urlscan.io logo urlscan.io
SecurityTrails logo

www.cyberark.com
104.16.69.86  Public Scan Open in urlscan Pro

Go To Rescan Add Verdict Report
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authenticati... 9yr old
Submission: On March 14 via api from RU — Scanned from IL
 Behaviour Indicators
Similar DOM Content API
Verdicts

Summary

This website contacted 75 IPs in 7 countries across 64 domains to perform 225 HTTP transactions. The main IP is 104.16.69.86, located in Ascension Island and belongs to CLOUDFLARENET - Cloudflare, Inc., US. The main domain is www.cyberark.com. The Cisco Umbrella rank of the primary domain is 428640. 9yr old
TLS certificate: Issued by WE1 on February 22nd 2026. Valid for: 3mo.
This is the only time www.cyberark.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
1 27 104.16.69.86 13335 (CLOUDFLAR...)
30 18.66.102.30 16509 (AMAZON-02)
7 104.17.25.14 13335 (CLOUDFLAR...)
9 18.173.205.109 16509 (AMAZON-02)
5 142.250.201.74 15169 (GOOGLE)
9 23.52.181.12 16625 (AKAMAI-AS)
1 108.138.7.50 16509 (AMAZON-02)
4 142.251.141.104 15169 (GOOGLE)
3 34.117.77.79 396982 (GOOGLE-CL...)
2 23.67.142.205 16625 (AKAMAI-AS)
5 142.250.201.163 15169 (GOOGLE)
1 54.146.227.19 14618 (AMAZON-AES)
2 176.34.239.19 16509 (AMAZON-02)
9 50.16.211.97 14618 (AMAZON-AES)
5 18.66.122.78 16509 (AMAZON-02)
4 104.102.33.245 16625 (AKAMAI-AS)
1 151.101.1.140 54113 (FASTLY)
1 23.55.161.151 20940 (AKAMAI-AS...)
2 57.144.244.128 32934 (FACEBOOK)
4 108.138.26.44 16509 (AMAZON-02)
5 3.229.217.25 14618 (AMAZON-AES)
2 35.204.89.238 396982 (GOOGLE-CL...)
1 18.245.60.124 16509 (AMAZON-02)
2 18.172.114.101 16509 (AMAZON-02)
3 9 142.251.151.119 15169 (GOOGLE)
1 2 54.78.54.11 16509 (AMAZON-02)
1 18.245.46.25 16509 (AMAZON-02)
2 172.217.168.78 15169 (GOOGLE)
1 192.28.164.179 15224 (OMNITURE)
3 5 142.251.127.157 15169 (GOOGLE)
1 2 52.18.115.33 16509 (AMAZON-02)
1 1 34.240.240.83 16509 (AMAZON-02)
1 63.140.62.200 16509 (AMAZON-02)
1 18.66.122.49 16509 (AMAZON-02)
1 151.101.65.140 54113 (FASTLY)
1 151.101.129.140 54113 (FASTLY)
2 5 150.171.22.12 8075 (MICROSOFT...)
1 1 104.18.41.41 13335 (CLOUDFLAR...)
2 3 216.58.206.66 15169 (GOOGLE)
6 172.217.16.195 15169 (GOOGLE)
2 57.144.244.1 32934 (FACEBOOK)
5 192.28.164.244 15224 (OMNITURE)
14 19 52.223.40.198 16509 (AMAZON-02)
1 65.8.101.109 16509 (AMAZON-02)
1 3.211.70.183 14618 (AMAZON-AES)
1 34.96.71.22 396982 (GOOGLE-CL...)
2 18.66.102.85 16509 (AMAZON-02)
2 142.251.127.154 15169 (GOOGLE)
1 3 104.18.26.193 13335 (CLOUDFLAR...)
1 34.225.5.229 14618 (AMAZON-AES)
1 2 69.173.144.165 26667 (RUBICONPR...)
1 18.173.205.94 16509 (AMAZON-02)
2 216.239.36.181 15169 (GOOGLE)
2 2 37.252.171.53 29990 (ASN-APPNEXUS)
1 1 142.251.37.2 15169 (GOOGLE)
3 5 37.252.171.21 29990 (ASN-APPNEXUS)
2 4 74.121.140.211 30419 (PAEDAE-INC)
3 4 69.173.144.138 26667 (RUBICONPR...)
1 104.18.27.193 13335 (CLOUDFLAR...)
4 4 142.251.141.66 15169 (GOOGLE)
3 3 35.214.136.108 19527 (GOOGLE-2)
21 26 34.7.37.3 396982 (GOOGLE-CL...)
1 51.38.120.206 16276 (OVH OVH SAS)
1 18.245.46.60 16509 (AMAZON-02)
4 4 3.125.70.222 16509 (AMAZON-02)
1 1 46.228.164.30 56396 (Amobee NE...)
1 2 151.101.66.49 54113 (FASTLY)
1 1 35.214.194.245 19527 (GOOGLE-2)
1 2 172.64.146.152 13335 (CLOUDFLAR...)
1 54.146.30.88 14618 (AMAZON-AES)
1 2 44.211.20.238 14618 (AMAZON-AES)
1 100.55.244.171 14618 (AMAZON-AES)
1 2 34.111.113.62 396982 (GOOGLE-CL...)
1 35.168.61.84 14618 (AMAZON-AES)
1 13.226.244.23 16509 (AMAZON-02)
2 2 172.67.75.205 13335 (CLOUDFLAR...)
1 2 81.17.55.116 60781 (LEASEWEB-...)
1 54.78.254.47 16509 (AMAZON-02)
1 35.212.17.176 15169 (GOOGLE)
1 2 108.128.131.68 16509 (AMAZON-02)
1 2 54.154.24.113 16509 (AMAZON-02)
2 2 35.244.174.68 396982 (GOOGLE-CL...)
1 107.178.254.65 396982 (GOOGLE-CL...)
1 2 35.244.159.8 396982 (GOOGLE-CL...)
1 1 103.231.98.109 62713 (AS-PUBMATIC)
1 63.140.62.210 16509 (AMAZON-02)
225 75
27    104.16.69.86 (Ascension Island)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
www.cyberark.com 9yr old
30    18.66.102.30 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-18-66-102-30.fra56.r.cloudfront.net
content.cdntwrk.com 12yr old
7    104.17.25.14 (Ascension Island)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
cdnjs.cloudflare.com 13yr old
9    18.173.205.109 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-18-173-205-109.fra56.r.cloudfront.net
cihost.uberflip.com 9yr old
5    142.250.201.74 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: tzfraa-aq-in-f10.1e100.net
fonts.googleapis.com 56yr old
9    23.52.181.12 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a23-52-181-12.deploy.static.akamaitechnologies.com
assets.adobedtm.com 56yr old
1    108.138.7.50 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-108-138-7-50.fra56.r.cloudfront.net
ob.segreencolumn.com 3yr old
4    142.251.141.104 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: tzfraa-ai-in-f8.1e100.net
www.googletagmanager.com 56yr old
3    34.117.77.79 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US)
PTR: 79.77.117.34.bc.googleusercontent.com
ml314.com 12yr old
2    23.67.142.205 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a23-67-142-205.deploy.static.akamaitechnologies.com
munchkin.marketo.net 9yr old
5    142.250.201.163 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: par21s23-in-f3.1e100.net
fonts.gstatic.com 9yr old
1    54.146.227.19 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-146-227-19.compute-1.amazonaws.com
in.ml314.com 11yr old
2    176.34.239.19 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-176-34-239-19.eu-west-1.compute.amazonaws.com
dpm.demdex.net 56yr old
9    50.16.211.97 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-50-16-211-97.compute-1.amazonaws.com
obs.segreencolumn.com 3yr old
5    18.66.122.78 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-18-66-122-78.fra60.r.cloudfront.net
consent.trustarc.com 8yr old
4    104.102.33.245 (Frankfurt am Main, Germany)

ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US)
PTR: a104-102-33-245.deploy.static.akamaitechnologies.com
sjrtp6-cdn.marketo.com 9yr old
rtp-static.marketo.com 9yr old
1    151.101.1.140 (United States)

ASN54113 (FASTLY - Fastly, Inc., US)
www.redditstatic.com 11yr old
1    23.55.161.151 (Frankfurt am Main, Germany)

ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL)
PTR: a23-55-161-151.deploy.static.akamaitechnologies.com
snap.licdn.com 9yr old
2    57.144.244.128 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK - Facebook, Inc., US)
PTR: xx-fbcdn-shv-01-fra5.fbcdn.net
connect.facebook.net 56yr old
4    108.138.26.44 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-108-138-26-44.fra56.r.cloudfront.net
nexus.ensighten.com 13yr old
5    3.229.217.25 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-3-229-217-25.compute-1.amazonaws.com
tags.srv.stackadapt.com 10yr old
2    35.204.89.238 (Groningen, Netherlands)

ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US)
PTR: 238.89.204.35.bc.googleusercontent.com
tag.simpli.fi 9yr old
i.simpli.fi 10yr old
1    18.245.60.124 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-18-245-60-124.fra60.r.cloudfront.net
s.dpmsrv.com 9yr old
2    18.172.114.101 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-18-172-114-101.fra60.r.cloudfront.net
js.adsrvr.org 9yr old
9    142.251.151.119 (United States)

ASN15169 (GOOGLE - Google LLC, US)
www.google.com 56yr old
2    54.78.54.11 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-78-54-11.eu-west-1.compute.amazonaws.com
cnv.event.prod.bidr.io 8yr old
1    18.245.46.25 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-18-245-46-25.fra56.r.cloudfront.net
tag.demandbase.com 9yr old
2    172.217.168.78 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: lcfraa-bk-in-f14.1e100.net
www.google-analytics.com 56yr old
1    192.28.164.179 (United States)

ASN15224 (OMNITURE - Adobe Inc., US)
316-czp-275.mktoresp.com 9yr old
5    142.251.127.157 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: lcfrai-in-f157.1e100.net
googleads.g.doubleclick.net 56yr old
2    52.18.115.33 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-52-18-115-33.eu-west-1.compute.amazonaws.com
cyberark.demdex.net 5yr old
dpm.demdex.net 56yr old
1    34.240.240.83 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-34-240-240-83.eu-west-1.compute.amazonaws.com
cm.everesttech.net 9yr old
1    63.140.62.200 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ip-63-140-62-200.data.adobedc.net
cyberark.tt.omtrdc.net 5yr old
1    18.66.122.49 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-18-66-122-49.fra60.r.cloudfront.net
consent.trustarc.com 8yr old
1    151.101.65.140 (United States)

ASN54113 (FASTLY - Fastly, Inc., US)
pixel-config.reddit.com 3yr old
1    151.101.129.140 (United States)

ASN54113 (FASTLY - Fastly, Inc., US)
alb.reddit.com 9yr old
5    150.171.22.12 (United States)

ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US)
px.ads.linkedin.com 9yr old
1    104.18.41.41 (Ascension Island)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
www.linkedin.com 56yr old
3    216.58.206.66 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: mil07s08-in-f2.1e100.net
www.googleadservices.com 56yr old
6    172.217.16.195 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: tzfraa-at-in-f3.1e100.net
www.google.co.il 9yr old
2    57.144.244.1 (Frankfurt am Main, Germany)

ASN32934 (FACEBOOK - Facebook, Inc., US)
PTR: edge-star-mini-shv-01-fra5.facebook.com
www.facebook.com 56yr old
5    192.28.164.244 (United States)

ASN15224 (OMNITURE - Adobe Inc., US)
sjrtp6.marketo.com 9yr old
19    52.223.40.198 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: a6370ebea231e0c9a.awsglobalaccelerator.com
insight.adsrvr.org 9yr old
match.adsrvr.org 9yr old
1    65.8.101.109 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-65-8-101-109.fra60.r.cloudfront.net
d1eoo1tco6rr5e.cloudfront.net 9yr old
1    3.211.70.183 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-3-211-70-183.compute-1.amazonaws.com
a.dpmsrv.com 9yr old
1    34.96.71.22 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US)
PTR: 22.71.96.34.bc.googleusercontent.com
s.company-target.com 4yr old
2    18.66.102.85 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-18-66-102-85.fra56.r.cloudfront.net
api.company-target.com 9yr old
2    142.251.127.154 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: lcfrai-in-f154.1e100.net
stats.g.doubleclick.net 56yr old
3    104.18.26.193 (Ascension Island)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
dsum-sec.casalemedia.com 12yr old
1    34.225.5.229 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-34-225-5-229.compute-1.amazonaws.com
partners.tremorhub.com 9yr old
2    69.173.144.165 (Germany)

ASN26667 (RUBICONPROJECT - Magnite, Inc., US)
pixel.rubiconproject.com 9yr old
1    18.173.205.94 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-18-173-205-94.fra56.r.cloudfront.net
tag-logger.demandbase.com 3yr old
2    216.239.36.181 (United States)

ASN15169 (GOOGLE - Google LLC, US)
analytics.google.com 8yr old
2    37.252.171.53 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEXUS - Xandr Inc., US)
PTR: 1003.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
ib.adnxs.com 9yr old
1    142.251.37.2 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: muc11s23-in-f2.1e100.net
cm.g.doubleclick.net 9yr old
5    37.252.171.21 (Frankfurt am Main, Germany)

ASN29990 (ASN-APPNEXUS - Xandr Inc., US)
PTR: 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
ib.adnxs.com 9yr old
4    74.121.140.211 (Reston, United States)

ASN30419 (PAEDAE-INC - PaeDae, Inc., US)
pixel.mathtag.com 13yr old
4    69.173.144.138 (Germany)

ASN26667 (RUBICONPROJECT - Magnite, Inc., US)
pixel.rubiconproject.com 9yr old
1    104.18.27.193 (Ascension Island)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
dsum-sec.casalemedia.com 12yr old
4    142.251.141.66 (United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: tzfraa-ar-in-f2.1e100.net
cm.g.doubleclick.net 9yr old
3    35.214.136.108 (Groningen, Netherlands)

ASN19527 (GOOGLE-2 - Google LLC, US)
PTR: 108.136.214.35.bc.googleusercontent.com
x.bidswitch.net 13yr old
26    34.7.37.3 (Groningen, Netherlands)

ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US)
PTR: 3.37.7.34.bc.googleusercontent.com
um.simpli.fi 9yr old
1    51.38.120.206 (Hessen, Germany)

ASN16276 (OVH OVH SAS, FR)
PTR: ip206.ip-51-38-120.eu
onetag-sys.com 11yr old
1    18.245.46.60 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-18-245-46-60.fra56.r.cloudfront.net
synchroscript.deliveryengine.adswizz.com 9yr old
4    3.125.70.222 (Frankfurt am Main, Germany)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-3-125-70-222.eu-central-1.compute.amazonaws.com
ps.eyeota.net 13yr old
1    46.228.164.30 (United Kingdom)

ASN56396 (Amobee NEXXEN GROUP LTD, GB)
d.turn.com 13yr old
2    151.101.66.49 (United States)

ASN54113 (FASTLY - Fastly, Inc., US)
sync-tm.everesttech.net 9yr old
1    35.214.194.245 (Groningen, Netherlands)

ASN19527 (GOOGLE-2 - Google LLC, US)
PTR: 245.194.214.35.bc.googleusercontent.com
s.ad.smaato.net 6yr old
2    172.64.146.152 (Ascension Island)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
capi.connatix.com 7yr old
1    54.146.30.88 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-54-146-30-88.compute-1.amazonaws.com
sync.1rx.io 9yr old
2    44.211.20.238 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-44-211-20-238.compute-1.amazonaws.com
eb2.3lift.com 9yr old
1    100.55.244.171 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-100-55-244-171.compute-1.amazonaws.com
simplifi.partners.tremorhub.com 7yr old
2    34.111.113.62 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US)
PTR: 62.113.111.34.bc.googleusercontent.com
pixel.tapad.com 9yr old
1    35.168.61.84 (Ashburn, United States)

ASN14618 (AMAZON-AES - Amazon.com, Inc., US)
PTR: ec2-35-168-61-84.compute-1.amazonaws.com
aa.agkn.com 9yr old
1    13.226.244.23 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: server-13-226-244-23.fra56.r.cloudfront.net
sync.intentiq.com 9yr old
2    172.67.75.205 (Ascension Island)

ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US)
fei.pro-market.net 9yr old
2    81.17.55.116 (Netherlands)

ASN60781 (LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V., NL)
sync.smartadserver.com 9yr old
1    54.78.254.47 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-78-254-47.eu-west-1.compute.amazonaws.com
loadm.exelator.com 13yr old
1    35.212.17.176 (Washington, United States)

ASN15169 (GOOGLE - Google LLC, US)
PTR: 176.17.212.35.bc.googleusercontent.com
sync.bfmio.com 9yr old
2    108.128.131.68 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-108-128-131-68.eu-west-1.compute.amazonaws.com
bcp.crwdcntrl.net 9yr old
2    54.154.24.113 (Dublin, Ireland)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ec2-54-154-24-113.eu-west-1.compute.amazonaws.com
ce.lijit.com 9yr old
2    35.244.174.68 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US)
PTR: 68.174.244.35.bc.googleusercontent.com
idsync.rlcdn.com 9yr old
1    107.178.254.65 (United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US)
PTR: 65.254.178.107.bc.googleusercontent.com
pippio.com 11yr old
2    35.244.159.8 (Kansas City, United States)

ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US)
PTR: 8.159.244.35.bc.googleusercontent.com
us-u.openx.net 9yr old
1    103.231.98.109 (Japan)

ASN62713 (AS-PUBMATIC - PubMatic, Inc., US)
simage2.pubmatic.com 9yr old
1    63.140.62.210 (United States)

