www.tevora.com Open in urlscan Pro
35.190.152.144 Public Scan

Go To Rescan
Add Verdict Report

URL:
https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Submission: On February 08 via manual (February 8th 2024, 8:44:19 pm UTC) from US — Scanned from DE

Summary HTTP 187 Redirects Links 14 Behaviour Indicators

Summary

This website contacted 35 IPs in 4 countries across 30 domains to perform 187 HTTP transactions. The main IP is 35.190.152.144, located in North Charleston, United States and belongs to GOOGLE-CLOUD-PLATFORM, US. The main domain is www.tevora.com.
TLS certificate: Issued by R3 on February 4th 2024. Valid for: 3 months.

This is the only time www.tevora.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

	IP Address	AS Autonomous System
102	35.190.152.144 35.190.152.144	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
2	2a00:1450:400... 2a00:1450:4001:80b::200a	15169 (GOOGLE) (GOOGLE)
9	2606:4700:10:... 2606:4700:10::6816:47c5	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:8bce	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:bb59	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	192.0.76.3 192.0.76.3	2635 (AUTOMATTIC) (AUTOMATTIC)
4	2a00:1450:400... 2a00:1450:4001:811::2008	15169 (GOOGLE) (GOOGLE)
8	2a00:1450:400... 2a00:1450:4001:830::2003	15169 (GOOGLE) (GOOGLE)
3	2606:4700::68... 2606:4700::6812:b07d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:10:... 2606:4700:10::ac43:b9b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6811:589a	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6810:50ba	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700::68... 2606:4700::6811:e6a3	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2606:4700:440... 2606:4700:4400::ac40:991b	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:4001:829::200e	15169 (GOOGLE) (GOOGLE)
1	2a02:26f0:350... 2a02:26f0:3500:16::215:1496	20940 (AKAMAI-ASN1) (AKAMAI-ASN1)
1	18.245.46.25 18.245.46.25	16509 (AMAZON-02) (AMAZON-02)
10	2a00:1450:400... 2a00:1450:4001:82b::2004	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6812:c07d	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2a00:1450:400... 2a00:1450:400c:c00::9b	15169 (GOOGLE) (GOOGLE)
1	2606:4700:10:... 2606:4700:10::6816:1cc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 1	2620:1ec:21::14 2620:1ec:21::14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	13.107.42.14 13.107.42.14	8068 (MICROSOFT...) (MICROSOFT-CORP-MSN-AS-BLOCK)
1	34.96.71.22 34.96.71.22	396982 (GOOGLE-CL...) (GOOGLE-CLOUD-PLATFORM)
1	35.244.174.68 35.244.174.68	15169 (GOOGLE) (GOOGLE)
1	18.66.97.20 18.66.97.20	16509 (AMAZON-02) (AMAZON-02)
9	2a00:1450:400... 2a00:1450:4001:82a::2003	15169 (GOOGLE) (GOOGLE)
1	2606:4700::68... 2606:4700::6811:cccc	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1 2	104.18.36.155 104.18.36.155	13335 (CLOUDFLAR...) (CLOUDFLARENET)
1	2600:1f18:612... 2600:1f18:612b:4216:4246:5d9e:b167:57c0	14618 (AMAZON-AES) (AMAZON-AES)
1	69.173.144.165 69.173.144.165	26667 (RUBICONPR...) (RUBICONPROJECT)
1	2a00:1450:400... 2a00:1450:4001:80b::2002	15169 (GOOGLE) (GOOGLE)
3	172.64.150.44 172.64.150.44	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6813:9a53	13335 (CLOUDFLAR...) (CLOUDFLARENET)
2	2606:4700::68... 2606:4700::6810:880f	13335 (CLOUDFLAR...) (CLOUDFLARENET)
187	35

102 35.190.152.144 (North Charleston, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 144.152.190.35.bc.googleusercontent.com

www.tevora.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:80b::200a (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.googleapis.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2606:4700:10::6816:47c5 (United States)

ASN13335 (CLOUDFLARENET, US)

static.addtoany.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:8bce (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:bb59 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 192.0.76.3 (San Francisco, United States)

ASN2635 (AUTOMATTIC, US)

stats.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
pixel.wp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

4 2a00:1450:4001:811::2008 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.googletagmanager.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

8 2a00:1450:4001:830::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

fonts.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 2606:4700::6812:b07d (United States)

ASN13335 (CLOUDFLARENET, US)

forms.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::ac43:b9b (United States)

ASN13335 (CLOUDFLARENET, US)

acsbapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6811:589a (United States)

ASN13335 (CLOUDFLARENET, US)

js.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools
forms.hscollectedforms.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6810:50ba (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-analytics.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:e6a3 (United States)

ASN13335 (CLOUDFLARENET, US)

js.hsadspixel.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:4400::ac40:991b (United States)

ASN13335 (CLOUDFLARENET, US)

js.hs-banner.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:4001:829::200e (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google-analytics.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a02:26f0:3500:16::215:1496 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1, NL)

snap.licdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.245.46.25 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-245-46-25.fra56.r.cloudfront.net

tag.demandbase.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

10 2a00:1450:4001:82b::2004 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.google.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6812:c07d (United States)

ASN13335 (CLOUDFLARENET, US)

forms-na1.hsforms.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2a00:1450:400c:c00::9b (Brussels, Belgium)

ASN15169 (GOOGLE, US)

stats.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700:10::6816:1cc (United States)

ASN13335 (CLOUDFLARENET, US)

cdn.acsbapp.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2620:1ec:21::14 (United States) 1 redirects

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 13.107.42.14 (United States)

ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US)

px4.ads.linkedin.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 34.96.71.22 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM, US)
PTR: 22.71.96.34.bc.googleusercontent.com

s.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 35.244.174.68 (Kansas City, United States)

ASN15169 (GOOGLE, US)
PTR: 68.174.244.35.bc.googleusercontent.com

id.rlcdn.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 18.66.97.20 (United States)

ASN16509 (AMAZON-02, US)
PTR: server-18-66-97-20.fra56.r.cloudfront.net

api.company-target.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

9 2a00:1450:4001:82a::2003 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

www.gstatic.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2606:4700::6811:cccc (United States)

ASN13335 (CLOUDFLARENET, US)

api.hubapi.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 104.18.36.155 (None, ) 1 redirects

ASN13335 (CLOUDFLARENET, US)

dsum-sec.casalemedia.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2600:1f18:612b:4216:4246:5d9e:b167:57c0 (Ashburn, United States)

ASN14618 (AMAZON-AES, US)

partners.tremorhub.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 69.173.144.165 (Frankfurt am Main, Germany)

ASN26667 (RUBICONPROJECT, US)

pixel.rubiconproject.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

1 2a00:1450:4001:80b::2002 (Frankfurt am Main, Germany)

ASN15169 (GOOGLE, US)

googleads.g.doubleclick.net	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

3 172.64.150.44 (United States)

ASN13335 (CLOUDFLARENET, US)

js.zi-scripts.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6813:9a53 (United States)

ASN13335 (CLOUDFLARENET, US)

track.hubspot.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

2 2606:4700::6810:880f (United States)

ASN13335 (CLOUDFLARENET, US)

ws.zoominfo.com	Domain lookup VirusTotal SecurityTrails crt.sh Censys Domaintools

	Apex Domain Subdomains	Transfer
102	tevora.com www.tevora.com	1 MB
17	gstatic.com fonts.gstatic.com www.gstatic.com	778 KB
10	google.com www.google.com — Cisco Umbrella Rank: 2	102 KB
9	addtoany.com static.addtoany.com — Cisco Umbrella Rank: 3925	33 KB
4	hsforms.com forms.hsforms.com — Cisco Umbrella Rank: 4278 forms-na1.hsforms.com — Cisco Umbrella Rank: 6786	5 KB
4	googletagmanager.com www.googletagmanager.com — Cisco Umbrella Rank: 37	314 KB
3	zi-scripts.com js.zi-scripts.com — Cisco Umbrella Rank: 8358	3 KB
3	doubleclick.net stats.g.doubleclick.net — Cisco Umbrella Rank: 79 googleads.g.doubleclick.net — Cisco Umbrella Rank: 38	2 KB
2	zoominfo.com ws.zoominfo.com — Cisco Umbrella Rank: 4371	2 KB
2	hubspot.com track.hubspot.com — Cisco Umbrella Rank: 2301	2 KB
2	casalemedia.com 1 redirects dsum-sec.casalemedia.com — Cisco Umbrella Rank: 622	1 KB
2	company-target.com s.company-target.com — Cisco Umbrella Rank: 1515 api.company-target.com — Cisco Umbrella Rank: 3815	1 KB
2	linkedin.com 1 redirects px.ads.linkedin.com — Cisco Umbrella Rank: 349 px4.ads.linkedin.com — Cisco Umbrella Rank: 6550	1 KB
2	google-analytics.com www.google-analytics.com — Cisco Umbrella Rank: 27	21 KB
2	hscollectedforms.net js.hscollectedforms.net — Cisco Umbrella Rank: 4534 forms.hscollectedforms.net — Cisco Umbrella Rank: 4621	26 KB
2	acsbapp.com acsbapp.com — Cisco Umbrella Rank: 4005 cdn.acsbapp.com — Cisco Umbrella Rank: 4189	91 KB
2	wp.com stats.wp.com — Cisco Umbrella Rank: 2723 pixel.wp.com — Cisco Umbrella Rank: 2679	3 KB
2	googleapis.com fonts.googleapis.com — Cisco Umbrella Rank: 28	2 KB
1	rubiconproject.com pixel.rubiconproject.com — Cisco Umbrella Rank: 381	239 B
1	tremorhub.com partners.tremorhub.com — Cisco Umbrella Rank: 1311	393 B
1	hubapi.com api.hubapi.com — Cisco Umbrella Rank: 3557	1 KB
1	rlcdn.com id.rlcdn.com — Cisco Umbrella Rank: 738	98 B
1	demandbase.com tag.demandbase.com — Cisco Umbrella Rank: 4395	21 KB
1	licdn.com snap.licdn.com — Cisco Umbrella Rank: 783	16 KB
1	hs-banner.com js.hs-banner.com — Cisco Umbrella Rank: 2148	23 KB
1	hsadspixel.net js.hsadspixel.net — Cisco Umbrella Rank: 3251	4 KB
1	hs-analytics.net js.hs-analytics.net — Cisco Umbrella Rank: 2120	21 KB
1	hs-scripts.com js.hs-scripts.com — Cisco Umbrella Rank: 2407 js-na1.hs-scripts.com Failed	1 KB
1	hsforms.net js.hsforms.net — Cisco Umbrella Rank: 6523	154 KB
0	google.de Failed www.google.de Failed
187	30

	Domain	Requested by
102	www.tevora.com	www.tevora.com www.googletagmanager.com snap.licdn.com js.hs-analytics.net
10	www.google.com	js.hsforms.net www.tevora.com www.gstatic.com www.google.com
9	www.gstatic.com	www.google.com www.gstatic.com
9	static.addtoany.com	www.tevora.com static.addtoany.com
8	fonts.gstatic.com	fonts.googleapis.com www.google.com
4	www.googletagmanager.com	www.tevora.com www.googletagmanager.com js.hsadspixel.net
3	js.zi-scripts.com	www.tevora.com js.zi-scripts.com
3	forms.hsforms.com	js.hsforms.net www.tevora.com
2	ws.zoominfo.com	js.zi-scripts.com
2	track.hubspot.com
2	dsum-sec.casalemedia.com	1 redirects s.company-target.com
2	stats.g.doubleclick.net	www.googletagmanager.com www.google-analytics.com
2	www.google-analytics.com	www.googletagmanager.com www.google-analytics.com
2	fonts.googleapis.com	www.tevora.com
1	googleads.g.doubleclick.net	www.googletagmanager.com
1	pixel.rubiconproject.com	s.company-target.com
1	partners.tremorhub.com	s.company-target.com
1	api.hubapi.com	js.hsadspixel.net
1	forms.hscollectedforms.net	js.hscollectedforms.net
1	api.company-target.com	tag.demandbase.com
1	id.rlcdn.com	www.tevora.com
1	s.company-target.com	tag.demandbase.com
1	px4.ads.linkedin.com	www.tevora.com
1	px.ads.linkedin.com	1 redirects snap.licdn.com
1	cdn.acsbapp.com	acsbapp.com
1	forms-na1.hsforms.com	www.tevora.com
1	tag.demandbase.com	www.tevora.com
1	snap.licdn.com	www.googletagmanager.com
1	pixel.wp.com	www.tevora.com
1	js.hs-banner.com	js.hs-scripts.com
1	js.hsadspixel.net	js.hs-scripts.com
1	js.hs-analytics.net	js.hs-scripts.com
1	js.hscollectedforms.net	js.hs-scripts.com
1	acsbapp.com	www.tevora.com
1	stats.wp.com	www.tevora.com
1	js.hs-scripts.com	www.tevora.com
1	js.hsforms.net	www.tevora.com
0	js-na1.hs-scripts.com Failed	js.hs-analytics.net
0	www.google.de Failed	www.tevora.com
187	39

This site contains links to these domains. Also see Links.

Domain
accessibe.com
www.addtoany.com
gist.github.com
blog.xpnsec.com
github.com
www.securityweek.com
www.youtube.com
twitter.com
www.linkedin.com
www.instagram.com

Subject Issuer	Validity	Valid
www.tevora.com R3	`2024-02-04` - `2024-05-04`	3 months	crt.sh
upload.video.google.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
static.addtoany.com E1	`2023-12-27` - `2024-03-26`	3 months	crt.sh
sni.cloudflaressl.com Cloudflare Inc ECC CA-3	`2023-05-16` - `2024-05-15`	a year	crt.sh
*.wp.com Sectigo ECC Domain Validation Secure Server CA	`2023-11-28` - `2024-12-28`	a year	crt.sh
*.google-analytics.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
*.gstatic.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
acsbapp.com GTS CA 1P5	`2023-12-26` - `2024-03-25`	3 months	crt.sh
snap.licdn.com DigiCert SHA2 Secure Server CA	`2023-12-13` - `2024-12-12`	a year	crt.sh
tag.demandbase.com Go Daddy Secure Certificate Authority - G2	`2023-08-23` - `2024-09-23`	a year	crt.sh
www.google.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
*.g.doubleclick.net GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
*.company-target.com R3	`2023-12-19` - `2024-03-18`	3 months	crt.sh
*.rlcdn.com Sectigo RSA Domain Validation Secure Server CA	`2023-02-02` - `2024-03-03`	a year	crt.sh
api.demandbase.com Go Daddy Secure Certificate Authority - G2	`2023-09-27` - `2024-09-26`	a year	crt.sh
hubapi.com Cloudflare Inc ECC CA-3	`2023-04-07` - `2024-04-06`	a year	crt.sh
*.tremorhub.com Amazon RSA 2048 M03	`2024-01-24` - `2025-02-21`	a year	crt.sh
*.rubiconproject.com DigiCert TLS RSA SHA256 2020 CA1	`2023-03-05` - `2024-04-03`	a year	crt.sh
*.google.com GTS CA 1C3	`2024-01-09` - `2024-04-02`	3 months	crt.sh
zi-scripts.com GTS CA 1P5	`2024-01-30` - `2024-04-29`	3 months	crt.sh
hubspot.com Cloudflare Inc ECC CA-3	`2024-01-06` - `2024-12-31`	a year	crt.sh
zoominfo.com Cloudflare Inc ECC CA-3	`2023-04-04` - `2024-04-03`	a year	crt.sh

This page contains 5 frames:

Primary Page: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Frame ID: 581C3C925330D4E4FD8D4BD9CDAD13F3
Requests: 160 HTTP requests in this frame

Frame: https://static.addtoany.com/menu/sm.25.html
Frame ID: 30BE704AE120323F268892594E0812E5
Requests: 1 HTTP requests in this frame

Frame: https://s.company-target.com/s/sync?exc=lr
Frame ID: 930E54B9AE6991EAC93910814CE6BC1B
Requests: 4 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm&co=aHR0cHM6Ly93d3cudGV2b3JhLmNvbTo0NDM.&hl=en&v=x5WWoE57Fv0d6ATKsLDIAKnt&size=invisible&badge=inline&cb=ovf77p6yqb33
Frame ID: 333198328D9EAB6D2C63D41A05F79E9C
Requests: 8 HTTP requests in this frame

Frame: https://www.google.com/recaptcha/enterprise/bframe?hl=en&v=x5WWoE57Fv0d6ATKsLDIAKnt&k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm
Frame ID: E23A4CB9121B057943E0ABE4B3BD3343
Requests: 12 HTTP requests in this frame

Screenshot
Live screenshot

Full Image

Page Title

Targeting MSOL Accounts to Compromise Internal Networks Tevora

Detected technologies

WordPress (CMS) Expand

Overall confidence: 100%
Detected patterns

<link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
/wp-(?:content|includes)/

AddToAny (Widgets) Expand

Overall confidence: 100%
Detected patterns

addtoany\.com/menu/page\.js

Google Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

google-analytics\.com/(?:ga|urchin|analytics)\.js

Google Font API (Font Scripts) Expand

Overall confidence: 100%
Detected patterns

<link[^>]* href=[^>]+fonts\.(?:googleapis|google)\.com

Google Tag Manager (Tag Managers) Expand

Overall confidence: 100%
Detected patterns

googletagmanager\.com/gtm\.js
googletagmanager\.com/gtag/js

HubSpot Analytics (Analytics) Expand

Overall confidence: 100%
Detected patterns

js\.hs-analytics\.net/analytics

Linkedin Insight Tag (Analytics) Expand

Overall confidence: 100%
Detected patterns

snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Lodash (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

lodash.*\.js

Rubicon Project (Advertising Networks) Expand

Overall confidence: 100%
Detected patterns

https?://[^/]*\.rubiconproject\.com

Select2 (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

select2(?:\.min|\.full)?\.js

Slick (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

(?:/([\d.]+))?/slick(?:\.min)?\.js

jQuery (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

jQuery Migrate (JavaScript Libraries) Expand

Overall confidence: 100%
Detected patterns

jquery[.-]migrate(?:-([\d.]+))?(?:\.min)?\.js(?:\?ver=([\d.]+))?

Page Statistics

187
Requests

96 %
HTTPS

71 %
IPv6

30
Domains

39
Subdomains

35
IPs

4
Countries

2777 kB
Transfer

6938 kB
Size

26
Cookies

14 Outgoing links

These are links going to different origins than the main page.

URL: https://accessibe.com/blog/knowledgebase/screen-reader-guide
Title: Accessibility Screen-Reader Guide, Feedback, and Issue Reporting

Search URL Search Domain Scan URL

URL: https://www.addtoany.com/share#url=https%3A%2F%2Fwww.tevora.com%2Fthreat-blog%2Ftargeting-msol-accounts-to-compromise-internal-networks%2F&title=Targeting%20MSOL%20Accounts%20to%20Compromise%20Internal%20Networks
Title: Share

Search URL Search Domain Scan URL

URL: https://gist.github.com/xpn/f12b145dba16c2eebdd1c6829267b90c
Title: this

Search URL Search Domain Scan URL

URL: https://blog.xpnsec.com/
Title: xpn

Search URL Search Domain Scan URL

URL: https://github.com/fox-it/adconnectdump
Title: Fox-It’s ADSyncQuery.exe and AdConnectDump.py

Search URL Search Domain Scan URL

URL: https://github.com/fortra/impacket/blob/master/examples/secretsdump.py
Title: secrets dump

Search URL Search Domain Scan URL

URL: https://blog.xpnsec.com/azuread-connect-for-redteam/
Title: Azure AD Connect for Red Teamers” by XPN Security

Search URL Search Domain Scan URL

URL: https://www.securityweek.com/stealthy-admin-accounts-found-hybrid-office-365-deployments/
Title: Stealthy Admin Accounts Found in Hybrid Office 365 Deployments” by Security Week

Search URL Search Domain Scan URL

URL: https://www.youtube.com/watch?v=xei8lAPitX8
Title: “I’m In Your Cloud Pwning Your Azure Environment” by Dirk Jan Mollema, DEF CON 27 Conference

Search URL Search Domain Scan URL

URL: https://www.youtube.com/channel/UCdmnqhdRf1QB--YLDfo4Ceg

Search URL Search Domain Scan URL

URL: https://twitter.com/tevora

Search URL Search Domain Scan URL

URL: https://www.linkedin.com/company/122635

Search URL Search Domain Scan URL

URL: https://www.instagram.com/lifeattevora/?hl=en

Search URL Search Domain Scan URL

URL: https://www.addtoany.com/
Title: AddToAny

Search URL Search Domain Scan URL

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 113

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1416369&time=1707425053718&url=https%3A%2F%2Fwww.tevora.com%2Fthreat-blog%2Ftargeting-msol-accounts-to-compromise-internal-networks%2F HTTP 302
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1416369&time=1707425053718&url=https%3A%2F%2Fwww.tevora.com%2Fthreat-blog%2Ftargeting-msol-accounts-to-compromise-internal-networks%2F&e_ipv6=AQKdQVfDVo8jUAAAAY2KdryTjcJ3MA1yUqF8hhGQgKwkTq7Zi0NpYUAweW0F4xMhcfAyAeun

Request Chain 125

https://dsum-sec.casalemedia.com/rum?cm_dsp_id=18&expiry=1723149853&external_user_id=a7647831-6a50-4189-97e7-556790972f4e HTTP 302
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=18&expiry=1723149853&external_user_id=a7647831-6a50-4189-97e7-556790972f4e&C=1

187 HTTP transactions
0 data transactions

Method
Protocol Status Resource
Path Size
x-fer Time
Latency Type
MIME-Type IP
Location

GET
H2 200 Primary Request / Show response
www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/ 101 KB
24 KB 815ms
176ms Document
text/html 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

144.152.190.35.bc.googleusercontent.com

Software

nginx / WP Engine

Resource Hash

e8980ff784eec4d49d1400eda42338778189558466b133dd4c7aa53ad24237a8

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' data: ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.addtoany.com https://js.hsforms.net https://acsbapp.com https://js.hs-scripts.com https://snap.licdn.com https://tag.demandbase.com https://js.zi-scripts.com https://js.hs-banner.com https://js.hscollectedforms.net https://js.hs-analytics.net https://js.hsadspixel.net/ https://www.google.com https://www.gstatic.com/ https://yoast.com https://stats.wp.com https://widgets.wp.com https://s0.wp.com https://js.hubspot.com www.googletagservices.com .googlesyndication.com .googleadservices.com googleads.g.doubleclick.net adservice.google.com adservice.google.ae adservice.google.al adservice.google.at adservice.google.be adservice.google.bg adservice.google.bs adservice.google.ca adservice.google.ch adservice.google.ci adservice.google.cl adservice.google.co.bw adservice.google.co.cr adservice.google.co.id adservice.google.co.il adservice.google.co.in adservice.google.co.jp adservice.google.co.ke adservice.google.co.kr adservice.google.co.mz adservice.google.co.nz adservice.google.co.th adservice.google.co.tz adservice.google.co.uk adservice.google.co.uz adservice.google.co.ve adservice.google.co.za adservice.google.co.zm adservice.google.co.zw adservice.google.com.ai adservice.google.com.ar adservice.google.com.au adservice.google.com.bd adservice.google.com.bh adservice.google.com.bn adservice.google.com.bo adservice.google.com.br adservice.google.com.co adservice.google.com.cy adservice.google.com.ec adservice.google.com.eg adservice.google.com.et adservice.google.com.fj adservice.google.com.gh adservice.google.com.gi adservice.google.com.gt adservice.google.com.hk adservice.google.com.jm adservice.google.com.kh adservice.google.com.kw adservice.google.com.lb adservice.google.com.mm adservice.google.com.mt adservice.google.com.mx adservice.google.com.my adservice.google.com.ng adservice.google.com.ni adservice.google.com.np adservice.google.com.om adservice.google.com.pa adservice.google.com.pe adservice.google.com.ph adservice.google.com.pk adservice.google.com.pr adservice.google.com.py adservice.google.com.qa adservice.google.com.sa adservice.google.com.sg adservice.google.com.sv adservice.google.com.tr adservice.google.com.tw adservice.google.com.ua adservice.google.com.uy adservice.google.com.vn adservice.google.cz adservice.google.de adservice.google.dk adservice.google.dz adservice.google.ee adservice.google.es adservice.google.fi adservice.google.fr adservice.google.ge adservice.google.gr adservice.google.gy adservice.google.hn adservice.google.hr adservice.google.hu adservice.google.ie adservice.google.im adservice.google.iq adservice.google.is adservice.google.it adservice.google.jo adservice.google.kz adservice.google.li adservice.google.lk adservice.google.lt adservice.google.lu adservice.google.lv adservice.google.md adservice.google.mk adservice.google.mu adservice.google.nl adservice.google.no adservice.google.pl adservice.google.pt adservice.google.ro adservice.google.rs adservice.google.ru adservice.google.se adservice.google.si adservice.google.sk adservice.google.so adservice.google.sr adservice.google.tl adservice.google.tn adservice.google.tt google-analytics.com www.google-analytics.com ssl.google-analytics.com stats.g.doubleclick.net ajax.googleapis.com maps.googleapis.com maps.google.com translate.googleapis.com translate.google.com www.googletagmanager.com googletagmanager.com tagmanager.google.com; style-src 'self' 'unsafe-inline' data: https://s0.wp.com https://widgets.wp.com fonts.googleapis.com 'unsafe-inline' maps.googleapis.com maps.google.com translate.googleapis.com www.googletagmanager.com tagmanager.google.com; img-src 'self' data: https://id.rlcdn.com https://px.ads.linkedin.com https://forms.hsforms.com https://forms-na1.hsforms.com https://segments.company-target.com https://px4.ads.linkedin.com https://track.hubspot.com https://dify.wpengine.com https://pixel.wp.com https://www.linkedin.com https://en.wordpress.com https://static.hsappstatic.net s.w.org ps.w.org ts.w.org secure.gravatar.com www.gravatar.com .googlesyndication.com stats.g.doubleclick.net data: blob: google-analytics.com www.google-analytics.com ssl.google-analytics.com www.google.com .googleapis.com maps.google.com maps.gstatic.com www.gstatic.com .ggpht.com translate.googleapis.com translate.google.com i.ytimg.com www.googletagmanager.com; connect-src 'self' https://forms.hsforms.com https://hubspot-forms-static-embed.s3.amazonaws.com https://cdn.acsbapp.com/ https://api.company-target.com https://js.zi-scripts.com https://api.hubapi.com https://forms.hscollectedforms.net https://tag-logger.demandbase.com https://yoast.com https://my.wpengine.com https://ws.zoominfo.com https://exceptions.hubspot.com https://segments.company-target.com .googlesyndication.com googleads.g.doubleclick.net stats.g.doubleclick.net www.google-analytics.com ampcid.google.com analytics.google.com about: maps.googleapis.com maps.google.com translate.googleapis.com www.googletagmanager.com; font-src 'self' data: https://s0.wp.com data: fonts.gstatic.com fonts.googleapis.com; object-src 'self' ; media-src 'self' ; frame-src 'self' https://static.addtoany.com https://s.company-target.com https://td.doubleclick.net https://www.google.com https://static.hsappstatic.net https://app.hubspot.com https://widgets.wp.com https://forms.hsforms.com *.googlesyndication.com googleads.g.doubleclick.net maps.googleapis.com maps.google.com www.youtube.com www.googletagmanager.com; child-src 'self' www.youtube.com www.googletagmanager.com; worker-src 'self' blob:; upgrade-insecure-requests; block-all-mixed-content; report-uri https://www.tevora.com?gdsih-csp-report;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block; report=https://www.tevora.com?gdsih-xxp-report;

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

cache-control: max-age=600, must-revalidate
content-encoding: br
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' data: ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.addtoany.com https://js.hsforms.net https://acsbapp.com https://js.hs-scripts.com https://snap.licdn.com https://tag.demandbase.com https://js.zi-scripts.com https://js.hs-banner.com https://js.hscollectedforms.net https://js.hs-analytics.net https://js.hsadspixel.net/ https://www.google.com https://www.gstatic.com/ https://yoast.com https://stats.wp.com https://widgets.wp.com https://s0.wp.com https://js.hubspot.com www.googletagservices.com *.googlesyndication.com *.googleadservices.com googleads.g.doubleclick.net adservice.google.com adservice.google.ae adservice.google.al adservice.google.at adservice.google.be adservice.google.bg adservice.google.bs adservice.google.ca adservice.google.ch adservice.google.ci adservice.google.cl adservice.google.co.bw adservice.google.co.cr adservice.google.co.id adservice.google.co.il adservice.google.co.in adservice.google.co.jp adservice.google.co.ke adservice.google.co.kr adservice.google.co.mz adservice.google.co.nz adservice.google.co.th adservice.google.co.tz adservice.google.co.uk adservice.google.co.uz adservice.google.co.ve adservice.google.co.za adservice.google.co.zm adservice.google.co.zw adservice.google.com.ai adservice.google.com.ar adservice.google.com.au adservice.google.com.bd adservice.google.com.bh adservice.google.com.bn adservice.google.com.bo adservice.google.com.br adservice.google.com.co adservice.google.com.cy adservice.google.com.ec adservice.google.com.eg adservice.google.com.et adservice.google.com.fj adservice.google.com.gh adservice.google.com.gi adservice.google.com.gt adservice.google.com.hk adservice.google.com.jm adservice.google.com.kh adservice.google.com.kw adservice.google.com.lb adservice.google.com.mm adservice.google.com.mt adservice.google.com.mx adservice.google.com.my adservice.google.com.ng adservice.google.com.ni adservice.google.com.np adservice.google.com.om adservice.google.com.pa adservice.google.com.pe adservice.google.com.ph adservice.google.com.pk adservice.google.com.pr adservice.google.com.py adservice.google.com.qa adservice.google.com.sa adservice.google.com.sg adservice.google.com.sv adservice.google.com.tr adservice.google.com.tw adservice.google.com.ua adservice.google.com.uy adservice.google.com.vn adservice.google.cz adservice.google.de adservice.google.dk adservice.google.dz adservice.google.ee adservice.google.es adservice.google.fi adservice.google.fr adservice.google.ge adservice.google.gr adservice.google.gy adservice.google.hn adservice.google.hr adservice.google.hu adservice.google.ie adservice.google.im adservice.google.iq adservice.google.is adservice.google.it adservice.google.jo adservice.google.kz adservice.google.li adservice.google.lk adservice.google.lt adservice.google.lu adservice.google.lv adservice.google.md adservice.google.mk adservice.google.mu adservice.google.nl adservice.google.no adservice.google.pl adservice.google.pt adservice.google.ro adservice.google.rs adservice.google.ru adservice.google.se adservice.google.si adservice.google.sk adservice.google.so adservice.google.sr adservice.google.tl adservice.google.tn adservice.google.tt google-analytics.com www.google-analytics.com ssl.google-analytics.com stats.g.doubleclick.net ajax.googleapis.com maps.googleapis.com maps.google.com translate.googleapis.com translate.google.com www.googletagmanager.com googletagmanager.com tagmanager.google.com; style-src 'self' 'unsafe-inline' data: https://s0.wp.com https://widgets.wp.com fonts.googleapis.com 'unsafe-inline' maps.googleapis.com maps.google.com translate.googleapis.com www.googletagmanager.com tagmanager.google.com; img-src 'self' data: https://id.rlcdn.com https://px.ads.linkedin.com https://forms.hsforms.com https://forms-na1.hsforms.com https://segments.company-target.com https://px4.ads.linkedin.com https://track.hubspot.com https://dify.wpengine.com https://pixel.wp.com https://www.linkedin.com https://en.wordpress.com https://static.hsappstatic.net s.w.org ps.w.org ts.w.org secure.gravatar.com www.gravatar.com *.googlesyndication.com stats.g.doubleclick.net data: blob: google-analytics.com www.google-analytics.com ssl.google-analytics.com www.google.com *.googleapis.com maps.google.com maps.gstatic.com www.gstatic.com *.ggpht.com translate.googleapis.com translate.google.com i.ytimg.com www.googletagmanager.com; connect-src 'self' https://forms.hsforms.com https://hubspot-forms-static-embed.s3.amazonaws.com https://cdn.acsbapp.com/ https://api.company-target.com https://js.zi-scripts.com https://api.hubapi.com https://forms.hscollectedforms.net https://tag-logger.demandbase.com https://yoast.com https://my.wpengine.com https://ws.zoominfo.com https://exceptions.hubspot.com https://segments.company-target.com *.googlesyndication.com googleads.g.doubleclick.net stats.g.doubleclick.net www.google-analytics.com ampcid.google.com analytics.google.com about: maps.googleapis.com maps.google.com translate.googleapis.com www.googletagmanager.com; font-src 'self' data: https://s0.wp.com data: fonts.gstatic.com fonts.googleapis.com; object-src 'self' ; media-src 'self' ; frame-src 'self' https://static.addtoany.com https://s.company-target.com https://td.doubleclick.net https://www.google.com https://static.hsappstatic.net https://app.hubspot.com https://widgets.wp.com https://forms.hsforms.com *.googlesyndication.com googleads.g.doubleclick.net maps.googleapis.com maps.google.com www.youtube.com www.googletagmanager.com; child-src 'self' www.youtube.com www.googletagmanager.com; worker-src 'self' blob:; upgrade-insecure-requests; block-all-mixed-content; report-uri https://www.tevora.com?gdsih-csp-report;
content-type: text/html; charset=UTF-8
date: Thu, 08 Feb 2024 20:44:12 GMT
feature-policy: interest-cohort *;
link: <https://www.tevora.com/wp-json/>; rel="https://api.w.org/" <https://www.tevora.com/wp-json/wp/v2/threat-blog/24983>; rel="alternate"; type="application/json" <https://www.tevora.com/?p=24983>; rel=shortlink
permissions-policy: interest-cohort=(*)
referrer-policy: same-origin
server: nginx
strict-transport-security: max-age=31536000; includeSubDomains
vary: Accept-Encoding Accept-Encoding Accept-Encoding Accept-Encoding,Cookie
x-cache: HIT: 7
x-cache-group: normal
x-cacheable: SHORT
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-powered-by: WP Engine
x-xss-protection: 1; mode=block; report=https://www.tevora.com?gdsih-xxp-report;

GET
H2 200 css2
fonts.googleapis.com/ 9 KB
1 KB 186ms
65ms Stylesheet
text/css 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto%3Awght%40300%3B400%3B500%3B700&display=swap&ver=6.4.2

Requested by

Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

886e1e675050878cd1710ba030a7787613e5bbbe02a2b099683306c16ac8c8cd

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 08 Feb 2024 20:44:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 08 Feb 2024 19:30:44 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 08 Feb 2024 20:44:12 GMT

GET
H2 200 css2
fonts.googleapis.com/ 12 KB
835 B 187ms
66ms Stylesheet
text/css 2a00:1450:4001:80b::200a
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.googleapis.com/css2?family=Roboto+Slab%3Awght%40300%3B400%3B500%3B600%3B700&display=swap&ver=6.4.2

Requested by

Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::200a Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

ESF /

Resource Hash

88f04c38ef32bb9fb2e7a2a9a1dd888568caf26fd202a9a038ca2532d3b36ce5

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=31536000
date: Thu, 08 Feb 2024 20:44:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 0
last-modified: Thu, 08 Feb 2024 20:44:12 GMT
server: ESF
cross-origin-opener-policy: same-origin-allow-popups
x-frame-options: SAMEORIGIN
content-type: text/css; charset=utf-8
access-control-allow-origin: *
cache-control: private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin: *
link: <https://fonts.gstatic.com>; rel=preconnect; crossorigin
expires: Thu, 08 Feb 2024 20:44:12 GMT

GET
H2 200 style.min.css
www.tevora.com/wp-includes/css/dist/block-library/ 107 KB
15 KB 136ms
133ms Stylesheet
text/css 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.tevora.com/wp-includes/css/dist/block-library/style.min.css?ver=6.4.2
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 698b89c0da3d319754d6a837b5e6d4e6a42dc402d9ffd7559b8c4cb29c644340

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:12 GMT
content-encoding: br
last-modified: Sun, 05 Nov 2023 19:40:32 GMT
server: nginx
etag: W/"6547efb0-1add3"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 styles-blocks.css
www.tevora.com/wp-content/plugins/prismatic/css/ 526 B
516 B 136ms
133ms Stylesheet
text/css 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.tevora.com/wp-content/plugins/prismatic/css/styles-blocks.css?ver=6.4.2
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: dc8e317c924d49916e599d91520cb5f64eb9b1ff74120e5d058ca526d0ec6266

