000,-,0,0,203,195,97,10,34729,,,,,,-,
cf-ray
8f6f17eb29674c0d-MIA
alt-svc
h3=":443"; ma=86400
content-length
43
date
Tue, 24 Dec 2024 08:06:41 GMT
content-type
image/gif
server
cloudflare
24c56ada-3442-4637-bd3c-b168a4e799a9
https://www.huntress.com/ Frame
0
0

anchor
www.google.com/recaptcha/api2/ Frame 7AFA
0
0
Document
General
Full URL
https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LchEywUAAAAAAdAXlscEm7Kcb3DJ38pngRCQJsC&co=aHR0cHM6Ly93d3cuaHVudHJlc3MuY29tOjQ0Mw..&hl=en&v=zIriijn3uj5Vpknvt_LnfNbF&theme=dark&size=normal&cb=in7wa7ba5h6y
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/zIriijn3uj5Vpknvt_LnfNbF/recaptcha__en.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.65.164 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s71-in-f4.1e100.net
Software
ESF /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-eBLVVT091Yw5yks2VToCSA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.huntress.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-security-policy
script-src 'report-sample' 'nonce-eBLVVT091Yw5yks2VToCSA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-opener-policy-report-only
same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy
cross-origin
date
Tue, 24 Dec 2024 08:06:41 GMT
expires
Mon, 01 Jan 1990 00:00:00 GMT
pragma
no-cache
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server
ESF
x-content-type-options
nosniff
x-xss-protection
0
sw_iframe.html
www.googletagmanager.com/static/service_worker/4cc0/ Frame 473D
0
0
Document
General
Full URL
https://www.googletagmanager.com/static/service_worker/4cc0/sw_iframe.html?origin=https%3A%2F%2Fwww.huntress.com
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-TXRTDGW4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80d::2008 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
age
399940
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
public, max-age=31536000
content-encoding
br
content-length
1476
content-type
text/html
cross-origin-opener-policy
same-origin; report-to="analytics-container-tag-serving"
cross-origin-resource-policy
cross-origin
date
Thu, 19 Dec 2024 17:01:01 GMT
expires
Fri, 19 Dec 2025 17:01:01 GMT
last-modified
Thu, 12 Dec 2024 10:18:00 GMT
report-to
{"group":"analytics-container-tag-serving","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/analytics-container-tag-serving"}]}
server
sffe
service-worker-allowed
/static/service_worker
vary
Accept-Encoding
x-content-type-options
nosniff
x-xss-protection
0
index.umd.min.js
cdn.jsdelivr.net/npm/@snowplow/browser-plugin-button-click-tracking@latest/dist/
5 KB
2 KB
Script
General
Full URL
https://cdn.jsdelivr.net/npm/@snowplow/browser-plugin-button-click-tracking@latest/dist/index.umd.min.js
Requested by
Host: static.huntresscdn.com
URL: https://static.huntresscdn.com/3_24_2_kzhk9kjvjzpzdnk61lg3.js
Protocol
H3
Security
QUIC, , AES_256_GCM
Server
151.101.129.229 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
ce6f51ef30adef6442774f5f60a50ed096c5dc797f9dc65069538324797a2987
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

access-control-expose-headers
*
content-encoding
br
etag
W/"12b6-phdva+/Zg2zTupVqQ9j6nkTI4No"
age
5629
x-content-type-options
nosniff
x-jsd-version-type
version
alt-svc
h3=":443";ma=86400,h3-29=":443";ma=86400,h3-27=":443";ma=86400
x-cache
HIT, HIT
date
Tue, 24 Dec 2024 08:06:41 GMT
content-type
application/javascript; charset=utf-8
x-served-by
cache-fra-etou8220149-FRA, cache-mia-kmia1760081-MIA
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=604800, s-maxage=43200
timing-allow-origin
*
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
access-control-allow-origin
*
content-length
1879
x-jsd-version
4.1.0
a80de67cd3df6e48c1f5461985b686eabca45874.webp
embed-ssl.wistia.com/deliveries/
101 KB
101 KB
Image
General
Full URL
https://embed-ssl.wistia.com/deliveries/a80de67cd3df6e48c1f5461985b686eabca45874.webp?image_crop_resized=1920x1080
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:21b8:1a00:1e:c86:4140:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
envoy /
Resource Hash
47824fb47f1f4ed58e4e6ad9706eda4471ac98102e4b5dd84c180603354c9f33

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

surrogate-key
a80de67cd3df6e48c1f5461985b686eabca45874 thumbnail-delivery
etag
76lYaUqmm4Ng4lC6sLH7kow0anA=
age
566679
access-control-request-method
*
x-cache
Hit from cloudfront
x-amz-cf-id
Z-_2_wnlKvCXPI8QI4KydhdQp1cmi6njPSSHkI0ETFMVwyT6ANLGEQ==
date
Tue, 17 Dec 2024 18:42:02 GMT
content-type
image/webp
content-disposition
inline
vary
Origin
last-modified
Tue, 10 Dec 2024 02:00:19 UTC
edge-cache-tag
a80de67cd3df6e48c1f5461985b686eabca45874
cache-control
max-age=31536000
x-envoy-upstream-service-time
514
x-cdn
cloudfront
via
1.1 1e84d8aad593d115bedca1ef2da41e60.cloudfront.net (CloudFront)
accept-ranges
none
x-amz-cf-pop
JFK52-P9
server
envoy
facebookPixel.js
fast.wistia.net/assets/external/
23 KB
6 KB
Script
General
Full URL
https://fast.wistia.net/assets/external/facebookPixel.js
Requested by
Host: fast.wistia.com
URL: https://fast.wistia.com/assets/external/publicApi.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42::644 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
4dceacbf31977470786701c48799e1a24967f145f6281b421f0d48a0fd6f2ed0
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

content-encoding
br
etag
"84561462b620f556a54bfddc399a06ab"
age
276
x-cache
HIT, HIT
date
Tue, 24 Dec 2024 08:06:41 GMT
last-modified
Fri, 20 Dec 2024 20:11:38 GMT
x-served-by
cache-iad-kjyo7100179-IAD, cache-mia-kmia1760031-MIA
x-cache-hits
32, 0
content-type
text/javascript
vary
Accept-Encoding
strict-transport-security
max-age=0
cache-control
public, max-age=3600
timing-allow-origin
*
x-timer
S1735027601.151784,VS0,VE1
via
1.1 varnish, 1.1 varnish
x-browser
chrome
x-ecma-v
modern
x-browser-version
131
accept-ranges
bytes
access-control-allow-origin
*
content-length
5527
asset-version
ea49143d3ad772007b2d472dbbb9c363df7c98a6
server
AmazonS3
x-amz-server-side-encryption
AES256
googleAnalytics4.js
fast.wistia.net/assets/external/
25 KB
6 KB
Script
General
Full URL
https://fast.wistia.net/assets/external/googleAnalytics4.js
Requested by
Host: fast.wistia.com
URL: https://fast.wistia.com/assets/external/publicApi.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42::644 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
fedef5d4449d0caf6cc8c396b9a02c10e9b404c3d7293b46f501b5cba09366b8
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

content-encoding
br
etag
"f84e9f9275b3f26442d378131bb2efc0"
age
837
x-cache
HIT, HIT
date
Tue, 24 Dec 2024 08:06:41 GMT
last-modified
Fri, 20 Dec 2024 20:11:38 GMT
x-served-by
cache-iad-kiad7000173-IAD, cache-mia-kmia1760031-MIA
x-cache-hits
17, 2
content-type
text/javascript
vary
Accept-Encoding
strict-transport-security
max-age=0
cache-control
public, max-age=3600
timing-allow-origin
*
x-timer
S1735027601.151930,VS0,VE0
via
1.1 varnish, 1.1 varnish
x-browser
chrome
x-ecma-v
modern
x-browser-version
131
accept-ranges
bytes
access-control-allow-origin
*
content-length
6157
asset-version
ea49143d3ad772007b2d472dbbb9c363df7c98a6
server
AmazonS3
x-amz-server-side-encryption
AES256
view
js.hs-banner.com/cookie-banner-public/v1/activity/ Frame
0
0
Preflight
General
Full URL
https://js.hs-banner.com/cookie-banner-public/v1/activity/view
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::ac40:9310 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.huntress.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
access-control-allow-origin
https://www.huntress.com
access-control-expose-headers
x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
access-control-max-age
604800
cf-cache-status
DYNAMIC
cf-ray
8f6f17eb39fa8d97-MIA
content-length
0
content-type
application/octet-stream
date
Tue, 24 Dec 2024 08:06:41 GMT
server
cloudflare
timing-allow-origin
*
vary
origin
x-envoy-upstream-service-time
0
x-evy-trace-listener
listener_https
x-evy-trace-route-configuration
listener_https/all
x-evy-trace-route-service-name
envoyset-translator
x-evy-trace-served-by-pod
iad02/analytics-js-proxy-td/envoy-proxy-8586d94f84-l4dxl
x-evy-trace-virtual-host
all
x-hubspot-correlation-id
7f22d9e0-63ea-480c-a846-805a666c416c
x-request-id
7f22d9e0-63ea-480c-a846-805a666c416c
view
js.hs-banner.com/cookie-banner-public/v1/activity/
0
375 B
XHR
General
Full URL
https://js.hs-banner.com/cookie-banner-public/v1/activity/view
Requested by
Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:4400::ac40:9310 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type
application/json
Referer
https://www.huntress.com/

Response headers

access-control-max-age
604800
x-request-id
b9ce90c1-3970-422c-8f8f-d4e0c24ec2fa
access-control-expose-headers
x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cf-cache-status
DYNAMIC
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
x-content-type-options
nosniff
x-evy-trace-listener
listener_https
date
Tue, 24 Dec 2024 08:06:41 GMT
x-hubspot-correlation-id
b9ce90c1-3970-422c-8f8f-d4e0c24ec2fa
vary
origin
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
x-evy-trace-route-service-name
envoyset-translator
x-evy-trace-served-by-pod
iad02/analytics-js-proxy-td/envoy-proxy-8586d94f84-vkszw
timing-allow-origin
*
x-envoy-upstream-service-time
15
access-control-allow-credentials
true
cf-ray
8f6f17ebba148d97-MIA
access-control-allow-origin
https://www.huntress.com
x-evy-trace-route-configuration
listener_https/all
server
cloudflare
x-evy-trace-virtual-host
all
combinedConfigs
cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/
61 B
1 KB
Fetch
General
Full URL
https://cta-service-cms2.hubspot.com/web-interactives/public/v1/embed/combinedConfigs?portalId=3911692&currentUrl=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fthreat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild%3Fis%3D3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Requested by
Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
027f9fef93a2d620715de7311a5bf674cb3df18a352d2a0a7266c147c157333f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

x-robots-tag
noindex, follow
access-control-max-age
180
x-request-id
d26451b7-f22d-42d2-b0ad-4ee090019fe2
content-encoding
br
cf-cache-status
DYNAMIC
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=3JzHoFlvagCAnEpoAkAKC567u2S%2BWsNZYBbA6ni4t1mKcLdSMdnhXQRMXbdkqbkQkxAu3AyFPUfAHGlwZZT9xH1tNC6K%2FQqofes75J0hwRQquKwxe%2Bv5Zc%2BoxFKtNJaPQzqHQ2G4RwoNMWrj5Xhs%2FtWFW0Lb1qt6L88%3D"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
access-control-allow-methods
OPTIONS, GET
x-evy-trace-listener
listener_https
date
Tue, 24 Dec 2024 08:06:41 GMT
x-hubspot-correlation-id
d26451b7-f22d-42d2-b0ad-4ee090019fe2
content-type
application/json;charset=utf-8
vary
origin
access-control-allow-headers
Accept, Accept-Charset, Accept-Encoding, Accept-Language, Content-Type, Host, Origin, Referer, User-Agent
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name
envoyset-translator
cache-control
max-age=0, no-cache, no-store
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod
iad02/star-hubspot-td/envoy-proxy-b967ccf5d-tw288
x-envoy-upstream-service-time
7
access-control-allow-credentials
true
cf-ray
8f6f17eb19d1da53-MIA
access-control-allow-origin
https://www.huntress.com
x-evy-trace-route-configuration
listener_https/all
server
cloudflare
x-evy-trace-virtual-host
all
config
pixel-config.reddit.com/pixels/t2_12z44i/
3 B
124 B
XHR
General
Full URL
https://pixel-config.reddit.com/pixels/t2_12z44i/config
Requested by
Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.140 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

cache-control
max-age=14400
content-encoding
gzip
via
1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
27
date
Tue, 24 Dec 2024 08:06:41 GMT
content-type
application/json
t2_12z44i_telemetry
www.redditstatic.com/ads/conversions-config/v1/pixel/config/
86 B
700 B
XHR
General
Full URL
https://www.redditstatic.com/ads/conversions-config/v1/pixel/config/t2_12z44i_telemetry
Requested by
Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42::396 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
snooserv /
Resource Hash
98d77039ea9249b3dce91ad7b467ee382f29daa61213c3e2737bd4a8786c8801

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

cache-control
max-age=300
nel
{"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
content-encoding
gzip
report-to
{"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
via
1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
98
date
Tue, 24 Dec 2024 08:06:41 GMT
content-type
application/json
vary
Accept-Encoding,Origin
server
snooserv
rp.gif
alb.reddit.com/
42 B
637 B
Image
General
Full URL
https://alb.reddit.com/rp.gif?ts=1735027601117&id=t2_12z44i&event=PageVisit&m.itemCount=undefined&m.value=&m.valueDecimal=undefined&m.currency=undefined&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=f79df72e-0758-4f3f-b6a8-39b42bf5769a&aaid=&em=&external_id=&idfa=&integration=gtm&opt_out=0&sh=1600&sw=1200&v=rdt_b192616d&dpm=&dpcc=&dprc=
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.140 San Francisco, United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Varnish /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

nel
{"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
retry-after
0
cross-origin-resource-policy
cross-origin
report-to
{"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
via
1.1 varnish
accept-ranges
bytes
content-length
42
date
Tue, 24 Dec 2024 08:06:41 GMT
content-type
image/gif
server
Varnish
collect
analytics.google.com/g/
0
555 B
Fetch
General
Full URL
https://analytics.google.com/g/collect?v=2&tid=G-GCTMBVFESS&gtm=45je4cc1v9122196611z89171248136za200zb9171248136&_p=1735027600107&_gaz=1&gcd=13l3l3l3l1l1&npa=0&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&cid=1059849745.1735027601&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&pae=1&frm=0&pscdl=noapi&_s=1&sid=1735027601&sct=1&seg=0&dl=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fthreat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild%3Fis%3D3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2&dt=Cleo%20Software%20Actively%20Being%20Exploited%20in%20the%20Wild%20CVE-2024-55956%20%7C%20Huntress&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=4842
Requested by
Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2001:4860:4802:32::181 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:136:0
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:136:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://www.huntress.com
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 24 Dec 2024 08:06:41 GMT
content-type
text/plain
server
Golfe2
collect
stats.g.doubleclick.net/g/
0
546 B
Ping
General
Full URL
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-GCTMBVFESS&cid=1059849745.1735027601&gtm=45je4cc1v9122196611z89171248136za200zb9171248136&aip=1&dma=0&gcd=13l3l3l3l1l1&npa=0&frm=0&tag_exp=101925629~102067555~102067808~102081485~102198178
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-GCTMBVFESS&l=dataLayer&cx=c&gtm=45He4cc1v9171248136za200
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4004:c06::9a Washington, United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:111:0
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:111:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://www.huntress.com
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 24 Dec 2024 08:06:41 GMT
content-type
text/plain
server
Golfe2
rul
td.doubleclick.net/td/ga/ Frame 1638
0
0
Document
General
Full URL
https://td.doubleclick.net/td/ga/rul?tid=G-GCTMBVFESS&gacid=1059849745.1735027601&gtm=45je4cc1v9122196611z89171248136za200zb9171248136&dma=0&gcd=13l3l3l3l1l1&npa=0&pscdl=noapi&aip=1&fledge=1&frm=0&tag_exp=101925629~102067555~102067808~102081485~102198178&z=1766909564
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-GCTMBVFESS&l=dataLayer&cx=c&gtm=45He4cc1v9171248136za200
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2607:f8b0:4006:80e::2002 , United States, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.huntress.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, must-revalidate
content-encoding
br
content-length
16
content-type
text/html; charset=UTF-8
cross-origin-resource-policy
cross-origin
date
Tue, 24 Dec 2024 08:06:41 GMT
expires
Fri, 01 Jan 1990 00:00:00 GMT
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
pragma
no-cache
server
cafe
timing-allow-origin
*
x-content-type-options
nosniff
x-xss-protection
0
403957864408442
connect.facebook.net/signals/config/
79 KB
16 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/403957864408442?v=2.9.179&r=stable&domain=www.huntress.com&hme=b8122d5d96cd6f542162ba4f497489972d1ebe228d24c39d34f560e30ae932ce&ex_m=70%2C122%2C107%2C111%2C61%2C4%2C100%2C69%2C16%2C97%2C89%2C51%2C54%2C173%2C176%2C188%2C184%2C185%2C187%2C29%2C101%2C53%2C77%2C186%2C168%2C171%2C181%2C182%2C189%2C132%2C41%2C191%2C192%2C34%2C144%2C15%2C50%2C197%2C196%2C134%2C18%2C40%2C1%2C43%2C65%2C66%2C67%2C71%2C93%2C17%2C14%2C96%2C92%2C91%2C108%2C52%2C110%2C39%2C109%2C30%2C94%2C26%2C169%2C172%2C141%2C86%2C56%2C84%2C33%2C73%2C0%2C95%2C32%2C28%2C82%2C83%2C88%2C47%2C46%2C87%2C37%2C11%2C12%2C13%2C6%2C7%2C25%2C22%2C23%2C57%2C62%2C64%2C75%2C102%2C27%2C76%2C9%2C8%2C80%2C48%2C21%2C104%2C103%2C105%2C98%2C10%2C20%2C3%2C38%2C74%2C19%2C5%2C90%2C81%2C44%2C35%2C85%2C2%2C36%2C63%2C42%2C106%2C45%2C79%2C68%2C112%2C60%2C59%2C31%2C99%2C58%2C55%2C49%2C78%2C72%2C24%2C113
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
31.13.65.7 Lithia Springs, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
xx-fbcdn-shv-01-atl3.fbcdn.net
Software
/
Resource Hash
e4fd04a54ebf90f08e74b2ad14620a2da4b21d15f5ff5a6fbbe2bab5da5aec41
Security Headers
Name Value
Content-Security-Policy default-src 'self' data: blob: *;script-src 'nonce-cNL7uNqG' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

content-encoding
gzip
report-to
{"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options
nosniff
expires
Sat, 01 Jan 2000 00:00:00 GMT
alt-svc
h3=":443"; ma=86400
date
Tue, 24 Dec 2024 08:06:41 GMT
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
priority
u=3,i
x-frame-options
DENY
strict-transport-security
max-age=31536000; preload; includeSubDomains
reporting-endpoints
coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy
default-src 'self' data: blob: *;script-src 'nonce-cNL7uNqG' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: data: 'self' https://*.google-analytics.com *.google.com;style-src data: blob: 'unsafe-inline' *;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' https://*.google-analytics.com;img-src 'self' data: blob: * https://*.google-analytics.com;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control
public, max-age=1200
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
x-fb-connection-quality
EXCELLENT; q=0.9, rtt=42, rtx=0, c=77, mss=1232, tbw=70511, tp=65, tpl=0, uplat=4, ullat=-1
pragma
public
x-fb-debug
+FgX9DLFnlhAzcMjVHSvVmiSihd+LJ0hSr/yHWJTAjhie4YMjf4iFYiHxz80kTjaYJeKi7YsqunMnLHHeQ+UCw==
cross-origin-resource-policy
cross-origin
permissions-policy
accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy
force-load-at-top
content-length
15995
x-xss-protection
0
origin-agent-cluster
?1
json
forms.hscollectedforms.net/collected-forms/v1/config/
133 B
658 B
XHR
General
Full URL
https://forms.hscollectedforms.net/collected-forms/v1/config/json?portalId=3911692&utk=
Requested by
Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:6efe , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
543351d4360e32621e4bb7588aa7b81d1fbc027c580a6246938e3fc8a2dfedcc
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept
application/json, text/plain, */*
Referer
https://www.huntress.com/

