doublepulsar.com Open in urlscan Pro
52.1.147.205 Public Scan

Go To Rescan
Add Verdict Report

Submitted URL:
https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73...
Effective URL:
https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73...
Submission: On January 29 via manual (January 29th 2020, 7:12:43 pm UTC) from NO

Summary HTTP 67 Redirects Links 28 Behaviour Indicators

Summary

This website contacted 13 IPs in 3 countries across 9 domains to perform 67 HTTP transactions. The main IP is 52.1.147.205, located in Ashburn, United States and belongs to AMAZON-AES, US. The main domain is doublepulsar.com.
TLS certificate: Issued by Sectigo RSA Domain Validation Secure ... on March 20th 2019. Valid for: a year.

This is the only time doublepulsar.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
1 6	52.1.147.205 52.1.147.205	14618 (AMAZON-AES) (AMAZON-AES)
1 1	2606:4700::68... 2606:4700::6810:797f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2a02:26f0:6c0... 2a02:26f0:6c00:181::13b8	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
6	2606:4700::68... 2606:4700::6810:7591	13335 (CLOUDFLAR...) (CLOUDFLARENET)
32	2606:4700::68... 2606:4700::6810:7691	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:814::200e	15169 (GOOGLE) (GOOGLE)
1	13.35.254.197 13.35.254.197	16509 (AMAZON-02) (AMAZON-02)
1	143.204.214.65 143.204.214.65	16509 (AMAZON-02) (AMAZON-02)
1	2600:9000:20e... 2600:9000:20eb:8400:19:9934:6a80:93a1	16509 (AMAZON-02) (AMAZON-02)
2	52.5.230.147 52.5.230.147	14618 (AMAZON-AES) (AMAZON-AES)
4	2600:9000:20e... 2600:9000:20eb:b200:11:f728:3040:93a1	16509 (AMAZON-02) (AMAZON-02)
2	34.225.221.107 34.225.221.107	14618 (AMAZON-AES) (AMAZON-AES)
10	34.194.182.13 34.194.182.13	14618 (AMAZON-AES) (AMAZON-AES)
67	13

6 52.1.147.205 (Ashburn, United States) 1 redirects

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-1-147-205.compute-1.amazonaws.com

doublepulsar.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:797f (United States) 1 redirects

ASN13335 (CLOUDFLARENET, US)

medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:6c00:181::13b8 (Ascension Island)

ASN20940 (AKAMAI-ASN1, US)

cdn.optimizely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

6 2606:4700::6810:7591 (United States)

ASN13335 (CLOUDFLARENET, US)

glyph.medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

32 2606:4700::6810:7691 (United States)

ASN13335 (CLOUDFLARENET, US)

miro.medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
cdn-client.medium.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:814::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.35.254.197 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-13-35-254-197.fra6.r.cloudfront.net

d1z2jf7jlzjs58.cloudfront.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 143.204.214.65 (Seattle, United States)

ASN16509 (AMAZON-02, US)
PTR: server-143-204-214-65.fra53.r.cloudfront.net

cdn.branch.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:9000:20eb:8400:19:9934:6a80:93a1 (United States)

ASN16509 (AMAZON-02, US)

app.link	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 52.5.230.147 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-52-5-230-147.compute-1.amazonaws.com

srv-2020-01-29-19.pixel.parsely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2600:9000:20eb:b200:11:f728:3040:93a1 (United States)

ASN16509 (AMAZON-02, US)

api2.branch.io	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 34.225.221.107 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-225-221-107.compute-1.amazonaws.com

errors.client.optimizely.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 34.194.182.13 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)
PTR: ec2-34-194-182-13.compute-1.amazonaws.com

collector-medium.lightstep.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
39	medium.com 1 redirects medium.com glyph.medium.com miro.medium.com cdn-client.medium.com	1 MB
10	lightstep.com collector-medium.lightstep.com	2 KB
6	doublepulsar.com 1 redirects doublepulsar.com	33 KB
5	branch.io cdn.branch.io api2.branch.io	24 KB
3	optimizely.com cdn.optimizely.com errors.client.optimizely.com	81 KB
2	parsely.com srv-2020-01-29-19.pixel.parsely.com	765 B
2	google-analytics.com www.google-analytics.com	18 KB
1	app.link app.link	724 B
1	cloudfront.net d1z2jf7jlzjs58.cloudfront.net	17 KB
67	9

	Domain	Requested by
22	miro.medium.com	doublepulsar.com cdn-client.medium.com
10	collector-medium.lightstep.com	cdn-client.medium.com
10	cdn-client.medium.com	doublepulsar.com cdn-client.medium.com
6	glyph.medium.com	doublepulsar.com
6	doublepulsar.com	1 redirects cdn-client.medium.com
4	api2.branch.io	cdn-client.medium.com
2	errors.client.optimizely.com	cdn-client.medium.com
2	srv-2020-01-29-19.pixel.parsely.com	d1z2jf7jlzjs58.cloudfront.net
2	www.google-analytics.com	doublepulsar.com
1	app.link	cdn.branch.io
1	cdn.branch.io	doublepulsar.com
1	d1z2jf7jlzjs58.cloudfront.net	cdn-client.medium.com
1	cdn.optimizely.com	doublepulsar.com
1	medium.com	1 redirects
67	14

This site contains links to these domains. Also see Links.

Domain
medium.com
blog.gentilkiwi.com
www.korznikov.com
arstechnica.co.uk
www.youtube.com
github.com
help.medium.com

Subject Issuer	Validity	Valid
doublepulsar.com Sectigo RSA Domain Validation Secure Server CA	`2019-03-20` - `2020-03-19`	a year	crt.sh
cdn.optimizely.com DigiCert ECC Secure Server CA	`2018-11-24` - `2020-02-23`	a year	crt.sh
*.medium.com DigiCert SHA2 Secure Server CA	`2018-07-31` - `2020-09-09`	2 years	crt.sh
*.google-analytics.com GTS CA 1O1	`2020-01-14` - `2020-04-07`	3 months	crt.sh
*.cloudfront.net DigiCert Global CA G2	`2019-07-17` - `2020-07-05`	a year	crt.sh
*.branch.io DigiCert SHA2 Secure Server CA	`2018-12-05` - `2020-12-08`	2 years	crt.sh
appipv4.link Amazon	`2019-08-19` - `2020-09-19`	a year	crt.sh
*.pixel.parsely.com Let's Encrypt Authority X3	`2019-12-02` - `2020-03-01`	3 months	crt.sh
errors.client.optimizely.com DigiCert SHA2 High Assurance Server CA	`2018-09-24` - `2020-09-28`	2 years	crt.sh
*.lightstep.com Let's Encrypt Authority X3	`2019-11-26` - `2020-02-24`	3 months	crt.sh

This page contains 1 frames:

Primary Page: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068
Frame ID: 2C63250C152D2513426D66BA71DB8767
Requests: 71 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page URL History Show full URLs

https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move... HTTP 302
https://medium.com/m/global-identity?redirectUrl=https%3A%2F%2Fdoublepulsar.com%2Frdp-hijacking... HTTP 302
https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move... Page URL

Detected technologies

Nginx (Web Servers) Expand

Overall confidence: 100%
Detected patterns

headers server /nginx(?:\/([\d.]+))?/i

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

script /google-analytics\.com\/(?:ga|urchin|analytics)\.js/i

Page Statistics

67
Requests

100 %
HTTPS

54 %
IPv6

9
Domains

14
Subdomains

13
IPs

3
Countries

1406 kB
Transfer

3157 kB
Size

4
Cookies

28 Outgoing links

These are links going to different origins than the main page.

URL: https://medium.com/?source=post_page-----da2a1e73a5f6----------------------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=login&redirect=https%3A%2F%2Fdoublepulsar.com%2Frdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6&source=post_page-----da2a1e73a5f6---------------------nav_reg-
Title: Sign in

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fdoublepulsar.com%2Frdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6&source=post_page-----da2a1e73a5f6---------------------nav_reg-
Title: Get started

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fdoublepulsar.com%2Frdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6&source=-7db6d2df42a6-------------------------follow_byline-
Title: Follow

Search URL Search Domain Scan URL

URL: https://medium.com/p/da2a1e73a5f6/share/twitter?source=post_actions_header---------------------------

Search URL Search Domain Scan URL

URL: https://medium.com/p/da2a1e73a5f6/share/facebook?source=post_actions_header---------------------------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fdoublepulsar.com%2Frdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6&source=post_actions_header--------------------------bookmark_sidebar-

Search URL Search Domain Scan URL

URL: http://blog.gentilkiwi.com/securite/vol-de-session-rdp
Title: Benjamin Delpy

Search URL Search Domain Scan URL

URL: http://www.korznikov.com/2017/03/0-day-or-feature-privilege-escalation.html
Title: Alexander Korznikov

Search URL Search Domain Scan URL

URL: https://arstechnica.co.uk/security/2016/11/trick-or-treat-google-issues-warning-of-critical-windows-vulnerability/
Title: SYSTEM exploits

Search URL Search Domain Scan URL

URL: https://www.youtube.com/watch?v=OgsoIoWmhWw
Title: https://www.youtube.com/watch?v=OgsoIoWmhWw

Search URL Search Domain Scan URL

URL: https://github.com/ztgrace/sticky_keys_hunter
Title: ztgrace/sticky_keys_huntersticky_keys_hunter - A script to test an RDP host for sticky keys and utilman backdoor.github.com

Search URL Search Domain Scan URL

URL: https://github.com/gentilkiwi/mimikatz/releases
Title: gentilkiwi/mimikatzmimikatz - A little tool to play with Windows securitygithub.com

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fdoublepulsar.com%2Frdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6&source=post_sidebar--------------------------follow_sidebar-
Title: Follow

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fdoublepulsar.com%2Frdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6&source=post_sidebar-----da2a1e73a5f6---------------------clap_sidebar-

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fdoublepulsar.com%2Frdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6&source=post_actions_footer-----da2a1e73a5f6---------------------clap_footer-

Search URL Search Domain Scan URL

URL: https://medium.com/p/da2a1e73a5f6/share/twitter?source=post_actions_footer---------------------------

Search URL Search Domain Scan URL

URL: https://medium.com/p/da2a1e73a5f6/share/facebook?source=post_actions_footer---------------------------

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fdoublepulsar.com%2Frdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6&source=post_actions_footer--------------------------bookmark_sidebar-

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fdoublepulsar.com%2Frdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6&source=follow_footer-7db6d2df42a6-------------------------follow_footer-
Title: Follow

Search URL Search Domain Scan URL

URL: https://medium.com/m/signin?operation=register&redirect=https%3A%2F%2Fdoublepulsar.com%2Frdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6&source=follow_footer--------------------------follow_footer-
Title: Follow