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:12 GMT
content-encoding: br
last-modified: Tue, 24 Oct 2023 04:10:26 GMT
server: nginx
etag: W/"653743b2-20e"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 mediaelementplayer-legacy.min.css
www.tevora.com/wp-includes/js/mediaelement/ 11 KB
3 KB 143ms
141ms Stylesheet
text/css 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.tevora.com/wp-includes/js/mediaelement/mediaelementplayer-legacy.min.css?ver=4.2.17
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:12 GMT
content-encoding: br
last-modified: Tue, 29 Sep 2020 15:53:06 GMT
server: nginx
etag: W/"5f735862-2bf8"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 wp-mediaelement.min.css
www.tevora.com/wp-includes/js/mediaelement/ 4 KB
1 KB 192ms
190ms Stylesheet
text/css 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.tevora.com/wp-includes/js/mediaelement/wp-mediaelement.min.css?ver=6.4.2
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:12 GMT
content-encoding: br
last-modified: Fri, 07 Jun 2019 20:45:02 GMT
server: nginx
etag: W/"5cfaccce-105a"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 frontend_blocks.css
www.tevora.com/wp-content/plugins/berg-custom/dist/ 3 KB
1 KB 193ms
190ms Stylesheet
text/css 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.tevora.com/wp-content/plugins/berg-custom/dist/frontend_blocks.css?ver=1.0.0
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: b232fdcfea9d3c1d5f1f568237126524d3738e9b54b03a193ed688aed1e47e7c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:12 GMT
content-encoding: br
last-modified: Tue, 24 Oct 2023 14:16:00 GMT
server: nginx
etag: W/"6537d1a0-cc7"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 frontend_blocks.css
www.tevora.com/wp-content/plugins/berg/dist/ 5 KB
1 KB 200ms
198ms Stylesheet
text/css 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.tevora.com/wp-content/plugins/berg/dist/frontend_blocks.css?ver=1.0.0
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 0301b4256760793e6413772460ced32b76fcfe52fa9c89428d51adb26f767844

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:12 GMT
content-encoding: br
last-modified: Tue, 24 Oct 2023 14:15:28 GMT
server: nginx
etag: W/"6537d180-1387"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 index.css
www.tevora.com/wp-content/plugins/accordion-blocks/build/ 1 KB
687 B 201ms
199ms Stylesheet
text/css 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.tevora.com/wp-content/plugins/accordion-blocks/build/index.css?ver=1.5.0
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 42287925d01999d4f4a32a2463947d1e7c0ebb8978c06ed7e818682ef161b0cd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:12 GMT
content-encoding: br
last-modified: Tue, 24 Oct 2023 04:10:32 GMT
server: nginx
etag: W/"653743b8-47e"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 frontend.min.css
www.tevora.com/wp-content/plugins/wp-user-avatar/assets/css/ 101 KB
16 KB 234ms
232ms Stylesheet
text/css 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.tevora.com/wp-content/plugins/wp-user-avatar/assets/css/frontend.min.css?ver=4.13.4
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: cd4ea0c51ab60a7a520269e7634dfd43ca5bd23b589305247926d188514a7c43

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:12 GMT
content-encoding: br
last-modified: Tue, 24 Oct 2023 04:10:22 GMT
server: nginx
etag: W/"653743ae-195a0"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 flatpickr.min.css
www.tevora.com/wp-content/plugins/wp-user-avatar/assets/flatpickr/ 14 KB
3 KB 135ms
132ms Stylesheet
text/css 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.tevora.com/wp-content/plugins/wp-user-avatar/assets/flatpickr/flatpickr.min.css?ver=4.13.4
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 3668f6d335416599574fb1f336cbd2b9bb2f8fcff63e63a9ca3b68df4d0c6165

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:12 GMT
content-encoding: br
last-modified: Tue, 24 Oct 2023 04:10:22 GMT
server: nginx
etag: W/"653743ae-3601"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 select2.min.css
www.tevora.com/wp-content/plugins/wp-user-avatar/assets/select2/ 15 KB
2 KB 239ms
237ms Stylesheet
text/css 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.tevora.com/wp-content/plugins/wp-user-avatar/assets/select2/select2.min.css?ver=6.4.2
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 044efea78208376302aad3808aaabdf3c2f7bdd80ba9d55c9e0e4d3baa7a3908

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:12 GMT
content-encoding: br
last-modified: Tue, 24 Oct 2023 04:10:22 GMT
server: nginx
etag: W/"653743ae-3a75"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 front.min.css
www.tevora.com/wp-content/plugins/cookie-notice/css/ 5 KB
1 KB 257ms
255ms Stylesheet
text/css 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.tevora.com/wp-content/plugins/cookie-notice/css/front.min.css?ver=2.4.11
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: f158b8591a08b6c02bb345ae96dd62f0c632f7f635bb4a5f449fce24bdc11789

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:12 GMT
content-encoding: br
last-modified: Tue, 24 Oct 2023 04:10:30 GMT
server: nginx
etag: W/"653743b6-14d6"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 addtoany.min.css
www.tevora.com/wp-content/plugins/add-to-any/ 2 KB
742 B 258ms
256ms Stylesheet
text/css 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.tevora.com/wp-content/plugins/add-to-any/addtoany.min.css?ver=1.16
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: c19e3e4151ea4933fa9ba9703c51fe20ad469237771214b1c5001d1b107ddef5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:12 GMT
content-encoding: br
last-modified: Tue, 24 Oct 2023 04:10:32 GMT
server: nginx
etag: W/"653743b8-644"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 vendor.css
www.tevora.com/wp-content/themes/berg-theme-child/dist/css/ 49 KB
6 KB 267ms
265ms Stylesheet
text/css 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.tevora.com/wp-content/themes/berg-theme-child/dist/css/vendor.css?ver=6.4.2
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: e13709c99b05193f622ad34d5f2bdf66cb9aa56f12356acf96b6e540bd5f8338

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:12 GMT
content-encoding: br
last-modified: Tue, 24 Oct 2023 14:13:50 GMT
server: nginx
etag: W/"6537d11e-c2d5"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 style.css
www.tevora.com/wp-content/themes/berg-theme-child/dist/css/ 640 KB
62 KB 298ms
296ms Stylesheet
text/css 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.tevora.com/wp-content/themes/berg-theme-child/dist/css/style.css?ver=6.4.2
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 42ede4fe88145fa0cacedaf83a4518f1542a6f5d94025528a7cfba0c6f8a1ead

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:12 GMT
content-encoding: br
last-modified: Tue, 24 Oct 2023 14:13:50 GMT
server: nginx
etag: W/"6537d11e-9fe1f"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 jetpack.css
www.tevora.com/wp-content/plugins/jetpack/css/ 98 KB
19 KB 255ms
254ms Stylesheet
text/css 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.tevora.com/wp-content/plugins/jetpack/css/jetpack.css?ver=12.6.2
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 1170849a1f6deb911dc030011d8bcc57a6caaf659343e66114fb2f87369ed40e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:12 GMT
content-encoding: br
last-modified: Tue, 24 Oct 2023 04:10:28 GMT
server: nginx
etag: W/"653743b4-18724"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: text/css
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 frontend_blocks_custom.js Show response
www.tevora.com/wp-content/plugins/berg-custom/dist/ 1014 B
741 B 256ms
254ms Script
application/javascript 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.tevora.com/wp-content/plugins/berg-custom/dist/frontend_blocks_custom.js?ver=1.0.0
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 2855d95ed2613ea6a8b1f447a8273286885522d110e1e4d53b06bedea6f12dc6

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:12 GMT
content-encoding: br
last-modified: Tue, 24 Oct 2023 14:15:56 GMT
server: nginx
etag: W/"6537d19c-3f6"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 jquery.min.js Show response
www.tevora.com/wp-includes/js/jquery/ 86 KB
31 KB 257ms
256ms Script
application/javascript 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.tevora.com/wp-includes/js/jquery/jquery.min.js?ver=3.7.1
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:12 GMT
content-encoding: br
last-modified: Mon, 28 Aug 2023 17:14:23 GMT
server: nginx
etag: W/"64ecd5ef-15601"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 jquery-migrate.min.js Show response
www.tevora.com/wp-includes/js/jquery/ 13 KB
5 KB 328ms
327ms Script
application/javascript 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.tevora.com/wp-includes/js/jquery/jquery-migrate.min.js?ver=3.4.1
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:12 GMT
content-encoding: br
last-modified: Fri, 09 Jun 2023 05:49:24 GMT
server: nginx
etag: W/"6482bd64-3509"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 vendor.js Show response
www.tevora.com/wp-content/themes/berg-theme-child/dist/js/ 319 KB
96 KB 328ms
327ms Script
application/javascript 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.tevora.com/wp-content/themes/berg-theme-child/dist/js/vendor.js?ver=1
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 48d09e18d6ceed3a540871588c8f0e83a088986e142fb72d61e241d49d0489c7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:12 GMT
content-encoding: br
last-modified: Tue, 24 Oct 2023 14:13:48 GMT
server: nginx
etag: W/"6537d11c-4fa70"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 main.js Show response
www.tevora.com/wp-content/themes/berg-theme-child/dist/js/ 210 KB
66 KB 329ms
327ms Script
application/javascript 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.tevora.com/wp-content/themes/berg-theme-child/dist/js/main.js?ver=1
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 792f045fb88687b355c7fb9db033737612528d5beb826d85cd2ff368ed6e744f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:12 GMT
content-encoding: br
last-modified: Tue, 24 Oct 2023 14:13:48 GMT
server: nginx
etag: W/"6537d11c-34756"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 page.js Show response
static.addtoany.com/menu/ 3 KB
2 KB 100ms
38ms Script
application/javascript 2606:4700:10::6816:47c5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/page.js

Requested by

Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:47c5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

8a3d8c061a2a585985a71d5b1a45c424c5bc79b310c86b4731b5bececf5ea5df

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 27582
content-encoding: br
alt-svc: h3=":443"; ma=86400
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"257f9651f9cfd949f6dde30f51352116"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=06BekgNcA6IJcPYOuIAHYCu%2BOe1OsLsvKcK0e8vUkbUegmeDsK3DEeMEU4WtdOJKbghCYSw%2FpL2YDNtCy3tmLebmE3bwSHe9FenwZ0Bs0oIPBFItSFIE9N2EtNPR%2FMd%2BNU4dru8mVlOPHihjFlD6%2FC4v"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=86400, stale-while-revalidate=30, public
cf-ray: 8526b5968eb1abce-CPH

GET
H2 200 addtoany.min.js Show response
www.tevora.com/wp-content/plugins/add-to-any/ 129 B
317 B 151ms
145ms Script
application/javascript 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.tevora.com/wp-content/plugins/add-to-any/addtoany.min.js?ver=1.1
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 50679e0e3933c945348a2db0cc128bb14b57a60a74fabf8cae13acc14efbb2e1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
content-encoding: br
last-modified: Tue, 24 Oct 2023 04:10:32 GMT
server: nginx
etag: W/"653743b8-81"
vary: Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 flatpickr.min.js Show response
www.tevora.com/wp-content/plugins/wp-user-avatar/assets/flatpickr/ 49 KB
15 KB 329ms
328ms Script
application/javascript 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.tevora.com/wp-content/plugins/wp-user-avatar/assets/flatpickr/flatpickr.min.js?ver=4.13.4
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: ddbda21655c0c2cb09913a9e33d856a8b8f3e1eae610cdbda8524def2dc71f7d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:12 GMT
content-encoding: br
last-modified: Tue, 24 Oct 2023 04:10:22 GMT
server: nginx
etag: W/"653743ae-c5a4"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 select2.min.js Show response
www.tevora.com/wp-content/plugins/wp-user-avatar/assets/select2/ 69 KB
20 KB 329ms
328ms Script
application/javascript 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.tevora.com/wp-content/plugins/wp-user-avatar/assets/select2/select2.min.js?ver=4.13.4
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 00501810e93307a8882a74d864e7547fd1458deea539361dc1124ac133799a4b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:12 GMT
content-encoding: br
last-modified: Tue, 24 Oct 2023 04:10:22 GMT
server: nginx
etag: W/"653743ae-114c3"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 front.min.js Show response
www.tevora.com/wp-content/plugins/cookie-notice/js/ 8 KB
2 KB 161ms
155ms Script
application/javascript 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.tevora.com/wp-content/plugins/cookie-notice/js/front.min.js?ver=2.4.11
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 08756c47213d461baa3b01f42448a76d11f524470c7a34f9018733889bd4f49c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
content-encoding: br
last-modified: Tue, 24 Oct 2023 04:10:30 GMT
server: nginx
etag: W/"653743b6-21fc"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 slick.js Show response
www.tevora.com/wp-content/themes/berg-theme-child/assets/js/vendor/ 43 KB
11 KB 329ms
328ms Script
application/javascript 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.tevora.com/wp-content/themes/berg-theme-child/assets/js/vendor/slick.js?ver=1.0
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 357452f2a55c999ddd3afdcbce2c339d41cf7a01613d9d45ff88a753bb82f21d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:12 GMT
content-encoding: br
last-modified: Tue, 24 Oct 2023 14:12:24 GMT
server: nginx
etag: W/"6537d0c8-ab69"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 custom.js Show response
www.tevora.com/wp-content/themes/berg-theme-child/assets/js/ 4 KB
2 KB 329ms
329ms Script
application/javascript 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.tevora.com/wp-content/themes/berg-theme-child/assets/js/custom.js?ver=1.0
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 6fa82bb0bdde33f4b3af3f189b8dee0549a48358d4c21c6bcd2239dbb1b575fb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:12 GMT
content-encoding: br
last-modified: Tue, 24 Oct 2023 14:12:24 GMT
server: nginx
etag: W/"6537d0c8-1179"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 logo.png
www.tevora.com/wp-content/uploads/2021/06/ 1 KB
1 KB 253ms
253ms Image
image/png 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2021/06/logo.png
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 81264db4635426a010998b8de0c70f464b9c6de7c68c0223a94ee939943f04cc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:12 GMT
last-modified: Tue, 30 Nov 2021 15:24:11 GMT
server: nginx
etag: "61a6421b-4e2"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 1250

GET
H2 200 search@2x.png
www.tevora.com/wp-content/uploads/2021/07/ 423 B
624 B 254ms
253ms Image
image/png 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2021/07/search@2x.png
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 31d3597c13825747741e10fe906c470292169c0b7c263c9fb6bab164f94f8a06

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:12 GMT
last-modified: Tue, 30 Nov 2021 15:24:12 GMT
server: nginx
etag: "61a6421c-1a7"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 423

GET
H2 200 icons-8-test-passed.svg
www.tevora.com/wp-content/uploads/2021/06/ 2 KB
907 B 178ms
178ms Image
image/svg+xml 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2021/06/icons-8-test-passed.svg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: ec7dae37ddfa1cad5b97235b8d26b0d3eb8351c944fb065d5bf81d6ae73d7a09

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:12 GMT
content-encoding: br
last-modified: Tue, 30 Nov 2021 15:24:11 GMT
server: nginx
etag: W/"61a6421b-6ec"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 icons-8-privacy.svg
www.tevora.com/wp-content/uploads/2021/07/ 1 KB
839 B 179ms
178ms Image
image/svg+xml 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2021/07/icons-8-privacy.svg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 508e1915a0ae16b61b44e96f3035dbeaea19045038393657560f072bcd82bc5e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:12 GMT
content-encoding: br
last-modified: Tue, 30 Nov 2021 15:24:11 GMT
server: nginx
etag: W/"61a6421b-4ee"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 icons-8-process.svg
www.tevora.com/wp-content/uploads/2021/07/ 2 KB
1 KB 136ms
129ms Image
image/svg+xml 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2021/07/icons-8-process.svg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 492ffabf8d198a2460912fb2a5232ac32e815c7cc7b299b5157072d181a86d99

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
content-encoding: br
last-modified: Tue, 30 Nov 2021 15:24:11 GMT
server: nginx
etag: W/"61a6421b-842"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 Threat_skull_icon40x40.png
www.tevora.com/wp-content/uploads/2021/11/ 3 KB
4 KB 165ms
159ms Image
image/png 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2021/11/Threat_skull_icon40x40.png
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 5286b81d1c8cd4d63918dda0fce1d0947ceb756edd1e0131d345a5e20d90e0f4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
last-modified: Tue, 30 Nov 2021 15:24:09 GMT
server: nginx
etag: "61a64219-d5a"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3418

GET
H2 200 icons-8-warning-shield.svg
www.tevora.com/wp-content/uploads/2021/07/ 1 KB
836 B 158ms
152ms Image
image/svg+xml 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2021/07/icons-8-warning-shield.svg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: eb3fd6be8ccb11f7eca998573b38dbe848e843d05162d1da0280f09db9a05b58

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
content-encoding: br
last-modified: Tue, 30 Nov 2021 15:24:11 GMT
server: nginx
etag: W/"61a6421b-45d"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 icons-8-cloud-firewall.svg
www.tevora.com/wp-content/uploads/2021/07/ 1 KB
821 B 164ms
158ms Image
image/svg+xml 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2021/07/icons-8-cloud-firewall.svg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: f5bbb6a04570e63a0c07b7aca153124c7d67d1c1d27ce991126d327a76574dfb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
content-encoding: br
last-modified: Tue, 30 Nov 2021 15:24:11 GMT
server: nginx
etag: W/"61a6421b-4ef"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 12.svg
www.tevora.com/wp-content/uploads/2021/07/ 3 KB
2 KB 166ms
160ms Image
image/svg+xml 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2021/07/12.svg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: cead85a9301fa26a500daf2746e729c54644425abed2dddcca7afb07aaabb050

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
content-encoding: br
last-modified: Tue, 30 Nov 2021 15:24:10 GMT
server: nginx
etag: W/"61a6421a-dad"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 8.svg
www.tevora.com/wp-content/uploads/2021/07/ 2 KB
1 KB 159ms
153ms Image
image/svg+xml 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2021/07/8.svg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 4a39ef0ef5920d4a604b3da13cf0be683fc0cb338579b49b529555cbeead4928

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
content-encoding: br
last-modified: Tue, 30 Nov 2021 15:24:10 GMT
server: nginx
etag: W/"61a6421a-80c"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 4.svg
www.tevora.com/wp-content/uploads/2021/07/ 3 KB
2 KB 159ms
154ms Image
image/svg+xml 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2021/07/4.svg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 8cf4cfc0fb5acfcc2bc69c7824c633feb4063be8fc5505f7873df949f8becf29

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
content-encoding: br
last-modified: Tue, 30 Nov 2021 15:24:10 GMT
server: nginx
etag: W/"61a6421a-df7"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 11.svg
www.tevora.com/wp-content/uploads/2021/07/ 5 KB
2 KB 149ms
144ms Image
image/svg+xml 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2021/07/11.svg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 6a9aeb4c22c8a3f018879d40d2379918286ff8c2026be2679c50e01a5f777b2e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
content-encoding: br
last-modified: Tue, 30 Nov 2021 15:24:10 GMT
server: nginx
etag: W/"61a6421a-125a"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 7.svg
www.tevora.com/wp-content/uploads/2021/07/ 3 KB
1 KB 167ms
162ms Image
image/svg+xml 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2021/07/7.svg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 004e2313f859cd17b06984b71ba85edf3e02a74c2fcdf09ce4616ef63d8b37e5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
content-encoding: br
last-modified: Tue, 30 Nov 2021 15:24:10 GMT
server: nginx
etag: W/"61a6421a-bf3"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 3.svg
www.tevora.com/wp-content/uploads/2021/07/ 5 KB
2 KB 168ms
163ms Image
image/svg+xml 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2021/07/3.svg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: bd92564857cdb83242b7602bb5d249b54dc78ff55c6d28e21e3bd90b1b3e7b3b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
content-encoding: br
last-modified: Tue, 30 Nov 2021 15:24:10 GMT
server: nginx
etag: W/"61a6421a-12ef"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 group3.svg
www.tevora.com/wp-content/uploads/2021/07/ 2 KB
1021 B 177ms
172ms Image
image/svg+xml 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2021/07/group3.svg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 463d09552783494b59878f72b1c512d7e15c11c7db3b0d219e8d491a4a20b6d4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
content-encoding: br
last-modified: Tue, 30 Nov 2021 15:24:11 GMT
server: nginx
etag: W/"61a6421b-690"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 group7.svg
www.tevora.com/wp-content/uploads/2021/07/ 1 KB
866 B 167ms
162ms Image
image/svg+xml 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2021/07/group7.svg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: a8d1708b200629891cf19efa1b05c0d88fb08c27c51952f4814e4e10bda12ffd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
content-encoding: br
last-modified: Tue, 30 Nov 2021 15:24:11 GMT
server: nginx
etag: W/"61a6421b-5dd"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 group12.svg
www.tevora.com/wp-content/uploads/2021/07/ 2 KB
1 KB 162ms
157ms Image
image/svg+xml 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2021/07/group12.svg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: f1a55ab2c17e454e85736fee568bebeada6c4fa49f6b2dad54d4387a51b772bf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
content-encoding: br
last-modified: Tue, 30 Nov 2021 15:24:11 GMT
server: nginx
etag: W/"61a6421b-7cb"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 group4.svg
www.tevora.com/wp-content/uploads/2021/07/ 2 KB
1 KB 161ms
156ms Image
image/svg+xml 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2021/07/group4.svg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 2825d24e74d5907dff2d834775792730e52f2f885086378e4adc220b995a5930

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
content-encoding: br
last-modified: Tue, 30 Nov 2021 15:24:11 GMT
server: nginx
etag: W/"61a6421b-82d"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 group8.svg
www.tevora.com/wp-content/uploads/2021/07/ 2 KB
904 B 160ms
155ms Image
image/svg+xml 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2021/07/group8.svg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: c716b5c4e4e7ba75afde24c6da8acf13eb9b8b33933adc07ea4da9c82833f733

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
content-encoding: br
last-modified: Tue, 30 Nov 2021 15:24:11 GMT
server: nginx
etag: W/"61a6421b-678"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 group13.svg
www.tevora.com/wp-content/uploads/2021/07/ 2 KB
1013 B 164ms
159ms Image
image/svg+xml 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2021/07/group13.svg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 901b9ea57c9690cf801d6f11483eb53d1abdc699b8ff41075453c959ceefa1dc

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
content-encoding: br
last-modified: Tue, 30 Nov 2021 15:24:11 GMT
server: nginx
etag: W/"61a6421b-6e1"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 group4-1.svg
www.tevora.com/wp-content/uploads/2021/07/ 2 KB
1 KB 165ms
161ms Image
image/svg+xml 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2021/07/group4-1.svg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 02f412f7c8b7b2b0d81c8259b96369f39d4a1e8432ced663ec4c8e5e02e3a0f9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
content-encoding: br
last-modified: Tue, 30 Nov 2021 15:24:11 GMT
server: nginx
etag: W/"61a6421b-7b8"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 group.svg
www.tevora.com/wp-content/uploads/2021/06/ 1 KB
772 B 266ms
262ms Image
image/svg+xml 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2021/06/group.svg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: cc130a0066b09d481462e46b1f3f4cb35778984010a3620b37ddadcbdc98e86c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
content-encoding: br
last-modified: Tue, 30 Nov 2021 15:24:11 GMT
server: nginx
etag: W/"61a6421b-479"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 group3-1.svg
www.tevora.com/wp-content/uploads/2021/07/ 3 KB
1 KB 267ms
263ms Image
image/svg+xml 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2021/07/group3-1.svg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 2351c9050b274736629245447236a1763f4946ec7d221f97b02d050bef93ad72

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
content-encoding: br
last-modified: Tue, 30 Nov 2021 15:24:11 GMT
server: nginx
etag: W/"61a6421b-b64"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 group5-1.svg
www.tevora.com/wp-content/uploads/2021/07/ 1 KB
808 B 269ms
265ms Image
image/svg+xml 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2021/07/group5-1.svg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: b035fd2b48041f766aa4a49965f573ef9488d14d8dc694d2923e7b41772f7357

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
content-encoding: br
last-modified: Tue, 30 Nov 2021 15:24:11 GMT
server: nginx
etag: W/"61a6421b-4ea"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 group-copy-2.svg
www.tevora.com/wp-content/uploads/2021/09/ 1003 B
693 B 270ms
266ms Image
image/svg+xml 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2021/09/group-copy-2.svg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: f03e5cad9b2decaf7f877a1cb88debf3d8ac7870c6823bb6dbf19527eff775f4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
content-encoding: br
last-modified: Tue, 30 Nov 2021 15:24:09 GMT
server: nginx
etag: W/"61a64219-3eb"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 News.svg
www.tevora.com/wp-content/uploads/2021/07/ 6 KB
2 KB 268ms
264ms Image
image/svg+xml 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2021/07/News.svg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: f72b0c5d6f07db8804bbfa6ca2008fd1cc1a450db396fa8e7c5b90c702a3187d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
content-encoding: br
last-modified: Tue, 30 Nov 2021 15:24:11 GMT
server: nginx
etag: W/"61a6421b-17a3"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 group6-1.svg
www.tevora.com/wp-content/uploads/2021/07/ 1 KB
856 B 269ms
265ms Image
image/svg+xml 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2021/07/group6-1.svg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 4b8f3924d5f17f09df639cb030ebe4f7cf5b0f1601ab87472c563c4bff7e784f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
content-encoding: br
last-modified: Tue, 30 Nov 2021 15:24:11 GMT
server: nginx
etag: W/"61a6421b-588"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
BLOB 200
OK 28c9444a-e620-40c2-85a6-9b2627f2be1c
https://www.tevora.com/ 1 KB
0 Other
text/javascript

General

Check archive.org

Show headers Download Go to

Full URL: blob:https://www.tevora.com/28c9444a-e620-40c2-85a6-9b2627f2be1c
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: BLOB
Server: -, , ASN (),
Reverse DNS
Software: /
Resource Hash: 453cb806084fdabec32e286af2e88899f79022125c2527afffbec507975d2c22

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Length: 1245
Content-Type: text/javascript

GET
H2 200 image-1.png
www.tevora.com/wp-content/uploads/2023/05/ 44 KB
44 KB 252ms
252ms Image
image/png 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2023/05/image-1.png
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: aa02b4de96ba9195dba69d9122f69ae7b3e5cbce8e244f2b2cdda47e04602805

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:12 GMT
last-modified: Wed, 31 May 2023 18:02:25 GMT
server: nginx
etag: "64778bb1-af93"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 44947

GET
H2 200 image-2.png
www.tevora.com/wp-content/uploads/2023/05/ 72 KB
73 KB 271ms
267ms Image
image/png 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2023/05/image-2.png
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 65b5262a91bd3bcd0fe0ad2214f6d5a473b2d7d005bc81ffacd1482696f8e26b

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
last-modified: Wed, 31 May 2023 18:03:04 GMT
server: nginx
etag: "64778bd8-1215f"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 74079

GET
H2 200 image-3.png
www.tevora.com/wp-content/uploads/2023/05/ 138 KB
139 KB 271ms
268ms Image
image/png 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2023/05/image-3.png
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 1450d66599b38ae575a683399638da9584b1abe8eea5c4816ad27235f5e9094c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
last-modified: Wed, 31 May 2023 18:03:20 GMT
server: nginx
etag: "64778be8-228e3"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 141539

GET
H2 200 v2.js Show response
js.hsforms.net/forms/ 481 KB
154 KB 125ms
42ms Script
application/javascript 2606:4700::6810:8bce
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsforms.net/forms/v2.js

Requested by

Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:8bce , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d36723abef18616fa3fd4ca645638b74a655be246b374b909aaea89245d645ba

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

content-encoding: br
age: 209
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=forms-embed/static-1.4662/bundles/project-v2.js&cfRay=8526b07dba9234e8-WAW
x-amz-replication-status: COMPLETED
x-evy-trace-listener: listener_https
etag: W/"901e54a14df8fb921f61ad1626d78aec"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
cache-control: s-maxage=600, max-age=300
x-hs-target-asset: forms-embed/static-1.4662/bundles/project-v2.js
date: Thu, 08 Feb 2024 20:44:13 GMT
x-amz-version-id: Sy9z64wPMCabKXuNCQ40uKHrSWHQMm__
via: 1.1 05133180bbd1649d4b8f97441bf305e8.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-amz-cf-pop: IAD12-P3
x-hubspot-correlation-id: d01b0df7-5a9d-4a33-8f77-0f97e24dec40
x-cache: Hit from cloudfront
cache-tag: staticjsapp-forms-embed-v2-web-prod,staticjsapp-prod
x-envoy-upstream-service-time: 1
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-request-id: d01b0df7-5a9d-4a33-8f77-0f97e24dec40
last-modified: Wed, 07 Feb 2024 11:39:14 UTC
server: cloudflare
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sj8NyFcde08MFXXatZKd6ds3fq2hExBgCP6RCDgrFszAotRETYY2Npa3JLAH9oyrO7ZBcpIQj2obxNWEXV%2BTZ4IONwoSfxHxqBE0dLQCSwPWxydBoqesvUoXz2KVehlY6Jw8wZxNGG%2F6Fb%2Bu"}],"group":"cf-nel","max_age":604800}
x-hs-cache-status: HIT
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-748b697-nww6r
cf-ray: 8526b596ab6b355a-WAW
x-amz-cf-id: Xe7joiw09zczSwn9uQD2LqireXDPimMYSmq709hos0J5mxnx7JtJqQ==

GET
H2 200 tevora-white-01@2x.png
www.tevora.com/wp-content/uploads/2021/06/ 2 KB
2 KB 272ms
269ms Image
image/png 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2021/06/tevora-white-01@2x.png
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: cfc4cf057c03a209180e8741b14d52c3c56c8651dcf8228170a0bc6a50ec1ac9

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
last-modified: Tue, 30 Nov 2021 15:24:11 GMT
server: nginx
etag: "61a6421b-636"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 1590

GET
H2 200 icons-8-play-button.png
www.tevora.com/wp-content/uploads/2021/06/ 269 B
470 B 270ms
267ms Image
image/png 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2021/06/icons-8-play-button.png
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 30656ac05ad6e64d72af7a507a24c770194508f2f90e161be04b645c04504abf

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
last-modified: Tue, 30 Nov 2021 15:24:12 GMT
server: nginx
etag: "61a6421c-10d"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 269

GET
H2 200 Shape5.png
www.tevora.com/wp-content/uploads/2021/07/ 675 B
876 B 271ms
268ms Image
image/png 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2021/07/Shape5.png
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 20652052f52ae7ae3488a11de94060c462d57234cb839c9d69479ef9a5dc65e2

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
last-modified: Tue, 30 Nov 2021 15:24:12 GMT
server: nginx
etag: "61a6421c-2a3"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 675

GET
H2 200 icons-8-twitter.png
www.tevora.com/wp-content/uploads/2021/06/ 294 B
495 B 272ms
269ms Image
image/png 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2021/06/icons-8-twitter.png
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 29bef405f29d190c2a055a173551ad73f488ae4fa96191830115649a7b413646

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
last-modified: Tue, 30 Nov 2021 15:24:11 GMT
server: nginx
etag: "61a6421b-126"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 294

GET
H2 200 Path2.png
www.tevora.com/wp-content/uploads/2021/07/ 829 B
1 KB 274ms
271ms Image
image/png 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2021/07/Path2.png
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 898be9f6701716fa35fa8e04612504a7d77e6b09f20a4ef204151cdb1913a0b5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
last-modified: Tue, 30 Nov 2021 15:24:11 GMT
server: nginx
etag: "61a6421b-33d"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 829

GET
H2 200 icons-8-linkedin.png
www.tevora.com/wp-content/uploads/2021/06/ 247 B
448 B 274ms
271ms Image
image/png 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2021/06/icons-8-linkedin.png
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: a699fc08da29f99f1f5fa047d4c6694075296b3faf71b0bb9f42f0de53ce14c8

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
last-modified: Tue, 30 Nov 2021 15:24:11 GMT
server: nginx
etag: "61a6421b-f7"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 247

GET
H2 200 Shape4.png
www.tevora.com/wp-content/uploads/2021/07/ 582 B
783 B 275ms
272ms Image
image/png 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2021/07/Shape4.png
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 9de3c2573bc024f36ab74f0a9b8eacf7e3154e4e8b074a54686b1884ec4f00b5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
last-modified: Tue, 30 Nov 2021 15:24:11 GMT
server: nginx
etag: "61a6421b-246"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 582

GET
H2 200 icons-8-instagram.png
www.tevora.com/wp-content/uploads/2021/06/ 316 B
517 B 275ms
273ms Image
image/png 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2021/06/icons-8-instagram.png
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 32ec92d7a08198689be406ed2ce826d74e9a129587d043eaf334031372af057d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
last-modified: Tue, 30 Nov 2021 15:24:12 GMT
server: nginx
etag: "61a6421c-13c"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 316

GET
H2 200 Shape3.png
www.tevora.com/wp-content/uploads/2021/07/ 847 B
1 KB 272ms
270ms Image
image/png 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2021/07/Shape3.png
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: e0893208fc69a8da3d062b64686c2c3b0c74711453ffd65fa2cc1bdbba838f50

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
last-modified: Tue, 30 Nov 2021 15:24:11 GMT
server: nginx
etag: "61a6421b-34f"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 847

GET
H2 200 lodash.min.js Show response
www.tevora.com/wp-includes/js/dist/vendor/ 69 KB
25 KB 137ms
131ms Script
application/javascript 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.tevora.com/wp-includes/js/dist/vendor/lodash.min.js?ver=4.17.19
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 211fdb26a74dac46f2bd297c0f02953de9e69355035cad239d87acf21c5a6a0e

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
content-encoding: br
last-modified: Thu, 21 Sep 2023 13:26:32 GMT
server: nginx
etag: W/"650c4488-115ad"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 frontend_blocks.js Show response
www.tevora.com/wp-content/plugins/berg/dist/ 134 KB
43 KB 138ms
132ms Script
application/javascript 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.tevora.com/wp-content/plugins/berg/dist/frontend_blocks.js?ver=1.0.0
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 171adc86ee544243b9713665b02b4fa251be21e622848a64166ac34cfc8bfcb1

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
content-encoding: br
last-modified: Tue, 24 Oct 2023 14:15:20 GMT
server: nginx
etag: W/"6537d178-21609"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 accordion-blocks.min.js Show response
www.tevora.com/wp-content/plugins/accordion-blocks/js/ 3 KB
1 KB 138ms
132ms Script
application/javascript 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.tevora.com/wp-content/plugins/accordion-blocks/js/accordion-blocks.min.js?ver=1.5.0
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: a204849a0777563cc401d76d1a8e1ab5c5a6c554d391c0b24493985b4a4f42af

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
content-encoding: br
last-modified: Tue, 24 Oct 2023 04:10:32 GMT
server: nginx
etag: W/"653743b8-a2c"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 7013481.js Show response
js.hs-scripts.com/ 2 KB
1 KB 330ms
254ms Script
application/javascript 2606:4700::6810:bb59
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hs-scripts.com/7013481.js?integration=WordPress&ver=10.2.23

Requested by

Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:bb59 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7af448d4d07afce5edebdd0648469678e418c9d8e45ef56a23f91d0a5c64a6e3

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: EXPIRED
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: bed335f8-90f4-4193-8b7e-94685677347b
x-envoy-upstream-service-time: 93
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: bed335f8-90f4-4193-8b7e-94685677347b
last-modified: Thu, 08 Feb 2024 18:55:11 GMT
server: cloudflare
x-trace: 2B903E0342BBC2477F13964E3A251384BE2092B679000000000000000000
vary: origin, Accept-Encoding
access-control-max-age: 3600
content-type: application/javascript;charset=utf-8
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-f7f4ffb8f-q4mkw
cache-control: public, max-age=90
access-control-allow-credentials: true
cf-ray: 8526b5969b3b347f-WAW
expires: Thu, 08 Feb 2024 20:45:43 GMT

GET
H2 200 frontend.min.js Show response
www.tevora.com/wp-content/plugins/wp-user-avatar/assets/js/ 18 KB
4 KB 141ms
135ms Script
application/javascript 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.tevora.com/wp-content/plugins/wp-user-avatar/assets/js/frontend.min.js?ver=4.13.4
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 572e5e4a394913b6c3c000f37295ba6da7f7cadd25e3c70c7552e90b9f99ac58