Response headers

x-robots-tag
none
access-control-max-age
180
x-request-id
49f0eb7d-18fb-4009-9fa4-b95436135c98
content-encoding
br
cf-cache-status
DYNAMIC
access-control-allow-methods
GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
x-content-type-options
nosniff
x-evy-trace-listener
listener_https
date
Tue, 24 Dec 2024 08:06:41 GMT
x-hubspot-correlation-id
49f0eb7d-18fb-4009-9fa4-b95436135c98
content-type
application/json;charset=utf-8
vary
Accept-Encoding
access-control-allow-headers
*
x-evy-trace-route-service-name
envoyset-translator
cache-control
max-age=0
x-evy-trace-served-by-pod
iad02/app-td/envoy-proxy-856d8787d5-fpplf
x-envoy-upstream-service-time
3
cf-ray
8f6f17ec4c817481-MIA
access-control-allow-origin
https://www.huntress.com
x-evy-trace-route-configuration
listener_https/all
server
cloudflare
x-evy-trace-virtual-host
all
429191348
google.com/pagead/form-data/
0
0
Ping
General
Full URL
https://google.com/pagead/form-data/429191348?gtm=45be4cc1pfv9136018371z89171248136za201zb9171248136&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&npa=0&frm=0&pscdl=noapi&auid=1724909886.1735027601&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ec_mode=m&em=tv.1~pn.e0~fn0.dCNOmK_nSY-12vHzasLXiswzlGT5UHA7jAGYkvmCuQs~ln0.dCNOmK_nSY-12vHzasLXiswzlGT5UHA7jAGYkvmCuQs~co0.null
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=AW-429191348&l=dataLayer&cx=c&gtm=45He4cc1v9171248136za200
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.72.110 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s32-in-f14.1e100.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

429191348
google.com/ccm/form-data/
0
20 B
Ping
General
Full URL
https://google.com/ccm/form-data/429191348?gtm=45be4cc1pfv9136018371z89171248136za201zb9171248136&gcd=13l3l3l3l1l1&dma=0&tag_exp=101925629~102067555~102067808~102081485~102198178&npa=0&frm=0&pscdl=noapi&auid=1724909886.1735027601&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&ec_mode=m&ecsid=1913920476.1735027601&em=tv.1~pn.e0~fn0.dCNOmK_nSY-12vHzasLXiswzlGT5UHA7jAGYkvmCuQs~ln0.dCNOmK_nSY-12vHzasLXiswzlGT5UHA7jAGYkvmCuQs~co0.null
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=AW-429191348&l=dataLayer&cx=c&gtm=45He4cc1v9171248136za200
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.72.110 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga34s32-in-f14.1e100.net
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:57:0
report-to
{"group":"coop_reporting","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:57:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://www.huntress.com
cross-origin-opener-policy-report-only
same-origin; report-to=coop_reporting
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 24 Dec 2024 08:06:41 GMT
content-type
text/plain
server
Golfe2
insight.old.min.js
snap.licdn.com/li.lms-analytics/
40 KB
14 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.old.min.js
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:1c00:6::17df:d105 Secaucus, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software
/
Resource Hash
e6b8a90a2870483ace67380ff4a64b39bfecb7952a432393470d76a6614fc62c
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

cache-control
max-age=16923
content-encoding
gzip
x-cdn
AKAM
x-content-type-options
nosniff
accept-ranges
bytes
content-length
14634
date
Tue, 24 Dec 2024 08:06:41 GMT
last-modified
Mon, 02 Dec 2024 19:22:52 GMT
content-type
application/javascript;charset=utf-8
vary
Accept-Encoding
x-amz-server-side-encryption
AES256
gif.gif
ibc-flow.techtarget.com/a/
43 B
439 B
XHR
General
Full URL
https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=17715818&r=1735027601338&ref=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fthreat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild%3Fis%3D3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2&version=2.4
Requested by
Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
231.208.111.34.bc.googleusercontent.com
Software
nginx/1.20.2 /
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
ibc_rate_tier
17715818
Referer
https://www.huntress.com/

Response headers

x-goog-metageneration
1
x-goog-hash
crc32c=7uenZA==, md5=/JT7DD7YqPkJ28djCgmH/w==
etag
"fc94fb0c3ed8a8f909dbc7630a0987ff"
access-control-allow-methods
GET, POST, OPTIONS
x-goog-stored-content-encoding
identity
expires
Tue, 24 Dec 2024 09:06:41 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length
43
date
Tue, 24 Dec 2024 08:06:41 GMT
content-type
image/gif
last-modified
Thu, 08 Dec 2022 21:19:29 GMT
vary
Origin
x-guploader-uploadid
AFiumC4q662HauU-FZjgCyuqlDi0xtuEVQsdT0S7QcnTn5vVWy8WLJ-lZ51HwmIITnSq9FI5
access-control-allow-headers
ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
cache-control
public, max-age=3600
x-goog-storage-class
STANDARD
via
1.1 google
accept-ranges
bytes
access-control-allow-origin
*
x-goog-generation
1670534369365034
content-length
43
server
nginx/1.20.2
gif.gif
ibc-flow.techtarget.com/a/ Frame
0
0
Preflight
General
Full URL
https://ibc-flow.techtarget.com/a/gif.gif?actTypeId=31&cid=17715818&r=1735027601338&ref=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fthreat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild%3Fis%3D3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2&version=2.4
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.111.208.231 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
231.208.111.34.bc.googleusercontent.com
Software
nginx/1.20.2 /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
ibc_rate_tier
Access-Control-Request-Method
GET
Origin
https://www.huntress.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-headers
ibc_header,ibc_rate_tier,User-Agent,X-Requested-With,Cache-Control,Content-Type,Range
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
private, max-age=0
content-length
0
content-type
text/html; charset=UTF-8
date
Tue, 24 Dec 2024 08:06:41 GMT
expires
Tue, 24 Dec 2024 08:06:41 GMT
server
nginx/1.20.2
vary
Origin
via
1.1 google
x-guploader-uploadid
AFiumC5C_Z2aNZFQbfinf_V5zWEUBK0C7YIAAiwSB9BGQNEVl8bxHTdoF23Zgpn7h8IDMVgG
187135658.js
bat.bing.com/p/action/
363 B
421 B
Script
General
Full URL
https://bat.bing.com/p/action/187135658.js
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
4922a8859b315c354c23ad278e35483c6cf29aebf1c509c2c928c1f41634fe43
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
private,max-age=1800
content-encoding
br
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 554F7D301B9F4B0DB4464790AF7B18AD Ref B: MIAEDGE1820 Ref C: 2024-12-24T08:06:41Z
x-cache
CONFIG_NOCACHE
date
Tue, 24 Dec 2024 08:06:40 GMT
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
sa.css
tags.srv.stackadapt.com/
65 B
203 B
Stylesheet
General
Full URL
https://tags.srv.stackadapt.com/sa.css
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.196.12.18 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-196-12-18.compute-1.amazonaws.com
Software
/
Resource Hash
3d5e2f7e7d7b47abbb9e045643f1f783327593164a1cc826823b86935ea0dc1b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

access-control-allow-origin
*
cache-control
only-if-cached, no-transform, private, max-age=7776000
content-length
65
date
Tue, 24 Dec 2024 08:06:41 GMT
content-type
text/css
sa.jpeg
tags.srv.stackadapt.com/
651 B
2 KB
Fetch
General
Full URL
https://tags.srv.stackadapt.com/sa.jpeg
Requested by
Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.196.12.18 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-196-12-18.compute-1.amazonaws.com
Software
/
Resource Hash
1e1fd2fe50ec28f7768e206d51760c817982ca62ac2b8e48f31f56576e70d28a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

access-control-allow-origin
*
cache-control
only-if-cached, no-transform, private, max-age=7776000
content-length
651
date
Tue, 24 Dec 2024 08:06:41 GMT
content-type
image/jpeg
modules.60031afbf51fb3e88a5b.js
script.hotjar.com/
223 KB
56 KB
Script
General
Full URL
https://script.hotjar.com/modules.60031afbf51fb3e88a5b.js
Requested by
Host: static.hotjar.com
URL: https://static.hotjar.com/c/hotjar-2159185.js?sv=6
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.164.96.46 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-164-96-46.jfk50.r.cloudfront.net
Software
/
Resource Hash
e38338484d969872e570a554c807dab4a79233b82d64a7cb7028fb459123d44a
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

x-robots-tag
none
content-encoding
br
etag
"b4a1a7933e55e780894c3f39b1aca0b4"
age
504934
x-content-type-options
nosniff
x-cache
Hit from cloudfront
x-amz-cf-id
hm_kqznTQ27rkh7SW0zn39PLeOxjoarF3dBDIB_2Pzm3Smqqwst91Q==
date
Wed, 18 Dec 2024 11:51:07 GMT
content-type
application/javascript; charset=utf-8
last-modified
Wed, 18 Dec 2024 11:50:24 GMT
vary
Accept-Encoding
strict-transport-security
max-age=2592000; includeSubDomains
cache-control
max-age=31536000
cross-origin-resource-policy
cross-origin
via
1.1 1abf103face183cd8172f37e6ac30038.cloudfront.net (CloudFront)
accept-ranges
bytes
access-control-allow-origin
*
content-length
56408
x-amz-cf-pop
JFK50-P5
6si.min.js
j.6sc.co/
69 KB
19 KB
Script
General
Full URL
https://j.6sc.co/6si.min.js
Requested by
Host: j.6sc.co
URL: https://j.6sc.co/j/e666a54d-ff29-48f9-9baa-2be6ac05412e.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.200.88.71 Secaucus, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
a23-200-88-71.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
420b8db005b9223c5e1d9ba4140abc2356eac8069735ad8c870fcc8313828de4
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

cache-control
private, proxy-revalidate, max-age=10800
content-encoding
gzip
etag
"6763d3a0-115be"
x-content-type-options
nosniff
expires
Tue, 24 Dec 2024 11:06:41 GMT
accept-ranges
bytes
content-length
19249
date
Tue, 24 Dec 2024 08:06:41 GMT
content-type
application/javascript
vary
Accept-Encoding
server
nginx/1.14.0 (Ubuntu)
last-modified
Thu, 19 Dec 2024 08:04:48 GMT
notify
api.neverbounce.com/v4/poe/
63 B
283 B
Script
General
Full URL
https://api.neverbounce.com/v4/poe/notify?key=public_0e95e4405380cdd75d8aa57fca3692dc&event=form.load&callback=__neverbounce_992127
Requested by
Host: cdn.neverbounce.com
URL: https://cdn.neverbounce.com/widget/dist/NeverBounce.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
44.198.96.243 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-44-198-96-243.compute-1.amazonaws.com
Software
nginx /
Resource Hash
7fe2559e602297a61f2b4b798435323cbe8e566b825e4b395e284cb9a6b8db15
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
cache-control
no-cache, private
content-encoding
gzip
x-ua-compatible
IE=Edge
date
Tue, 24 Dec 2024 08:06:41 GMT
content-type
application/javascript
vary
Accept-Encoding
server
nginx
assign
tracking-api.production.g2.com/attribution_tracking/conversions/
0
0
Ping
General
Full URL
https://tracking-api.production.g2.com/attribution_tracking/conversions/assign
Requested by
Host: tracking.g2crowd.com
URL: https://tracking.g2crowd.com/attribution_tracking/conversions/1006267.js?p=https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2&e=
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.145.131.117 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-54-145-131-117.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type
multipart/form-data; boundary=----WebKitFormBoundaryBh8wC5BcIhVyvBCI
Referer
https://www.huntress.com/

Response headers

ingest
pixels.spotify.com/v1/
52 B
271 B
Fetch
General
Full URL
https://pixels.spotify.com/v1/ingest
Requested by
Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1901:1:7c5:: , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
Software
envoy /
Resource Hash
cfae8b984e17800ed9c948b8597762d2427984b451d809ee1e1bedffa9362704
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff

Request headers

Referer
https://www.huntress.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept
application/json
Content-Type
application/json

Response headers

strict-transport-security
max-age=31536000
grpc-status
0
content-encoding
gzip
x-envoy-upstream-service-time
1
x-content-type-options
nosniff
via
HTTP/2 edgeproxy, 1.1 google
grpc-accept-encoding
gzip,x-snappy-framed
access-control-allow-origin
https://www.huntress.com
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 24 Dec 2024 08:06:41 GMT
content-type
application/json
vary
Accept-Encoding
grpc-encoding
identity
server
envoy
ingest
pixels.spotify.com/v1/ Frame
0
0
Preflight
General
Full URL
https://pixels.spotify.com/v1/ingest
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1901:1:7c5:: , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
Software
envoy /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.huntress.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-headers
content-type
access-control-allow-origin
https://www.huntress.com
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
date
Tue, 24 Dec 2024 08:06:41 GMT
server
envoy
vary
Accept-Encoding
via
HTTP/2 edgeproxy, 1.1 google
truncated
/
2 KB
2 KB
Font
General
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
14328f67af6b839ac4f57c7e5c2b32ef51e9d2d0f6532731120d1c989f8476f2

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://www.huntress.com
Referer

Response headers

Content-Type
application/x-font-woff;charset=utf-8
counters.gif
perf-na1.hsforms.com/embed/v3/
35 B
958 B
Image
General
Full URL
https://perf-na1.hsforms.com/embed/v3/counters.gif?key=config-loaded-success&value=1
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.80.204 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

x-robots-tag
none
x-request-id
ef5386ef-ad34-4642-aada-0b85975c84cb
access-control-expose-headers
X-Origin-Hublet
cf-cache-status
MISS
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
x-evy-trace-listener
listener_https
server-timing
cfExtPri
date
Tue, 24 Dec 2024 08:06:41 GMT
x-hubspot-correlation-id
ef5386ef-ad34-4642-aada-0b85975c84cb
content-type
image/gif
vary
origin, Accept-Encoding
last-modified
Tue, 24 Dec 2024 08:06:41 GMT
priority
u=3,i
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name
envoyset-translator
cache-control
max-age=0, no-cache, no-store
x-evy-trace-served-by-pod
iad02/star-hubspot-td/envoy-proxy-b967ccf5d-4nb5b
x-envoy-upstream-service-time
2
access-control-allow-credentials
false
cf-ray
8f6f17ed7a3d2588-MIA
accept-ranges
bytes
x-evy-trace-route-configuration
listener_https/all
content-length
35
server
cloudflare
x-evy-trace-virtual-host
all
/
www.facebook.com/tr/
0
16 B
Image
General
Full URL
https://www.facebook.com/tr/?id=403957864408442&ev=PageView&dl=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fthreat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild%3Fis%3D3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2&rl=&if=false&ts=1735027601461&sw=1600&sh=1200&v=2.9.179&r=stable&ec=0&o=4126&fbp=fb.1.1735027601458.420175617186782264&cs_est=true&ler=empty&cdl=API_unavailable&it=1735027601283&coo=false&rqm=GET
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
31.13.65.36 Lithia Springs, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
edge-star-mini-shv-01-atl3.facebook.com
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-fb-connection-quality
GOOD; q=0.7, rtt=53, rtx=0, c=23, mss=1232, tbw=4642, tp=12, tpl=0, uplat=0, ullat=0
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
alt-svc
h3=":443"; ma=86400
content-length
0
date
Tue, 24 Dec 2024 08:06:41 GMT
content-type
text/plain
server
proxygen-bolt
priority
u=3,i
/
www.facebook.com/privacy_sandbox/pixel/register/trigger/
67 B
196 B
Image
General
Full URL
https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=403957864408442&ev=PageView&dl=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fthreat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild%3Fis%3D3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2&rl=&if=false&ts=1735027601461&sw=1600&sh=1200&v=2.9.179&r=stable&ec=0&o=4126&fbp=fb.1.1735027601458.420175617186782264&cs_est=true&ler=empty&cdl=API_unavailable&it=1735027601283&coo=false&rqm=FGET
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
31.13.65.36 Lithia Springs, United States, ASN32934 (FACEBOOK, US),
Reverse DNS
edge-star-mini-shv-01-atl3.facebook.com
Software
/
Resource Hash
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
Security Headers
Name Value
Content-Security-Policy default-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'wasm-unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

content-encoding
zstd
report-to
{"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7451886805505692096"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options
nosniff
expires
Sat, 01 Jan 2000 00:00:00 GMT
alt-svc
h3=":443"; ma=86400
date
Tue, 24 Dec 2024 08:06:41 GMT
content-type
image/png
vary
Accept-Encoding
x-fb-debug
OsJ4SVQwmHqJ3H4/brzY/fFJdE/eY/4WFgoQRGN7QwJK+DYxQVaniasJ1w2UzuqNohbNovl3e6hwy1WoPpo69w==
priority
u=3,i
x-frame-options
DENY
strict-transport-security
max-age=15552000; preload
reporting-endpoints
coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7451886805505692096", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy
default-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'unsafe-inline' blob: data: 'self' connect.facebook.net 'wasm-unsafe-eval' https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net *.carriersignal.info blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
cache-control
private, no-store, no-cache, must-revalidate
x-fb-connection-quality
EXCELLENT; q=0.9, rtt=49, rtx=0, c=23, mss=1232, tbw=5010, tp=15, tpl=0, uplat=154, ullat=0
cross-origin-opener-policy
same-origin-allow-popups;report-to="coop_report"
pragma
no-cache
cross-origin-resource-policy
cross-origin
permissions-policy
accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy
force-load-at-top
x-xss-protection
0
origin-agent-cluster
?1
counters.gif
forms.hsforms.com/embed/v3/
35 B
917 B
Image
General
Full URL
https://forms.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=1
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.19.175.188 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