ASN16509 (AMAZON-02 - Amazon.com, Inc., US)
PTR: ip-63-140-62-210.data.adobedc.net
cyberark.sc.omtrdc.net 5yr old
Apex Domain
Subdomains		 Transfer
30 cdntwrk.com
content.cdntwrk.com — Cisco Umbrella Rank: 184512 12yr old
3 MB
28 simpli.fi
tag.simpli.fi — Cisco Umbrella Rank: 6731 9yr old
i.simpli.fi — Cisco Umbrella Rank: 5413 10yr old
um.simpli.fi — Cisco Umbrella Rank: 1195 9yr old
16 KB
27 cyberark.com
www.cyberark.com — Cisco Umbrella Rank: 428640 9yr old
414 KB
21 adsrvr.org
js.adsrvr.org — Cisco Umbrella Rank: 1537 9yr old
insight.adsrvr.org — Cisco Umbrella Rank: 1255 9yr old
match.adsrvr.org — Cisco Umbrella Rank: 555 9yr old
25 KB
12 doubleclick.net
googleads.g.doubleclick.net — Cisco Umbrella Rank: 63 56yr old
stats.g.doubleclick.net — Cisco Umbrella Rank: 249 56yr old
cm.g.doubleclick.net — Cisco Umbrella Rank: 358 9yr old
8 KB
11 google.com
www.google.com — Cisco Umbrella Rank: 4 56yr old
analytics.google.com — Cisco Umbrella Rank: 227 8yr old
198 B
10 segreencolumn.com
ob.segreencolumn.com — Cisco Umbrella Rank: 48309 3yr old
obs.segreencolumn.com — Cisco Umbrella Rank: 41822 3yr old
46 KB
9 marketo.com
sjrtp6-cdn.marketo.com — Cisco Umbrella Rank: 310128 9yr old
rtp-static.marketo.com — Cisco Umbrella Rank: 35611 9yr old
sjrtp6.marketo.com — Cisco Umbrella Rank: 289387 9yr old
182 KB
9 adobedtm.com
assets.adobedtm.com — Cisco Umbrella Rank: 400 56yr old
106 KB
9 uberflip.com
cihost.uberflip.com — Cisco Umbrella Rank: 427729 9yr old
670 KB
7 adnxs.com
ib.adnxs.com — Cisco Umbrella Rank: 418 9yr old
7 KB
7 cloudflare.com
cdnjs.cloudflare.com — Cisco Umbrella Rank: 340 13yr old
425 KB
6 rubiconproject.com
pixel.rubiconproject.com — Cisco Umbrella Rank: 554 9yr old
8 KB
6 google.co.il
www.google.co.il — Cisco Umbrella Rank: 17992 9yr old
798 B
6 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 480 9yr old
www.linkedin.com — Cisco Umbrella Rank: 769 56yr old
3 KB
6 trustarc.com
consent.trustarc.com — Cisco Umbrella Rank: 4137 8yr old
157 KB
5 stackadapt.com
tags.srv.stackadapt.com — Cisco Umbrella Rank: 2422 10yr old
10 KB
5 gstatic.com
fonts.gstatic.com 9yr old
158 KB
5 googleapis.com
fonts.googleapis.com — Cisco Umbrella Rank: 81 56yr old
184 KB
4 eyeota.net
ps.eyeota.net — Cisco Umbrella Rank: 1313 13yr old
2 KB
4 mathtag.com
pixel.mathtag.com — Cisco Umbrella Rank: 7263 13yr old
3 KB
4 casalemedia.com
dsum-sec.casalemedia.com — Cisco Umbrella Rank: 887 12yr old
3 KB
4 ensighten.com
nexus.ensighten.com — Cisco Umbrella Rank: 6294 13yr old
12 KB
4 demdex.net
dpm.demdex.net — Cisco Umbrella Rank: 372 56yr old
cyberark.demdex.net 5yr old
5 KB
4 ml314.com
ml314.com — Cisco Umbrella Rank: 2088 12yr old
in.ml314.com — Cisco Umbrella Rank: 26352 11yr old
13 KB
4 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 71 56yr old
588 KB
3 bidswitch.net
x.bidswitch.net — Cisco Umbrella Rank: 544 13yr old
1010 B
3 company-target.com
s.company-target.com — Cisco Umbrella Rank: 2151 4yr old
api.company-target.com — Cisco Umbrella Rank: 5077 9yr old
2 KB
3 googleadservices.com
www.googleadservices.com — Cisco Umbrella Rank: 137 56yr old
1 KB
3 everesttech.net
cm.everesttech.net — Cisco Umbrella Rank: 2044 9yr old
sync-tm.everesttech.net — Cisco Umbrella Rank: 1178 9yr old
1 KB
2 openx.net
us-u.openx.net — Cisco Umbrella Rank: 738 9yr old
504 B
2 lijit.com
ce.lijit.com — Cisco Umbrella Rank: 1419 9yr old
776 B
2 crwdcntrl.net
bcp.crwdcntrl.net — Cisco Umbrella Rank: 1497 9yr old
840 B
2 smartadserver.com
sync.smartadserver.com — Cisco Umbrella Rank: 1707 9yr old
887 B
2 pro-market.net
fei.pro-market.net — Cisco Umbrella Rank: 2623 9yr old
1 KB
2 tapad.com
pixel.tapad.com — Cisco Umbrella Rank: 656 9yr old
1 KB
2 3lift.com
eb2.3lift.com — Cisco Umbrella Rank: 689 9yr old
969 B
2 connatix.com
capi.connatix.com — Cisco Umbrella Rank: 1373 7yr old
587 B
2 tremorhub.com
partners.tremorhub.com — Cisco Umbrella Rank: 1672 9yr old
simplifi.partners.tremorhub.com — Cisco Umbrella Rank: 8828 7yr old
679 B
2 rlcdn.com
id.rlcdn.com Failed 9yr old
idsync.rlcdn.com — Cisco Umbrella Rank: 735 9yr old
775 B
2 facebook.com
www.facebook.com — Cisco Umbrella Rank: 143 56yr old
218 B
2 reddit.com
pixel-config.reddit.com — Cisco Umbrella Rank: 1804 3yr old
alb.reddit.com — Cisco Umbrella Rank: 1018 9yr old
964 B
2 omtrdc.net
cyberark.tt.omtrdc.net 5yr old
cyberark.sc.omtrdc.net 5yr old
1 KB
2 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 96 56yr old
21 KB
2 demandbase.com
tag.demandbase.com — Cisco Umbrella Rank: 7239 9yr old
tag-logger.demandbase.com — Cisco Umbrella Rank: 6847 3yr old
22 KB
2 bidr.io
cnv.event.prod.bidr.io — Cisco Umbrella Rank: 11699 8yr old
893 B
2 dpmsrv.com
s.dpmsrv.com — Cisco Umbrella Rank: 31307 9yr old
a.dpmsrv.com — Cisco Umbrella Rank: 50685 9yr old
13 KB
2 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 290 56yr old
132 KB
2 marketo.net
munchkin.marketo.net — Cisco Umbrella Rank: 5987 9yr old
6 KB
1 pubmatic.com
simage2.pubmatic.com — Cisco Umbrella Rank: 1262 9yr old
546 B
1 pippio.com
pippio.com — Cisco Umbrella Rank: 1285 11yr old
571 B
1 bfmio.com
sync.bfmio.com — Cisco Umbrella Rank: 1467 9yr old
379 B
1 exelator.com
loadm.exelator.com — Cisco Umbrella Rank: 3048 13yr old
324 B
1 intentiq.com
sync.intentiq.com — Cisco Umbrella Rank: 1486 9yr old
218 B
1 agkn.com
aa.agkn.com — Cisco Umbrella Rank: 784 9yr old
307 B
1 1rx.io
sync.1rx.io — Cisco Umbrella Rank: 696 9yr old
44 B
1 smaato.net
s.ad.smaato.net — Cisco Umbrella Rank: 986 6yr old
392 B
1 turn.com
d.turn.com — Cisco Umbrella Rank: 1884 13yr old
451 B
1 adswizz.com
synchroscript.deliveryengine.adswizz.com — Cisco Umbrella Rank: 3666 9yr old
387 B
1 onetag-sys.com
onetag-sys.com — Cisco Umbrella Rank: 968 11yr old
232 B
1 cloudfront.net
d1eoo1tco6rr5e.cloudfront.net 9yr old
669 B
1 mktoresp.com
316-czp-275.mktoresp.com 9yr old
318 B
1 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 1270 9yr old
19 KB
1 redditstatic.com
www.redditstatic.com — Cisco Umbrella Rank: 1021 11yr old
19 KB
225 64
Domain Requested by
30 content.cdntwrk.com www.cyberark.com
content.cdntwrk.com
27 www.cyberark.com 1 redirects www.cyberark.com
content.cdntwrk.com
26 um.simpli.fi 21 redirects
12 match.adsrvr.org 10 redirects www.cyberark.com
insight.adsrvr.org
9 www.google.com 3 redirects www.googletagmanager.com
www.cyberark.com
9 obs.segreencolumn.com ob.segreencolumn.com
www.cyberark.com
9 assets.adobedtm.com www.cyberark.com
assets.adobedtm.com
9 cihost.uberflip.com www.cyberark.com
cihost.uberflip.com
7 ib.adnxs.com 5 redirects www.cyberark.com
7 insight.adsrvr.org 4 redirects js.adsrvr.org
7 cdnjs.cloudflare.com www.cyberark.com
cdnjs.cloudflare.com
6 pixel.rubiconproject.com 4 redirects s.company-target.com
6 www.google.co.il www.cyberark.com
6 consent.trustarc.com www.cyberark.com
consent.trustarc.com
5 cm.g.doubleclick.net 5 redirects
5 sjrtp6.marketo.com sjrtp6-cdn.marketo.com
rtp-static.marketo.com
5 px.ads.linkedin.com 2 redirects snap.licdn.com
www.cyberark.com
5 googleads.g.doubleclick.net 3 redirects www.googletagmanager.com
5 tags.srv.stackadapt.com www.cyberark.com
tags.srv.stackadapt.com
5 fonts.gstatic.com fonts.googleapis.com
5 fonts.googleapis.com www.cyberark.com
cihost.uberflip.com
4 ps.eyeota.net 4 redirects
4 pixel.mathtag.com 2 redirects www.cyberark.com
4 dsum-sec.casalemedia.com 1 redirects s.company-target.com
d1eoo1tco6rr5e.cloudfront.net
www.cyberark.com
4 nexus.ensighten.com www.googletagmanager.com
nexus.ensighten.com
4 www.googletagmanager.com www.cyberark.com
www.googletagmanager.com
www.google-analytics.com
3 x.bidswitch.net 3 redirects
3 rtp-static.marketo.com sjrtp6-cdn.marketo.com
3 www.googleadservices.com 2 redirects www.googletagmanager.com
3 dpm.demdex.net 1 redirects assets.adobedtm.com
www.cyberark.com
3 ml314.com www.cyberark.com
ml314.com
2 us-u.openx.net 1 redirects
2 idsync.rlcdn.com 2 redirects
2 ce.lijit.com 1 redirects
2 bcp.crwdcntrl.net 1 redirects
2 sync.smartadserver.com 1 redirects
2 fei.pro-market.net 2 redirects
2 pixel.tapad.com 1 redirects
2 eb2.3lift.com 1 redirects
2 capi.connatix.com 1 redirects
2 sync-tm.everesttech.net 1 redirects
2 analytics.google.com www.googletagmanager.com
2 stats.g.doubleclick.net www.google-analytics.com
www.googletagmanager.com
2 api.company-target.com tag.demandbase.com
2 www.facebook.com www.cyberark.com
2 www.google-analytics.com www.googletagmanager.com
www.google-analytics.com
2 cnv.event.prod.bidr.io 1 redirects www.cyberark.com
2 js.adsrvr.org www.googletagmanager.com
insight.adsrvr.org
2 connect.facebook.net www.cyberark.com
connect.facebook.net
2 munchkin.marketo.net www.cyberark.com
munchkin.marketo.net
1 cyberark.sc.omtrdc.net assets.adobedtm.com
1 simage2.pubmatic.com 1 redirects
1 pippio.com
1 sync.bfmio.com
1 loadm.exelator.com
1 sync.intentiq.com
1 aa.agkn.com
1 simplifi.partners.tremorhub.com
1 sync.1rx.io
1 s.ad.smaato.net 1 redirects
1 d.turn.com 1 redirects
1 synchroscript.deliveryengine.adswizz.com
1 onetag-sys.com
1 i.simpli.fi tag.simpli.fi
1 tag-logger.demandbase.com tag.demandbase.com
1 partners.tremorhub.com s.company-target.com
1 s.company-target.com tag.demandbase.com
1 a.dpmsrv.com s.dpmsrv.com
1 d1eoo1tco6rr5e.cloudfront.net nexus.ensighten.com
1 www.linkedin.com 1 redirects
1 alb.reddit.com www.cyberark.com
1 pixel-config.reddit.com www.redditstatic.com
1 cyberark.tt.omtrdc.net assets.adobedtm.com
1 cm.everesttech.net 1 redirects
1 cyberark.demdex.net assets.adobedtm.com
1 316-czp-275.mktoresp.com munchkin.marketo.net
1 tag.demandbase.com www.cyberark.com
1 s.dpmsrv.com www.cyberark.com
1 tag.simpli.fi www.googletagmanager.com
1 snap.licdn.com www.googletagmanager.com
1 www.redditstatic.com www.googletagmanager.com
1 sjrtp6-cdn.marketo.com www.cyberark.com
1 in.ml314.com ml314.com
1 ob.segreencolumn.com www.cyberark.com
0 id.rlcdn.com Failed www.cyberark.com
225 85
Subject Issuer Validity Valid
cyberark.com
WE1		 2026-02-22 -
2026-05-23		 3mo crt.sh
content.cdntwrk.com
Amazon RSA 2048 M03		 2025-07-25 -
2026-08-23		 1yr crt.sh
cdnjs.cloudflare.com
WE1		 2026-03-14 -
2026-06-12		 3mo crt.sh
*.uberflip.com
Amazon RSA 2048 M02		 2025-07-05 -
2026-08-03		 1yr crt.sh
upload.video.google.com
WE2		 2026-02-02 -
2026-04-27		 3mo crt.sh
assets.adobedtm.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2025-06-24 -
2026-07-25		 1yr crt.sh
*.segreencolumn.com
Amazon RSA 2048 M03		 2025-05-19 -
2026-06-17		 1yr crt.sh
*.google-analytics.com
WE2		 2026-02-02 -
2026-04-27		 3mo crt.sh
event-horizon.gcp.bomm.in
WR3		 2026-01-24 -
2026-04-24		 3mo crt.sh
*.marketo.net
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2025-10-22 -
2026-10-21		 1yr crt.sh
*.gstatic.com
WE2		 2026-02-02 -
2026-04-27		 3mo crt.sh
*.ml314.com
Amazon RSA 2048 M04		 2025-08-13 -
2026-09-09		 1yr crt.sh
*.demdex.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2025-10-14 -
2026-11-14		 1yr crt.sh
*.trustarc.com
Amazon RSA 2048 M01		 2026-01-14 -
2027-02-11		 1yr crt.sh
*.marketo.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2025-10-22 -
2026-10-21		 1yr crt.sh
www.redditstatic.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2025-11-21 -
2026-05-19		 6mo crt.sh
*.licdn.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2025-10-14 -
2026-10-13		 1yr crt.sh
*.facebook.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2025-12-21 -
2026-03-21		 3mo crt.sh
nexus.ensighten.com
Amazon RSA 2048 M04		 2025-07-31 -
2026-08-29		 1yr crt.sh
*.srv.stackadapt.com
Amazon RSA 2048 M04		 2025-07-09 -
2026-08-06		 1yr crt.sh
*.simpli.fi
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2025-10-23 -
2026-11-23		 1yr crt.sh
*.dpmsrv.com
Amazon RSA 2048 M04		 2025-12-16 -
2027-01-13		 1yr crt.sh
*.adsrvr.org
GlobalSign GCC R3 DV TLS CA 2020		 2026-03-04 -
2027-04-02		 1yr crt.sh
*.google.com
WR2		 2026-02-02 -
2026-04-27		 3mo crt.sh
tag.demandbase.com
Amazon RSA 2048 M02		 2025-08-29 -
2026-09-27		 1yr crt.sh
*.mktoresp.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2025-07-22 -
2026-08-22		 1yr crt.sh
*.g.doubleclick.net
WE2		 2026-02-02 -
2026-04-27		 3mo crt.sh
*.tt.omtrdc.net
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2025-03-06 -
2026-04-06		 1yr crt.sh
*.reddit.com
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2025-11-24 -
2026-05-22		 6mo crt.sh
www.linkedin.com
DigiCert SHA2 Secure Server CA		 2026-02-11 -
2026-08-11		 6mo crt.sh
*.googleadservices.com
WE2		 2026-02-02 -
2026-04-27		 3mo crt.sh
*.google.co.il
WE2		 2026-02-02 -
2026-04-27		 3mo crt.sh
*.cloudfront.net
Amazon RSA 2048 M01		 2025-05-05 -
2026-04-23		 1yr crt.sh
*.company-target.com
R13		 2026-02-06 -
2026-05-07		 3mo crt.sh
api.demandbase.com
Amazon RSA 2048 M03		 2025-08-25 -
2026-09-23		 1yr crt.sh
*.tremorhub.com
Amazon RSA 2048 M01		 2025-11-25 -
2026-12-24		 1yr crt.sh
*.rubiconproject.com
DigiCert TLS RSA SHA256 2020 CA1		 2025-03-04 -
2026-04-03		 1yr crt.sh
tag-logger.demandbase.com
Amazon RSA 2048 M04		 2025-11-13 -
2026-12-12		 1yr crt.sh
*.sc.omtrdc.net
DigiCert Global G2 TLS RSA SHA256 2020 CA1		 2026-02-09 -
2027-03-12		 1yr crt.sh

This page contains 8 frames:

Primary Page: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Frame ID: 9AA1A110D5E28ACC3B3580F2C87D1962
Requests: 212 HTTP requests in this frame

Frame: https://www.cyberark.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/ea2d291c0fdc/main.js
Frame ID: 473CD6D591D7766284F9CD45754FD3AF
Requests: 2 HTTP requests in this frame

Frame: https://cyberark.demdex.net/dest5.html?d_nsid=0
Frame ID: 736401AE6884DD1D091920B04CA39613
Requests: 1 HTTP requests in this frame

Frame: https://consent.trustarc.com/get?name=crossdomain.html&domain=cyberark.com
Frame ID: 584C403A5D7962BC6378C459FCFFF9C7
Requests: 1 HTTP requests in this frame

Frame: https://d1eoo1tco6rr5e.cloudfront.net/0v1kpom/u9beit9/iframe
Frame ID: 82742BD4DBA0AA07D3DBF67C825E9958
Requests: 2 HTTP requests in this frame

Frame: https://s.company-target.com/s/sync?exc=lr
Frame ID: C8767D5DBD8E29ACF94D0BB15CA77977
Requests: 4 HTTP requests in this frame

Frame: https://insight.adsrvr.org/track/cei?advertiser_id=db8v4fb&cookie_sync=1&upv=3.0.0&upid=2kfe2lm&ref=https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Frame ID: 92F6C1F31AEB9FBA233371F0AA025DC3
Requests: 2 HTTP requests in this frame

Frame: https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic
Frame ID: 67BFE096F4A82B21D80493BCC9671262
Requests: 1 HTTP requests in this frame

Screenshot
Live screenshot
Full Image

Page Title

Golden SAML: Newly Discovered Attack Technique Forges Authentication to Cloud Apps

Detected technologies

Overall confidence: 100%
Detected patterns
  • <link rel=["']stylesheet["'] [^>]+/wp-(?:content|includes)/
  • /wp-(?:content|includes)/
Overall confidence: 100%
Detected patterns
  • bootstrap(?:[^>]*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)[^>]*?(?:\.min)?\.js
Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)
Overall confidence: 100%
Detected patterns
  • \.doubleclick\.net
Overall confidence: 100%
Detected patterns
  • //nexus\.ensighten\.com/
Overall confidence: 100%
Detected patterns
  • (?:F|f)o(?:n|r)t-?(?:A|a)wesome(?:.*?([0-9a-fA-F]{7,40}|[\d]+(?:.[\d]+(?:.[\d]+)?)?)|)
Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js
  • googletagmanager\.com/gtag/js
Overall confidence: 100%
Detected patterns
  • <!-- (?:End )?Google Tag Manager -->
  • googletagmanager\.com/gtm\.js
  • \.googletagmanager\.com/
Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js
Overall confidence: 100%
Detected patterns
  • munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.openx\.net
Overall confidence: 100%
Detected patterns
  • https?://[^/]*\.rubiconproject\.com
Overall confidence: 100%
Detected patterns
  • consent\.trustarc\.com
Overall confidence: 100%
Detected patterns
  • jquery
  • /(\d+\.\d+\.\d+)/jquery(?!\.popupoverlay\.js)[/.-][^u]
Overall confidence: 100%
Detected patterns
Overall confidence: 100%
Detected patterns
Overall confidence: 100%
Detected patterns
  • cdnjs\.cloudflare\.com
Overall confidence: 100%
Detected patterns
  • \.demandbase\.com/
Overall confidence: 100%
Detected patterns
  • connect\.facebook\.\w+/.+/fbevents\.js
  • connect\.facebook.\w+/signals/config/\d+\?v=([\d\.]+)
Overall confidence: 100%
Detected patterns
  • www\.redditstatic\.com
Overall confidence: 100%
Detected patterns
  • \.simpli\.fi
Overall confidence: 100%
Detected patterns
  • \.(?:linksmart|lijit)\.com/
Overall confidence: 100%
Detected patterns
  • srv\.stackadapt\.com/
Overall confidence: 100%
Detected patterns
  • \.adsrvr\.org/
Overall confidence: 100%
Detected patterns