Search URL Search Domain Scan URL

URL: https://medium.com/p/da2a1e73a5f6/responses/show?source=follow_footer--------------------------follow_footer-
Title: See responses (5)

Search URL Search Domain Scan URL

URL: https://medium.com/about?autoplay=1&source=post_page-----da2a1e73a5f6----------------------
Title: Discover Medium

Search URL Search Domain Scan URL

URL: https://medium.com/topics?source=post_page-----da2a1e73a5f6----------------------
Title: Make Medium yours

Search URL Search Domain Scan URL

URL: https://medium.com/membership?source=post_page-----da2a1e73a5f6----------------------
Title: Become a member

Search URL Search Domain Scan URL

URL: https://help.medium.com/?source=post_page-----da2a1e73a5f6----------------------
Title: Help

Search URL Search Domain Scan URL

URL: https://medium.com/policy/9db0094a1e0f?source=post_page-----da2a1e73a5f6----------------------
Title: Legal

Search URL Search Domain Scan URL

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6 HTTP 302
https://medium.com/m/global-identity?redirectUrl=https%3A%2F%2Fdoublepulsar.com%2Frdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6 HTTP 302
https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068 Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

67 HTTP transactions
4 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2

200

Primary Request rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6 Show response
doublepulsar.com/
Redirect Chain

https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
https://medium.com/m/global-identity?redirectUrl=https%3A%2F%2Fdoublepulsar.com%2Frdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068

162 KB
32 KB

1388ms
1388ms

Document
text/html

52.1.147.205
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.1.147.205 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-1-147-205.compute-1.amazonaws.com

Software

nginx /

Resource Hash

b90725c6bfd681ced61bb48780a94c1aecf809181002cda01a2a1ca7ba83d758

Security Headers

Name	Value
X-Frame-Options	allow-from medium.com

Request headers

:method: GET
:authority: doublepulsar.com
:scheme: https
:path: /rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068
pragma: no-cache
cache-control: no-cache
upgrade-insecure-requests: 1
user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
sec-fetch-user: ?1
accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
sec-fetch-site: none
sec-fetch-mode: navigate
accept-encoding: gzip, deflate, br
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Sec-Fetch-User: ?1

Response headers

status: 200
server: nginx
date: Wed, 29 Jan 2020 19:12:24 GMT
content-type: text/html; charset=utf-8
set-cookie: optimizelyEndUserId=lo_iXFHNZJMl3BS; path=/; expires=Thu, 28 Jan 2021 19:12:23 GMT; samesite=none; secure uid=lo_iXFHNZJMl3BS; path=/; expires=Thu, 28 Jan 2021 19:12:23 GMT; samesite=none; secure; httponly sid=1:gUQoO0TcXZiJqtUZtO5lTraY6XOhPgHsgJ33nI2I+i8pb4yKxdEa6h/OYIy3rMdY; path=/; expires=Thu, 28 Jan 2021 19:12:23 GMT; samesite=none; secure; httponly
sepia-upstream: production
x-frame-options: allow-from medium.com
cache-control: no-cache, no-store, max-age=0, must-revalidate
medium-fulfilled-by: lite/master-20200129-174809-4132d44ee3, rito/master-20200129-173555-02b8289012, tutu/medium-39832
etag: W/"289a9-Cd7nbnRS0IQgTQD7RNPu7+2V8Fs"
vary: Accept-Encoding
content-encoding: gzip
x-envoy-upstream-service-time: 1209

Redirect headers

status: 302
date: Wed, 29 Jan 2020 19:12:23 GMT
content-type: application/octet-stream
set-cookie: __cfduid=df22ad093f5c22059ff0ceca1a61def091580325142; expires=Fri, 28-Feb-20 19:12:22 GMT; path=/; domain=.medium.com; HttpOnly; SameSite=Lax uid=lo_iXFHNZJMl3BS; Expires=Thu, 28-Jan-21 19:12:23 GMT; Domain=.medium.com; Path=/; Secure; HttpOnly optimizelyEndUserId=lo_iXFHNZJMl3BS; path=/; expires=Thu, 28 Jan 2021 19:12:23 GMT; domain=.medium.com; samesite=none; secure sid=1:GTK229leaXsFIKgju+BmQ54wISacW34ef8ax6aF2o6jvL9stWk+xqezT9jCgrqwE; path=/; expires=Thu, 28 Jan 2021 19:12:23 GMT; domain=.medium.com; samesite=none; secure; httponly __cfruid=148ab34e61210f8b44e96036c3852b6b6f9981b5-1580325143; path=/; domain=.medium.com; HttpOnly; Secure; SameSite=None
content-security-policy: default-src 'self'; connect-src https://localhost https://*.instapaper.com https://*.stripe.com https://glyph.medium.com https://*.paypal.com https://getpocket.com https://medium.com https://*.medium.com https://*.medium.com https://medium.com https://*.medium.com https://*.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://*.lightstep.com https://*.branch.io 'self'; font-src data: https://*.amazonaws.com https://*.medium.com https://glyph.medium.com https://medium.com https://*.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://*.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://*.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
x-frame-options: sameorigin
x-content-type-options: nosniff
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge, Chrome=1
x-powered-by: Medium
x-obvious-tid: 1580325143100:2b401b6cb501
x-obvious-info: 39833-0649fde,0649fdef085
link: <https://medium.com/humans.txt>; rel="humans"
cache-control: no-cache, no-store, max-age=0, must-revalidate
expires: Thu, 09 Sep 1999 09:09:09 GMT
pragma: no-cache
location: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068
strict-transport-security: max-age=15552000; includeSubDomains; preload
cf-cache-status: DYNAMIC
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
server: cloudflare
cf-ray: 55cd846ce941beb0-FRA

GET
H2 200 16180790160.js Show response
cdn.optimizely.com/js/ 262 KB
81 KB 18ms
6ms Script
text/javascript 2a02:26f0:6c00:181::13b8
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn.optimizely.com/js/16180790160.js

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:6c00:181::13b8 , Ascension Island, ASN20940 (AKAMAI-ASN1, US),

Reverse DNS

Software

AmazonS3 /

Resource Hash

8f8292ac0b6005f405a55e5db2d60c2096de9cb501d84b72df45a71d5780fa7c

Security Headers

Name	Value
Strict-Transport-Security	max-age=15768000

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

x-amz-meta-pci_enabled: False
x-amz-version-id: hStH5GGQ0nhUEKSHCr1aENbaDgSb730F
content-encoding: gzip
x-amz-request-id: 501730A0204766EA
status: 200
access-control-max-age: 86400
date: Wed, 29 Jan 2020 19:12:24 GMT
x-amz-replication-status: COMPLETED
server-timing: cdn;desc="AkamaiION";dur=0,rtt;desc="4";dur=0,cdnip;desc="2a02:26f0:6c00:181::13b8";dur=0,cdnmap;desc="";dur=0,proto;desc="h2";dur=0
strict-transport-security: max-age=15768000
content-length: 81875
x-amz-id-2: 9KNL8DlrxDfbeln2O1C8BaM4go8tyZWZl+pHEp1HTPKADXbgbKYSljK0lmZpVVkDY+LUVcFBXCo=
last-modified: Wed, 29 Jan 2020 17:51:13 GMT
server: AmazonS3
etag: "167bb94de60c72e15f07ae54d59d9ef4"
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: text/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: x-amz-meta-revision
cache-control: max-age=120
x-amz-meta-revision: 825
accept-ranges: bytes
timing-allow-origin: *
access-control-allow-headers: *

GET
H2 200 m2.css
glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/ 44 KB
29 KB 47ms
26ms Stylesheet
text/css 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

087a4c7aa118304c5ce85d5917d95a49b3c93204ef3500752dfde52595e4eac6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 29 Jan 2020 19:12:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2520
status: 200
access-control-max-age: 86400
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: text/css
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=14400
access-control-allow-credentials: true
cf-ray: 55cd8479fde72754-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Wed, 29 Jan 2020 23:12:24 GMT

GET
H2 200 1*bry5HIDtIpONm_IDzSVYWA.jpeg
miro.medium.com/max/164/ 6 KB
6 KB 65ms
47ms Image
image/jpeg 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/164/1*bry5HIDtIpONm_IDzSVYWA.jpeg

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

e544bd8d73fe98d8ba7a775515ae3f80b1dc3d63f6aaded903352e5bfd0dbf5f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 29 Jan 2020 19:12:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1171073
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3196-7da812a
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 5682
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 55cd8479fad99aaa-FRA
expires: Fri, 28 Feb 2020 19:12:24 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 43 KB
17 KB 6ms
5ms Script
text/javascript 2a00:1450:4001:814::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Mon, 19 Aug 2019 17:22:41 GMT
server: Golfe2
age: 2331
date: Wed, 29 Jan 2020 18:33:33 GMT
vary: Accept-Encoding
content-type: text/javascript
status: 200
cache-control: public, max-age=7200
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 17803
expires: Wed, 29 Jan 2020 20:33:33 GMT

GET
DATA 200
OK truncated
/ 9 KB
9 KB Font
font/opentype

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 99c5448d6c84fc71d6805e2485727db250113edcaea123a064f8c26ce95947d8

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Origin: https://doublepulsar.com

Response headers

Content-Type: font/opentype

GET
H2 200 collect
www.google-analytics.com/r/ 35 B
101 B 14ms
14ms Image
image/gif 2a00:1450:4001:814::200e
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google-analytics.com/r/collect?v=1&_v=j79&a=656404896&t=pageview&_s=1&dl=https%3A%2F%2Fdoublepulsar.com%2Frdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6%3Fgi%3D91da4b8c2068&ul=en-us&de=UTF-8&dt=RDP%20hijacking%20%E2%80%94%20how%20to%20hijack%20RDS%20and%20RemoteApp%20sessions%20transparently%20to%20move%20through%20an%20organisation&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=IEBAAEAB~&jid=1562703964&gjid=1952530972&cid=664639393.1580325145&tid=UA-24232453-2&_gid=1351598528.1580325145&_r=1&z=906848666

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:814::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

pragma: no-cache
date: Wed, 29 Jan 2020 19:12:24 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
access-control-allow-origin: *
content-type: image/gif
status: 200
cache-control: no-cache, no-store, must-revalidate
alt-svc: quic=":443"; ma=2592000; v="46,43",h3-Q050=":443"; ma=2592000,h3-Q049=":443"; ma=2592000,h3-Q048=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000
content-length: 35
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 1*bAnzT3NFn-9L1xf_XWqzgA.jpeg
miro.medium.com/fit/c/96/96/ 4 KB
4 KB 31ms
30ms Image
image/jpeg 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/96/96/1*bAnzT3NFn-9L1xf_XWqzgA.jpeg