x-robots-tag
none
x-request-id
09ac4c68-15d9-43dc-989f-28814737e24c
access-control-expose-headers
X-Origin-Hublet
cf-cache-status
DYNAMIC
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
x-evy-trace-listener
listener_https
server-timing
cfExtPri
date
Tue, 24 Dec 2024 08:06:41 GMT
x-hubspot-correlation-id
09ac4c68-15d9-43dc-989f-28814737e24c
content-type
image/gif
vary
origin
priority
u=3,i
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name
envoyset-translator
cache-control
max-age=0, no-cache, no-store
x-evy-trace-served-by-pod
iad02/star-hubspot-td/envoy-proxy-b967ccf5d-4nb5b
x-envoy-upstream-service-time
1
access-control-allow-credentials
false
cf-ray
8f6f17ed8ac6da33-MIA
x-evy-trace-route-configuration
listener_https/all
content-length
35
server
cloudflare
x-evy-trace-virtual-host
all
replay
browser-intake-datadoghq.com/api/v2/
53 B
113 B
XHR
General
Full URL
https://browser-intake-datadoghq.com/api/v2/replay?ddsource=browser&ddtags=sdk_version%3A5.34.1%2Capi%3Axhr%2Cenv%3Aproduction%2Cservice%3Ahuntress.com%2Cversion%3A1.0.0&dd-api-key=pub66bcc27a4e8914137e6493224fb92edb&dd-evp-origin-version=5.34.1&dd-evp-origin=browser&dd-request-id=99d8996f-b12e-4c63-8417-91d975303a3b
Requested by
Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1f18:24e6:b901:72e3:1bfe:b271:96b2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
b3468d16ad043cb04a12a90d6e9ccc7152fa29747f4a304875e9695e66394495
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type
multipart/form-data; boundary=----WebKitFormBoundaryfWNXZZ7ovPOjwvwg
Referer
https://www.huntress.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
access-control-allow-origin
*
content-length
53
accept-encoding
identity,gzip,x-gzip,deflate,x-deflate,zstd
date
Tue, 24 Dec 2024 08:06:41 GMT
content-type
application/json
dd-request-id
99d8996f-b12e-4c63-8417-91d975303a3b
adsct
t.co/1/i/
43 B
627 B
Image
General
Full URL
https://t.co/1/i/adsct?bci=4&dv=Pacific%2FHonolulu%26en-US%2Cen%26Google%20Inc.%26Linux%20x86_64%26255%261600%261200%2616%2624%261600%261200%260%26na&eci=3&event=%7B%7D&event_id=00eb724d-405f-4b4b-b319-26886e1ce821&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=78cd49dd-6748-4d11-8c8f-ded168aa2d5c&tw_document_href=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fthreat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild%3Fis%3D3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2&tw_iframe_status=0&txn_id=odo68&type=javascript&version=2.3.31
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.66.0.227 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare tsa_b /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

strict-transport-security
max-age=0
x-transaction-id
b348f94175f2c709
cache-control
no-cache, no-store, max-age=0
x-connection-hash
432ad1fb41843f332ccc76e0ec0e56517c0296b0388612923a58462916bf6b95
cf-cache-status
DYNAMIC
cf-ray
8f6f17ef1afd4c2b-MIA
x-response-time
79
content-length
43
date
Tue, 24 Dec 2024 08:06:41 GMT
content-type
image/gif;charset=utf-8
perf
7402827104
server
cloudflare tsa_b
adsct
analytics.twitter.com/1/i/
43 B
724 B
Image
General
Full URL
https://analytics.twitter.com/1/i/adsct?bci=4&dv=Pacific%2FHonolulu%26en-US%2Cen%26Google%20Inc.%26Linux%20x86_64%26255%261600%261200%2616%2624%261600%261200%260%26na&eci=3&event=%7B%7D&event_id=00eb724d-405f-4b4b-b319-26886e1ce821&integration=advertiser&p_id=Twitter&p_user_id=0&pl_id=78cd49dd-6748-4d11-8c8f-ded168aa2d5c&tw_document_href=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fthreat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild%3Fis%3D3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2&tw_iframe_status=0&txn_id=odo68&type=javascript&version=2.3.31
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.195 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_b /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

strict-transport-security
max-age=631138519
x-transaction-id
0f7cf55a3a1ea62c
cache-control
no-cache, no-store, max-age=0
x-connection-hash
9b206bb5f848c61d649c416e222c843a7fdd9a9a9de4a73962cb8e163eeb4b6d
x-response-time
5
content-length
43
date
Tue, 24 Dec 2024 08:06:41 GMT
perf
7402827104
content-type
image/gif;charset=utf-8
server
tsa_b
0
bat.bing.com/action/
0
358 B
Image
General
Full URL
https://bat.bing.com/action/0?ti=187135658&Ver=2&mid=c5ea1f4a-c957-4b2b-823e-2d8ab23ddf9b&bo=1&sid=02214980c1ce11efb70c25223e7c8c0d&vid=02215b40c1ce11ef94016b09ad891d8d&vids=1&msclkid=N&pi=918639831&lg=en-US&sw=1600&sh=1200&sc=24&tl=Cleo%20Software%20Actively%20Being%20Exploited%20in%20the%20Wild%20CVE-2024-55956%20%7C%20Huntress&p=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fthreat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild%3Fis%3D3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2&r=&lt=4613&evt=pageLoad&sv=1&cdb=AQAQ&rn=112808
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2620:1ec:33:1::10 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
no-cache, must-revalidate
pragma
no-cache
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: F3D901BE4E6C4311BED41C9AFF512625 Ref B: MIAEDGE1820 Ref C: 2024-12-24T08:06:41Z
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
*
x-cache
CONFIG_NOCACHE
date
Tue, 24 Dec 2024 08:06:41 GMT
attribution_trigger
px.ads.linkedin.com/
2 B
763 B
XHR
General
Full URL
https://px.ads.linkedin.com/attribution_trigger?pid=3281745&time=1735027601496&url=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fthreat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild%3Fis%3D3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Requested by
Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept
*
Referer
https://www.huntress.com/

Response headers

x-li-pop
afd-prod-lor1-x
content-encoding
gzip
x-fs-uuid
000629ff97e1c2a6d7d1784d6ea07fb6
x-msedge-ref
Ref A: EF78F7FE6C07448582EC2F04F2070ADD Ref B: MIA301000105027 Ref C: 2024-12-24T08:06:41Z
x-li-fabric
prod-lor1
x-restli-protocol-version
1.0.0
access-control-allow-methods
GET, OPTIONS
x-li-uuid
AAYp/5fhwqbX0XhNbqB/tg==
x-li-proto
http/2
access-control-allow-origin
*
x-cache
CONFIG_NOCACHE
date
Tue, 24 Dec 2024 08:06:41 GMT
content-type
application/json
access-control-allow-headers
*
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3281745&time=1735027601496&li_adsId=08578903-bc56-47ea-9361-2cd7bd12ad53&url=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fthreat-advisory-oh-no-cleo-cl...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3281745&time=1735027601496&li_adsId=08578903-bc56-47ea-9361-2cd7bd12ad53&url=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fthreat-advisory-oh-no-cleo-cl...
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D3281745%26time%3D1735027601496%26li_adsId%3D08578903-bc56-47ea-9361-2cd7bd12ad53%...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=3281745&time=1735027601496&li_adsId=08578903-bc56-47ea-9361-2cd7bd12ad53&url=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fthreat-advisory-oh-no-cleo-cl...
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3281745&time=1735027601496&li_adsId=08578903-bc56-47ea-9361-2cd7bd12ad53&url=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fthreat-advisory-oh-no-cleo-c...
0
489 B
Image
General
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3281745&time=1735027601496&li_adsId=08578903-bc56-47ea-9361-2cd7bd12ad53&url=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fthreat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild%3Fis%3D3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2&cookiesTest=true&liSync=true&e_ipv6=AQIxi7AZKSxDsgAAAZP3tDNFfsut0viR8MMU-IsICcU3zSvWhcb653nr3EIM9bkNAQVV8Q
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

linkedin-action
1
x-li-pop
afd-prod-lor1-x
x-msedge-ref
Ref A: E4ECA599BF7C49ED9C509F8230B1CE86 Ref B: MIAEDGE2917 Ref C: 2024-12-24T08:06:42Z
x-li-fabric
prod-lor1
x-li-uuid
AAYp/5ft8zK4kAX1wtkugQ==
x-li-proto
http/2
x-cache
CONFIG_NOCACHE
content-length
0
date
Tue, 24 Dec 2024 08:06:42 GMT
content-type
application/javascript

Redirect headers

linkedin-action
1
x-li-pop
afd-prod-lor1-x
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=3281745&time=1735027601496&li_adsId=08578903-bc56-47ea-9361-2cd7bd12ad53&url=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fthreat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild%3Fis%3D3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2&cookiesTest=true&liSync=true&e_ipv6=AQIxi7AZKSxDsgAAAZP3tDNFfsut0viR8MMU-IsICcU3zSvWhcb653nr3EIM9bkNAQVV8Q
x-msedge-ref
Ref A: C5A1722CC61C43D58812539260D8F933 Ref B: MIAEDGE2106 Ref C: 2024-12-24T08:06:42Z
x-li-fabric
prod-lor1
x-li-uuid
AAYp/5foLnAkcWmEmg4wUg==
x-li-proto
http/2
x-cache
CONFIG_NOCACHE
content-length
0
date
Tue, 24 Dec 2024 08:06:41 GMT
/
px.ads.linkedin.com/wa/
0
564 B
XHR
General
Full URL
https://px.ads.linkedin.com/wa/
Requested by
Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:21::14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://www.huntress.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Accept
*
Content-Type
text/plain;charset=UTF-8

Response headers

linkedin-action
1
x-li-pop
afd-prod-lva1-x
x-msedge-ref
Ref A: BA911C3318CF4D30AB5081D6CD1537BD Ref B: MIAEDGE2106 Ref C: 2024-12-24T08:06:41Z
x-li-fabric
prod-lva1
access-control-allow-credentials
true
x-li-uuid
AAYp/5fhu7iPSsenTDllPA==
x-li-proto
http/2
access-control-allow-origin
https://www.huntress.com
x-cache
CONFIG_NOCACHE
date
Tue, 24 Dec 2024 08:06:41 GMT
vary
Origin
getuidj
secure.adnxs.com/
11 B
702 B
XHR
General
Full URL
https://secure.adnxs.com/getuidj
Requested by
Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
68.67.181.103 North Bergen, United States, ASN29990 (ASN-APPNEX, US),
Reverse DNS
1041.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net
Software
nginx/1.23.4 /
Resource Hash
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
Security Headers
Name Value
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

cache-control
no-store, no-cache, private
pragma
no-cache
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials
true
x-proxy-origin
38.132.118.70; 38.132.118.70; 1041.bm-nginx-loadbalancer.mgmt.nym2.adnexus.net; adnxs.com
expires
Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin
https://www.huntress.com
an-x-request-uuid
218bfa1a-fe45-430f-ba2c-e213f62dd6ad
content-length
11
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date
Tue, 24 Dec 2024 08:06:41 GMT
x-xss-protection
0
content-type
application/json; charset=utf-8
server
nginx/1.23.4
/
c.6sc.co/
7 B
194 B
XHR
General
Full URL
https://c.6sc.co/
Requested by
Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.200.88.71 Secaucus, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
a23-200-88-71.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

access-control-max-age
86400
access-control-allow-credentials
true
access-control-allow-methods
GET,POST
access-control-allow-origin
https://www.huntress.com
content-length
7
date
Tue, 24 Dec 2024 08:06:41 GMT
content-type
text/html
access-control-allow-headers
*
/
ipv6.6sc.co/
18 B
309 B
XHR
General
Full URL
https://ipv6.6sc.co/
Requested by
Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
2600:141b:1c00:2e::17d1:48d1 Secaucus, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
Software
/
Resource Hash
c397f4ba950e1a41f2629374b350ffe5ae0442ab9b0bb4742f618c7a089aaad6

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

cache-control
max-age=0, no-cache, no-store
pragma
no-cache
6si-ipv6
2001:550:1d05:1::9
expires
Tue, 24 Dec 2024 08:06:41 GMT
server-timing
cdn-cache; desc=HIT, edge; dur=1, ak_p; desc="1735027601663_399550033_359574944_12_513_60_123_219";dur=1
access-control-allow-origin
https://www.huntress.com
content-length
18
date
Tue, 24 Dec 2024 08:06:41 GMT
content-type
text/html
vary
Origin
rum
browser-intake-datadoghq.com/api/v2/
53 B
135 B
Fetch
General
Full URL
https://browser-intake-datadoghq.com/api/v2/rum?ddsource=browser&ddtags=sdk_version%3A5.34.1%2Capi%3Afetch%2Cenv%3Aproduction%2Cservice%3Ahuntress.com%2Cversion%3A1.0.0&dd-api-key=pub66bcc27a4e8914137e6493224fb92edb&dd-evp-origin-version=5.34.1&dd-evp-origin=browser&dd-request-id=e543ec97-87da-4f15-8721-68871eff98a4&batch_time=1735027601534
Requested by
Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1f18:24e6:b901:72e3:1bfe:b271:96b2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
2b0fbfb6b248aab96e5c34dea4842314d34ade82780ac991aa9507c1a646c6b9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8
Referer
https://www.huntress.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
access-control-allow-origin
*
content-length
53
accept-encoding
identity,gzip,x-gzip,deflate,x-deflate,zstd
date
Tue, 24 Dec 2024 08:06:41 GMT
content-type
application/json
dd-request-id
e543ec97-87da-4f15-8721-68871eff98a4
rum
browser-intake-datadoghq.com/api/v2/
53 B
112 B
Fetch
General
Full URL
https://browser-intake-datadoghq.com/api/v2/rum?ddsource=browser&ddtags=sdk_version%3A5.34.1%2Capi%3Afetch%2Cenv%3Aproduction%2Cservice%3Ahuntress.com%2Cversion%3A1.0.0&dd-api-key=pub66bcc27a4e8914137e6493224fb92edb&dd-evp-origin-version=5.34.1&dd-evp-origin=browser&dd-request-id=823ca1d6-c682-4180-8a00-326c9dd69171&batch_time=1735027601536
Requested by
Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1f18:24e6:b901:72e3:1bfe:b271:96b2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
de3421dd0135b085e9a0079299f9747f1546b1d03ed5010c41b2997b3352fde3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8
Referer
https://www.huntress.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
access-control-allow-origin
*
content-length
53
accept-encoding
identity,gzip,x-gzip,deflate,x-deflate,zstd
date
Tue, 24 Dec 2024 08:06:41 GMT
content-type
application/json
dd-request-id
823ca1d6-c682-4180-8a00-326c9dd69171
rum
browser-intake-datadoghq.com/api/v2/
53 B
112 B
Fetch
General
Full URL
https://browser-intake-datadoghq.com/api/v2/rum?ddsource=browser&ddtags=sdk_version%3A5.34.1%2Capi%3Afetch%2Cenv%3Aproduction%2Cservice%3Ahuntress.com%2Cversion%3A1.0.0&dd-api-key=pub66bcc27a4e8914137e6493224fb92edb&dd-evp-origin-version=5.34.1&dd-evp-origin=browser&dd-request-id=c28e7459-bb85-4d61-b2a4-aa1a7e0be996&batch_time=1735027601538
Requested by
Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1f18:24e6:b901:72e3:1bfe:b271:96b2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
b04b76399ee4aef0bf30eb5a3c8fa794785b690f0e8594b3d7d016806c26b38e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8
Referer
https://www.huntress.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
access-control-allow-origin
*
content-length
53
accept-encoding
identity,gzip,x-gzip,deflate,x-deflate,zstd
date
Tue, 24 Dec 2024 08:06:41 GMT
content-type
application/json
dd-request-id
c28e7459-bb85-4d61-b2a4-aa1a7e0be996
rum
browser-intake-datadoghq.com/api/v2/
53 B
112 B
Fetch
General
Full URL
https://browser-intake-datadoghq.com/api/v2/rum?ddsource=browser&ddtags=sdk_version%3A5.34.1%2Capi%3Afetch%2Cenv%3Aproduction%2Cservice%3Ahuntress.com%2Cversion%3A1.0.0&dd-api-key=pub66bcc27a4e8914137e6493224fb92edb&dd-evp-origin-version=5.34.1&dd-evp-origin=browser&dd-request-id=40e02d68-71c7-41b2-8f01-c546867c50d9&batch_time=1735027601540
Requested by
Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1f18:24e6:b901:72e3:1bfe:b271:96b2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
f747a6b8633575162fcb12b74e1f55a964aac27cae5c89720efcc29985c26198
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8
Referer
https://www.huntress.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
access-control-allow-origin
*
content-length
53
accept-encoding
identity,gzip,x-gzip,deflate,x-deflate,zstd
date
Tue, 24 Dec 2024 08:06:41 GMT
content-type
application/json
dd-request-id
40e02d68-71c7-41b2-8f01-c546867c50d9
afedf25e-b970-433d-a9d9-b9c43a9ae35b
https://www.huntress.com/
43 B
0
Image
General
Full URL
blob:https://www.huntress.com/afedf25e-b970-433d-a9d9-b9c43a9ae35b
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/gif
Content-Length
43
saq_pxl
tags.srv.stackadapt.com/
138 B
333 B
XHR
General
Full URL
https://tags.srv.stackadapt.com/saq_pxl?uid=yZKscIIzalsoNin7qAYxQw&is_js=true&landing_url=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fthreat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild%3Fis%3D3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2&t=Cleo%20Software%20Actively%20Being%20Exploited%20in%20the%20Wild%20CVE-2024-55956%20%7C%20Huntress&tip=d7JcCHxpks6t_GghoizhiDz7rIAOhA5R5gs39aIuJmA&host=https%3A%2F%2Fwww.huntress.com&sa_conv_data_css_value=%270-2c2df343-078c-5f5c-5e20-760050e08db7%27&sa_conv_data_image_value=ffd8ffe000104a46494600010101006000600000ffdb004300080606070605080707070909080a0c140d0c0b0b0c1912130f141d1a1f1e1d1a1c1c20242e2720222c231c1c2837292c30313434341f27393d38323c2e333432ffdb0043010909090c0b0c180d0d1832211c213232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232323232ffc00011080001000103012200021101031101ffc4001f0000010501010101010100000000000000000102030405060708090a0bffc400b5100002010303020403050504040000017d01020300041105122131410613516107227114328191a1082342b1c11552d1f02433627282090a161718191a25262728292a3435363738393a434445464748494a535455565758595a636465666768696a737475767778797a838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae1e2e3e4e5e6e7e8e9eaf1f2f3f4f5f6f7f8f9faffc4001f0100030101010101010101010000000000000102030405060708090a0bffc400b51100020102040403040705040400010277000102031104052131061241510761711322328108144291a1b1c109233352f0156272d10a162434e125f11718191a262728292a35363738393a434445464748494a535455565758595a636465666768696a737475767778797a82838485868788898a92939495969798999aa2a3a4a5a6a7a8a9aab2b3b4b5b6b7b8b9bac2c3c4c5c6c7c8c9cad2d3d4d5d6d7d8d9dae2e3e4e5e6e7e8e9eaf2f3f4f5f6f7f8f9faffda000c03010002110311003f00f7fa28a2803fffd92c2df343078c5f5c5e20760050e08db726847646&l_src=&l_src_d=&u_src=&u_src_d=&shop=false&sa-user-id-v3=s%253AAQAKIAPUedzHQELGu9dQtoE8inZnRYgwfzgcKmWRYGWBTArwENYBGAQgkdepuwYwAToExbdv9kIEYIxUeg.rTeNNos1xaoF3nYDk%252BDHlS5cdTnQ610X5quRXvESXh0&sa-user-id-v2=s%253ALC3zQweMX1xeIHYAUOCNtyaEdkY.GdEPQUkp2agv5EyFIeXKJWSmX2GpxrT%252BQxumnRcGG50&sa-user-id=s%253A0-2c2df343-078c-5f5c-5e20-760050e08db7.snsH4E%252FAyqmh%252Bl%252Fo2o%252BobQpFCzY%252BZeNI9SaOvxJMKIo
Requested by
Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
34.196.12.18 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
ec2-34-196-12-18.compute-1.amazonaws.com
Software
/
Resource Hash
fc573eaf0e39d6b2429951f78b744dde5acb4cbee85a9b903aea0210072d9b48