Page Statistics

225
Requests

84 %
HTTPS

0 %
IPv6

64
Domains

85
Subdomains

75
IPs

7
Countries

6368 kB
Transfer

11975 kB
Size

110
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 62
  • https://www.cyberark.com/cdn-cgi/challenge-platform/scripts/jsd/main.js HTTP 302
  • https://www.cyberark.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/ea2d291c0fdc/main.js
Request Chain 105
  • https://cnv.event.prod.bidr.io/log/cnv?tag_id=188&buzz_key=intentsify&value=&segment_key=intentsify-1098&account_id=2&order=[ORDER]&ord=[CACHEBUSTER] HTTP 303
  • https://cnv.event.prod.bidr.io/log/cnv?tag_id=188&buzz_key=intentsify&value=&segment_key=intentsify-1098&account_id=2&order=%5BORDER%5D&ord=%5BCACHEBUSTER%5D&_bee_ppp=1
Request Chain 115
  • https://cm.everesttech.net/cm/dd?d_uuid=40063168363633222981499930872278632852 HTTP 302
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=abT_OQAAAE0b6QO-
Request Chain 126
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=17906&time=1773469241030&li_adsId=d179f441-3a79-4559-ac15-e97dc06580a4&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fgolden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps&tm=gtmv2 HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=17906&time=1773469241030&li_adsId=d179f441-3a79-4559-ac15-e97dc06580a4&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fgolden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps&tm=gtmv2&cookiesTest=true HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D17906%26time%3D1773469241030%26li_adsId%3Dd179f441-3a79-4559-ac15-e97dc06580a4%26url%3Dhttps%253A%252F%252Fwww.cyberark.com%252Fresources%252Fthreat-research-blog%252Fgolden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps%26tm%3Dgtmv2%26cookiesTest%3Dtrue%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=17906&time=1773469241030&li_adsId=d179f441-3a79-4559-ac15-e97dc06580a4&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fgolden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps&tm=gtmv2&cookiesTest=true&liSync=true
Request Chain 130
  • https://www.googleadservices.com/pagead/conversion/1071691665/?label=H8zfCNSYxvwYEJHvgv8D&guid=ON&script=0 HTTP 302
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1071691665/?label=H8zfCNSYxvwYEJHvgv8D&guid=ON&script=0&ct_cookie_present=false&random=523391497&crd=CLTesQIIobixAgixwbECCLDBsQIIscOxAgiKxbECCMLJsQIItMaxAgiT2rECCNvcsQIIh9uxAgjTxbECCOvMsQII7c6xAgjVz7ECCPTasQIIl9SxAgjJ27ECCLHhsQIIs-GxAgim3bECCLDesQI&cerd=CgSI3b0t&fsk=ChEI8OvOzQYQtqmjsqjx5qviARIsAF5ryED5BClOyAuqURCNuj9tjVgKcJZ_20MpIvEH6IDlk-D3oFGTo6HcJ8oaAnXZ&pscrd=IhMI1OGc4d-ekwMV-kQdCR19mxoYMgwIA2IICAAQABgAIAAyDAgEYggIABAAGAAgADIMCAdiCAgAEAAYACAAMgwICGIICAAQABgAIAAyDAgJYggIABAAGAAgADIMCApiCAgAEAAYACAAMgwIAmIICAAQABgAIAAyDAgLYggIABAAGAAgADIMCBViCAgAEAAYACAAMgwIH2IICAAQABgAIAAyDAgTYggIABAAGAAgADIMCBJiCAgAEAAYACAAOokBaHR0cHM6Ly93d3cuY3liZXJhcmsuY29tL3Jlc291cmNlcy90aHJlYXQtcmVzZWFyY2gtYmxvZy9nb2xkZW4tc2FtbC1uZXdseS1kaXNjb3ZlcmVkLWF0dGFjay10ZWNobmlxdWUtZm9yZ2VzLWF1dGhlbnRpY2F0aW9uLXRvLWNsb3VkLWFwcHN6DAgJYggIABAAGAAgAA HTTP 302
  • https://www.google.com/pagead/1p-conversion/1071691665/?label=H8zfCNSYxvwYEJHvgv8D&guid=ON&script=0&ct_cookie_present=false&random=523391497&crd=CLTesQIIobixAgixwbECCLDBsQIIscOxAgiKxbECCMLJsQIItMaxAgiT2rECCNvcsQIIh9uxAgjTxbECCOvMsQII7c6xAgjVz7ECCPTasQIIl9SxAgjJ27ECCLHhsQIIs-GxAgim3bECCLDesQI&cerd=CgSI3b0t&fsk=ChEI8OvOzQYQtqmjsqjx5qviARIsAF5ryED5BClOyAuqURCNuj9tjVgKcJZ_20MpIvEH6IDlk-D3oFGTo6HcJ8oaAnXZ&pscrd=IhMI1OGc4d-ekwMV-kQdCR19mxoYMgwIA2IICAAQABgAIAAyDAgEYggIABAAGAAgADIMCAdiCAgAEAAYACAAMgwICGIICAAQABgAIAAyDAgJYggIABAAGAAgADIMCApiCAgAEAAYACAAMgwIAmIICAAQABgAIAAyDAgLYggIABAAGAAgADIMCBViCAgAEAAYACAAMgwIH2IICAAQABgAIAAyDAgTYggIABAAGAAgADIMCBJiCAgAEAAYACAAOokBaHR0cHM6Ly93d3cuY3liZXJhcmsuY29tL3Jlc291cmNlcy90aHJlYXQtcmVzZWFyY2gtYmxvZy9nb2xkZW4tc2FtbC1uZXdseS1kaXNjb3ZlcmVkLWF0dGFjay10ZWNobmlxdWUtZm9yZ2VzLWF1dGhlbnRpY2F0aW9uLXRvLWNsb3VkLWFwcHN6DAgJYggIABAAGAAgAA&is_vtc=1&cid=CAQSvwEA56J1eS7cTbfx5w9wOJQgRG8mgYGPnkCrHQyGOgxmpktTG_i7ML8sA3UMPyClfbD8JvigquZGoHpW7k6k7EzfExniKTBG_dcJnlr8rPk8y0o5FPu6fnMtEpC3Uzw586R1qOWMt4kLuYFbc1CT0FOQHRRsn4iLy6H4CKxhcNpxHeeL5EZo5IUoTgSXAiU7ai1JSLBA08fCUEKdJzBexVTpSOtiXOEtY88O93YZWUKX4vAY5e9CoBvu0Y9_EPJoFw&random=68090297 HTTP 302
  • https://www.google.co.il/pagead/1p-conversion/1071691665/?label=H8zfCNSYxvwYEJHvgv8D&guid=ON&script=0&ct_cookie_present=false&random=523391497&crd=CLTesQIIobixAgixwbECCLDBsQIIscOxAgiKxbECCMLJsQIItMaxAgiT2rECCNvcsQIIh9uxAgjTxbECCOvMsQII7c6xAgjVz7ECCPTasQIIl9SxAgjJ27ECCLHhsQIIs-GxAgim3bECCLDesQI&cerd=CgSI3b0t&fsk=ChEI8OvOzQYQtqmjsqjx5qviARIsAF5ryED5BClOyAuqURCNuj9tjVgKcJZ_20MpIvEH6IDlk-D3oFGTo6HcJ8oaAnXZ&is_vtc=1&cid=CAQSvwEA56J1eS7cTbfx5w9wOJQgRG8mgYGPnkCrHQyGOgxmpktTG_i7ML8sA3UMPyClfbD8JvigquZGoHpW7k6k7EzfExniKTBG_dcJnlr8rPk8y0o5FPu6fnMtEpC3Uzw586R1qOWMt4kLuYFbc1CT0FOQHRRsn4iLy6H4CKxhcNpxHeeL5EZo5IUoTgSXAiU7ai1JSLBA08fCUEKdJzBexVTpSOtiXOEtY88O93YZWUKX4vAY5e9CoBvu0Y9_EPJoFw&random=68090297&ipr=y&pscrd=IhMI1OGc4d-ekwMV-kQdCR19mxoYMgwIA2IICAAQABgAIAAyDAgEYggIABAAGAAgADIMCAdiCAgAEAAYACAAMgwICGIICAAQABgAIAAyDAgJYggIABAAGAAgADIMCApiCAgAEAAYACAAMgwIAmIICAAQABgAIAAyDAgLYggIABAAGAAgADIMCBViCAgAEAAYACAAMgwIH2IICAAQABgAIAAyDAgTYggIABAAGAAgADIMCBJiCAgAEAAYACAAOokBaHR0cHM6Ly93d3cuY3liZXJhcmsuY29tL3Jlc291cmNlcy90aHJlYXQtcmVzZWFyY2gtYmxvZy9nb2xkZW4tc2FtbC1uZXdseS1kaXNjb3ZlcmVkLWF0dGFjay10ZWNobmlxdWUtZm9yZ2VzLWF1dGhlbnRpY2F0aW9uLXRvLWNsb3VkLWFwcHN6DAgJYggIABAAGAAgAIIBAnAB
Request Chain 146
  • https://insight.adsrvr.org/tags/0v1kpom/u9beit9/iframe HTTP 301
  • https://d1eoo1tco6rr5e.cloudfront.net/0v1kpom/u9beit9/iframe
Request Chain 147
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1071691665/?random=319567778&cv=11&fst=1773469241120&bg=ffffff&guid=ON&async=1&en=conversion&gtm=45be63b1v898648185za20gzb72025662zd72025662xec&gcd=13l3l3l3l1l1&dma=0&tag_exp=103116026~103200004~115616986~115938465~115938469~116024733~117484252&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fgolden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps&label=H8zfCNSYxvwYEJHvgv8D&capi=1&gtm_ee=1&frm=0&tiba=Golden%20SAML%3A%20Newly%20Discovered%20Attack%20Technique%20Forges%20Authentication%20to%20Cloud%20Apps&hn=www.googleadservices.com&npa=0&pscdl=noapi&auid=314487143.1773469241&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&gcl_ctr=1~0~0&data=event%3Dconversion&category=acrcp_v1_512&fmt=8&ct_cookie_present=false&crd=CLTesQII8t-xAgihuLECCLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgi0xrECCJPasQII29yxAgiH27ECCNPFsQII68yxAgjtzrECCNXPsQII9NqxAgiX1LECCMnbsQIIseGxAgiz4bECCKbdsQIIsN6xAkoZdHJpZ2dlcj1uYXZpZ2F0aW9uLXNvdXJjZVoDCgEBYgMKAQM&cerd=CgSI3b0t&fsk=ChEI8OvOzQYQtqmjsqjx5qviARIsAF5ryEAiLqfbv0uZlTg44ufaUjvD4y3znC_yPv_ujLOzTpkpLiM86HBkozEaAsLZ&pscrd=IhMIjreZ4d-ekwMVrUYdCR3jbye-MgwIA2IICAAQABgAIAAyDAgEYggIABAAGAAgADIMCAdiCAgAEAAYACAAMgwICGIICAAQABgAIAAyDAgJYggIABAAGAAgADIMCApiCAgAEAAYACAAMgwIAmIICAAQABgAIAAyDAgLYggIABAAGAAgADIMCBViCAgAEAAYACAAMgwIH2IICAAQABgAIAAyDAgTYggIABAAGAAgADIMCBJiCAgAEAAYACAAOokBaHR0cHM6Ly93d3cuY3liZXJhcmsuY29tL3Jlc291cmNlcy90aHJlYXQtcmVzZWFyY2gtYmxvZy9nb2xkZW4tc2FtbC1uZXdseS1kaXNjb3ZlcmVkLWF0dGFjay10ZWNobmlxdWUtZm9yZ2VzLWF1dGhlbnRpY2F0aW9uLXRvLWNsb3VkLWFwcHNCVkNoQUk4T3ZPelFZUWg2Ymd4WWVSbkxnUkVpd0FRV3Z6a1RiUkRBTWVCZnBJQnZia1lqb3FoS3Nsdi1FeTlHNzBOYVlHVkhNZ3JLZFhxOU1OV2NlVjd3egwICWIICAAQABgAIAA HTTP 302
  • https://www.google.com/pagead/1p-conversion/1071691665/?random=319567778&cv=11&fst=1773469241120&bg=ffffff&guid=ON&async=1&en=conversion&gtm=45be63b1v898648185za20gzb72025662zd72025662xec&gcd=13l3l3l3l1l1&dma=0&tag_exp=103116026~103200004~115616986~115938465~115938469~116024733~117484252&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fgolden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps&label=H8zfCNSYxvwYEJHvgv8D&capi=1&gtm_ee=1&frm=0&tiba=Golden%20SAML%3A%20Newly%20Discovered%20Attack%20Technique%20Forges%20Authentication%20to%20Cloud%20Apps&hn=www.googleadservices.com&npa=0&pscdl=noapi&auid=314487143.1773469241&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&gcl_ctr=1~0~0&data=event%3Dconversion&category=acrcp_v1_512&fmt=8&ct_cookie_present=false&crd=CLTesQII8t-xAgihuLECCLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgi0xrECCJPasQII29yxAgiH27ECCNPFsQII68yxAgjtzrECCNXPsQII9NqxAgiX1LECCMnbsQIIseGxAgiz4bECCKbdsQIIsN6xAkoZdHJpZ2dlcj1uYXZpZ2F0aW9uLXNvdXJjZVoDCgEBYgMKAQM&cerd=CgSI3b0t&fsk=ChEI8OvOzQYQtqmjsqjx5qviARIsAF5ryEAiLqfbv0uZlTg44ufaUjvD4y3znC_yPv_ujLOzTpkpLiM86HBkozEaAsLZ&pscrd=IhMIjreZ4d-ekwMVrUYdCR3jbye-MgwIA2IICAAQABgAIAAyDAgEYggIABAAGAAgADIMCAdiCAgAEAAYACAAMgwICGIICAAQABgAIAAyDAgJYggIABAAGAAgADIMCApiCAgAEAAYACAAMgwIAmIICAAQABgAIAAyDAgLYggIABAAGAAgADIMCBViCAgAEAAYACAAMgwIH2IICAAQABgAIAAyDAgTYggIABAAGAAgADIMCBJiCAgAEAAYACAAOokBaHR0cHM6Ly93d3cuY3liZXJhcmsuY29tL3Jlc291cmNlcy90aHJlYXQtcmVzZWFyY2gtYmxvZy9nb2xkZW4tc2FtbC1uZXdseS1kaXNjb3ZlcmVkLWF0dGFjay10ZWNobmlxdWUtZm9yZ2VzLWF1dGhlbnRpY2F0aW9uLXRvLWNsb3VkLWFwcHNCVkNoQUk4T3ZPelFZUWg2Ymd4WWVSbkxnUkVpd0FRV3Z6a1RiUkRBTWVCZnBJQnZia1lqb3FoS3Nsdi1FeTlHNzBOYVlHVkhNZ3JLZFhxOU1OV2NlVjd3egwICWIICAAQABgAIAA&is_vtc=1&cid=CAQSvwEA56J1edkvIYUOw8djb3q22BrOule_0msAvcJbmDAd540dk1acYIdsz0U5PNQYE5zZQfM9Dc_K8hnVhwm9U6NRu2GHBXe4OHjaniD8TUTVesyKREAPVO8u15o6UM9RsH1ZAtDYG7z4ny4O2z77tVGq6wxgl70fRE8k7XriJRkQ-daGiI6q9F98R9ixk4yf9G3BV2h6vVbekNiqScAEp2vJakeU4DLP7kVzACDiFeQN9fc7p0jbN_ceAyuv6CPRkw&random=941399293 HTTP 302
  • https://www.google.co.il/pagead/1p-conversion/1071691665/?random=319567778&cv=11&fst=1773469241120&bg=ffffff&guid=ON&async=1&en=conversion&gtm=45be63b1v898648185za20gzb72025662zd72025662xec&gcd=13l3l3l3l1l1&dma=0&tag_exp=103116026~103200004~115616986~115938465~115938469~116024733~117484252&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fgolden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps&label=H8zfCNSYxvwYEJHvgv8D&capi=1&gtm_ee=1&frm=0&tiba=Golden%20SAML%3A%20Newly%20Discovered%20Attack%20Technique%20Forges%20Authentication%20to%20Cloud%20Apps&hn=www.googleadservices.com&npa=0&pscdl=noapi&auid=314487143.1773469241&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&gcl_ctr=1~0~0&data=event%3Dconversion&category=acrcp_v1_512&fmt=8&ct_cookie_present=false&crd=CLTesQII8t-xAgihuLECCLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgi0xrECCJPasQII29yxAgiH27ECCNPFsQII68yxAgjtzrECCNXPsQII9NqxAgiX1LECCMnbsQIIseGxAgiz4bECCKbdsQIIsN6xAkoZdHJpZ2dlcj1uYXZpZ2F0aW9uLXNvdXJjZVoDCgEBYgMKAQM&cerd=CgSI3b0t&fsk=ChEI8OvOzQYQtqmjsqjx5qviARIsAF5ryEAiLqfbv0uZlTg44ufaUjvD4y3znC_yPv_ujLOzTpkpLiM86HBkozEaAsLZ&is_vtc=1&cid=CAQSvwEA56J1edkvIYUOw8djb3q22BrOule_0msAvcJbmDAd540dk1acYIdsz0U5PNQYE5zZQfM9Dc_K8hnVhwm9U6NRu2GHBXe4OHjaniD8TUTVesyKREAPVO8u15o6UM9RsH1ZAtDYG7z4ny4O2z77tVGq6wxgl70fRE8k7XriJRkQ-daGiI6q9F98R9ixk4yf9G3BV2h6vVbekNiqScAEp2vJakeU4DLP7kVzACDiFeQN9fc7p0jbN_ceAyuv6CPRkw&random=941399293&ipr=y&pscrd=IhMIjreZ4d-ekwMVrUYdCR3jbye-MgwIA2IICAAQABgAIAAyDAgEYggIABAAGAAgADIMCAdiCAgAEAAYACAAMgwICGIICAAQABgAIAAyDAgJYggIABAAGAAgADIMCApiCAgAEAAYACAAMgwIAmIICAAQABgAIAAyDAgLYggIABAAGAAgADIMCBViCAgAEAAYACAAMgwIH2IICAAQABgAIAAyDAgTYggIABAAGAAgADIMCBJiCAgAEAAYACAAOokBaHR0cHM6Ly93d3cuY3liZXJhcmsuY29tL3Jlc291cmNlcy90aHJlYXQtcmVzZWFyY2gtYmxvZy9nb2xkZW4tc2FtbC1uZXdseS1kaXNjb3ZlcmVkLWF0dGFjay10ZWNobmlxdWUtZm9yZ2VzLWF1dGhlbnRpY2F0aW9uLXRvLWNsb3VkLWFwcHNCVkNoQUk4T3ZPelFZUWg2Ymd4WWVSbkxnUkVpd0FRV3Z6a1RiUkRBTWVCZnBJQnZia1lqb3FoS3Nsdi1FeTlHNzBOYVlHVkhNZ3JLZFhxOU1OV2NlVjd3egwICWIICAAQABgAIACCAQVwAYgBAQ
Request Chain 161
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=18&expiry=1789366841&external_user_id=e650fb5c-3b88-46ca-a587-b6bf604d5b33 HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=18&expiry=1789366841&external_user_id=e650fb5c-3b88-46ca-a587-b6bf604d5b33&C=1
Request Chain 170
  • https://insight.adsrvr.org/track/pxl/?adv=0v1kpom&ct=0:u9beit9&fmt=3 HTTP 302
  • https://dpm.demdex.net/ibs:dpid=903&dpuuid=84287645-639f-44a7-be57-32558b730d7e&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam HTTP 302
  • https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=84287645-639f-44a7-be57-32558b730d7e HTTP 307
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fmatch.adsrvr.org%252ftrack%252fcmf%252fappnexus%253fttd%253d1%2526anid%253d%2524UID%26ttd_tdid%3D84287645-639f-44a7-be57-32558b730d7e HTTP 302
  • https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=6262219618946998537&ttd_tdid=84287645-639f-44a7-be57-32558b730d7e HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=ODQyODc2NDUtNjM5Zi00NGE3LWJlNTctMzI1NThiNzMwZDdl&gdpr=0&gdpr_consent=&ttd_tdid=84287645-639f-44a7-be57-32558b730d7e HTTP 302
  • https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=84287645-639f-44a7-be57-32558b730d7e&google_gid=CAESELAbeGUHTKQO0b7fY9JewEo&google_cver=1 HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=84287645-639f-44a7-be57-32558b730d7e&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon HTTP 302
  • https://match.adsrvr.org/track/cmf/rubicon?gdpr=0 HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=84287645-639f-44a7-be57-32558b730d7e&expiration=1776061244&gdpr=0&gdpr_consent=
Request Chain 171
  • https://ib.adnxs.com/seg?member=827&consent=1&add=37503624,37503625 HTTP 307
  • https://ib.adnxs.com/bounce?%2Fseg%3Fmember%3D827%26consent%3D1%26add%3D37503624%2C37503625
Request Chain 172
  • https://pixel.mathtag.com/event/img?mt_id=2373692&mt_adid=431650 HTTP 302
  • https://pixel.mathtag.com/event/img?primary-x-request-id=344fbf1d1d832934861424a55aae6a87&mt_id=2373692&mt_adid=431650
Request Chain 173
  • https://pixel.mathtag.com/event/img?mt_id=2373694&mt_adid=431650 HTTP 302
  • https://pixel.mathtag.com/event/img?primary-x-request-id=dd88174debab3ae42b3dd4ef589d5fd0&mt_id=2373694&mt_adid=431650
Request Chain 174
  • https://insight.adsrvr.org/track/pxl/?adv=f6ba480&ct=0:zorfgoq&fmt=3 HTTP 302
  • https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=84287645-639f-44a7-be57-32558b730d7e HTTP 302
  • https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=149472567156098708&ttd_tdid=84287645-639f-44a7-be57-32558b730d7e HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=84287645-639f-44a7-be57-32558b730d7e&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon HTTP 302
  • https://match.adsrvr.org/track/cmf/rubicon?gdpr=0 HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=84287645-639f-44a7-be57-32558b730d7e&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon HTTP 302
  • https://match.adsrvr.org/track/cmf/rubicon?gdpr=0 HTTP 302
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=84287645-639f-44a7-be57-32558b730d7e&expiration=1776061244&gdpr=0&gdpr_consent=
Request Chain 175
  • https://insight.adsrvr.org/track/pxl/?adv=f6ba480&ct=0:wvpxlx5&fmt=3 HTTP 302
  • https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=84287645-639f-44a7-be57-32558b730d7e HTTP 302
  • https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=149472567156098708&ttd_tdid=84287645-639f-44a7-be57-32558b730d7e HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=ODQyODc2NDUtNjM5Zi00NGE3LWJlNTctMzI1NThiNzMwZDdl&gdpr=0&gdpr_consent=&ttd_tdid=84287645-639f-44a7-be57-32558b730d7e HTTP 302
  • https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=84287645-639f-44a7-be57-32558b730d7e&google_gid=CAESELAbeGUHTKQO0b7fY9JewEo&google_cver=1 HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=84287645-639f-44a7-be57-32558b730d7e&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon HTTP 302
  • https://match.adsrvr.org/track/cmf/rubicon?gdpr=0 HTTP 302
  • https://x.bidswitch.net/syncd?dsp_id=93&user_group=1&user_id=84287645-639f-44a7-be57-32558b730d7e&expires=30&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dbidswitch HTTP 302
  • https://x.bidswitch.net/ul_cb/syncd?dsp_id=93&user_group=1&user_id=84287645-639f-44a7-be57-32558b730d7e&expires=30&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dbidswitch HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=bidswitch
Request Chain 185
  • https://um.simpli.fi/bombora HTTP 302
  • https://ml314.com/utsync.ashx?et=0&eid=93940&fp=7BCE36D896B24D3E9FFB9A9004C0C77F
Request Chain 186
  • https://um.simpli.fi/bidswitch HTTP 302
  • https://x.bidswitch.net/sync?dsp_id=518&user_id=7BCE36D896B24D3E9FFB9A9004C0C77F HTTP 302
  • https://onetag-sys.com/match/?int_id=30&uid=a17a1391-522b-47c1-b3f7-7910d09cb5de&gdpr=&gdpr_consent=&us_privacy=
Request Chain 187
  • https://um.simpli.fi/adswizz HTTP 302
  • https://synchroscript.deliveryengine.adswizz.com/syncMe?partnerDomain=simpli.fi&idType=cookie&partnerUserId=7BCE36D896B24D3E9FFB9A9004C0C77F
Request Chain 188
  • https://um.simpli.fi/eyeota HTTP 302
  • https://ps.eyeota.net/match?bid=irm51m1&uid=7BCE36D896B24D3E9FFB9A9004C0C77F HTTP 302
  • https://ps.eyeota.net/match/bounce/?bid=irm51m1&uid=7BCE36D896B24D3E9FFB9A9004C0C77F HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm&google_sc&google_hm=MnZZRVMwYm4wQlVoOE4xYjBPTmdHTXZUQ0xDMVIyRG5aaEx4NnBxRVQyWjA&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&dc_rc=1&dc_mr=5&dc_orig=irm51m1& HTTP 302
  • https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&dc_rc=1&dc_mr=5&dc_orig=irm51m1&google_gid=CAESEOIzutn5rD-X6R4WVZebaXc&google_cver=1 HTTP 302
  • https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMjg0NTA1NDYvdC8w/url/https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=$!{TURN_UUID}&newuser=1&dc_rc=2&dc_mr=5&dc_orig=irm51m1& HTTP 302
  • https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=4457383036734668487&newuser=1&dc_rc=2&dc_mr=5&dc_orig=irm51m1& HTTP 302
  • https://sync-tm.everesttech.net/upi/pid/lons7jax?redir=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fuid%3D%24%7BTM_USER_ID%7D%26bid%3D0rijhbu%26dc_rc%3D3%26dc_mr%3D5%26dc_orig%3Dirm51m1%26 HTTP 302
  • https://sync-tm.everesttech.net/ct/upi/pid/lons7jax?redir=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fuid%3D%24%7BTM_USER_ID%7D%26bid%3D0rijhbu%26dc_rc%3D3%26dc_mr%3D5%26dc_orig%3Dirm51m1%26&_test=abT_PwAAe3y8TwAz
Request Chain 189
  • https://um.simpli.fi/smaato HTTP 302
  • https://s.ad.smaato.net/c/?dspInit=675&dspCookie=7BCE36D896B24D3E9FFB9A9004C0C77F HTTP 302
  • https://capi.connatix.com/us/pixel?puid=b8a8954356&pId=48&gdpr=0&gdpr_consent=&us_privacy={usPrivacyString} HTTP 302
  • https://capi.connatix.com/us/pixel?puid=b8a8954356&pId=48&gdpr=0&gdpr_consent=&us_privacy={usPrivacyString}&final=true
Request Chain 190
  • https://um.simpli.fi/nexxen HTTP 302
  • https://sync.1rx.io/usersync/simplifi/7BCE36D896B24D3E9FFB9A9004C0C77F
Request Chain 191
  • https://um.simpli.fi/triplelift HTTP 302
  • https://eb2.3lift.com/xuid?mid=7969&xuid=7BCE36D896B24D3E9FFB9A9004C0C77F&dongle=yf3 HTTP 302
  • https://eb2.3lift.com/xuid?ld=1&mid=7969&xuid=7BCE36D896B24D3E9FFB9A9004C0C77F&dongle=yf3&gdpr=0&cmp_cs=&us_privacy=
Request Chain 192
  • https://um.simpli.fi/telaria_p HTTP 302
  • https://simplifi.partners.tremorhub.com/sync?UISF=7BCE36D896B24D3E9FFB9A9004C0C77F
Request Chain 193
  • https://um.simpli.fi/tapad HTTP 302
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=2305&partner_device_id=7BCE36D896B24D3E9FFB9A9004C0C77F HTTP 302
  • https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=7BCE36D896B24D3E9FFB9A9004C0C77F
Request Chain 194
  • https://um.simpli.fi/ad_advisor HTTP 302
  • https://aa.agkn.com/adscores/g.pixel?sid=9201915418&sifi_uid=7BCE36D896B24D3E9FFB9A9004C0C77F
Request Chain 195
  • https://um.simpli.fi/intentiq HTTP 302
  • https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=7BCE36D896B24D3E9FFB9A9004C0C77F
Request Chain 198
  • https://um.simpli.fi/dtnx HTTP 302
  • https://fei.pro-market.net/engine?du=24;csync=7BCE36D896B24D3E9FFB9A9004C0C77F;mimetype=img; HTTP 302
  • https://fei.pro-market.net/engine?du=24;csync=7BCE36D896B24D3E9FFB9A9004C0C77F;mimetype=img;sr HTTP 302
  • https://sync.smartadserver.com/getuid?url=https%3A%2F%2Ffei.pro-market.net%2Fengine%3Fsite%3D161185%26size%3D1x1%26du%3D36%26csync%3D[sas_uid] HTTP 302
  • https://sync.smartadserver.com/getuid?url=https://fei.pro-market.net/engine?site=161185&size=1x1&du=36&csync=[sas_uid]&cklb=1
Request Chain 199
  • https://um.simpli.fi/exelatem HTTP 302
  • https://loadm.exelator.com/load/?p=204&g=2191&simid=7BCE36D896B24D3E9FFB9A9004C0C77F&j=0
Request Chain 201
  • https://um.simpli.fi/beachfront HTTP 302
  • https://sync.bfmio.com/sync?pid=141&uid=7BCE36D896B24D3E9FFB9A9004C0C77F
Request Chain 202
  • https://um.simpli.fi/crwdcntrl HTTP 302
  • https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=7BCE36D896B24D3E9FFB9A9004C0C77F HTTP 302
  • https://bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/tpid=7BCE36D896B24D3E9FFB9A9004C0C77F
Request Chain 203
  • https://um.simpli.fi/lj_match HTTP 302
  • https://ce.lijit.com/merge?pid=2&3pid=7BCE36D896B24D3E9FFB9A9004C0C77F HTTP 302
  • https://ce.lijit.com/merge?pid=2&3pid=7BCE36D896B24D3E9FFB9A9004C0C77F&dnr=1
Request Chain 204
  • https://um.simpli.fi/liveramp_match HTTP 302
  • https://idsync.rlcdn.com/419566.gif?partner_uid=7BCE36D896B24D3E9FFB9A9004C0C77F HTTP 307
  • https://idsync.rlcdn.com/1000.gif?memo=CO7NGRIrCicIARDuJBogN0JDRTM2RDg5NkIyNEQzRTlGRkI5QTkwMDRDMEM3N0YQABoNCL78080GEgUI6AcQAEIASgA HTTP 307
  • https://pippio.com/api/sync?pid=5324&it=1&iv=2b42d1c7c77af0b603a3367a60d62e12482a2e185ac7c51d6f0cb5e2286abbe6791426b5417dce21&_=2
Request Chain 205
  • https://www.googleadservices.com/pagead/conversion/1026675585/?random=1773469245372&cv=7&fst=1773469245372&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON HTTP 302
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1026675585/?random=1752528150&cv=7&fst=1773469245372&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLTesQII8d-xAgihuLECCLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgi0xrECCJPasQII29yxAgiH27ECCNPFsQII68yxAgjtzrECCNXPsQII9NqxAgiX1LECCMnbsQIIseGxAgiz4bECCKbdsQIIsN6xAg&cerd=CgSI3b0t&fsk=ChEI8OvOzQYQtqmjsqjx5qviARIsAF5ryEC4ZQ4YfUQJ9En4NFQUJVRnlck7E4peGUBwFwjYB_ArpkwR8zFRpowaAuoL&pscrd=IhMI9ciY49-ekwMVOUUdCR2g_hu8MgwIA2IICAAQABgAIAAyDAgEYggIABAAGAAgADIMCAdiCAgAEAAYACAAMgwICGIICAAQABgAIAAyDAgJYggIABAAGAAgADIMCApiCAgAEAAYACAAMgwIAmIICAAQABgAIAAyDAgLYggIABAAGAAgADIMCBViCAgAEAAYACAAMgwIH2IICAAQABgAIAAyDAgTYggIABAAGAAgADIMCBJiCAgAEAAYACAAOokBaHR0cHM6Ly93d3cuY3liZXJhcmsuY29tL3Jlc291cmNlcy90aHJlYXQtcmVzZWFyY2gtYmxvZy9nb2xkZW4tc2FtbC1uZXdseS1kaXNjb3ZlcmVkLWF0dGFjay10ZWNobmlxdWUtZm9yZ2VzLWF1dGhlbnRpY2F0aW9uLXRvLWNsb3VkLWFwcHN6DAgJYggIABAAGAAgAA HTTP 302
  • https://www.google.com/pagead/1p-conversion/1026675585/?random=1752528150&cv=7&fst=1773469245372&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLTesQII8d-xAgihuLECCLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgi0xrECCJPasQII29yxAgiH27ECCNPFsQII68yxAgjtzrECCNXPsQII9NqxAgiX1LECCMnbsQIIseGxAgiz4bECCKbdsQIIsN6xAg&cerd=CgSI3b0t&fsk=ChEI8OvOzQYQtqmjsqjx5qviARIsAF5ryEC4ZQ4YfUQJ9En4NFQUJVRnlck7E4peGUBwFwjYB_ArpkwR8zFRpowaAuoL&pscrd=IhMI9ciY49-ekwMVOUUdCR2g_hu8MgwIA2IICAAQABgAIAAyDAgEYggIABAAGAAgADIMCAdiCAgAEAAYACAAMgwICGIICAAQABgAIAAyDAgJYggIABAAGAAgADIMCApiCAgAEAAYACAAMgwIAmIICAAQABgAIAAyDAgLYggIABAAGAAgADIMCBViCAgAEAAYACAAMgwIH2IICAAQABgAIAAyDAgTYggIABAAGAAgADIMCBJiCAgAEAAYACAAOokBaHR0cHM6Ly93d3cuY3liZXJhcmsuY29tL3Jlc291cmNlcy90aHJlYXQtcmVzZWFyY2gtYmxvZy9nb2xkZW4tc2FtbC1uZXdseS1kaXNjb3ZlcmVkLWF0dGFjay10ZWNobmlxdWUtZm9yZ2VzLWF1dGhlbnRpY2F0aW9uLXRvLWNsb3VkLWFwcHN6DAgJYggIABAAGAAgAA&is_vtc=1&cid=CAQSvwEA56J1eXvf99l3irOkOkHqLtueQWC4fdMwGpnvpJwTWpuUdTKQ0qah5KvK9Ec3e_INqjABO7ODXvifvX4LR4dRwzjrgh8kfAPeLrtZ5TV2OBWRPML3GTGntJBD4JfLub2fECNz5Qiy5mVYehmMJ1-TySPsOxNWFm7EmLdVgQ9DHr9vHHcz831tJmGORvYB4xDIPlhnGUD-8kw_XitYjorxUavEO99KIoQYQic8CBAUSQkepi8LYXV9nshNjC09Eg&random=3162843267 HTTP 302
  • https://www.google.co.il/pagead/1p-conversion/1026675585/?random=1752528150&cv=7&fst=1773469245372&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLTesQII8d-xAgihuLECCLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgi0xrECCJPasQII29yxAgiH27ECCNPFsQII68yxAgjtzrECCNXPsQII9NqxAgiX1LECCMnbsQIIseGxAgiz4bECCKbdsQIIsN6xAg&cerd=CgSI3b0t&fsk=ChEI8OvOzQYQtqmjsqjx5qviARIsAF5ryEC4ZQ4YfUQJ9En4NFQUJVRnlck7E4peGUBwFwjYB_ArpkwR8zFRpowaAuoL&is_vtc=1&cid=CAQSvwEA56J1eXvf99l3irOkOkHqLtueQWC4fdMwGpnvpJwTWpuUdTKQ0qah5KvK9Ec3e_INqjABO7ODXvifvX4LR4dRwzjrgh8kfAPeLrtZ5TV2OBWRPML3GTGntJBD4JfLub2fECNz5Qiy5mVYehmMJ1-TySPsOxNWFm7EmLdVgQ9DHr9vHHcz831tJmGORvYB4xDIPlhnGUD-8kw_XitYjorxUavEO99KIoQYQic8CBAUSQkepi8LYXV9nshNjC09Eg&random=3162843267&ipr=y&pscrd=IhMI9ciY49-ekwMVOUUdCR2g_hu8MgwIA2IICAAQABgAIAAyDAgEYggIABAAGAAgADIMCAdiCAgAEAAYACAAMgwICGIICAAQABgAIAAyDAgJYggIABAAGAAgADIMCApiCAgAEAAYACAAMgwIAmIICAAQABgAIAAyDAgLYggIABAAGAAgADIMCBViCAgAEAAYACAAMgwIH2IICAAQABgAIAAyDAgTYggIABAAGAAgADIMCBJiCAgAEAAYACAAOokBaHR0cHM6Ly93d3cuY3liZXJhcmsuY29tL3Jlc291cmNlcy90aHJlYXQtcmVzZWFyY2gtYmxvZy9nb2xkZW4tc2FtbC1uZXdseS1kaXNjb3ZlcmVkLWF0dGFjay10ZWNobmlxdWUtZm9yZ2VzLWF1dGhlbnRpY2F0aW9uLXRvLWNsb3VkLWFwcHN6DAgJYggIABAAGAAgAIIBAnAB
Request Chain 207
  • https://um.simpli.fi/an HTTP 302
  • https://ib.adnxs.com/setuid?entity=66&code=7BCE36D896B24D3E9FFB9A9004C0C77F
Request Chain 208
  • https://um.simpli.fi/rb_match HTTP 302
  • https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=7BCE36D896B24D3E9FFB9A9004C0C77F&expires=365
Request Chain 209
  • https://um.simpli.fi/ox_match HTTP 302
  • https://us-u.openx.net/w/1.0/sd?id=537072966&val=7BCE36D896B24D3E9FFB9A9004C0C77F HTTP 302
  • https://us-u.openx.net/w/1.0/sd?cc=1&id=537072966&val=7BCE36D896B24D3E9FFB9A9004C0C77F
Request Chain 210
  • https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_cm&google_sc HTTP 302
  • https://um.simpli.fi/g_match?id=&google_gid=CAESEG0GUjdLWDKrZlv-_dcA2K8&google_cver=1 HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=7BCE36D896B24D3E9FFB9A9004C0C77F HTTP 302
  • https://um.simpli.fi/g_match?id=
Request Chain 212
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=84287645-639f-44a7-be57-32558b730d7e&r=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dpubmatic HTTP 302
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic

225 HTTP transactions

Resource
Path		 Size
x-fer		 Type
MIME-Type
Primary Request golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
www.cyberark.com/resources/threat-research-blog/ 		391 KB
59 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.69.86 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e5c7208df8112b91fb43a21c4b54b1b6e1d66cf70382a90485dd8e0e6c243d07
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.cyberark.com/
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36

Response headers

alt-svc
h3=":443"; ma=86400
cf-cache-status
DYNAMIC
cf-ray
9dc12c728fa7c222-TLV
content-encoding
gzip
content-language
en
content-security-policy
frame-ancestors 'self' https://www.cyberark.com/
content-type
text/html; charset=UTF-8
date
Sat, 14 Mar 2026 06:20:38 GMT
p3p
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
priority
u=0,i
referrer-policy
unsafe-url
server
cloudflare
server-timing
cfExtPri
speculation-rules
"/cdn-cgi/speculation"
strict-transport-security
max-age=31536000; includeSubDomains; preload
vary
accept-encoding
x-content-type-options
nosniff
x-frame-options
DENY
x-xss-protection
1; mode=block
speculation
www.cyberark.com/cdn-cgi/ 		128 B
385 B 		Other
General
Check archive.org
Download Go to
Full URL
https://www.cyberark.com/cdn-cgi/speculation
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.69.86 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Origin
https://www.cyberark.com
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
speculation-rules
"/cdn-cgi/speculation"
x-content-type-options
nosniff
cf-ray
9dc12c76b9d8c222-TLV
access-control-allow-origin
https://www.cyberark.com
alt-svc
h3=":443"; ma=86400
content-length
128
server-timing
cfExtPri
date
Sat, 14 Mar 2026 06:20:38 GMT
content-type
application/speculationrules+json
vary
Origin, Accept-Encoding
server
cloudflare
priority
u=4,i
lato.css
content.cdntwrk.com/css/google-fonts/ 		6 KB
951 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://content.cdntwrk.com/css/google-fonts/lato.css?v=075928935a99
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.102.30 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-66-102-30.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
88b4bd1c3c8e9af6516b562e9679955ff48479ee6a5771e97ef425d1c5425e1f

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

access-control-max-age
0
content-encoding
gzip
etag
W/"37291223d8c6a87c6435a8740e28f134"
age
44371
access-control-allow-methods
GET, HEAD
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
x-amz-cf-id
-B6K45xFqb08wjcWsPRXMh3c5mOcMTCJw-XRnbEjckSUxjNpEy1COw==
date
Fri, 13 Mar 2026 18:01:09 GMT
content-type
text/css
vary
accept-encoding
last-modified
Thu, 12 Mar 2026 14:00:29 GMT
via
1.1 83f1b8f73f37458f38e2ee1fc0b9e68c.cloudfront.net (CloudFront)
access-control-allow-origin
*
x-amz-cf-pop
FRA56-P2
server
AmazonS3
x-amz-server-side-encryption
AES256
hubs.bc805b535b8c6058120d.css
content.cdntwrk.com/css/hubs/ 		267 KB
45 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://content.cdntwrk.com/css/hubs/hubs.bc805b535b8c6058120d.css
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.102.30 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-66-102-30.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
f9c0f62b8a0f09e69dc09f581bf16c8f065ebcb743f1efebb9da584027652566

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

access-control-max-age
0
content-encoding
gzip
etag
W/"2ac79e29fa999480c9f843a0687b864f"
age
255284
access-control-allow-methods
GET, HEAD
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
x-amz-cf-id
bGhr9j1N6pf4QsJnShoBdGXHkMZ3PXEdxqMLu4D6SQLkQ1ofOra5BA==
date
Wed, 11 Mar 2026 07:25:55 GMT
content-type
text/css
vary
accept-encoding
last-modified
Wed, 25 Feb 2026 14:39:51 GMT
via
1.1 83f1b8f73f37458f38e2ee1fc0b9e68c.cloudfront.net (CloudFront)
access-control-allow-origin
*
x-amz-cf-pop
FRA56-P2
server
AmazonS3
x-amz-server-side-encryption
AES256
all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.2/css/ 		101 KB
19 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.2/css/all.min.css
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.25.14 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5ceaaba22d75b58e04150311f596306562a3e595e27ed4b1dfa451b82dda9e50
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Origin
https://www.cyberark.com
Referer

Response headers

cf-cdnjs-via
cfworker/kv
content-encoding
br
cf-cache-status
HIT
etag
"660cc074-49fa"
age
689685
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=mFjkyM6mh5qoyn9vGZ9dAZMFj7ARyvnYKjha2W7ulPYViFQezSJctfRx8V66qzbll0H1xTUBYcHct6NE5ptMVrNuUPvd6rLjyf4B%2FBw0zPiyd5I%3D"}]}
x-content-type-options
nosniff
expires
Thu, 04 Mar 2027 06:20:38 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 14 Mar 2026 06:20:38 GMT
content-type
text/css; charset=utf-8
last-modified
Wed, 03 Apr 2024 02:35:32 GMT
vary
Accept-Encoding
priority
u=0,i=?0
strict-transport-security
max-age=15780000
cache-control
public, max-age=30672000
timing-allow-origin
*
nel
{"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
9dc12c773e5ec22e-TLV
accept-ranges
bytes
access-control-allow-origin
*
content-length
18938
server
cloudflare
fontawesome.css
www.cyberark.com/wp-content/themes/understrap-child-1.0.1/includes/fontawesome/css/ 		225 KB
43 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.cyberark.com/wp-content/themes/understrap-child-1.0.1/includes/fontawesome/css/fontawesome.css?ver=6.5.3
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.69.86 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
219d7416ab96d326fcb9fd3d639821032442f97a256236f4fa6c6063e947013d
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com *.mktoutil.com mktoutil.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wistia.net wistia.net *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi dpmsrv.com *.dpmsrv.com adnxs.com *.adnxs.com *.cloudflareinsights.com cloudflareinsights.com *.smartrecruiters.com smartrecruiters.com js.storylane.io/js/v2/storylane.js app.storylane.io demandbase.com *.demandbase.com company-target.com *.company-target.com venafi.cloud *.venafi.cloud venafi.eu *.venafi.eu vimeo.com *.vimeo.com data: blob:; upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"65d769a6-38532"
age
990506
x-content-type-options
nosniff
expires
Sun, 14 Mar 2027 06:20:38 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 14 Mar 2026 06:20:38 GMT
content-type
text/css
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
last-modified
Thu, 22 Feb 2024 15:35:02 GMT
x-frame-options
SAMEORIGIN
priority
u=0,i=?0
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com *.mktoutil.com mktoutil.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wistia.net wistia.net *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi dpmsrv.com *.dpmsrv.com adnxs.com *.adnxs.com *.cloudflareinsights.com cloudflareinsights.com *.smartrecruiters.com smartrecruiters.com js.storylane.io/js/v2/storylane.js app.storylane.io demandbase.com *.demandbase.com company-target.com *.company-target.com venafi.cloud *.venafi.cloud venafi.eu *.venafi.eu vimeo.com *.vimeo.com data: blob:; upgrade-insecure-requests;
cache-control
public, max-age=31536000
speculation-rules
"/cdn-cgi/speculation"
referrer-policy
strict-origin-when-cross-origin
cf-ray
9dc12c76b9dac222-TLV
permissions-policy
midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
access-control-allow-origin
*
server
cloudflare
en.css
cihost.uberflip.com/cyberArk/master/build/en/ 		527 KB
78 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cihost.uberflip.com/cyberArk/master/build/en/en.css
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.173.205.109 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-173-205-109.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
eae2ae55dd936065b7ad5f5f36db2c99e8525482915139a3b6421d554193ffb1