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
content-encoding: br
last-modified: Tue, 24 Oct 2023 04:10:22 GMT
server: nginx
etag: W/"653743ae-4733"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 e-202406.js Show response
stats.wp.com/ 7 KB
3 KB 89ms
27ms Script
application/javascript 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.wp.com/e-202406.js
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: 4f9f4e2e225088f9cf3b6b54aa421e0f776d1802255505d2f752e1f83f441641

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-minify-cache: hit
x-nc: HIT hhn
date: Thu, 08 Feb 2024 20:44:13 GMT
content-encoding: br
server: nginx
x-minify: t
etag: W/14377-1704402356565.5398
vary: Accept-Encoding
access-control-allow-methods: GET, HEAD
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=31536000
alt-svc: h3=":443"; ma=86400
expires: Mon, 03 Feb 2025 14:06:59 GMT

GET
H2 200 gtm.js Show response
www.googletagmanager.com/ 202 KB
73 KB 284ms
72ms Script
application/javascript 2a00:1450:4001:811::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtm.js?id=GTM-T245DHZ

Requested by

Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

c6d8c2087d93bf1e24a9893d020eee0663562626165ce6da54935a7b8d42b4a7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 73915
x-xss-protection: 0
last-modified: Thu, 08 Feb 2024 19:57:45 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 08 Feb 2024 20:44:13 GMT

GET
H2 200 icon-sprite-v1.6.svg
www.tevora.com/wp-content/themes/berg-theme-child/dist/images/ 28 KB
8 KB 255ms
255ms Image
image/svg+xml 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/themes/berg-theme-child/dist/images/icon-sprite-v1.6.svg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/wp-content/themes/berg-theme-child/dist/css/style.css?ver=6.4.2
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: ee85f1d740c49f41a84b78243c3d33734d70242ce9ee07778d53fcbba4347db3

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/wp-content/themes/berg-theme-child/dist/css/style.css?ver=6.4.2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
content-encoding: br
last-modified: Tue, 24 Oct 2023 14:13:48 GMT
server: nginx
etag: W/"6537d11c-6f27"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 path-blog-inner-mid.svg
www.tevora.com/wp-content/themes/berg-theme-child/dist/images/ 991 B
773 B 258ms
258ms Image
image/svg+xml 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/themes/berg-theme-child/dist/images/path-blog-inner-mid.svg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/wp-content/themes/berg-theme-child/dist/css/style.css?ver=6.4.2
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 58606f6e16ac645af86bd0b74a2b20ca8541661067c5c9541ccb6a458c3ab419

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/wp-content/themes/berg-theme-child/dist/css/style.css?ver=6.4.2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
content-encoding: br
last-modified: Tue, 24 Oct 2023 14:13:48 GMT
server: nginx
etag: W/"6537d11c-3df"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 KFOlCnqEu92Fr1MmWUlfBBc4.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 277ms
73ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOlCnqEu92Fr1MmWUlfBBc4.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto%3Awght%40300%3B400%3B500%3B700&display=swap&ver=6.4.2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.tevora.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 17:56:55 GMT
x-content-type-options: nosniff
age: 96438
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15860
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:42 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 06 Feb 2025 17:56:55 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v30/ 15 KB
16 KB 267ms
64ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto%3Awght%40300%3B400%3B500%3B700&display=swap&ver=6.4.2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.tevora.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Wed, 07 Feb 2024 23:58:11 GMT
x-content-type-options: nosniff
age: 74762
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15744
x-xss-protection: 0
last-modified: Wed, 11 May 2022 19:24:48 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Thu, 06 Feb 2025 23:58:11 GMT

GET
H2 200 BngMUXZYTXPIvIBgJJSb6ufN5qU.woff2
fonts.gstatic.com/s/robotoslab/v34/ 34 KB
34 KB 324ms
120ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/robotoslab/v34/BngMUXZYTXPIvIBgJJSb6ufN5qU.woff2

Requested by

Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=Roboto+Slab%3Awght%40300%3B400%3B500%3B600%3B700&display=swap&ver=6.4.2

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

a8e429611131e3fdc2018ec943a36100dbabb4aaa788c8dead6bdcf927917293

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://fonts.googleapis.com/
Origin: https://www.tevora.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 00:04:21 GMT
x-content-type-options: nosniff
age: 74392
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 34328
x-xss-protection: 0
last-modified: Tue, 24 Oct 2023 01:54:50 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Fri, 07 Feb 2025 00:04:21 GMT

GET
H2 200 image-4-693x1024.png
www.tevora.com/wp-content/uploads/2023/05/ 258 KB
259 KB 240ms
240ms Image
image/png 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2023/05/image-4-693x1024.png
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 8495dc9f62bda607389501ea00518d9d2c2628a35dab4b9a8d3261f08de43d23

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
last-modified: Wed, 31 May 2023 18:08:50 GMT
server: nginx
etag: "64778d32-40893"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 264339

GET
H2 200 sm.25.html Show response
static.addtoany.com/menu/ Frame 30BE 716 B
739 B 44ms
42ms Document
text/html 2606:4700:10::6816:47c5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/sm.25.html

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/page.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:47c5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

274d4116239b63097bb7c16e56e27cbb5a77be20392fb8e2317c0a0235185cad

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-origin: *
age: 16673
alt-svc: h3=":443"; ma=86400
cache-control: max-age=315360000, immutable
cf-cache-status: HIT
cf-ray: 8526b597787cabce-CPH
content-encoding: br
content-type: text/html; charset=utf-8
date: Thu, 08 Feb 2024 20:44:13 GMT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
referrer-policy: strict-origin-when-cross-origin
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zug0GuV8TT18l%2FvMZH%2FJnDeJHp7wf%2B1Y662Hj9%2BLzz2bUcCdNCoPp%2Fh0DEFIQdCRWhP4K%2BoKw%2FRmNo3FmNPd%2Fwhjcq0lNYxvJsnDWqwQO4JO8fVs77yEaENmOQytJ1Ua8d%2FapSMn"}],"group":"cf-nel","max_age":604800}
server: cloudflare
strict-transport-security: max-age=31536000; includeSubDomains; preload
vary: Accept-Encoding
x-content-type-options: nosniff

GET
H2 200 core.Ep5bSEmr.js Show response
static.addtoany.com/menu/modules/ 70 KB
26 KB 111ms
59ms Script
application/javascript 2606:4700:10::6816:47c5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/modules/core.Ep5bSEmr.js

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/page.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700:10::6816:47c5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

219b652de3176257072749c876811cc963494f5fbdee3f92eb38e7392f724ce0

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer
Origin: https://www.tevora.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 9903
content-encoding: br
alt-svc: h3=":443"; ma=86400
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"a995aaed2cd978eb5749462d1dc3635e"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eYkspdNQUAHYNahZwfst8xRQBAqJMAvDcYeUQWIFrArMiQ3eVwVaS0JfIV0FXc3JShuDDxBJUNahNuJ5JR%2BV1tLaUPEnaQscTVRBJTYrEuuV%2FdwbnGLtYNt9UNnXjHub9KJoBf2tFQDh132YyPVg2C3i"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=315360000, immutable
cf-ray: 8526b5971839abde-CPH

GET
H/1.1 200
OK json Show response
forms.hsforms.com/embed/v3/form/7013481/6c95561c-1e3b-4787-9cd6-1020f66646d8/ 6 KB
2 KB 259ms
177ms XHR
application/json 2606:4700::6812:b07d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hsforms.com/embed/v3/form/7013481/6c95561c-1e3b-4787-9cd6-1020f66646d8/json?hs_static_app=forms-embed&hs_static_app_version=1.4662&X-HubSpot-Static-App-Info=forms-embed-1.4662

Requested by

Host: js.hsforms.net
URL: https://js.hsforms.net/forms/v2.js

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:b07d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

83254569c5a8ee71c2a1a3abbdd9d848b6a4ff0b5c700b30cc2fa27b086e19db

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

X-Origin-Hublet: na1
Date: Thu, 08 Feb 2024 20:44:13 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
CF-Cache-Status: DYNAMIC
Content-Encoding: br
x-evy-trace-route-service-name: envoyset-translator
X-HubSpot-Correlation-Id: d03160dd-ddd5-4140-8954-be59d6527b67
Transfer-Encoding: chunked
x-envoy-upstream-service-time: 10
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: d03160dd-ddd5-4140-8954-be59d6527b67
Server: cloudflare
X-Trace: 2B80E4AD54355398702575B0AFAF0B2A08CD46DBE0000000000000000000
Vary: origin
Access-Control-Allow-Methods: OPTIONS, GET
Content-Type: application/json;charset=utf-8
Access-Control-Allow-Origin: https://www.tevora.com
x-evy-trace-virtual-host: all
Access-Control-Expose-Headers: X-Origin-Hublet
Access-Control-Max-Age: 180
Access-Control-Allow-Credentials: false
Cache-Control: max-age=0, no-cache, no-store
X-Robots-Tag: none
Access-Control-Allow-Headers: *
CF-RAY: 8526b5980d11356c-WAW
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-bfd765d7d-z8vxw

GET
H2 200 app.js Show response
acsbapp.com/apps/app/dist/js/ 297 KB
90 KB 282ms
202ms Script
application/javascript 2606:4700:10::ac43:b9b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://acsbapp.com/apps/app/dist/js/app.js
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::ac43:b9b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7e4bd1bfb0e844f06b8dd49f472969dc4d52987a747493f44055170ecd4218aa

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
content-encoding: br
cf-cache-status: REVALIDATED
x-guploader-uploadid: ABPtcPo0eMY2YBiIbqbzUf0rBj90uUAtsXiAV8Ib32uSSOiLrG7EJv-BbKYc0TnyjzMvfW8Wm9yG1HrUNA
x-goog-storage-class: STANDARD
x-goog-metageneration: 3
x-goog-stored-content-encoding: identity
last-modified: Tue, 06 Feb 2024 14:25:20 GMT
server: cloudflare
etag: W/"224f3ab97519091eef3a64ef7dbb22db"
vary: Accept-Encoding
x-goog-hash: crc32c=IFrfhA==, md5=Ik86uXUZCR7vOmTvfbsi2w==
x-goog-generation: 1707229520007073
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cache-control: public, max-age=300, must-revalidate
x-goog-stored-content-length: 304003
cf-ray: 8526b5980e2d95fa-ARN
expires: Fri, 07 Feb 2025 20:44:13 GMT

GET
H2 200 footer-V.svg
www.tevora.com/wp-content/themes/berg-theme-child/dist/images/ 709 B
632 B 166ms
165ms Image
image/svg+xml 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/themes/berg-theme-child/dist/images/footer-V.svg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/wp-content/themes/berg-theme-child/dist/css/style.css?ver=6.4.2
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 2ccd3b1f2416e64e3c1b16943db539d335f8c35886543a88a3f16fef2bc9e9b5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/wp-content/themes/berg-theme-child/dist/css/style.css?ver=6.4.2
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
content-encoding: br
last-modified: Tue, 24 Oct 2023 14:13:48 GMT
server: nginx
etag: W/"6537d11c-2c5"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: image/svg+xml
access-control-allow-origin: *
cache-control: public, max-age=31536000

GET
H2 200 collectedforms.js Show response
js.hscollectedforms.net/ 69 KB
25 KB 308ms
153ms Script
application/javascript 2606:4700::6811:589a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hscollectedforms.net/collectedforms.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/7013481.js?integration=WordPress&ver=10.2.23

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:589a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7c326f96b9af470b51c887a189b1f81d241d6beef4844b37c8add5144fa6f55d

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer
Origin: https://www.tevora.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
x-amz-version-id: JAkD5shSwdxe4gNEROP8R.wQbdFvcCSE
via: 1.1 736ad67f05a9a5a8fd5ed8cba30196f4.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: EXPIRED
x-amz-cf-pop: IAD12-P3
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: c0396cb5-79ec-4a8f-8960-31aa359442bd
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=collected-forms-embed-js/static-1.451/bundles/project.js&cfRay=8526b5994b18bf71-WAW
x-cache: Hit from cloudfront
cache-tag: staticjsapp-collected-forms-embed-js-web-prod,staticjsapp-prod
content-encoding: br
x-envoy-upstream-service-time: 0
x-amz-replication-status: COMPLETED
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: c0396cb5-79ec-4a8f-8960-31aa359442bd
last-modified: Wed, 03 Jan 2024 09:59:36 UTC
server: cloudflare
etag: W/"dc52d8d37d1323196ca91b50795df6c4"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
access-control-allow-origin: *
x-evy-trace-virtual-host: all
x-hs-cache-status: HIT
cache-control: s-maxage=600, max-age=300
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-748b697-c4fsd
cf-ray: 8526b5994b18bf71-WAW
x-amz-cf-id: chxq-xPMN8c_Q6xUIBm0ClYGkTr07nF0OZzmchKWT-KqOCfY9DUf0Q==
x-hs-target-asset: collected-forms-embed-js/static-1.451/bundles/project.js

GET
H2 200 7013481.js Show response
js.hs-analytics.net/analytics/1707424800000/ 66 KB
21 KB 344ms
190ms Script
text/javascript 2606:4700::6810:50ba
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-analytics.net/analytics/1707424800000/7013481.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/7013481.js?integration=WordPress&ver=10.2.23
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700::6810:50ba , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 49eed4fb8b8326551b840b96cf3b7f661441e5a03b6734c0221d142180724157

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
x-amz-version-id: null
content-encoding: br
cf-cache-status: MISS
x-amz-request-id: E46PTBSCAVA0BY49
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: f7473f33-c865-43a6-9ad6-1f526e871191
x-envoy-upstream-service-time: 32
x-amz-id-2: eaFEPrip1Q8UH5B7Z1Dvt3DsHy9iC8tVFAzwJvevgk2ELQcos2m2hKcrAXPy3h5JWoA1CfkAsm4=
x-evy-trace-listener: listener_https
x-request-id: f7473f33-c865-43a6-9ad6-1f526e871191
x-evy-trace-route-configuration: listener_https/all
last-modified: Wed, 03 Jan 2024 16:38:43 GMT
server: cloudflare
etag: W/"d2c9c7fd9e5925dace941c5bbf0c46cb"
vary: origin, Accept-Encoding
content-type: text/javascript
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-8555f56d-phrfm
cache-control: max-age=300,public
access-control-allow-credentials: false
cf-ray: 8526b5994b7d8876-WAW
expires: Thu, 08 Feb 2024 20:49:13 GMT

GET
H2 200 fb.js Show response
js.hsadspixel.net/ 6 KB
4 KB 199ms
45ms Script
application/javascript 2606:4700::6811:e6a3
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://js.hsadspixel.net/fb.js

Requested by

Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/7013481.js?integration=WordPress&ver=10.2.23

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:e6a3 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

91d1bde942744d48fec9019c7b87b351f7a165e544d59fcbb4e43f3309be4ab9

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
x-amz-version-id: gvApL1OxjF_N9vv.KngIIs22vbExO7Ym
via: 1.1 3c43e000c50d5633eb558057710f3c54.cloudfront.net (CloudFront)
x-content-type-options: nosniff
cf-cache-status: HIT
x-amz-cf-pop: IAD12-P3
age: 5
x-amz-server-side-encryption: AES256
x-evy-trace-route-service-name: envoyset-translator
content-security-policy-report-only: frame-ancestors 'self'; report-uri https://send.hsbrowserreports.com/csp/report?resource=adsscriptloaderstatic/static-1.514/bundles/pixels-release.js&cfRay=8526b5773e1bfc73-WAW
x-cache: Hit from cloudfront
x-hubspot-correlation-id: d64721c6-cb26-4b1f-b3ff-82f60350ffbf
cache-tag: staticjsapp-AdsScriptLoaderCloudflare-web-prod,staticjsapp-prod
content-encoding: br
x-envoy-upstream-service-time: 0
x-amz-replication-status: COMPLETED
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: d64721c6-cb26-4b1f-b3ff-82f60350ffbf
last-modified: Tue, 23 Jan 2024 14:51:49 UTC
server: cloudflare
etag: W/"67b4606337c5c72b80dacfb036530227"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
x-hs-cache-status: HIT
x-evy-trace-virtual-host: all
cache-control: max-age=600
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-748b697-nww6r
cf-ray: 8526b5994e6bfbc6-WAW
x-amz-cf-id: -IwxRRmUgxtE9JMUcdFAgty8NCkmoexJ9JwnT9fHAtPxNlSTEpMHgA==
x-hs-target-asset: adsscriptloaderstatic/static-1.514/bundles/pixels-release.js

GET
H2 200 banner.js Show response
js.hs-banner.com/v2/7013481/ 69 KB
23 KB 323ms
171ms Script
text/javascript 2606:4700:4400::ac40:991b
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.hs-banner.com/v2/7013481/banner.js
Requested by: Host: js.hs-scripts.com
URL: https://js.hs-scripts.com/7013481.js?integration=WordPress&ver=10.2.23
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:4400::ac40:991b , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 10d3ba7ff310b5e29ee1bc00445a95b4b5da34f1b8ea2797455ea1b83039d8f9

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
x-amz-version-id: e8e77jXX2DapzkjI1s2UvpMAgevBeWr6
content-encoding: br
cf-cache-status: REVALIDATED
x-amz-request-id: RVYGXNR3HFTK1TM7
x-evy-trace-route-service-name: envoyset-translator
x-amz-server-side-encryption: AES256
x-hubspot-correlation-id: 773ed30f-4086-4a7c-b5b5-ecfdace38472
x-envoy-upstream-service-time: 41
x-amz-id-2: +EePNhKn9k4ZN9pv+UW5vARWWHd/6n3hi2d8LPz80z3hurTlLkorRpOELammCfJq61p43QUuSF0uca3KlWHH/apaoe9HHkNnQvz5wC0u9hg=
x-evy-trace-listener: listener_https
x-request-id: 773ed30f-4086-4a7c-b5b5-ecfdace38472
x-evy-trace-route-configuration: listener_https/all
last-modified: Tue, 06 Feb 2024 15:28:51 GMT
server: cloudflare
etag: W/"1bb391b805e1e627e86c2475b9f4142f"
access-control-max-age: 604800
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: text/javascript; charset=UTF-8
vary: origin, Accept-Encoding
x-evy-trace-virtual-host: all
access-control-expose-headers: x-last-modified-timestamp, X-HubSpot-NotFound, X-HS-User-Request, Link, Server-Timing
cache-control: max-age=300,public
access-control-allow-credentials: true
x-evy-trace-served-by-pod: iad02/analytics-js-proxy-td/envoy-proxy-8555f56d-pbs6d
timing-allow-origin: *
access-control-allow-headers: Origin, X-Requested-With, Content-Type, Accept, Accept-Charset, Accept-Encoding, X-Override-Internal-Permissions, X-Properties-Source, X-Properties-SourceId, X-Properties-Flag, X-Hubspot-User-Id, X-Hubspot-Trace, X-Hubspot-Callee, X-Hubspot-Offset, X-Hubspot-No-Trace, X-HubSpot-Static-App-Info, X-HubSpot-Messages-Uri, X-HubSpot-Request-Source, X-HubSpot-Request-Reason, Subscription-Billing-Auth-Token, X-App-CSRF, X-Tools-CSRF, Online-Payment-Signing-UUID, X-Source, X-SourceId, X-Origin-UserId, X-Biden-Request-Source, X-HubSpot-CSRF-hubspotapi, X-Force-Cookie-Refresh, X-Force-Cookie-Refresh-No-Cache, X-HS-User-Request, X-Application-Id, X-HS-Referer, X-HubSpot-Correlation-Id
cf-ray: 8526b5993c066a77-TXL
expires: Thu, 08 Feb 2024 20:49:13 GMT

GET
H3 200 facebook.js Show response
static.addtoany.com/menu/svg/icons/ 430 B
817 B 62ms
61ms Script
application/javascript 2606:4700:10::6816:47c5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/svg/icons/facebook.js

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/modules/core.Ep5bSEmr.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::6816:47c5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

9ee1397f4da0e0c981a979bc1ea43be1d0c28bf3619636df8ab9dc09fa770aaf

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://static.addtoany.com/menu/modules/core.Ep5bSEmr.js
Origin: https://www.tevora.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3897
content-encoding: br
alt-svc: h3=":443"; ma=86400
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"3c6ccaafe275b5b477d0400b5847bbce"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=D3mG79C4FeW1gZYdGYZ6RskrDb%2B1DN6VTzN9unMbaRjLGDiArszzY9BBM4f0FKKqDurPkBLS5POYY4zj67RPbJvU39XNbOe8Lgr8CUg2tg5vhzNPutwPSP8BPrLpfUQQF%2BPA%2FOqW"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=7776000, stale-while-revalidate=30, public
cf-ray: 8526b5985cf29939-ARN

GET
H3 200 twitter.js Show response
static.addtoany.com/menu/svg/icons/ 695 B
928 B 60ms
60ms Script
application/javascript 2606:4700:10::6816:47c5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/svg/icons/twitter.js

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/modules/core.Ep5bSEmr.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::6816:47c5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

74ec1e2bfcf647ccdeaf5b127294db846ee4a6f8ffd6c909d4938370d4187d1f

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://static.addtoany.com/menu/modules/core.Ep5bSEmr.js
Origin: https://www.tevora.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3897
content-encoding: br
alt-svc: h3=":443"; ma=86400
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"31edccd311957616d32bbcad27fcf679"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EK%2Bd5LeFCwf8N5bSsgSu0cSnDN%2F2dmxAczI80RU6ZrzcyNfld1cP6WCk4uTUaU6tdjgMK63EMlQwf%2FWQn%2FC9OVww0ruH%2B3byooueqQ8QvklV9NImKK9arBFTdk%2FjaV8yWbAia0Pu"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=7776000, stale-while-revalidate=30, public
cf-ray: 8526b5985cf59939-ARN

GET
H3 200 email.js Show response
static.addtoany.com/menu/svg/icons/ 427 B
817 B 64ms
63ms Script
application/javascript 2606:4700:10::6816:47c5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/svg/icons/email.js

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/modules/core.Ep5bSEmr.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::6816:47c5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

b199ed28ba39e8d3bdc0d2860b8f710808796f2c7272406178010428f509d397

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://static.addtoany.com/menu/modules/core.Ep5bSEmr.js
Origin: https://www.tevora.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3897
content-encoding: br
alt-svc: h3=":443"; ma=86400
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"48a669f03d3a3ea93ea22be8f12d6cc2"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bynbzoDRga2nYC%2BDEzFzzW%2F0L0t1ghAC7p0xtYskRpVimb7SYEGvTBvsDAwGh0znHPaU5UxZ%2BCinEIhxsmKYjp5D7EgZlBASKDtHSo7qh%2BRl5sLHEjj7ZrVXu31fuo2yXgT%2BtQjq"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=7776000, stale-while-revalidate=30, public
cf-ray: 8526b5985cf79939-ARN

GET
H3 200 linkedin.js Show response
static.addtoany.com/menu/svg/icons/ 447 B
820 B 61ms
60ms Script
application/javascript 2606:4700:10::6816:47c5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/svg/icons/linkedin.js

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/modules/core.Ep5bSEmr.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::6816:47c5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

7f9daed000021c96e3353a5b331baa4443cdcfd11737976cd8b2f6821eabf65c

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://static.addtoany.com/menu/modules/core.Ep5bSEmr.js
Origin: https://www.tevora.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3897
content-encoding: br
alt-svc: h3=":443"; ma=86400
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"9c8ac02824bf44bdc91505c6344a09ef"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EF8sO9wpexr0W3uc13HdLQL8Lx2g83y1P3zsJB9JWu%2BbOPy%2FVL4CT91lnHq1uV0H4Pn%2B93Zki2rBTVCUFBvocip93puL80WQf0%2BbRDYcFhOkz9t%2B67%2Fda4ia9X%2FPyYTrDcl3fF90"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=7776000, stale-while-revalidate=30, public
cf-ray: 8526b5985cf99939-ARN

GET
H3 200 reddit.js Show response
static.addtoany.com/menu/svg/icons/ 929 B
1020 B 53ms
52ms Script
application/javascript 2606:4700:10::6816:47c5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/svg/icons/reddit.js

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/modules/core.Ep5bSEmr.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::6816:47c5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

32acbaf49df946ebb1f9958224f92100b9dca8fa41d0e4ca354d43f08f6f20d1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://static.addtoany.com/menu/modules/core.Ep5bSEmr.js
Origin: https://www.tevora.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3897
content-encoding: br
alt-svc: h3=":443"; ma=86400
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"22f5e4e420fe8a8f261f152f0bdf4c34"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Qsu2dNVjatiltyCxJwt3uYFu1Jv69w9N%2F2aUNJD9xYf5uSCke6buYgx4cNz6B3yj3bw3j2Rvf5XbeiZ%2BkE8TuhM%2B4koefMhGO9eCfjRx344vcgx9xc6b9wEfM3Xi6HudeaJ2Xj6t"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=7776000, stale-while-revalidate=30, public
cf-ray: 8526b5985cfc9939-ARN

GET
H3 200 a2a.js Show response
static.addtoany.com/menu/svg/icons/ 182 B
674 B 61ms
61ms Script
application/javascript 2606:4700:10::6816:47c5
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://static.addtoany.com/menu/svg/icons/a2a.js

Requested by

Host: static.addtoany.com
URL: https://static.addtoany.com/menu/modules/core.Ep5bSEmr.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700:10::6816:47c5 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

3dab93242ee573bbcfc22c9d15acd47794e500ed44e6bd48a35400b39d65aa43

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer: https://static.addtoany.com/menu/modules/core.Ep5bSEmr.js
Origin: https://www.tevora.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: HIT
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
age: 3897
content-encoding: br
alt-svc: h3=":443"; ma=86400
referrer-policy: strict-origin-when-cross-origin
server: cloudflare
etag: W/"0aca4ea1e5f8f250126a8e0c597dd969"
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dL2tAAG7lK%2FZ%2Bdy4iUHBpROk2PbZtZdNA1gl0FlU5EJKSACPOrtliWS%2FBzl6%2F%2BdRH2KpD%2Bqeth6oraGfLbsQyW5zL6ukuWCxLHKfTeGLhWD63UFvzA3AFaQDzql67LSa%2FGEbS%2BiL"}],"group":"cf-nel","max_age":604800}
content-type: application/javascript
access-control-allow-origin: *
cache-control: max-age=7776000, stale-while-revalidate=30, public
cf-ray: 8526b5985cfd9939-ARN

GET
H2 200 g.gif
pixel.wp.com/ 50 B
177 B 33ms
27ms Image
image/gif 192.0.76.3
AUTOMATTIC

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.wp.com/g.gif?v=ext&blog=204589598&post=24983&tz=-8&srv=www.tevora.com&j=1%3A12.6.2&host=www.tevora.com&ref=&fcp=1428&rand=0.31608188688587924
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 192.0.76.3 San Francisco, United States, ASN2635 (AUTOMATTIC, US),
Reverse DNS
Software: nginx /
Resource Hash: f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-origin: *
date: Thu, 08 Feb 2024 20:44:13 GMT
cache-control: no-cache
server: nginx
alt-svc: h3=":443"; ma=86400
content-length: 50
content-type: image/gif

GET
H2 200 wp-emoji-release.min.js Show response
www.tevora.com/wp-includes/js/ 18 KB
5 KB 199ms
199ms Script
application/javascript 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://www.tevora.com/wp-includes/js/wp-emoji-release.min.js?ver=6.4.2
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
content-encoding: br
last-modified: Thu, 02 Feb 2023 00:53:25 GMT
server: nginx
etag: W/"63db0985-4904"
vary: Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
content-type: application/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000

POST
H2 200 admin-ajax.php Show response
www.tevora.com/wp-admin/ 8 KB
5 KB 477ms
477ms XHR
text/html 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.tevora.com/wp-admin/admin-ajax.php

Requested by

Host: www.tevora.com
URL: https://www.tevora.com/wp-content/themes/berg-theme-child/dist/js/main.js?ver=1

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

144.152.190.35.bc.googleusercontent.com

Software

nginx / WP Engine

Resource Hash

8c9cb85abf40b913e6c24e1d855e6a3153a84266a165154d0263e23d56811f83

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' data: ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.addtoany.com https://js.hsforms.net https://acsbapp.com https://js.hs-scripts.com https://snap.licdn.com https://tag.demandbase.com https://js.zi-scripts.com https://js.hs-banner.com https://js.hscollectedforms.net https://js.hs-analytics.net https://js.hsadspixel.net/ https://www.google.com https://www.gstatic.com/ https://yoast.com https://stats.wp.com https://widgets.wp.com https://s0.wp.com https://js.hubspot.com www.googletagservices.com .googlesyndication.com .googleadservices.com googleads.g.doubleclick.net adservice.google.com adservice.google.ae adservice.google.al adservice.google.at adservice.google.be adservice.google.bg adservice.google.bs adservice.google.ca adservice.google.ch adservice.google.ci adservice.google.cl adservice.google.co.bw adservice.google.co.cr adservice.google.co.id adservice.google.co.il adservice.google.co.in adservice.google.co.jp adservice.google.co.ke adservice.google.co.kr adservice.google.co.mz adservice.google.co.nz adservice.google.co.th adservice.google.co.tz adservice.google.co.uk adservice.google.co.uz adservice.google.co.ve adservice.google.co.za adservice.google.co.zm adservice.google.co.zw adservice.google.com.ai adservice.google.com.ar adservice.google.com.au adservice.google.com.bd adservice.google.com.bh adservice.google.com.bn adservice.google.com.bo adservice.google.com.br adservice.google.com.co adservice.google.com.cy adservice.google.com.ec adservice.google.com.eg adservice.google.com.et adservice.google.com.fj adservice.google.com.gh adservice.google.com.gi adservice.google.com.gt adservice.google.com.hk adservice.google.com.jm adservice.google.com.kh adservice.google.com.kw adservice.google.com.lb adservice.google.com.mm adservice.google.com.mt adservice.google.com.mx adservice.google.com.my adservice.google.com.ng adservice.google.com.ni adservice.google.com.np adservice.google.com.om adservice.google.com.pa adservice.google.com.pe adservice.google.com.ph adservice.google.com.pk adservice.google.com.pr adservice.google.com.py adservice.google.com.qa adservice.google.com.sa adservice.google.com.sg adservice.google.com.sv adservice.google.com.tr adservice.google.com.tw adservice.google.com.ua adservice.google.com.uy adservice.google.com.vn adservice.google.cz adservice.google.de adservice.google.dk adservice.google.dz adservice.google.ee adservice.google.es adservice.google.fi adservice.google.fr adservice.google.ge adservice.google.gr adservice.google.gy adservice.google.hn adservice.google.hr adservice.google.hu adservice.google.ie adservice.google.im adservice.google.iq adservice.google.is adservice.google.it adservice.google.jo adservice.google.kz adservice.google.li adservice.google.lk adservice.google.lt adservice.google.lu adservice.google.lv adservice.google.md adservice.google.mk adservice.google.mu adservice.google.nl adservice.google.no adservice.google.pl adservice.google.pt adservice.google.ro adservice.google.rs adservice.google.ru adservice.google.se adservice.google.si adservice.google.sk adservice.google.so adservice.google.sr adservice.google.tl adservice.google.tn adservice.google.tt google-analytics.com www.google-analytics.com ssl.google-analytics.com stats.g.doubleclick.net ajax.googleapis.com maps.googleapis.com maps.google.com translate.googleapis.com translate.google.com www.googletagmanager.com googletagmanager.com tagmanager.google.com; style-src 'self' 'unsafe-inline' data: https://s0.wp.com https://widgets.wp.com fonts.googleapis.com 'unsafe-inline' maps.googleapis.com maps.google.com translate.googleapis.com www.googletagmanager.com tagmanager.google.com; img-src 'self' data: https://id.rlcdn.com https://px.ads.linkedin.com https://forms.hsforms.com https://forms-na1.hsforms.com https://segments.company-target.com https://px4.ads.linkedin.com https://track.hubspot.com https://dify.wpengine.com https://pixel.wp.com https://www.linkedin.com https://en.wordpress.com https://static.hsappstatic.net s.w.org ps.w.org ts.w.org secure.gravatar.com www.gravatar.com .googlesyndication.com stats.g.doubleclick.net data: blob: google-analytics.com www.google-analytics.com ssl.google-analytics.com www.google.com .googleapis.com maps.google.com maps.gstatic.com www.gstatic.com .ggpht.com translate.googleapis.com translate.google.com i.ytimg.com www.googletagmanager.com; connect-src 'self' https://forms.hsforms.com https://hubspot-forms-static-embed.s3.amazonaws.com https://cdn.acsbapp.com/ https://api.company-target.com https://js.zi-scripts.com https://api.hubapi.com https://forms.hscollectedforms.net https://tag-logger.demandbase.com https://yoast.com https://my.wpengine.com https://ws.zoominfo.com https://exceptions.hubspot.com https://segments.company-target.com .googlesyndication.com googleads.g.doubleclick.net stats.g.doubleclick.net www.google-analytics.com ampcid.google.com analytics.google.com about: maps.googleapis.com maps.google.com translate.googleapis.com www.googletagmanager.com; font-src 'self' data: https://s0.wp.com data: fonts.gstatic.com fonts.googleapis.com; object-src 'self' ; media-src 'self' ; frame-src 'self' https://static.addtoany.com https://s.company-target.com https://td.doubleclick.net https://www.google.com https://static.hsappstatic.net https://app.hubspot.com https://widgets.wp.com https://forms.hsforms.com *.googlesyndication.com googleads.g.doubleclick.net maps.googleapis.com maps.google.com www.youtube.com www.googletagmanager.com; child-src 'self' www.youtube.com www.googletagmanager.com; worker-src 'self' blob:; upgrade-insecure-requests; block-all-mixed-content; report-uri https://www.tevora.com?gdsih-csp-report;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block; report=https://www.tevora.com?gdsih-xxp-report;