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

access-control-allow-methods
GET
access-control-allow-origin
https://www.huntress.com
content-length
138
date
Tue, 24 Dec 2024 08:06:41 GMT
content-type
text/plain; charset=utf-8
access-control-allow-credentials
true
access-control-allow-headers
*
img.gif
b.6sc.co/v1/beacon/
43 B
257 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=a87a3edc53b5a86d1795d11887b5aa39&svisitor=null&visitor=e51b62de-aebe-4aff-869c-596b7036ddc5&session=f4131538-26f2-49dc-8925-2ab13f50e703&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Tue%2C%2024%20Dec%202024%2008%3A06%3A41%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Huntress%20identified%20an%20emerging%20threat%20involving%20Cleo%E2%80%99s%20LexiCom%2C%20VLTransfer%2C%20and%20Harmony%20software%2C%20known%20as%20CVE-2024-55956%2C%20commonly%20used%20to%20manage%20file%20transfers.%20Read%20more%20about%20this%20emerging%20threat%20on%20the%20Huntress%20Blog.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Cleo%20Software%20Actively%20Being%20Exploited%20in%20the%20Wild%20CVE-2024-55956%20%7C%20Huntress%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fthreat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild%3Fis%3D3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2&pageViewId=6dcf070b-e742-4b90-80f6-ff030ee382b3&webTagId=e666a54d-ff29-48f9-9baa-2be6ac05412e&v=1.1.31
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.200.88.71 Secaucus, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
a23-200-88-71.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

cache-control
max-age=0, no-cache, no-store
etag
"615ccf10-2b"
pragma
no-cache
x-content-type-options
nosniff
expires
Tue, 24 Dec 2024 08:06:41 GMT
accept-ranges
bytes
content-length
43
date
Tue, 24 Dec 2024 08:06:41 GMT
content-type
image/gif
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
img.gif
b.6sc.co/v1/beacon/
43 B
257 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=a87a3edc53b5a86d1795d11887b5aa39&svisitor=null&visitor=e51b62de-aebe-4aff-869c-596b7036ddc5&session=f4131538-26f2-49dc-8925-2ab13f50e703&event=ni%3AasyncSettingsAudit&q=%7B%22settings%22%3A%22%5B%7B%5C%22name%5C%22%3A%5C%22setToken%5C%22%2C%5C%22value%5C%22%3A%5C%22a87a3edc53b5a86d1795d11887b5aa39%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2024%20Dec%202024%2008%3A06%3A41%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22disableCookies%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2024%20Dec%202024%2008%3A06%3A41%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIPv6Ping%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2024%20Dec%202024%2008%3A06%3A41%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableIgnorePageUrlHash%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2024%20Dec%202024%2008%3A06%3A41%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableRetargeting%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2024%20Dec%202024%2008%3A06%3A41%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setWhiteListFields%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2024%20Dec%202024%2008%3A06%3A41%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCustomMetatags%5C%22%2C%5C%22value%5C%22%3A%5C%22%5B%5D%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2024%20Dec%202024%2008%3A06%3A41%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22storeTagId%5C%22%2C%5C%22value%5C%22%3A%5C%22e666a54d-ff29-48f9-9baa-2be6ac05412e%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2024%20Dec%202024%2008%3A06%3A41%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableEventTracking%5C%22%2C%5C%22value%5C%22%3A%5C%22true%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2024%20Dec%202024%2008%3A06%3A41%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22setCompanyDetailsExpiration%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2024%20Dec%202024%2008%3A06%3A41%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%2C%7B%5C%22name%5C%22%3A%5C%22enableCompanyDetails%5C%22%2C%5C%22value%5C%22%3A%5C%22false%5C%22%2C%5C%22dateTime%5C%22%3A%5C%22Tue%2C%2024%20Dec%202024%2008%3A06%3A41%20GMT%5C%22%2C%5C%22timeSincePageLoad%5C%22%3A%5C%220%5C%22%7D%5D%22%7D&isIframe=false&m=%7B%22description%22%3A%22Huntress%20identified%20an%20emerging%20threat%20involving%20Cleo%E2%80%99s%20LexiCom%2C%20VLTransfer%2C%20and%20Harmony%20software%2C%20known%20as%20CVE-2024-55956%2C%20commonly%20used%20to%20manage%20file%20transfers.%20Read%20more%20about%20this%20emerging%20threat%20on%20the%20Huntress%20Blog.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Cleo%20Software%20Actively%20Being%20Exploited%20in%20the%20Wild%20CVE-2024-55956%20%7C%20Huntress%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fthreat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild%3Fis%3D3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2&pageViewId=6dcf070b-e742-4b90-80f6-ff030ee382b3&webTagId=e666a54d-ff29-48f9-9baa-2be6ac05412e&v=1.1.31
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.200.88.71 Secaucus, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
a23-200-88-71.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

cache-control
max-age=0, no-cache, no-store
etag
"5e502810-2b"
pragma
no-cache
x-content-type-options
nosniff
expires
Tue, 24 Dec 2024 08:06:41 GMT
accept-ranges
bytes
content-length
43
date
Tue, 24 Dec 2024 08:06:41 GMT
content-type
image/gif
last-modified
Fri, 21 Feb 2020 18:57:20 GMT
server
nginx/1.14.0 (Ubuntu)
img.gif
b.6sc.co/v1/beacon/
43 B
257 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=a87a3edc53b5a86d1795d11887b5aa39&svisitor=null&visitor=e51b62de-aebe-4aff-869c-596b7036ddc5&session=f4131538-26f2-49dc-8925-2ab13f50e703&event=ipv6&q=%7B%22address%22%3A%222001%3A550%3A1d05%3A1%3A%3A9%22%7D&isIframe=false&m=%7B%22description%22%3A%22Huntress%20identified%20an%20emerging%20threat%20involving%20Cleo%E2%80%99s%20LexiCom%2C%20VLTransfer%2C%20and%20Harmony%20software%2C%20known%20as%20CVE-2024-55956%2C%20commonly%20used%20to%20manage%20file%20transfers.%20Read%20more%20about%20this%20emerging%20threat%20on%20the%20Huntress%20Blog.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Cleo%20Software%20Actively%20Being%20Exploited%20in%20the%20Wild%20CVE-2024-55956%20%7C%20Huntress%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fthreat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild%3Fis%3D3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2&pageViewId=6dcf070b-e742-4b90-80f6-ff030ee382b3&webTagId=e666a54d-ff29-48f9-9baa-2be6ac05412e&ipv6=2001%3A550%3A1d05%3A1%3A%3A9&v=1.1.31
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.200.88.71 Secaucus, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
a23-200-88-71.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

cache-control
max-age=0, no-cache, no-store
etag
"63f020a0-2b"
pragma
no-cache
x-content-type-options
nosniff
expires
Tue, 24 Dec 2024 08:06:41 GMT
accept-ranges
bytes
content-length
43
date
Tue, 24 Dec 2024 08:06:41 GMT
content-type
image/gif
last-modified
Sat, 18 Feb 2023 00:49:36 GMT
server
nginx/1.14.0 (Ubuntu)
rum
browser-intake-datadoghq.com/api/v2/
53 B
112 B
Fetch
General
Full URL
https://browser-intake-datadoghq.com/api/v2/rum?ddsource=browser&ddtags=sdk_version%3A5.34.1%2Capi%3Afetch%2Cenv%3Aproduction%2Cservice%3Ahuntress.com%2Cversion%3A1.0.0&dd-api-key=pub66bcc27a4e8914137e6493224fb92edb&dd-evp-origin-version=5.34.1&dd-evp-origin=browser&dd-request-id=87b0b06a-0d44-4ac8-a76e-2f3db14b1a86&batch_time=1735027601848
Requested by
Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1f18:24e6:b901:72e3:1bfe:b271:96b2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
61647a0bdc00666f1e6c0619b42fe1ed522a255f703d6c9fb45e5a22e90c17cf
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8
Referer
https://www.huntress.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
access-control-allow-origin
*
content-length
53
accept-encoding
identity,gzip,x-gzip,deflate,x-deflate,zstd
date
Tue, 24 Dec 2024 08:06:41 GMT
content-type
application/json
dd-request-id
87b0b06a-0d44-4ac8-a76e-2f3db14b1a86
rum
browser-intake-datadoghq.com/api/v2/
53 B
112 B
Fetch
General
Full URL
https://browser-intake-datadoghq.com/api/v2/rum?ddsource=browser&ddtags=sdk_version%3A5.34.1%2Capi%3Afetch%2Cenv%3Aproduction%2Cservice%3Ahuntress.com%2Cversion%3A1.0.0&dd-api-key=pub66bcc27a4e8914137e6493224fb92edb&dd-evp-origin-version=5.34.1&dd-evp-origin=browser&dd-request-id=96fd03c9-b502-4e7b-ac0b-e226dd75861c&batch_time=1735027601880
Requested by
Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1f18:24e6:b901:72e3:1bfe:b271:96b2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
894f93b24189898a84b033b15a5223ca8c63bd8d8dd5dfc54d31dc87e037ef87
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8
Referer
https://www.huntress.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
access-control-allow-origin
*
content-length
53
accept-encoding
identity,gzip,x-gzip,deflate,x-deflate,zstd
date
Tue, 24 Dec 2024 08:06:41 GMT
content-type
application/json
dd-request-id
96fd03c9-b502-4e7b-ac0b-e226dd75861c
bframe
www.google.com/recaptcha/api2/ Frame 9801
0
0
Document
General
Full URL
https://www.google.com/recaptcha/api2/bframe?hl=en&v=zIriijn3uj5Vpknvt_LnfNbF&k=6LchEywUAAAAAAdAXlscEm7Kcb3DJ38pngRCQJsC
Requested by
Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/zIriijn3uj5Vpknvt_LnfNbF/recaptcha__en.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.65.164 Plainview, United States, ASN15169 (GOOGLE, US),
Reverse DNS
lga25s71-in-f4.1e100.net
Software
ESF /
Resource Hash
Security Headers
Name Value
Content-Security-Policy script-src 'report-sample' 'nonce-vvv4dtrBDvbrk9xlEMsklQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

Referer
https://www.huntress.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control
no-cache, no-store, max-age=0, must-revalidate
content-encoding
gzip
content-security-policy
script-src 'report-sample' 'nonce-vvv4dtrBDvbrk9xlEMsklQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type
text/html; charset=utf-8
cross-origin-embedder-policy
require-corp
cross-origin-opener-policy-report-only
same-origin; report-to="coop_38fac9d5b82543fc4729580d18ff2d3d"
cross-origin-resource-policy
cross-origin
date
Tue, 24 Dec 2024 08:06:42 GMT
expires
Mon, 01 Jan 1990 00:00:00 GMT
pragma
no-cache
report-to
{"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]} {"group":"coop_38fac9d5b82543fc4729580d18ff2d3d","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/38fac9d5b82543fc4729580d18ff2d3d"}]}
server
ESF
x-content-type-options
nosniff
x-xss-protection
0
5d3cypit2iz8.js
js.driftt.com/include/1735027800000/
212 KB
60 KB
Script
General
Full URL
https://js.driftt.com/include/1735027800000/5d3cypit2iz8.js
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.238.55.7 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-238-55-7.jfk52.r.cloudfront.net
Software
istio-envoy /
Resource Hash
93a2fd82dd3a13a9e9ce0583f3bde1b6e88da6ebce30fa8c87cee4d9d927e4d2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

content-encoding
gzip
x-amz-version-id
fwT06mdOrTHjuLmyd8.idzR8VPd5.dxi
etag
W/"576cdc1c0941a520c47b54aef3b463f7"
access-control-allow-methods
GET, POST, OPTIONS
x-cache
RefreshHit from cloudfront
x-amz-cf-id
5mSDHwoFHIk0bD8QUT-F_TC28eQfIZbE2wOAQ-ZWfuipdRG3gzG04g==
date
Tue, 24 Dec 2024 08:06:42 GMT
content-type
application/javascript; charset=utf-8
last-modified
Mon, 21 Aug 2023 14:57:31 GMT
vary
Accept-Encoding
access-control-allow-headers
DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
strict-transport-security
max-age=31536000; includeSubDomains, max-age=31536000; includeSubDomains
cache-control
max-age=10
x-envoy-upstream-service-time
32
access-control-allow-credentials
true,true
via
1.1 06127425b01b17c7839a24e2c48a93a6.cloudfront.net (CloudFront), 1.1 3f3479c6387cb9e42ecda1d46e66eddc.cloudfront.net (CloudFront)
access-control-allow-origin
*
x-amz-cf-pop
IAD55-P7, JFK52-P4
server
istio-envoy
x-amz-server-side-encryption
AES256
img.gif
b.6sc.co/v1/beacon/
43 B
258 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=a87a3edc53b5a86d1795d11887b5aa39&svisitor=null&visitor=e51b62de-aebe-4aff-869c-596b7036ddc5&session=f4131538-26f2-49dc-8925-2ab13f50e703&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2024%20Dec%202024%2008%3A06%3A42%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2024%20Dec%202024%2008%3A06%3A41%20GMT%22%2C%22timeSpent%22%3A%221007%22%2C%22totalTimeSpent%22%3A%221007%22%7D&isIframe=false&m=%7B%22description%22%3A%22Huntress%20identified%20an%20emerging%20threat%20involving%20Cleo%E2%80%99s%20LexiCom%2C%20VLTransfer%2C%20and%20Harmony%20software%2C%20known%20as%20CVE-2024-55956%2C%20commonly%20used%20to%20manage%20file%20transfers.%20Read%20more%20about%20this%20emerging%20threat%20on%20the%20Huntress%20Blog.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Cleo%20Software%20Actively%20Being%20Exploited%20in%20the%20Wild%20CVE-2024-55956%20%7C%20Huntress%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fthreat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild%3Fis%3D3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2&pageViewId=6dcf070b-e742-4b90-80f6-ff030ee382b3&an_uid=0&webTagId=e666a54d-ff29-48f9-9baa-2be6ac05412e&ipv6=2001%3A550%3A1d05%3A1%3A%3A9&v=1.1.31
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.200.88.71 Secaucus, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
a23-200-88-71.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

cache-control
max-age=0, no-cache, no-store
etag
"63f02dad-2b"
pragma
no-cache
x-content-type-options
nosniff
expires
Tue, 24 Dec 2024 08:06:42 GMT
accept-ranges
bytes
content-length
43
date
Tue, 24 Dec 2024 08:06:42 GMT
content-type
image/gif
last-modified
Sat, 18 Feb 2023 01:45:17 GMT
server
nginx/1.14.0 (Ubuntu)
tp2
webhooks.fivetran.com/snowplow/ec8653cd-0011-4e95-956d-5d58fd8cd16e/com.snowplowanalytics.snowplow/ Frame
0
0
Preflight
General
Full URL
https://webhooks.fivetran.com/snowplow/ec8653cd-0011-4e95-956d-5d58fd8cd16e/com.snowplowanalytics.snowplow/tp2
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.139.124.58 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
58.124.139.34.bc.googleusercontent.com
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.huntress.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type
access-control-allow-methods
GET, POST, HEAD, OPTIONS
access-control-allow-origin
https://www.huntress.com
access-control-expose-headers
Server-Timing
content-length
0
content-type
application/json
date
Tue, 24 Dec 2024 08:06:42 GMT
server-timing
traceparent;desc="00-e59277c9b3dc8ee52233509f94cb036a-00007d033e292bd1-01"
strict-transport-security
max-age=15724800; includeSubDomains
vary
Origin
tp2
t.huntress.com/com.snowplowanalytics.snowplow/ Frame
0
0
Preflight
General
Full URL
https://t.huntress.com/com.snowplowanalytics.snowplow/tp2
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
76.223.15.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a88311a88630c144d.awsglobalaccelerator.com
Software
nginx /
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type
Access-Control-Request-Method
POST
Origin
https://www.huntress.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type, SP-Anonymous
access-control-allow-origin
https://www.huntress.com
access-control-max-age
600
content-length
0
date
Tue, 24 Dec 2024 08:06:42 GMT
server
nginx
strict-transport-security
max-age=31536000; includeSubDomains
playPauseLoadingControl.js
fast.wistia.net/assets/external/
83 KB
22 KB
Script
General
Full URL
https://fast.wistia.net/assets/external/playPauseLoadingControl.js
Requested by
Host: fast.wistia.com
URL: https://fast.wistia.com/assets/external/publicApi.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42::644 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
5391ba1ea0e305e29df1bc7c1cea8d264ae924843ba6672cc7d504b1fb53f40e
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://www.huntress.com
Referer

Response headers

content-encoding
br
etag
"7211c50b3c11a1498b4d02fe842c57d0"
age
3275
access-control-allow-methods
GET, HEAD
x-cache
HIT, HIT
date
Tue, 24 Dec 2024 08:06:42 GMT
last-modified
Fri, 20 Dec 2024 20:11:38 GMT
x-served-by
cache-iad-kjyo7100106-IAD, cache-mia-kmia1760036-MIA
x-cache-hits
21, 22
content-type
text/javascript
vary
Accept-Encoding
strict-transport-security
max-age=0
cache-control
public, max-age=3600
timing-allow-origin
*
x-timer
S1735027603.699313,VS0,VE0
via
1.1 varnish, 1.1 varnish
x-browser
chrome
x-ecma-v
modern
x-browser-version
131
accept-ranges
bytes
access-control-allow-origin
*
content-length
22489
asset-version
ea49143d3ad772007b2d472dbbb9c363df7c98a6
server
AmazonS3
x-amz-server-side-encryption
AES256
zi-tag.js
js.zi-scripts.com/
9 KB
3 KB
Script
General
Full URL
https://js.zi-scripts.com/zi-tag.js
Requested by
Host: www.huntress.com
URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.150.44 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
2316eedc39d2ae71b2098be3e91ad3662cb1b70d42f6c61ebb6ab5beefd919b6