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

3aa0d1997e4797fd162e0cb072757c98d1a1450814cc2cbb4d08180e55c1cd3d

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 29 Jan 2020 19:12:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 664360
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3196-7da812a
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 4457
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 55cd847a7b7e9aaa-FRA
expires: Fri, 28 Feb 2020 19:12:24 GMT

GET
H2 200 1*bd6ZhReKUzjJwunNpA6cDg.gif
miro.medium.com/freeze/max/60/ 766 B
843 B 21ms
21ms Image
image/jpeg 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/freeze/max/60/1*bd6ZhReKUzjJwunNpA6cDg.gif?q=20

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

84e57719d1208500d7efe55c983d9b9ac288c82f9f81e2d0562a13dd922646b2

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 29 Jan 2020 19:12:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1683793
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3196-7da812a
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 766
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 55cd847a7b7f9aaa-FRA
expires: Fri, 28 Feb 2020 19:12:24 GMT

GET
H2 200 1*Wr_SRDwI4hYKClcVKc0rrQ.png
miro.medium.com/max/60/ 2 KB
2 KB 22ms
21ms Image
image/png 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/1*Wr_SRDwI4hYKClcVKc0rrQ.png?q=20

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

315dd7535645055e1fe3d8b1e0e635561266a36be467b5914776b3157a923811

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 29 Jan 2020 19:12:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 39471
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3209-f49543a
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 1708
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 55cd847a7b809aaa-FRA
expires: Fri, 28 Feb 2020 19:12:24 GMT

GET
H2 200 1*S5y5lGUCtZXvGQi7IpHpew.png
miro.medium.com/max/60/ 2 KB
2 KB 24ms
24ms Image
image/png 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/60/1*S5y5lGUCtZXvGQi7IpHpew.png?q=20

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

466fa52768ab18d92daf1c12f9e4265e242e849beb826ccdd88d9cd2d0439fb1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 29 Jan 2020 19:12:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 39471
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3197-fb89d63
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 1654
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 55cd847a7b819aaa-FRA
expires: Fri, 28 Feb 2020 19:12:24 GMT

GET
H2 200 1*oFF3A3KhTzGrEnS_3vV36g.gif
miro.medium.com/freeze/max/60/ 853 B
945 B 19ms
18ms Image
image/jpeg 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/freeze/max/60/1*oFF3A3KhTzGrEnS_3vV36g.gif?q=20

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

d72f686c585ca0ee1f3830895c5031c8310015e667cea7a4eb164818578fcef5

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 29 Jan 2020 19:12:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 292307
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3209-f49543a
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 853
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 55cd847a7b839aaa-FRA
expires: Fri, 28 Feb 2020 19:12:24 GMT

GET
H2 200 1*bAnzT3NFn-9L1xf_XWqzgA.jpeg
miro.medium.com/fit/c/160/160/ 8 KB
9 KB 25ms
25ms Image
image/jpeg 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/160/160/1*bAnzT3NFn-9L1xf_XWqzgA.jpeg

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

7b58407d0e2327c81eb74dfae158cb4abd6765864446e02de0a9964a9a3ac0e7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 29 Jan 2020 19:12:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2523635
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3207-e0e5660
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 8643
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 55cd847a7b849aaa-FRA
expires: Fri, 28 Feb 2020 19:12:24 GMT

GET
H2 200 1*euFkwA7zJWm-l7aDoNtJrw.jpeg
miro.medium.com/fit/c/160/160/ 10 KB
10 KB 34ms
33ms Image
image/jpeg 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/160/160/1*euFkwA7zJWm-l7aDoNtJrw.jpeg

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

12ae1072afc293ec30101e3f8d4eee96b04952b8f21ac49df261e70ae69cafbf

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 29 Jan 2020 19:12:24 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2523635
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3196-7da812a
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 10240
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 55cd847a7b859aaa-FRA
expires: Fri, 28 Feb 2020 19:12:24 GMT

GET
H2 200 manifest.dfd6bf3a.js Show response
cdn-client.medium.com/lite/static/js/ 4 KB
2 KB 40ms
25ms Script
application/javascript 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/manifest.dfd6bf3a.js

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9b4099b39d076b74a80876fb3a14732680df8a24d44f1e2b493cd3cbc7149eee

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 29 Jan 2020 19:12:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 4206
cf-ray: 55cd847aabbf9aaa-FRA
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
x-amz-request-id: E450AE7B9D2DC543
x-amz-id-2: 1XTOa6wxkZABBuVHUbq5ecqvcCbDwgLsFdH8Vl7gw7dY/TsqZ0PVel+B6Rg5bw+AiA16jWDbz9E=
last-modified: Wed, 29 Jan 2020 17:55:26 GMT
server: cloudflare
etag: W/"831a0b8fc590ec9ce2193b6e8ffb9ebc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: bX4gD9VilGeV04mcJrwLaUREWYHhOtfW
vary: Accept-Encoding
cache-control: public, max-age=31536000
content-type: application/javascript
expires: Thu, 28 Jan 2021 19:12:24 GMT

GET
H2 200 vendors~main.a133fb80.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 757 KB
198 KB 53ms
38ms Script
application/javascript 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/vendors~main.a133fb80.chunk.js

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b79eb86973be4f5f4f0e13240d44fb3159feb6faf712f0182ad2b96acb1eee7b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 29 Jan 2020 19:12:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 344677
cf-ray: 55cd847aabc29aaa-FRA
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
x-amz-request-id: FB030BE5E21C5FAC
x-amz-id-2: u0Z03VoYgI5CiPwINr0zGoLACItlAwIh5tkDrpV28x6SMp19F7Z8cLNashqHOyfBWlI671SHW8g=
last-modified: Wed, 08 Jan 2020 22:18:08 GMT
server: cloudflare
etag: W/"20d4b9213c56b87279628c2a70dc16fc"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: _CxpRTIbxXS3UIsnGI_SaWk1BSxRkH6x
vary: Accept-Encoding
cache-control: public, max-age=31536000
content-type: application/javascript
expires: Thu, 28 Jan 2021 19:12:24 GMT

GET
H2 200 main.b6ab3697.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 447 KB
102 KB 38ms
23ms Script
application/javascript 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/main.b6ab3697.chunk.js

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

0c5b1efc6a1eaaf0ab7c93aae52167e2cc2478655f99bb162422e042533f2d5b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 29 Jan 2020 19:12:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 76217
cf-ray: 55cd847aabc09aaa-FRA
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
x-amz-request-id: 1D700038FAE3113F
x-amz-id-2: qXbnP2xbzBkQCvCDWuPqNQQYNEkbEaTTDesBuiVOwCPwHpOviST0VTq+dxX2eOMH40pT1h6X5Xg=
last-modified: Tue, 28 Jan 2020 21:53:53 GMT
server: cloudflare
etag: W/"160c27fd1176b2c8a8a611e91ca025ee"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: bc8nQp5WNKUZoT_2hmuvOL30sHIFEsK0
vary: Accept-Encoding
cache-control: public, max-age=31536000
content-type: application/javascript
expires: Thu, 28 Jan 2021 19:12:24 GMT

GET
H2 200 vendors~screen.collection.packageBuilder~screen.landingpages.pres45~screen.landingpages.tribute~scre~3e410f11.d2f0cb5c.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 38 KB
16 KB 35ms
20ms Script
application/javascript 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/vendors~screen.collection.packageBuilder~screen.landingpages.pres45~screen.landingpages.tribute~scre~3e410f11.d2f0cb5c.chunk.js

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ec658154249e4a8085e4db08af846b60a435a18504352bb8f002d889e70ece2b

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 29 Jan 2020 19:12:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1112392
cf-ray: 55cd847aabc49aaa-FRA
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
x-amz-request-id: 29F3D495C30F835E
x-amz-id-2: MvWcRT51ZvS5o6QdG0DhPHf3r/WRxyq7WGy+W7T/kThgEmeUqKQ66Yf1JrrPffgWAPWRpwtf324=
last-modified: Thu, 05 Dec 2019 21:58:46 GMT
server: cloudflare
etag: W/"8b9fec58d0bdfd692d5c65e3b37f33bf"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: sJq85UZn_PUcguJu9c1aJgvrnhAD7C9I
vary: Accept-Encoding
cache-control: public, max-age=31536000
content-type: application/javascript
expires: Thu, 28 Jan 2021 19:12:24 GMT

GET
H2 200 screen.collection.packageBuilder~screen.landingpages.pres45~screen.landingpages.tribute~screen.post~~4767c889.764d541b.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 21 KB
6 KB 46ms
31ms Script
application/javascript 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/screen.collection.packageBuilder~screen.landingpages.pres45~screen.landingpages.tribute~screen.post~~4767c889.764d541b.chunk.js

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9011a4655f51c6f642e9f79c9ab75abccbfd5e8e93ef162742dfbf7a73e5f606

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 29 Jan 2020 19:12:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 151967
cf-ray: 55cd847aabc39aaa-FRA
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
x-amz-request-id: C1492B86B6CC5EE8
x-amz-id-2: 4v4MwrclI9k5XBnycFPKqMuiWkVX/k+WauHiOPJWFCTN84y6ZioVfF5QRydcgOwYzqU1iaE4PaI=
last-modified: Tue, 28 Jan 2020 00:52:09 GMT
server: cloudflare
etag: W/"9196f357893a8c0508d9fc5437b25ee5"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: r8AqEDaOIe6Fub3leUlHnR3Z06ldIPH4
vary: Accept-Encoding
cache-control: public, max-age=31536000
content-type: application/javascript
expires: Thu, 28 Jan 2021 19:12:24 GMT

GET
H2 200 screen.collection.packageBuilder~screen.landingpages.pres45~screen.landingpages.tribute~screen.post~~73c4bb05.61e342f3.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 119 KB
31 KB 40ms
26ms Script
application/javascript 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/screen.collection.packageBuilder~screen.landingpages.pres45~screen.landingpages.tribute~screen.post~~73c4bb05.61e342f3.chunk.js

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f7e5a1c87a596c3228544e084eaa5a612dc73f4bc8c932926c9413e116acc6c1

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 29 Jan 2020 19:12:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 151967
cf-ray: 55cd847aabc19aaa-FRA
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
x-amz-request-id: 471B82E73827EF2B
x-amz-id-2: zzLxP25/vp+obR9oTVvlTS/Vfo9pm7/Lm4lpjqeh9TvEpCaBMOrDUoGW5Ny+B1h2p565kOy39GQ=
last-modified: Tue, 28 Jan 2020 00:52:09 GMT
server: cloudflare
etag: W/"ea3d9cba361565420eee407a6829618d"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: o2R8J52iAR3NClBUMwixuFUOH0vJWCO4
vary: Accept-Encoding
cache-control: public, max-age=31536000
content-type: application/javascript
expires: Thu, 28 Jan 2021 19:12:24 GMT