Request headers

Accept: text/html, */*; q=0.01
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
X-Requested-With: XMLHttpRequest
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' data: ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.addtoany.com https://js.hsforms.net https://acsbapp.com https://js.hs-scripts.com https://snap.licdn.com https://tag.demandbase.com https://js.zi-scripts.com https://js.hs-banner.com https://js.hscollectedforms.net https://js.hs-analytics.net https://js.hsadspixel.net/ https://www.google.com https://www.gstatic.com/ https://yoast.com https://stats.wp.com https://widgets.wp.com https://s0.wp.com https://js.hubspot.com www.googletagservices.com *.googlesyndication.com *.googleadservices.com googleads.g.doubleclick.net adservice.google.com adservice.google.ae adservice.google.al adservice.google.at adservice.google.be adservice.google.bg adservice.google.bs adservice.google.ca adservice.google.ch adservice.google.ci adservice.google.cl adservice.google.co.bw adservice.google.co.cr adservice.google.co.id adservice.google.co.il adservice.google.co.in adservice.google.co.jp adservice.google.co.ke adservice.google.co.kr adservice.google.co.mz adservice.google.co.nz adservice.google.co.th adservice.google.co.tz adservice.google.co.uk adservice.google.co.uz adservice.google.co.ve adservice.google.co.za adservice.google.co.zm adservice.google.co.zw adservice.google.com.ai adservice.google.com.ar adservice.google.com.au adservice.google.com.bd adservice.google.com.bh adservice.google.com.bn adservice.google.com.bo adservice.google.com.br adservice.google.com.co adservice.google.com.cy adservice.google.com.ec adservice.google.com.eg adservice.google.com.et adservice.google.com.fj adservice.google.com.gh adservice.google.com.gi adservice.google.com.gt adservice.google.com.hk adservice.google.com.jm adservice.google.com.kh adservice.google.com.kw adservice.google.com.lb adservice.google.com.mm adservice.google.com.mt adservice.google.com.mx adservice.google.com.my adservice.google.com.ng adservice.google.com.ni adservice.google.com.np adservice.google.com.om adservice.google.com.pa adservice.google.com.pe adservice.google.com.ph adservice.google.com.pk adservice.google.com.pr adservice.google.com.py adservice.google.com.qa adservice.google.com.sa adservice.google.com.sg adservice.google.com.sv adservice.google.com.tr adservice.google.com.tw adservice.google.com.ua adservice.google.com.uy adservice.google.com.vn adservice.google.cz adservice.google.de adservice.google.dk adservice.google.dz adservice.google.ee adservice.google.es adservice.google.fi adservice.google.fr adservice.google.ge adservice.google.gr adservice.google.gy adservice.google.hn adservice.google.hr adservice.google.hu adservice.google.ie adservice.google.im adservice.google.iq adservice.google.is adservice.google.it adservice.google.jo adservice.google.kz adservice.google.li adservice.google.lk adservice.google.lt adservice.google.lu adservice.google.lv adservice.google.md adservice.google.mk adservice.google.mu adservice.google.nl adservice.google.no adservice.google.pl adservice.google.pt adservice.google.ro adservice.google.rs adservice.google.ru adservice.google.se adservice.google.si adservice.google.sk adservice.google.so adservice.google.sr adservice.google.tl adservice.google.tn adservice.google.tt google-analytics.com www.google-analytics.com ssl.google-analytics.com stats.g.doubleclick.net ajax.googleapis.com maps.googleapis.com maps.google.com translate.googleapis.com translate.google.com www.googletagmanager.com googletagmanager.com tagmanager.google.com; style-src 'self' 'unsafe-inline' data: https://s0.wp.com https://widgets.wp.com fonts.googleapis.com 'unsafe-inline' maps.googleapis.com maps.google.com translate.googleapis.com www.googletagmanager.com tagmanager.google.com; img-src 'self' data: https://id.rlcdn.com https://px.ads.linkedin.com https://forms.hsforms.com https://forms-na1.hsforms.com https://segments.company-target.com https://px4.ads.linkedin.com https://track.hubspot.com https://dify.wpengine.com https://pixel.wp.com https://www.linkedin.com https://en.wordpress.com https://static.hsappstatic.net s.w.org ps.w.org ts.w.org secure.gravatar.com www.gravatar.com *.googlesyndication.com stats.g.doubleclick.net data: blob: google-analytics.com www.google-analytics.com ssl.google-analytics.com www.google.com *.googleapis.com maps.google.com maps.gstatic.com www.gstatic.com *.ggpht.com translate.googleapis.com translate.google.com i.ytimg.com www.googletagmanager.com; connect-src 'self' https://forms.hsforms.com https://hubspot-forms-static-embed.s3.amazonaws.com https://cdn.acsbapp.com/ https://api.company-target.com https://js.zi-scripts.com https://api.hubapi.com https://forms.hscollectedforms.net https://tag-logger.demandbase.com https://yoast.com https://my.wpengine.com https://ws.zoominfo.com https://exceptions.hubspot.com https://segments.company-target.com *.googlesyndication.com googleads.g.doubleclick.net stats.g.doubleclick.net www.google-analytics.com ampcid.google.com analytics.google.com about: maps.googleapis.com maps.google.com translate.googleapis.com www.googletagmanager.com; font-src 'self' data: https://s0.wp.com data: fonts.gstatic.com fonts.googleapis.com; object-src 'self' ; media-src 'self' ; frame-src 'self' https://static.addtoany.com https://s.company-target.com https://td.doubleclick.net https://www.google.com https://static.hsappstatic.net https://app.hubspot.com https://widgets.wp.com https://forms.hsforms.com *.googlesyndication.com googleads.g.doubleclick.net maps.googleapis.com maps.google.com www.youtube.com www.googletagmanager.com; child-src 'self' www.youtube.com www.googletagmanager.com; worker-src 'self' blob:; upgrade-insecure-requests; block-all-mixed-content; report-uri https://www.tevora.com?gdsih-csp-report;
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
content-encoding: gzip
x-powered-by: WP Engine
content-length: 918
x-xss-protection: 1; mode=block; report=https://www.tevora.com?gdsih-xxp-report;
referrer-policy: strict-origin-when-cross-origin
server: nginx
x-frame-options: SAMEORIGIN
vary: Accept-Encoding
content-type: text/html;charset=UTF-8
access-control-allow-origin: https://www.tevora.com
cache-control: no-cache, must-revalidate, max-age=0
feature-policy: interest-cohort *;
permissions-policy: interest-cohort=(*)
access-control-allow-credentials: true
x-robots-tag: noindex
expires: Wed, 11 Jan 1984 05:00:00 GMT

GET
H2 200 js Show response
www.googletagmanager.com/gtag/ 295 KB
95 KB 78ms
76ms Script
application/javascript 2a00:1450:4001:811::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=G-S8Q6BRR8Y7&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T245DHZ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

7ba57ee8157cb7a61c287134db7b180d2aa2a4d326277aea97dd444ea7c4e600

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
access-control-allow-headers: Cache-Control
content-length: 97646
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
expires: Thu, 08 Feb 2024 20:44:13 GMT

GET
H2 200 analytics.js Show response
www.google-analytics.com/ 52 KB
21 KB 176ms
56ms Script
text/javascript 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/analytics.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T245DHZ

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

strict-transport-security: max-age=10886400; includeSubDomains; preload
content-encoding: gzip
x-content-type-options: nosniff
date: Thu, 08 Feb 2024 19:48:09 GMT
last-modified: Tue, 12 Dec 2023 18:09:08 GMT
server: Golfe2
age: 3364
vary: Accept-Encoding
content-type: text/javascript
cache-control: public, max-age=7200
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 20994
expires: Thu, 08 Feb 2024 21:48:09 GMT

GET
H2 200 insight.min.js Show response
snap.licdn.com/li.lms-analytics/ 43 KB
16 KB 125ms
38ms Script
application/javascript 2a02:26f0:3500:16::215:1496
AKAMAI-ASN1

General

Check archive.org

Show headers Download Go to

Full URL

https://snap.licdn.com/li.lms-analytics/insight.min.js

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T245DHZ

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

2a02:26f0:3500:16::215:1496 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),

Reverse DNS

Software

Resource Hash

b5474d3ed408366dcebededf5c987f44b43b389137272c282c6c972852a14fc0

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
last-modified: Tue, 23 Jan 2024 14:42:29 GMT
x-cdn: AKAM
x-amz-server-side-encryption: AES256
vary: Accept-Encoding
content-type: application/javascript;charset=utf-8
cache-control: max-age=69882
accept-ranges: bytes
content-length: 15732

GET
H2 200 0f0c190e3746d9bc.min.js Show response
tag.demandbase.com/ 74 KB
21 KB 135ms
49ms Script
application/javascript 18.245.46.25
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://tag.demandbase.com/0f0c190e3746d9bc.min.js

Requested by

Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.245.46.25 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-245-46-25.fra56.r.cloudfront.net

Software

AmazonS3 /

Resource Hash

b92f948f2d43b317da896694312f7f62bfdc13b4fe0626fb16606e6760b036a5

Security Headers

Name	Value
Strict-Transport-Security	max-age=63072000; includeSubDomains; preload

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

x-amz-version-id: 9rG7DvfsdK3.dVxeoLgU2siO4Z.r1M4l
content-encoding: gzip
via: 1.1 5335ce80c0b9264bc591cce2c73bef5e.cloudfront.net (CloudFront)
date: Thu, 08 Feb 2024 20:40:28 GMT
strict-transport-security: max-age=63072000; includeSubDomains; preload
x-amz-cf-pop: FRA56-P9
age: 226
x-amz-server-side-encryption: AES256
x-cache: Hit from cloudfront
last-modified: Mon, 11 Dec 2023 18:47:31 GMT
server: AmazonS3
etag: W/"c9aba430dd3a10cec39897d763384312"
vary: Accept-Encoding
content-type: application/javascript; charset=utf-8
cache-control: public, max-age=3600
permissions-policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-amz-cf-id: q0RMOJq9ubrRVGmPdz3rB7lwL_iquw33WDvYfuH7gvnXbaBfeX3wxA==

GET
H3 200 counters.gif
forms.hsforms.com/embed/v3/ 35 B
625 B 206ms
171ms Image
image/gif 2606:4700::6812:b07d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-DEFINITION_SUCCESS&count=1

Requested by

Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:b07d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 03fc06b8-0095-42b0-a59d-436525062b54
x-envoy-upstream-service-time: 1
alt-svc: h3=":443"; ma=86400
content-length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 03fc06b8-0095-42b0-a59d-436525062b54
server: cloudflare
x-trace: 2BEEBC71039CECE3AA31711E6A1DAF47F1307883AC000000000000000000
vary: origin
content-type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-bfd765d7d-kq4w2
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
x-robots-tag: none
cf-ray: 8526b5996abcfbce-WAW

GET
H2 200 enterprise.js Show response
www.google.com/recaptcha/ 1 KB
1 KB 183ms
65ms Script
text/javascript 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/enterprise.js?&onload=hsRecaptchaLoaded_e06e8230_53c9_45ff_8a65_e687338e274a&render=explicit&hl=en

Requested by

Host: js.hsforms.net
URL: https://js.hsforms.net/forms/v2.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

6f1fdb05f39561628f6a4ce26a93bd3273efb57e0b0285b1c4c09cc2885e2a2d

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Thu, 08 Feb 2024 20:44:13 GMT

GET
H/1.1 200
OK counters.gif
forms-na1.hsforms.com/embed/v3/ 35 B
1016 B 261ms
178ms Image
image/gif 2606:4700::6812:c07d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms-na1.hsforms.com/embed/v3/counters.gif?key=forms-embed-v2-RENDER_SUCCESS&count=1

Requested by

Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/

Protocol

HTTP/1.1

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6812:c07d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Date: Thu, 08 Feb 2024 20:44:13 GMT
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
X-Content-Type-Options: nosniff
CF-Cache-Status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
X-HubSpot-Correlation-Id: ca2e694a-e9b1-4f33-8940-2ff40ca7a58a
x-envoy-upstream-service-time: 16
Connection: keep-alive
alt-svc: h3=":443"; ma=86400
Content-Length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: ca2e694a-e9b1-4f33-8940-2ff40ca7a58a
Server: cloudflare
X-Trace: 2B520D55FD30BCA2E8A6C62D39CD2CFDD25AC74C65000000000000000000
Vary: origin
Content-Type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-bfd765d7d-z84xk
Access-Control-Expose-Headers: X-Origin-Hublet
Cache-Control: max-age=0, no-cache, no-store
Access-Control-Allow-Credentials: false
X-Robots-Tag: none
CF-RAY: 8526b599c8391648-WAW

POST
H2 204 /
www.tevora.com/ 0
4 KB 414ms
413ms Other
text/plain 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.tevora.com/?gdsih-csp-report

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-S8Q6BRR8Y7&l=dataLayer&cx=c

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

144.152.190.35.bc.googleusercontent.com

Software

nginx / WP Engine

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' data: ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.addtoany.com https://js.hsforms.net https://acsbapp.com https://js.hs-scripts.com https://snap.licdn.com https://tag.demandbase.com https://js.zi-scripts.com https://js.hs-banner.com https://js.hscollectedforms.net https://js.hs-analytics.net https://js.hsadspixel.net/ https://www.google.com https://www.gstatic.com/ https://yoast.com https://stats.wp.com https://widgets.wp.com https://s0.wp.com https://js.hubspot.com www.googletagservices.com .googlesyndication.com .googleadservices.com googleads.g.doubleclick.net adservice.google.com adservice.google.ae adservice.google.al adservice.google.at adservice.google.be adservice.google.bg adservice.google.bs adservice.google.ca adservice.google.ch adservice.google.ci adservice.google.cl adservice.google.co.bw adservice.google.co.cr adservice.google.co.id adservice.google.co.il adservice.google.co.in adservice.google.co.jp adservice.google.co.ke adservice.google.co.kr adservice.google.co.mz adservice.google.co.nz adservice.google.co.th adservice.google.co.tz adservice.google.co.uk adservice.google.co.uz adservice.google.co.ve adservice.google.co.za adservice.google.co.zm adservice.google.co.zw adservice.google.com.ai adservice.google.com.ar adservice.google.com.au adservice.google.com.bd adservice.google.com.bh adservice.google.com.bn adservice.google.com.bo adservice.google.com.br adservice.google.com.co adservice.google.com.cy adservice.google.com.ec adservice.google.com.eg adservice.google.com.et adservice.google.com.fj adservice.google.com.gh adservice.google.com.gi adservice.google.com.gt adservice.google.com.hk adservice.google.com.jm adservice.google.com.kh adservice.google.com.kw adservice.google.com.lb adservice.google.com.mm adservice.google.com.mt adservice.google.com.mx adservice.google.com.my adservice.google.com.ng adservice.google.com.ni adservice.google.com.np adservice.google.com.om adservice.google.com.pa adservice.google.com.pe adservice.google.com.ph adservice.google.com.pk adservice.google.com.pr adservice.google.com.py adservice.google.com.qa adservice.google.com.sa adservice.google.com.sg adservice.google.com.sv adservice.google.com.tr adservice.google.com.tw adservice.google.com.ua adservice.google.com.uy adservice.google.com.vn adservice.google.cz adservice.google.de adservice.google.dk adservice.google.dz adservice.google.ee adservice.google.es adservice.google.fi adservice.google.fr adservice.google.ge adservice.google.gr adservice.google.gy adservice.google.hn adservice.google.hr adservice.google.hu adservice.google.ie adservice.google.im adservice.google.iq adservice.google.is adservice.google.it adservice.google.jo adservice.google.kz adservice.google.li adservice.google.lk adservice.google.lt adservice.google.lu adservice.google.lv adservice.google.md adservice.google.mk adservice.google.mu adservice.google.nl adservice.google.no adservice.google.pl adservice.google.pt adservice.google.ro adservice.google.rs adservice.google.ru adservice.google.se adservice.google.si adservice.google.sk adservice.google.so adservice.google.sr adservice.google.tl adservice.google.tn adservice.google.tt google-analytics.com www.google-analytics.com ssl.google-analytics.com stats.g.doubleclick.net ajax.googleapis.com maps.googleapis.com maps.google.com translate.googleapis.com translate.google.com www.googletagmanager.com googletagmanager.com tagmanager.google.com; style-src 'self' 'unsafe-inline' data: https://s0.wp.com https://widgets.wp.com fonts.googleapis.com 'unsafe-inline' maps.googleapis.com maps.google.com translate.googleapis.com www.googletagmanager.com tagmanager.google.com; img-src 'self' data: https://id.rlcdn.com https://px.ads.linkedin.com https://forms.hsforms.com https://forms-na1.hsforms.com https://segments.company-target.com https://px4.ads.linkedin.com https://track.hubspot.com https://dify.wpengine.com https://pixel.wp.com https://www.linkedin.com https://en.wordpress.com https://static.hsappstatic.net s.w.org ps.w.org ts.w.org secure.gravatar.com www.gravatar.com .googlesyndication.com stats.g.doubleclick.net data: blob: google-analytics.com www.google-analytics.com ssl.google-analytics.com www.google.com .googleapis.com maps.google.com maps.gstatic.com www.gstatic.com .ggpht.com translate.googleapis.com translate.google.com i.ytimg.com www.googletagmanager.com; connect-src 'self' https://forms.hsforms.com https://hubspot-forms-static-embed.s3.amazonaws.com https://cdn.acsbapp.com/ https://api.company-target.com https://js.zi-scripts.com https://api.hubapi.com https://forms.hscollectedforms.net https://tag-logger.demandbase.com https://yoast.com https://my.wpengine.com https://ws.zoominfo.com https://exceptions.hubspot.com https://segments.company-target.com .googlesyndication.com googleads.g.doubleclick.net stats.g.doubleclick.net www.google-analytics.com ampcid.google.com analytics.google.com about: maps.googleapis.com maps.google.com translate.googleapis.com www.googletagmanager.com; font-src 'self' data: https://s0.wp.com data: fonts.gstatic.com fonts.googleapis.com; object-src 'self' ; media-src 'self' ; frame-src 'self' https://static.addtoany.com https://s.company-target.com https://td.doubleclick.net https://www.google.com https://static.hsappstatic.net https://app.hubspot.com https://widgets.wp.com https://forms.hsforms.com *.googlesyndication.com googleads.g.doubleclick.net maps.googleapis.com maps.google.com www.youtube.com www.googletagmanager.com; child-src 'self' www.youtube.com www.googletagmanager.com; worker-src 'self' blob:; upgrade-insecure-requests; block-all-mixed-content; report-uri https://www.tevora.com?gdsih-csp-report;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block; report=https://www.tevora.com?gdsih-xxp-report;

Request headers

Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' data: ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.addtoany.com https://js.hsforms.net https://acsbapp.com https://js.hs-scripts.com https://snap.licdn.com https://tag.demandbase.com https://js.zi-scripts.com https://js.hs-banner.com https://js.hscollectedforms.net https://js.hs-analytics.net https://js.hsadspixel.net/ https://www.google.com https://www.gstatic.com/ https://yoast.com https://stats.wp.com https://widgets.wp.com https://s0.wp.com https://js.hubspot.com www.googletagservices.com *.googlesyndication.com *.googleadservices.com googleads.g.doubleclick.net adservice.google.com adservice.google.ae adservice.google.al adservice.google.at adservice.google.be adservice.google.bg adservice.google.bs adservice.google.ca adservice.google.ch adservice.google.ci adservice.google.cl adservice.google.co.bw adservice.google.co.cr adservice.google.co.id adservice.google.co.il adservice.google.co.in adservice.google.co.jp adservice.google.co.ke adservice.google.co.kr adservice.google.co.mz adservice.google.co.nz adservice.google.co.th adservice.google.co.tz adservice.google.co.uk adservice.google.co.uz adservice.google.co.ve adservice.google.co.za adservice.google.co.zm adservice.google.co.zw adservice.google.com.ai adservice.google.com.ar adservice.google.com.au adservice.google.com.bd adservice.google.com.bh adservice.google.com.bn adservice.google.com.bo adservice.google.com.br adservice.google.com.co adservice.google.com.cy adservice.google.com.ec adservice.google.com.eg adservice.google.com.et adservice.google.com.fj adservice.google.com.gh adservice.google.com.gi adservice.google.com.gt adservice.google.com.hk adservice.google.com.jm adservice.google.com.kh adservice.google.com.kw adservice.google.com.lb adservice.google.com.mm adservice.google.com.mt adservice.google.com.mx adservice.google.com.my adservice.google.com.ng adservice.google.com.ni adservice.google.com.np adservice.google.com.om adservice.google.com.pa adservice.google.com.pe adservice.google.com.ph adservice.google.com.pk adservice.google.com.pr adservice.google.com.py adservice.google.com.qa adservice.google.com.sa adservice.google.com.sg adservice.google.com.sv adservice.google.com.tr adservice.google.com.tw adservice.google.com.ua adservice.google.com.uy adservice.google.com.vn adservice.google.cz adservice.google.de adservice.google.dk adservice.google.dz adservice.google.ee adservice.google.es adservice.google.fi adservice.google.fr adservice.google.ge adservice.google.gr adservice.google.gy adservice.google.hn adservice.google.hr adservice.google.hu adservice.google.ie adservice.google.im adservice.google.iq adservice.google.is adservice.google.it adservice.google.jo adservice.google.kz adservice.google.li adservice.google.lk adservice.google.lt adservice.google.lu adservice.google.lv adservice.google.md adservice.google.mk adservice.google.mu adservice.google.nl adservice.google.no adservice.google.pl adservice.google.pt adservice.google.ro adservice.google.rs adservice.google.ru adservice.google.se adservice.google.si adservice.google.sk adservice.google.so adservice.google.sr adservice.google.tl adservice.google.tn adservice.google.tt google-analytics.com www.google-analytics.com ssl.google-analytics.com stats.g.doubleclick.net ajax.googleapis.com maps.googleapis.com maps.google.com translate.googleapis.com translate.google.com www.googletagmanager.com googletagmanager.com tagmanager.google.com; style-src 'self' 'unsafe-inline' data: https://s0.wp.com https://widgets.wp.com fonts.googleapis.com 'unsafe-inline' maps.googleapis.com maps.google.com translate.googleapis.com www.googletagmanager.com tagmanager.google.com; img-src 'self' data: https://id.rlcdn.com https://px.ads.linkedin.com https://forms.hsforms.com https://forms-na1.hsforms.com https://segments.company-target.com https://px4.ads.linkedin.com https://track.hubspot.com https://dify.wpengine.com https://pixel.wp.com https://www.linkedin.com https://en.wordpress.com https://static.hsappstatic.net s.w.org ps.w.org ts.w.org secure.gravatar.com www.gravatar.com *.googlesyndication.com stats.g.doubleclick.net data: blob: google-analytics.com www.google-analytics.com ssl.google-analytics.com www.google.com *.googleapis.com maps.google.com maps.gstatic.com www.gstatic.com *.ggpht.com translate.googleapis.com translate.google.com i.ytimg.com www.googletagmanager.com; connect-src 'self' https://forms.hsforms.com https://hubspot-forms-static-embed.s3.amazonaws.com https://cdn.acsbapp.com/ https://api.company-target.com https://js.zi-scripts.com https://api.hubapi.com https://forms.hscollectedforms.net https://tag-logger.demandbase.com https://yoast.com https://my.wpengine.com https://ws.zoominfo.com https://exceptions.hubspot.com https://segments.company-target.com *.googlesyndication.com googleads.g.doubleclick.net stats.g.doubleclick.net www.google-analytics.com ampcid.google.com analytics.google.com about: maps.googleapis.com maps.google.com translate.googleapis.com www.googletagmanager.com; font-src 'self' data: https://s0.wp.com data: fonts.gstatic.com fonts.googleapis.com; object-src 'self' ; media-src 'self' ; frame-src 'self' https://static.addtoany.com https://s.company-target.com https://td.doubleclick.net https://www.google.com https://static.hsappstatic.net https://app.hubspot.com https://widgets.wp.com https://forms.hsforms.com *.googlesyndication.com googleads.g.doubleclick.net maps.googleapis.com maps.google.com www.youtube.com www.googletagmanager.com; child-src 'self' www.youtube.com www.googletagmanager.com; worker-src 'self' blob:; upgrade-insecure-requests; block-all-mixed-content; report-uri https://www.tevora.com?gdsih-csp-report;
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
referrer-policy: same-origin
x-powered-by: WP Engine
x-frame-options: SAMEORIGIN
feature-policy: interest-cohort *;
permissions-policy: interest-cohort=(*)
x-xss-protection: 1; mode=block; report=https://www.tevora.com?gdsih-xxp-report;

POST
H2 204 collect
stats.g.doubleclick.net/g/ 0
253 B 171ms
57ms Ping
text/plain 2a00:1450:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL: https://stats.g.doubleclick.net/g/collect?v=2&tid=G-S8Q6BRR8Y7&cid=1091683361.1707425054&gtm=45je4270v9103278546z89104995285za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l3l1&npa=0
Requested by: Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-S8Q6BRR8Y7&l=dataLayer&cx=c
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2a00:1450:400c:c00::9b Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software: Golfe2 /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Feb 2024 20:44:13 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.tevora.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 /
www.tevora.com/ 0
4 KB 299ms
298ms Other
text/plain 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.tevora.com/?gdsih-csp-report

Requested by

Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

144.152.190.35.bc.googleusercontent.com

Software

nginx / WP Engine

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' data: ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.addtoany.com https://js.hsforms.net https://acsbapp.com https://js.hs-scripts.com https://snap.licdn.com https://tag.demandbase.com https://js.zi-scripts.com https://js.hs-banner.com https://js.hscollectedforms.net https://js.hs-analytics.net https://js.hsadspixel.net/ https://www.google.com https://www.gstatic.com/ https://yoast.com https://stats.wp.com https://widgets.wp.com https://s0.wp.com https://js.hubspot.com www.googletagservices.com .googlesyndication.com .googleadservices.com googleads.g.doubleclick.net adservice.google.com adservice.google.ae adservice.google.al adservice.google.at adservice.google.be adservice.google.bg adservice.google.bs adservice.google.ca adservice.google.ch adservice.google.ci adservice.google.cl adservice.google.co.bw adservice.google.co.cr adservice.google.co.id adservice.google.co.il adservice.google.co.in adservice.google.co.jp adservice.google.co.ke adservice.google.co.kr adservice.google.co.mz adservice.google.co.nz adservice.google.co.th adservice.google.co.tz adservice.google.co.uk adservice.google.co.uz adservice.google.co.ve adservice.google.co.za adservice.google.co.zm adservice.google.co.zw adservice.google.com.ai adservice.google.com.ar adservice.google.com.au adservice.google.com.bd adservice.google.com.bh adservice.google.com.bn adservice.google.com.bo adservice.google.com.br adservice.google.com.co adservice.google.com.cy adservice.google.com.ec adservice.google.com.eg adservice.google.com.et adservice.google.com.fj adservice.google.com.gh adservice.google.com.gi adservice.google.com.gt adservice.google.com.hk adservice.google.com.jm adservice.google.com.kh adservice.google.com.kw adservice.google.com.lb adservice.google.com.mm adservice.google.com.mt adservice.google.com.mx adservice.google.com.my adservice.google.com.ng adservice.google.com.ni adservice.google.com.np adservice.google.com.om adservice.google.com.pa adservice.google.com.pe adservice.google.com.ph adservice.google.com.pk adservice.google.com.pr adservice.google.com.py adservice.google.com.qa adservice.google.com.sa adservice.google.com.sg adservice.google.com.sv adservice.google.com.tr adservice.google.com.tw adservice.google.com.ua adservice.google.com.uy adservice.google.com.vn adservice.google.cz adservice.google.de adservice.google.dk adservice.google.dz adservice.google.ee adservice.google.es adservice.google.fi adservice.google.fr adservice.google.ge adservice.google.gr adservice.google.gy adservice.google.hn adservice.google.hr adservice.google.hu adservice.google.ie adservice.google.im adservice.google.iq adservice.google.is adservice.google.it adservice.google.jo adservice.google.kz adservice.google.li adservice.google.lk adservice.google.lt adservice.google.lu adservice.google.lv adservice.google.md adservice.google.mk adservice.google.mu adservice.google.nl adservice.google.no adservice.google.pl adservice.google.pt adservice.google.ro adservice.google.rs adservice.google.ru adservice.google.se adservice.google.si adservice.google.sk adservice.google.so adservice.google.sr adservice.google.tl adservice.google.tn adservice.google.tt google-analytics.com www.google-analytics.com ssl.google-analytics.com stats.g.doubleclick.net ajax.googleapis.com maps.googleapis.com maps.google.com translate.googleapis.com translate.google.com www.googletagmanager.com googletagmanager.com tagmanager.google.com; style-src 'self' 'unsafe-inline' data: https://s0.wp.com https://widgets.wp.com fonts.googleapis.com 'unsafe-inline' maps.googleapis.com maps.google.com translate.googleapis.com www.googletagmanager.com tagmanager.google.com; img-src 'self' data: https://id.rlcdn.com https://px.ads.linkedin.com https://forms.hsforms.com https://forms-na1.hsforms.com https://segments.company-target.com https://px4.ads.linkedin.com https://track.hubspot.com https://dify.wpengine.com https://pixel.wp.com https://www.linkedin.com https://en.wordpress.com https://static.hsappstatic.net s.w.org ps.w.org ts.w.org secure.gravatar.com www.gravatar.com .googlesyndication.com stats.g.doubleclick.net data: blob: google-analytics.com www.google-analytics.com ssl.google-analytics.com www.google.com .googleapis.com maps.google.com maps.gstatic.com www.gstatic.com .ggpht.com translate.googleapis.com translate.google.com i.ytimg.com www.googletagmanager.com; connect-src 'self' https://forms.hsforms.com https://hubspot-forms-static-embed.s3.amazonaws.com https://cdn.acsbapp.com/ https://api.company-target.com https://js.zi-scripts.com https://api.hubapi.com https://forms.hscollectedforms.net https://tag-logger.demandbase.com https://yoast.com https://my.wpengine.com https://ws.zoominfo.com https://exceptions.hubspot.com https://segments.company-target.com .googlesyndication.com googleads.g.doubleclick.net stats.g.doubleclick.net www.google-analytics.com ampcid.google.com analytics.google.com about: maps.googleapis.com maps.google.com translate.googleapis.com www.googletagmanager.com; font-src 'self' data: https://s0.wp.com data: fonts.gstatic.com fonts.googleapis.com; object-src 'self' ; media-src 'self' ; frame-src 'self' https://static.addtoany.com https://s.company-target.com https://td.doubleclick.net https://www.google.com https://static.hsappstatic.net https://app.hubspot.com https://widgets.wp.com https://forms.hsforms.com *.googlesyndication.com googleads.g.doubleclick.net maps.googleapis.com maps.google.com www.youtube.com www.googletagmanager.com; child-src 'self' www.youtube.com www.googletagmanager.com; worker-src 'self' blob:; upgrade-insecure-requests; block-all-mixed-content; report-uri https://www.tevora.com?gdsih-csp-report;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block; report=https://www.tevora.com?gdsih-xxp-report;

Request headers

Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' data: ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.addtoany.com https://js.hsforms.net https://acsbapp.com https://js.hs-scripts.com https://snap.licdn.com https://tag.demandbase.com https://js.zi-scripts.com https://js.hs-banner.com https://js.hscollectedforms.net https://js.hs-analytics.net https://js.hsadspixel.net/ https://www.google.com https://www.gstatic.com/ https://yoast.com https://stats.wp.com https://widgets.wp.com https://s0.wp.com https://js.hubspot.com www.googletagservices.com *.googlesyndication.com *.googleadservices.com googleads.g.doubleclick.net adservice.google.com adservice.google.ae adservice.google.al adservice.google.at adservice.google.be adservice.google.bg adservice.google.bs adservice.google.ca adservice.google.ch adservice.google.ci adservice.google.cl adservice.google.co.bw adservice.google.co.cr adservice.google.co.id adservice.google.co.il adservice.google.co.in adservice.google.co.jp adservice.google.co.ke adservice.google.co.kr adservice.google.co.mz adservice.google.co.nz adservice.google.co.th adservice.google.co.tz adservice.google.co.uk adservice.google.co.uz adservice.google.co.ve adservice.google.co.za adservice.google.co.zm adservice.google.co.zw adservice.google.com.ai adservice.google.com.ar adservice.google.com.au adservice.google.com.bd adservice.google.com.bh adservice.google.com.bn adservice.google.com.bo adservice.google.com.br adservice.google.com.co adservice.google.com.cy adservice.google.com.ec adservice.google.com.eg adservice.google.com.et adservice.google.com.fj adservice.google.com.gh adservice.google.com.gi adservice.google.com.gt adservice.google.com.hk adservice.google.com.jm adservice.google.com.kh adservice.google.com.kw adservice.google.com.lb adservice.google.com.mm adservice.google.com.mt adservice.google.com.mx adservice.google.com.my adservice.google.com.ng adservice.google.com.ni adservice.google.com.np adservice.google.com.om adservice.google.com.pa adservice.google.com.pe adservice.google.com.ph adservice.google.com.pk adservice.google.com.pr adservice.google.com.py adservice.google.com.qa adservice.google.com.sa adservice.google.com.sg adservice.google.com.sv adservice.google.com.tr adservice.google.com.tw adservice.google.com.ua adservice.google.com.uy adservice.google.com.vn adservice.google.cz adservice.google.de adservice.google.dk adservice.google.dz adservice.google.ee adservice.google.es adservice.google.fi adservice.google.fr adservice.google.ge adservice.google.gr adservice.google.gy adservice.google.hn adservice.google.hr adservice.google.hu adservice.google.ie adservice.google.im adservice.google.iq adservice.google.is adservice.google.it adservice.google.jo adservice.google.kz adservice.google.li adservice.google.lk adservice.google.lt adservice.google.lu adservice.google.lv adservice.google.md adservice.google.mk adservice.google.mu adservice.google.nl adservice.google.no adservice.google.pl adservice.google.pt adservice.google.ro adservice.google.rs adservice.google.ru adservice.google.se adservice.google.si adservice.google.sk adservice.google.so adservice.google.sr adservice.google.tl adservice.google.tn adservice.google.tt google-analytics.com www.google-analytics.com ssl.google-analytics.com stats.g.doubleclick.net ajax.googleapis.com maps.googleapis.com maps.google.com translate.googleapis.com translate.google.com www.googletagmanager.com googletagmanager.com tagmanager.google.com; style-src 'self' 'unsafe-inline' data: https://s0.wp.com https://widgets.wp.com fonts.googleapis.com 'unsafe-inline' maps.googleapis.com maps.google.com translate.googleapis.com www.googletagmanager.com tagmanager.google.com; img-src 'self' data: https://id.rlcdn.com https://px.ads.linkedin.com https://forms.hsforms.com https://forms-na1.hsforms.com https://segments.company-target.com https://px4.ads.linkedin.com https://track.hubspot.com https://dify.wpengine.com https://pixel.wp.com https://www.linkedin.com https://en.wordpress.com https://static.hsappstatic.net s.w.org ps.w.org ts.w.org secure.gravatar.com www.gravatar.com *.googlesyndication.com stats.g.doubleclick.net data: blob: google-analytics.com www.google-analytics.com ssl.google-analytics.com www.google.com *.googleapis.com maps.google.com maps.gstatic.com www.gstatic.com *.ggpht.com translate.googleapis.com translate.google.com i.ytimg.com www.googletagmanager.com; connect-src 'self' https://forms.hsforms.com https://hubspot-forms-static-embed.s3.amazonaws.com https://cdn.acsbapp.com/ https://api.company-target.com https://js.zi-scripts.com https://api.hubapi.com https://forms.hscollectedforms.net https://tag-logger.demandbase.com https://yoast.com https://my.wpengine.com https://ws.zoominfo.com https://exceptions.hubspot.com https://segments.company-target.com *.googlesyndication.com googleads.g.doubleclick.net stats.g.doubleclick.net www.google-analytics.com ampcid.google.com analytics.google.com about: maps.googleapis.com maps.google.com translate.googleapis.com www.googletagmanager.com; font-src 'self' data: https://s0.wp.com data: fonts.gstatic.com fonts.googleapis.com; object-src 'self' ; media-src 'self' ; frame-src 'self' https://static.addtoany.com https://s.company-target.com https://td.doubleclick.net https://www.google.com https://static.hsappstatic.net https://app.hubspot.com https://widgets.wp.com https://forms.hsforms.com *.googlesyndication.com googleads.g.doubleclick.net maps.googleapis.com maps.google.com www.youtube.com www.googletagmanager.com; child-src 'self' www.youtube.com www.googletagmanager.com; worker-src 'self' blob:; upgrade-insecure-requests; block-all-mixed-content; report-uri https://www.tevora.com?gdsih-csp-report;
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
referrer-policy: same-origin
x-powered-by: WP Engine
x-frame-options: SAMEORIGIN
feature-policy: interest-cohort *;
permissions-policy: interest-cohort=(*)
x-xss-protection: 1; mode=block; report=https://www.tevora.com?gdsih-xxp-report;

GET ga-audiences
www.google.de/ads/ 0
0

GET
H2 200 config.json Show response
cdn.acsbapp.com/config/tevora.com/ 163 B
707 B 268ms
212ms Fetch
application/json 2606:4700:10::6816:1cc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://cdn.acsbapp.com/config/tevora.com/config.json
Requested by: Host: acsbapp.com
URL: https://acsbapp.com/apps/app/dist/js/app.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 2606:4700:10::6816:1cc , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: 7778f96a9e00a7916499bc8d4dc59f288f27701ea6c1e384631d45b66fe42848

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
content-encoding: br
cf-cache-status: REVALIDATED
x-guploader-uploadid: ABPtcPrWLQm3JMA8shG-XaLhvTvJi7ek576r10YNWFJNxcIWi79wFVBNREUmnroBdPtVLzfxR4S2S-0sQA
x-goog-storage-class: STANDARD
x-goog-metageneration: 2
x-goog-stored-content-encoding: identity
last-modified: Wed, 08 Feb 2023 14:04:05 GMT
server: cloudflare
etag: W/"1ad7b1f64b787d8c7c63b80916a69d21"
vary: Accept-Encoding
x-goog-hash: crc32c=wr/BGA==, md5=Gtex9kt4fYx8Y7gJFqadIQ==
x-goog-generation: 1675865045909650
content-type: application/json
access-control-allow-origin: *
access-control-expose-headers: *, Content-Length, Date, Server, Transfer-Encoding, X-GUploader-UploadID, X-Google-Trace
cache-control: public, max-age=300, must-revalidate
x-goog-stored-content-length: 163
cf-ray: 8526b59a187e6dee-CPH
expires: Fri, 07 Feb 2025 20:44:13 GMT

GET
H2

200

collect
px4.ads.linkedin.com/
Redirect Chain

https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=1416369&time=1707425053718&url=https%3A%2F%2Fwww.tevora.com%2Fthreat-blog%2Ftargeting-msol-accounts-to-compromise-internal-networks%2F
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1416369&time=1707425053718&url=https%3A%2F%2Fwww.tevora.com%2Fthreat-blog%2Ftargeting-msol-accounts-to-compromise-internal-networks%2F&e_ipv6=AQK...