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

content-encoding
gzip
cf-cache-status
DYNAMIC
x-amz-version-id
Q8AFTvKb8EtoOgGtrVmzLCMTAh5swpvC
etag
W/"5b11ce08c51a9e4b3f4bbe37deea19c1"
age
2234
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
x-amz-cf-id
b6pMp-A0GERWGmnr4lF2SNwbmFUkay0Ef56mYCYZc6N1-h8Y8nUoVw==
date
Tue, 24 Dec 2024 08:06:42 GMT
content-type
application/javascript
last-modified
Fri, 13 Dec 2024 14:58:23 GMT
vary
Accept-Encoding
priority
u=3,i=?0
server-timing
cfExtPri
via
1.1 d481ba816f2e9bf8e90f7db3c5a89e20.cloudfront.net (CloudFront)
cf-ray
8f6f17f52f35a4e5-MIA
x-amz-cf-pop
MIA50-P1
server
cloudflare
tp2
webhooks.fivetran.com/snowplow/ec8653cd-0011-4e95-956d-5d58fd8cd16e/com.snowplowanalytics.snowplow/
53 B
424 B
XHR
General
Full URL
https://webhooks.fivetran.com/snowplow/ec8653cd-0011-4e95-956d-5d58fd8cd16e/com.snowplowanalytics.snowplow/tp2
Requested by
Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
34.139.124.58 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
58.124.139.34.bc.googleusercontent.com
Software
/
Resource Hash
4081a5f270ace3305571b8f393e20c3a50141d103fb6fced35cf64d5182c2cd2
Security Headers
Name Value
Strict-Transport-Security max-age=15724800; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type
application/json; charset=UTF-8
Referer
https://www.huntress.com/

Response headers

strict-transport-security
max-age=15724800; includeSubDomains
access-control-expose-headers
Server-Timing
access-control-allow-credentials
true
access-control-allow-methods
GET, POST, HEAD, OPTIONS
server-timing
traceparent;desc="00-88a89bb5500f2b402b681324c72ac6ea-552ed46dceeeb800-01"
access-control-allow-origin
https://www.huntress.com
content-length
53
date
Tue, 24 Dec 2024 08:06:42 GMT
content-type
application/json
vary
Origin
access-control-allow-headers
Content-Type
tp2
t.huntress.com/com.snowplowanalytics.snowplow/
2 B
306 B
XHR
General
Full URL
https://t.huntress.com/com.snowplowanalytics.snowplow/tp2
Requested by
Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
76.223.15.4 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
a88311a88630c144d.awsglobalaccelerator.com
Software
nginx /
Resource Hash
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type
application/json; charset=UTF-8
Referer
https://www.huntress.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
access-control-allow-origin
https://www.huntress.com
content-length
2
date
Tue, 24 Dec 2024 08:06:42 GMT
content-type
text/plain
server
nginx
access-control-allow-credentials
true
__ptq.gif
track.hubspot.com/
45 B
1 KB
Image
General
Full URL
https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=1372317473&v=1.1&a=3911692&rcu=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fthreat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild&pu=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fthreat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild%3Fis%3D3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2&t=Cleo+Software+Actively+Being+Exploited+in+the+Wild+CVE-2024-55956+%7C+Huntress&cts=1735027602702&vi=06235866c67167ac919241f07caa4651&nc=true&ce=false&pt=1&cc=0
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700::6810:7674 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

x-robots-tag
none
x-request-id
b9453bc4-e3fc-44e7-9417-d448255a56e1
cf-cache-status
DYNAMIC
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=gpCfXbdeTdZ9C3SGoQXByeCiDHQq8GudNh6rVa6w3f3b%2BvZg4GzuSBt6arYr%2BjS0To7CBFC0WQ2tqsqxCLpqBu9BoMJUk%2BsBv%2BKFrfhBfP1zmW8yd8fvYtxpWX47acMng4KAZuL1mgJyCSbgAtQ6"}],"group":"cf-nel","max_age":604800}
x-content-type-options
nosniff
x-evy-trace-listener
listener_https
p3p
CP="NOI CUR ADM OUR NOR STA NID"
date
Tue, 24 Dec 2024 08:06:42 GMT
x-hubspot-correlation-id
b9453bc4-e3fc-44e7-9417-d448255a56e1
content-type
image/gif
vary
origin, Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
x-evy-trace-route-service-name
envoyset-translator
cache-control
no-cache, no-store, no-transform
nel
{"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-served-by-pod
iad02/analytics-tracking-td/envoy-proxy-c658cb6d4-ktnwt
x-envoy-upstream-service-time
8
access-control-allow-credentials
false
cf-ray
8f6f17f59cc03360-MIA
x-evy-trace-route-configuration
listener_https/all
content-length
45
server
cloudflare
x-evy-trace-virtual-host
all
mput
pipedream.wistia.com/
2 B
328 B
Fetch
General
Full URL
https://pipedream.wistia.com/mput?topic=metrics
Requested by
Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:266a:bc00:3:471f:5240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
envoy /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type
application/x-www-form-urlencoded
Referer
https://www.huntress.com/

Response headers

x-envoy-upstream-service-time
2
access-control-allow-methods
POST, OPTIONS
via
1.1 0b4bd786c6b93c5bc7d37331a04a3fdc.cloudfront.net (CloudFront)
access-control-allow-origin
*
x-cache
Miss from cloudfront
content-length
2
x-amz-cf-id
4TnVLFjgSnx3NiU8p-tYjq08pfneao4pfOnugeFlemhUtOM6sGTZnA==
date
Tue, 24 Dec 2024 08:06:42 GMT
content-type
text/plain; charset=utf-8
x-amz-cf-pop
JFK52-P5
server
envoy
hls_video.js
fast.wistia.net/assets/external/engines/
520 KB
128 KB
Script
General
Full URL
https://fast.wistia.net/assets/external/engines/hls_video.js
Requested by
Host: fast.wistia.com
URL: https://fast.wistia.com/assets/external/publicApi.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42::644 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
dc8100597827a188e39056320ab8ba9428cc9272cd74f8cd132d5854b6ca5822
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://www.huntress.com
Referer

Response headers

content-encoding
br
etag
"1c8901016542a7d2e6a106a0fce0a7a5"
age
3354
access-control-allow-methods
GET, HEAD
x-cache
HIT, HIT
date
Tue, 24 Dec 2024 08:06:42 GMT
last-modified
Fri, 20 Dec 2024 20:11:38 GMT
x-served-by
cache-iad-kiad7000077-IAD, cache-mia-kmia1760036-MIA
x-cache-hits
6, 1
content-type
text/javascript
vary
Accept-Encoding
strict-transport-security
max-age=0
cache-control
public, max-age=3600
timing-allow-origin
*
x-timer
S1735027603.719489,VS0,VE1
via
1.1 varnish, 1.1 varnish
x-browser
chrome
x-ecma-v
modern
x-browser-version
131
accept-ranges
bytes
access-control-allow-origin
*
content-length
130861
asset-version
ea49143d3ad772007b2d472dbbb9c363df7c98a6
server
AmazonS3
x-amz-server-side-encryption
AES256
x
distillery.wistia.com/
0
290 B
Fetch
General
Full URL
https://distillery.wistia.com/x
Requested by
Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.63.24 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-63-24.ewr53.r.cloudfront.net
Software
envoy /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type
text/plain
Referer
https://www.huntress.com/

Response headers

cache-control
max-age=0, private, must-revalidate
x-envoy-upstream-service-time
1
via
1.1 4c18e6ed879a674305cb5156731cf396.cloudfront.net (CloudFront)
access-control-allow-origin
*
x-cache
Miss from cloudfront
x-amz-cf-id
RvuuMOh6TKqWZ5y0bVGwN9wGaixA8pFhHaUYOvKeV81tXejXLlN3KA==
date
Tue, 24 Dec 2024 08:06:42 GMT
x-amz-cf-pop
EWR53-C1
server
envoy
66030a0ceace49bce51c36de_favicon-32x32.png
cdn.prod.website-files.com/6579dd0b5f9a54376d296915/
1 KB
2 KB
Other
General
Full URL
https://cdn.prod.website-files.com/6579dd0b5f9a54376d296915/66030a0ceace49bce51c36de_favicon-32x32.png
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.18.160.117 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
c12f11d824a0e7cb513ff4574c1664ac5c3949efc35896edeb0612fe45f1c00b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

cf-cache-status
HIT
etag
"966e794cd99e0b0b48cd4df13cdc04a5"
x-amz-version-id
zgVWaHGriVUpkEY2ghAZ8_qygV1PEHYb
age
88879
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Tue, 24 Dec 2024 08:06:42 GMT
content-type
image/png
last-modified
Tue, 26 Mar 2024 17:46:53 GMT
vary
Accept-Encoding
priority
u=1,i
x-amz-id-2
rS3T5QRoeOmCB3zNtD1hdOzoImUnmk4CPVe/umumD/QKnFKBe4fVu2EU85gEKUrmSyr5bg5uoTQ=
cache-control
max-age=31536000, must-revalidate
x-amz-request-id
BSTSNZF5N8NTF05N
cf-ray
8f6f17f50f5b9abf-MIA
accept-ranges
bytes
access-control-allow-origin
*
content-length
1294
server
cloudflare
x-amz-server-side-encryption
AES256
rum
browser-intake-datadoghq.com/api/v2/
53 B
135 B
Fetch
General
Full URL
https://browser-intake-datadoghq.com/api/v2/rum?ddsource=browser&ddtags=sdk_version%3A5.34.1%2Capi%3Afetch%2Cenv%3Aproduction%2Cservice%3Ahuntress.com%2Cversion%3A1.0.0&dd-api-key=pub66bcc27a4e8914137e6493224fb92edb&dd-evp-origin-version=5.34.1&dd-evp-origin=browser&dd-request-id=b8b39cf7-e98c-425b-8d2b-1e892215f6e8&batch_time=1735027602775
Requested by
Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1f18:24e6:b901:72e3:1bfe:b271:96b2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
f25eec203bc322c7cc1a7a9edeba6073b48c7d497953d0829f4382f17e1dcc3e
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8
Referer
https://www.huntress.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
access-control-allow-origin
*
content-length
53
accept-encoding
identity,gzip,x-gzip,deflate,x-deflate,zstd
date
Tue, 24 Dec 2024 08:06:42 GMT
content-type
application/json
dd-request-id
b8b39cf7-e98c-425b-8d2b-1e892215f6e8
getSubscriptions
js.zi-scripts.com/unified/v1/master/
203 B
613 B
Fetch
General
Full URL
https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Requested by
Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.150.44 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
dd1e0693fedd274eb1a447ae03add46f2781fd54f8ae2f47184e6e2a63b95bd9

Request headers

Authorization
Bearer 5880e3e5891679926699
Referer
https://www.huntress.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type
application/json
visited_url
https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2

Response headers

content-encoding
gzip
cf-cache-status
DYNAMIC
etag
W/"cb-YdVY/YHnO8ZKiMrmY+IZ2P1eiHw"
apigw-requestid
DSW_CjSPvHcES-Q=
alt-svc
h3=":443"; ma=86400
x-cache
Miss from cloudfront
x-amz-cf-id
2YPG3OfWrJ6-0U3yyOrsdog5aN6EU3qBeWD4Tu-8iapR5oBy2ElrOA==
date
Tue, 24 Dec 2024 08:06:43 GMT
content-type
application/json; charset=utf-8
vary
Origin
priority
u=1,i
server-timing
cfExtPri
via
1.1 1ad12697f0062c092a5231330f069526.cloudfront.net (CloudFront)
cf-ray
8f6f17f6bc33225d-MIA
access-control-allow-origin
https://www.huntress.com
x-amz-cf-pop
MIA50-P1
x-powered-by
Express
server
cloudflare
getSubscriptions
js.zi-scripts.com/unified/v1/master/ Frame
0
0
Preflight
General
Full URL
https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.64.150.44 San Francisco, United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization,content-type,visited_url
Access-Control-Request-Method
GET
Origin
https://www.huntress.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-headers
Origin,X-Requested-With,Content-Type,Accept,Authorization,X-Amp-Device-Id,X-Amp-Session-Id,visited_url,_zitok,forwarded,x-ziaccesstoken
access-control-allow-methods
POST, GET, OPTIONS, PATCH, DELETE, PUT
access-control-allow-origin
https://www.huntress.com
alt-svc
h3=":443"; ma=86400
apigw-requestid
DSW_BhSpvHcESyA=
cf-cache-status
DYNAMIC
cf-ray
8f6f17f5bbc3225d-MIA
date
Tue, 24 Dec 2024 08:06:42 GMT
priority
u=1,i
server
cloudflare
server-timing
cfExtPri
vary
Origin
via
1.1 1ad12697f0062c092a5231330f069526.cloudfront.net (CloudFront)
x-amz-cf-id
Z8isTPm7W2NnWgN77ORip-2zzr7x0JeHjdr2Jd-6MGCFbEIyGrFEDQ==
x-amz-cf-pop
MIA50-P1
x-cache
Miss from cloudfront
x-powered-by
Express
xjosbwtcdf.m3u8
fast.wistia.com/embed/medias/
1 KB
1 KB
XHR
General
Full URL
https://fast.wistia.com/embed/medias/xjosbwtcdf.m3u8
Requested by
Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42:600::644 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
envoy /
Resource Hash
3c90424de283e0f696f1d08202d7423cc4a1983b99531106289b15863ee102c1
Security Headers
Name Value
Strict-Transport-Security max-age=0
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

x-request-id
4ce6935d-84dd-4551-9b93-50fef2df71e3
etag
W/"3c90424de283e0f696f1d08202d7423c"
age
15753
x-permitted-cross-domain-policies
none
x-content-type-options
nosniff
x-cache
Miss from cloudfront, HIT, HIT
x-amz-cf-id
ySL09bgAihTE46sJpdCADZhE4xGZYiri_Aeu7kyQftgLhrCyBZcB1A==
date
Tue, 24 Dec 2024 08:06:42 GMT
content-type
application/x-mpegURL
x-served-by
cache-iad-kcgs7200044-IAD, cache-mia-kmia1760052-MIA
x-runtime
0.035255
x-cache-hits
6298, 0
vary
Accept-Encoding,X-Forwarded-Proto,X-ECMA-Override
strict-transport-security
max-age=0
cache-control
public, no-cache
timing-allow-origin
*
x-envoy-upstream-service-time
37
x-timer
S1735027603.857642,VS0,VE1
via
1.1 7188701415bacec1212330181f9c1646.cloudfront.net (CloudFront), 1.1 varnish, 1.1 varnish
x-browser
chrome
x-ecma-v
modern
x-browser-version
131
accept-ranges
bytes
access-control-allow-origin
*
content-length
1120
x-amz-cf-pop
IAD61-P4
server
envoy
a3591ba5e949a37083cc6f5a4191e903.min.js
js.sentry-cdn.com/
3 KB
2 KB
Script
General
Full URL
https://js.sentry-cdn.com/a3591ba5e949a37083cc6f5a4191e903.min.js
Requested by
Host: fast.wistia.com
URL: https://fast.wistia.com/assets/external/publicApi.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:200::729 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
/
Resource Hash
e2617702866abfa1fca8d8d056d72e5f28d6fdeaf399422e3a5bca5f56f06d7a
Security Headers
Name Value
Content-Security-Policy img-src * blob: data:; frame-src app.pendo.io demo.arcade.software js.stripe.com sentry.io; media-src *; script-src 'self' 'unsafe-inline' 'report-sample' s1.sentry-cdn.com js.sentry-cdn.com browser.sentry-cdn.com statuspage-production.s3.amazonaws.com static.zdassets.com aui-cdn.atlassian.com connect-cdn.atl-paas.net js.stripe.com 'strict-dynamic' cdn.pendo.io data.pendo.io pendo-io-static.storage.googleapis.com pendo-static-5634074999128064.storage.googleapis.com; object-src 'none'; font-src * data:; connect-src 'self' *.algolia.net *.algolianet.com *.algolia.io sentry.io *.sentry.io s1.sentry-cdn.com o1.ingest.sentry.io api2.amplitude.com app.pendo.io data.pendo.io reload.getsentry.net t687h3m0nh65.statuspage.io sentry.zendesk.com ekr.zdassets.com maps.googleapis.com; worker-src blob:; style-src * 'unsafe-inline'; frame-ancestors 'self' *.sentry.io; default-src 'none'; base-uri 'none'; report-uri https://o1.ingest.sentry.io/api/54785/security/?sentry_key=f724a8a027db45f5b21507e7142ff78e&sentry_release=9b2543374b2ffee2e192253d7e32c5c376b47c63
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options deny
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://www.huntress.com
Referer
https://www.huntress.com/

Response headers

content-encoding
gzip
age
52
x-envoy-attempt-count
1
x-content-type-options
nosniff
date
Tue, 24 Dec 2024 08:06:42 GMT
content-type
text/javascript
x-served-by
frontend-misc-b9d998644-ftsbx, cache-chi-klot8100079-CHI, cache-mia-kmia1760058-MIA
vary
Accept-Encoding
x-frame-options
deny
strict-transport-security
max-age=31536000; includeSubDomains
content-security-policy
img-src * blob: data:; frame-src app.pendo.io demo.arcade.software js.stripe.com sentry.io; media-src *; script-src 'self' 'unsafe-inline' 'report-sample' s1.sentry-cdn.com js.sentry-cdn.com browser.sentry-cdn.com statuspage-production.s3.amazonaws.com static.zdassets.com aui-cdn.atlassian.com connect-cdn.atl-paas.net js.stripe.com 'strict-dynamic' cdn.pendo.io data.pendo.io pendo-io-static.storage.googleapis.com pendo-static-5634074999128064.storage.googleapis.com; object-src 'none'; font-src * data:; connect-src 'self' *.algolia.net *.algolianet.com *.algolia.io sentry.io *.sentry.io s1.sentry-cdn.com o1.ingest.sentry.io api2.amplitude.com app.pendo.io data.pendo.io reload.getsentry.net t687h3m0nh65.statuspage.io sentry.zendesk.com ekr.zdassets.com maps.googleapis.com; worker-src blob:; style-src * 'unsafe-inline'; frame-ancestors 'self' *.sentry.io; default-src 'none'; base-uri 'none'; report-uri https://o1.ingest.sentry.io/api/54785/security/?sentry_key=f724a8a027db45f5b21507e7142ff78e&sentry_release=9b2543374b2ffee2e192253d7e32c5c376b47c63
cache-control
public, max-age=3600, s-maxage=60, stale-while-revalidate=315360000, stale-if-error=315360000
timing-allow-origin
*
x-envoy-upstream-service-time
26
accept-ranges
bytes
access-control-allow-origin
*
content-length
1335
x-xss-protection
1; mode=block
bundle.es5.min.js
browser.sentry-cdn.com/7.120.2/
90 KB
28 KB
Script
General
Full URL
https://browser.sentry-cdn.com/7.120.2/bundle.es5.min.js
Requested by
Host: js.sentry-cdn.com
URL: https://js.sentry-cdn.com/a3591ba5e949a37083cc6f5a4191e903.min.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2a04:4e42:200::729 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
Fastly /
Resource Hash
bd705313aae42931009a71cb629bf0a847c7446759c63ad18cc4e9cba1f4ae83
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://www.huntress.com
Referer
https://www.huntress.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
cache-control
public, max-age=31536000
content-encoding
gzip
etag
"bd83da71c71901f502737a8970408462"
age
944895
expires
Sat, 13 Dec 2025 09:38:27 GMT
accept-ranges
bytes
access-control-allow-origin
*
content-length
28996
date
Tue, 24 Dec 2024 08:06:42 GMT
last-modified
Fri, 13 Dec 2024 07:43:51 GMT
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
server
Fastly
/
o4505518331658240.ingest.us.sentry.io/api/4505794284290048/envelope/
56 B
355 B
Fetch
General
Full URL
https://o4505518331658240.ingest.us.sentry.io/api/4505794284290048/envelope/?sentry_key=a3591ba5e949a37083cc6f5a4191e903&sentry_version=7&sentry_client=sentry.javascript.browser%2F7.120.2
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.120.195.249 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS
249.195.120.34.bc.googleusercontent.com
Software
nginx /
Resource Hash
7c1e2d0f6a27b6701cbfc14d4b2c6863a2de1753603e0eafaf1a1c42a4e22b65
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8
Referer
https://www.huntress.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
access-control-expose-headers
x-sentry-error,x-sentry-rate-limits,retry-after
cross-origin-resource-policy
cross-origin
via
1.1 google
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Tue, 24 Dec 2024 08:06:43 GMT
content-type
application/json
vary
origin, access-control-request-method, access-control-request-headers
server
nginx
formcomplete.js
ws-assets.zoominfo.com/
49 KB
15 KB
Script
General
Full URL
https://ws-assets.zoominfo.com/formcomplete.js
Requested by
Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.117.43 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
dcb09186a3d016b8ae56ecd0cb76f787254388177fc8318061d619b56a7d81b2