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

vary
accept-encoding
content-encoding
gzip
x-amz-meta-s3cmd-attrs
atime:1738956171/ctime:1738956171/gid:118/gname:docker/md5:829b80f0bc4cd6464a268395513f8817/mode:33188/mtime:1738956171/uid:1001/uname:runner
etag
W/"829b80f0bc4cd6464a268395513f8817"
age
7093
via
1.1 0140ca34c2d577c2578595f0c9e0050e.cloudfront.net (CloudFront)
x-cache
Hit from cloudfront
x-amz-cf-id
93MomrfW8jzLplvNIIL8Ex0d0Hk6xR2WzDRtgax6jZlqVfax5ZUaeQ==
date
Sat, 14 Mar 2026 04:25:50 GMT
content-type
text/css
last-modified
Fri, 07 Feb 2025 19:22:56 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P12
x-amz-server-side-encryption
AES256
all.min.css
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.2.0/css/ 		46 KB
9 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.2.0/css/all.min.css
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.25.14 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
8891a160f8a2afb81de5259f9f68e5af3782348ea2927ad9e969bc88c7d39984
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Origin
https://www.cyberark.com
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cf-cdnjs-via
cfworker/kv
content-encoding
br
cf-cache-status
HIT
etag
"5eb03e60-b752"
age
883299
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=%2BHRlxe%2Fs3%2BXxYtX9SLeFkdqC%2BGqdm%2Br85YGpRK72Ms05uTZGQ0bQfMcygrZOX5noQi%2FxxjtPg%2ByEaJNUdiLsBqk%2FqXBrgfmXlga%2BJOIKjFwtlXk%3D"}]}
x-content-type-options
nosniff
expires
Thu, 04 Mar 2027 06:20:38 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 14 Mar 2026 06:20:38 GMT
content-type
text/css; charset=utf-8
last-modified
Mon, 04 May 2020 16:10:08 GMT
vary
Accept-Encoding
priority
u=0,i=?0
strict-transport-security
max-age=15780000
cache-control
public, max-age=30672000
timing-allow-origin
*
nel
{"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
9dc12c773e61c22e-TLV
accept-ranges
bytes
access-control-allow-origin
*
content-length
8281
server
cloudflare
css
fonts.googleapis.com/ 		12 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:300,400&display=swap
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
142.250.201.74 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
tzfraa-aq-in-f10.1e100.net
Software
ESF /
Resource Hash
4f677c72abaf624f80c8f5a21f46e71d63f82876fb80a185cbe1377de6a79ea6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Sat, 14 Mar 2026 06:20:39 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 14 Mar 2026 06:20:39 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Sat, 14 Mar 2026 06:20:39 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
enlighterjs.min.css
www.cyberark.com/wp-content/themes/understrap-child/includes/enlighter/ 		78 KB
13 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://www.cyberark.com/wp-content/themes/understrap-child/includes/enlighter/enlighterjs.min.css?ver=5.4.2
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.69.86 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7ef8a267de455c3a72237bf7db0c97c97e35e52452ff9ece15876d0d60f9c0e9
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com *.mktoutil.com mktoutil.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wistia.net wistia.net *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi dpmsrv.com *.dpmsrv.com adnxs.com *.adnxs.com *.cloudflareinsights.com cloudflareinsights.com *.smartrecruiters.com smartrecruiters.com js.storylane.io/js/v2/storylane.js app.storylane.io demandbase.com *.demandbase.com company-target.com *.company-target.com venafi.cloud *.venafi.cloud venafi.eu *.venafi.eu vimeo.com *.vimeo.com data: blob:; upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"5f4d2349-13634"
age
310040
x-content-type-options
nosniff
expires
Sun, 14 Mar 2027 06:20:38 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 14 Mar 2026 06:20:38 GMT
content-type
text/css
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
last-modified
Mon, 31 Aug 2020 16:20:25 GMT
x-frame-options
SAMEORIGIN
priority
u=0,i=?0
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com *.mktoutil.com mktoutil.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wistia.net wistia.net *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi dpmsrv.com *.dpmsrv.com adnxs.com *.adnxs.com *.cloudflareinsights.com cloudflareinsights.com *.smartrecruiters.com smartrecruiters.com js.storylane.io/js/v2/storylane.js app.storylane.io demandbase.com *.demandbase.com company-target.com *.company-target.com venafi.cloud *.venafi.cloud venafi.eu *.venafi.eu vimeo.com *.vimeo.com data: blob:; upgrade-insecure-requests;
cache-control
public, max-age=31536000
speculation-rules
"/cdn-cgi/speculation"
referrer-policy
strict-origin-when-cross-origin
cf-ray
9dc12c76b9dbc222-TLV
permissions-policy
midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
access-control-allow-origin
*
server
cloudflare
enlighterjs.min.js
www.cyberark.com/wp-content/themes/understrap-child/includes/enlighter/ 		57 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.cyberark.com/wp-content/themes/understrap-child/includes/enlighter/enlighterjs.min.js?ver=5.4.2
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.69.86 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
a117f36dba1eb2100f340bb68f3cc4d4c04d50d8a1d61c36a5d0a682aed9d362
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com *.mktoutil.com mktoutil.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wistia.net wistia.net *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi dpmsrv.com *.dpmsrv.com adnxs.com *.adnxs.com *.cloudflareinsights.com cloudflareinsights.com *.smartrecruiters.com smartrecruiters.com js.storylane.io/js/v2/storylane.js app.storylane.io demandbase.com *.demandbase.com company-target.com *.company-target.com venafi.cloud *.venafi.cloud venafi.eu *.venafi.eu vimeo.com *.vimeo.com data: blob:; upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"5f4d2349-e307"
age
990506
x-content-type-options
nosniff
expires
Sun, 14 Mar 2027 06:20:38 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 14 Mar 2026 06:20:38 GMT
content-type
application/javascript
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
last-modified
Mon, 31 Aug 2020 16:20:25 GMT
x-frame-options
SAMEORIGIN
priority
u=1,i=?0
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com *.mktoutil.com mktoutil.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wistia.net wistia.net *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi dpmsrv.com *.dpmsrv.com adnxs.com *.adnxs.com *.cloudflareinsights.com cloudflareinsights.com *.smartrecruiters.com smartrecruiters.com js.storylane.io/js/v2/storylane.js app.storylane.io demandbase.com *.demandbase.com company-target.com *.company-target.com venafi.cloud *.venafi.cloud venafi.eu *.venafi.eu vimeo.com *.vimeo.com data: blob:; upgrade-insecure-requests;
cache-control
public, max-age=31536000
speculation-rules
"/cdn-cgi/speculation"
referrer-policy
strict-origin-when-cross-origin
cf-ray
9dc12c76b9dcc222-TLV
permissions-policy
midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
access-control-allow-origin
*
server
cloudflare
css2
fonts.googleapis.com/ 		2 KB
1 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Roboto+Mono&display=swap
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
142.250.201.74 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
tzfraa-aq-in-f10.1e100.net
Software
ESF /
Resource Hash
acefee5919ad26b14b672618d4db53e269288c6067b374f15383b81767e6322a
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Sat, 14 Mar 2026 06:20:39 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 14 Mar 2026 06:20:39 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Sat, 14 Mar 2026 06:08:55 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
launch-e8e6adf0fe30.min.js
assets.adobedtm.com/789d877fe9a8/09207f0a9c44/ 		298 KB
87 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/launch-e8e6adf0fe30.min.js
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.181.12 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-52-181-12.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
752bae4ad65c49d137fd4a2b82b7229e01a61a769baf0a8d61fb94f2fa663359
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cache-control
max-age=3600
timing-allow-origin
*
content-encoding
gzip
etag
"95c7d7286bf23d5c3413e82814c05732:1762975006.092411"
x-content-type-options
nosniff
expires
Sat, 14 Mar 2026 07:20:40 GMT
accept-ranges
bytes
access-control-allow-origin
https://www.cyberark.com
content-length
89256
date
Sat, 14 Mar 2026 06:20:40 GMT
content-type
application/x-javascript
last-modified
Wed, 12 Nov 2025 19:16:46 GMT
server
AkamaiNetStorage
vary
Accept-Encoding
84cf3062f98cbab994d639a975b2798e.js
ob.segreencolumn.com/i/ 		118 KB
44 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ob.segreencolumn.com/i/84cf3062f98cbab994d639a975b2798e.js
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.7.50 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-108-138-7-50.fra56.r.cloudfront.net
Software
Caddy /
Resource Hash
b9a43d9c1267add6dc178add460022752a200e1f2974e9cb0322fe0a025275b0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cache-control
max-age=43200
content-encoding
gzip
etag
"1d7ca-kJEmJ2fZl66CWiwVxYE4vZPXj60"
age
25695
via
1.1 b4bf06ec43f99543c974d975a6c597da.cloudfront.net (CloudFront)
expires
Sat, 14 Mar 2026 11:12:25 GMT
x-cache
Hit from cloudfront
content-length
44807
x-amz-cf-id
RxPxJ-qHZ53uebPF6Y8KKCm9W9XdwozSEACGqpLAm1JrFrL0lAaK4g==
date
Fri, 13 Mar 2026 23:12:30 GMT
content-type
text/javascript; charset=utf-8
vary
accept-encoding
server
Caddy
x-amz-cf-pop
FRA56-P6
gtm.js
www.googletagmanager.com/ 		506 KB
167 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-5SFWTH
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.141.104 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
tzfraa-ai-in-f8.1e100.net
Software
Google Tag Manager /
Resource Hash
91eb45e152428a3e9f37db0fc1a012a944907dc7c4a26ad0266ac00ea6c67ff1
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

content-encoding
zstd
expires
Sat, 14 Mar 2026 06:20:40 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 14 Mar 2026 06:20:40 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
last-modified
Sat, 14 Mar 2026 06:00:00 GMT
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
*
content-length
170996
x-xss-protection
0
server
Google Tag Manager
cyberark-logo-tagline.svg
www.cyberark.com/wp-content/uploads/2024/10/ 		16 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cyberark.com/wp-content/uploads/2024/10/cyberark-logo-tagline.svg
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.69.86 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
bc765a035f517ac4cbabc8b790609aa1710b89c05f517273d9465cf702dab8c1
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com *.mktoutil.com mktoutil.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wistia.net wistia.net *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi dpmsrv.com *.dpmsrv.com adnxs.com *.adnxs.com *.cloudflareinsights.com cloudflareinsights.com *.smartrecruiters.com smartrecruiters.com js.storylane.io/js/v2/storylane.js app.storylane.io demandbase.com *.demandbase.com company-target.com *.company-target.com venafi.cloud *.venafi.cloud venafi.eu *.venafi.eu vimeo.com *.vimeo.com data: blob:; upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"698c7209-4040"
age
990530
x-content-type-options
nosniff
expires
Sun, 14 Mar 2027 06:20:38 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 14 Mar 2026 06:20:38 GMT
content-type
image/svg+xml
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
last-modified
Wed, 11 Feb 2026 12:11:53 GMT
x-frame-options
SAMEORIGIN
priority
u=2,i
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com *.mktoutil.com mktoutil.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wistia.net wistia.net *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi dpmsrv.com *.dpmsrv.com adnxs.com *.adnxs.com *.cloudflareinsights.com cloudflareinsights.com *.smartrecruiters.com smartrecruiters.com js.storylane.io/js/v2/storylane.js app.storylane.io demandbase.com *.demandbase.com company-target.com *.company-target.com venafi.cloud *.venafi.cloud venafi.eu *.venafi.eu vimeo.com *.vimeo.com data: blob:; upgrade-insecure-requests;
cache-control
public, max-age=31536000
speculation-rules
"/cdn-cgi/speculation"
referrer-policy
strict-origin-when-cross-origin
cf-ray
9dc12c76c9e3c222-TLV
permissions-policy
midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
access-control-allow-origin
*
server
cloudflare
cora-ai-nav.png
www.cyberark.com/wp-content/uploads/2024/05/ 		3 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cyberark.com/wp-content/uploads/2024/05/cora-ai-nav.png
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.69.86 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
22480d7ad71f14068913f91d946e7a5cd5a33a6ddd60494fa090ce6c02aca15d
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com *.mktoutil.com mktoutil.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wistia.net wistia.net *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi dpmsrv.com *.dpmsrv.com adnxs.com *.adnxs.com *.cloudflareinsights.com cloudflareinsights.com *.smartrecruiters.com smartrecruiters.com js.storylane.io/js/v2/storylane.js app.storylane.io demandbase.com *.demandbase.com company-target.com *.company-target.com venafi.cloud *.venafi.cloud venafi.eu *.venafi.eu vimeo.com *.vimeo.com data: blob:; upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cf-bgj
imgq:85,h2pri
etag
"6647a196-7a87"
age
971641
cf-cache-status
HIT
x-content-type-options
nosniff
expires
Sun, 14 Mar 2027 06:20:38 GMT
cf-polished
ok, orig_size=31367
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 14 Mar 2026 06:20:38 GMT
content-type
image/webp
last-modified
Fri, 17 May 2024 18:27:34 GMT
vary
accept, Accept-Encoding
priority
u=4,i
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com *.mktoutil.com mktoutil.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wistia.net wistia.net *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi dpmsrv.com *.dpmsrv.com adnxs.com *.adnxs.com *.cloudflareinsights.com cloudflareinsights.com *.smartrecruiters.com smartrecruiters.com js.storylane.io/js/v2/storylane.js app.storylane.io demandbase.com *.demandbase.com company-target.com *.company-target.com venafi.cloud *.venafi.cloud venafi.eu *.venafi.eu vimeo.com *.vimeo.com data: blob:; upgrade-insecure-requests;
cache-control
public, max-age=31536000
speculation-rules
"/cdn-cgi/speculation"
referrer-policy
strict-origin-when-cross-origin
cf-ray
9dc12c76c9e5c222-TLV
permissions-policy
midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
accept-ranges
bytes
access-control-allow-origin
*
content-length
3416
server
cloudflare
Icons-Globe@2x.png
www.cyberark.com/wp-content/uploads/2020/12/ 		496 B
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cyberark.com/wp-content/uploads/2020/12/Icons-Globe@2x.png
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.69.86 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
58e87012ca6026107d7528768b7de0adad95fadec78500ce274775e993c30a95
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com *.mktoutil.com mktoutil.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wistia.net wistia.net *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi dpmsrv.com *.dpmsrv.com adnxs.com *.adnxs.com *.cloudflareinsights.com cloudflareinsights.com *.smartrecruiters.com smartrecruiters.com js.storylane.io/js/v2/storylane.js app.storylane.io demandbase.com *.demandbase.com company-target.com *.company-target.com venafi.cloud *.venafi.cloud venafi.eu *.venafi.eu vimeo.com *.vimeo.com data: blob:; upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cf-bgj
imgq:85,h2pri
etag
"5fed076b-47b"
age
983274
cf-cache-status
HIT
x-content-type-options
nosniff
expires
Sun, 14 Mar 2027 06:20:39 GMT
cf-polished
ok, orig_size=1147
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 14 Mar 2026 06:20:39 GMT
content-type
image/webp
last-modified
Wed, 30 Dec 2020 23:04:11 GMT
vary
accept, Accept-Encoding
priority
u=4,i
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com *.mktoutil.com mktoutil.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wistia.net wistia.net *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi dpmsrv.com *.dpmsrv.com adnxs.com *.adnxs.com *.cloudflareinsights.com cloudflareinsights.com *.smartrecruiters.com smartrecruiters.com js.storylane.io/js/v2/storylane.js app.storylane.io demandbase.com *.demandbase.com company-target.com *.company-target.com venafi.cloud *.venafi.cloud venafi.eu *.venafi.eu vimeo.com *.vimeo.com data: blob:; upgrade-insecure-requests;
cache-control
public, max-age=31536000
speculation-rules
"/cdn-cgi/speculation"
referrer-policy
strict-origin-when-cross-origin
cf-ray
9dc12c786ad2c222-TLV
permissions-policy
midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
accept-ranges
bytes
access-control-allow-origin
*
content-length
496
server
cloudflare
ajax-loader-white-2x.gif
content.cdntwrk.com/img/hubs/ 		3 KB
3 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://content.cdntwrk.com/img/hubs/ajax-loader-white-2x.gif?v=19a554b579c4
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.102.30 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-66-102-30.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
c1cd0852f3077f1b059e16529d8de16acb490990d6cb796dd74873de0bfd8a91

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

access-control-max-age
0
etag
"5217392f882b27d35ec2e72946f2df7e"
age
256197
access-control-allow-methods
GET, HEAD
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
x-amz-cf-id
IRDaOUcsU9wyXU2fRd0U8GP7_8PS1q_vAylRmef8Cx3XWidiYv-GBg==
date
Wed, 11 Mar 2026 07:10:43 GMT
content-type
image/gif
last-modified
Sat, 07 Mar 2026 20:33:28 GMT
via
1.1 83f1b8f73f37458f38e2ee1fc0b9e68c.cloudfront.net (CloudFront)
accept-ranges
bytes
access-control-allow-origin
*
content-length
2707
x-amz-cf-pop
FRA56-P2
server
AmazonS3
x-amz-server-side-encryption
AES256
chevron-down-64x64.png
content.cdntwrk.com/img/hubs/ 		760 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://content.cdntwrk.com/img/hubs/chevron-down-64x64.png?v=78668873251b
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
18.66.102.30 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-66-102-30.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
5e240679c3215c840cf754104fe7291c77f2f52ad551c95e8c8364d0124938ec