0
265 B

217ms
131ms

Image
application/javascript

13.107.42.14
MICROSOFT-CORP-MS...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1416369&time=1707425053718&url=https%3A%2F%2Fwww.tevora.com%2Fthreat-blog%2Ftargeting-msol-accounts-to-compromise-internal-networks%2F&e_ipv6=AQKdQVfDVo8jUAAAAY2KdryTjcJ3MA1yUqF8hhGQgKwkTq7Zi0NpYUAweW0F4xMhcfAyAeun
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Server: 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:14 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 25152E8A17AC4DF8950A4FE877317AAF Ref B: CPH30EDGE0707 Ref C: 2024-02-08T20:44:14Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
content-type: application/javascript
x-li-fabric: prod-lva1
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYQ5N/T1wDoQd8cs1WN4Q==

Redirect headers

date: Thu, 08 Feb 2024 20:44:13 GMT
x-li-pop: afd-prod-lva1-x
x-msedge-ref: Ref A: 6F3CA08998964B65A2DCF49A32DE2762 Ref B: CPH30EDGE0717 Ref C: 2024-02-08T20:44:13Z
linkedin-action: 1
x-cache: CONFIG_NOCACHE
x-li-fabric: prod-lva1
location: https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=1416369&time=1707425053718&url=https%3A%2F%2Fwww.tevora.com%2Fthreat-blog%2Ftargeting-msol-accounts-to-compromise-internal-networks%2F&e_ipv6=AQKdQVfDVo8jUAAAAY2KdryTjcJ3MA1yUqF8hhGQgKwkTq7Zi0NpYUAweW0F4xMhcfAyAeun
x-li-proto: http/2
content-length: 0
x-li-uuid: AAYQ5N/QiYb6xgnhcDyPdg==

GET
H2 200 sync Show response
s.company-target.com/s/ Frame 930E 634 B
968 B 213ms
133ms Document
text/html 34.96.71.22
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL: https://s.company-target.com/s/sync?exc=lr
Requested by: Host: tag.demandbase.com
URL: https://tag.demandbase.com/0f0c190e3746d9bc.min.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 34.96.71.22 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 22.71.96.34.bc.googleusercontent.com
Software: /
Resource Hash: 19aa17672f5a6ebc71e52740ad6599892e2cb42fd76ee730f1d3f07d332c5c3e

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

access-control-allow-methods: GET,OPTIONS
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 634
content-type: text/html; charset=UTF-8
date: Thu, 08 Feb 2024 20:44:13 GMT
via: 1.1 google

GET
H2 451 464526.gif
id.rlcdn.com/ 0
98 B 109ms
37ms Image
text/plain 35.244.174.68
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://id.rlcdn.com/464526.gif
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 35.244.174.68 Kansas City, United States, ASN15169 (GOOGLE, US),
Reverse DNS: 68.174.244.35.bc.googleusercontent.com
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 0

POST
H2 401 ip.json Show response
api.company-target.com/api/v2/ 12 B
510 B 157ms
79ms XHR
text/plain 18.66.97.20
AMAZON-02

General

Check archive.org

Show headers Download Go to

Full URL

https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fwww.tevora.com%2Fthreat-blog%2Ftargeting-msol-accounts-to-compromise-internal-networks%2F&page_title=Targeting%20MSOL%20Accounts%20to%20Compromise%20Internal%20Networks%20Tevora

Requested by

Host: tag.demandbase.com
URL: https://tag.demandbase.com/0f0c190e3746d9bc.min.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

18.66.97.20 , United States, ASN16509 (AMAZON-02, US),

Reverse DNS

server-18-66-97-20.fra56.r.cloudfront.net

Software

nginx /

Resource Hash

d089c8a9fc28e4e50223eb38c9409e362521be9380a37341304fbac7a4cd9e5f

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: text/plain;charset=UTF-8

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
via: 1.1 985c0b2ec44bdebc7f24f26d1e427d30.cloudfront.net (CloudFront)
www-authenticate: DemandBase API v2
x-content-type-options: nosniff
x-amz-cf-pop: FRA56-P2
x-cache: Error from cloudfront
request-id: 6cd4a47b-c984-4e81-a5f5-9f416197ef6b
content-length: 12
server: nginx
access-control-max-age: 7200
access-control-allow-methods: GET, POST, OPTIONS
content-type: text/plain;charset=utf-8
access-control-allow-origin: https://www.tevora.com
access-control-expose-headers
vary: Origin
access-control-allow-credentials: true
x-amz-cf-id: ukVoPfEkKbxd3875HX2_ldquSKOGuoVy6hohreOfgM7xGXd2Nh-TCQ==

POST
H2 200 collect Show response
www.google-analytics.com/j/ 4 B
208 B 63ms
63ms XHR
text/plain 2a00:1450:4001:829::200e
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google-analytics.com/j/collect?v=1&_v=j101&a=1748679910&t=pageview&_s=1&dl=https%3A%2F%2Fwww.tevora.com%2Fthreat-blog%2Ftargeting-msol-accounts-to-compromise-internal-networks%2F&ul=en-us&de=UTF-8&dt=Targeting%20MSOL%20Accounts%20to%20Compromise%20Internal%20Networks%20Tevora&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=YADAAEABAAAAACAAI~&jid=1904680482&gjid=1066924364&cid=1091683361.1707425054&tid=UA-16460355-1&_gid=108238700.1707425054&_r=1&_slc=1&gtm=45He4270n81T245DHZv9104995285za200&gcd=13l3l3l3l1&dma_cps=sypham&dma=1&z=1625157795

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:829::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
date: Thu, 08 Feb 2024 20:44:13 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.tevora.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 json Show response
forms.hscollectedforms.net/collected-forms/v1/config/ 115 B
430 B 169ms
155ms XHR
application/json 2606:4700::6811:589a
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://forms.hscollectedforms.net/collected-forms/v1/config/json?portalId=7013481&utk=

Requested by

Host: js.hscollectedforms.net
URL: https://js.hscollectedforms.net/collectedforms.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:589a , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

d275b3cdd830f9c022c8a16779b9ee242515cd6b14ac8d7e266bc9fa0d4b7a7a

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: application/json, text/plain, */*
Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:13 GMT
content-encoding: br
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 5829260d-5695-411b-b91f-ad94ae548165
x-envoy-upstream-service-time: 2
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 5829260d-5695-411b-b91f-ad94ae548165
server: cloudflare
vary: Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.tevora.com
x-evy-trace-virtual-host: all
cache-control: max-age=0
x-evy-trace-served-by-pod: iad02/app-td/envoy-proxy-748b697-xb229
access-control-max-age: 180
x-robots-tag: none
access-control-allow-headers: *
cf-ray: 8526b59a6cadbf71-WAW

GET
H2 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/ 490 KB
195 KB 174ms
56ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/enterprise.js?&onload=hsRecaptchaLoaded_e06e8230_53c9_45ff_8a65_e687338e274a&render=explicit&hl=en

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5aa02ad9ec4550065de8002ea1108be5d10bbb1173d2f3447f88ce1af317d4bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer
Origin: https://www.tevora.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 18:04:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9601
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 199529
x-xss-protection: 0
last-modified: Mon, 05 Feb 2024 05:00:25 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 07 Feb 2025 18:04:12 GMT

GET
H2 200 json Show response
api.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/ 116 B
1 KB 261ms
181ms XHR
application/json 2606:4700::6811:cccc
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://api.hubapi.com/hs-script-loader-public/v1/config/pixels-and-events/json?portalId=7013481

Requested by

Host: js.hsadspixel.net
URL: https://js.hsadspixel.net/fb.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6811:cccc , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

efe93e12c81a6b8187b2c1c88f4225635c28101d87ad79caef6602b7b39b9034

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 2611f646-d61a-4753-804c-a350aca299b5
content-encoding: br
x-envoy-upstream-service-time: 13
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 2611f646-d61a-4753-804c-a350aca299b5
server: cloudflare
x-trace: 2B314725421481C809FF5B7B37261A7A15BCB5ADDE000000000000000000
vary: origin, Accept-Encoding
access-control-allow-methods: GET, OPTIONS, PUT, POST, DELETE, PATCH, HEAD
content-type: application/json;charset=utf-8
access-control-allow-origin: https://www.tevora.com
x-evy-trace-served-by-pod: iad02/hubapi-td/envoy-proxy-f7f4ffb8f-czz5r
access-control-max-age: 180
access-control-allow-credentials: false
x-evy-trace-virtual-host: all
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XW7jaRyvjovJbFbGP6RPVGczVl%2BXJk6TBPpSwU34fXXqRpqxb8tqUBiKET8x17rh2zS7wkc71d97N3yPCUF%2FbZERB0%2FUCuFNQ%2FUyyJwPR%2FdMSlzBTve8LlwEabapRwBwDdc%2BbVtpnxMy5kKm"}],"group":"cf-nel","max_age":604800}
cf-ray: 8526b59ae832353c-WAW
access-control-allow-headers: *

POST
H2 200 collect Show response
stats.g.doubleclick.net/j/ 4 B
151 B 57ms
57ms XHR
text/plain 2a00:1450:400c:c00::9b
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j101&tid=UA-16460355-1&cid=1091683361.1707425054&jid=1904680482&gjid=1066924364&_gid=108238700.1707425054&_u=YADAAEAAAAAAACAAI~&z=361824951

Requested by

Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:400c:c00::9b Brussels, Belgium, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Golfe2 /

Resource Hash

84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80

Security Headers

Name	Value
Strict-Transport-Security	max-age=10886400; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

Referer
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: text/plain

Response headers

pragma: no-cache
strict-transport-security: max-age=10886400; includeSubDomains; preload
date: Thu, 08 Feb 2024 20:44:13 GMT
x-content-type-options: nosniff
last-modified: Sun, 17 May 1998 03:00:00 GMT
server: Golfe2
content-type: text/plain
access-control-allow-origin: https://www.tevora.com
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 4
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H2 200 ga-audiences
www.google.com/ads/ 42 B
296 B 81ms
81ms Image
image/gif 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-16460355-1&cid=1091683361.1707425054&jid=1904680482&_u=YADAAEAAAAAAACAAI~&z=488825966

Requested by

Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Feb 2024 20:44:13 GMT
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 /
www.tevora.com/ 0
4 KB 352ms
351ms Other
text/plain 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.tevora.com/?gdsih-csp-report

Requested by

Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

144.152.190.35.bc.googleusercontent.com

Software

nginx / WP Engine

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' data: ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.addtoany.com https://js.hsforms.net https://acsbapp.com https://js.hs-scripts.com https://snap.licdn.com https://tag.demandbase.com https://js.zi-scripts.com https://js.hs-banner.com https://js.hscollectedforms.net https://js.hs-analytics.net https://js.hsadspixel.net/ https://www.google.com https://www.gstatic.com/ https://yoast.com https://stats.wp.com https://widgets.wp.com https://s0.wp.com https://js.hubspot.com www.googletagservices.com .googlesyndication.com .googleadservices.com googleads.g.doubleclick.net adservice.google.com adservice.google.ae adservice.google.al adservice.google.at adservice.google.be adservice.google.bg adservice.google.bs adservice.google.ca adservice.google.ch adservice.google.ci adservice.google.cl adservice.google.co.bw adservice.google.co.cr adservice.google.co.id adservice.google.co.il adservice.google.co.in adservice.google.co.jp adservice.google.co.ke adservice.google.co.kr adservice.google.co.mz adservice.google.co.nz adservice.google.co.th adservice.google.co.tz adservice.google.co.uk adservice.google.co.uz adservice.google.co.ve adservice.google.co.za adservice.google.co.zm adservice.google.co.zw adservice.google.com.ai adservice.google.com.ar adservice.google.com.au adservice.google.com.bd adservice.google.com.bh adservice.google.com.bn adservice.google.com.bo adservice.google.com.br adservice.google.com.co adservice.google.com.cy adservice.google.com.ec adservice.google.com.eg adservice.google.com.et adservice.google.com.fj adservice.google.com.gh adservice.google.com.gi adservice.google.com.gt adservice.google.com.hk adservice.google.com.jm adservice.google.com.kh adservice.google.com.kw adservice.google.com.lb adservice.google.com.mm adservice.google.com.mt adservice.google.com.mx adservice.google.com.my adservice.google.com.ng adservice.google.com.ni adservice.google.com.np adservice.google.com.om adservice.google.com.pa adservice.google.com.pe adservice.google.com.ph adservice.google.com.pk adservice.google.com.pr adservice.google.com.py adservice.google.com.qa adservice.google.com.sa adservice.google.com.sg adservice.google.com.sv adservice.google.com.tr adservice.google.com.tw adservice.google.com.ua adservice.google.com.uy adservice.google.com.vn adservice.google.cz adservice.google.de adservice.google.dk adservice.google.dz adservice.google.ee adservice.google.es adservice.google.fi adservice.google.fr adservice.google.ge adservice.google.gr adservice.google.gy adservice.google.hn adservice.google.hr adservice.google.hu adservice.google.ie adservice.google.im adservice.google.iq adservice.google.is adservice.google.it adservice.google.jo adservice.google.kz adservice.google.li adservice.google.lk adservice.google.lt adservice.google.lu adservice.google.lv adservice.google.md adservice.google.mk adservice.google.mu adservice.google.nl adservice.google.no adservice.google.pl adservice.google.pt adservice.google.ro adservice.google.rs adservice.google.ru adservice.google.se adservice.google.si adservice.google.sk adservice.google.so adservice.google.sr adservice.google.tl adservice.google.tn adservice.google.tt google-analytics.com www.google-analytics.com ssl.google-analytics.com stats.g.doubleclick.net ajax.googleapis.com maps.googleapis.com maps.google.com translate.googleapis.com translate.google.com www.googletagmanager.com googletagmanager.com tagmanager.google.com; style-src 'self' 'unsafe-inline' data: https://s0.wp.com https://widgets.wp.com fonts.googleapis.com 'unsafe-inline' maps.googleapis.com maps.google.com translate.googleapis.com www.googletagmanager.com tagmanager.google.com; img-src 'self' data: https://id.rlcdn.com https://px.ads.linkedin.com https://forms.hsforms.com https://forms-na1.hsforms.com https://segments.company-target.com https://px4.ads.linkedin.com https://track.hubspot.com https://dify.wpengine.com https://pixel.wp.com https://www.linkedin.com https://en.wordpress.com https://static.hsappstatic.net s.w.org ps.w.org ts.w.org secure.gravatar.com www.gravatar.com .googlesyndication.com stats.g.doubleclick.net data: blob: google-analytics.com www.google-analytics.com ssl.google-analytics.com www.google.com .googleapis.com maps.google.com maps.gstatic.com www.gstatic.com .ggpht.com translate.googleapis.com translate.google.com i.ytimg.com www.googletagmanager.com; connect-src 'self' https://forms.hsforms.com https://hubspot-forms-static-embed.s3.amazonaws.com https://cdn.acsbapp.com/ https://api.company-target.com https://js.zi-scripts.com https://api.hubapi.com https://forms.hscollectedforms.net https://tag-logger.demandbase.com https://yoast.com https://my.wpengine.com https://ws.zoominfo.com https://exceptions.hubspot.com https://segments.company-target.com .googlesyndication.com googleads.g.doubleclick.net stats.g.doubleclick.net www.google-analytics.com ampcid.google.com analytics.google.com about: maps.googleapis.com maps.google.com translate.googleapis.com www.googletagmanager.com; font-src 'self' data: https://s0.wp.com data: fonts.gstatic.com fonts.googleapis.com; object-src 'self' ; media-src 'self' ; frame-src 'self' https://static.addtoany.com https://s.company-target.com https://td.doubleclick.net https://www.google.com https://static.hsappstatic.net https://app.hubspot.com https://widgets.wp.com https://forms.hsforms.com *.googlesyndication.com googleads.g.doubleclick.net maps.googleapis.com maps.google.com www.youtube.com www.googletagmanager.com; child-src 'self' www.youtube.com www.googletagmanager.com; worker-src 'self' blob:; upgrade-insecure-requests; block-all-mixed-content; report-uri https://www.tevora.com?gdsih-csp-report;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block; report=https://www.tevora.com?gdsih-xxp-report;

Request headers

Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Thu, 08 Feb 2024 20:44:14 GMT
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' data: ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.addtoany.com https://js.hsforms.net https://acsbapp.com https://js.hs-scripts.com https://snap.licdn.com https://tag.demandbase.com https://js.zi-scripts.com https://js.hs-banner.com https://js.hscollectedforms.net https://js.hs-analytics.net https://js.hsadspixel.net/ https://www.google.com https://www.gstatic.com/ https://yoast.com https://stats.wp.com https://widgets.wp.com https://s0.wp.com https://js.hubspot.com www.googletagservices.com *.googlesyndication.com *.googleadservices.com googleads.g.doubleclick.net adservice.google.com adservice.google.ae adservice.google.al adservice.google.at adservice.google.be adservice.google.bg adservice.google.bs adservice.google.ca adservice.google.ch adservice.google.ci adservice.google.cl adservice.google.co.bw adservice.google.co.cr adservice.google.co.id adservice.google.co.il adservice.google.co.in adservice.google.co.jp adservice.google.co.ke adservice.google.co.kr adservice.google.co.mz adservice.google.co.nz adservice.google.co.th adservice.google.co.tz adservice.google.co.uk adservice.google.co.uz adservice.google.co.ve adservice.google.co.za adservice.google.co.zm adservice.google.co.zw adservice.google.com.ai adservice.google.com.ar adservice.google.com.au adservice.google.com.bd adservice.google.com.bh adservice.google.com.bn adservice.google.com.bo adservice.google.com.br adservice.google.com.co adservice.google.com.cy adservice.google.com.ec adservice.google.com.eg adservice.google.com.et adservice.google.com.fj adservice.google.com.gh adservice.google.com.gi adservice.google.com.gt adservice.google.com.hk adservice.google.com.jm adservice.google.com.kh adservice.google.com.kw adservice.google.com.lb adservice.google.com.mm adservice.google.com.mt adservice.google.com.mx adservice.google.com.my adservice.google.com.ng adservice.google.com.ni adservice.google.com.np adservice.google.com.om adservice.google.com.pa adservice.google.com.pe adservice.google.com.ph adservice.google.com.pk adservice.google.com.pr adservice.google.com.py adservice.google.com.qa adservice.google.com.sa adservice.google.com.sg adservice.google.com.sv adservice.google.com.tr adservice.google.com.tw adservice.google.com.ua adservice.google.com.uy adservice.google.com.vn adservice.google.cz adservice.google.de adservice.google.dk adservice.google.dz adservice.google.ee adservice.google.es adservice.google.fi adservice.google.fr adservice.google.ge adservice.google.gr adservice.google.gy adservice.google.hn adservice.google.hr adservice.google.hu adservice.google.ie adservice.google.im adservice.google.iq adservice.google.is adservice.google.it adservice.google.jo adservice.google.kz adservice.google.li adservice.google.lk adservice.google.lt adservice.google.lu adservice.google.lv adservice.google.md adservice.google.mk adservice.google.mu adservice.google.nl adservice.google.no adservice.google.pl adservice.google.pt adservice.google.ro adservice.google.rs adservice.google.ru adservice.google.se adservice.google.si adservice.google.sk adservice.google.so adservice.google.sr adservice.google.tl adservice.google.tn adservice.google.tt google-analytics.com www.google-analytics.com ssl.google-analytics.com stats.g.doubleclick.net ajax.googleapis.com maps.googleapis.com maps.google.com translate.googleapis.com translate.google.com www.googletagmanager.com googletagmanager.com tagmanager.google.com; style-src 'self' 'unsafe-inline' data: https://s0.wp.com https://widgets.wp.com fonts.googleapis.com 'unsafe-inline' maps.googleapis.com maps.google.com translate.googleapis.com www.googletagmanager.com tagmanager.google.com; img-src 'self' data: https://id.rlcdn.com https://px.ads.linkedin.com https://forms.hsforms.com https://forms-na1.hsforms.com https://segments.company-target.com https://px4.ads.linkedin.com https://track.hubspot.com https://dify.wpengine.com https://pixel.wp.com https://www.linkedin.com https://en.wordpress.com https://static.hsappstatic.net s.w.org ps.w.org ts.w.org secure.gravatar.com www.gravatar.com *.googlesyndication.com stats.g.doubleclick.net data: blob: google-analytics.com www.google-analytics.com ssl.google-analytics.com www.google.com *.googleapis.com maps.google.com maps.gstatic.com www.gstatic.com *.ggpht.com translate.googleapis.com translate.google.com i.ytimg.com www.googletagmanager.com; connect-src 'self' https://forms.hsforms.com https://hubspot-forms-static-embed.s3.amazonaws.com https://cdn.acsbapp.com/ https://api.company-target.com https://js.zi-scripts.com https://api.hubapi.com https://forms.hscollectedforms.net https://tag-logger.demandbase.com https://yoast.com https://my.wpengine.com https://ws.zoominfo.com https://exceptions.hubspot.com https://segments.company-target.com *.googlesyndication.com googleads.g.doubleclick.net stats.g.doubleclick.net www.google-analytics.com ampcid.google.com analytics.google.com about: maps.googleapis.com maps.google.com translate.googleapis.com www.googletagmanager.com; font-src 'self' data: https://s0.wp.com data: fonts.gstatic.com fonts.googleapis.com; object-src 'self' ; media-src 'self' ; frame-src 'self' https://static.addtoany.com https://s.company-target.com https://td.doubleclick.net https://www.google.com https://static.hsappstatic.net https://app.hubspot.com https://widgets.wp.com https://forms.hsforms.com *.googlesyndication.com googleads.g.doubleclick.net maps.googleapis.com maps.google.com www.youtube.com www.googletagmanager.com; child-src 'self' www.youtube.com www.googletagmanager.com; worker-src 'self' blob:; upgrade-insecure-requests; block-all-mixed-content; report-uri https://www.tevora.com?gdsih-csp-report;
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
referrer-policy: same-origin
x-powered-by: WP Engine
x-frame-options: SAMEORIGIN
feature-policy: interest-cohort *;
permissions-policy: interest-cohort=(*)
x-xss-protection: 1; mode=block; report=https://www.tevora.com?gdsih-xxp-report;

GET ga-audiences
www.google.de/ads/ 0
0

GET
H2

200

rum
dsum-sec.casalemedia.com/ Frame 930E
Redirect Chain

https://dsum-sec.casalemedia.com/rum?cm_dsp_id=18&expiry=1723149853&external_user_id=a7647831-6a50-4189-97e7-556790972f4e
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=18&expiry=1723149853&external_user_id=a7647831-6a50-4189-97e7-556790972f4e&C=1

43 B
339 B

74ms
74ms

Image
image/gif

104.18.36.155
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://dsum-sec.casalemedia.com/rum?cm_dsp_id=18&expiry=1723149853&external_user_id=a7647831-6a50-4189-97e7-556790972f4e&C=1
Requested by: Host: s.company-target.com
URL: https://s.company-target.com/s/sync?exc=lr
Protocol: H2
Server: 104.18.36.155 -, , ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Feb 2024 20:44:14 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=R23g3zw%2BdkX6HP8froEo%2BkFBFODmmbtKib6AHxZQl7IRfX%2FeuIjCALzHPUVnRbNZeicyhAYOuN8g5Qucdlop5movt8biIBevkIXgY4MM6uTkpTVCDBp8OXnAwaD1IYEfxUpM1ZgoEtOP%2Bg%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
content-type: image/gif
cache-control: no-cache
cf-ray: 8526b59bdfb944f8-TXL
alt-svc: h3=":443"; ma=86400
content-length: 43
expires: 0

Redirect headers

pragma: no-cache
date: Thu, 08 Feb 2024 20:44:14 GMT
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
server: cloudflare
vary: Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9f4cGSxcauUYF4WrYfZirDJNE6nAHj9rlg9l1m6pt7gG1VVgaCz100SPWfqn9qv0ojq1wN2F1d7ug%2FkRsgF0wIKqLNYAOg7RwcmtdqJyxYS%2FaygyA5CKSsKLjYE%2Ba%2Fvpfu7RfyH5MTOaSA%3D%3D"}],"group":"cf-nel","max_age":604800}
p3p: policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
location: /rum?cm_dsp_id=18&expiry=1723149853&external_user_id=a7647831-6a50-4189-97e7-556790972f4e&C=1
cache-control: no-cache
cf-ray: 8526b59b7f0a44f8-TXL
alt-svc: h3=":443"; ma=86400
content-length: 0
expires: 0

GET
H2 200 sync
partners.tremorhub.com/ Frame 930E 43 B
393 B 372ms
119ms Image
image/gif 2600:1f18:612b:4216:4246:5d9e:b167:57c0
AMAZON-AES

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://partners.tremorhub.com/sync?UIDM=a7647831-6a50-4189-97e7-556790972f4e
Requested by: Host: s.company-target.com
URL: https://s.company-target.com/s/sync?exc=lr
Protocol: H2
Security: TLS 1.2, ECDHE_RSA, AES_128_GCM
Server: 2600:1f18:612b:4216:4246:5d9e:b167:57c0 Ashburn, United States, ASN14618 (AMAZON-AES, US),
Reverse DNS
Software: nginx /
Resource Hash: a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

p3p: CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date: Thu, 08 Feb 2024 20:44:14 GMT
server: nginx
content-type: image/gif

GET
H/1.1 204
No Content tap.php
pixel.rubiconproject.com/ Frame 930E 0
239 B 117ms
29ms Image
image/gif 69.173.144.165
RUBICONPROJECT

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://pixel.rubiconproject.com/tap.php?nid=5578&put=a7647831-6a50-4189-97e7-556790972f4e&v=1181926
Requested by: Host: s.company-target.com
URL: https://s.company-target.com/s/sync?exc=lr
Protocol: HTTP/1.1
Security: TLS 1.2, ECDHE_RSA, AES_256_CBC
Server: 69.173.144.165 Frankfurt am Main, Germany, ASN26667 (RUBICONPROJECT, US),
Reverse DNS
Software: /
Resource Hash: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

Content-Type: image/gif
Pragma: no-cache
Expires: 0
Cache-Control: no-cache,no-store,must-revalidate
X-RPHost: 3db54fddb1cb324ce2cdd5a6ec3dc2dd
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"

GET
H3 200 counters.gif
forms.hsforms.com/embed/v3/ 35 B
590 B 181ms
181ms Image
image/gif 2606:4700::6812:b07d
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://forms.hsforms.com/embed/v3/counters.gif?key=collected-forms-embed-js-form-bind&count=2

Requested by

Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6812:b07d , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: ab0bdb2b-98cf-487f-8186-8eedb4d12e29
x-envoy-upstream-service-time: 20
alt-svc: h3=":443"; ma=86400
content-length: 35
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: ab0bdb2b-98cf-487f-8186-8eedb4d12e29
server: cloudflare
x-trace: 2B955FD26C0C417275B55C041B0E8170DE69E1ADEB000000000000000000
vary: origin
content-type: image/gif
x-evy-trace-virtual-host: all
x-evy-trace-served-by-pod: iad02/star-hubspot-td/envoy-proxy-bfd765d7d-whsh6
access-control-expose-headers: X-Origin-Hublet
cache-control: max-age=0, no-cache, no-store
access-control-allow-credentials: false
x-robots-tag: none
cf-ray: 8526b59b6e92fbce-WAW

GET
H2 200 20th_logo.jpg
www.tevora.com/wp-content/uploads/2021/10/ 4 KB
4 KB 136ms
133ms Image
image/jpeg 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2021/10/20th_logo.jpg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 0d91532d06a2f73d3f280b8990686e5835aacd299d1ae6956200ccf374580c40

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:14 GMT
last-modified: Tue, 30 Nov 2021 15:24:09 GMT
server: nginx
etag: "61a64219-10bc"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 4284

GET
H2 200 Hulu-768x432-1.jpg
www.tevora.com/wp-content/uploads/2019/09/ 5 KB
5 KB 139ms
136ms Image
image/jpeg 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2019/09/Hulu-768x432-1.jpg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: e50d6185fd72dc1b6907ecf86c58663bc7e7f8192b9d5c93ddec23f4ae123f12

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:14 GMT
last-modified: Tue, 30 Nov 2021 15:24:15 GMT
server: nginx
etag: "61a6421f-1267"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 4711

GET
H2 200 Intuit-1.png
www.tevora.com/wp-content/uploads/2019/09/ 1 KB
2 KB 138ms
135ms Image
image/png 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2019/09/Intuit-1.png
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 8d38189049ce55b1e1baee06c5e6d656da9a1a44125d75d70437bc4a00a27628

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:14 GMT
last-modified: Tue, 30 Nov 2021 15:24:16 GMT
server: nginx
etag: "61a64220-5c5"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 1477

GET
H2 200 bankofhope-2.jpg
www.tevora.com/wp-content/uploads/2017/01/ 2 KB
2 KB 134ms
131ms Image
image/jpeg 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2017/01/bankofhope-2.jpg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: f85b7117d868138012e3893329afebe0a368309d987ff678fdae40e5747ad28d

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:14 GMT
last-modified: Tue, 30 Nov 2021 15:24:21 GMT
server: nginx
etag: "61a64225-83f"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 2111

GET
H2 200 boinggo-1.jpg
www.tevora.com/wp-content/uploads/2017/01/ 3 KB
3 KB 139ms
136ms Image
image/jpeg 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2017/01/boinggo-1.jpg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 7b5a635f04d6238cbd91ed03089a7555ee28819eb9b92c9a682c0af00b49cfea

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:14 GMT
last-modified: Tue, 30 Nov 2021 15:24:21 GMT
server: nginx
etag: "61a64225-b98"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 2968

GET
H2 200 legendary-1.jpg
www.tevora.com/wp-content/uploads/2017/01/ 2 KB
2 KB 146ms
143ms Image
image/jpeg 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2017/01/legendary-1.jpg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: b74fd28a1590e1487aae342b683a8309618abbe55a41bca806f4004545d49c28

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:14 GMT
last-modified: Tue, 30 Nov 2021 15:24:21 GMT
server: nginx
etag: "61a64225-892"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 2194

GET
H2 200 coffee-bean-1.jpg
www.tevora.com/wp-content/uploads/2017/01/ 3 KB
3 KB 140ms
137ms Image
image/jpeg 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2017/01/coffee-bean-1.jpg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 53d88527a3e49d19a9bede4b1bba96bb53fe1fcfde86920c21586fe333a233e7

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:14 GMT
last-modified: Tue, 30 Nov 2021 15:24:21 GMT
server: nginx
etag: "61a64225-a54"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 2644

GET
H2 200 ucla-1.jpg
www.tevora.com/wp-content/uploads/2017/01/ 3 KB
3 KB 140ms
137ms Image
image/jpeg 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2017/01/ucla-1.jpg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: f68868b8e87e173e3410a669f7d8aaf755e6af31103c80e2dc26ac7310c68621

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:14 GMT
last-modified: Tue, 30 Nov 2021 15:24:21 GMT
server: nginx
etag: "61a64225-b2a"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 2858

GET
H2 200 Wynn-Resorts-1.jpg
www.tevora.com/wp-content/uploads/2017/01/ 14 KB
14 KB 141ms
139ms Image
image/jpeg 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2017/01/Wynn-Resorts-1.jpg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 5d18147c68b333c1e9327542ffddf90667643bb1315cfc2d337c2ff01a258708

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:14 GMT
last-modified: Tue, 30 Nov 2021 15:24:21 GMT
server: nginx
etag: "61a64225-3683"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 13955

GET
H2 200 experian-1.jpg
www.tevora.com/wp-content/uploads/2015/03/ 3 KB
3 KB 144ms
142ms Image
image/jpeg 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2015/03/experian-1.jpg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: aa14fae610e174ef0ba655aaf648fbe8fb0fae14c0105f3dad69882ee55ae3a0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:14 GMT
last-modified: Tue, 30 Nov 2021 15:24:24 GMT
server: nginx
etag: "61a64228-bf8"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3064

GET
H2 200 zappos-1.jpg
www.tevora.com/wp-content/uploads/2015/03/ 4 KB
4 KB 142ms
140ms Image
image/jpeg 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2015/03/zappos-1.jpg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: b2a231865753bfcf78cae3cd6967e79bff574a1685e0170e8b9e7219bedd6e7c

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:14 GMT
last-modified: Tue, 30 Nov 2021 15:24:24 GMT
server: nginx
etag: "61a64228-e94"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3732

GET
H2 200 westfield-1.jpg
www.tevora.com/wp-content/uploads/2015/03/ 3 KB
3 KB 142ms
140ms Image
image/jpeg 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2015/03/westfield-1.jpg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 90308c3581c20a582429698cf03129c3270bd727844fcefab5ce4433b2c01c24

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:14 GMT
last-modified: Tue, 30 Nov 2021 15:24:25 GMT
server: nginx
etag: "61a64229-bd9"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3033

GET
H2 200 lmu-1.jpg
www.tevora.com/wp-content/uploads/2015/03/ 1 KB
2 KB 147ms
145ms Image
image/jpeg 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2015/03/lmu-1.jpg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 11e256253ef3b15cfd4ba2540fb4e8ba870654fbef01d66511105e876f908ab4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:14 GMT
last-modified: Tue, 30 Nov 2021 15:24:24 GMT
server: nginx
etag: "61a64228-5d1"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 1489

GET
H2 200 sony-1.jpg
www.tevora.com/wp-content/uploads/2015/02/ 3 KB
3 KB 143ms
141ms Image
image/jpeg 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2015/02/sony-1.jpg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 370d29dc028dade2550da75381274a8e27d25ccf7af72f430cb82e1a347c67eb

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:14 GMT
last-modified: Tue, 30 Nov 2021 15:24:26 GMT
server: nginx
etag: "61a6422a-a33"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 2611

GET
H2 200 tommy-hilfiger-1.jpg
www.tevora.com/wp-content/uploads/2015/02/ 3 KB
4 KB 144ms
142ms Image
image/jpeg 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2015/02/tommy-hilfiger-1.jpg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: fef367294f4fad7012903de7ac80229115d3a75f4d199490156547d71849f86a

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:14 GMT
last-modified: Tue, 30 Nov 2021 15:24:26 GMT
server: nginx
etag: "61a6422a-d57"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3415

GET
H2 200 Qualcomm-1.png
www.tevora.com/wp-content/uploads/2015/02/ 4 KB
4 KB 147ms
145ms Image
image/png 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2015/02/Qualcomm-1.png
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 2910031d2b8ed2e463b7c3f765af71bdde3a2142e363c56c95234f91c9069fc4

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:14 GMT
last-modified: Tue, 30 Nov 2021 15:24:25 GMT
server: nginx
etag: "61a64229-e6a"
vary: Accept-Encoding
content-type: image/png
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3690

GET
H2 200 deltaco-1.jpg
www.tevora.com/wp-content/uploads/2015/02/ 2 KB
3 KB 145ms
143ms Image
image/jpeg 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2015/02/deltaco-1.jpg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: dd2ec14eb58c28a584f757fc0fef324217b7a15173a907713c248510816c04dd

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:14 GMT
last-modified: Tue, 30 Nov 2021 15:24:25 GMT
server: nginx
etag: "61a64229-9fe"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 2558

GET
H2 200 coop-financial-services-1.jpg
www.tevora.com/wp-content/uploads/2015/02/ 2 KB
2 KB 199ms
197ms Image
image/jpeg 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2015/02/coop-financial-services-1.jpg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: f11b0f814bae302ef94c2a847b6dc8b06a48b50cd3fab1357945d7574bec3bf5

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:14 GMT
last-modified: Tue, 30 Nov 2021 15:24:25 GMT
server: nginx
etag: "61a64229-6b3"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 1715

GET
H2 200 ucdavis-1.jpg
www.tevora.com/wp-content/uploads/2015/02/ 3 KB
4 KB 145ms
144ms Image
image/jpeg 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2015/02/ucdavis-1.jpg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 1bfc45674a0697b5b0799898a1334e300783244d97f243a85c714b0941ab148f