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

x-goog-metageneration
1
x-goog-hash
crc32c=A2aW0Q==, md5=JRurSHzL3UB0yE1Wjm0Zqg==
cf-cache-status
DYNAMIC
etag
W/"251bab487ccbdd4074c84d568e6d19aa"
age
513
content-encoding
gzip
x-goog-stored-content-encoding
identity
expires
Tue, 24 Dec 2024 08:58:10 GMT
alt-svc
h3=":443"; ma=86400
x-goog-stored-content-length
50634
server-timing
cfExtPri
date
Tue, 24 Dec 2024 08:06:43 GMT
content-type
application/javascript
last-modified
Wed, 06 Nov 2024 05:44:23 GMT
priority
u=3,i=?0
x-guploader-uploadid
AFiumC4asP2F2smJSIyFd4MgjKGuQJXZuSNUxCyeJcrL4ANOjKv4gOUwCp20uunwIAwPFUFfaFTkEgM
cache-control
public, max-age=3600
x-goog-storage-class
STANDARD
cf-ray
8f6f17f7f972b3cb-MIA
x-goog-generation
1730871862939881
server
cloudflare
/
ws.zoominfo.com/pixel/62f67a71a4cf97008ef6d460/
3 KB
2 KB
Fetch
General
Full URL
https://ws.zoominfo.com/pixel/62f67a71a4cf97008ef6d460/?iszitag=true
Requested by
Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.118.43 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
fdfb6c215abe26eb1b9fa83c0080d23ebd4e577d81de5cfa1fabbfac5949e40e
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

_zitok
464f04daacc27ae2ede21735027603
_vtok
MzguMTMyLjExOC43MA==
visited-url
https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Referer
https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type
text/javascript

Response headers

x-robots-tag
noindex, nofollow
content-encoding
gzip
cf-cache-status
DYNAMIC
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Tue, 24 Dec 2024 08:06:43 GMT
content-type
text/javascript
vary
Accept-Encoding
priority
u=1,i
access-control-allow-headers
Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url,page-url
access-control-allow-credentials
true
via
1.1 google
cf-ray
8f6f17f8c9200a36-MIA
access-control-allow-origin
https://www.huntress.com
x-powered-by
Express
server
cloudflare
/
ws.zoominfo.com/pixel/62f67a71a4cf97008ef6d460/ Frame
0
0
Preflight
General
Full URL
https://ws.zoominfo.com/pixel/62f67a71a4cf97008ef6d460/?iszitag=true
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.118.43 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept
*/*
Access-Control-Request-Headers
_vtok,_zitok,content-type,visited-url
Access-Control-Request-Method
GET
Origin
https://www.huntress.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url,page-url
access-control-allow-origin
https://www.huntress.com
allow
GET,HEAD
alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8f6f17f80fc0a56f-MIA
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Tue, 24 Dec 2024 08:06:43 GMT
priority
u=1,i
server
cloudflare
server-timing
cfExtPri
via
1.1 google
x-content-type-options
nosniff
x-powered-by
Express
x-robots-tag
noindex, nofollow
forms
ws.zoominfo.com/formcomplete-v2/
0
0

forms
ws.zoominfo.com/formcomplete-v2/ Frame
0
0
Preflight
General
Full URL
https://ws.zoominfo.com/formcomplete-v2/forms
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.118.43 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
Security Headers
Name Value
X-Frame-Options SAMEORIGIN

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization,content-type
Access-Control-Request-Method
POST
Origin
https://www.huntress.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

cache-control
private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
cf-ray
8f6f17f8a818a56f-MIA
content-type
text/html; charset=UTF-8
date
Tue, 24 Dec 2024 08:06:43 GMT
expires
Thu, 01 Jan 1970 00:00:01 GMT
referrer-policy
same-origin
server
cloudflare
x-frame-options
SAMEORIGIN
logError
ws.zoominfo.com/formcomplete-v2/ Frame
0
0
Preflight
General
Full URL
https://ws.zoominfo.com/formcomplete-v2/logError
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.118.43 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Accept
*/*
Access-Control-Request-Headers
authorization,content-type
Access-Control-Request-Method
POST
Origin
https://www.huntress.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,Authorization,visitorId,_zitok
access-control-allow-origin
https://www.huntress.com
allow
POST
alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
8f6f17f95873a56f-MIA
content-encoding
gzip
content-type
text/html; charset=utf-8
date
Tue, 24 Dec 2024 08:06:43 GMT
priority
u=1,i
server
cloudflare
server-timing
cfExtPri
via
1.1 google
x-content-type-options
nosniff
x-powered-by
Express
x-robots-tag
noindex, nofollow
logError
ws.zoominfo.com/formcomplete-v2/
15 B
390 B
Fetch
General
Full URL
https://ws.zoominfo.com/formcomplete-v2/logError
Requested by
Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.118.43 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare / Express
Resource Hash
edc48cd3b0bc4fa7ba23aad40b8508a17d370ca38be174bae2a2f64634e65a2b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Authorization
bearer ee0b7c00d7b33f2f419df08b3996eb
Referer
https://www.huntress.com/
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type
application/json

Response headers

x-robots-tag
noindex, nofollow
cf-cache-status
DYNAMIC
etag
W/"f-NQVRlQfKHCoInEbhALgECMonhCE"
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Tue, 24 Dec 2024 08:06:43 GMT
content-type
application/json; charset=utf-8
priority
u=1,i
access-control-allow-headers
Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,Authorization, visitorId, _zitok
access-control-allow-credentials
true
via
1.1 google
cf-ray
8f6f17f9d9800a36-MIA
access-control-allow-origin
https://www.huntress.com
content-length
15
x-powered-by
Express
server
cloudflare
mput
pipedream.wistia.com/
2 B
329 B
Fetch
General
Full URL
https://pipedream.wistia.com/mput?topic=metrics
Requested by
Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:266a:bc00:3:471f:5240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
envoy /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type
application/x-www-form-urlencoded
Referer
https://www.huntress.com/

Response headers

x-envoy-upstream-service-time
1
access-control-allow-methods
POST, OPTIONS
via
1.1 0b4bd786c6b93c5bc7d37331a04a3fdc.cloudfront.net (CloudFront)
access-control-allow-origin
*
x-cache
Miss from cloudfront
content-length
2
x-amz-cf-id
pkyhY15wjDhcNLNNdyugJrm9daNBvzw9HtCRBGk3faRRiCvMXUN0gQ==
date
Tue, 24 Dec 2024 08:06:43 GMT
content-type
text/plain; charset=utf-8
x-amz-cf-pop
JFK52-P5
server
envoy
rum
browser-intake-datadoghq.com/api/v2/
53 B
136 B
Fetch
General
Full URL
https://browser-intake-datadoghq.com/api/v2/rum?ddsource=browser&ddtags=sdk_version%3A5.34.1%2Capi%3Afetch%2Cenv%3Aproduction%2Cservice%3Ahuntress.com%2Cversion%3A1.0.0&dd-api-key=pub66bcc27a4e8914137e6493224fb92edb&dd-evp-origin-version=5.34.1&dd-evp-origin=browser&dd-request-id=48608fb5-7094-4d5a-a8a6-020db780c719&batch_time=1735027603482
Requested by
Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1f18:24e6:b901:72e3:1bfe:b271:96b2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
f6607b961b07d7b4a145e74a24477d8a871304a035100e0a5aa264d6c8ac6943
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8
Referer
https://www.huntress.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
access-control-allow-origin
*
content-length
53
accept-encoding
identity,gzip,x-gzip,deflate,x-deflate,zstd
date
Tue, 24 Dec 2024 08:06:43 GMT
content-type
application/json
dd-request-id
48608fb5-7094-4d5a-a8a6-020db780c719
img.gif
b.6sc.co/v1/beacon/
43 B
258 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=a87a3edc53b5a86d1795d11887b5aa39&svisitor=null&visitor=e51b62de-aebe-4aff-869c-596b7036ddc5&session=f4131538-26f2-49dc-8925-2ab13f50e703&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2024%20Dec%202024%2008%3A06%3A43%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2024%20Dec%202024%2008%3A06%3A42%20GMT%22%2C%22timeSpent%22%3A%221010%22%2C%22totalTimeSpent%22%3A%222017%22%7D&isIframe=false&m=%7B%22description%22%3A%22Huntress%20identified%20an%20emerging%20threat%20involving%20Cleo%E2%80%99s%20LexiCom%2C%20VLTransfer%2C%20and%20Harmony%20software%2C%20known%20as%20CVE-2024-55956%2C%20commonly%20used%20to%20manage%20file%20transfers.%20Read%20more%20about%20this%20emerging%20threat%20on%20the%20Huntress%20Blog.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Cleo%20Software%20Actively%20Being%20Exploited%20in%20the%20Wild%20CVE-2024-55956%20%7C%20Huntress%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fthreat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild%3Fis%3D3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2&pageViewId=6dcf070b-e742-4b90-80f6-ff030ee382b3&an_uid=0&webTagId=e666a54d-ff29-48f9-9baa-2be6ac05412e&ipv6=2001%3A550%3A1d05%3A1%3A%3A9&v=1.1.31
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.200.88.71 Secaucus, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
a23-200-88-71.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

cache-control
max-age=0, no-cache, no-store
etag
"63f02dad-2b"
pragma
no-cache
x-content-type-options
nosniff
expires
Tue, 24 Dec 2024 08:06:43 GMT
accept-ranges
bytes
content-length
43
date
Tue, 24 Dec 2024 08:06:43 GMT
content-type
image/gif
last-modified
Sat, 18 Feb 2023 01:45:17 GMT
server
nginx/1.14.0 (Ubuntu)
ac392291-4bf0-4ad7-b9ea-2cb8bbd94774
https://www.huntress.com/
3 KB
0
Script
General
Full URL
blob:https://www.huntress.com/ac392291-4bf0-4ad7-b9ea-2cb8bbd94774
Requested by
Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
fdfb6c215abe26eb1b9fa83c0080d23ebd4e577d81de5cfa1fabbfac5949e40e

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
text/javascript
Content-Length
3033
allIntegrations.js
fast.wistia.net/assets/external/
55 KB
14 KB
Script
General
Full URL
https://fast.wistia.net/assets/external/allIntegrations.js
Requested by
Host: fast.wistia.com
URL: https://fast.wistia.com/assets/external/publicApi.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a04:4e42::644 , United States, ASN54113 (FASTLY, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
e773b8e04b3034bac298b2ae1f532b5c5d475d91eaa4138af1510ccfd12470f0
Security Headers
Name Value
Strict-Transport-Security max-age=0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Origin
https://www.huntress.com
Referer

Response headers

content-encoding
br
etag
"b18246bcac6ea07a910ac8cb06e13247"
age
351
access-control-allow-methods
GET, HEAD
x-cache
HIT, HIT
date
Tue, 24 Dec 2024 08:06:43 GMT
last-modified
Fri, 20 Dec 2024 20:11:38 GMT
x-served-by
cache-iad-kjyo7100159-IAD, cache-mia-kmia1760036-MIA
x-cache-hits
3, 2
content-type
text/javascript
vary
Accept-Encoding
strict-transport-security
max-age=0
cache-control
public, max-age=3600
timing-allow-origin
*
x-timer
S1735027604.718900,VS0,VE0
via
1.1 varnish, 1.1 varnish
x-browser
chrome
x-ecma-v
modern
x-browser-version
131
accept-ranges
bytes
access-control-allow-origin
*
content-length
14221
asset-version
ea49143d3ad772007b2d472dbbb9c363df7c98a6
server
AmazonS3
x-amz-server-side-encryption
AES256
mput
pipedream.wistia.com/
2 B
328 B
Fetch
General
Full URL
https://pipedream.wistia.com/mput?topic=metrics
Requested by
Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:266a:bc00:3:471f:5240:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
envoy /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type
application/x-www-form-urlencoded
Referer
https://www.huntress.com/

Response headers

x-envoy-upstream-service-time
0
access-control-allow-methods
POST, OPTIONS
via
1.1 0b4bd786c6b93c5bc7d37331a04a3fdc.cloudfront.net (CloudFront)
access-control-allow-origin
*
x-cache
Miss from cloudfront
content-length
2
x-amz-cf-id
d2nS9fLnxFI8e39JzCFG_LIc_4dU5lIzGRWqov13uZyZsrspAqvk9g==
date
Tue, 24 Dec 2024 08:06:44 GMT
content-type
text/plain; charset=utf-8
x-amz-cf-pop
JFK52-P5
server
envoy
img.gif
b.6sc.co/v1/beacon/
43 B
258 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=a87a3edc53b5a86d1795d11887b5aa39&svisitor=null&visitor=e51b62de-aebe-4aff-869c-596b7036ddc5&session=f4131538-26f2-49dc-8925-2ab13f50e703&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2024%20Dec%202024%2008%3A06%3A44%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2024%20Dec%202024%2008%3A06%3A43%20GMT%22%2C%22timeSpent%22%3A%221010%22%2C%22totalTimeSpent%22%3A%223027%22%7D&isIframe=false&m=%7B%22description%22%3A%22Huntress%20identified%20an%20emerging%20threat%20involving%20Cleo%E2%80%99s%20LexiCom%2C%20VLTransfer%2C%20and%20Harmony%20software%2C%20known%20as%20CVE-2024-55956%2C%20commonly%20used%20to%20manage%20file%20transfers.%20Read%20more%20about%20this%20emerging%20threat%20on%20the%20Huntress%20Blog.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Cleo%20Software%20Actively%20Being%20Exploited%20in%20the%20Wild%20CVE-2024-55956%20%7C%20Huntress%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fthreat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild%3Fis%3D3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2&pageViewId=6dcf070b-e742-4b90-80f6-ff030ee382b3&an_uid=0&webTagId=e666a54d-ff29-48f9-9baa-2be6ac05412e&ipv6=2001%3A550%3A1d05%3A1%3A%3A9&v=1.1.31
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.200.88.71 Secaucus, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
a23-200-88-71.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

cache-control
max-age=0, no-cache, no-store
etag
"60bb2e15-2b"
pragma
no-cache
x-content-type-options
nosniff
expires
Tue, 24 Dec 2024 08:06:44 GMT
accept-ranges
bytes
content-length
43
date
Tue, 24 Dec 2024 08:06:44 GMT
content-type
image/gif
last-modified
Sat, 05 Jun 2021 07:56:05 GMT
server
nginx/1.14.0 (Ubuntu)
img.gif
b.6sc.co/v1/beacon/
43 B
258 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=a87a3edc53b5a86d1795d11887b5aa39&svisitor=null&visitor=e51b62de-aebe-4aff-869c-596b7036ddc5&session=f4131538-26f2-49dc-8925-2ab13f50e703&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2024%20Dec%202024%2008%3A06%3A45%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2024%20Dec%202024%2008%3A06%3A44%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%224027%22%7D&isIframe=false&m=%7B%22description%22%3A%22Huntress%20identified%20an%20emerging%20threat%20involving%20Cleo%E2%80%99s%20LexiCom%2C%20VLTransfer%2C%20and%20Harmony%20software%2C%20known%20as%20CVE-2024-55956%2C%20commonly%20used%20to%20manage%20file%20transfers.%20Read%20more%20about%20this%20emerging%20threat%20on%20the%20Huntress%20Blog.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Cleo%20Software%20Actively%20Being%20Exploited%20in%20the%20Wild%20CVE-2024-55956%20%7C%20Huntress%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fthreat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild%3Fis%3D3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2&pageViewId=6dcf070b-e742-4b90-80f6-ff030ee382b3&an_uid=0&webTagId=e666a54d-ff29-48f9-9baa-2be6ac05412e&ipv6=2001%3A550%3A1d05%3A1%3A%3A9&v=1.1.31
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.200.88.71 Secaucus, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
a23-200-88-71.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

cache-control
max-age=0, no-cache, no-store
etag
"63f02dad-2b"
pragma
no-cache
x-content-type-options
nosniff
expires
Tue, 24 Dec 2024 08:06:45 GMT
accept-ranges
bytes
content-length
43
date
Tue, 24 Dec 2024 08:06:45 GMT
content-type
image/gif
last-modified
Sat, 18 Feb 2023 01:45:17 GMT
server
nginx/1.14.0 (Ubuntu)
replay
browser-intake-datadoghq.com/api/v2/
53 B
136 B
Fetch
General
Full URL
https://browser-intake-datadoghq.com/api/v2/replay?ddsource=browser&ddtags=sdk_version%3A5.34.1%2Capi%3Afetch%2Cenv%3Aproduction%2Cservice%3Ahuntress.com%2Cversion%3A1.0.0&dd-api-key=pub66bcc27a4e8914137e6493224fb92edb&dd-evp-origin-version=5.34.1&dd-evp-origin=browser&dd-request-id=da488461-d280-42fc-a053-52b764c70605
Requested by
Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1f18:24e6:b901:72e3:1bfe:b271:96b2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
8a99446088a12a73cdd0a20ef79e257b65db0c9259575b19de5a9f72e92f582b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type
multipart/form-data; boundary=----WebKitFormBoundaryE93pLYVvg6b28YDZ
Referer
https://www.huntress.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
access-control-allow-origin
*
content-length
53
accept-encoding
identity,gzip,x-gzip,deflate,x-deflate,zstd
date
Tue, 24 Dec 2024 08:06:46 GMT
content-type
application/json
dd-request-id
da488461-d280-42fc-a053-52b764c70605
img.gif
b.6sc.co/v1/beacon/
43 B
257 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=a87a3edc53b5a86d1795d11887b5aa39&svisitor=null&visitor=e51b62de-aebe-4aff-869c-596b7036ddc5&session=f4131538-26f2-49dc-8925-2ab13f50e703&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2024%20Dec%202024%2008%3A06%3A46%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2024%20Dec%202024%2008%3A06%3A45%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%225028%22%7D&isIframe=false&m=%7B%22description%22%3A%22Huntress%20identified%20an%20emerging%20threat%20involving%20Cleo%E2%80%99s%20LexiCom%2C%20VLTransfer%2C%20and%20Harmony%20software%2C%20known%20as%20CVE-2024-55956%2C%20commonly%20used%20to%20manage%20file%20transfers.%20Read%20more%20about%20this%20emerging%20threat%20on%20the%20Huntress%20Blog.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Cleo%20Software%20Actively%20Being%20Exploited%20in%20the%20Wild%20CVE-2024-55956%20%7C%20Huntress%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fthreat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild%3Fis%3D3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2&pageViewId=6dcf070b-e742-4b90-80f6-ff030ee382b3&an_uid=0&webTagId=e666a54d-ff29-48f9-9baa-2be6ac05412e&ipv6=2001%3A550%3A1d05%3A1%3A%3A9&v=1.1.31
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.200.88.71 Secaucus, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
a23-200-88-71.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