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

access-control-max-age
0
etag
"26818bdf0706c780af4a52b44ea17fdc"
age
255283
access-control-allow-methods
GET, HEAD
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
x-amz-cf-id
V20JolkmPZvOAndbX9E73bCpowNt8twJFayfWgzoeOzfYn_AnMpY_A==
date
Wed, 11 Mar 2026 07:25:57 GMT
content-type
image/png
vary
accept-encoding
last-modified
Wed, 25 Feb 2026 14:39:58 GMT
via
1.1 c2e56cd54e2593df95ccca8a6d98c958.cloudfront.net (CloudFront)
accept-ranges
bytes
access-control-allow-origin
*
content-length
760
x-amz-cf-pop
FRA56-P2
server
AmazonS3
x-amz-server-side-encryption
AES256
Golden-SAML-image.png
www.cyberark.com/wp-content/uploads/2017/11/ 		19 KB
22 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cyberark.com/wp-content/uploads/2017/11/Golden-SAML-image.png
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.69.86 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5f7b5928808a1fab833a81628932ce41e85f33ccdd41664b557a5d8002ddbbb7
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com *.mktoutil.com mktoutil.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wistia.net wistia.net *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi dpmsrv.com *.dpmsrv.com adnxs.com *.adnxs.com *.cloudflareinsights.com cloudflareinsights.com *.smartrecruiters.com smartrecruiters.com js.storylane.io/js/v2/storylane.js app.storylane.io demandbase.com *.demandbase.com company-target.com *.company-target.com venafi.cloud *.venafi.cloud venafi.eu *.venafi.eu vimeo.com *.vimeo.com data: blob:; upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cf-bgj
h2pri,imgq:85
etag
"5d72f385-1c8b3"
cf-cache-status
HIT
x-content-type-options
nosniff
expires
Sun, 14 Mar 2027 06:20:40 GMT
cf-polished
ok, orig_size=116915
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 14 Mar 2026 06:20:40 GMT
content-type
image/webp
last-modified
Sat, 07 Sep 2019 00:02:13 GMT
vary
accept, Accept-Encoding
priority
u=4,i
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com *.mktoutil.com mktoutil.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wistia.net wistia.net *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi dpmsrv.com *.dpmsrv.com adnxs.com *.adnxs.com *.cloudflareinsights.com cloudflareinsights.com *.smartrecruiters.com smartrecruiters.com js.storylane.io/js/v2/storylane.js app.storylane.io demandbase.com *.demandbase.com company-target.com *.company-target.com venafi.cloud *.venafi.cloud venafi.eu *.venafi.eu vimeo.com *.vimeo.com data: blob:; upgrade-insecure-requests;
cache-control
public, max-age=31536000
speculation-rules
"/cdn-cgi/speculation"
referrer-policy
strict-origin-when-cross-origin
cf-ray
9dc12c7d1d16c222-TLV
permissions-policy
midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
accept-ranges
bytes
access-control-allow-origin
*
content-length
18956
server
cloudflare
Image-1.jpg
www.cyberark.com/wp-content/uploads/2017/11/ 		55 KB
59 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cyberark.com/wp-content/uploads/2017/11/Image-1.jpg
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.69.86 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
0ae1d8ff559d265d54750e40737826960c9948d43edfb72b2d33c7fb2dcd3ebb
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com *.mktoutil.com mktoutil.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wistia.net wistia.net *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi dpmsrv.com *.dpmsrv.com adnxs.com *.adnxs.com *.cloudflareinsights.com cloudflareinsights.com *.smartrecruiters.com smartrecruiters.com js.storylane.io/js/v2/storylane.js app.storylane.io demandbase.com *.demandbase.com company-target.com *.company-target.com venafi.cloud *.venafi.cloud venafi.eu *.venafi.eu vimeo.com *.vimeo.com data: blob:; upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cf-bgj
imgq:85,h2pri
etag
"5d72f385-1eba9"
cf-cache-status
HIT
x-content-type-options
nosniff
expires
Sun, 14 Mar 2027 06:20:40 GMT
cf-polished
ok, orig_size=125865
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 14 Mar 2026 06:20:40 GMT
content-type
image/webp
last-modified
Sat, 07 Sep 2019 00:02:13 GMT
vary
accept, Accept-Encoding
priority
u=1,i
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com *.mktoutil.com mktoutil.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wistia.net wistia.net *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi dpmsrv.com *.dpmsrv.com adnxs.com *.adnxs.com *.cloudflareinsights.com cloudflareinsights.com *.smartrecruiters.com smartrecruiters.com js.storylane.io/js/v2/storylane.js app.storylane.io demandbase.com *.demandbase.com company-target.com *.company-target.com venafi.cloud *.venafi.cloud venafi.eu *.venafi.eu vimeo.com *.vimeo.com data: blob:; upgrade-insecure-requests;
cache-control
public, max-age=31536000
speculation-rules
"/cdn-cgi/speculation"
referrer-policy
strict-origin-when-cross-origin
cf-ray
9dc12c7d1d1bc222-TLV
permissions-policy
midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
accept-ranges
bytes
access-control-allow-origin
*
content-length
56394
server
cloudflare
SAML-2.jpg
www.cyberark.com/wp-content/uploads/2017/11/ 		19 KB
23 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cyberark.com/wp-content/uploads/2017/11/SAML-2.jpg
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.69.86 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
17ec719c8fc3d2f11d574963335660fd461c642743f6ca54d9cfd4ead26b3f61
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com *.mktoutil.com mktoutil.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wistia.net wistia.net *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi dpmsrv.com *.dpmsrv.com adnxs.com *.adnxs.com *.cloudflareinsights.com cloudflareinsights.com *.smartrecruiters.com smartrecruiters.com js.storylane.io/js/v2/storylane.js app.storylane.io demandbase.com *.demandbase.com company-target.com *.company-target.com venafi.cloud *.venafi.cloud venafi.eu *.venafi.eu vimeo.com *.vimeo.com data: blob:; upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cf-bgj
h2pri,imgq:85
etag
"5d72f385-6a7a"
cf-cache-status
HIT
x-content-type-options
nosniff
expires
Sun, 14 Mar 2027 06:20:40 GMT
cf-polished
ok, orig_size=27258
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 14 Mar 2026 06:20:40 GMT
content-type
image/webp
last-modified
Sat, 07 Sep 2019 00:02:13 GMT
vary
accept, Accept-Encoding
priority
u=1,i
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com *.mktoutil.com mktoutil.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wistia.net wistia.net *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi dpmsrv.com *.dpmsrv.com adnxs.com *.adnxs.com *.cloudflareinsights.com cloudflareinsights.com *.smartrecruiters.com smartrecruiters.com js.storylane.io/js/v2/storylane.js app.storylane.io demandbase.com *.demandbase.com company-target.com *.company-target.com venafi.cloud *.venafi.cloud venafi.eu *.venafi.eu vimeo.com *.vimeo.com data: blob:; upgrade-insecure-requests;
cache-control
public, max-age=31536000
speculation-rules
"/cdn-cgi/speculation"
referrer-policy
strict-origin-when-cross-origin
cf-ray
9dc12c7d1d1cc222-TLV
permissions-policy
midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
accept-ranges
bytes
access-control-allow-origin
*
content-length
19448
server
cloudflare
SAML-2-b.jpg
www.cyberark.com/wp-content/uploads/2017/11/ 		41 KB
44 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cyberark.com/wp-content/uploads/2017/11/SAML-2-b.jpg
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.69.86 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
623315489f08928990290cd0de14e35c11baea8a50149acc6d27cbef6757dab0
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com *.mktoutil.com mktoutil.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wistia.net wistia.net *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi dpmsrv.com *.dpmsrv.com adnxs.com *.adnxs.com *.cloudflareinsights.com cloudflareinsights.com *.smartrecruiters.com smartrecruiters.com js.storylane.io/js/v2/storylane.js app.storylane.io demandbase.com *.demandbase.com company-target.com *.company-target.com venafi.cloud *.venafi.cloud venafi.eu *.venafi.eu vimeo.com *.vimeo.com data: blob:; upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cf-bgj
imgq:85,h2pri
etag
"5d72f385-c9d3"
cf-cache-status
HIT
x-content-type-options
nosniff
expires
Sun, 14 Mar 2027 06:20:40 GMT
cf-polished
ok, orig_size=51667
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 14 Mar 2026 06:20:40 GMT
content-type
image/webp
last-modified
Sat, 07 Sep 2019 00:02:13 GMT
vary
accept, Accept-Encoding
priority
u=1,i
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com *.mktoutil.com mktoutil.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wistia.net wistia.net *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi dpmsrv.com *.dpmsrv.com adnxs.com *.adnxs.com *.cloudflareinsights.com cloudflareinsights.com *.smartrecruiters.com smartrecruiters.com js.storylane.io/js/v2/storylane.js app.storylane.io demandbase.com *.demandbase.com company-target.com *.company-target.com venafi.cloud *.venafi.cloud venafi.eu *.venafi.eu vimeo.com *.vimeo.com data: blob:; upgrade-insecure-requests;
cache-control
public, max-age=31536000
speculation-rules
"/cdn-cgi/speculation"
referrer-policy
strict-origin-when-cross-origin
cf-ray
9dc12c7d1d1dc222-TLV
permissions-policy
midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
accept-ranges
bytes
access-control-allow-origin
*
content-length
41498
server
cloudflare
ADFS-Public-Certificate.jpg
www.cyberark.com/wp-content/uploads/2017/11/ 		3 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cyberark.com/wp-content/uploads/2017/11/ADFS-Public-Certificate.jpg
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.69.86 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ae39109580d502f2f8728e062d65bee0d92a4b3f45a02b59deb27a904e056d3a
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com *.mktoutil.com mktoutil.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wistia.net wistia.net *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi dpmsrv.com *.dpmsrv.com adnxs.com *.adnxs.com *.cloudflareinsights.com cloudflareinsights.com *.smartrecruiters.com smartrecruiters.com js.storylane.io/js/v2/storylane.js app.storylane.io demandbase.com *.demandbase.com company-target.com *.company-target.com venafi.cloud *.venafi.cloud venafi.eu *.venafi.eu vimeo.com *.vimeo.com data: blob:; upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cf-bgj
h2pri,imgq:85
etag
"5d72f385-3142"
cf-cache-status
HIT
x-content-type-options
nosniff
expires
Sun, 14 Mar 2027 06:20:40 GMT
cf-polished
ok, orig_size=12610
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 14 Mar 2026 06:20:40 GMT
content-type
image/webp
last-modified
Sat, 07 Sep 2019 00:02:13 GMT
vary
accept, Accept-Encoding
priority
u=5,i
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com *.mktoutil.com mktoutil.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wistia.net wistia.net *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi dpmsrv.com *.dpmsrv.com adnxs.com *.adnxs.com *.cloudflareinsights.com cloudflareinsights.com *.smartrecruiters.com smartrecruiters.com js.storylane.io/js/v2/storylane.js app.storylane.io demandbase.com *.demandbase.com company-target.com *.company-target.com venafi.cloud *.venafi.cloud venafi.eu *.venafi.eu vimeo.com *.vimeo.com data: blob:; upgrade-insecure-requests;
cache-control
public, max-age=31536000
speculation-rules
"/cdn-cgi/speculation"
referrer-policy
strict-origin-when-cross-origin
cf-ray
9dc12c7d1d1fc222-TLV
permissions-policy
midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
accept-ranges
bytes
access-control-allow-origin
*
content-length
2658
server
cloudflare
IdP-Name.jpg
www.cyberark.com/wp-content/uploads/2017/11/ 		2 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cyberark.com/wp-content/uploads/2017/11/IdP-Name.jpg
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.69.86 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
da70aaab22df021fab995b92d471f3e92495729f3c219f5d676c6cae8239b417
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com *.mktoutil.com mktoutil.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wistia.net wistia.net *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi dpmsrv.com *.dpmsrv.com adnxs.com *.adnxs.com *.cloudflareinsights.com cloudflareinsights.com *.smartrecruiters.com smartrecruiters.com js.storylane.io/js/v2/storylane.js app.storylane.io demandbase.com *.demandbase.com company-target.com *.company-target.com venafi.cloud *.venafi.cloud venafi.eu *.venafi.eu vimeo.com *.vimeo.com data: blob:; upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cf-bgj
imgq:85,h2pri
etag
"5d72f385-300e"
cf-cache-status
HIT
x-content-type-options
nosniff
expires
Sun, 14 Mar 2027 06:20:40 GMT
cf-polished
ok, orig_size=12302
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 14 Mar 2026 06:20:40 GMT
content-type
image/webp
last-modified
Sat, 07 Sep 2019 00:02:13 GMT
vary
accept, Accept-Encoding
priority
u=5,i
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com *.mktoutil.com mktoutil.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wistia.net wistia.net *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi dpmsrv.com *.dpmsrv.com adnxs.com *.adnxs.com *.cloudflareinsights.com cloudflareinsights.com *.smartrecruiters.com smartrecruiters.com js.storylane.io/js/v2/storylane.js app.storylane.io demandbase.com *.demandbase.com company-target.com *.company-target.com venafi.cloud *.venafi.cloud venafi.eu *.venafi.eu vimeo.com *.vimeo.com data: blob:; upgrade-insecure-requests;
cache-control
public, max-age=31536000
speculation-rules
"/cdn-cgi/speculation"
referrer-policy
strict-origin-when-cross-origin
cf-ray
9dc12c7d1d21c222-TLV
permissions-policy
midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
accept-ranges
bytes
access-control-allow-origin
*
content-length
2434
server
cloudflare
Role-name.jpg
www.cyberark.com/wp-content/uploads/2017/11/ 		3 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cyberark.com/wp-content/uploads/2017/11/Role-name.jpg
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.69.86 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
eee6eaf59f3744b188505112ab4f349b8a7bdb5a460a253042a55ce40373bf2f
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com *.mktoutil.com mktoutil.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wistia.net wistia.net *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi dpmsrv.com *.dpmsrv.com adnxs.com *.adnxs.com *.cloudflareinsights.com cloudflareinsights.com *.smartrecruiters.com smartrecruiters.com js.storylane.io/js/v2/storylane.js app.storylane.io demandbase.com *.demandbase.com company-target.com *.company-target.com venafi.cloud *.venafi.cloud venafi.eu *.venafi.eu vimeo.com *.vimeo.com data: blob:; upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cf-bgj
imgq:85,h2pri
etag
"5d72f385-31b3"
cf-cache-status
HIT
x-content-type-options
nosniff
expires
Sun, 14 Mar 2027 06:20:40 GMT
cf-polished
ok, orig_size=12723
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 14 Mar 2026 06:20:40 GMT
content-type
image/webp
last-modified
Sat, 07 Sep 2019 00:02:13 GMT
vary
accept, Accept-Encoding
priority
u=5,i
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com *.mktoutil.com mktoutil.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wistia.net wistia.net *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi dpmsrv.com *.dpmsrv.com adnxs.com *.adnxs.com *.cloudflareinsights.com cloudflareinsights.com *.smartrecruiters.com smartrecruiters.com js.storylane.io/js/v2/storylane.js app.storylane.io demandbase.com *.demandbase.com company-target.com *.company-target.com venafi.cloud *.venafi.cloud venafi.eu *.venafi.eu vimeo.com *.vimeo.com data: blob:; upgrade-insecure-requests;
cache-control
public, max-age=31536000
speculation-rules
"/cdn-cgi/speculation"
referrer-policy
strict-origin-when-cross-origin
cf-ray
9dc12c7d1d22c222-TLV
permissions-policy
midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
accept-ranges
bytes
access-control-allow-origin
*
content-length
2974
server
cloudflare
PS-aws.jpg
www.cyberark.com/wp-content/uploads/2017/11/ 		4 KB
8 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cyberark.com/wp-content/uploads/2017/11/PS-aws.jpg
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.69.86 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
59a7a179044a073f8724448ebb09aef58d8874ffcbb4138c3f89482c3ea5db63
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com *.mktoutil.com mktoutil.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wistia.net wistia.net *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi dpmsrv.com *.dpmsrv.com adnxs.com *.adnxs.com *.cloudflareinsights.com cloudflareinsights.com *.smartrecruiters.com smartrecruiters.com js.storylane.io/js/v2/storylane.js app.storylane.io demandbase.com *.demandbase.com company-target.com *.company-target.com venafi.cloud *.venafi.cloud venafi.eu *.venafi.eu vimeo.com *.vimeo.com data: blob:; upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cf-bgj
imgq:85,h2pri
etag
"5d72f385-366a"
cf-cache-status
HIT
x-content-type-options
nosniff
expires
Sun, 14 Mar 2027 06:20:40 GMT
cf-polished
ok, orig_size=13930
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 14 Mar 2026 06:20:40 GMT
content-type
image/webp
last-modified
Sat, 07 Sep 2019 00:02:13 GMT
vary
accept, Accept-Encoding
priority
u=1,i
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com *.mktoutil.com mktoutil.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wistia.net wistia.net *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi dpmsrv.com *.dpmsrv.com adnxs.com *.adnxs.com *.cloudflareinsights.com cloudflareinsights.com *.smartrecruiters.com smartrecruiters.com js.storylane.io/js/v2/storylane.js app.storylane.io demandbase.com *.demandbase.com company-target.com *.company-target.com venafi.cloud *.venafi.cloud venafi.eu *.venafi.eu vimeo.com *.vimeo.com data: blob:; upgrade-insecure-requests;
cache-control
public, max-age=31536000
speculation-rules
"/cdn-cgi/speculation"
referrer-policy
strict-origin-when-cross-origin
cf-ray
9dc12c7d1d23c222-TLV
permissions-policy
midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
accept-ranges
bytes
access-control-allow-origin
*
content-length
4146
server
cloudflare
PS-python.jpg
www.cyberark.com/wp-content/uploads/2017/11/ 		20 KB
24 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cyberark.com/wp-content/uploads/2017/11/PS-python.jpg
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.69.86 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
19bb468ba17ea560dc3b738083bfdfbe55dea24abc35be5d6889d1bc2fd31182
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com *.mktoutil.com mktoutil.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wistia.net wistia.net *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi dpmsrv.com *.dpmsrv.com adnxs.com *.adnxs.com *.cloudflareinsights.com cloudflareinsights.com *.smartrecruiters.com smartrecruiters.com js.storylane.io/js/v2/storylane.js app.storylane.io demandbase.com *.demandbase.com company-target.com *.company-target.com venafi.cloud *.venafi.cloud venafi.eu *.venafi.eu vimeo.com *.vimeo.com data: blob:; upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cf-bgj
imgq:85,h2pri
etag
"5d72f385-7d2d"
cf-cache-status
HIT
x-content-type-options
nosniff
expires
Sun, 14 Mar 2027 06:20:40 GMT
cf-polished
ok, orig_size=32045
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 14 Mar 2026 06:20:40 GMT
content-type
image/webp
last-modified
Sat, 07 Sep 2019 00:02:13 GMT
vary
accept, Accept-Encoding
priority
u=1,i
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com *.mktoutil.com mktoutil.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wistia.net wistia.net *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi dpmsrv.com *.dpmsrv.com adnxs.com *.adnxs.com *.cloudflareinsights.com cloudflareinsights.com *.smartrecruiters.com smartrecruiters.com js.storylane.io/js/v2/storylane.js app.storylane.io demandbase.com *.demandbase.com company-target.com *.company-target.com venafi.cloud *.venafi.cloud venafi.eu *.venafi.eu vimeo.com *.vimeo.com data: blob:; upgrade-insecure-requests;
cache-control
public, max-age=31536000
speculation-rules
"/cdn-cgi/speculation"
referrer-policy
strict-origin-when-cross-origin
cf-ray
9dc12c7d1d24c222-TLV
permissions-policy
midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
accept-ranges
bytes
access-control-allow-origin
*
content-length
20136
server
cloudflare
operation-of-tool.jpg
www.cyberark.com/wp-content/uploads/2017/11/ 		32 KB
36 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cyberark.com/wp-content/uploads/2017/11/operation-of-tool.jpg
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.69.86 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
dfcf469c7a66c6b348b50f9cd98a103da4c6ba969f80fb88ee7fed530315b302
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com *.mktoutil.com mktoutil.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wistia.net wistia.net *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi dpmsrv.com *.dpmsrv.com adnxs.com *.adnxs.com *.cloudflareinsights.com cloudflareinsights.com *.smartrecruiters.com smartrecruiters.com js.storylane.io/js/v2/storylane.js app.storylane.io demandbase.com *.demandbase.com company-target.com *.company-target.com venafi.cloud *.venafi.cloud venafi.eu *.venafi.eu vimeo.com *.vimeo.com data: blob:; upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cf-bgj
imgq:85,h2pri
etag
"5d72f385-142b2"
cf-cache-status
HIT
x-content-type-options
nosniff
expires
Sun, 14 Mar 2027 06:20:40 GMT
cf-polished
ok, orig_size=82610
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 14 Mar 2026 06:20:40 GMT
content-type
image/webp
last-modified
Sat, 07 Sep 2019 00:02:13 GMT
vary
accept, Accept-Encoding
priority
u=1,i
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com *.mktoutil.com mktoutil.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wistia.net wistia.net *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi dpmsrv.com *.dpmsrv.com adnxs.com *.adnxs.com *.cloudflareinsights.com cloudflareinsights.com *.smartrecruiters.com smartrecruiters.com js.storylane.io/js/v2/storylane.js app.storylane.io demandbase.com *.demandbase.com company-target.com *.company-target.com venafi.cloud *.venafi.cloud venafi.eu *.venafi.eu vimeo.com *.vimeo.com data: blob:; upgrade-insecure-requests;
cache-control
public, max-age=31536000
speculation-rules
"/cdn-cgi/speculation"
referrer-policy
strict-origin-when-cross-origin
cf-ray
9dc12c7d1d25c222-TLV
permissions-policy
midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
accept-ranges
bytes
access-control-allow-origin
*
content-length
33204
server
cloudflare
mediaproxy
content.cdntwrk.com/ 		7 KB
7 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2017%2F12%2FPredictions-e1513000344330.jpg&size=1&version=1718922359&sig=25183725287a8f589d78c190845ce651&default=
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
18.66.102.30 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-66-102-30.fra56.r.cloudfront.net
Software
/
Resource Hash
fb2f383b5253bd2edfb18c734bcbba3bfceb5b9ba20bb2b6f383edcec368df98

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

x-amz-cf-pop
FRA56-P2
cache-control
max-age=1234567890
age
6992591
via
1.1 c2e56cd54e2593df95ccca8a6d98c958.cloudfront.net (CloudFront)
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
content-length
6980
x-amz-cf-id
-51dJLNVR92rVn2ODf6F6n6UoQJVYxKM_13JzpRR4i_eq2gHUEmuig==
date
Tue, 23 Dec 2025 07:57:28 GMT
content-type
image/webp
content-disposition
inline; filename="Predictions-e1513000344330.webp"
last-modified
Tue, 23 Dec 2025 07:57:18 GMT
mediaproxy
content.cdntwrk.com/ 		6 KB
6 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2017%2F10%2Fplugin-e1508789670134.jpg&size=1&version=1718922359&sig=3d7223731d2f233e7c32519e60e21179&default=
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
18.66.102.30 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-66-102-30.fra56.r.cloudfront.net
Software
/
Resource Hash
7da00d50d49129b8cd6db682a403151b757c09599645060c91db8d379fc9c1e5

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

x-amz-cf-pop
FRA56-P2
cache-control
max-age=1234567890
age
6722866
via
1.1 c2e56cd54e2593df95ccca8a6d98c958.cloudfront.net (CloudFront)
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
content-length
5862
x-amz-cf-id
KNTNJqAl92BGTo_BI760qmAiCW7palWNCxh-aH2Szqp4HQwhxhrt-Q==
date
Fri, 26 Dec 2025 10:52:53 GMT
content-type
image/webp
content-disposition
inline; filename="plugin-e1508789670134.webp"
last-modified
Fri, 26 Dec 2025 10:52:43 GMT
email-decode.min.js
www.cyberark.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/ 		1 KB
901 B 		Script
General
Check archive.org
Download Go to
Full URL
https://www.cyberark.com/cdn-cgi/scripts/5c5dd728/cloudflare-static/email-decode.min.js
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.69.86 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=172800, public
content-encoding
gzip
etag
W/"69a80e61-4d7"
speculation-rules
"/cdn-cgi/speculation"
x-content-type-options
nosniff
cf-ray
9dc12c790b1ac222-TLV
expires
Mon, 16 Mar 2026 06:20:39 GMT
date
Sat, 14 Mar 2026 06:20:39 GMT
content-type
application/javascript
last-modified
Wed, 04 Mar 2026 10:50:09 GMT
vary
Accept-Encoding
server
cloudflare
x-frame-options
DENY
hubs_app.bc805b535b8c6058120d.js
content.cdntwrk.com/js/hubs/ 		827 KB
248 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://content.cdntwrk.com/js/hubs/hubs_app.bc805b535b8c6058120d.js
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.102.30 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-66-102-30.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
a593e91ed4b2d26f56bb1f92f8d0fc1d2741b97823b154404d955a77380d06ec

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

access-control-max-age
0
content-encoding
gzip
etag
W/"40d0aeb30958dbc46b0fc841096c402d"
age
104327
access-control-allow-methods
GET, HEAD
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
x-amz-cf-id
HgsdIRYpqCAwBPWPIRbd5F29E9oBU5b-CBMj3Z7LIGD0NYb3HsL9QA==
date
Fri, 13 Mar 2026 01:21:53 GMT
content-type
application/javascript
vary
accept-encoding
last-modified
Thu, 12 Mar 2026 14:00:39 GMT
via
1.1 83f1b8f73f37458f38e2ee1fc0b9e68c.cloudfront.net (CloudFront)
access-control-allow-origin
*
x-amz-cf-pop
FRA56-P2
server
AmazonS3
x-amz-server-side-encryption
AES256
en.bundle.js
cihost.uberflip.com/cyberArk/master/build/en/ 		298 KB
86 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cihost.uberflip.com/cyberArk/master/build/en/en.bundle.js
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.173.205.109 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-173-205-109.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
dc0e20bf83a2fa90b0138f93f14ba2a0fabf13bda151ea2b07da9e7c8bceb8d8