GET
H2 200 screen.post~screen.post.amp~screen.profile~screen.sequence.library~screen.sequence.post~screen.stori~aba94ffa.5a17883b.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 51 KB
15 KB 20ms
20ms Script
application/javascript 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/screen.post~screen.post.amp~screen.profile~screen.sequence.library~screen.sequence.post~screen.stori~aba94ffa.5a17883b.chunk.js

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

30b1d142b42e4a9db1700076f61108c537724076d337c67c9b4ae93be7500dc7

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 29 Jan 2020 19:12:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 166729
cf-ray: 55cd847acbe49aaa-FRA
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
x-amz-request-id: AF349363878D2EF4
x-amz-id-2: H3+g0olCHA5O27/6Tx/bmQsN/oXK1bRW1aIXqwYiXEoOEWJJV3iuXTr8Moahb2yq9gZH26M9YA0=
last-modified: Mon, 27 Jan 2020 20:47:44 GMT
server: cloudflare
etag: W/"50103af55dadb42a00f0d25fa79fb450"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: Y6kbsyt7Bs4wbnDvK2P6t.Sov1OLnyrd
vary: Accept-Encoding
cache-control: public, max-age=31536000
content-type: application/javascript
expires: Thu, 28 Jan 2021 19:12:24 GMT

GET
H2 200 screen.post.4ba43457.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 276 KB
63 KB 20ms
20ms Script
application/javascript 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/screen.post.4ba43457.chunk.js

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

4268eef0074145f26764f710535fd99a8c51bd884847364a86da1f61f364c2f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 29 Jan 2020 19:12:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 4206
cf-ray: 55cd847acbf69aaa-FRA
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
x-amz-request-id: 4035F5F588012B78
x-amz-id-2: uU9II6kwm8dpIgC03Z1U0NGAkm5PIRVAwegblHcjkxn42BTmJboPqGGUB9utBY92zYbBeo+A2Q4=
last-modified: Wed, 29 Jan 2020 17:55:28 GMT
server: cloudflare
etag: W/"d2c9bf8da7f41610f9e6fdd9c5fb8c50"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: kqtAaf5fvVudF1OnlPtr3J9v4FmC8LLr
vary: Accept-Encoding
cache-control: public, max-age=31536000
content-type: application/javascript
expires: Thu, 28 Jan 2021 19:12:24 GMT

GET
DATA 200
OK truncated
/ 156 B
0 Image
image/svg+xml

General

Check archive.org

Show headers Download Go to Show image

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 4c0cc04185396c9a83cfda3644c23327d7d8ff9247157c438575b83713894173

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Content-Type: image/svg+xml

GET
H2 200 0*UEsyEzNqcXOl_9ih.
miro.medium.com/max/320/ 22 KB
22 KB 188ms
188ms Image
image/jpeg 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/320/0*UEsyEzNqcXOl_9ih.

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

416609b14adedeafb57c74f034b86d5bf8bba853ccf7360a671c8135f8150f4f

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 29 Jan 2020 19:12:24 GMT
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3217-8161a0a
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 22187
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, must-revalidate, max-age=2592000
accept-ranges: bytes
cf-ray: 55cd847a9ba79aaa-FRA
expires: Fri, 28 Feb 2020 19:12:24 UTC

GET
H2 200 0*vEmdb17TmcRb5Tqo.
miro.medium.com/max/320/ 78 KB
78 KB 201ms
200ms Image
image/png 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/320/0*vEmdb17TmcRb5Tqo.

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

a3a27b8942e400fe53cccde4cb44bf746edfeb37af6de19df58baa150e5e03fe

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 29 Jan 2020 19:12:24 GMT
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3217-8161a0a
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 79363
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: public, must-revalidate, max-age=2592000
accept-ranges: bytes
cf-ray: 55cd847a9ba99aaa-FRA
expires: Fri, 28 Feb 2020 19:12:24 UTC

GET
DATA 200
OK truncated
/ 10 KB
10 KB Font
font/opentype

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: ef1ed6a034a5055a869c7c25765ee1f2844a27a54e83e8a857d77b3f1cd83dd3

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Origin: https://doublepulsar.com

Response headers

Content-Type: font/opentype

GET
H2 200 fell-400-normal.woff
glyph.medium.com/font/78ce731/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 14 KB
14 KB 73ms
53ms Font
application/font-woff 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/78ce731/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/fell-400-normal.woff

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f57137897a4e676f0d2199b79def1a95b253a1a938dff9d8ba10519f3beb2b08

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css
Origin: https://doublepulsar.com

Response headers

date: Wed, 29 Jan 2020 19:12:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2442816
status: 200
access-control-max-age: 86400
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
access-control-allow-credentials: true
cf-ray: 55cd847ab8816431-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Thu, 28 Jan 2021 19:12:24 GMT

GET
DATA 200
OK truncated
/ 10 KB
10 KB Font
font/opentype

General

Check archive.org

Show headers Download Go to

Full URL: data:truncated
Protocol: DATA
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: a3d669b687929b3aa777fdd2c400c2b8c6b794978536a64d7e1f71edcf8037e8

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Origin: https://doublepulsar.com

Response headers

Content-Type: font/opentype

GET
H2 200 charter-400-italic.woff
glyph.medium.com/font/81d2bf1/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 10 KB
11 KB 83ms
64ms Font
application/font-woff 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/81d2bf1/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/charter-400-italic.woff

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

f0b9a9e4ea994c106a4fc595828ca1332b2cd0435d5d159d26d1773344d97367

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css
Origin: https://doublepulsar.com

Response headers

date: Wed, 29 Jan 2020 19:12:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1317168
status: 200
access-control-max-age: 86400
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
access-control-allow-credentials: true
cf-ray: 55cd847ab88c6431-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Thu, 28 Jan 2021 19:12:24 GMT

GET
H2 200 charter-700-normal.woff
glyph.medium.com/font/f50d520/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 10 KB
10 KB 65ms
45ms Font
application/font-woff 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/f50d520/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/charter-700-normal.woff

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

41532aec4c3a3a0747ca853b064ef7a96483a95798a6526974ec043997e2ccf9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css
Origin: https://doublepulsar.com

Response headers

date: Wed, 29 Jan 2020 19:12:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 746293
status: 200
access-control-max-age: 86400
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
access-control-allow-credentials: true
cf-ray: 55cd847ab8896431-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Thu, 28 Jan 2021 19:12:24 GMT

GET
H2 200 charter-700-italic.woff
glyph.medium.com/font/77a0c0c/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/ 11 KB
11 KB 77ms
58ms Font
application/font-woff 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/77a0c0c/0-3j_4g_6bu_6c4_6c8_6c9_6cc_6cd_6ci_6cm/charter-700-italic.woff

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d9f4969854fa4004e00ddf84c2ca5ada59216aef292c3f6e7a5b1a73d90646f9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css
Origin: https://doublepulsar.com

Response headers

date: Wed, 29 Jan 2020 19:12:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 80603
status: 200
access-control-max-age: 86400
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
access-control-allow-credentials: true
cf-ray: 55cd847ab8886431-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Thu, 28 Jan 2021 19:12:24 GMT

GET
H2 200 marat-sans-400-normal.woff
glyph.medium.com/font/d8659c9/3k-4f_4h-6bt_6bv-6c3_6c5-6c7_6ca-6cb_6ce-6ch_6cj-6cl_6cn-nvnj/ 14 KB
14 KB 77ms
62ms Font
application/font-woff 2606:4700::6810:7591
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://glyph.medium.com/font/d8659c9/3k-4f_4h-6bt_6bv-6c3_6c5-6c7_6ca-6cb_6ce-6ch_6cj-6cl_6cn-nvnj/marat-sans-400-normal.woff

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7591 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

12fe85ec038af8c41ba830412520589dbd125d417913c10a57838ac92ab96192

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://glyph.medium.com/css/e/sr/latin/e/ssr/latin/e/ssb/latin/m2.css
Origin: https://doublepulsar.com

Response headers

date: Wed, 29 Jan 2020 19:12:24 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 4756318
status: 200
access-control-max-age: 86400
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
server: cloudflare
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
access-control-allow-methods: GET, POST, PUT, DELETE
content-type: application/font-woff
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=31536000
access-control-allow-credentials: true
cf-ray: 55cd847ab88b6431-FRA
access-control-allow-headers: Accept, Cache-Control, Content-Type, Cookie, DNT, Origin, User-Agent, X-Client-Date, X-Obvious-Cid, X-Opentracing, X-Xsrf-Token, ot-tracer-sampled, ot-tracer-spanid, ot-tracer-traceid
expires: Thu, 28 Jan 2021 19:12:24 GMT

POST
H2 200 graphql Show response
doublepulsar.com/_/ 94 B
359 B 210ms
210ms Fetch
application/json 52.1.147.205
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://doublepulsar.com/_/graphql
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.a133fb80.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_256_GCM
Server: 52.1.147.205 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-1-147-205.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 8e9ffdb13313203d85b19444377063d15c0ae53c8b7480287e6aad11e102e04f

Request headers

apollographql-client-name: lite
Medium-Frontend-Route: post
Origin: https://doublepulsar.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Graphql-Operation: InteractivePostBodyQuery
content-type: application/json
accept: */*
Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068
Medium-Frontend-App: lite/master-20200129-174809-4132d44ee3
apollographql-client-version: master-20200129-174809-4132d44ee3

Response headers

date: Wed, 29 Jan 2020 19:12:25 GMT
sepia-upstream: production
server: nginx
etag: W/"5e-NDRyWQtDNvbjROzSQMgB7LvSna0"
status: 200
content-type: application/json; charset=utf-8
access-control-allow-origin: *
medium-fulfilled-by: rito/master-20200129-173555-02b8289012, tutu/medium-39823
x-envoy-upstream-service-time: 82
content-length: 94
x-request-received-at: 1580325145241

POST
H2 200 client-ready
doublepulsar.com/_/lite/performance/ 2 B
0 118ms
118ms Fetch
text/plain 52.1.147.205
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://doublepulsar.com/_/lite/performance/client-ready

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.b6ab3697.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.1.147.205 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-1-147-205.compute-1.amazonaws.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	allow-from medium.com

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
Origin: https://doublepulsar.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Content-Type: application/json