cache-control
max-age=0, no-cache, no-store
etag
"63f020a0-2b"
pragma
no-cache
x-content-type-options
nosniff
expires
Tue, 24 Dec 2024 08:06:46 GMT
accept-ranges
bytes
content-length
43
date
Tue, 24 Dec 2024 08:06:46 GMT
content-type
image/gif
last-modified
Sat, 18 Feb 2023 00:49:36 GMT
server
nginx/1.14.0 (Ubuntu)
img.gif
b.6sc.co/v1/beacon/
43 B
257 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=a87a3edc53b5a86d1795d11887b5aa39&svisitor=null&visitor=e51b62de-aebe-4aff-869c-596b7036ddc5&session=f4131538-26f2-49dc-8925-2ab13f50e703&event=active_time_track&q=%7B%22currentTime%22%3A%22Tue%2C%2024%20Dec%202024%2008%3A06%3A47%20GMT%22%2C%22lastTrackTime%22%3A%22Tue%2C%2024%20Dec%202024%2008%3A06%3A46%20GMT%22%2C%22timeSpent%22%3A%221000%22%2C%22totalTimeSpent%22%3A%226028%22%7D&isIframe=false&m=%7B%22description%22%3A%22Huntress%20identified%20an%20emerging%20threat%20involving%20Cleo%E2%80%99s%20LexiCom%2C%20VLTransfer%2C%20and%20Harmony%20software%2C%20known%20as%20CVE-2024-55956%2C%20commonly%20used%20to%20manage%20file%20transfers.%20Read%20more%20about%20this%20emerging%20threat%20on%20the%20Huntress%20Blog.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22Cleo%20Software%20Actively%20Being%20Exploited%20in%20the%20Wild%20CVE-2024-55956%20%7C%20Huntress%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fwww.huntress.com%2Fblog%2Fthreat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild%3Fis%3D3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2&pageViewId=6dcf070b-e742-4b90-80f6-ff030ee382b3&an_uid=0&webTagId=e666a54d-ff29-48f9-9baa-2be6ac05412e&ipv6=2001%3A550%3A1d05%3A1%3A%3A9&v=1.1.31
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.200.88.71 Secaucus, United States, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
a23-200-88-71.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Referer
https://www.huntress.com/

Response headers

cache-control
max-age=0, no-cache, no-store
etag
"615ccf10-2b"
pragma
no-cache
x-content-type-options
nosniff
expires
Tue, 24 Dec 2024 08:06:47 GMT
accept-ranges
bytes
content-length
43
date
Tue, 24 Dec 2024 08:06:47 GMT
content-type
image/gif
last-modified
Tue, 05 Oct 2021 22:17:52 GMT
server
nginx/1.14.0 (Ubuntu)
rum
browser-intake-datadoghq.com/api/v2/
53 B
136 B
Fetch
General
Full URL
https://browser-intake-datadoghq.com/api/v2/rum?ddsource=browser&ddtags=sdk_version%3A5.34.1%2Capi%3Afetch%2Cenv%3Aproduction%2Cservice%3Ahuntress.com%2Cversion%3A1.0.0&dd-api-key=pub66bcc27a4e8914137e6493224fb92edb&dd-evp-origin-version=5.34.1&dd-evp-origin=browser&dd-request-id=fe0d507f-d5d0-4012-9d45-dd3275080625&batch_time=1735027607640
Requested by
Host: www.datadoghq-browser-agent.com
URL: https://www.datadoghq-browser-agent.com/us1/v5/datadog-logs.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:1f18:24e6:b901:72e3:1bfe:b271:96b2 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software
/
Resource Hash
564d6e3e556cb5955988cc99ccfe5868b105ef20598118b3b2cb7fe78e2d8583
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8
Referer
https://www.huntress.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
access-control-allow-origin
*
content-length
53
accept-encoding
identity,gzip,x-gzip,deflate,x-deflate,zstd
date
Tue, 24 Dec 2024 08:06:47 GMT
content-type
application/json
dd-request-id
fe0d507f-d5d0-4012-9d45-dd3275080625

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
a.quora.com
URL
https://a.quora.com/qevents.js
Domain
www.huntress.com
URL
blob:https://www.huntress.com/24c56ada-3442-4637-bd3c-b168a4e799a9
Domain
ws.zoominfo.com
URL
https://ws.zoominfo.com/formcomplete-v2/forms

Verdicts & Comments Add Verdict or Comment

158 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| ___grecaptcha_cfg object| grecaptcha string| __recaptcha_api boolean| __google_recaptcha_client object| dataLayer object| zi string| ZIProjectKey string| SITE_VERSION object| DD_LOGS object| DD_RUM function| LoadDriftWidget object| mutiny function| $ function| jQuery object| mutinyWpJsonp function| addEventListenerWithParams function| validateEmailAddress function| nbResponseResult function| setHutkVal function| isValidRecaptcha function| resetFormState function| setSuccessState function| setFailedState function| submitClickListener function| setCorrelationId function| setPageUrl function| setCountryName function| setSubmitButtonValue function| hubSpotPreFormSubmitHandler function| hubSpotFormSubmitHandler function| formSubmitListener function| clearError object| link object| __webpack_modules__ object| __webpack_module_cache__ function| __webpack_require__ object| __webpack_exports__ object| Wistia object| wistiaOptions function| tram object| Webflow function| objectFitPolyfill function| findFormSubmitButton function| initSnowplowTracker object| GlobalSnowplowNamespace function| snowplow_ft function| snowplow object| accordion object| displayUntilElements number| currentDate object| WebflowTools object| google_tag_manager object| google_tag_data object| recaptcha string| _wistiaElemId object| _hsp function| getCookie function| mediumZoom string| _linkedin_data_partner_id function| rdt function| qp string| qpGtm function| fbq function| _fbq function| hj object| _hjSettings object| _NBSettings object| techtargetic function| saq function| _saq object| uetq function| spdt function| twq object| fsAttributes object| FsAttributes object| closure_lm_949134 function| onYouTubeIframeAPIReady boolean| PIXELS_RAN object| enabledEventSettings object| _hsq boolean| _hspb_ran boolean| _hspb_loaded object| __hsCollectedFormsDebug object| hsCtasOnReady object| __PRIVATE__HubspotCtaClient object| hsCallsToActionsReady object| __hsWebInteractiveInstance object| hsConversationsOnReady object| HubSpotCallsToActions boolean| hubspot_web_interactives_running function| redditNormalizeEmail object| globalRoot function| bindToWindowOnError object| leadflows object| hubspot function| OutpostErrorReporter function| _registerAvailablePopup object| _availablePopups boolean| popupPoliceActive boolean| LEAD_FLOWS_RAN boolean| COMMON_SETUP_RAN object| gaGlobal object| snowplowButtonClickTracking function| sanitizeKey boolean| _hstc_loaded object| t object| n function| e object| _wq function| UET function| UET_init function| UET_push object| ueto_7c6f51b923 object| hjSiteSettings object| hjLazyModules function| hjBootstrap object| hjBootstrapCalled object| _6si object| SENTRY_RELEASE object| _nb function| __neverbounce_992127 object| regeneratorRuntime object| twttr function| lintrk boolean| _already_called_lintrk object| ORIBILI object| res object| saCookies string| current_window_url_param function| drift object| drift_init_options object| 3eiXJRXgVuLsYGH9303q object| _driftFrames object| __post_robot_10_0_46__ string| __DRIFT_ENV__ string| __DRIFT_BUILD_ID__ string| __DRIFT_BRANCH__ boolean| drift_invoked boolean| _hstc_ran string| __hsUserToken number| expireDateTime object| zitag object| ZILogs function| loadZILogs function| errorHandler object| Sentry string| SENTRY_SDK_SOURCE object| __SENTRY__ object| _zi_fc object| _zi object| ziws

54 Cookies

Domain/Path Name / Value
.hs-scripts.com/ Name: __cf_bm
Value: c3iM.ODfxfltFfpxEl4N.x9eEJ8HvZFW8F9tRc8avtE-1735027600-1.0.1.1-blyOENX_ThqwRvFehV3bmrIWGXY6cuaI9RUsjvd7BVxXULrOBYbIDW3l.c8NpctgEDwvJ6JKoVGNlUPts2L95Q
.hsadspixel.net/ Name: __cf_bm
Value: uANxhAhHp5hfa6veiQiiHt0RZ3R2DqzFCzz65HbZFO8-1735027600-1.0.1.1-0uFlRj1dwAPS6jsaZnoTYmGzJBVxN7RZ5NJtRjsgLGEZfIKVpfRfpSgsy03ce1ajUCbF7CKaXM7GHPBWccuKrg
.hs-banner.com/ Name: __cf_bm
Value: W0MxqSqTSDzq2ho.mNWaOKx7DhLgs6UbPk6DwobmJ_Y-1735027600-1.0.1.1-.wQ7iGQRf1jq.m5MKwCHOeCQae7_5JVSHhH4D6BLbP6i4WyjCYAPwkR6Pl1peyjaEX0Ll6C10N7QNlwPbo3fRw
.huntress.com/ Name: _sp_ses.1564
Value: *
.hs-analytics.net/ Name: __cf_bm
Value: DfKw2Faxe67NNehDw_YSm9HN576zbDLCstpwYJdA6.A-1735027601-1.0.1.1-0P5O0fxaY0MWtPitP3iDYk0iyIbuan47LAjEiJvv8UyZv.w9RlJcRbnRhUguVVJPdkfI468nELtxbBD3jdZbFA
.huntress.com/ Name: _rdt_uuid
Value: 1735027601114.f79df72e-0758-4f3f-b6a8-39b42bf5769a
.techtarget.com/ Name: __cf_bm
Value: nqTQPOXo6A7nPdZnEE4nFmoLxk9QTtrpOmna_BEnWmA-1735027601-1.0.1.1-OzfqD19gCKRsTTkG7kcVgxebTKVp59jpeferbfrslY4ou5sZGrpO79iWmWAmCI33kQGLA6ZVpeIT05FGnMcVsA
tags.srv.stackadapt.com/ Name: sa-user-id
Value: s%3A0-2c2df343-078c-5f5c-5e20-760050e08db7.snsH4E%2FAyqmh%2Bl%2Fo2o%2BobQpFCzY%2BZeNI9SaOvxJMKIo
.srv.stackadapt.com/ Name: sa-user-id
Value: s%3A0-2c2df343-078c-5f5c-5e20-760050e08db7.snsH4E%2FAyqmh%2Bl%2Fo2o%2BobQpFCzY%2BZeNI9SaOvxJMKIo
tags.srv.stackadapt.com/ Name: sa-user-id-v2
Value: s%3ALC3zQweMX1xeIHYAUOCNtyaEdkY.GdEPQUkp2agv5EyFIeXKJWSmX2GpxrT%2BQxumnRcGG50
.srv.stackadapt.com/ Name: sa-user-id-v2
Value: s%3ALC3zQweMX1xeIHYAUOCNtyaEdkY.GdEPQUkp2agv5EyFIeXKJWSmX2GpxrT%2BQxumnRcGG50
tags.srv.stackadapt.com/ Name: sa-user-id-v3
Value: s%3AAQAKIAPUedzHQELGu9dQtoE8inZnRYgwfzgcKmWRYGWBTArwENYBGAQgkdepuwYwAToExbdv9kIEYIxUeg.rTeNNos1xaoF3nYDk%2BDHlS5cdTnQ610X5quRXvESXh0
.srv.stackadapt.com/ Name: sa-user-id-v3
Value: s%3AAQAKIAPUedzHQELGu9dQtoE8inZnRYgwfzgcKmWRYGWBTArwENYBGAQgkdepuwYwAToExbdv9kIEYIxUeg.rTeNNos1xaoF3nYDk%2BDHlS5cdTnQ610X5quRXvESXh0
.huntress.com/ Name: _ga_GCTMBVFESS
Value: GS1.1.1735027601.1.0.1735027601.60.0.0
.huntress.com/ Name: _ga
Value: GA1.1.1059849745.1735027601
.g2crowd.com/ Name: __cf_bm
Value: 43d.owmXkZGDrhsTwGZhwmHKBORm.0KR13FmizBmPx8-1735027601-1.0.1.1-t1i3dSR_rD8Scw4Kz0a80KZWK3ODDhpDfXpIpPp2_xXobBwKwbZ17CedFJDE_5Ef_Vco6wfemyk75OvyrUKBKg
.huntress.com/ Name: _gcl_au
Value: 1.1.1724909886.1735027601.1913920476.1735027601.1735027601
www.huntress.com/ Name: __spdt
Value: 3556f6973d954bd5bf1f30806f20a4cc
www.huntress.com/ Name: sa-user-id
Value: s%253A0-2c2df343-078c-5f5c-5e20-760050e08db7.snsH4E%252FAyqmh%252Bl%252Fo2o%252BobQpFCzY%252BZeNI9SaOvxJMKIo
www.huntress.com/ Name: sa-user-id-v2
Value: s%253ALC3zQweMX1xeIHYAUOCNtyaEdkY.GdEPQUkp2agv5EyFIeXKJWSmX2GpxrT%252BQxumnRcGG50
www.huntress.com/ Name: sa-user-id-v3
Value: s%253AAQAKIAPUedzHQELGu9dQtoE8inZnRYgwfzgcKmWRYGWBTArwENYBGAQgkdepuwYwAToExbdv9kIEYIxUeg.rTeNNos1xaoF3nYDk%252BDHlS5cdTnQ610X5quRXvESXh0
.huntress.com/ Name: _fbp
Value: fb.1.1735027601458.420175617186782264
.huntress.com/ Name: _uetsid
Value: 02214980c1ce11efb70c25223e7c8c0d
.huntress.com/ Name: _uetvid
Value: 02215b40c1ce11ef94016b09ad891d8d
.doubleclick.net/ Name: test_cookie
Value: CheckForPermission
.bing.com/ Name: MUID
Value: 26DE670D825968700221725283C96924
.bat.bing.com/ Name: MR
Value: 0
.hsforms.com/ Name: __cf_bm
Value: zPawb_lQ4ShYuKy4ApC9TGIkATkKqXXaP32mHnaiObI-1735027601-1.0.1.1-CkPoqYZuDEcKvq61UoPJVDA4GWzenfyKjZ_ZtnXVQ_mhpgloGt3_E9Y7YgNw6ObTGVyU.DYymbJt7sX9Ugx6Wg
.hsforms.com/ Name: _cfuvid
Value: GGip8Xrkw.64oDk0kZ0cOFlZFNAEusPkSRTgqcD_wmU-1735027601627-0.0.1.1-604800000
.huntress.com/ Name: _hjSessionUser_2159185
Value: eyJpZCI6Ijg4YTg1OGUwLWExOTEtNWY5NC1hMmMxLTRhOTRmMmZjYmE4NyIsImNyZWF0ZWQiOjE3MzUwMjc2MDE3NjksImV4aXN0aW5nIjp0cnVlfQ==
.huntress.com/ Name: _hjSession_2159185
Value: eyJpZCI6IjAyYjE2ODM2LTE2MDEtNDQyMi04OTIyLTZhMDNiNjNiZGQ5MiIsImMiOjE3MzUwMjc2MDE3NzEsInMiOjEsInIiOjAsInNiIjowLCJzciI6MCwic2UiOjAsImZzIjoxLCJzcCI6MH0=
www.huntress.com/ Name: _gd_visitor
Value: e51b62de-aebe-4aff-869c-596b7036ddc5
www.huntress.com/ Name: _gd_session
Value: f4131538-26f2-49dc-8925-2ab13f50e703
.twitter.com/ Name: guest_id_marketing
Value: v1%3A173502760178593747
.twitter.com/ Name: guest_id_ads
Value: v1%3A173502760178593747
.twitter.com/ Name: personalization_id
Value: "v1_UUPwYpkIZ/uRG8/KQKschw=="
.twitter.com/ Name: guest_id
Value: v1%3A173502760178593747
.adnxs.com/ Name: receive-cookie-deprecation
Value: 1
www.huntress.com/ Name: _an_uid
Value: 0
.t.co/ Name: muc_ads
Value: 7ac0f520-307a-4e24-87cd-703e6f7645b1
.t.co/ Name: __cf_bm
Value: MfReduFCeucR6DXkuhqDxTvjhmEB22iTBziZdvYG0dk-1735027601-1.0.1.1-X8Noh0QF2qfrKUBhZPcFnamQwKyWyKm23OqnKbPsxeKw0duSrcMC8rkuKKBE6H1uPRtzMHlP37Nvioc3nCFo8w
.linkedin.com/ Name: li_sugr
Value: b5df328a-f8d3-4753-8978-8065b541ad65
.linkedin.com/ Name: bcookie
Value: "v=2&d4a827b4-0593-4732-894c-b8188eb335a7"
.linkedin.com/ Name: lidc
Value: "b=OGST05:s=O:r=O:a=O:p=O:g=3261:u=1:x=1:i=1735027601:t=1735114001:v=2:sig=AQEi7W6-ot2DLdFOCmysWxj7Lh2oVg7Z"
.linkedin.com/ Name: UserMatchHistory
Value: AQI3Z8kQsDMj6wAAAZP3tDIvFcV6CVcjmmoCIhNi0mX_ZiTae_8ZlrWH2N7uVGMf3Ys2gOcArgq15w
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQKfXgqktse6sQAAAZP3tDIv5hrW5_jqduV43E7qp9KYo0OCORvHducOJPxB_k2BS__Uvvoj1w62T82JEcBj2g
.www.linkedin.com/ Name: bscookie
Value: "v=1&20241224080642438d9400-7d76-416f-8ba4-6b817ac607f5AQFF6Czpai8fcISSdVWormU4sA8LHUWB"
.huntress.com/ Name: _sp_id.1564
Value: 88c29b49-71ca-433f-bdd5-ca1d201662e7.1735027601.1.1735027603..20d1432f-fc04-4a7a-b39d-c790412b94a3..f7fa049b-0431-449b-b180-48cf5ce44a1a.1735027602687.2
.hubspot.com/ Name: __cf_bm
Value: ZCzHUv6.4f6eEBXlps4xhqs3zEvAxQnQ9LHgDpPSa0c-1735027602-1.0.1.1-Ey.O4zVTPFlp7UEKxR1Rj81VqpDHnWqIq2aZMeafNMQVhJCbOmLQwxk6t.pfnlXJmfhaU.Gijg9tIj.r7zCa8g
.hubspot.com/ Name: _cfuvid
Value: LAhKmXQHl0SVDvGXr8PEJIDutX.6FGTMrd4ELBuuhV4-1735027602874-0.0.1.1-604800000
.huntress.com/ Name: sp
Value: bffb13b9-5fec-4e5f-b60d-835c1ae151da
.www.huntress.com/ Name: _zitok
Value: 464f04daacc27ae2ede21735027603
.zoominfo.com/ Name: _cfuvid
Value: aoXGnZs7JRFSMPGPrNdjd.iYCP.qHmxU_eb.GD2cy3A-1735027603232-0.0.1.1-604800000
www.huntress.com/ Name: _dd_s
Value: logs=1&id=23e3d3f7-5722-40c2-b2cb-f727747ca5f7&created=1735027600399&expire=1735028500469&rum=1