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:14 GMT
last-modified: Tue, 30 Nov 2021 15:24:26 GMT
server: nginx
etag: "61a6422a-d6b"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3435

GET
H2 200 Coinstar-640x421-1.jpg
www.tevora.com/wp-content/uploads/2015/01/ 4 KB
4 KB 146ms
144ms Image
image/jpeg 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to Show image

Full URL: https://www.tevora.com/wp-content/uploads/2015/01/Coinstar-640x421-1.jpg
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_256_GCM
Server: 35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),
Reverse DNS: 144.152.190.35.bc.googleusercontent.com
Software: nginx /
Resource Hash: 1d3bf22bec92f229749f3ee891d3708708aa45f5a018706ac38b9c12c87b1403

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:14 GMT
last-modified: Tue, 30 Nov 2021 15:24:26 GMT
server: nginx
etag: "61a6422a-f0e"
vary: Accept-Encoding
content-type: image/jpeg
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
content-length: 3854

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 201 KB
73 KB 71ms
71ms Script
application/javascript 2a00:1450:4001:811::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-1016308136

Requested by

Host: js.hsadspixel.net
URL: https://js.hsadspixel.net/fb.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

fc6313694fdbf1135a24bbad5d23cd94ed733f3010bd2da5f35f193ceb3cbea7

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:14 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 74623
x-xss-protection: 0
last-modified: Thu, 08 Feb 2024 19:45:23 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 08 Feb 2024 20:44:14 GMT

GET
H3 200 js Show response
www.googletagmanager.com/gtag/ 201 KB
73 KB 74ms
74ms Script
application/javascript 2a00:1450:4001:811::2008
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.googletagmanager.com/gtag/js?id=AW-1016308136&l=dataLayer&cx=c

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-T245DHZ

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

Google Tag Manager /

Resource Hash

009ec9e1009ecfb9d317cf7b60199e810fa268b3e5292cf24baea3876cc790b1

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:14 GMT
content-encoding: br
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 74643
x-xss-protection: 0
last-modified: Thu, 08 Feb 2024 19:57:45 GMT
server: Google Tag Manager
vary: Accept-Encoding
content-type: application/javascript; charset=UTF-8
access-control-allow-origin: *
cache-control: private, max-age=900
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
expires: Thu, 08 Feb 2024 20:44:14 GMT

POST
H2 204 /
www.tevora.com/ 0
4 KB 339ms
339ms Other
text/plain 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.tevora.com/?gdsih-csp-report

Requested by

Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

144.152.190.35.bc.googleusercontent.com

Software

nginx / WP Engine

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' data: ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.addtoany.com https://js.hsforms.net https://acsbapp.com https://js.hs-scripts.com https://snap.licdn.com https://tag.demandbase.com https://js.zi-scripts.com https://js.hs-banner.com https://js.hscollectedforms.net https://js.hs-analytics.net https://js.hsadspixel.net/ https://www.google.com https://www.gstatic.com/ https://yoast.com https://stats.wp.com https://widgets.wp.com https://s0.wp.com https://js.hubspot.com www.googletagservices.com .googlesyndication.com .googleadservices.com googleads.g.doubleclick.net adservice.google.com adservice.google.ae adservice.google.al adservice.google.at adservice.google.be adservice.google.bg adservice.google.bs adservice.google.ca adservice.google.ch adservice.google.ci adservice.google.cl adservice.google.co.bw adservice.google.co.cr adservice.google.co.id adservice.google.co.il adservice.google.co.in adservice.google.co.jp adservice.google.co.ke adservice.google.co.kr adservice.google.co.mz adservice.google.co.nz adservice.google.co.th adservice.google.co.tz adservice.google.co.uk adservice.google.co.uz adservice.google.co.ve adservice.google.co.za adservice.google.co.zm adservice.google.co.zw adservice.google.com.ai adservice.google.com.ar adservice.google.com.au adservice.google.com.bd adservice.google.com.bh adservice.google.com.bn adservice.google.com.bo adservice.google.com.br adservice.google.com.co adservice.google.com.cy adservice.google.com.ec adservice.google.com.eg adservice.google.com.et adservice.google.com.fj adservice.google.com.gh adservice.google.com.gi adservice.google.com.gt adservice.google.com.hk adservice.google.com.jm adservice.google.com.kh adservice.google.com.kw adservice.google.com.lb adservice.google.com.mm adservice.google.com.mt adservice.google.com.mx adservice.google.com.my adservice.google.com.ng adservice.google.com.ni adservice.google.com.np adservice.google.com.om adservice.google.com.pa adservice.google.com.pe adservice.google.com.ph adservice.google.com.pk adservice.google.com.pr adservice.google.com.py adservice.google.com.qa adservice.google.com.sa adservice.google.com.sg adservice.google.com.sv adservice.google.com.tr adservice.google.com.tw adservice.google.com.ua adservice.google.com.uy adservice.google.com.vn adservice.google.cz adservice.google.de adservice.google.dk adservice.google.dz adservice.google.ee adservice.google.es adservice.google.fi adservice.google.fr adservice.google.ge adservice.google.gr adservice.google.gy adservice.google.hn adservice.google.hr adservice.google.hu adservice.google.ie adservice.google.im adservice.google.iq adservice.google.is adservice.google.it adservice.google.jo adservice.google.kz adservice.google.li adservice.google.lk adservice.google.lt adservice.google.lu adservice.google.lv adservice.google.md adservice.google.mk adservice.google.mu adservice.google.nl adservice.google.no adservice.google.pl adservice.google.pt adservice.google.ro adservice.google.rs adservice.google.ru adservice.google.se adservice.google.si adservice.google.sk adservice.google.so adservice.google.sr adservice.google.tl adservice.google.tn adservice.google.tt google-analytics.com www.google-analytics.com ssl.google-analytics.com stats.g.doubleclick.net ajax.googleapis.com maps.googleapis.com maps.google.com translate.googleapis.com translate.google.com www.googletagmanager.com googletagmanager.com tagmanager.google.com; style-src 'self' 'unsafe-inline' data: https://s0.wp.com https://widgets.wp.com fonts.googleapis.com 'unsafe-inline' maps.googleapis.com maps.google.com translate.googleapis.com www.googletagmanager.com tagmanager.google.com; img-src 'self' data: https://id.rlcdn.com https://px.ads.linkedin.com https://forms.hsforms.com https://forms-na1.hsforms.com https://segments.company-target.com https://px4.ads.linkedin.com https://track.hubspot.com https://dify.wpengine.com https://pixel.wp.com https://www.linkedin.com https://en.wordpress.com https://static.hsappstatic.net s.w.org ps.w.org ts.w.org secure.gravatar.com www.gravatar.com .googlesyndication.com stats.g.doubleclick.net data: blob: google-analytics.com www.google-analytics.com ssl.google-analytics.com www.google.com .googleapis.com maps.google.com maps.gstatic.com www.gstatic.com .ggpht.com translate.googleapis.com translate.google.com i.ytimg.com www.googletagmanager.com; connect-src 'self' https://forms.hsforms.com https://hubspot-forms-static-embed.s3.amazonaws.com https://cdn.acsbapp.com/ https://api.company-target.com https://js.zi-scripts.com https://api.hubapi.com https://forms.hscollectedforms.net https://tag-logger.demandbase.com https://yoast.com https://my.wpengine.com https://ws.zoominfo.com https://exceptions.hubspot.com https://segments.company-target.com .googlesyndication.com googleads.g.doubleclick.net stats.g.doubleclick.net www.google-analytics.com ampcid.google.com analytics.google.com about: maps.googleapis.com maps.google.com translate.googleapis.com www.googletagmanager.com; font-src 'self' data: https://s0.wp.com data: fonts.gstatic.com fonts.googleapis.com; object-src 'self' ; media-src 'self' ; frame-src 'self' https://static.addtoany.com https://s.company-target.com https://td.doubleclick.net https://www.google.com https://static.hsappstatic.net https://app.hubspot.com https://widgets.wp.com https://forms.hsforms.com *.googlesyndication.com googleads.g.doubleclick.net maps.googleapis.com maps.google.com www.youtube.com www.googletagmanager.com; child-src 'self' www.youtube.com www.googletagmanager.com; worker-src 'self' blob:; upgrade-insecure-requests; block-all-mixed-content; report-uri https://www.tevora.com?gdsih-csp-report;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block; report=https://www.tevora.com?gdsih-xxp-report;

Request headers

Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Thu, 08 Feb 2024 20:44:14 GMT
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' data: ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.addtoany.com https://js.hsforms.net https://acsbapp.com https://js.hs-scripts.com https://snap.licdn.com https://tag.demandbase.com https://js.zi-scripts.com https://js.hs-banner.com https://js.hscollectedforms.net https://js.hs-analytics.net https://js.hsadspixel.net/ https://www.google.com https://www.gstatic.com/ https://yoast.com https://stats.wp.com https://widgets.wp.com https://s0.wp.com https://js.hubspot.com www.googletagservices.com *.googlesyndication.com *.googleadservices.com googleads.g.doubleclick.net adservice.google.com adservice.google.ae adservice.google.al adservice.google.at adservice.google.be adservice.google.bg adservice.google.bs adservice.google.ca adservice.google.ch adservice.google.ci adservice.google.cl adservice.google.co.bw adservice.google.co.cr adservice.google.co.id adservice.google.co.il adservice.google.co.in adservice.google.co.jp adservice.google.co.ke adservice.google.co.kr adservice.google.co.mz adservice.google.co.nz adservice.google.co.th adservice.google.co.tz adservice.google.co.uk adservice.google.co.uz adservice.google.co.ve adservice.google.co.za adservice.google.co.zm adservice.google.co.zw adservice.google.com.ai adservice.google.com.ar adservice.google.com.au adservice.google.com.bd adservice.google.com.bh adservice.google.com.bn adservice.google.com.bo adservice.google.com.br adservice.google.com.co adservice.google.com.cy adservice.google.com.ec adservice.google.com.eg adservice.google.com.et adservice.google.com.fj adservice.google.com.gh adservice.google.com.gi adservice.google.com.gt adservice.google.com.hk adservice.google.com.jm adservice.google.com.kh adservice.google.com.kw adservice.google.com.lb adservice.google.com.mm adservice.google.com.mt adservice.google.com.mx adservice.google.com.my adservice.google.com.ng adservice.google.com.ni adservice.google.com.np adservice.google.com.om adservice.google.com.pa adservice.google.com.pe adservice.google.com.ph adservice.google.com.pk adservice.google.com.pr adservice.google.com.py adservice.google.com.qa adservice.google.com.sa adservice.google.com.sg adservice.google.com.sv adservice.google.com.tr adservice.google.com.tw adservice.google.com.ua adservice.google.com.uy adservice.google.com.vn adservice.google.cz adservice.google.de adservice.google.dk adservice.google.dz adservice.google.ee adservice.google.es adservice.google.fi adservice.google.fr adservice.google.ge adservice.google.gr adservice.google.gy adservice.google.hn adservice.google.hr adservice.google.hu adservice.google.ie adservice.google.im adservice.google.iq adservice.google.is adservice.google.it adservice.google.jo adservice.google.kz adservice.google.li adservice.google.lk adservice.google.lt adservice.google.lu adservice.google.lv adservice.google.md adservice.google.mk adservice.google.mu adservice.google.nl adservice.google.no adservice.google.pl adservice.google.pt adservice.google.ro adservice.google.rs adservice.google.ru adservice.google.se adservice.google.si adservice.google.sk adservice.google.so adservice.google.sr adservice.google.tl adservice.google.tn adservice.google.tt google-analytics.com www.google-analytics.com ssl.google-analytics.com stats.g.doubleclick.net ajax.googleapis.com maps.googleapis.com maps.google.com translate.googleapis.com translate.google.com www.googletagmanager.com googletagmanager.com tagmanager.google.com; style-src 'self' 'unsafe-inline' data: https://s0.wp.com https://widgets.wp.com fonts.googleapis.com 'unsafe-inline' maps.googleapis.com maps.google.com translate.googleapis.com www.googletagmanager.com tagmanager.google.com; img-src 'self' data: https://id.rlcdn.com https://px.ads.linkedin.com https://forms.hsforms.com https://forms-na1.hsforms.com https://segments.company-target.com https://px4.ads.linkedin.com https://track.hubspot.com https://dify.wpengine.com https://pixel.wp.com https://www.linkedin.com https://en.wordpress.com https://static.hsappstatic.net s.w.org ps.w.org ts.w.org secure.gravatar.com www.gravatar.com *.googlesyndication.com stats.g.doubleclick.net data: blob: google-analytics.com www.google-analytics.com ssl.google-analytics.com www.google.com *.googleapis.com maps.google.com maps.gstatic.com www.gstatic.com *.ggpht.com translate.googleapis.com translate.google.com i.ytimg.com www.googletagmanager.com; connect-src 'self' https://forms.hsforms.com https://hubspot-forms-static-embed.s3.amazonaws.com https://cdn.acsbapp.com/ https://api.company-target.com https://js.zi-scripts.com https://api.hubapi.com https://forms.hscollectedforms.net https://tag-logger.demandbase.com https://yoast.com https://my.wpengine.com https://ws.zoominfo.com https://exceptions.hubspot.com https://segments.company-target.com *.googlesyndication.com googleads.g.doubleclick.net stats.g.doubleclick.net www.google-analytics.com ampcid.google.com analytics.google.com about: maps.googleapis.com maps.google.com translate.googleapis.com www.googletagmanager.com; font-src 'self' data: https://s0.wp.com data: fonts.gstatic.com fonts.googleapis.com; object-src 'self' ; media-src 'self' ; frame-src 'self' https://static.addtoany.com https://s.company-target.com https://td.doubleclick.net https://www.google.com https://static.hsappstatic.net https://app.hubspot.com https://widgets.wp.com https://forms.hsforms.com *.googlesyndication.com googleads.g.doubleclick.net maps.googleapis.com maps.google.com www.youtube.com www.googletagmanager.com; child-src 'self' www.youtube.com www.googletagmanager.com; worker-src 'self' blob:; upgrade-insecure-requests; block-all-mixed-content; report-uri https://www.tevora.com?gdsih-csp-report;
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
referrer-policy: same-origin
x-powered-by: WP Engine
x-frame-options: SAMEORIGIN
feature-policy: interest-cohort *;
permissions-policy: interest-cohort=(*)
x-xss-protection: 1; mode=block; report=https://www.tevora.com?gdsih-xxp-report;

POST /
px.ads.linkedin.com/wa/ 0
0

GET
H3 200 anchor Show response
www.google.com/recaptcha/enterprise/ Frame 3331 45 KB
28 KB 78ms
78ms Document
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm&co=aHR0cHM6Ly93d3cudGV2b3JhLmNvbTo0NDM.&hl=en&v=x5WWoE57Fv0d6ATKsLDIAKnt&size=invisible&badge=inline&cb=ovf77p6yqb33

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/recaptcha__en.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

1eae30e4c596dfc837f797cd98a296c9d9d1ae6e89dbb1c9bbf122b5261798b1

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-3koutmaFOY_NAzbAQDyUJA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-3koutmaFOY_NAzbAQDyUJA' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 08 Feb 2024 20:44:14 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/ Frame 3331 55 KB
24 KB 171ms
58ms Stylesheet
text/css 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm&co=aHR0cHM6Ly93d3cudGV2b3JhLmNvbTo0NDM.&hl=en&v=x5WWoE57Fv0d6ATKsLDIAKnt&size=invisible&badge=inline&cb=ovf77p6yqb33

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 12:12:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 30701
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24606
x-xss-protection: 0
last-modified: Mon, 05 Feb 2024 05:00:25 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 07 Feb 2025 12:12:33 GMT

GET
H3 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/ Frame 3331 490 KB
195 KB 197ms
85ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/recaptcha__en.js

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5aa02ad9ec4550065de8002ea1108be5d10bbb1173d2f3447f88ce1af317d4bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 18:04:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9602
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 199529
x-xss-protection: 0
last-modified: Mon, 05 Feb 2024 05:00:25 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 07 Feb 2025 18:04:12 GMT

GET
H2 200 / Show response
googleads.g.doubleclick.net/pagead/viewthroughconversion/1016308136/ 3 KB
2 KB 191ms
69ms Script
text/javascript 2a00:1450:4001:80b::2002
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1016308136/?random=1707425054275&cv=11&fst=1707425054275&bg=ffffff&guid=ON&async=1&gtm=45be4270za200&gcd=13l3l3l3l1&dma_cps=sypham&dma=1&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.tevora.com%2Fthreat-blog%2Ftargeting-msol-accounts-to-compromise-internal-networks%2F&hn=www.googleadservices.com&frm=0&tiba=Targeting%20MSOL%20Accounts%20to%20Compromise%20Internal%20Networks%20Tevora&did=dZTQ1Zm&gdid=dZTQ1Zm&npa=0&pscdl=noapi&auid=1585792327.1707425054&uamb=0&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4

Requested by

Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=AW-1016308136

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:80b::2002 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

230265a4a8ecf231ed02be9b45be405c76956bfc31dd67556147c1d106b3d8ac

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Feb 2024 20:44:14 GMT
content-encoding: br
x-content-type-options: nosniff
server: cafe
content-type: text/javascript; charset=UTF-8
p3p: policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
cache-control: no-cache, must-revalidate
cross-origin-resource-policy: cross-origin
content-disposition: attachment; filename="f.txt"
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 1320
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

GET
H3 200 /
www.google.com/pagead/1p-user-list/1016308136/ 42 B
64 B 67ms
67ms Image
image/gif 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/pagead/1p-user-list/1016308136/?random=1707425054275&cv=11&fst=1707422400000&bg=ffffff&guid=ON&async=1&gtm=45be4270za200&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.tevora.com%2Fthreat-blog%2Ftargeting-msol-accounts-to-compromise-internal-networks%2F&frm=0&tiba=Targeting%20MSOL%20Accounts%20to%20Compromise%20Internal%20Networks%20Tevora&npa=0&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSGwAvHhf_WfiUEGGv9VnGw3IkcvuH5mSsRo1LUQ&random=2989630854&rmt_tld=0&ipr=y

Requested by

Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

cafe /

Resource Hash

ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Security Headers

Name	Value
Content-Security-Policy	script-src 'none'; object-src 'none'
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

pragma: no-cache
date: Thu, 08 Feb 2024 20:44:14 GMT
content-security-policy: script-src 'none'; object-src 'none'
x-content-type-options: nosniff
server: cafe
content-type: image/gif
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control: no-cache, no-store, must-revalidate
cross-origin-resource-policy: cross-origin
timing-allow-origin: *
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 42
x-xss-protection: 0
expires: Fri, 01 Jan 1990 00:00:00 GMT

POST
H2 204 /
www.tevora.com/ 0
4 KB 333ms
333ms Other
text/plain 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.tevora.com/?gdsih-csp-report

Requested by

Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

144.152.190.35.bc.googleusercontent.com

Software

nginx / WP Engine

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' data: ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.addtoany.com https://js.hsforms.net https://acsbapp.com https://js.hs-scripts.com https://snap.licdn.com https://tag.demandbase.com https://js.zi-scripts.com https://js.hs-banner.com https://js.hscollectedforms.net https://js.hs-analytics.net https://js.hsadspixel.net/ https://www.google.com https://www.gstatic.com/ https://yoast.com https://stats.wp.com https://widgets.wp.com https://s0.wp.com https://js.hubspot.com www.googletagservices.com .googlesyndication.com .googleadservices.com googleads.g.doubleclick.net adservice.google.com adservice.google.ae adservice.google.al adservice.google.at adservice.google.be adservice.google.bg adservice.google.bs adservice.google.ca adservice.google.ch adservice.google.ci adservice.google.cl adservice.google.co.bw adservice.google.co.cr adservice.google.co.id adservice.google.co.il adservice.google.co.in adservice.google.co.jp adservice.google.co.ke adservice.google.co.kr adservice.google.co.mz adservice.google.co.nz adservice.google.co.th adservice.google.co.tz adservice.google.co.uk adservice.google.co.uz adservice.google.co.ve adservice.google.co.za adservice.google.co.zm adservice.google.co.zw adservice.google.com.ai adservice.google.com.ar adservice.google.com.au adservice.google.com.bd adservice.google.com.bh adservice.google.com.bn adservice.google.com.bo adservice.google.com.br adservice.google.com.co adservice.google.com.cy adservice.google.com.ec adservice.google.com.eg adservice.google.com.et adservice.google.com.fj adservice.google.com.gh adservice.google.com.gi adservice.google.com.gt adservice.google.com.hk adservice.google.com.jm adservice.google.com.kh adservice.google.com.kw adservice.google.com.lb adservice.google.com.mm adservice.google.com.mt adservice.google.com.mx adservice.google.com.my adservice.google.com.ng adservice.google.com.ni adservice.google.com.np adservice.google.com.om adservice.google.com.pa adservice.google.com.pe adservice.google.com.ph adservice.google.com.pk adservice.google.com.pr adservice.google.com.py adservice.google.com.qa adservice.google.com.sa adservice.google.com.sg adservice.google.com.sv adservice.google.com.tr adservice.google.com.tw adservice.google.com.ua adservice.google.com.uy adservice.google.com.vn adservice.google.cz adservice.google.de adservice.google.dk adservice.google.dz adservice.google.ee adservice.google.es adservice.google.fi adservice.google.fr adservice.google.ge adservice.google.gr adservice.google.gy adservice.google.hn adservice.google.hr adservice.google.hu adservice.google.ie adservice.google.im adservice.google.iq adservice.google.is adservice.google.it adservice.google.jo adservice.google.kz adservice.google.li adservice.google.lk adservice.google.lt adservice.google.lu adservice.google.lv adservice.google.md adservice.google.mk adservice.google.mu adservice.google.nl adservice.google.no adservice.google.pl adservice.google.pt adservice.google.ro adservice.google.rs adservice.google.ru adservice.google.se adservice.google.si adservice.google.sk adservice.google.so adservice.google.sr adservice.google.tl adservice.google.tn adservice.google.tt google-analytics.com www.google-analytics.com ssl.google-analytics.com stats.g.doubleclick.net ajax.googleapis.com maps.googleapis.com maps.google.com translate.googleapis.com translate.google.com www.googletagmanager.com googletagmanager.com tagmanager.google.com; style-src 'self' 'unsafe-inline' data: https://s0.wp.com https://widgets.wp.com fonts.googleapis.com 'unsafe-inline' maps.googleapis.com maps.google.com translate.googleapis.com www.googletagmanager.com tagmanager.google.com; img-src 'self' data: https://id.rlcdn.com https://px.ads.linkedin.com https://forms.hsforms.com https://forms-na1.hsforms.com https://segments.company-target.com https://px4.ads.linkedin.com https://track.hubspot.com https://dify.wpengine.com https://pixel.wp.com https://www.linkedin.com https://en.wordpress.com https://static.hsappstatic.net s.w.org ps.w.org ts.w.org secure.gravatar.com www.gravatar.com .googlesyndication.com stats.g.doubleclick.net data: blob: google-analytics.com www.google-analytics.com ssl.google-analytics.com www.google.com .googleapis.com maps.google.com maps.gstatic.com www.gstatic.com .ggpht.com translate.googleapis.com translate.google.com i.ytimg.com www.googletagmanager.com; connect-src 'self' https://forms.hsforms.com https://hubspot-forms-static-embed.s3.amazonaws.com https://cdn.acsbapp.com/ https://api.company-target.com https://js.zi-scripts.com https://api.hubapi.com https://forms.hscollectedforms.net https://tag-logger.demandbase.com https://yoast.com https://my.wpengine.com https://ws.zoominfo.com https://exceptions.hubspot.com https://segments.company-target.com .googlesyndication.com googleads.g.doubleclick.net stats.g.doubleclick.net www.google-analytics.com ampcid.google.com analytics.google.com about: maps.googleapis.com maps.google.com translate.googleapis.com www.googletagmanager.com; font-src 'self' data: https://s0.wp.com data: fonts.gstatic.com fonts.googleapis.com; object-src 'self' ; media-src 'self' ; frame-src 'self' https://static.addtoany.com https://s.company-target.com https://td.doubleclick.net https://www.google.com https://static.hsappstatic.net https://app.hubspot.com https://widgets.wp.com https://forms.hsforms.com *.googlesyndication.com googleads.g.doubleclick.net maps.googleapis.com maps.google.com www.youtube.com www.googletagmanager.com; child-src 'self' www.youtube.com www.googletagmanager.com; worker-src 'self' blob:; upgrade-insecure-requests; block-all-mixed-content; report-uri https://www.tevora.com?gdsih-csp-report;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block; report=https://www.tevora.com?gdsih-xxp-report;

Request headers

Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Thu, 08 Feb 2024 20:44:14 GMT
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' data: ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.addtoany.com https://js.hsforms.net https://acsbapp.com https://js.hs-scripts.com https://snap.licdn.com https://tag.demandbase.com https://js.zi-scripts.com https://js.hs-banner.com https://js.hscollectedforms.net https://js.hs-analytics.net https://js.hsadspixel.net/ https://www.google.com https://www.gstatic.com/ https://yoast.com https://stats.wp.com https://widgets.wp.com https://s0.wp.com https://js.hubspot.com www.googletagservices.com *.googlesyndication.com *.googleadservices.com googleads.g.doubleclick.net adservice.google.com adservice.google.ae adservice.google.al adservice.google.at adservice.google.be adservice.google.bg adservice.google.bs adservice.google.ca adservice.google.ch adservice.google.ci adservice.google.cl adservice.google.co.bw adservice.google.co.cr adservice.google.co.id adservice.google.co.il adservice.google.co.in adservice.google.co.jp adservice.google.co.ke adservice.google.co.kr adservice.google.co.mz adservice.google.co.nz adservice.google.co.th adservice.google.co.tz adservice.google.co.uk adservice.google.co.uz adservice.google.co.ve adservice.google.co.za adservice.google.co.zm adservice.google.co.zw adservice.google.com.ai adservice.google.com.ar adservice.google.com.au adservice.google.com.bd adservice.google.com.bh adservice.google.com.bn adservice.google.com.bo adservice.google.com.br adservice.google.com.co adservice.google.com.cy adservice.google.com.ec adservice.google.com.eg adservice.google.com.et adservice.google.com.fj adservice.google.com.gh adservice.google.com.gi adservice.google.com.gt adservice.google.com.hk adservice.google.com.jm adservice.google.com.kh adservice.google.com.kw adservice.google.com.lb adservice.google.com.mm adservice.google.com.mt adservice.google.com.mx adservice.google.com.my adservice.google.com.ng adservice.google.com.ni adservice.google.com.np adservice.google.com.om adservice.google.com.pa adservice.google.com.pe adservice.google.com.ph adservice.google.com.pk adservice.google.com.pr adservice.google.com.py adservice.google.com.qa adservice.google.com.sa adservice.google.com.sg adservice.google.com.sv adservice.google.com.tr adservice.google.com.tw adservice.google.com.ua adservice.google.com.uy adservice.google.com.vn adservice.google.cz adservice.google.de adservice.google.dk adservice.google.dz adservice.google.ee adservice.google.es adservice.google.fi adservice.google.fr adservice.google.ge adservice.google.gr adservice.google.gy adservice.google.hn adservice.google.hr adservice.google.hu adservice.google.ie adservice.google.im adservice.google.iq adservice.google.is adservice.google.it adservice.google.jo adservice.google.kz adservice.google.li adservice.google.lk adservice.google.lt adservice.google.lu adservice.google.lv adservice.google.md adservice.google.mk adservice.google.mu adservice.google.nl adservice.google.no adservice.google.pl adservice.google.pt adservice.google.ro adservice.google.rs adservice.google.ru adservice.google.se adservice.google.si adservice.google.sk adservice.google.so adservice.google.sr adservice.google.tl adservice.google.tn adservice.google.tt google-analytics.com www.google-analytics.com ssl.google-analytics.com stats.g.doubleclick.net ajax.googleapis.com maps.googleapis.com maps.google.com translate.googleapis.com translate.google.com www.googletagmanager.com googletagmanager.com tagmanager.google.com; style-src 'self' 'unsafe-inline' data: https://s0.wp.com https://widgets.wp.com fonts.googleapis.com 'unsafe-inline' maps.googleapis.com maps.google.com translate.googleapis.com www.googletagmanager.com tagmanager.google.com; img-src 'self' data: https://id.rlcdn.com https://px.ads.linkedin.com https://forms.hsforms.com https://forms-na1.hsforms.com https://segments.company-target.com https://px4.ads.linkedin.com https://track.hubspot.com https://dify.wpengine.com https://pixel.wp.com https://www.linkedin.com https://en.wordpress.com https://static.hsappstatic.net s.w.org ps.w.org ts.w.org secure.gravatar.com www.gravatar.com *.googlesyndication.com stats.g.doubleclick.net data: blob: google-analytics.com www.google-analytics.com ssl.google-analytics.com www.google.com *.googleapis.com maps.google.com maps.gstatic.com www.gstatic.com *.ggpht.com translate.googleapis.com translate.google.com i.ytimg.com www.googletagmanager.com; connect-src 'self' https://forms.hsforms.com https://hubspot-forms-static-embed.s3.amazonaws.com https://cdn.acsbapp.com/ https://api.company-target.com https://js.zi-scripts.com https://api.hubapi.com https://forms.hscollectedforms.net https://tag-logger.demandbase.com https://yoast.com https://my.wpengine.com https://ws.zoominfo.com https://exceptions.hubspot.com https://segments.company-target.com *.googlesyndication.com googleads.g.doubleclick.net stats.g.doubleclick.net www.google-analytics.com ampcid.google.com analytics.google.com about: maps.googleapis.com maps.google.com translate.googleapis.com www.googletagmanager.com; font-src 'self' data: https://s0.wp.com data: fonts.gstatic.com fonts.googleapis.com; object-src 'self' ; media-src 'self' ; frame-src 'self' https://static.addtoany.com https://s.company-target.com https://td.doubleclick.net https://www.google.com https://static.hsappstatic.net https://app.hubspot.com https://widgets.wp.com https://forms.hsforms.com *.googlesyndication.com googleads.g.doubleclick.net maps.googleapis.com maps.google.com www.youtube.com www.googletagmanager.com; child-src 'self' www.youtube.com www.googletagmanager.com; worker-src 'self' blob:; upgrade-insecure-requests; block-all-mixed-content; report-uri https://www.tevora.com?gdsih-csp-report;
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
referrer-policy: same-origin
x-powered-by: WP Engine
x-frame-options: SAMEORIGIN
feature-policy: interest-cohort *;
permissions-policy: interest-cohort=(*)
x-xss-protection: 1; mode=block; report=https://www.tevora.com?gdsih-xxp-report;

GET /
www.google.de/pagead/1p-user-list/1016308136/ 0
0

GET
H3 200 zftWH1OehvU7cp4CwShG1rGJcDUeSLUwVTlpfhapoYQ.js Show response
www.google.com/js/bg/ Frame 3331 17 KB
7 KB 62ms
59ms Script
text/javascript 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/js/bg/zftWH1OehvU7cp4CwShG1rGJcDUeSLUwVTlpfhapoYQ.js

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/recaptcha__en.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cdfb561f539e86f53b729e02c12846d6b18970351e48b5305539697e16a9a184

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm&co=aHR0cHM6Ly93d3cudGV2b3JhLmNvbTo0NDM.&hl=en&v=x5WWoE57Fv0d6ATKsLDIAKnt&size=invisible&badge=inline&cb=ovf77p6yqb33
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 00:00:27 GMT
content-encoding: br
x-content-type-options: nosniff
age: 74627
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6922
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 10:00:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 07 Feb 2025 00:00:27 GMT

GET
H3 200 logo_48.png
www.gstatic.com/recaptcha/api2/ Frame 3331 2 KB
2 KB 58ms
56ms Image
image/png 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/logo_48.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/styles__ltr.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 19:56:54 GMT
x-content-type-options: nosniff
age: 262040
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 2228
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
expires: Mon, 12 Feb 2024 19:56:54 GMT

GET
H2 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 3331 15 KB
15 KB 68ms
66ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 05:31:50 GMT
x-content-type-options: nosniff
age: 313944
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 04 Feb 2025 05:31:50 GMT

GET
H2 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame 3331 15 KB
15 KB 60ms
58ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Requested by

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 09:09:14 GMT
x-content-type-options: nosniff
age: 214500
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15552
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:33:02 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 05 Feb 2025 09:09:14 GMT

GET
H3 200 webworker.js
www.google.com/recaptcha/enterprise/ Frame 3331 102 B
135 B 67ms
65ms Other
text/javascript 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/enterprise/webworker.js?hl=en&v=x5WWoE57Fv0d6ATKsLDIAKnt

Requested by

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

3b918b6cef39462c9fed66b7ce89d8fd5fe04984c12f689e88327a703d738a0a

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/recaptcha/enterprise/anchor?ar=1&k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm&co=aHR0cHM6Ly93d3cudGV2b3JhLmNvbTo0NDM.&hl=en&v=x5WWoE57Fv0d6ATKsLDIAKnt&size=invisible&badge=inline&cb=ovf77p6yqb33
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:14 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
cross-origin-embedder-policy: require-corp
x-frame-options: SAMEORIGIN
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript; charset=utf-8
cache-control: private, max-age=300
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Thu, 08 Feb 2024 20:44:14 GMT

GET
H2 200 zi-tag.js Show response
js.zi-scripts.com/ 8 KB
3 KB 207ms
152ms Script
application/javascript 172.64.150.44
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/zi-tag.js
Requested by: Host: www.tevora.com
URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.150.44 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare /
Resource Hash: bfae35edc61595bd27d16c01ddc44ef00c152c0006e16f836101d3b6a6621d01

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:14 GMT
x-amz-version-id: lFoq_FZJwJ3rDVe9.7kNMZjc5YKK6r5L
content-encoding: gzip
cf-cache-status: DYNAMIC
last-modified: Mon, 11 Dec 2023 12:17:02 GMT
server: cloudflare
via: 1.1 ce18b5517bbba48636fceebb7d62ba00.cloudfront.net (CloudFront)
x-amz-cf-pop: BAH53-C1
etag: W/"15c02cdee0df6c26ba3d8c62d912c66c"
age: 60506
vary: Accept-Encoding
x-cache: Hit from cloudfront
content-type: application/javascript
cf-ray: 8526b5a07b6b4534-TXL
x-amz-cf-id: mX3ujFvo-wyXHcpH0vgYqJIt63U7r7xE7gsmXiEX3tT-39OqiT-KSA==

POST
H2 204 /
www.tevora.com/ 0
4 KB 318ms
318ms Other
text/plain 35.190.152.144
GOOGLE-CLOUD-PLAT...