Response headers

date: Wed, 29 Jan 2020 19:12:25 GMT
sepia-upstream: production
server: nginx
x-frame-options: allow-from medium.com
etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
vary: Accept-Encoding
content-type: text/plain; charset=utf-8
status: 200
cache-control: no-cache, no-store, max-age=0, must-revalidate
x-envoy-upstream-service-time: 1
medium-fulfilled-by: lite/master-20200129-174809-4132d44ee3
content-length: 2

GET
H2 200 vendors~tracing.6badc2b7.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 62 KB
16 KB 22ms
22ms Script
application/javascript 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/vendors~tracing.6badc2b7.chunk.js

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/manifest.dfd6bf3a.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

cf286b2a4add532c3cdef294dc5407b149042bcad1544c884def577790d0e515

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 29 Jan 2020 19:12:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 767836
cf-ray: 55cd847e79389aaa-FRA
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
x-amz-request-id: B4C0A507B7346689
x-amz-id-2: jKk0Z6Ewm+3kOQ5J13vmIN9cuDiiMCEjR4MrLi1k1E0WUl4JIFrkJ93xwGGftwDm9PwgE0u5ELc=
last-modified: Fri, 20 Dec 2019 19:02:36 GMT
server: cloudflare
etag: W/"aaf7e39d80f407d31957292cb916fccb"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: SCYmmygTDmaf02dfBEPSsZKrrumZjm_D
vary: Accept-Encoding
cache-control: public, max-age=31536000
content-type: application/javascript
expires: Thu, 28 Jan 2021 19:12:25 GMT

GET
H2 200 tracing.61367508.chunk.js Show response
cdn-client.medium.com/lite/static/js/ 2 KB
2 KB 20ms
20ms Script
application/javascript 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://cdn-client.medium.com/lite/static/js/tracing.61367508.chunk.js

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/manifest.dfd6bf3a.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

ab22cfbee907f4027d8ab50ae662112d445d32a98a4d36152695b0a3ec148377

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 29 Jan 2020 19:12:25 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: HIT
age: 152124
cf-ray: 55cd847e793a9aaa-FRA
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
x-amz-request-id: BE6B7F2DD9832129
x-amz-id-2: rcngygqAcZXPmlKeEMWAJzc1jhMaaBoYNomV6ouZe+4o9NH2gghpmUypLttiv/utW0wY6RTc1ds=
last-modified: Tue, 14 Jan 2020 00:48:30 GMT
server: cloudflare
etag: W/"c0b5ac519b4f0dbbab772e332a5eabff"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
x-amz-version-id: UhJC7_KAg7P9_mOWHiSkV7ZnSzes2OYV
vary: Accept-Encoding
cache-control: public, max-age=31536000
content-type: application/javascript
expires: Thu, 28 Jan 2021 19:12:25 GMT

GET
H/1.1 200
OK p.js Show response
d1z2jf7jlzjs58.cloudfront.net/keys/medium.com/ 41 KB
17 KB 99ms
24ms Script
application/x-javascript 13.35.254.197
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://d1z2jf7jlzjs58.cloudfront.net/keys/medium.com/p.js
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.b6ab3697.chunk.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 13.35.254.197 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-13-35-254-197.fra6.r.cloudfront.net
Software: nginx /
Resource Hash: 58711bafae315df048e1bc0c36ae1dfd017810b34fd9b4b021f774694397baad

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Tue, 28 Jan 2020 09:44:25 GMT
Content-Encoding: gzip
Age: 34057
Transfer-Encoding: chunked
X-Cache: Hit from cloudfront
Connection: keep-alive
Pragma: public
Last-Modified: Mon, 07 Oct 2019 18:17:48 GMT
Server: nginx
ETag: W/"5d9b814c-a469"
Content-Type: application/x-javascript
Via: 1.1 c1fb60e38be5022a78e4b52bedded7c2.cloudfront.net (CloudFront)
Cache-Control: max-age=86400, public
X-Amz-Cf-Pop: FRA6-C1
X-Amz-Cf-Id: MgRn7UDZivktubPbcMCnGg2P9vOdxaKdF5zsMhtL5201QAaHZAedRQ==
Expires: Wed, 29 Jan 2020 09:44:25 GMT

GET
H2 200 0*UEsyEzNqcXOl_9ih.
miro.medium.com/max/160/ 9 KB
9 KB 661ms
661ms Image
image/jpeg 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/160/0*UEsyEzNqcXOl_9ih.

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/screen.post.4ba43457.chunk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

8b79e3a38df306d57cfeb0f9f95330f7e5ff0a14b79977747fa16055d5a08860

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 29 Jan 2020 19:12:26 GMT
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3217-8161a0a
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 8953
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, must-revalidate, max-age=2592000
accept-ranges: bytes
cf-ray: 55cd8480dcb59aaa-FRA
expires: Fri, 28 Feb 2020 19:12:26 UTC

GET
H2 200 0*vEmdb17TmcRb5Tqo.
miro.medium.com/max/160/ 22 KB
22 KB 195ms
194ms Image
image/png 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/160/0*vEmdb17TmcRb5Tqo.

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/screen.post.4ba43457.chunk.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

9bb655b4a4f03e01c5993082e2c57b321c85e6ee298d14381d486df780866592

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 29 Jan 2020 19:12:25 GMT
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3217-8161a0a
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 22288
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
cache-control: public, must-revalidate, max-age=2592000
accept-ranges: bytes
cf-ray: 55cd8480dcb69aaa-FRA
expires: Fri, 28 Feb 2020 19:12:25 UTC

GET
H2 200 1*bry5HIDtIpONm_IDzSVYWA.jpeg
miro.medium.com/max/82/ 2 KB
2 KB 35ms
34ms Image
image/jpeg 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/82/1*bry5HIDtIpONm_IDzSVYWA.jpeg

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

4ac5a0d5cb35d64af1d5a228d5e082e70c165a6636d6c239f3858f9d961483bd

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 29 Jan 2020 19:12:25 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 329646
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3217-8161a0a
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 2458
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 55cd84817d9e9aaa-FRA
expires: Fri, 28 Feb 2020 19:12:25 GMT

GET
H2 200 1*bAnzT3NFn-9L1xf_XWqzgA.jpeg
miro.medium.com/fit/c/48/48/ 2 KB
2 KB 22ms
21ms Image
image/jpeg 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/48/48/1*bAnzT3NFn-9L1xf_XWqzgA.jpeg

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

9ba33dfb5fe4421b2cb2c2f93613e7c08d86783992d97e2cf386bdb1809d5be9

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 29 Jan 2020 19:12:25 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2373137
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3196-7da812a
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 1838
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 55cd84817da19aaa-FRA
expires: Fri, 28 Feb 2020 19:12:25 GMT

GET
H2 200 1*bd6ZhReKUzjJwunNpA6cDg.gif
miro.medium.com/freeze/max/30/ 652 B
876 B 21ms
20ms Image
image/jpeg 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/freeze/max/30/1*bd6ZhReKUzjJwunNpA6cDg.gif?q=20

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

24691ec0bd6fa1dd1d9d0328a40d94e44787fe8beb6a01fd238f67834f5aacad

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 29 Jan 2020 19:12:25 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 219283
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3203-7aaf868
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 652
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 55cd84817da29aaa-FRA
expires: Fri, 28 Feb 2020 19:12:25 GMT

GET
H2 200 1*Wr_SRDwI4hYKClcVKc0rrQ.png
miro.medium.com/max/30/ 660 B
753 B 21ms
21ms Image
image/png 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/30/1*Wr_SRDwI4hYKClcVKc0rrQ.png?q=20

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

4e29aa4b6cec96cbdd13812f13b75bf5e68e58c1462dfcc514163a1673d3de08

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 29 Jan 2020 19:12:25 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1301129
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3209-f49543a
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 660
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 55cd84817da59aaa-FRA
expires: Fri, 28 Feb 2020 19:12:25 GMT

GET
H2 200 1*S5y5lGUCtZXvGQi7IpHpew.png
miro.medium.com/max/30/ 653 B
728 B 30ms
30ms Image
image/png 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/30/1*S5y5lGUCtZXvGQi7IpHpew.png?q=20

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

264856beed65104e730909bf5c7467ce948ca08101cacd8095233e972b5329df

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 29 Jan 2020 19:12:25 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 32959
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3209-f49543a
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 653
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 55cd84819dce9aaa-FRA
expires: Fri, 28 Feb 2020 19:12:25 GMT

GET
H2 200 1*oFF3A3KhTzGrEnS_3vV36g.gif
miro.medium.com/freeze/max/30/ 674 B
786 B 39ms
39ms Image
image/jpeg 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/freeze/max/30/1*oFF3A3KhTzGrEnS_3vV36g.gif?q=20

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

d81e68e7fa23ea0de142c9c565693074840e2c7afafd8cf7e1d556c607a8ca8e

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 29 Jan 2020 19:12:25 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 1301129
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3196-7da812a
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 674
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 55cd84819dd09aaa-FRA
expires: Fri, 28 Feb 2020 19:12:25 GMT

GET
H2 200 1*bAnzT3NFn-9L1xf_XWqzgA.jpeg
miro.medium.com/fit/c/80/80/ 3 KB
4 KB 32ms
32ms Image
image/jpeg 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/80/80/1*bAnzT3NFn-9L1xf_XWqzgA.jpeg

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

9bf8bdee55b997431fd7d8e6eadce7ef38aa1deeef96a814e1b5797c3c895555

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 29 Jan 2020 19:12:25 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 548734
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3203-7aaf868
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 3523
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 55cd84819dd29aaa-FRA
expires: Fri, 28 Feb 2020 19:12:25 GMT

GET
H2 200 1*euFkwA7zJWm-l7aDoNtJrw.jpeg
miro.medium.com/fit/c/80/80/ 3 KB
3 KB 30ms
30ms Image
image/jpeg 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/fit/c/80/80/1*euFkwA7zJWm-l7aDoNtJrw.jpeg

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

d49f9d5f6cf0fe5e246dae163447d21a876c54cdf3da502fca7d95f2441a51a6

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 29 Jan 2020 19:12:25 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 2373136
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3209-f49543a
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 3499
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/jpeg
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 55cd8481ade89aaa-FRA
expires: Fri, 28 Feb 2020 19:12:25 GMT

GET
H/1.1 200
OK branch-latest.min.js Show response
cdn.branch.io/ 72 KB
22 KB 127ms
35ms Script
text/javascript 143.204.214.65
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.branch.io/branch-latest.min.js
Requested by: Host: doublepulsar.com
URL: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6?gi=91da4b8c2068
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 143.204.214.65 Seattle, United States, ASN16509 (AMAZON-02, US),
Reverse DNS: server-143-204-214-65.fra53.r.cloudfront.net
Software: AmazonS3 /
Resource Hash: fa9d274b979b1535fc9832fb156c5860455395a3021effde2ae6fe7f0395e36e