4 Console Messages

Source Level URL
Text
network error URL: https://a.quora.com/qevents.js
Message:
Failed to load resource: net::ERR_BLOCKED_BY_RESPONSE.NotSameOrigin
network error URL: https://o4505518331658240.ingest.us.sentry.io/api/4505794284290048/envelope/?sentry_key=a3591ba5e949a37083cc6f5a4191e903&sentry_version=7&sentry_client=sentry.javascript.browser%2F7.120.2
Message:
Failed to load resource: the server responded with a status of 403 ()
javascript error URL: https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild?is=3cc281958f63eebc723632b92b93875672eaaa64090471f4e2d75510ccf799c2
Message:
Access to fetch at 'https://ws.zoominfo.com/formcomplete-v2/forms' from origin 'https://www.huntress.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.
network error URL: https://ws.zoominfo.com/formcomplete-v2/forms
Message:
Failed to load resource: net::ERR_FAILED

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy frame-ancestors 'self' https://hub.huntress.com https://huntress-new.webflow.io https://huntress.seismic.com;

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

a.quora.com
ajax.googleapis.com
alb.reddit.com
analytics.google.com
analytics.twitter.com
api.neverbounce.com
b.6sc.co
bat.bing.com
browser-intake-datadoghq.com
browser.sentry-cdn.com
c.6sc.co
cdn.jsdelivr.net
cdn.neverbounce.com
cdn.prod.website-files.com
click.email.sans.org
client-registry.mutinycdn.com
connect.facebook.net
cta-service-cms2.hubspot.com
d3e54v103j8qbb.cloudfront.net
distillery.wistia.com
embed-ssl.wistia.com
fast.wistia.com
fast.wistia.net
forms.hscollectedforms.net
forms.hsforms.com
gist.github.com
github.githubassets.com
google.com
ibc-flow.techtarget.com
ipv6.6sc.co
j.6sc.co
js.driftt.com
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.hsadspixel.net
js.hscollectedforms.net
js.hsleadflows.net
js.hubspot.com
js.sentry-cdn.com
js.zi-scripts.com
o4505518331658240.ingest.us.sentry.io
perf-na1.hsforms.com
pipedream.wistia.com
pixel-config.reddit.com
pixel.byspotify.com
pixels.spotify.com
px.ads.linkedin.com
px4.ads.linkedin.com
q.quora.com
script.hotjar.com
secure.adnxs.com
snap.licdn.com
static.ads-twitter.com
static.hotjar.com
static.huntresscdn.com
stats.g.doubleclick.net
t.co
t.huntress.com
tags.srv.stackadapt.com
td.doubleclick.net
tools.refokus.com
track.hubspot.com
tracking-api.production.g2.com
tracking.g2crowd.com
trk.techtarget.com
webhooks.fivetran.com
ws-assets.zoominfo.com
ws.zoominfo.com
www.datadoghq-browser-agent.com
www.facebook.com
www.google.com
www.googletagmanager.com
www.gstatic.com
www.huntress.com
www.linkedin.com
www.redditstatic.com
a.quora.com
ws.zoominfo.com
www.huntress.com
104.16.117.43
104.16.118.43
104.18.160.117
104.18.80.204
104.19.175.188
104.244.42.195
108.138.106.78
108.139.54.225
13.107.42.14
13.225.63.24
13.33.251.183
13.33.252.127
136.147.189.155
140.82.113.3
142.250.65.164
142.250.72.110
146.75.36.157
151.101.129.229
151.101.193.91
151.101.65.140
151.101.67.52
162.159.153.247
172.64.150.44
172.66.0.227
18.164.96.46
18.238.55.7
185.199.111.154
2001:4860:4802:32::181
23.200.88.71
2600:141b:1c00:2e::17d1:48d1
2600:141b:1c00:6::17df:d105
2600:1901:1:7c5::
2600:1f18:24e6:b901:72e3:1bfe:b271:96b2
2600:9000:21b8:1a00:1e:c86:4140:93a1
2600:9000:266a:bc00:3:471f:5240:93a1
2606:4700:20::681a:ad
2606:4700:4400::ac40:9310
2606:4700::6810:6efe
2606:4700::6810:7674
2606:4700::6810:89d1
2606:4700::6810:a0a8
2606:4700::6811:80ac
2606:4700::6812:1347
2606:4700::6812:1fb0
2606:4700::6812:8d11
2607:f8b0:4004:c06::9a
2607:f8b0:4006:80d::2008
2607:f8b0:4006:80e::2002
2607:f8b0:4006:81c::2003
2607:f8b0:4006:81d::200a
2620:1ec:21::14
2620:1ec:33:1::10
2a04:4e42:200::729
2a04:4e42:600::485
2a04:4e42:600::644
2a04:4e42::396
2a04:4e42::644
3.233.126.24
31.13.65.36
31.13.65.7
34.111.208.231
34.117.162.98
34.120.195.249
34.139.124.58
34.196.12.18
44.198.96.243
54.145.131.117
68.67.181.103
76.223.15.4
0020be3f1555293342637940e02d32e0f0c3b1951f6a274c00a6e3afe91610d1
009c517f25ca5b2dc84784a3433c905c83537f031c63c080ae1e02df75fc90a8
01366f3e3bbc518168394ae3d84db2b7b96ad623562cf6baf0968e273defbf5e
027f9fef93a2d620715de7311a5bf674cb3df18a352d2a0a7266c147c157333f
0c07b854855b0e2bd7839c3659defa45307e96e281b3c00571d09f213eb6a76e
0c7178cc6ca34fb18e30f070a5e7a1c287b2d7ccfcba2cfdf06e0f46eda55740
10429db431cbd2fc042c7397c8f1e62996d636ddeef2702c912d9fb7fc650c35
112cd29ef362c35c4c9ebe4806e6a678d5e62ec0d68d30b55ba584190b18d795
1402811141d6cf6956918acd3398468bd385081a50b90a5d251fe7a3312c0801
14328f67af6b839ac4f57c7e5c2b32ef51e9d2d0f6532731120d1c989f8476f2
1764bc84ea6abe91f1634b73a5a6c0ebff400461dfea6a4040bd0c03d86caa8b
1e1fd2fe50ec28f7768e206d51760c817982ca62ac2b8e48f31f56576e70d28a
2316eedc39d2ae71b2098be3e91ad3662cb1b70d42f6c61ebb6ab5beefd919b6
2418c9b2b788e3ea84865dbd1efe80567dc77be8523c4f5c9271df07c5139808
24751cbae618f6fbeb532498fd1ceeda5350f30085086cd5426961a2695e3d9f
2689367b205c16ce32ed4200942b8b8b1e262dfc70d9bc9fbc77c49699a4f1df
269ae54dd73d89793323dd5814c9b382e9bcb8a1e8533bbd654e9478ce2f6d4d
2b0fbfb6b248aab96e5c34dea4842314d34ade82780ac991aa9507c1a646c6b9
2c699eb55ae3fe61b3d783c8936ab1eb949c596a5c89118f703e328ede2b8308
2dfe28cbdb83f01c940de6a88ab86200154fd772d568035ac568664e52068363
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
350cf9ff67297ce9f79b1a35fb7205326d21f149ab404f81ec875968f0b7d083
36b097a74149a547cc7fe1da7b5a9cacf6c36d2f91872f11874479e1d4fafee2
3c90424de283e0f696f1d08202d7423cc4a1983b99531106289b15863ee102c1
3d5e2f7e7d7b47abbb9e045643f1f783327593164a1cc826823b86935ea0dc1b
3d9093851b0b2347611090c65fa9583f0e7caf5b0fa712007f6638515fdc5603
4081a5f270ace3305571b8f393e20c3a50141d103fb6fced35cf64d5182c2cd2
410bc437980cd2bf8f388c099ea15a4a4e0e687341055adaafe0450f728981b6
420b8db005b9223c5e1d9ba4140abc2356eac8069735ad8c870fcc8313828de4
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
442375f1dd6362e4a3e889f3f11e7d14aa686899a36f112ae73986a80475681b
47824fb47f1f4ed58e4e6ad9706eda4471ac98102e4b5dd84c180603354c9f33
4922a8859b315c354c23ad278e35483c6cf29aebf1c509c2c928c1f41634fe43
4dceacbf31977470786701c48799e1a24967f145f6281b421f0d48a0fd6f2ed0
51ca3efdd5899fe7cadf8a244b247ca13b89ff6b322b2ca12758322db8da042a
5391ba1ea0e305e29df1bc7c1cea8d264ae924843ba6672cc7d504b1fb53f40e
543351d4360e32621e4bb7588aa7b81d1fbc027c580a6246938e3fc8a2dfedcc
548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
553797b86e5516ebb3b4a6ffc794d7d9eca1fc1f3ca8ab0703e5eff9934e29c8
564d6e3e556cb5955988cc99ccfe5868b105ef20598118b3b2cb7fe78e2d8583
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
5932f75a425a9c8d1c5b8bfd25777b5ce5af01f596e925ee8c393a7dee1e3a5b
61647a0bdc00666f1e6c0619b42fe1ed522a255f703d6c9fb45e5a22e90c17cf
640d525f0c6d09a6cdc4c6f6b0d44c4d2d92ce5e35ae1a945ccac5da67071f9d
652e8677aec33767d2a5f229384f79b4f526104bf7e94d7d258070f94743c3cc
653267cc251288e709b21804225fe741c382fb14fe397e1005cb0b885083ba2e
674d5ab1e2c5a783115e67fabc4805ac2e8a83d48eb6a1ad3535c23a959a1801
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6c0d4e3bd890a4bf01c9a301d3e3ff127af22636c4f94250cc230815eb701593
6f3642cd8faa981a6b7f71cb0bd88a222ed7c92510100761c38f4bfd689853f2
71425f588c17edb9905c3ed73aee0404b58772b91c8154fe53d3157f58f0b2e2
71ff609fb53e30a44f5b97eb292f1daeaae937fd18c8699ff4064d425a2f6210
790dccf2671e2e84968bc73b3341078979eb93cc4a20e77f0454e0d8f7cc2d22
7c1e2d0f6a27b6701cbfc14d4b2c6863a2de1753603e0eafaf1a1c42a4e22b65
7da57a437a999e2503178063a85ca9557211686f50d7671db0142a2ceb3095d2
7f48f3ce60332f4b98af436696611cd315285ad19d4468af784e80a8f073d4b7
7f62ee80b8c824f30ad6c278146632d25b7e159e0a9cd91a356068eb9340061c
7f8bc25ed93cda3b731e3fee0f426764de8cd21ba43f9557923cdd89cc2225c3
7fe2559e602297a61f2b4b798435323cbe8e566b825e4b395e284cb9a6b8db15
82ba33778a6595a59baef6e6964c64d7c3e9888c2bbf74461f1948b295db28e2
889e4055351e629718cc9647a7f696cb4fb1e246bcf29bd25e2f8ce5105c27b5
894f93b24189898a84b033b15a5223ca8c63bd8d8dd5dfc54d31dc87e037ef87
89aa43cb2db8717165e898b18806ad757585f8815f9f514bb0afbd3c390def95
8a99446088a12a73cdd0a20ef79e257b65db0c9259575b19de5a9f72e92f582b
8c50c60c0a774b595ebca31a479693fc74066f6c55f904799790efd4f0642664
8d2f56691b3acbcde12b8d7f58a1130f0637a6e72dcb760aebaca0ff939db146
8f0f089b8d2746c56340171bba62f027d4d2dc0f520588d9480432693381e14a
93a2fd82dd3a13a9e9ce0583f3bde1b6e88da6ebce30fa8c87cee4d9d927e4d2
93d4a7e5e9ddf6d92a8c155e8f402d0e6aada0b73eacdc2c4b9be337d308fbde
94c33d6b7a8a3ec1b2fa2f21d8d13e760f5a2b1d0bcd6bc79040eaf8fc3db99a
98d77039ea9249b3dce91ad7b467ee382f29daa61213c3e2737bd4a8786c8801
99ad7afebc78c84be7097c53ec37782c23f13b78404673ca266b3290319cf990
a1e79865576e220b93dfe34d011286a8335ee8ac4eb6450300fb45a4f15a600e
a4aba4543a40b2e2d78e4006eb941a3a18cf95dc81041ad362321a3995bcc898
a577cc713533d7a1edbc5186c3f7b8788bbf317a857111150778d6a617220cec
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
aabc88a6db8b22022f96ca88e4f0a7be426abef2b35169a71515a2d55246402a
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
ace449f8c185f9f62716fd9998c8f4d09f6849ead77ec8c3849aa69f4c8c1d36
ad1a0bf17b8433241806ec0b3cb9c17be616ea295df90068ab3e646de802e111
ad9dea1ac2eb241166c18f9fa47c760e456171d9ebcc4ae40b4abf1b92fdc9d4
b04b76399ee4aef0bf30eb5a3c8fa794785b690f0e8594b3d7d016806c26b38e
b261530f05e272e18b5b5c86d860c4979c82b5b6c538e1643b3c94fc9ba76dd6
b3468d16ad043cb04a12a90d6e9ccc7152fa29747f4a304875e9695e66394495
b58912cc3bf0066c2e66dbde3b7881fcf87ad4948314b3e264511a0ee192fc90
bc8ab7e0b55fff2c3651c4d71964c7f9c46abf81ad2fbf64abeeab4084855718
bd705313aae42931009a71cb629bf0a847c7446759c63ad18cc4e9cba1f4ae83
c12f11d824a0e7cb513ff4574c1664ac5c3949efc35896edeb0612fe45f1c00b
c2894cd697b6e87cd89a195120ff37714770ecd37316ecb15515d54ff399a0a2
c397f4ba950e1a41f2629374b350ffe5ae0442ab9b0bb4742f618c7a089aaad6
c68a273bf2b08c99c46ac43d1059b8067818b3b889fa890b068d942a957a000c
c821dd2f8d12eab5b584ed29a4075008d8defc15fc1090e59841330b9d8d10bd
c82da715fa06b3537fad12eafa4ec2fd0031dc426b1d7cf10214786c8e629b60
c99531b584c2990420c6cf8f267e27bca20375cf89d4afdcaa5b3afb7a9f35d2
c99d11cb4960d6e1918ed55d5bcbb316d38b51098e2efc1201904d7274d3273e
ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
cd72aeb01656187cdb7dcb6e74fe11d38b23dc2a7bece84c723ad81ef56b581d
ce54d767f01eb9114389e6ef95a27fe04211a98a4a7a0a4a6a56cb9274656e63
ce6f51ef30adef6442774f5f60a50ed096c5dc797f9dc65069538324797a2987
cfae8b984e17800ed9c948b8597762d2427984b451d809ee1e1bedffa9362704
cfeb21563fae9a04d315a4e6b1083b6bee877405ff0d29bb27503fc5499bccbd
d0d8837abb30839d383fb8ec75c1d5f85aed4429fd949e5958a09be0d038a707
d4963b8afebfa0063b5d17b4c80f49bce702a37ea5c9b91bb3c996bb9dea4b60
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dc8100597827a188e39056320ab8ba9428cc9272cd74f8cd132d5854b6ca5822
dcb09186a3d016b8ae56ecd0cb76f787254388177fc8318061d619b56a7d81b2
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
dd1e0693fedd274eb1a447ae03add46f2781fd54f8ae2f47184e6e2a63b95bd9
dd28ae51d0905b06265882747d25d114914193a3f14a6c7fed734153d7492b71
de3421dd0135b085e9a0079299f9747f1546b1d03ed5010c41b2997b3352fde3
e2617702866abfa1fca8d8d056d72e5f28d6fdeaf399422e3a5bca5f56f06d7a
e38338484d969872e570a554c807dab4a79233b82d64a7cb7028fb459123d44a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e4fd04a54ebf90f08e74b2ad14620a2da4b21d15f5ff5a6fbbe2bab5da5aec41
e6b8a90a2870483ace67380ff4a64b39bfecb7952a432393470d76a6614fc62c
e773b8e04b3034bac298b2ae1f532b5c5d475d91eaa4138af1510ccfd12470f0
ed9fa70145ee3f5fa23b5bb33c1a43771df4b18c2d52b921be3060dbb11855d9
edc48cd3b0bc4fa7ba23aad40b8508a17d370ca38be174bae2a2f64634e65a2b
ef1598216ee946f370aaefb331a0d494d43d681d0972b348915b62c8a818233e
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f05c5f2c71c87a8fa8887410fd3cf4a32009caad461e0ac26f8f7190fd123d9e
f2314da0b26cc727445f74c19d54f2f75944ea1a610497231ba6a5d9e541acf0
f25eec203bc322c7cc1a7a9edeba6073b48c7d497953d0829f4382f17e1dcc3e
f6607b961b07d7b4a145e74a24477d8a871304a035100e0a5aa264d6c8ac6943
f747a6b8633575162fcb12b74e1f55a964aac27cae5c89720efcc29985c26198
f7f6a5894f1d19ddad6fa392b2ece2c5e578cbf7da4ea805b6885eb6985b6e3d
fc573eaf0e39d6b2429951f78b744dde5acb4cbee85a9b903aea0210072d9b48
fc9a93dd241f6b045cbff0481cf4e1901becd0e12fb45166a8f17f95823f0b1a
fdfb6c215abe26eb1b9fa83c0080d23ebd4e577d81de5cfa1fabbfac5949e40e
fe04a9dc88d3f3be8d4f6bc63a9a80f45a4c6d8460e7551dab849457c091920a
fedef5d4449d0caf6cc8c396b9a02c10e9b404c3d7293b46f501b5cba09366b8