General

Check archive.org

Show headers Download Go to

Full URL

https://www.tevora.com/?gdsih-csp-report

Requested by

Host: js.hs-analytics.net
URL: https://js.hs-analytics.net/analytics/1707424800000/7013481.js

Protocol

Security

TLS 1.3, , AES_256_GCM

Server

35.190.152.144 North Charleston, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM, US),

Reverse DNS

144.152.190.35.bc.googleusercontent.com

Software

nginx / WP Engine

Resource Hash

e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Security Headers

Name	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' data: ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.addtoany.com https://js.hsforms.net https://acsbapp.com https://js.hs-scripts.com https://snap.licdn.com https://tag.demandbase.com https://js.zi-scripts.com https://js.hs-banner.com https://js.hscollectedforms.net https://js.hs-analytics.net https://js.hsadspixel.net/ https://www.google.com https://www.gstatic.com/ https://yoast.com https://stats.wp.com https://widgets.wp.com https://s0.wp.com https://js.hubspot.com www.googletagservices.com .googlesyndication.com .googleadservices.com googleads.g.doubleclick.net adservice.google.com adservice.google.ae adservice.google.al adservice.google.at adservice.google.be adservice.google.bg adservice.google.bs adservice.google.ca adservice.google.ch adservice.google.ci adservice.google.cl adservice.google.co.bw adservice.google.co.cr adservice.google.co.id adservice.google.co.il adservice.google.co.in adservice.google.co.jp adservice.google.co.ke adservice.google.co.kr adservice.google.co.mz adservice.google.co.nz adservice.google.co.th adservice.google.co.tz adservice.google.co.uk adservice.google.co.uz adservice.google.co.ve adservice.google.co.za adservice.google.co.zm adservice.google.co.zw adservice.google.com.ai adservice.google.com.ar adservice.google.com.au adservice.google.com.bd adservice.google.com.bh adservice.google.com.bn adservice.google.com.bo adservice.google.com.br adservice.google.com.co adservice.google.com.cy adservice.google.com.ec adservice.google.com.eg adservice.google.com.et adservice.google.com.fj adservice.google.com.gh adservice.google.com.gi adservice.google.com.gt adservice.google.com.hk adservice.google.com.jm adservice.google.com.kh adservice.google.com.kw adservice.google.com.lb adservice.google.com.mm adservice.google.com.mt adservice.google.com.mx adservice.google.com.my adservice.google.com.ng adservice.google.com.ni adservice.google.com.np adservice.google.com.om adservice.google.com.pa adservice.google.com.pe adservice.google.com.ph adservice.google.com.pk adservice.google.com.pr adservice.google.com.py adservice.google.com.qa adservice.google.com.sa adservice.google.com.sg adservice.google.com.sv adservice.google.com.tr adservice.google.com.tw adservice.google.com.ua adservice.google.com.uy adservice.google.com.vn adservice.google.cz adservice.google.de adservice.google.dk adservice.google.dz adservice.google.ee adservice.google.es adservice.google.fi adservice.google.fr adservice.google.ge adservice.google.gr adservice.google.gy adservice.google.hn adservice.google.hr adservice.google.hu adservice.google.ie adservice.google.im adservice.google.iq adservice.google.is adservice.google.it adservice.google.jo adservice.google.kz adservice.google.li adservice.google.lk adservice.google.lt adservice.google.lu adservice.google.lv adservice.google.md adservice.google.mk adservice.google.mu adservice.google.nl adservice.google.no adservice.google.pl adservice.google.pt adservice.google.ro adservice.google.rs adservice.google.ru adservice.google.se adservice.google.si adservice.google.sk adservice.google.so adservice.google.sr adservice.google.tl adservice.google.tn adservice.google.tt google-analytics.com www.google-analytics.com ssl.google-analytics.com stats.g.doubleclick.net ajax.googleapis.com maps.googleapis.com maps.google.com translate.googleapis.com translate.google.com www.googletagmanager.com googletagmanager.com tagmanager.google.com; style-src 'self' 'unsafe-inline' data: https://s0.wp.com https://widgets.wp.com fonts.googleapis.com 'unsafe-inline' maps.googleapis.com maps.google.com translate.googleapis.com www.googletagmanager.com tagmanager.google.com; img-src 'self' data: https://id.rlcdn.com https://px.ads.linkedin.com https://forms.hsforms.com https://forms-na1.hsforms.com https://segments.company-target.com https://px4.ads.linkedin.com https://track.hubspot.com https://dify.wpengine.com https://pixel.wp.com https://www.linkedin.com https://en.wordpress.com https://static.hsappstatic.net s.w.org ps.w.org ts.w.org secure.gravatar.com www.gravatar.com .googlesyndication.com stats.g.doubleclick.net data: blob: google-analytics.com www.google-analytics.com ssl.google-analytics.com www.google.com .googleapis.com maps.google.com maps.gstatic.com www.gstatic.com .ggpht.com translate.googleapis.com translate.google.com i.ytimg.com www.googletagmanager.com; connect-src 'self' https://forms.hsforms.com https://hubspot-forms-static-embed.s3.amazonaws.com https://cdn.acsbapp.com/ https://api.company-target.com https://js.zi-scripts.com https://api.hubapi.com https://forms.hscollectedforms.net https://tag-logger.demandbase.com https://yoast.com https://my.wpengine.com https://ws.zoominfo.com https://exceptions.hubspot.com https://segments.company-target.com .googlesyndication.com googleads.g.doubleclick.net stats.g.doubleclick.net www.google-analytics.com ampcid.google.com analytics.google.com about: maps.googleapis.com maps.google.com translate.googleapis.com www.googletagmanager.com; font-src 'self' data: https://s0.wp.com data: fonts.gstatic.com fonts.googleapis.com; object-src 'self' ; media-src 'self' ; frame-src 'self' https://static.addtoany.com https://s.company-target.com https://td.doubleclick.net https://www.google.com https://static.hsappstatic.net https://app.hubspot.com https://widgets.wp.com https://forms.hsforms.com *.googlesyndication.com googleads.g.doubleclick.net maps.googleapis.com maps.google.com www.youtube.com www.googletagmanager.com; child-src 'self' www.youtube.com www.googletagmanager.com; worker-src 'self' blob:; upgrade-insecure-requests; block-all-mixed-content; report-uri https://www.tevora.com?gdsih-csp-report;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block; report=https://www.tevora.com?gdsih-xxp-report;

Request headers

Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: application/csp-report

Response headers

date: Thu, 08 Feb 2024 20:44:14 GMT
content-security-policy: default-src 'self' 'unsafe-inline' 'unsafe-eval' data: ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.addtoany.com https://js.hsforms.net https://acsbapp.com https://js.hs-scripts.com https://snap.licdn.com https://tag.demandbase.com https://js.zi-scripts.com https://js.hs-banner.com https://js.hscollectedforms.net https://js.hs-analytics.net https://js.hsadspixel.net/ https://www.google.com https://www.gstatic.com/ https://yoast.com https://stats.wp.com https://widgets.wp.com https://s0.wp.com https://js.hubspot.com www.googletagservices.com *.googlesyndication.com *.googleadservices.com googleads.g.doubleclick.net adservice.google.com adservice.google.ae adservice.google.al adservice.google.at adservice.google.be adservice.google.bg adservice.google.bs adservice.google.ca adservice.google.ch adservice.google.ci adservice.google.cl adservice.google.co.bw adservice.google.co.cr adservice.google.co.id adservice.google.co.il adservice.google.co.in adservice.google.co.jp adservice.google.co.ke adservice.google.co.kr adservice.google.co.mz adservice.google.co.nz adservice.google.co.th adservice.google.co.tz adservice.google.co.uk adservice.google.co.uz adservice.google.co.ve adservice.google.co.za adservice.google.co.zm adservice.google.co.zw adservice.google.com.ai adservice.google.com.ar adservice.google.com.au adservice.google.com.bd adservice.google.com.bh adservice.google.com.bn adservice.google.com.bo adservice.google.com.br adservice.google.com.co adservice.google.com.cy adservice.google.com.ec adservice.google.com.eg adservice.google.com.et adservice.google.com.fj adservice.google.com.gh adservice.google.com.gi adservice.google.com.gt adservice.google.com.hk adservice.google.com.jm adservice.google.com.kh adservice.google.com.kw adservice.google.com.lb adservice.google.com.mm adservice.google.com.mt adservice.google.com.mx adservice.google.com.my adservice.google.com.ng adservice.google.com.ni adservice.google.com.np adservice.google.com.om adservice.google.com.pa adservice.google.com.pe adservice.google.com.ph adservice.google.com.pk adservice.google.com.pr adservice.google.com.py adservice.google.com.qa adservice.google.com.sa adservice.google.com.sg adservice.google.com.sv adservice.google.com.tr adservice.google.com.tw adservice.google.com.ua adservice.google.com.uy adservice.google.com.vn adservice.google.cz adservice.google.de adservice.google.dk adservice.google.dz adservice.google.ee adservice.google.es adservice.google.fi adservice.google.fr adservice.google.ge adservice.google.gr adservice.google.gy adservice.google.hn adservice.google.hr adservice.google.hu adservice.google.ie adservice.google.im adservice.google.iq adservice.google.is adservice.google.it adservice.google.jo adservice.google.kz adservice.google.li adservice.google.lk adservice.google.lt adservice.google.lu adservice.google.lv adservice.google.md adservice.google.mk adservice.google.mu adservice.google.nl adservice.google.no adservice.google.pl adservice.google.pt adservice.google.ro adservice.google.rs adservice.google.ru adservice.google.se adservice.google.si adservice.google.sk adservice.google.so adservice.google.sr adservice.google.tl adservice.google.tn adservice.google.tt google-analytics.com www.google-analytics.com ssl.google-analytics.com stats.g.doubleclick.net ajax.googleapis.com maps.googleapis.com maps.google.com translate.googleapis.com translate.google.com www.googletagmanager.com googletagmanager.com tagmanager.google.com; style-src 'self' 'unsafe-inline' data: https://s0.wp.com https://widgets.wp.com fonts.googleapis.com 'unsafe-inline' maps.googleapis.com maps.google.com translate.googleapis.com www.googletagmanager.com tagmanager.google.com; img-src 'self' data: https://id.rlcdn.com https://px.ads.linkedin.com https://forms.hsforms.com https://forms-na1.hsforms.com https://segments.company-target.com https://px4.ads.linkedin.com https://track.hubspot.com https://dify.wpengine.com https://pixel.wp.com https://www.linkedin.com https://en.wordpress.com https://static.hsappstatic.net s.w.org ps.w.org ts.w.org secure.gravatar.com www.gravatar.com *.googlesyndication.com stats.g.doubleclick.net data: blob: google-analytics.com www.google-analytics.com ssl.google-analytics.com www.google.com *.googleapis.com maps.google.com maps.gstatic.com www.gstatic.com *.ggpht.com translate.googleapis.com translate.google.com i.ytimg.com www.googletagmanager.com; connect-src 'self' https://forms.hsforms.com https://hubspot-forms-static-embed.s3.amazonaws.com https://cdn.acsbapp.com/ https://api.company-target.com https://js.zi-scripts.com https://api.hubapi.com https://forms.hscollectedforms.net https://tag-logger.demandbase.com https://yoast.com https://my.wpengine.com https://ws.zoominfo.com https://exceptions.hubspot.com https://segments.company-target.com *.googlesyndication.com googleads.g.doubleclick.net stats.g.doubleclick.net www.google-analytics.com ampcid.google.com analytics.google.com about: maps.googleapis.com maps.google.com translate.googleapis.com www.googletagmanager.com; font-src 'self' data: https://s0.wp.com data: fonts.gstatic.com fonts.googleapis.com; object-src 'self' ; media-src 'self' ; frame-src 'self' https://static.addtoany.com https://s.company-target.com https://td.doubleclick.net https://www.google.com https://static.hsappstatic.net https://app.hubspot.com https://widgets.wp.com https://forms.hsforms.com *.googlesyndication.com googleads.g.doubleclick.net maps.googleapis.com maps.google.com www.youtube.com www.googletagmanager.com; child-src 'self' www.youtube.com www.googletagmanager.com; worker-src 'self' blob:; upgrade-insecure-requests; block-all-mixed-content; report-uri https://www.tevora.com?gdsih-csp-report;
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
server: nginx
referrer-policy: same-origin
x-powered-by: WP Engine
x-frame-options: SAMEORIGIN
feature-policy: interest-cohort *;
permissions-policy: interest-cohort=(*)
x-xss-protection: 1; mode=block; report=https://www.tevora.com?gdsih-xxp-report;

GET 7013481.js
js-na1.hs-scripts.com/ 0
0

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
738 B 240ms
176ms Image
image/gif 2606:4700::6813:9a53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=1&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2032787945&v=1.1&a=7013481&ct=blog-post&rcu=https%3A%2F%2Fwww.tevora.com%2Fthreat-blog%2Ftargeting-msol-accounts-to-compromise-internal-networks%2F&pu=https%3A%2F%2Fwww.tevora.com%2Fthreat-blog%2Ftargeting-msol-accounts-to-compromise-internal-networks%2F&t=Targeting+MSOL+Accounts+to+Compromise+Internal+Networks+Tevora&cts=1707425054735&vi=47af47413a87ac81cdd86e12c99960ca&nc=true&u=66129585.47af47413a87ac81cdd86e12c99960ca.1707425054734.1707425054734.1707425054734.1&b=66129585.1.1707425054734&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: ca864506-78e7-434f-9baf-0c8158e86b04
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 7
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: ca864506-78e7-434f-9baf-0c8158e86b04
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=q5pHqUiWR1RurD3MXhvqMdXBtejxsgJP9HuqqIKsKxRLg5DELZu0jmBhp7gQavAIV5QeqLW5o9hyLaJ9EkBsrhh1jfRvrOo6VKA1oP2aqCnAEfkeayZ9dxGYhgur4IkQycspQRSxFGeukOEU1u2U"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-68f68ffdf9-9lgsc
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 8526b5a09ee53527-WAW
x-robots-tag: none

GET
H2 200 __ptq.gif
track.hubspot.com/ 45 B
1 KB 235ms
174ms Image
image/gif 2606:4700::6813:9a53
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://track.hubspot.com/__ptq.gif?k=15&fi=6c95561c-1e3b-4787-9cd6-1020f66646d8&fci=e06e8230-53c9-45ff-8a65-e687338e274a&ft=0&sd=1600x1200&cd=24-bit&cs=UTF-8&ln=en-us&bfp=2032787945&v=1.1&a=7013481&ct=blog-post&rcu=https%3A%2F%2Fwww.tevora.com%2Fthreat-blog%2Ftargeting-msol-accounts-to-compromise-internal-networks%2F&pu=https%3A%2F%2Fwww.tevora.com%2Fthreat-blog%2Ftargeting-msol-accounts-to-compromise-internal-networks%2F&t=Targeting+MSOL+Accounts+to+Compromise+Internal+Networks+Tevora&cts=1707425054736&vi=47af47413a87ac81cdd86e12c99960ca&nc=true&u=66129585.47af47413a87ac81cdd86e12c99960ca.1707425054734.1707425054734.1707425054734.1&b=66129585.1.1707425054734&cc=15

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6813:9a53 , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare /

Resource Hash

dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4

Security Headers

Name	Value
Strict-Transport-Security	max-age=31536000; includeSubDomains; preload
X-Content-Type-Options	nosniff

Request headers

accept-language: de-DE,de;q=0.9
Referer
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:14 GMT
strict-transport-security: max-age=31536000; includeSubDomains; preload
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
nel: {"success_fraction":0.01,"report_to":"cf-nel","max_age":604800}
x-evy-trace-route-service-name: envoyset-translator
x-hubspot-correlation-id: 7d2c0a20-ac46-4fcc-a32e-99ddd517f908
p3p: CP="NOI CUR ADM OUR NOR STA NID"
x-envoy-upstream-service-time: 8
content-length: 45
x-evy-trace-route-configuration: listener_https/all
x-evy-trace-listener: listener_https
x-request-id: 7d2c0a20-ac46-4fcc-a32e-99ddd517f908
server: cloudflare
vary: origin, Accept-Encoding
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qTyCUMpMPPqc6Xr%2FXOBiDbmQZa9LZ6RUUZqsMdXQw%2FrwkThu30KeQll7s6EWQ1P0WJFXwTMfx09yb2E2s6wKht1T2%2FqjP87LjsHvHKui7ntB885wuQv97MVcXI8JOqVL7XtzJL53ytd4TZHENgCz"}],"group":"cf-nel","max_age":604800}
content-type: image/gif
x-evy-trace-served-by-pod: iad02/analytics-tracking-td/envoy-proxy-68f68ffdf9-zrmfx
x-evy-trace-virtual-host: all
cache-control: no-cache, no-store, no-transform
access-control-allow-credentials: false
cf-ray: 8526b5a09ee63527-WAW
x-robots-tag: none

GET
H3 200 bframe Show response
www.google.com/recaptcha/enterprise/ Frame E23A 7 KB
1 KB 67ms
67ms Document
text/html 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/enterprise/bframe?hl=en&v=x5WWoE57Fv0d6ATKsLDIAKnt&k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/recaptcha__en.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

38c8f950324b21bcc81cb1aa593f45b9fe31a56a41378ec803b09e69a0210614

Security Headers

Name	Value
Content-Security-Policy	script-src 'report-sample' 'nonce-EXZNfBAZgFQPLYjKUo4QcQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
X-Content-Type-Options	nosniff
X-Xss-Protection	1; mode=block

Request headers

Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
accept-language: de-DE,de;q=0.9

Response headers

alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
cache-control: no-cache, no-store, max-age=0, must-revalidate
content-encoding: gzip
content-security-policy: script-src 'report-sample' 'nonce-EXZNfBAZgFQPLYjKUo4QcQ' 'unsafe-inline' 'strict-dynamic' https: http: 'unsafe-eval';object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/recaptcha/1
content-type: text/html; charset=utf-8
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
date: Thu, 08 Feb 2024 20:44:14 GMT
expires: Mon, 01 Jan 1990 00:00:00 GMT
pragma: no-cache
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
server: GSE
x-content-type-options: nosniff
x-xss-protection: 1; mode=block

GET
H3 200 styles__ltr.css
www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/ Frame E23A 55 KB
24 KB 56ms
56ms Stylesheet
text/css 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/styles__ltr.css

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/enterprise/bframe?hl=en&v=x5WWoE57Fv0d6ATKsLDIAKnt&k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 12:12:33 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 30701
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 24606
x-xss-protection: 0
last-modified: Mon, 05 Feb 2024 05:00:25 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/css
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 07 Feb 2025 12:12:33 GMT

GET
H3 200 recaptcha__en.js Show response
www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/ Frame E23A 490 KB
195 KB 59ms
59ms Script
text/javascript 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/recaptcha__en.js

Requested by

Host: www.google.com
URL: https://www.google.com/recaptcha/enterprise/bframe?hl=en&v=x5WWoE57Fv0d6ATKsLDIAKnt&k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5aa02ad9ec4550065de8002ea1108be5d10bbb1173d2f3447f88ce1af317d4bd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 18:04:12 GMT
content-encoding: gzip
x-content-type-options: nosniff
age: 9602
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 199529
x-xss-protection: 0
last-modified: Mon, 05 Feb 2024 05:00:25 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
vary: Accept-Encoding
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: text/javascript
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 07 Feb 2025 18:04:12 GMT

GET
H2 200 getSubscriptions Show response
js.zi-scripts.com/unified/v1/master/ 150 B
437 B 477ms
477ms Fetch
application/json 172.64.150.44
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Requested by: Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.150.44 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash: 0df0dbe8aa9236ec3d8341fa9becbc2c63e2ecb39912f00bb6049e100c491e30

Request headers

visited_url: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Referer
accept-language: de-DE,de;q=0.9
Authorization: Bearer d1310d8fa71689136326
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: application/json

Response headers

date: Thu, 08 Feb 2024 20:44:16 GMT
via: 1.1 78aa4ecfac2dbbed080d75d85f660486.cloudfront.net (CloudFront)
content-encoding: gzip
cf-cache-status: DYNAMIC
server: cloudflare
x-amz-cf-pop: TXL52-C1
x-powered-by: Express
etag: W/"96-xIIJC9zjdPI21rCnNyovtQ1MIi0"
x-cache: Miss from cloudfront
content-type: application/json; charset=utf-8
access-control-allow-origin: *
access-control-expose-headers: *
cf-ray: 8526b5a6bd1344f2-TXL
x-amz-cf-id: po_MSW-rWpV859GnakIlMhIbMitnZfDm1TN8upjk-a4Sdy7PjSfjiw==
apigw-requestid: S1Z9EhdcvHcES-A=

OPTIONS
H2 204 getSubscriptions
js.zi-scripts.com/unified/v1/master/ Frame 0
0 846ms
801ms Preflight 172.64.150.44
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL: https://js.zi-scripts.com/unified/v1/master/getSubscriptions
Protocol: H2
Security: TLS 1.3, , AES_128_GCM
Server: 172.64.150.44 , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software: cloudflare / Express
Resource Hash

Request headers

Accept: */*
Access-Control-Request-Headers: authorization,content-type,visited_url
Access-Control-Request-Method: GET
Origin: https://www.tevora.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-headers: *
access-control-allow-methods: *
access-control-allow-origin: *
access-control-max-age: 0
apigw-requestid: S1Z8-h-xPHcEMeQ=
cf-cache-status: DYNAMIC
cf-ray: 8526b5a1bad344f2-TXL
date: Thu, 08 Feb 2024 20:44:15 GMT
server: cloudflare
vary: Access-Control-Request-Headers
via: 1.1 9e2832101d2afe9c375402906a247c04.cloudfront.net (CloudFront)
x-amz-cf-id: FSog-tzRddQ6LgTUHGJYczJWGaK9UB8LkCIrUba9ymU8YWEUSIWoMg==
x-amz-cf-pop: BAH53-C1
x-cache: Miss from cloudfront
x-powered-by: Express

POST
H3 200 reload Show response
www.google.com/recaptcha/api2/ Frame E23A 21 KB
15 KB 105ms
105ms XHR
application/json 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/recaptcha/api2/reload?k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/recaptcha__en.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

8db2ce6ec1b1ffab44752e8dfbabb19e78f77d8cd133b8ee3741dea9c373bb10

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

Referer: https://www.google.com/recaptcha/enterprise/bframe?hl=en&v=x5WWoE57Fv0d6ATKsLDIAKnt&k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: application/x-protobuffer

Response headers

date: Thu, 08 Feb 2024 20:44:15 GMT
content-encoding: gzip
x-content-type-options: nosniff
content-security-policy: frame-ancestors 'self'
server: GSE
x-frame-options: SAMEORIGIN
content-type: application/json; charset=utf-8
cache-control: private, max-age=0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Thu, 08 Feb 2024 20:44:15 GMT

GET
H3 200 refresh_2x.png
www.gstatic.com/recaptcha/api2/ Frame E23A 600 B
624 B 59ms
57ms Image
image/png 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/refresh_2x.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/styles__ltr.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

44b988703019cd6bfa86c91840fecf2a42b611b364e3eea2f4eb63bf62714e98

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 00:14:03 GMT
x-content-type-options: nosniff
age: 73812
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 600
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
expires: Thu, 15 Feb 2024 00:14:03 GMT

GET
H3 200 audio_2x.png
www.gstatic.com/recaptcha/api2/ Frame E23A 530 B
554 B 60ms
58ms Image
image/png 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/audio_2x.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/styles__ltr.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

89c62095126fca89ea1511cf35b49b8306162946b0c26d6f60c5506c51d85992

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 00:06:21 GMT
x-content-type-options: nosniff
age: 74274
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 530
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
expires: Thu, 15 Feb 2024 00:06:21 GMT

GET
H3 200 info_2x.png
www.gstatic.com/recaptcha/api2/ Frame E23A 665 B
689 B 61ms
59ms Image
image/png 2a00:1450:4001:82a::2003
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.gstatic.com/recaptcha/api2/info_2x.png

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/styles__ltr.css

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82a::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

55eaf62cb05da20088dc12b39d7d254d046cb1fd61ddf3ae641f1439efd0a5ee

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/styles__ltr.css
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 00:14:03 GMT
x-content-type-options: nosniff
age: 73812
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 665
x-xss-protection: 0
last-modified: Tue, 03 Mar 2020 20:15:00 GMT
server: sffe
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-type: image/png
cache-control: public, max-age=604800
accept-ranges: bytes
expires: Thu, 15 Feb 2024 00:14:03 GMT

GET
H3 200 KFOmCnqEu92Fr1Mu4mxK.woff2
fonts.gstatic.com/s/roboto/v18/ Frame E23A 15 KB
15 KB 89ms
87ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxK.woff2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Mon, 05 Feb 2024 05:31:50 GMT
x-content-type-options: nosniff
age: 313945
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15344
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:32:55 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Tue, 04 Feb 2025 05:31:50 GMT

GET
H3 200 KFOlCnqEu92Fr1MmYUtfBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame E23A 15 KB
15 KB 61ms
60ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBBc4.woff2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

c912a9ce0c3122d4b2b29ad26bfe06b0390d1a5bdaa5d6128692c0befd1dfbbd

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Sat, 03 Feb 2024 00:11:33 GMT
x-content-type-options: nosniff
age: 505962
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15340
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:33:16 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Sun, 02 Feb 2025 00:11:33 GMT

GET
H3 200 KFOlCnqEu92Fr1MmEU9fBBc4.woff2
fonts.gstatic.com/s/roboto/v18/ Frame E23A 15 KB
15 KB 68ms
66ms Font
font/woff2 2a00:1450:4001:830::2003
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc4.woff2

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:830::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

Referer: https://www.google.com/
Origin: https://www.google.com
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Tue, 06 Feb 2024 09:09:14 GMT
x-content-type-options: nosniff
age: 214501
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 15552
x-xss-protection: 0
last-modified: Mon, 16 Oct 2017 17:33:02 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
content-type: font/woff2
access-control-allow-origin: *
cache-control: public, max-age=31536000
accept-ranges: bytes
timing-allow-origin: *
expires: Wed, 05 Feb 2025 09:09:14 GMT

GET
H3 200 zftWH1OehvU7cp4CwShG1rGJcDUeSLUwVTlpfhapoYQ.js Show response
www.google.com/js/bg/ Frame E23A 17 KB
7 KB 57ms
57ms Script
text/javascript 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to

Full URL

https://www.google.com/js/bg/zftWH1OehvU7cp4CwShG1rGJcDUeSLUwVTlpfhapoYQ.js

Requested by

Host: www.gstatic.com
URL: https://www.gstatic.com/recaptcha/releases/x5WWoE57Fv0d6ATKsLDIAKnt/recaptcha__en.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

sffe /

Resource Hash

cdfb561f539e86f53b729e02c12846d6b18970351e48b5305539697e16a9a184

Security Headers

Name	Value
X-Content-Type-Options	nosniff
X-Xss-Protection	0

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/recaptcha/enterprise/bframe?hl=en&v=x5WWoE57Fv0d6ATKsLDIAKnt&k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 00:00:27 GMT
content-encoding: br
x-content-type-options: nosniff
age: 74628
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/botguard-scs
cross-origin-resource-policy: cross-origin
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length: 6922
x-xss-protection: 0
last-modified: Mon, 15 Jan 2024 10:00:00 GMT
server: sffe
cross-origin-opener-policy: same-origin; report-to="botguard-scs"
vary: Accept-Encoding
report-to: {"group":"botguard-scs","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/botguard-scs"}]}
content-type: text/javascript
cache-control: public, max-age=31536000
accept-ranges: bytes
expires: Fri, 07 Feb 2025 00:00:27 GMT

GET
H3 200 payload
www.google.com/recaptcha/api2/ Frame E23A 41 KB
41 KB 67ms
66ms Image
image/jpeg 2a00:1450:4001:82b::2004
GOOGLE

General

Check archive.org

Show headers Download Go to Show image

Full URL

https://www.google.com/recaptcha/api2/payload?p=06AFcWeA7TeFzFak44PKLElQ3sBjTYr86D5bAIjs0Dtp8QbLqZekOcHtuqCuARSPN0HyyX-g3HqewFGBBqncLNEYcF_t3Dvx06R10Ri5HldXaewRKXg-6ixPbedwXk5uYR9zcYjVbSlAnXA0zxso-Rv8H6rPlIc5E9PcP9J9-A6R4VJUf7MrWEmpzItb7Ov8CWGptFYIjflswopAMfIKdUxrWugOeeY3dI4A&k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm

Protocol

Security

QUIC, , AES_128_GCM

Server

2a00:1450:4001:82b::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),

Reverse DNS

Software

GSE /

Resource Hash

de2c9627201af7d0127e2eed55f52f88a2ae16e18ef7c13cbc40b6299af8743c

Security Headers

Name	Value
Content-Security-Policy	frame-ancestors 'self'
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block

Request headers

accept-language: de-DE,de;q=0.9
Referer: https://www.google.com/recaptcha/enterprise/bframe?hl=en&v=x5WWoE57Fv0d6ATKsLDIAKnt&k=6Ld_ad8ZAAAAAAqr0ePo1dUfAi0m4KPkCMQYwPPm
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

date: Thu, 08 Feb 2024 20:44:15 GMT
content-security-policy: frame-ancestors 'self'
x-content-type-options: nosniff
server: GSE
x-frame-options: SAMEORIGIN
content-type: image/jpeg
cache-control: private, max-age=30
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-xss-protection: 1; mode=block
expires: Thu, 08 Feb 2024 20:44:15 GMT

GET
H3 200 / Show response
ws.zoominfo.com/pixel/64b1c2ed6f6dd71644b28c2c/ 3 KB
2 KB 378ms
344ms Fetch
text/javascript 2606:4700::6810:880f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/64b1c2ed6f6dd71644b28c2c/?iszitag=true

Requested by

Host: js.zi-scripts.com
URL: https://js.zi-scripts.com/zi-tag.js

Protocol

Security

QUIC, , AES_128_GCM

Server

2606:4700::6810:880f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

da3a11158cfd564619555243faa9db23da88fdc7bcc846f14a768d5df2d0b9a8

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

visited-url: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
Referer: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/
_vtok: MTkzLjMyLjI0OC4yMDk=
_zitok: 29b27ccbbe9e198948a61707425056
accept-language: de-DE,de;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36
Content-Type: text/javascript

Response headers

date: Thu, 08 Feb 2024 20:44:16 GMT
content-encoding: gzip
x-content-type-options: nosniff
cf-cache-status: DYNAMIC
via: 1.1 google
server: cloudflare
x-powered-by: Express
vary: Accept-Encoding
content-type: text/javascript
access-control-allow-origin: https://www.tevora.com
access-control-allow-credentials: true
x-robots-tag: noindex, nofollow
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for, x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url
alt-svc: h3=":443"; ma=86400
cf-ray: 8526b5ab98d08872-WAW

OPTIONS
H2 200 /
ws.zoominfo.com/pixel/64b1c2ed6f6dd71644b28c2c/ Frame 0
0 261ms
193ms Preflight
text/html 2606:4700::6810:880f
CLOUDFLARENET

General

Check archive.org

Show headers Download Go to

Full URL

https://ws.zoominfo.com/pixel/64b1c2ed6f6dd71644b28c2c/?iszitag=true

Protocol

Security

TLS 1.3, , AES_128_GCM

Server

2606:4700::6810:880f , United States, ASN13335 (CLOUDFLARENET, US),

Reverse DNS

Software

cloudflare / Express

Resource Hash

Security Headers

Name	Value
X-Content-Type-Options	nosniff

Request headers

Accept: */*
Access-Control-Request-Headers: _vtok,_zitok,content-type,visited-url
Access-Control-Request-Method: GET
Origin: https://www.tevora.com
Sec-Fetch-Mode: cors
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.139 Safari/537.36

Response headers

access-control-allow-credentials: true
access-control-allow-headers: Content-Type,cf-ipcountry,service-version,x-appengine-user-ip,x-forwarded-for,x-ws-collect-type,requestFromZITag,unifiedScriptVerified,_zitok,_vtok,visited-url
access-control-allow-origin: https://www.tevora.com
allow: GET,HEAD
alt-svc: h3=":443"; ma=86400
cf-cache-status: DYNAMIC
cf-ray: 8526b5aa2eb48872-WAW
content-encoding: gzip
content-type: text/html; charset=utf-8
date: Thu, 08 Feb 2024 20:44:16 GMT
server: cloudflare
via: 1.1 google
x-content-type-options: nosniff
x-powered-by: Express
x-robots-tag: noindex, nofollow

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain: www.google.de
URL: https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-S8Q6BRR8Y7&cid=1091683361.1707425054&gtm=45je4270v9103278546z89104995285za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l3l1&npa=0&z=824874016

Domain: www.google.de
URL: https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-16460355-1&cid=1091683361.1707425054&jid=1904680482&_u=YADAAEAAAAAAACAAI~&z=488825966

Domain: px.ads.linkedin.com
URL: https://px.ads.linkedin.com/wa/

Domain: www.google.de
URL: https://www.google.de/pagead/1p-user-list/1016308136/?random=1707425054275&cv=11&fst=1707422400000&bg=ffffff&guid=ON&async=1&gtm=45be4270za200&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.tevora.com%2Fthreat-blog%2Ftargeting-msol-accounts-to-compromise-internal-networks%2F&frm=0&tiba=Targeting%20MSOL%20Accounts%20to%20Compromise%20Internal%20Networks%20Tevora&npa=0&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSGwAvHhf_WfiUEGGv9VnGw3IkcvuH5mSsRo1LUQ&random=2989630854&rmt_tld=1&ipr=y

Domain: js-na1.hs-scripts.com
URL: https://js-na1.hs-scripts.com/7013481.js

Verdicts & Comments Add Verdict or Comment

98 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

26 Cookies

Cookies are little pieces of information stored in the browser of a user. Whenever a user visits the site again, he will also send his cookie values, thus allowing the website to re-identify him even if he changed locations. This is how permanent logins work.

Domain/Path	Expires	Name / Value
www.google.com/recaptcha	1970-01-20 22:36:17	Name: _GRECAPTCHA Value: 09AJmcDElHR9sKqZfsDubIk4GZ7bvzvtKsb-kh9uayl4quvMk_HcC01Qz1A7MEUZIBnghmm_-StLpIOmvKNt5FZ7g
.tevora.com/	1970-01-21 03:53:05	Name: _ga_S8Q6BRR8Y7 Value: GS1.1.1707425053.1.0.1707425053.60.0.0
.tevora.com/	1970-01-21 03:53:05	Name: _ga Value: GA1.2.1091683361.1707425054
.tevora.com/	1970-01-20 18:18:31	Name: _gid Value: GA1.2.108238700.1707425054
.tevora.com/	1970-01-20 18:17:05	Name: _gat_UA-16460355-1 Value: 1
.linkedin.com/	1970-01-21 03:02:41	Name: bcookie Value: "v=2&9cf94990-c959-4f19-8a40-49ddac8ac4f6"
.linkedin.com/	1970-01-20 22:36:17	Name: li_gc Value: MTswOzE3MDc0MjUwNTM7MjswMjHTcj6l3hGtXl3jGI/AoNbZCLWCgqbvWqMqI60iLgXQDA==
.linkedin.com/	1970-01-20 18:18:31	Name: lidc Value: "b=VGST05:s=V:r=V:a=V:p=V:g=2987:u=1:x=1:i=1707425053:t=1707511453:v=2:sig=AQFlPXepbCEsmp4h12KBZ9uwRIaD77M-"
.company-target.com/	1970-01-21 03:53:05	Name: tuuid Value: a7647831-6a50-4189-97e7-556790972f4e
.company-target.com/	1970-01-21 03:53:05	Name: tuuid_lu Value: 1707425053\|ix:0\|mctv:0\|rp:0
.casalemedia.com/	1970-01-21 03:02:41	Name: CMID Value: ZcU9HrmqPHYAAGZuAApOywAA
.casalemedia.com/	1970-01-20 20:26:41	Name: CMPS Value: 1187
.casalemedia.com/	1970-01-20 20:26:41	Name: CMPRO Value: 1187
.tevora.com/	1970-01-20 20:26:41	Name: _gcl_au Value: 1.1.1585792327.1707425054
.tremorhub.com/	1970-01-21 03:03:01	Name: tvid Value: 6d32dab795fc4f10a4fcb3ebfec73c5b
.tremorhub.com/	1970-01-21 03:53:05	Name: tv_UIDM Value: a7647831-6a50-4189-97e7-556790972f4e
.doubleclick.net/	1970-01-20 18:17:05	Name: test_cookie Value: CheckForPermission
.tevora.com/	1970-01-20 22:36:17	Name: __hstc Value: 66129585.47af47413a87ac81cdd86e12c99960ca.1707425054734.1707425054734.1707425054734.1
.tevora.com/	1970-01-20 22:36:17	Name: hubspotutk Value: 47af47413a87ac81cdd86e12c99960ca
.tevora.com/	1969-12-31 23:59:59	Name: __hssrc Value: 1
.tevora.com/	1970-01-20 18:17:06	Name: __hssc Value: 66129585.1.1707425054734
.hubspot.com/	1970-01-20 18:17:06	Name: __cf_bm Value: BfFCwDAIPIF8TujMhG_Omdy7yZNUKtAR0SgxYZleIGA-1707425054-1-AdZhv7TxYhhqjBZitHv/4UE0aSGX1xlrMLaF00fg993MOlSCBskoGY4q8mICtznIQpXaXfe2RjJPNPmFtp5630c=
.hubspot.com/	1969-12-31 23:59:59	Name: _cfuvid Value: Cmh8IBRuyxv2fFoOxuXyTMZy0DChTNkTOgkOp.g1NVM-1707425054960-0-604800000
.www.tevora.com/	1970-01-21 03:02:41	Name: _zitok Value: 29b27ccbbe9e198948a61707425056
.zoominfo.com/	1970-01-20 18:17:06	Name: __cf_bm Value: t_kWTOlLp7Bibr0JMGNgGb3ZLNL32c3RnM.ebgkBHIw-1707425056-1-AXEj5hlhyCzDfmUBsQOxkLgOsycVluRjlw3T1fYTDTI5AeWIKAkqMv3h36zYdPsg6kSvtvSD0vFHloKnvqUfU+0=
.zoominfo.com/	1969-12-31 23:59:59	Name: _cfuvid Value: W48pbUCWa68xPcXm6_i0J7F.lsXV1ohbov6I4sq3OMQ-1707425056888-0-604800000

37 Console Messages

A page may trigger messages to the console to be logged. These are often error messages about being unable to load a resource or execute a piece of JavaScript. Sometimes they also provide insight into the technology behind a website.