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

x-amz-version-id: KaZ_s5RxR_A3RK0c0TPrbY_uNCEYvwI3
Content-Encoding: gzip
Last-Modified: Thu, 23 Jan 2020 21:54:54 GMT
Server: AmazonS3
Age: 127
ETag: "29db6394d3c03b6eb0ec123e3cd91985"
X-Cache: Hit from cloudfront
Content-Type: text/javascript
Via: 1.1 f8895de4463e8d120a0f4b4a1f7703e4.cloudfront.net (CloudFront)
Cache-Control: max-age=300
Date: Wed, 29 Jan 2020 19:10:19 GMT
X-Amz-Cf-Pop: FRA53-C1
Connection: keep-alive
Content-Length: 21926
X-Amz-Cf-Id: ezyA5Tg35mw9XwZVhqvn2UmNyBfD8WPKZCBcjf7KI8v12jOREdBMdw==

GET
H2 200 1*bd6ZhReKUzjJwunNpA6cDg.gif
miro.medium.com/max/480/ 375 KB
375 KB 38ms
38ms Image
image/gif 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/480/1*bd6ZhReKUzjJwunNpA6cDg.gif

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

17f4079628a9d9d39501269be956e9a4ad48fc9f791f20613a9d55cae3705cd3

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 29 Jan 2020 19:12:25 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 39874
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3196-7da812a
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 383657
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/gif
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 55cd8481ce119aaa-FRA
expires: Fri, 28 Feb 2020 19:12:25 GMT

GET
H2 200 1*Wr_SRDwI4hYKClcVKc0rrQ.png
miro.medium.com/max/1410/ 106 KB
106 KB 34ms
34ms Image
image/png 2606:4700::6810:7691
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://miro.medium.com/max/1410/1*Wr_SRDwI4hYKClcVKc0rrQ.png

Requested by

Host: doublepulsar.com
URL: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:7691 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Geomyidae artificij

Resource Hash

fba517d3b95a8f0c3bd03accc6496aff26023a81facaaf122f6d1945bc986490

Security Headers

Name	Value
Strict-Transport-Security	max-age=15552000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

date: Wed, 29 Jan 2020 19:12:25 GMT
x-content-type-options: nosniff
cf-cache-status: HIT
age: 548713
x-powered-by: Geomyidae artificij
x-obvious-info: 16.3, 3203-7aaf868
status: 200
alt-svc: h3-24=":443"; ma=86400, h3-23=":443"; ma=86400
content-length: 108601
pragma: public
server: cloudflare
etag: "16.3"
expect-ct: max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
strict-transport-security: max-age=15552000; includeSubDomains; preload
content-type: image/png
access-control-allow-origin: *
vary: Accept-Encoding
cache-control: public, max-age=2592000
accept-ranges: bytes
cf-ray: 55cd8481ce129aaa-FRA
expires: Fri, 28 Feb 2020 19:12:25 GMT

GET
H/1.1 200
OK _r Show response
app.link/ 90 B
724 B 180ms
153ms Script
text/javascript 2600:9000:20eb:8400:19:9934:6a80:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://app.link/_r?sdk=web2.52.4&branch_key=key_live_ofxXr2qTrrU9NqURK8ZwEhknBxiI6KBm&callback=branch_callback__0

Requested by

Host: cdn.branch.io
URL: https://cdn.branch.io/branch-latest.min.js

Protocol

HTTP/1.1

Security

TLS 1.2, ECDHE_RSA, AES_128_GCM

Server

2600:9000:20eb:8400:19:9934:6a80:93a1 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

Software

openresty/1.13.6.2 / Express

Resource Hash

0a681f9d17a59ac51f43a613b2c50f8219ed0e993bc678d2ca474a34f874a245

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Wed, 29 Jan 2020 19:12:26 GMT
Via: 1.1 37c215a6cf8b04439db2f97a633421e6.cloudfront.net (CloudFront)
X-Content-Type-Options: nosniff
Server: openresty/1.13.6.2
X-Amz-Cf-Pop: FRA2-C1
X-Powered-By: Express
X-Cache: Miss from cloudfront
Content-Type: text/javascript; charset=utf-8
Connection: keep-alive
Content-Length: 90
ETag: W/"5a-ftU+Qvc4lVBbwKW6vSQZFmVOlxo"
X-Amz-Cf-Id: Rgb-_ViT_tnUd9xfTFz640tER_1WA3RA-9aLOA3lVlWFdf8AoA_HDw==

GET
H/1.1 200
OK / Show response
srv-2020-01-29-19.pixel.parsely.com/start/ 77 B
380 B 494ms
115ms Script
application/json 52.5.230.147
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://srv-2020-01-29-19.pixel.parsely.com/start/?rand=1580325146001&plid=18776444&idsite=medium.com&url=https%3A%2F%2Fdoublepulsar.com%2Frdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6&urlref=&screen=1600x1200%7C1600x1200%7C24&data=%7B%22viewerStatus%22%3A%22visitor%22%7D&sid=1&surl=https%3A%2F%2Fdoublepulsar.com%2Frdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6&sref=&sts=1580325145972&slts=0&title=RDP+hijacking+%E2%80%94+how+to+hijack+RDS+and+RemoteApp+sessions+transparently+to+move+through+an+organisation&date=Wed+Jan+29+2020+20%3A12%3A26+GMT%2B0100+(Central+European+Standard+Time)&action=pageview&js=1&pvid=62601216&callback=parselyStartCallback
Requested by: Host: d1z2jf7jlzjs58.cloudfront.net
URL: https://d1z2jf7jlzjs58.cloudfront.net/keys/medium.com/p.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.5.230.147 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-5-230-147.compute-1.amazonaws.com
Software: nginx /
Resource Hash: 5497f2b9ad2bedd3f77989d0c617901847572e3bd5c028d7a4eddb9fe64ab7f2

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Wed, 29 Jan 2020 19:12:26 GMT
Server: nginx
Connection: keep-alive
Content-Type: application/json
Content-Length: 77
P3P: CP="CUR ADM OUR NOR STA NID"

POST
H2 200 open Show response
api2.branch.io/v1/ 312 B
601 B 322ms
307ms XHR
application/json 2600:9000:20eb:b200:11:f728:3040:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api2.branch.io/v1/open
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.a133fb80.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:20eb:b200:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty/1.13.6.2 /
Resource Hash: c6deef14bf6201dc04c9ec57c5cbd4c3a0ed5c53a6364e846172175ef7fe2a7c

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
Origin: https://doublepulsar.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Wed, 29 Jan 2020 19:12:26 GMT
via: 1.1 cdcb559c2f25d8ad2ccf0419bee33b03.cloudfront.net (CloudFront)
server: openresty/1.13.6.2
x-amz-cf-pop: FRA2-C1
status: 200
x-cache: Miss from cloudfront
content-type: application/json
access-control-allow-origin: *
cache-control: no-cache
content-length: 312
x-amz-cf-id: 3zrxS6hlbDOJlgYRUFX-fIWq4nGXN_VOjX_Ay_jTZj_VHMM3_fgyvg==

OPTIONS
H/1.1 200
OK log Show response
errors.client.optimizely.com/ 13 B
408 B 631ms
120ms XHR
text/plain 34.225.221.107
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://errors.client.optimizely.com/log
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.a133fb80.chunk.js
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.225.221.107 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-225-221-107.compute-1.amazonaws.com
Software: /
Resource Hash: 16f1efa415bfdd7abcf8fdd76cc05ae6fa66ffdfdc730368ecea89ecfe5c3a12

Request headers

Access-Control-Request-Method: POST
Origin: https://doublepulsar.com
Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Access-Control-Request-Headers: content-type

Response headers

Date: Wed, 29 Jan 2020 19:12:27 GMT
Allow: POST,OPTIONS
Access-Control-Allow-Methods: GET,POST,OPTIONS
Content-Type: text/plain
Access-Control-Allow-Origin: https://doublepulsar.com
Access-Control-Max-Age: 1800
Access-Control-Allow-Credentials: true
Connection: keep-alive
Access-Control-Allow-Headers: X-Requested-With,Content-Type,Accept,Origin
Content-Length: 13

POST
H2 200 render
doublepulsar.com/_/lite/performance/ 2 B
0 119ms
119ms Fetch
text/plain 52.1.147.205
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://doublepulsar.com/_/lite/performance/render

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.b6ab3697.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.1.147.205 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-1-147-205.compute-1.amazonaws.com

Software

nginx /

Resource Hash

Security Headers

Name	Value
X-Frame-Options	allow-from medium.com

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
Origin: https://doublepulsar.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Content-Type: application/json

Response headers

date: Wed, 29 Jan 2020 19:12:26 GMT
sepia-upstream: production
server: nginx
x-frame-options: allow-from medium.com
etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc"
vary: Accept-Encoding
content-type: text/plain; charset=utf-8
status: 200
cache-control: no-cache, no-store, max-age=0, must-revalidate
x-envoy-upstream-service-time: 1
medium-fulfilled-by: lite/master-20200129-174809-4132d44ee3
content-length: 2

POST
H2 200 pageview Show response
api2.branch.io/v1/ 28 B
360 B 170ms
169ms XHR
application/json 2600:9000:20eb:b200:11:f728:3040:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api2.branch.io/v1/pageview
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.a133fb80.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:20eb:b200:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty/1.13.6.2 / Express
Resource Hash: a82dc28d43942326b346f92907df3bea5e38b2325ef97176f3b6234966bf19eb

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
Origin: https://doublepulsar.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Wed, 29 Jan 2020 19:12:26 GMT
via: 1.1 cdcb559c2f25d8ad2ccf0419bee33b03.cloudfront.net (CloudFront)
server: openresty/1.13.6.2
x-amz-cf-pop: FRA2-C1
x-powered-by: Express
etag: W/"1c-KRZWpHfIKyIHGKJ9mp9lAyX+vFY"
status: 200
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
content-length: 28
x-amz-cf-id: Z-2tE7fO57CtMftdfQmuLx5Pj5BOrmhqq0iticLjfwudz2vhNa1-Dg==

OPTIONS
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 0
174 B 377ms
118ms XHR
text/plain 34.194.182.13
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.a133fb80.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.194.182.13 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-194-182-13.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method: POST
Origin: https://doublepulsar.com
Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Access-Control-Request-Headers: content-type,lightstep-access-token

Response headers

status: 200
date: Wed, 29 Jan 2020 19:12:26 GMT
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 0
access-control-allow-methods: POST

POST
H2 200 pageview Show response
api2.branch.io/v1/ 28 B
361 B 215ms
215ms XHR
application/json 2600:9000:20eb:b200:11:f728:3040:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api2.branch.io/v1/pageview
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.a133fb80.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:20eb:b200:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty/1.13.6.2 / Express
Resource Hash: a82dc28d43942326b346f92907df3bea5e38b2325ef97176f3b6234966bf19eb