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

vary
accept-encoding
content-encoding
gzip
x-amz-meta-s3cmd-attrs
atime:1733842508/ctime:1733842508/gid:127/gname:docker/md5:4c60f4327c5d283d7ba850c870a51295/mode:33188/mtime:1733842508/uid:1001/uname:runner
etag
W/"4c60f4327c5d283d7ba850c870a51295"
age
85966
via
1.1 0140ca34c2d577c2578595f0c9e0050e.cloudfront.net (CloudFront)
x-cache
Hit from cloudfront
x-amz-cf-id
he7f9ZNftGfvrK4k9x-F88Xx2aVhEumuC31VT5VVE32T-S8cxx7IWg==
date
Fri, 13 Mar 2026 06:27:54 GMT
content-type
text/javascript
last-modified
Tue, 10 Dec 2024 14:55:12 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P12
x-amz-server-side-encryption
AES256
sha256.min.js
cdnjs.cloudflare.com/ajax/libs/js-sha256/0.9.0/ 		9 KB
4 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/js-sha256/0.9.0/sha256.min.js
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.25.14 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
7157511697db744d384a5a2a8646af23f3c90560abf93bb240fdd690b29a898a
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cf-cdnjs-via
cfworker/kv
content-encoding
br
cf-cache-status
HIT
etag
"5eb03ec6-2339"
age
264041
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=YuznVHQKyHuvZAhYDdmFk2kFhuZr6MihgSOkNeipIdgIUkDfZUpzp%2BIFw7HuLH5l%2F42RkMcGuDQShsf%2FOOiB%2FQqqTRo4mNEWXk6yrojgnAmsP7w%3D"}]}
x-content-type-options
nosniff
expires
Thu, 04 Mar 2027 06:20:39 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 14 Mar 2026 06:20:39 GMT
content-type
application/javascript; charset=utf-8
last-modified
Mon, 04 May 2020 16:11:50 GMT
vary
Accept-Encoding
priority
u=2,i=?0
strict-transport-security
max-age=15780000
cache-control
public, max-age=30672000
timing-allow-origin
*
nel
{"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
9dc12c7b5b7ec21f-TLV
accept-ranges
bytes
access-control-allow-origin
*
content-length
2977
server
cloudflare
External-darkblue.svg
www.cyberark.com/wp-content/uploads/2021/01/ 		952 B
4 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cyberark.com/wp-content/uploads/2021/01/External-darkblue.svg
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.69.86 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
1f150486021d4182821249f13273a7a87862756e2b021e3d19121aaae6a2e09d
Security Headers
Name Value
Content-Security-Policy default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com *.mktoutil.com mktoutil.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wistia.net wistia.net *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi dpmsrv.com *.dpmsrv.com adnxs.com *.adnxs.com *.cloudflareinsights.com cloudflareinsights.com *.smartrecruiters.com smartrecruiters.com js.storylane.io/js/v2/storylane.js app.storylane.io demandbase.com *.demandbase.com company-target.com *.company-target.com venafi.cloud *.venafi.cloud venafi.eu *.venafi.eu vimeo.com *.vimeo.com data: blob:; upgrade-insecure-requests;
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

content-encoding
br
cf-cache-status
HIT
etag
W/"60072571-3b8"
age
990525
x-content-type-options
nosniff
expires
Sun, 14 Mar 2027 06:20:39 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 14 Mar 2026 06:20:39 GMT
content-type
image/svg+xml
vary
Accept-Encoding, Accept-Encoding, Accept-Encoding, Accept-Encoding
last-modified
Tue, 19 Jan 2021 18:31:13 GMT
x-frame-options
SAMEORIGIN
priority
u=3,i
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
default-src 'self' 'unsafe-inline' 'unsafe-eval' cyberark.sc.omtrdc.net sc.omtrdc.net *.everesttech.net everesttech.net *.demdex.net demdex.net *.adobedtm.com adobedtm.com cyberark.tt.omtrdc.net tt.omtrdc.net *.typekit.net typekit.net *.akamaihd.net akamaihd.net s3.amazonaws.com *.amazonaws.com amazonaws.com s3.eu-central-1.amazonaws.com *.adnxs.com adnxs.com *.baidu.com baidu.com *.btttag.com btttag.com *.bluekai.com bluekai.com *.bootstrapcdn.com bootstrapcdn.com *.cdntwrk.com cdntwrk.com *.choozle.com choozle.com *.cloudflare.com cloudflare.com *.cloudfront.net cloudfront.net *.cyberark.com cyberark.com g.doubleclick.net *.doubleclick.net doubleclick.net fls.doubleclick.net *.driftt.com driftt.com *.ensighten.com ensighten.com *.facebook.com *.facebook.net facebook.com facebook.net *.fontawesome.com fontawesome.com *.google.ae *.google.al *.google.am *.google.at *.google.az *.google.ba *.google.be *.google.bg *.google.bj *.google.bs *.google.by *.google.ca *.google.cd *.google.ch *.google.ci *.google.cl *.google.cm *.google.cn *.google.com *.google.cz *.google.de *.google.dk *.google.dz *.google.ee *.google.es *.google.fi *.google.fr *.google.ge *.google.gr *.google.hn *.google.hr *.google.hu *.google.ie *.google.im *.google.iq *.google.is *.google.it *.google.je *.google.jo *.google.kz *.google.lk *.google.lt *.google.lu *.google.lv *.google.mg *.google.mk *.google.ml *.google.mn *.google.mu *.google.nl *.google.no *.google.pl *.google.pt *.google.ro *.google.rs *.google.ru *.google.sc *.google.se *.google.sk *.google.sn *.google.sr *.google.tg *.google.tn *.google.tt *.gstatic.com *.translate.goog google.ae google.al google.am google.at google.az google.ba google.be google.bg google.bj google.bs google.by google.ca google.cd google.ch google.ci google.cl google.cm google.cn google.co.ao google.co.bw google.co.cr google.co.id google.co.il google.co.in google.co.jp google.co.ke google.co.kr google.co.ls google.co.ma google.co.mz google.co.nz google.co.th google.co.ug google.co.uk google.co.uz google.co.ve google.co.za google.co.zw google.com google.com.ar google.com.au google.com.bd google.com.bh google.com.bn google.com.bo google.com.br google.com.bz google.com.co google.com.cy google.com.do google.com.ec google.com.eg google.com.et google.com.fj google.com.gh google.com.gt google.com.hk google.com.jm google.com.kh google.com.kw google.com.lb google.com.ly google.com.mm google.com.mt google.com.mx google.com.my google.com.ng google.com.ni google.com.np google.com.om google.com.pa google.com.pe google.com.ph google.com.pk google.com.pr google.com.py google.com.qa google.com.sa google.com.sg google.com.sl google.com.sv google.com.tr google.com.tw google.com.ua google.com.uy google.com.vc google.com.vn google.cz google.de google.dk google.dz google.ee google.es google.fi google.fr google.ge google.gr google.hn google.hr google.hu google.ie google.im google.iq google.is google.it google.je google.jo google.kz google.lk google.lt google.lu google.lv google.mg google.mk google.ml google.mn google.mu google.nl google.no google.pl google.pt google.ro google.rs google.ru google.sc google.se google.sk google.sn google.sr google.tg google.tn google.tt gstatic.com translate.goog googleadservices.com *.googleapis.com googleapis.com *.cloudfunctions.net cloudfunctions.net *.googletagmanager.com googletagmanager.com *.google-analytics.com google-analytics.com *.herokuapp.com herokuapp.com *.hotjar.com *.hotjar.io hotjar.com hotjar.io *.jquery.com jquery.com *.jsdelivr.net jsdelivr.net *.linkedin.com ads.linkedin.com cdn.linkedin.oribi.io linkedin.com linkedin.oribi.io *.licdn.com licdn.com *.marketo.com *.marketo.net *.mktoresp.com marketo.com marketo.net mktoresp.com *.mktoutil.com mktoutil.com cognitive.microsofttranslator.com *.microsoft.com microsoft.com *.moz.com moz.com *.myfonts.net myfonts.net *.newrelic.com *.nr-data.net newrelic.com nr-data.net *.openx.net openx.net *.rlcdn.com rlcdn.com *.reddit.com *.redditstatic.com reddit.com redditstatic.com *.rubiconproject.com rubiconproject.com *.krxd.net krxd.net *.stackadapt.com srv.stackadapt.com stackadapt.com *.adsrvr.org adsrvr.org *.trustarc.com trustarc.com *.twitter.com twitter.com *.6sc.co *.litix.io 6sc.co litix.io *.unpkg.com unpkg.com *.wistia.com wistia.com *.wistia.net wistia.net *.wpengine.com wpengine.com analytics.yahoo.com *.googleadservices.com *.duosecurity.com duosecurity.com yoast.com *.ceros.com ceros.com *.transistor.fm transistor.fm segreencolumn.com *.segreencolumn.com cnv.event.prod.bidr.io simpli.fi *.simpli.fi dpmsrv.com *.dpmsrv.com adnxs.com *.adnxs.com *.cloudflareinsights.com cloudflareinsights.com *.smartrecruiters.com smartrecruiters.com js.storylane.io/js/v2/storylane.js app.storylane.io demandbase.com *.demandbase.com company-target.com *.company-target.com venafi.cloud *.venafi.cloud venafi.eu *.venafi.eu vimeo.com *.vimeo.com data: blob:; upgrade-insecure-requests;
cache-control
public, max-age=31536000
speculation-rules
"/cdn-cgi/speculation"
referrer-policy
strict-origin-when-cross-origin
cf-ray
9dc12c7d1d26c222-TLV
permissions-policy
midi=(), microphone=(), camera=(), magnetometer=(), gyroscope=(), payment=()
access-control-allow-origin
*
server
cloudflare
css2
fonts.googleapis.com/ 		11 KB
779 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=DM+Sans:ital,opsz,wght@0,9..40,100..1000;1,9..40,100..1000&family=Titillium+Web:ital,wght@0,200;0,300;0,400;0,600;0,700;0,900;1,200;1,300;1,400;1,600;1,700&display=swap
Requested by
Host: cihost.uberflip.com
URL: https://cihost.uberflip.com/cyberArk/master/build/en/en.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
142.250.201.74 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
tzfraa-aq-in-f10.1e100.net
Software
ESF /
Resource Hash
608a2d05568fcb6af26e068d71652de00d4a205768fdc784ed1e859260b26a5c
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://cihost.uberflip.com/cyberArk/master/build/en/en.css

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Sat, 14 Mar 2026 06:20:39 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 14 Mar 2026 06:20:39 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Sat, 14 Mar 2026 06:20:39 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
css
fonts.googleapis.com/ 		29 KB
2 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700,800&display=swap
Requested by
Host: cihost.uberflip.com
URL: https://cihost.uberflip.com/cyberArk/master/build/en/en.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
142.250.201.74 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
tzfraa-aq-in-f10.1e100.net
Software
ESF /
Resource Hash
9d95d1586b80e36867fcc02a259a124fea267f62c2960cad88520cece45ea767
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://cihost.uberflip.com/cyberArk/master/build/en/en.css

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Sat, 14 Mar 2026 06:20:39 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 14 Mar 2026 06:20:39 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Sat, 14 Mar 2026 05:36:08 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
css2
fonts.googleapis.com/ 		668 KB
178 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://fonts.googleapis.com/css2?family=Noto+Sans+JP:wght@100;300;400;500;700;900&display=swap
Requested by
Host: cihost.uberflip.com
URL: https://cihost.uberflip.com/cyberArk/master/build/en/en.css
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
142.250.201.74 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
tzfraa-aq-in-f10.1e100.net
Software
ESF /
Resource Hash
0b0ac7c68db346fa3204bc6a91bc0520a99a9a624909cac18fa4cecd14336c55
Security Headers
Name Value
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://cihost.uberflip.com/cyberArk/master/build/en/en.css

Response headers

content-encoding
gzip
x-content-type-options
nosniff
expires
Sat, 14 Mar 2026 06:20:39 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 14 Mar 2026 06:20:39 GMT
content-type
text/css; charset=utf-8
vary
Sec-Fetch-Dest, Sec-Fetch-Mode, Sec-Fetch-Site
last-modified
Sat, 14 Mar 2026 06:20:39 GMT
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=31536000
link
<https://fonts.gstatic.com>; rel=preconnect; crossorigin
cache-control
private, max-age=86400, stale-while-revalidate=604800
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
x-xss-protection
0
server
ESF
ajax_ping
www.cyberark.com/resources/hubsFront/ 		49 B
413 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.cyberark.com/resources/hubsFront/ajax_ping
Requested by
Host: content.cdntwrk.com
URL: https://content.cdntwrk.com/js/hubs/hubs_app.bc805b535b8c6058120d.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.69.86 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
74935268619be1f087ce67765abd72f80107125f23b346f7615cc9e6a19d4595
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.cyberark.com/
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Accept
*/*

Response headers

content-encoding
gzip
cf-cache-status
DYNAMIC
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
p3p
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
date
Sat, 14 Mar 2026 06:20:40 GMT
content-type
application/json
priority
u=1,i
x-frame-options
DENY
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
frame-ancestors 'self' https://www.cyberark.com/
speculation-rules
"/cdn-cgi/speculation"
referrer-policy
unsafe-url
cf-ray
9dc12c7dad79c222-TLV
x-xss-protection
1; mode=block
content-language
en
server
cloudflare
stats_temp_item_609327918x6a8d83feed5085cdf09c2527c80d69fdceda5922c178d93803f843d5d2b72c0c177346923848dc4f19e4645046937016d3c13031863311d4f4faee2157d0714232ed359c88
www.cyberark.com/resources/hubsFront/signalMetricsTemp/ 		0
458 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.cyberark.com/resources/hubsFront/signalMetricsTemp/stats_temp_item_609327918x6a8d83feed5085cdf09c2527c80d69fdceda5922c178d93803f843d5d2b72c0c177346923848dc4f19e4645046937016d3c13031863311d4f4faee2157d0714232ed359c88?t=1773469239908
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.69.86 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.cyberark.com/
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

content-encoding
gzip
cf-cache-status
DYNAMIC
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
p3p
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
date
Sat, 14 Mar 2026 06:20:40 GMT
content-type
text/html; charset=UTF-8
priority
u=3,i
x-frame-options
DENY
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
frame-ancestors 'self' https://www.cyberark.com/
speculation-rules
"/cdn-cgi/speculation"
referrer-policy
unsafe-url
cf-ray
9dc12c7dbd87c222-TLV
x-xss-protection
1; mode=block
content-language
en
server
cloudflare
tag.aspx
ml314.com/ 		38 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://ml314.com/tag.aspx?142
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
79.77.117.34.bc.googleusercontent.com
Software
UploadServer /
Resource Hash
de51e430d25badc6910e9d30c8d9ddc8f15cd282a8a5096328d4a8328b8ad833

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

x-goog-metageneration
2
x-goog-hash
crc32c=UEcYDw==, md5=aQtiFVGJcziBbzsXNykBSA==
content-encoding
br
age
984
x-goog-stored-content-encoding
identity
x-cache-hit
hit
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
x-goog-stored-content-length
39165
date
Sat, 14 Mar 2026 06:04:16 GMT
last-modified
Fri, 06 Feb 2026 20:20:11 GMT
content-type
application/javascript
vary
Accept-Encoding
x-guploader-uploadid
AGQBYWzRSa_kiGKwPetsEaPKkrtUjNrjPeRRvk0CPQx4rjCmhlKmgBxXZjzj0OyrPJgzZ-LU
cache-control
public,max-age=3600
x-goog-storage-class
STANDARD
via
1.1 google
cache-id
TLV
accept-ranges
bytes
x-goog-generation
1770409211002499
content-length
12544
server
UploadServer
munchkin.js
munchkin.marketo.net/ 		1 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://munchkin.marketo.net/munchkin.js
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.67.142.205 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-67-142-205.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
0db210edd69ae50d9bdf5982ba9e3490972296be80a76a5dbec6159080da2b5d

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

Content-Encoding
gzip
ETag
"515ac790b706e56bc59f71a6205549c9:1772595965.945738"
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
746
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Date
Sat, 14 Mar 2026 06:20:40 GMT
Content-Type
application/x-javascript
Last-Modified
Wed, 04 Mar 2026 03:46:05 GMT
Server
AkamaiNetStorage
Vary
Accept-Encoding
sprite-1x.png
content.cdntwrk.com/img/hubs/ 		59 KB
59 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://content.cdntwrk.com/img/hubs/sprite-1x.png
Requested by
Host: content.cdntwrk.com
URL: https://content.cdntwrk.com/css/hubs/hubs.bc805b535b8c6058120d.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
18.66.102.30 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-66-102-30.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
a249bcffb2d8e92a3bdff919def43b14841803ad93b80ffa864db1090e007594

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://content.cdntwrk.com/css/hubs/hubs.bc805b535b8c6058120d.css

Response headers

access-control-max-age
0
etag
"9e7227669aa01cd19bcc27e802668929"
age
281083
access-control-allow-methods
GET, HEAD
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
x-amz-cf-id
zvjhY-E4cN9I8MZJhqkQ3GhtkxNyul3tpKb3bDWhh_JUEOAgZb9x3g==
date
Wed, 11 Mar 2026 00:15:58 GMT
content-type
image/png
last-modified
Sat, 07 Mar 2026 20:33:29 GMT
via
1.1 c2e56cd54e2593df95ccca8a6d98c958.cloudfront.net (CloudFront)
accept-ranges
bytes
access-control-allow-origin
*
content-length
60511
x-amz-cf-pop
FRA56-P2
server
AmazonS3
x-amz-server-side-encryption
AES256
truncated
/ 		43 B
0 		Image
General
Check archive.org
Download Go to Show image
Full URL
data:truncated
Protocol
DATA
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer

Response headers

Content-Type
image/gif
uparrow.png
content.cdntwrk.com/img/hubs/ 		194 B
529 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://content.cdntwrk.com/img/hubs/uparrow.png
Requested by
Host: content.cdntwrk.com
URL: https://content.cdntwrk.com/css/hubs/hubs.bc805b535b8c6058120d.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
18.66.102.30 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-66-102-30.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
1fb7ee27fdfb34869f89aa51d9af1cf86ecc6800ab591ec3ca78f155742200b2

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://content.cdntwrk.com/css/hubs/hubs.bc805b535b8c6058120d.css

Response headers

access-control-max-age
0
etag
"e5bbd7205c8f2ff1cd6c9f777f31da64"
age
255266
access-control-allow-methods
GET, HEAD
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
x-amz-cf-id
zaiOGOsS4tTa23JEp5K9SeDefEAFs5xr64WG9T768pgnhMi23Jz0Uw==
date
Wed, 11 Mar 2026 07:26:15 GMT
content-type
image/png
vary
accept-encoding
last-modified
Wed, 25 Feb 2026 14:39:58 GMT
via
1.1 c2e56cd54e2593df95ccca8a6d98c958.cloudfront.net (CloudFront)
accept-ranges
bytes
access-control-allow-origin
*
content-length
194
x-amz-cf-pop
FRA56-P2
server
AmazonS3
x-amz-server-side-encryption
AES256
NaPecZTIAOhVxoMyOr9n_E7fdMPmDQ.woff2
fonts.gstatic.com/s/titilliumweb/v19/ 		12 KB
12 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/titilliumweb/v19/NaPecZTIAOhVxoMyOr9n_E7fdMPmDQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=DM+Sans:ital,opsz,wght@0,9..40,100..1000;1,9..40,100..1000&family=Titillium+Web:ital,wght@0,200;0,300;0,400;0,600;0,700;0,900;1,200;1,300;1,400;1,600;1,700&display=swap
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.201.163 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
par21s23-in-f3.1e100.net
Software
sffe /
Resource Hash
861b80b49d2a634d8746e2e45c672309d9ba69a2fdd95da2af034d7a1d09b3f9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Origin
https://www.cyberark.com
Referer
https://fonts.googleapis.com/

Response headers

age
7765
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Sun, 14 Mar 2027 04:11:15 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 14 Mar 2026 04:11:15 GMT
last-modified
Tue, 09 Sep 2025 18:58:54 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
12344
x-xss-protection
0
server
sffe
fa-solid-900.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.2/webfonts/ 		153 KB
153 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.2/webfonts/fa-solid-900.woff2
Requested by
Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.2/css/all.min.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.25.14 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
ae17c16afbea216707b2203ea1cf9bdb45b9bfe47d0f4ae3258ddbc6294dd02f
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Origin
https://www.cyberark.com
Referer
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.2/css/all.min.css

Response headers

cf-cdnjs-via
cfworker/kv
cf-cache-status
HIT
etag
"660cc074-262f0"
age
606949
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=42Ma2FGxoJiPDyJss4n8%2B5ygOMV9T8P13vDMcaw1L9pM%2BgzvVOkZq7msutIKie9sTlnopRp3u27w%2B91GH%2BsYOfXsJfCwTVk72wcnh4Gwhy5%2BbYE%3D"}]}
x-content-type-options
nosniff
expires
Thu, 04 Mar 2027 06:20:40 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 14 Mar 2026 06:20:40 GMT
content-type
application/octet-stream; charset=utf-8
last-modified
Wed, 03 Apr 2024 02:35:32 GMT
vary
Accept-Encoding
priority
u=0,i=?0
strict-transport-security
max-age=15780000
cache-control
public, max-age=30672000
timing-allow-origin
*
nel
{"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
9dc12c7e39f1c22e-TLV
accept-ranges
bytes
access-control-allow-origin
*
content-length
156400
server
cloudflare
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
fonts.gstatic.com/s/opensans/v44/ 		47 KB
47 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v44/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTS-muw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700,800&display=swap
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.201.163 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
par21s23-in-f3.1e100.net
Software
sffe /
Resource Hash
d8e4fe0452aa2076429a9bb5d8757d00a994dd95986cf950e9a1a371b9a072a0
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Origin
https://www.cyberark.com
Referer
https://fonts.googleapis.com/

Response headers

age
389816
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Tue, 09 Mar 2027 18:03:44 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 09 Mar 2026 18:03:44 GMT
last-modified
Mon, 15 Sep 2025 16:30:41 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
48320
x-xss-protection
0
server
sffe
FontAwesome6Pro-Light.woff2
cihost.uberflip.com/cyberArk/master/build/fonts/ 		335 KB
336 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cihost.uberflip.com/cyberArk/master/build/fonts/FontAwesome6Pro-Light.woff2
Requested by
Host: cihost.uberflip.com
URL: https://cihost.uberflip.com/cyberArk/master/build/en/en.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.173.205.109 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-173-205-109.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
33bfff284b4455e2dd459c4bf0e6076a5fe5f8632b42b8ccd2dd5a0d55dbcfbb

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Origin
https://www.cyberark.com
Referer
https://cihost.uberflip.com/cyberArk/master/build/en/en.css

Response headers

etag
"c20e0f2006126b2025f47c77e1d5ee51"
access-control-allow-methods
GET, HEAD
x-cache
RefreshHit from cloudfront
x-amz-cf-id
9BMigK4q3URJivf9dNucdhFPQnrjDN3GhEzaHz2diV3MUQnraH6rXQ==
date
Sat, 14 Mar 2026 06:20:41 GMT
content-type
font/woff2
vary
Origin,Access-Control-Request-Headers,Access-Control-Request-Method,accept-encoding
last-modified
Mon, 24 Jun 2024 06:06:57 GMT
x-amz-meta-s3cmd-attrs
atime:1719209208/ctime:1719209208/gid:127/gname:docker/md5:c20e0f2006126b2025f47c77e1d5ee51/mode:33188/mtime:1719209208/uid:1001/uname:runner
via
1.1 24df21f8156a0df29febdf6c3e09e32c.cloudfront.net (CloudFront)
accept-ranges
bytes
access-control-allow-origin
*
content-length
343492
x-amz-cf-pop
FRA56-P12
server
AmazonS3
x-amz-server-side-encryption
AES256
rP2Hp2ywxg089UriCZOIHQ.woff2
fonts.gstatic.com/s/dmsans/v17/ 		61 KB
61 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/dmsans/v17/rP2Hp2ywxg089UriCZOIHQ.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=DM+Sans:ital,opsz,wght@0,9..40,100..1000;1,9..40,100..1000&family=Titillium+Web:ital,wght@0,200;0,300;0,400;0,600;0,700;0,900;1,200;1,300;1,400;1,600;1,700&display=swap
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.201.163 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
par21s23-in-f3.1e100.net
Software
sffe /
Resource Hash
ca72d2bcea8f4daa783dbdfa2d9b46068c3ce38168e05918fb867aa453b4f890
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Origin
https://www.cyberark.com
Referer
https://fonts.googleapis.com/

Response headers

age
123322
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Fri, 12 Mar 2027 20:05:18 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Thu, 12 Mar 2026 20:05:18 GMT
last-modified
Wed, 10 Sep 2025 16:30:14 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
62724
x-xss-protection
0
server
sffe
fontawesome-webfont.woff2
cihost.uberflip.com/cyberark-migration-tv2/OB-CyberArk_Migration_Tv2/assets/fonts/ 		75 KB
76 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cihost.uberflip.com/cyberark-migration-tv2/OB-CyberArk_Migration_Tv2/assets/fonts/fontawesome-webfont.woff2?v=4.7.0
Requested by
Host: cihost.uberflip.com
URL: https://cihost.uberflip.com/cyberArk/master/build/en/en.css
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.173.205.109 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-173-205-109.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Origin
https://www.cyberark.com
Referer
https://cihost.uberflip.com/cyberArk/master/build/en/en.css