Source	Level	URL Text
security	warning	Message: Error with Feature-Policy header: Origin trial controlled feature not enabled: 'interest-cohort'.
security	warning	Message: Error with Permissions-Policy header: Origin trial controlled feature not enabled: 'interest-cohort'.
security	error	URL: https://www.googletagmanager.com/gtag/js?id=G-S8Q6BRR8Y7&l=dataLayer&cx=c(Line 194) Message: Refused to connect to 'https://region1.analytics.google.com/g/collect?v=2&tid=G-S8Q6BRR8Y7&gtm=45je4270v9103278546z89104995285za200&_p=1707425053127&_gaz=1&gcd=13l3l3l3l1&npa=0&dma_cps=sypham&dma=1&cid=1091683361.1707425054&ul=en-us&sr=1600x1200&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&pscdl=noapi&_s=1&sid=1707425053&sct=1&seg=0&dl=https%3A%2F%2Fwww.tevora.com%2Fthreat-blog%2Ftargeting-msol-accounts-to-compromise-internal-networks%2F&dt=Targeting%20MSOL%20Accounts%20to%20Compromise%20Internal%20Networks%20Tevora&en=page_view&_fv=1&_nsi=1&_ss=1&tfd=1937' because it violates the following Content Security Policy directive: "connect-src 'self' https://forms.hsforms.com https://hubspot-forms-static-embed.s3.amazonaws.com https://cdn.acsbapp.com/ https://api.company-target.com https://js.zi-scripts.com https://api.hubapi.com https://forms.hscollectedforms.net https://tag-logger.demandbase.com https://yoast.com https://my.wpengine.com https://ws.zoominfo.com https://exceptions.hubspot.com https://segments.company-target.com *.googlesyndication.com googleads.g.doubleclick.net stats.g.doubleclick.net www.google-analytics.com ampcid.google.com analytics.google.com about: maps.googleapis.com maps.google.com translate.googleapis.com www.googletagmanager.com".
security	error	URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/ Message: Refused to load the image 'https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-S8Q6BRR8Y7&cid=1091683361.1707425054&gtm=45je4270v9103278546z89104995285za200&aip=1&dma=1&dma_cps=sypham&gcd=13l3l3l3l1&npa=0&z=824874016' because it violates the following Content Security Policy directive: "img-src 'self' data: https://id.rlcdn.com https://px.ads.linkedin.com https://forms.hsforms.com https://forms-na1.hsforms.com https://segments.company-target.com https://px4.ads.linkedin.com https://track.hubspot.com https://dify.wpengine.com https://pixel.wp.com https://www.linkedin.com https://en.wordpress.com https://static.hsappstatic.net s.w.org ps.w.org ts.w.org secure.gravatar.com www.gravatar.com .googlesyndication.com stats.g.doubleclick.net data: blob: google-analytics.com www.google-analytics.com ssl.google-analytics.com www.google.com .googleapis.com maps.google.com maps.gstatic.com www.gstatic.com *.ggpht.com translate.googleapis.com translate.google.com i.ytimg.com www.googletagmanager.com".
network	error	URL: https://id.rlcdn.com/464526.gif Message: Failed to load resource: the server responded with a status of 451 ()
security	error	URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/ Message: Refused to load the image 'https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j101&tid=UA-16460355-1&cid=1091683361.1707425054&jid=1904680482&_u=YADAAEAAAAAAACAAI~&z=488825966' because it violates the following Content Security Policy directive: "img-src 'self' data: https://id.rlcdn.com https://px.ads.linkedin.com https://forms.hsforms.com https://forms-na1.hsforms.com https://segments.company-target.com https://px4.ads.linkedin.com https://track.hubspot.com https://dify.wpengine.com https://pixel.wp.com https://www.linkedin.com https://en.wordpress.com https://static.hsappstatic.net s.w.org ps.w.org ts.w.org secure.gravatar.com www.gravatar.com .googlesyndication.com stats.g.doubleclick.net data: blob: google-analytics.com www.google-analytics.com ssl.google-analytics.com www.google.com .googleapis.com maps.google.com maps.gstatic.com www.gstatic.com *.ggpht.com translate.googleapis.com translate.google.com i.ytimg.com www.googletagmanager.com".
network	error	URL: https://api.company-target.com/api/v2/ip.json?referrer=&page=https%3A%2F%2Fwww.tevora.com%2Fthreat-blog%2Ftargeting-msol-accounts-to-compromise-internal-networks%2F&page_title=Targeting%20MSOL%20Accounts%20to%20Compromise%20Internal%20Networks%20Tevora Message: Failed to load resource: the server responded with a status of 401 ()
other	warning	URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
security	error	URL: https://snap.licdn.com/li.lms-analytics/insight.min.js Message: Refused to connect to 'https://px.ads.linkedin.com/wa/' because it violates the following Content Security Policy directive: "connect-src 'self' https://forms.hsforms.com https://hubspot-forms-static-embed.s3.amazonaws.com https://cdn.acsbapp.com/ https://api.company-target.com https://js.zi-scripts.com https://api.hubapi.com https://forms.hscollectedforms.net https://tag-logger.demandbase.com https://yoast.com https://my.wpengine.com https://ws.zoominfo.com https://exceptions.hubspot.com https://segments.company-target.com *.googlesyndication.com googleads.g.doubleclick.net stats.g.doubleclick.net www.google-analytics.com ampcid.google.com analytics.google.com about: maps.googleapis.com maps.google.com translate.googleapis.com www.googletagmanager.com".
other	warning	URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
security	error	URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/ Message: Refused to load the image 'https://www.google.de/pagead/1p-user-list/1016308136/?random=1707425054275&cv=11&fst=1707422400000&bg=ffffff&guid=ON&async=1&gtm=45be4270za200&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.tevora.com%2Fthreat-blog%2Ftargeting-msol-accounts-to-compromise-internal-networks%2F&frm=0&tiba=Targeting%20MSOL%20Accounts%20to%20Compromise%20Internal%20Networks%20Tevora&npa=0&data=event%3Dgtag.config&fmt=3&is_vtc=1&cid=CAQSGwAvHhf_WfiUEGGv9VnGw3IkcvuH5mSsRo1LUQ&random=2989630854&rmt_tld=1&ipr=y' because it violates the following Content Security Policy directive: "img-src 'self' data: https://id.rlcdn.com https://px.ads.linkedin.com https://forms.hsforms.com https://forms-na1.hsforms.com https://segments.company-target.com https://px4.ads.linkedin.com https://track.hubspot.com https://dify.wpengine.com https://pixel.wp.com https://www.linkedin.com https://en.wordpress.com https://static.hsappstatic.net s.w.org ps.w.org ts.w.org secure.gravatar.com www.gravatar.com .googlesyndication.com stats.g.doubleclick.net data: blob: google-analytics.com www.google-analytics.com ssl.google-analytics.com www.google.com .googleapis.com maps.google.com maps.gstatic.com www.gstatic.com *.ggpht.com translate.googleapis.com translate.google.com i.ytimg.com www.googletagmanager.com".
security	error	URL: https://js.hs-analytics.net/analytics/1707424800000/7013481.js(Line 19) Message: Refused to load the script 'https://js-na1.hs-scripts.com/7013481.js' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.addtoany.com https://js.hsforms.net https://acsbapp.com https://js.hs-scripts.com https://snap.licdn.com https://tag.demandbase.com https://js.zi-scripts.com https://js.hs-banner.com https://js.hscollectedforms.net https://js.hs-analytics.net https://js.hsadspixel.net/ https://www.google.com https://www.gstatic.com/ https://yoast.com https://stats.wp.com https://widgets.wp.com https://s0.wp.com https://js.hubspot.com www.googletagservices.com .googlesyndication.com .googleadservices.com googleads.g.doubleclick.net adservice.google.com adservice.google.ae adservice.google.al adservice.google.at adservice.google.be adservice.google.bg adservice.google.bs adservice.google.ca adservice.google.ch adservice.google.ci adservice.google.cl adservice.google.co.bw adservice.google.co.cr adservice.google.co.id adservice.google.co.il adservice.google.co.in adservice.google.co.jp adservice.google.co.ke adservice.google.co.kr adservice.google.co.mz adservice.google.co.nz adservice.google.co.th adservice.google.co.tz adservice.google.co.uk adservice.google.co.uz adservice.google.co.ve adservice.google.co.za adservice.google.co.zm adservice.google.co.zw adservice.google.com.ai adservice.google.com.ar adservice.google.com.au adservice.google.com.bd adservice.google.com.bh adservice.google.com.bn adservice.google.com.bo adservice.google.com.br adservice.google.com.co adservice.google.com.cy adservice.google.com.ec adservice.google.com.eg adservice.google.com.et adservice.google.com.fj adservice.google.com.gh adservice.google.com.gi adservice.google.com.gt adservice.google.com.hk adservice.google.com.jm adservice.google.com.kh adservice.google.com.kw adservice.google.com.lb adservice.google.com.mm adservice.google.com.mt adservice.google.com.mx adservice.google.com.my adservice.google.com.ng adservice.google.com.ni adservice.google.com.np adservice.google.com.om adservice.google.com.pa adservice.google.com.pe adservice.google.com.ph adservice.google.com.pk adservice.google.com.pr adservice.google.com.py adservice.google.com.qa adservice.google.com.sa adservice.google.com.sg adservice.google.com.sv adservice.google.com.tr adservice.google.com.tw adservice.google.com.ua adservice.google.com.uy adservice.google.com.vn adservice.google.cz adservice.google.de adservice.google.dk adservice.google.dz adservice.google.ee adservice.google.es adservice.google.fi adservice.google.fr adservice.google.ge adservice.google.gr adservice.google.gy adservice.google.hn adservice.google.hr adservice.google.hu adservice.google.ie adservice.google.im adservice.google.iq adservice.google.is adservice.google.it adservice.google.jo adservice.google.kz adservice.google.li adservice.google.lk adservice.google.lt adservice.google.lu adservice.google.lv adservice.google.md adservice.google.mk adservice.google.mu adservice.google.nl adservice.google.no adservice.google.pl adservice.google.pt adservice.google.ro adservice.google.rs adservice.google.ru adservice.google.se adservice.google.si adservice.google.sk adservice.google.so adservice.google.sr adservice.google.tl adservice.google.tn adservice.google.tt google-analytics.com www.google-analytics.com ssl.google-analytics.com stats.g.doubleclick.net ajax.googleapis.com maps.googleapis.com maps.google.com translate.googleapis.com translate.google.com www.googletagmanager.com googletagmanager.com tagmanager.google.com". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.
other	warning	URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.
other	warning	URL: https://www.tevora.com/threat-blog/targeting-msol-accounts-to-compromise-internal-networks/ Message: Third-party cookie will be blocked. Learn more in the Issues tab.

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header	Value
Content-Security-Policy	default-src 'self' 'unsafe-inline' 'unsafe-eval' data: ; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://static.addtoany.com https://js.hsforms.net https://acsbapp.com https://js.hs-scripts.com https://snap.licdn.com https://tag.demandbase.com https://js.zi-scripts.com https://js.hs-banner.com https://js.hscollectedforms.net https://js.hs-analytics.net https://js.hsadspixel.net/ https://www.google.com https://www.gstatic.com/ https://yoast.com https://stats.wp.com https://widgets.wp.com https://s0.wp.com https://js.hubspot.com www.googletagservices.com .googlesyndication.com .googleadservices.com googleads.g.doubleclick.net adservice.google.com adservice.google.ae adservice.google.al adservice.google.at adservice.google.be adservice.google.bg adservice.google.bs adservice.google.ca adservice.google.ch adservice.google.ci adservice.google.cl adservice.google.co.bw adservice.google.co.cr adservice.google.co.id adservice.google.co.il adservice.google.co.in adservice.google.co.jp adservice.google.co.ke adservice.google.co.kr adservice.google.co.mz adservice.google.co.nz adservice.google.co.th adservice.google.co.tz adservice.google.co.uk adservice.google.co.uz adservice.google.co.ve adservice.google.co.za adservice.google.co.zm adservice.google.co.zw adservice.google.com.ai adservice.google.com.ar adservice.google.com.au adservice.google.com.bd adservice.google.com.bh adservice.google.com.bn adservice.google.com.bo adservice.google.com.br adservice.google.com.co adservice.google.com.cy adservice.google.com.ec adservice.google.com.eg adservice.google.com.et adservice.google.com.fj adservice.google.com.gh adservice.google.com.gi adservice.google.com.gt adservice.google.com.hk adservice.google.com.jm adservice.google.com.kh adservice.google.com.kw adservice.google.com.lb adservice.google.com.mm adservice.google.com.mt adservice.google.com.mx adservice.google.com.my adservice.google.com.ng adservice.google.com.ni adservice.google.com.np adservice.google.com.om adservice.google.com.pa adservice.google.com.pe adservice.google.com.ph adservice.google.com.pk adservice.google.com.pr adservice.google.com.py adservice.google.com.qa adservice.google.com.sa adservice.google.com.sg adservice.google.com.sv adservice.google.com.tr adservice.google.com.tw adservice.google.com.ua adservice.google.com.uy adservice.google.com.vn adservice.google.cz adservice.google.de adservice.google.dk adservice.google.dz adservice.google.ee adservice.google.es adservice.google.fi adservice.google.fr adservice.google.ge adservice.google.gr adservice.google.gy adservice.google.hn adservice.google.hr adservice.google.hu adservice.google.ie adservice.google.im adservice.google.iq adservice.google.is adservice.google.it adservice.google.jo adservice.google.kz adservice.google.li adservice.google.lk adservice.google.lt adservice.google.lu adservice.google.lv adservice.google.md adservice.google.mk adservice.google.mu adservice.google.nl adservice.google.no adservice.google.pl adservice.google.pt adservice.google.ro adservice.google.rs adservice.google.ru adservice.google.se adservice.google.si adservice.google.sk adservice.google.so adservice.google.sr adservice.google.tl adservice.google.tn adservice.google.tt google-analytics.com www.google-analytics.com ssl.google-analytics.com stats.g.doubleclick.net ajax.googleapis.com maps.googleapis.com maps.google.com translate.googleapis.com translate.google.com www.googletagmanager.com googletagmanager.com tagmanager.google.com; style-src 'self' 'unsafe-inline' data: https://s0.wp.com https://widgets.wp.com fonts.googleapis.com 'unsafe-inline' maps.googleapis.com maps.google.com translate.googleapis.com www.googletagmanager.com tagmanager.google.com; img-src 'self' data: https://id.rlcdn.com https://px.ads.linkedin.com https://forms.hsforms.com https://forms-na1.hsforms.com https://segments.company-target.com https://px4.ads.linkedin.com https://track.hubspot.com https://dify.wpengine.com https://pixel.wp.com https://www.linkedin.com https://en.wordpress.com https://static.hsappstatic.net s.w.org ps.w.org ts.w.org secure.gravatar.com www.gravatar.com .googlesyndication.com stats.g.doubleclick.net data: blob: google-analytics.com www.google-analytics.com ssl.google-analytics.com www.google.com .googleapis.com maps.google.com maps.gstatic.com www.gstatic.com .ggpht.com translate.googleapis.com translate.google.com i.ytimg.com www.googletagmanager.com; connect-src 'self' https://forms.hsforms.com https://hubspot-forms-static-embed.s3.amazonaws.com https://cdn.acsbapp.com/ https://api.company-target.com https://js.zi-scripts.com https://api.hubapi.com https://forms.hscollectedforms.net https://tag-logger.demandbase.com https://yoast.com https://my.wpengine.com https://ws.zoominfo.com https://exceptions.hubspot.com https://segments.company-target.com .googlesyndication.com googleads.g.doubleclick.net stats.g.doubleclick.net www.google-analytics.com ampcid.google.com analytics.google.com about: maps.googleapis.com maps.google.com translate.googleapis.com www.googletagmanager.com; font-src 'self' data: https://s0.wp.com data: fonts.gstatic.com fonts.googleapis.com; object-src 'self' ; media-src 'self' ; frame-src 'self' https://static.addtoany.com https://s.company-target.com https://td.doubleclick.net https://www.google.com https://static.hsappstatic.net https://app.hubspot.com https://widgets.wp.com https://forms.hsforms.com *.googlesyndication.com googleads.g.doubleclick.net maps.googleapis.com maps.google.com www.youtube.com www.googletagmanager.com; child-src 'self' www.youtube.com www.googletagmanager.com; worker-src 'self' blob:; upgrade-insecure-requests; block-all-mixed-content; report-uri https://www.tevora.com?gdsih-csp-report;
Strict-Transport-Security	max-age=31536000; includeSubDomains
X-Content-Type-Options	nosniff
X-Frame-Options	SAMEORIGIN
X-Xss-Protection	1; mode=block; report=https://www.tevora.com?gdsih-xxp-report;

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

acsbapp.com
api.company-target.com
api.hubapi.com
cdn.acsbapp.com
dsum-sec.casalemedia.com
fonts.googleapis.com
fonts.gstatic.com
forms-na1.hsforms.com
forms.hscollectedforms.net
forms.hsforms.com
googleads.g.doubleclick.net
id.rlcdn.com
js-na1.hs-scripts.com
js.hs-analytics.net
js.hs-banner.com
js.hs-scripts.com
js.hsadspixel.net
js.hscollectedforms.net
js.hsforms.net
js.zi-scripts.com
partners.tremorhub.com
pixel.rubiconproject.com
pixel.wp.com
px.ads.linkedin.com
px4.ads.linkedin.com
s.company-target.com
snap.licdn.com
static.addtoany.com
stats.g.doubleclick.net
stats.wp.com
tag.demandbase.com
track.hubspot.com
ws.zoominfo.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.gstatic.com
www.tevora.com
js-na1.hs-scripts.com
px.ads.linkedin.com
www.google.de
104.18.36.155
13.107.42.14
172.64.150.44
18.245.46.25
18.66.97.20
192.0.76.3
2600:1f18:612b:4216:4246:5d9e:b167:57c0
2606:4700:10::6816:1cc
2606:4700:10::6816:47c5
2606:4700:10::ac43:b9b
2606:4700:4400::ac40:991b
2606:4700::6810:50ba
2606:4700::6810:880f
2606:4700::6810:8bce
2606:4700::6810:bb59
2606:4700::6811:589a
2606:4700::6811:cccc
2606:4700::6811:e6a3
2606:4700::6812:b07d
2606:4700::6812:c07d
2606:4700::6813:9a53
2620:1ec:21::14
2a00:1450:4001:80b::2002
2a00:1450:4001:80b::200a
2a00:1450:4001:811::2008
2a00:1450:4001:829::200e
2a00:1450:4001:82a::2003
2a00:1450:4001:82b::2004
2a00:1450:4001:830::2003
2a00:1450:400c:c00::9b
2a02:26f0:3500:16::215:1496
34.96.71.22
35.190.152.144
35.244.174.68
69.173.144.165
004e2313f859cd17b06984b71ba85edf3e02a74c2fcdf09ce4616ef63d8b37e5
00501810e93307a8882a74d864e7547fd1458deea539361dc1124ac133799a4b
009ec9e1009ecfb9d317cf7b60199e810fa268b3e5292cf24baea3876cc790b1
02f412f7c8b7b2b0d81c8259b96369f39d4a1e8432ced663ec4c8e5e02e3a0f9
0301b4256760793e6413772460ced32b76fcfe52fa9c89428d51adb26f767844
044efea78208376302aad3808aaabdf3c2f7bdd80ba9d55c9e0e4d3baa7a3908
08756c47213d461baa3b01f42448a76d11f524470c7a34f9018733889bd4f49c
0d91532d06a2f73d3f280b8990686e5835aacd299d1ae6956200ccf374580c40
0df0dbe8aa9236ec3d8341fa9becbc2c63e2ecb39912f00bb6049e100c491e30
10d3ba7ff310b5e29ee1bc00445a95b4b5da34f1b8ea2797455ea1b83039d8f9
1170849a1f6deb911dc030011d8bcc57a6caaf659343e66114fb2f87369ed40e
11e256253ef3b15cfd4ba2540fb4e8ba870654fbef01d66511105e876f908ab4
1450d66599b38ae575a683399638da9584b1abe8eea5c4816ad27235f5e9094c
171adc86ee544243b9713665b02b4fa251be21e622848a64166ac34cfc8bfcb1
19aa17672f5a6ebc71e52740ad6599892e2cb42fd76ee730f1d3f07d332c5c3e
1b9efb22c938500971aac2b2130a475fa23684dd69e43103894968df83145b8a
1bfc45674a0697b5b0799898a1334e300783244d97f243a85c714b0941ab148f
1d3bf22bec92f229749f3ee891d3708708aa45f5a018706ac38b9c12c87b1403
1eae30e4c596dfc837f797cd98a296c9d9d1ae6e89dbb1c9bbf122b5261798b1
20652052f52ae7ae3488a11de94060c462d57234cb839c9d69479ef9a5dc65e2
211fdb26a74dac46f2bd297c0f02953de9e69355035cad239d87acf21c5a6a0e
219b652de3176257072749c876811cc963494f5fbdee3f92eb38e7392f724ce0
230265a4a8ecf231ed02be9b45be405c76956bfc31dd67556147c1d106b3d8ac
2351c9050b274736629245447236a1763f4946ec7d221f97b02d050bef93ad72
274d4116239b63097bb7c16e56e27cbb5a77be20392fb8e2317c0a0235185cad
2825d24e74d5907dff2d834775792730e52f2f885086378e4adc220b995a5930
2855d95ed2613ea6a8b1f447a8273286885522d110e1e4d53b06bedea6f12dc6
2910031d2b8ed2e463b7c3f765af71bdde3a2142e363c56c95234f91c9069fc4
29bef405f29d190c2a055a173551ad73f488ae4fa96191830115649a7b413646
2ccd3b1f2416e64e3c1b16943db539d335f8c35886543a88a3f16fef2bc9e9b5
2e10d353ff038c2cad3492fc17801af3e6ef2669c9e9713bdb78b1dcb104c4fe
30656ac05ad6e64d72af7a507a24c770194508f2f90e161be04b645c04504abf
31d3597c13825747741e10fe906c470292169c0b7c263c9fb6bab164f94f8a06
32acbaf49df946ebb1f9958224f92100b9dca8fa41d0e4ca354d43f08f6f20d1
32ec92d7a08198689be406ed2ce826d74e9a129587d043eaf334031372af057d
357452f2a55c999ddd3afdcbce2c339d41cf7a01613d9d45ff88a753bb82f21d
3668f6d335416599574fb1f336cbd2b9bb2f8fcff63e63a9ca3b68df4d0c6165
370d29dc028dade2550da75381274a8e27d25ccf7af72f430cb82e1a347c67eb
38c8f950324b21bcc81cb1aa593f45b9fe31a56a41378ec803b09e69a0210614
3b918b6cef39462c9fed66b7ce89d8fd5fe04984c12f689e88327a703d738a0a
3dab93242ee573bbcfc22c9d15acd47794e500ed44e6bd48a35400b39d65aa43
3e253b66056519aa065b00a453bac37ac5ed8f3e6fe7b542e93a9dcdcc11d0bc
42287925d01999d4f4a32a2463947d1e7c0ebb8978c06ed7e818682ef161b0cd
42ede4fe88145fa0cacedaf83a4518f1542a6f5d94025528a7cfba0c6f8a1ead
44b988703019cd6bfa86c91840fecf2a42b611b364e3eea2f4eb63bf62714e98
453cb806084fdabec32e286af2e88899f79022125c2527afffbec507975d2c22
463d09552783494b59878f72b1c512d7e15c11c7db3b0d219e8d491a4a20b6d4
48d09e18d6ceed3a540871588c8f0e83a088986e142fb72d61e241d49d0489c7
492ffabf8d198a2460912fb2a5232ac32e815c7cc7b299b5157072d181a86d99
49eed4fb8b8326551b840b96cf3b7f661441e5a03b6734c0221d142180724157
4a39ef0ef5920d4a604b3da13cf0be683fc0cb338579b49b529555cbeead4928
4b8f3924d5f17f09df639cb030ebe4f7cf5b0f1601ab87472c563c4bff7e784f
4f79a89d16a5f717110fe080c0bf90b7e05ff95a4c4983f64d33110bf5f9c230
4f9f4e2e225088f9cf3b6b54aa421e0f776d1802255505d2f752e1f83f441641
50679e0e3933c945348a2db0cc128bb14b57a60a74fabf8cae13acc14efbb2e1
508e1915a0ae16b61b44e96f3035dbeaea19045038393657560f072bcd82bc5e
5274f11e6fb32ae0cf2dfb9f8043272865c397a7c4223b4cfa7d50ea52fbde89
5286b81d1c8cd4d63918dda0fce1d0947ceb756edd1e0131d345a5e20d90e0f4
53d88527a3e49d19a9bede4b1bba96bb53fe1fcfde86920c21586fe333a233e7
55eaf62cb05da20088dc12b39d7d254d046cb1fd61ddf3ae641f1439efd0a5ee
572e5e4a394913b6c3c000f37295ba6da7f7cadd25e3c70c7552e90b9f99ac58
58606f6e16ac645af86bd0b74a2b20ca8541661067c5c9541ccb6a458c3ab419
5a8c1e7681318caa29e9f44e8a6e271f6a4067a2703e9916dfd4fe9099241db7
5aa02ad9ec4550065de8002ea1108be5d10bbb1173d2f3447f88ce1af317d4bd
5d18147c68b333c1e9327542ffddf90667643bb1315cfc2d337c2ff01a258708
65b5262a91bd3bcd0fe0ad2214f6d5a473b2d7d005bc81ffacd1482696f8e26b
698b89c0da3d319754d6a837b5e6d4e6a42dc402d9ffd7559b8c4cb29c644340
6a9aeb4c22c8a3f018879d40d2379918286ff8c2026be2679c50e01a5f777b2e
6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
6f1fdb05f39561628f6a4ce26a93bd3273efb57e0b0285b1c4c09cc2885e2a2d
6fa82bb0bdde33f4b3af3f189b8dee0549a48358d4c21c6bcd2239dbb1b575fb
74ec1e2bfcf647ccdeaf5b127294db846ee4a6f8ffd6c909d4938370d4187d1f
7778f96a9e00a7916499bc8d4dc59f288f27701ea6c1e384631d45b66fe42848
7859a62e04b0acb06516eb12454de6673883ecfaeaed6c254659bca7cd59c050
792f045fb88687b355c7fb9db033737612528d5beb826d85cd2ff368ed6e744f
7af448d4d07afce5edebdd0648469678e418c9d8e45ef56a23f91d0a5c64a6e3
7b5a635f04d6238cbd91ed03089a7555ee28819eb9b92c9a682c0af00b49cfea
7ba57ee8157cb7a61c287134db7b180d2aa2a4d326277aea97dd444ea7c4e600
7c326f96b9af470b51c887a189b1f81d241d6beef4844b37c8add5144fa6f55d
7e4bd1bfb0e844f06b8dd49f472969dc4d52987a747493f44055170ecd4218aa
7f9daed000021c96e3353a5b331baa4443cdcfd11737976cd8b2f6821eabf65c
81264db4635426a010998b8de0c70f464b9c6de7c68c0223a94ee939943f04cc
83254569c5a8ee71c2a1a3abbdd9d848b6a4ff0b5c700b30cc2fa27b086e19db
8495dc9f62bda607389501ea00518d9d2c2628a35dab4b9a8d3261f08de43d23
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
886e1e675050878cd1710ba030a7787613e5bbbe02a2b099683306c16ac8c8cd
88f04c38ef32bb9fb2e7a2a9a1dd888568caf26fd202a9a038ca2532d3b36ce5
898be9f6701716fa35fa8e04612504a7d77e6b09f20a4ef204151cdb1913a0b5
89c62095126fca89ea1511cf35b49b8306162946b0c26d6f60c5506c51d85992
8a3d8c061a2a585985a71d5b1a45c424c5bc79b310c86b4731b5bececf5ea5df
8c9cb85abf40b913e6c24e1d855e6a3153a84266a165154d0263e23d56811f83
8cf4cfc0fb5acfcc2bc69c7824c633feb4063be8fc5505f7873df949f8becf29
8d38189049ce55b1e1baee06c5e6d656da9a1a44125d75d70437bc4a00a27628
8db2ce6ec1b1ffab44752e8dfbabb19e78f77d8cd133b8ee3741dea9c373bb10
901b9ea57c9690cf801d6f11483eb53d1abdc699b8ff41075453c959ceefa1dc
90308c3581c20a582429698cf03129c3270bd727844fcefab5ce4433b2c01c24
91d1bde942744d48fec9019c7b87b351f7a165e544d59fcbb4e43f3309be4ab9
9de3c2573bc024f36ab74f0a9b8eacf7e3154e4e8b074a54686b1884ec4f00b5
9ee1397f4da0e0c981a979bc1ea43be1d0c28bf3619636df8ab9dc09fa770aaf
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a204849a0777563cc401d76d1a8e1ab5c5a6c554d391c0b24493985b4a4f42af
a699fc08da29f99f1f5fa047d4c6694075296b3faf71b0bb9f42f0de53ce14c8
a8d1708b200629891cf19efa1b05c0d88fb08c27c51952f4814e4e10bda12ffd
a8e429611131e3fdc2018ec943a36100dbabb4aaa788c8dead6bdcf927917293
aa02b4de96ba9195dba69d9122f69ae7b3e5cbce8e244f2b2cdda47e04602805
aa14fae610e174ef0ba655aaf648fbe8fb0fae14c0105f3dad69882ee55ae3a0
aec60bc104db041b1512185839f18f52986df7e569e5445f740dd60f763fbca8
b035fd2b48041f766aa4a49965f573ef9488d14d8dc694d2923e7b41772f7357
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b199ed28ba39e8d3bdc0d2860b8f710808796f2c7272406178010428f509d397
b232fdcfea9d3c1d5f1f568237126524d3738e9b54b03a193ed688aed1e47e7c
b2a231865753bfcf78cae3cd6967e79bff574a1685e0170e8b9e7219bedd6e7c
b5474d3ed408366dcebededf5c987f44b43b389137272c282c6c972852a14fc0
b74fd28a1590e1487aae342b683a8309618abbe55a41bca806f4004545d49c28
b7908a015a567ec2363011df2475368dbff34360e9da3fdff50604d6395fb646
b92f948f2d43b317da896694312f7f62bfdc13b4fe0626fb16606e6760b036a5
bd92564857cdb83242b7602bb5d249b54dc78ff55c6d28e21e3bd90b1b3e7b3b
bfae35edc61595bd27d16c01ddc44ef00c152c0006e16f836101d3b6a6621d01
c19e3e4151ea4933fa9ba9703c51fe20ad469237771214b1c5001d1b107ddef5
c6d8c2087d93bf1e24a9893d020eee0663562626165ce6da54935a7b8d42b4a7
c716b5c4e4e7ba75afde24c6da8acf13eb9b8b33933adc07ea4da9c82833f733
c912a9ce0c3122d4b2b29ad26bfe06b0390d1a5bdaa5d6128692c0befd1dfbbd
cb6f2d32c49d1c2b25e9ffc9aaafa3f83075346c01bcd4ae6eb187392a4292cf
cc130a0066b09d481462e46b1f3f4cb35778984010a3620b37ddadcbdc98e86c
cd4ea0c51ab60a7a520269e7634dfd43ca5bd23b589305247926d188514a7c43
cdfb561f539e86f53b729e02c12846d6b18970351e48b5305539697e16a9a184
cead85a9301fa26a500daf2746e729c54644425abed2dddcca7afb07aaabb050
cfc4cf057c03a209180e8741b14d52c3c56c8651dcf8228170a0bc6a50ec1ac9
d089c8a9fc28e4e50223eb38c9409e362521be9380a37341304fbac7a4cd9e5f
d275b3cdd830f9c022c8a16779b9ee242515cd6b14ac8d7e266bc9fa0d4b7a7a
d36723abef18616fa3fd4ca645638b74a655be246b374b909aaea89245d645ba
da3a11158cfd564619555243faa9db23da88fdc7bcc846f14a768d5df2d0b9a8
dc111a70984a9eda00752b06277113029ef288f1125c31eff2477413e15e8aa4
dc8e317c924d49916e599d91520cb5f64eb9b1ff74120e5d058ca526d0ec6266
dd2ec14eb58c28a584f757fc0fef324217b7a15173a907713c248510816c04dd
ddbda21655c0c2cb09913a9e33d856a8b8f3e1eae610cdbda8524def2dc71f7d
de2c9627201af7d0127e2eed55f52f88a2ae16e18ef7c13cbc40b6299af8743c
de36e50194320a7d3ef1ace9bd34a875a8bd458b253c061979dd628e9bf49afd
e0893208fc69a8da3d062b64686c2c3b0c74711453ffd65fa2cc1bdbba838f50
e13709c99b05193f622ad34d5f2bdf66cb9aa56f12356acf96b6e540bd5f8338
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e50d6185fd72dc1b6907ecf86c58663bc7e7f8192b9d5c93ddec23f4ae123f12
e8980ff784eec4d49d1400eda42338778189558466b133dd4c7aa53ad24237a8
eb3fd6be8ccb11f7eca998573b38dbe848e843d05162d1da0280f09db9a05b58
ec7dae37ddfa1cad5b97235b8d26b0d3eb8351c944fb065d5bf81d6ae73d7a09
ee85f1d740c49f41a84b78243c3d33734d70242ce9ee07778d53fcbba4347db3
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
efe93e12c81a6b8187b2c1c88f4225635c28101d87ad79caef6602b7b39b9034
f03e5cad9b2decaf7f877a1cb88debf3d8ac7870c6823bb6dbf19527eff775f4
f11b0f814bae302ef94c2a847b6dc8b06a48b50cd3fab1357945d7574bec3bf5
f158b8591a08b6c02bb345ae96dd62f0c632f7f635bb4a5f449fce24bdc11789
f1a55ab2c17e454e85736fee568bebeada6c4fa49f6b2dad54d4387a51b772bf
f3a8992acb9ab911e0fa4ae12f4b85ef8e61008619f13ee51c7a121ff87f63b1
f5aebdfea35d1e7656ef4acc5db1f243209755ae3300943ef8fc6280f363c860
f5bbb6a04570e63a0c07b7aca153124c7d67d1c1d27ce991126d327a76574dfb
f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
f68868b8e87e173e3410a669f7d8aaf755e6af31103c80e2dc26ac7310c68621
f72b0c5d6f07db8804bbfa6ca2008fd1cc1a450db396fa8e7c5b90c702a3187d
f85b7117d868138012e3893329afebe0a368309d987ff678fdae40e5747ad28d
fc6313694fdbf1135a24bbad5d23cd94ed733f3010bd2da5f35f193ceb3cbea7
fef367294f4fad7012903de7ac80229115d3a75f4d199490156547d71849f86a

www.tevora.com Open in urlscan Pro 35.190.152.144 Public Scan

Summary

urlscan.io Verdict: No classification

Domain & IP information

Screenshot Live screenshot Full Image

Page Title

Detected technologies

Page Statistics

187 Requests

96 %HTTPS

71 %IPv6

30 Domains

39 Subdomains

35 IPs

4 Countries

2777 kBTransfer

6938 kBSize

26 Cookies

14 Outgoing links

Redirected requests

187 HTTP transactions Everything HTML Script AJAX CSS Image Expand all 0 data transactions

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

Response headers

Request headers

www.tevora.com Open in urlscan Pro
35.190.152.144 Public Scan

Screenshot
Live screenshot

Full Image

187
Requests

96 %
HTTPS

71 %
IPv6

30
Domains

39
Subdomains

35
IPs

4
Countries

2777 kB
Transfer

6938 kB
Size

26
Cookies

187 HTTP transactions
0 data transactions