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
Origin: https://doublepulsar.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Wed, 29 Jan 2020 19:12:26 GMT
via: 1.1 cdcb559c2f25d8ad2ccf0419bee33b03.cloudfront.net (CloudFront)
server: openresty/1.13.6.2
x-amz-cf-pop: FRA2-C1
x-powered-by: Express
etag: W/"1c-KRZWpHfIKyIHGKJ9mp9lAyX+vFY"
status: 200
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
content-length: 28
x-amz-cf-id: ldc9_FPwwBKBfGAC0L-IgiAVmOMbAHk-K5AwCOpR2qdD5j8865Z8Jg==

POST
H2 200 pageview Show response
api2.branch.io/v1/ 28 B
360 B 320ms
320ms XHR
application/json 2600:9000:20eb:b200:11:f728:3040:93a1
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL: https://api2.branch.io/v1/pageview
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.a133fb80.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:9000:20eb:b200:11:f728:3040:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software: openresty/1.13.6.2 / Express
Resource Hash: a82dc28d43942326b346f92907df3bea5e38b2325ef97176f3b6234966bf19eb

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
Origin: https://doublepulsar.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Content-Type: application/x-www-form-urlencoded

Response headers

date: Wed, 29 Jan 2020 19:12:27 GMT
via: 1.1 cdcb559c2f25d8ad2ccf0419bee33b03.cloudfront.net (CloudFront)
server: openresty/1.13.6.2
x-amz-cf-pop: FRA2-C1
x-powered-by: Express
etag: W/"1c-KRZWpHfIKyIHGKJ9mp9lAyX+vFY"
status: 200
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
content-length: 28
x-amz-cf-id: _wOFVfeG5tSYbRfOcBKP0ax65QapQtUgpuWBWdBg4qcfn1s-98t1UQ==

POST
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 113 B
311 B 138ms
138ms XHR
application/json 34.194.182.13
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.194.182.13 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-194-182-13.compute-1.amazonaws.com
Software: /
Resource Hash: f791df8ea5da42d437bcb871647774b8443dd623e9672b24ea7a279b4f3341d7

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
Origin: https://doublepulsar.com
LightStep-Access-Token: ce5be895bef60919541332990ac9fef2
Content-Type: application/json

Response headers

date: Wed, 29 Jan 2020 19:12:27 GMT
status: 200
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 113

POST
H/1.1 204
No Content log Show response
errors.client.optimizely.com/ 0
242 B 120ms
119ms XHR
text/plain 34.225.221.107
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://errors.client.optimizely.com/log
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.225.221.107 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-225-221-107.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
Origin: https://doublepulsar.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Content-Type: application/json

Response headers

Access-Control-Allow-Origin: https://doublepulsar.com
Access-Control-Expose-Headers
Access-Control-Allow-Credentials: true
Connection: keep-alive
Date: Wed, 29 Jan 2020 19:12:27 GMT
Content-Type: text/plain

OPTIONS
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 0
174 B 117ms
116ms XHR
text/plain 34.194.182.13
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.a133fb80.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.194.182.13 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-194-182-13.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method: POST
Origin: https://doublepulsar.com
Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Access-Control-Request-Headers: content-type,lightstep-access-token

Response headers

status: 200
date: Wed, 29 Jan 2020 19:12:27 GMT
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 0
access-control-allow-methods: POST

POST
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 113 B
311 B 120ms
119ms XHR
application/json 34.194.182.13
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.194.182.13 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-194-182-13.compute-1.amazonaws.com
Software: /
Resource Hash: 655c74c2a115a1e263b8188664d73f9ca690554b713a366227fa9ff8b255dbf0

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
Origin: https://doublepulsar.com
LightStep-Access-Token: ce5be895bef60919541332990ac9fef2
Content-Type: application/json

Response headers

date: Wed, 29 Jan 2020 19:12:27 GMT
status: 200
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 113

OPTIONS
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 0
174 B 124ms
124ms XHR
text/plain 34.194.182.13
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.a133fb80.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.194.182.13 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-194-182-13.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method: POST
Origin: https://doublepulsar.com
Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Access-Control-Request-Headers: content-type,lightstep-access-token

Response headers

status: 200
date: Wed, 29 Jan 2020 19:12:28 GMT
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 0
access-control-allow-methods: POST

POST
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 113 B
311 B 117ms
117ms XHR
application/json 34.194.182.13
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.194.182.13 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-194-182-13.compute-1.amazonaws.com
Software: /
Resource Hash: 6e4d95cbe64b2befb34b4297daa4938201fffbe5725eb1553d0052338e6b1de5

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
Origin: https://doublepulsar.com
LightStep-Access-Token: ce5be895bef60919541332990ac9fef2
Content-Type: application/json

Response headers

date: Wed, 29 Jan 2020 19:12:28 GMT
status: 200
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 113

OPTIONS
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 0
174 B 128ms
128ms XHR
text/plain 34.194.182.13
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.a133fb80.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.194.182.13 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-194-182-13.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method: POST
Origin: https://doublepulsar.com
Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Access-Control-Request-Headers: content-type,lightstep-access-token

Response headers

status: 200
date: Wed, 29 Jan 2020 19:12:28 GMT
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 0
access-control-allow-methods: POST

POST
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 113 B
311 B 132ms
132ms XHR
application/json 34.194.182.13
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.194.182.13 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-194-182-13.compute-1.amazonaws.com
Software: /
Resource Hash: 8dcc145d2fa979647e3bd66bb49ae460005daed5ee890d1f15a5b8739b12580c

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
Origin: https://doublepulsar.com
LightStep-Access-Token: ce5be895bef60919541332990ac9fef2
Content-Type: application/json

Response headers

date: Wed, 29 Jan 2020 19:12:28 GMT
status: 200
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 113

POST
H2 409 batch
doublepulsar.com/_/ 10 KB
0 140ms
140ms Fetch
text/html 52.1.147.205
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL

https://doublepulsar.com/_/batch

Requested by

Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/main.b6ab3697.chunk.js

Protocol

Security

TLS 1.2, ECDHE_RSA, AES_256_GCM

Server

52.1.147.205 Ashburn, United States, ASN14618 (AMAZON-AES, US),

Reverse DNS

ec2-52-1-147-205.compute-1.amazonaws.com

Software

nginx / Medium

Resource Hash

Security Headers

Name	Value
Content-Security-Policy	default-src 'self'; connect-src https://localhost https://.instapaper.com https://.stripe.com https://glyph.medium.com https://.paypal.com https://getpocket.com https://doublepulsar.com https://.doublepulsar.com https://.medium.com https://medium.com https://.medium.com https://.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://.lightstep.com https://.branch.io 'self'; font-src data: https://.amazonaws.com https://.medium.com https://glyph.medium.com https://medium.com https://.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
X-Content-Type-Options	nosniff
X-Frame-Options
X-Xss-Protection	1; mode=block

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
Origin: https://doublepulsar.com
x-xsrf-token: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
content-type: application/json

Response headers

content-security-policy: default-src 'self'; connect-src https://localhost https://*.instapaper.com https://*.stripe.com https://glyph.medium.com https://*.paypal.com https://getpocket.com https://doublepulsar.com https://*.doublepulsar.com https://*.medium.com https://medium.com https://*.medium.com https://*.algolia.net https://cdn-static-1.medium.com https://dnqgz544uhbo8.cloudfront.net https://cdn-videos-1.medium.com https://cdn-audio-1.medium.com https://*.lightstep.com https://*.branch.io 'self'; font-src data: https://*.amazonaws.com https://*.medium.com https://glyph.medium.com https://medium.com https://*.gstatic.com https://dnqgz544uhbo8.cloudfront.net https://cdn-static-1.medium.com 'self'; frame-src chromenull: https: webviewprogressproxy: medium: 'self'; img-src blob: data: https: 'self'; media-src https://*.cdn.vine.co https://d1fcbxp97j4nb2.cloudfront.net https://d262ilb51hltx0.cloudfront.net https://*.medium.com https://gomiro.medium.com https://miro.medium.com https://pbs.twimg.com 'self' blob:; object-src 'self'; script-src 'unsafe-eval' 'unsafe-inline' about: https: 'self'; style-src 'unsafe-inline' data: https: 'self'; report-uri https://csp.medium.com
x-content-type-options: nosniff
x-powered-by: Medium
x-obvious-info: 39833-0649fde,0649fdef085
status: 409
content-length: 10151
x-xss-protection: 1; mode=block
x-ua-compatible: IE=edge, Chrome=1
pragma: no-cache
x-obvious-tid: 1580325150433:15c0428ea338
server: nginx
date: Wed, 29 Jan 2020 19:12:30 GMT
x-frame-options
content-type: text/html; charset=utf-8
cache-control: no-cache, no-store, max-age=0, must-revalidate
link: <https://medium.com/humans.txt>; rel="humans"
expires: Thu, 09 Sep 1999 09:09:09 GMT

OPTIONS
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 0
174 B 118ms
118ms XHR
text/plain 34.194.182.13
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Requested by: Host: cdn-client.medium.com
URL: https://cdn-client.medium.com/lite/static/js/vendors~main.a133fb80.chunk.js
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.194.182.13 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-194-182-13.compute-1.amazonaws.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Access-Control-Request-Method: POST
Origin: https://doublepulsar.com
Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Access-Control-Request-Headers: content-type,lightstep-access-token

Response headers

status: 200
date: Wed, 29 Jan 2020 19:12:30 GMT
access-control-allow-credentials: true
access-control-allow-origin: *
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 0
access-control-allow-methods: POST

POST
H2 200 reports Show response
collector-medium.lightstep.com/api/v0/ 113 B
311 B 122ms
122ms XHR
application/json 34.194.182.13
AMAZON-AES

General

Check archive.org

Show headers Download Go to

Full URL: https://collector-medium.lightstep.com/api/v0/reports
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 34.194.182.13 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-34-194-182-13.compute-1.amazonaws.com
Software: /
Resource Hash: f72568a3373e312b713c09cc481f51214ba41c7e27a580659827bc461fb81a18

Request headers

User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36
Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
Origin: https://doublepulsar.com
LightStep-Access-Token: ce5be895bef60919541332990ac9fef2
Content-Type: application/json

Response headers

date: Wed, 29 Jan 2020 19:12:31 GMT
status: 200
access-control-allow-methods: POST
content-type: application/json
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: LightStep-Access-Token, Content-Type
content-length: 113

GET
H/1.1 200
OK /
srv-2020-01-29-19.pixel.parsely.com/event/ 43 B
385 B 116ms
115ms Image
image/gif 52.5.230.147
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://srv-2020-01-29-19.pixel.parsely.com/event/?rand=1580325156489&plid=18776444&idsite=medium.com&url=https%3A%2F%2Fdoublepulsar.com%2Frdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6&urlref=&screen=1600x1200%7C1600x1200%7C24&data=%7B%7D&sid=1&surl=https%3A%2F%2Fdoublepulsar.com%2Frdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6&sref=&sts=1580325156488&slts=0&date=Wed+Jan+29+2020+20%3A12%3A36+GMT%2B0100+(Central+European+Standard+Time)&action=heartbeat&inc=5&tt=4900&pvid=62601216&u=pid%3Da135fa00864082f7647d9f8706679410
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 52.5.230.147 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS: ec2-52-5-230-147.compute-1.amazonaws.com
Software: nginx /
Resource Hash: cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda

Request headers

Referer: https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.88 Safari/537.36

Response headers

Date: Wed, 29 Jan 2020 19:12:36 GMT
Last-Modified: Mon, 28 Sep 1970 06:00:00 GMT
Server: nginx
Connection: keep-alive
Content-Type: image/gif
Content-Length: 43
P3P: CP="CUR ADM OUR NOR STA NID"

Verdicts & Comments Add Verdict or Comment

25 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

4 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
.doublepulsar.com/	1970-01-19 16:28:09	Name: _parsely_visitor Value: {%22id%22:%22pid=a135fa00864082f7647d9f8706679410%22%2C%22session_count%22:1%2C%22last_session_ts%22:1580325145972}
.doublepulsar.com/	1970-01-19 06:58:46	Name: _parsely_session Value: {%22sid%22:1%2C%22surl%22:%22https://doublepulsar.com/rdp-hijacking-how-to-hijack-rds-and-remoteapp-sessions-transparently-to-move-through-an-da2a1e73a5f6%22%2C%22sref%22:%22%22%2C%22sts%22:1580325145972%2C%22slts%22:0}
doublepulsar.com/	1970-01-19 07:08:49	Name: lightstep_session_id Value: 53e785b63f043d8b
doublepulsar.com/	1970-01-19 07:08:49	Name: lightstep_guid/lite-web Value: 212081e657b59a4a

2 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
console-api	log	URL: https://cdn-client.medium.com/lite/static/js/main.b6ab3697.chunk.js(Line 1) Message: -+++++= .+++++= .+@@@@@+ #@@@@: .@@@@@= @@@@@ @+@@@@- =#@@@@@ @ +@@@@: :% @@@@@ @ @@@@-%: @@@@@ @ @@@@- @@@@@ -@- #@@+ :@@@@@: -#@@@#- ## =@@@@@@@= ....... .........
console-api	log	URL: https://cdn-client.medium.com/lite/static/js/main.b6ab3697.chunk.js(Line 1) Message: We're hiring! https://medium.com/jobs-at-medium/work-at-medium-959d1a85284e

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
X-Frame-Options	allow-from medium.com

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

api2.branch.io
app.link
cdn-client.medium.com
cdn.branch.io
cdn.optimizely.com
collector-medium.lightstep.com
d1z2jf7jlzjs58.cloudfront.net
doublepulsar.com
errors.client.optimizely.com
glyph.medium.com
medium.com
miro.medium.com
srv-2020-01-29-19.pixel.parsely.com
www.google-analytics.com
13.35.254.197
143.204.214.65
2600:9000:20eb:8400:19:9934:6a80:93a1
2600:9000:20eb:b200:11:f728:3040:93a1
2606:4700::6810:7591
2606:4700::6810:7691
2606:4700::6810:797f
2a00:1450:4001:814::200e
2a02:26f0:6c00:181::13b8
34.194.182.13
34.225.221.107
52.1.147.205
52.5.230.147
087a4c7aa118304c5ce85d5917d95a49b3c93204ef3500752dfde52595e4eac6
0a681f9d17a59ac51f43a613b2c50f8219ed0e993bc678d2ca474a34f874a245
0c5b1efc6a1eaaf0ab7c93aae52167e2cc2478655f99bb162422e042533f2d5b
12ae1072afc293ec30101e3f8d4eee96b04952b8f21ac49df261e70ae69cafbf
12fe85ec038af8c41ba830412520589dbd125d417913c10a57838ac92ab96192
16f1efa415bfdd7abcf8fdd76cc05ae6fa66ffdfdc730368ecea89ecfe5c3a12
17f4079628a9d9d39501269be956e9a4ad48fc9f791f20613a9d55cae3705cd3
24691ec0bd6fa1dd1d9d0328a40d94e44787fe8beb6a01fd238f67834f5aacad
264856beed65104e730909bf5c7467ce948ca08101cacd8095233e972b5329df
30b1d142b42e4a9db1700076f61108c537724076d337c67c9b4ae93be7500dc7
315dd7535645055e1fe3d8b1e0e635561266a36be467b5914776b3157a923811
3aa0d1997e4797fd162e0cb072757c98d1a1450814cc2cbb4d08180e55c1cd3d
41532aec4c3a3a0747ca853b064ef7a96483a95798a6526974ec043997e2ccf9
416609b14adedeafb57c74f034b86d5bf8bba853ccf7360a671c8135f8150f4f
4268eef0074145f26764f710535fd99a8c51bd884847364a86da1f61f364c2f9
466fa52768ab18d92daf1c12f9e4265e242e849beb826ccdd88d9cd2d0439fb1
4ac5a0d5cb35d64af1d5a228d5e082e70c165a6636d6c239f3858f9d961483bd
4c0cc04185396c9a83cfda3644c23327d7d8ff9247157c438575b83713894173
4e29aa4b6cec96cbdd13812f13b75bf5e68e58c1462dfcc514163a1673d3de08
5497f2b9ad2bedd3f77989d0c617901847572e3bd5c028d7a4eddb9fe64ab7f2
58711bafae315df048e1bc0c36ae1dfd017810b34fd9b4b021f774694397baad
655c74c2a115a1e263b8188664d73f9ca690554b713a366227fa9ff8b255dbf0
6e4d95cbe64b2befb34b4297daa4938201fffbe5725eb1553d0052338e6b1de5
7b58407d0e2327c81eb74dfae158cb4abd6765864446e02de0a9964a9a3ac0e7
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
84e57719d1208500d7efe55c983d9b9ac288c82f9f81e2d0562a13dd922646b2
8b79e3a38df306d57cfeb0f9f95330f7e5ff0a14b79977747fa16055d5a08860
8dcc145d2fa979647e3bd66bb49ae460005daed5ee890d1f15a5b8739b12580c
8e9ffdb13313203d85b19444377063d15c0ae53c8b7480287e6aad11e102e04f
8f8292ac0b6005f405a55e5db2d60c2096de9cb501d84b72df45a71d5780fa7c
9011a4655f51c6f642e9f79c9ab75abccbfd5e8e93ef162742dfbf7a73e5f606
99c5448d6c84fc71d6805e2485727db250113edcaea123a064f8c26ce95947d8
9b4099b39d076b74a80876fb3a14732680df8a24d44f1e2b493cd3cbc7149eee
9ba33dfb5fe4421b2cb2c2f93613e7c08d86783992d97e2cf386bdb1809d5be9
9bb655b4a4f03e01c5993082e2c57b321c85e6ee298d14381d486df780866592
9bf8bdee55b997431fd7d8e6eadce7ef38aa1deeef96a814e1b5797c3c895555
a3a27b8942e400fe53cccde4cb44bf746edfeb37af6de19df58baa150e5e03fe
a3d669b687929b3aa777fdd2c400c2b8c6b794978536a64d7e1f71edcf8037e8
a82dc28d43942326b346f92907df3bea5e38b2325ef97176f3b6234966bf19eb
ab22cfbee907f4027d8ab50ae662112d445d32a98a4d36152695b0a3ec148377
b79eb86973be4f5f4f0e13240d44fb3159feb6faf712f0182ad2b96acb1eee7b
b90725c6bfd681ced61bb48780a94c1aecf809181002cda01a2a1ca7ba83d758
c6deef14bf6201dc04c9ec57c5cbd4c3a0ed5c53a6364e846172175ef7fe2a7c
cf286b2a4add532c3cdef294dc5407b149042bcad1544c884def577790d0e515
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d49f9d5f6cf0fe5e246dae163447d21a876c54cdf3da502fca7d95f2441a51a6
d72f686c585ca0ee1f3830895c5031c8310015e667cea7a4eb164818578fcef5
d81e68e7fa23ea0de142c9c565693074840e2c7afafd8cf7e1d556c607a8ca8e
d9f4969854fa4004e00ddf84c2ca5ada59216aef292c3f6e7a5b1a73d90646f9
dbb67c620eaabf6679a314db18d3ae43037aef71ab27422e6feec08ee987cc0a
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e544bd8d73fe98d8ba7a775515ae3f80b1dc3d63f6aaded903352e5bfd0dbf5f
ec658154249e4a8085e4db08af846b60a435a18504352bb8f002d889e70ece2b
ef1ed6a034a5055a869c7c25765ee1f2844a27a54e83e8a857d77b3f1cd83dd3
f0b9a9e4ea994c106a4fc595828ca1332b2cd0435d5d159d26d1773344d97367
f57137897a4e676f0d2199b79def1a95b253a1a938dff9d8ba10519f3beb2b08
f72568a3373e312b713c09cc481f51214ba41c7e27a580659827bc461fb81a18
f791df8ea5da42d437bcb871647774b8443dd623e9672b24ea7a279b4f3341d7
f7e5a1c87a596c3228544e084eaa5a612dc73f4bc8c932926c9413e116acc6c1
fa9d274b979b1535fc9832fb156c5860455395a3021effde2ae6fe7f0395e36e
fba517d3b95a8f0c3bd03accc6496aff26023a81facaaf122f6d1945bc986490

doublepulsar.com Open in urlscan Pro 52.1.147.205 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page URL History Show full URLs

Detected technologies

Page Statistics

67 Requests

100 %HTTPS

54 %IPv6

9 Domains

14 Subdomains

13 IPs

3 Countries

1406 kBTransfer

3157 kBSize

4 Cookies

28 Outgoing links

Page URL History

Redirected requests

67 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 4 data transactions

Request headers

Response headers

Redirect headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

doublepulsar.com Open in urlscan Pro
52.1.147.205 Public Scan

Screenshot
Live screenshot

Full Image

67
Requests

100 %
HTTPS

54 %
IPv6

9
Domains

14
Subdomains

13
IPs

3
Countries

1406 kB
Transfer

3157 kB
Size

4
Cookies

67 HTTP transactions
4 data transactions