Response headers

etag
"af7ae505a9eed503f8b8e6982036873e"
age
79644
access-control-allow-methods
GET, HEAD
x-cache
Hit from cloudfront
x-amz-cf-id
6UgfX76rbfFxLVFJGuvc-0rm4KZKDc04uKKOupdvAp2wYfi7_ZvDDg==
date
Fri, 13 Mar 2026 08:13:17 GMT
content-type
binary/octet-stream
last-modified
Wed, 27 Jan 2021 17:56:57 GMT
vary
Origin,Access-Control-Request-Headers,Access-Control-Request-Method,accept-encoding
x-amz-meta-s3cmd-attrs
atime:1611770160/ctime:1611770160/gid:117/gname:docker/md5:af7ae505a9eed503f8b8e6982036873e/mode:33188/mtime:1611770160/uid:1001/uname:runner
via
1.1 24df21f8156a0df29febdf6c3e09e32c.cloudfront.net (CloudFront)
accept-ranges
bytes
access-control-allow-origin
*
content-length
77160
x-amz-cf-pop
FRA56-P12
server
AmazonS3
372722_2_unhinted_0.woff2
cihost.uberflip.com/cyberArk/OB-3963/build/fonts/ 		25 KB
26 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cihost.uberflip.com/cyberArk/OB-3963/build/fonts/372722_2_unhinted_0.woff2
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.173.205.109 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-173-205-109.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
2f5f9d511700318e988d3ef843afc49224162c8bb2435db7b9dc3590f525306f

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Origin
https://www.cyberark.com
Referer
https://www.cyberark.com/

Response headers

etag
"83914a011477cb60998949144e2ac5aa"
age
86268
access-control-allow-methods
GET, HEAD
x-cache
Hit from cloudfront
x-amz-cf-id
C_wEzg5WtracZ64tk10rrjpV7OcEmxc3hhK2ggVP9pk8FggJLiRQ1g==
date
Fri, 13 Mar 2026 06:22:53 GMT
content-type
binary/octet-stream
last-modified
Wed, 27 May 2020 16:17:01 GMT
vary
Origin,Access-Control-Request-Headers,Access-Control-Request-Method,accept-encoding
x-amz-meta-s3cmd-attrs
atime:1590596208/ctime:1590596208/gid:116/gname:docker/md5:83914a011477cb60998949144e2ac5aa/mode:33188/mtime:1590596208/uid:1001/uname:runner
via
1.1 24df21f8156a0df29febdf6c3e09e32c.cloudfront.net (CloudFront)
accept-ranges
bytes
access-control-allow-origin
*
content-length
26033
x-amz-cf-pop
FRA56-P12
server
AmazonS3
372722_4_unhinted_0.woff2
cihost.uberflip.com/cyberArk/OB-3963/build/fonts/ 		25 KB
25 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cihost.uberflip.com/cyberArk/OB-3963/build/fonts/372722_4_unhinted_0.woff2
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.173.205.109 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-173-205-109.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
66c708b80cab108a2fde84cac9677c07435537bc9d06085ccd1ac80cb93513b4

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Origin
https://www.cyberark.com
Referer
https://www.cyberark.com/

Response headers

etag
"da77e86db861301f9320c467d834e649"
age
86268
access-control-allow-methods
GET, HEAD
x-cache
Hit from cloudfront
x-amz-cf-id
rQhrA2gVM_gJ5DkChJULdQHg7dH77HQODqbyqDaMLQR09McHuJo2DA==
date
Fri, 13 Mar 2026 06:22:53 GMT
content-type
binary/octet-stream
last-modified
Wed, 27 May 2020 16:17:01 GMT
vary
Origin,Access-Control-Request-Headers,Access-Control-Request-Method,accept-encoding
x-amz-meta-s3cmd-attrs
atime:1590596208/ctime:1590596208/gid:116/gname:docker/md5:da77e86db861301f9320c467d834e649/mode:33188/mtime:1590596208/uid:1001/uname:runner
via
1.1 24df21f8156a0df29febdf6c3e09e32c.cloudfront.net (CloudFront)
accept-ranges
bytes
access-control-allow-origin
*
content-length
25237
x-amz-cf-pop
FRA56-P12
server
AmazonS3
fa-brands-400.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.2.0/webfonts/ 		63 KB
63 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.2.0/webfonts/fa-brands-400.woff2
Requested by
Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.2.0/css/all.min.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.25.14 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
4d0130d314f1669c9ea5a911d401d6250f96386a52b0c38f7b3fb43cdcd10589
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Origin
https://www.cyberark.com
Referer
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.2.0/css/all.min.css

Response headers

cf-cdnjs-via
cfworker/kv
cf-cache-status
HIT
etag
"5eb03e60-fa90"
age
16124465
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=MBnNU49sVsaZOaKWTNG6elhqPfhWowqL2BXAZEnhXTiqgtkowx9m8zHZgnyVZKXoLpqyZT7guyh%2FGPwJo%2F%2B2t5Et8xcqyMsWzLRFTsEJuD0Qot8%3D"}]}
x-content-type-options
nosniff
expires
Thu, 04 Mar 2027 06:20:40 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 14 Mar 2026 06:20:40 GMT
content-type
application/octet-stream; charset=utf-8
last-modified
Mon, 04 May 2020 16:10:08 GMT
vary
Accept-Encoding
priority
u=0,i=?0
strict-transport-security
max-age=15780000
cache-control
public, max-age=30672000
timing-allow-origin
*
nel
{"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
9dc12c7e39f2c22e-TLV
accept-ranges
bytes
access-control-allow-origin
*
content-length
64144
server
cloudflare
fa-solid-900.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/5.2.0/webfonts/ 		61 KB
62 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.2.0/webfonts/fa-solid-900.woff2
Requested by
Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.2.0/css/all.min.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.25.14 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
5c7df99df232586111917083a85aa31b82ee29e48ca2990e13fae0c0663a923f
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Origin
https://www.cyberark.com
Referer
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/5.2.0/css/all.min.css

Response headers

cf-cdnjs-via
cfworker/kv
cf-cache-status
HIT
etag
"5eb03e60-f408"
age
868038
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=5xtfAg9sJZtVrBFWMTc8U0UJM%2FfgRWctc5RBq87WkDeZJsB2Wa7P60QvY4UEIF24cuhpM6j48aYaOLUqWlpNVux%2FvYOVyMDSHFybwKp1qQ3xRMk%3D"}]}
x-content-type-options
nosniff
expires
Thu, 04 Mar 2027 06:20:40 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 14 Mar 2026 06:20:40 GMT
content-type
application/octet-stream; charset=utf-8
last-modified
Mon, 04 May 2020 16:10:08 GMT
vary
Accept-Encoding
priority
u=0,i=?0
strict-transport-security
max-age=15780000
cache-control
public, max-age=30672000
timing-allow-origin
*
nel
{"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
9dc12c7e39f3c22e-TLV
accept-ranges
bytes
access-control-allow-origin
*
content-length
62472
server
cloudflare
memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTUGmu1aB.woff2
fonts.gstatic.com/s/opensans/v44/ 		26 KB
26 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/opensans/v44/memvYaGs126MiZpBA-UvWbX2vVnXBbObj2OVTUGmu1aB.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css?family=Open+Sans:300,400,600,700,800&display=swap
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.201.163 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
par21s23-in-f3.1e100.net
Software
sffe /
Resource Hash
8f80f993e523f2e6c2d097552740fd26331658da23ffad31d26edcdd3aeec370
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Origin
https://www.cyberark.com
Referer
https://fonts.googleapis.com/

Response headers

age
390183
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Tue, 09 Mar 2027 17:57:37 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 09 Mar 2026 17:57:37 GMT
last-modified
Mon, 15 Sep 2025 16:30:32 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
26596
x-xss-protection
0
server
sffe
NaPDcZTIAOhVxoMyOr9n_E7ffHjDGItzYw.woff2
fonts.gstatic.com/s/titilliumweb/v19/ 		11 KB
11 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://fonts.gstatic.com/s/titilliumweb/v19/NaPDcZTIAOhVxoMyOr9n_E7ffHjDGItzYw.woff2
Requested by
Host: fonts.googleapis.com
URL: https://fonts.googleapis.com/css2?family=DM+Sans:ital,opsz,wght@0,9..40,100..1000;1,9..40,100..1000&family=Titillium+Web:ital,wght@0,200;0,300;0,400;0,600;0,700;0,900;1,200;1,300;1,400;1,600;1,700&display=swap
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.250.201.163 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
par21s23-in-f3.1e100.net
Software
sffe /
Resource Hash
9e3162d81ed6681322ab34791660f1b45c79945197e7a7dbb217005b2926caf4
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Origin
https://www.cyberark.com
Referer
https://fonts.googleapis.com/

Response headers

age
391011
report-to
{"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
x-content-type-options
nosniff
expires
Tue, 09 Mar 2027 17:43:49 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Mon, 09 Mar 2026 17:43:49 GMT
last-modified
Tue, 09 Sep 2025 18:57:42 GMT
content-type
font/woff2
cache-control
public, max-age=31536000
timing-allow-origin
*
cross-origin-opener-policy
same-origin; report-to="apps-themes"
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
accept-ranges
bytes
access-control-allow-origin
*
content-length
11732
x-xss-protection
0
server
sffe
fa-brands-400.woff2
cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.2/webfonts/ 		115 KB
116 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.2/webfonts/fa-brands-400.woff2
Requested by
Host: cdnjs.cloudflare.com
URL: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.2/css/all.min.css
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.17.25.14 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
232c6f6a7678304f9efaa26f30b1610debc2ba9f4cd636b5e6751c8d73761b92
Security Headers
Name Value
Strict-Transport-Security max-age=15780000
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Origin
https://www.cyberark.com
Referer
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.2/css/all.min.css

Response headers

cf-cdnjs-via
cfworker/kv
cf-cache-status
HIT
etag
"660cc074-1cc5c"
age
697245
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=teV59yJwJLMaVf4smRlb8VC5n5XS%2BHvvvz%2BCzRrWDiKQdIrjJgi3FrKxM9C4V3o4Etf%2BGi6thpAIDFmVf%2Fe19bLxsw%2BJxJxn8mwn3PyZElkgBFI%3D"}]}
x-content-type-options
nosniff
expires
Thu, 04 Mar 2027 06:20:40 GMT
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 14 Mar 2026 06:20:40 GMT
content-type
application/octet-stream; charset=utf-8
last-modified
Wed, 03 Apr 2024 02:35:32 GMT
vary
Accept-Encoding
priority
u=0,i=?0
strict-transport-security
max-age=15780000
cache-control
public, max-age=30672000
timing-allow-origin
*
nel
{"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
cross-origin-resource-policy
cross-origin
cf-ray
9dc12c7e7a08c22e-TLV
accept-ranges
bytes
access-control-allow-origin
*
content-length
117852
server
cloudflare
aHViPTEwODU0MCZjbWQ9YmFja2dyb3VuZF9pbWFnZSZ2ZXJzaW9uPTE3MTg3NzAxMDMmc2lnPTZiMjEwNzkxYWUwNDc5NGRjMjRkYmM3YjBhOTVkNzM1
content.cdntwrk.com/files/ 		20 KB
21 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://content.cdntwrk.com/files/aHViPTEwODU0MCZjbWQ9YmFja2dyb3VuZF9pbWFnZSZ2ZXJzaW9uPTE3MTg3NzAxMDMmc2lnPTZiMjEwNzkxYWUwNDc5NGRjMjRkYmM3YjBhOTVkNzM1
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
18.66.102.30 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-66-102-30.fra56.r.cloudfront.net
Software
/
Resource Hash
a36681fe4fd06eb0856952cddb2047065db39f00e819dbf0e9715540083f8198

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/

Response headers

x-amz-cf-pop
FRA56-P2
x-robots-tag
noindex
cache-control
max-age=15552000
etag
"1613686879-be99bf6a6e12dc968d17e108eb199e37"
age
10849569
via
1.1 c2e56cd54e2593df95ccca8a6d98c958.cloudfront.net (CloudFront)
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
x-amz-cf-id
gpbtPqDRxl0j1MjIGlkVKjxoiD5fXdlR52O4tg4Ejm3F-79st9n9mA==
date
Sat, 08 Nov 2025 16:34:31 GMT
content-type
image/webp
content-disposition
inline; filename="background_image.webp"
last-modified
Thu, 18 Feb 2021 22:21:19 GMT
372722_1_unhinted_0.woff2
cihost.uberflip.com/cyberArk/OB-3963/build/fonts/ 		25 KB
26 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://cihost.uberflip.com/cyberArk/OB-3963/build/fonts/372722_1_unhinted_0.woff2
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.173.205.109 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-173-205-109.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
d4761d421bbf2f059126b9ce4f5e0a9f7bc83b046a58162780a2b9c3ab8c9a56

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Origin
https://www.cyberark.com
Referer
https://www.cyberark.com/

Response headers

etag
"0601eae673330329b340003d42fc1c36"
age
86268
access-control-allow-methods
GET, HEAD
x-cache
Hit from cloudfront
x-amz-cf-id
jHkE3yMARJnyAgMgjMk2y37Lzsfv7Otyk14i05s_dibleAcHWEUkcQ==
date
Fri, 13 Mar 2026 06:22:53 GMT
content-type
binary/octet-stream
last-modified
Wed, 27 May 2020 16:17:01 GMT
vary
Origin,Access-Control-Request-Headers,Access-Control-Request-Method,accept-encoding
x-amz-meta-s3cmd-attrs
atime:1590596208/ctime:1590596208/gid:116/gname:docker/md5:0601eae673330329b340003d42fc1c36/mode:33188/mtime:1590596208/uid:1001/uname:runner
via
1.1 24df21f8156a0df29febdf6c3e09e32c.cloudfront.net (CloudFront)
accept-ranges
bytes
access-control-allow-origin
*
content-length
26041
x-amz-cf-pop
FRA56-P12
server
AmazonS3
ajax_updateMAPUsers
www.cyberark.com/resources/hubsFront/ 		116 B
429 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.cyberark.com/resources/hubsFront/ajax_updateMAPUsers
Requested by
Host: content.cdntwrk.com
URL: https://content.cdntwrk.com/js/hubs/hubs_app.bc805b535b8c6058120d.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.69.86 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
892a637e286877d9688ab92a770cdefb05f0e0b5600c7063adc2cd6f2fecbf8f
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.cyberark.com/
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Accept
*/*

Response headers

content-encoding
gzip
cf-cache-status
DYNAMIC
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
p3p
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
date
Sat, 14 Mar 2026 06:20:40 GMT
content-type
application/json
priority
u=1,i
x-frame-options
DENY
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
frame-ancestors 'self' https://www.cyberark.com/
referrer-policy
unsafe-url
cf-ray
9dc12c7e8decc222-TLV
x-xss-protection
1; mode=block
content-language
en
server
cloudflare
main.js
www.cyberark.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/ea2d291c0fdc/ Frame 473C
Redirect Chain
  • https://www.cyberark.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
  • https://www.cyberark.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/ea2d291c0fdc/main.js?
27 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.cyberark.com/cdn-cgi/challenge-platform/h/g/scripts/jsd/ea2d291c0fdc/main.js?
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H3
Server
104.16.69.86 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
4669b2dfe555b8033e408c1fc12ab79badbda018bb544508e231cf74a926afbd
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=14400, stale-if-error=10800, stale-while-revalidate=10800, public
content-encoding
gzip
speculation-rules
"/cdn-cgi/speculation"
x-content-type-options
nosniff
cf-ray
9dc12c7f3e34c222-TLV
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
date
Sat, 14 Mar 2026 06:20:40 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
server
cloudflare
priority
u=3,i=?0

Redirect headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
max-age=300, stale-if-error=10800, stale-while-revalidate=10800, public
location
/cdn-cgi/challenge-platform/h/g/scripts/jsd/ea2d291c0fdc/main.js?
speculation-rules
"/cdn-cgi/speculation"
x-content-type-options
nosniff
cf-ray
9dc12c7e8df3c222-TLV
access-control-allow-origin
*
alt-svc
h3=":443"; ma=86400
content-length
0
server-timing
cfExtPri
date
Sat, 14 Mar 2026 06:20:40 GMT
vary
Accept-Encoding
server
cloudflare
priority
u=3,i=?0
mediaproxy
content.cdntwrk.com/ 		117 KB
118 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2026%2F01%2Fpasskey-global-breakthrough-v1.png&size=1&version=1770099450&sig=c8e1d75c36a77d4bfe5b8acc48c700b0&default=
Requested by
Host: content.cdntwrk.com
URL: https://content.cdntwrk.com/js/hubs/hubs_app.bc805b535b8c6058120d.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
18.66.102.30 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-66-102-30.fra56.r.cloudfront.net
Software
/
Resource Hash
2cae1e0f64116783be1860b6b3a275157057d0f24f028e28c6e98ee6aa82a1a8

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

x-amz-cf-pop
FRA56-P2
cache-control
max-age=1234567890
age
3368903
via
1.1 c2e56cd54e2593df95ccca8a6d98c958.cloudfront.net (CloudFront)
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
content-length
120164
x-amz-cf-id
NLmtw6WqwkHC0ivOlfMUwNeAkf9b9VcN4VIDax1eyGC4fKhOM2Wv_w==
date
Tue, 03 Feb 2026 06:32:17 GMT
content-type
image/webp
content-disposition
inline; filename="passkey-global-breakthrough-v1.webp"
last-modified
Tue, 03 Feb 2026 06:32:07 GMT
mediaproxy
content.cdntwrk.com/ 		202 KB
203 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2026%2F01%2Fcommand-injection-in-apache.png&size=1&version=1770040745&sig=c0232f292f5fc10e65dea0943381d5bc&default=
Requested by
Host: content.cdntwrk.com
URL: https://content.cdntwrk.com/js/hubs/hubs_app.bc805b535b8c6058120d.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
18.66.102.30 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-66-102-30.fra56.r.cloudfront.net
Software
/
Resource Hash
aafea011e884eb0b14840d9a8db02927da95aa02909d31bf856a72cd20246a35

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

x-amz-cf-pop
FRA56-P2
cache-control
max-age=1234567890
age
3428370
via
1.1 c2e56cd54e2593df95ccca8a6d98c958.cloudfront.net (CloudFront)
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
content-length
207070
x-amz-cf-id
SRHCgMN28MH2t0zJwGtia9AUEM_ObvSA0YJjU21a-W61FPT9bRXRDA==
date
Mon, 02 Feb 2026 14:01:10 GMT
content-type
image/webp
content-disposition
inline; filename="command-injection-in-apache.webp"
last-modified
Mon, 02 Feb 2026 14:01:00 GMT
mediaproxy
content.cdntwrk.com/ 		199 KB
199 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2026%2F01%2Funo-reverse-card.png&size=1&version=1769608948&sig=0876559c5802cb7c241cbc092aef42da&default=
Requested by
Host: content.cdntwrk.com
URL: https://content.cdntwrk.com/js/hubs/hubs_app.bc805b535b8c6058120d.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
18.66.102.30 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-66-102-30.fra56.r.cloudfront.net
Software
/
Resource Hash
e236ccec492424188f1f5d91e08023e26ca3203db3842cf3e54f891514a0fc41

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

x-amz-cf-pop
FRA56-P2
cache-control
max-age=1234567890
age
3860069
via
1.1 c2e56cd54e2593df95ccca8a6d98c958.cloudfront.net (CloudFront)
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
content-length
203650
x-amz-cf-id
HkEV91aqcFMkZIDmBazhN3mZQrmo1c8ECpHbsN91fb4TwshAi495DQ==
date
Wed, 28 Jan 2026 14:06:11 GMT
content-type
image/webp
content-disposition
inline; filename="uno-reverse-card.webp"
last-modified
Wed, 28 Jan 2026 14:06:01 GMT
mediaproxy
content.cdntwrk.com/ 		122 KB
123 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2025%2F12%2Fvulnhalla-picking-the-true-vulnerabilities.png&size=1&version=1768487525&sig=08f1b6a99885ce18af26953b79b87655&default=
Requested by
Host: content.cdntwrk.com
URL: https://content.cdntwrk.com/js/hubs/hubs_app.bc805b535b8c6058120d.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
18.66.102.30 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-66-102-30.fra56.r.cloudfront.net
Software
/
Resource Hash
892a22c46a1f9b3175ca9505e0b3fe54514b3b1e270be879ffb2393aa652328a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

x-amz-cf-pop
FRA56-P2
cache-control
max-age=1234567890
age
4981699
via
1.1 c2e56cd54e2593df95ccca8a6d98c958.cloudfront.net (CloudFront)
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
content-length
125336
x-amz-cf-id
54m0J_nnfyWXLROjsAJ8CFFh0TJzpg1BfE6S3UCeLBfEbC5e_mkHVg==
date
Thu, 15 Jan 2026 14:32:21 GMT
content-type
image/webp
content-disposition
inline; filename="vulnhalla-picking-the-true-vulnerabilities.webp"
last-modified
Thu, 15 Jan 2026 14:32:11 GMT
mediaproxy
content.cdntwrk.com/ 		15 KB
15 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2025%2F11%2Fopen-sourcing-quicdraw-h3.jpg&size=1&version=1765364102&sig=1dce5c6d74ba81a9cefb7655b61d0c38&default=
Requested by
Host: content.cdntwrk.com
URL: https://content.cdntwrk.com/js/hubs/hubs_app.bc805b535b8c6058120d.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
18.66.102.30 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-66-102-30.fra56.r.cloudfront.net
Software
/
Resource Hash
b563a1c24a769b1996e5b3bcf3bb56bd558d14e813d553784d368f306dd83936

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

x-amz-cf-pop
FRA56-P2
cache-control
max-age=1234567890
age
8105099
via
1.1 c2e56cd54e2593df95ccca8a6d98c958.cloudfront.net (CloudFront)
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
content-length
15490
x-amz-cf-id
W47jLH3i1hNUCAuljxDFs1rw6L2rSqO0PQQIhozPz2ZpkUDpBmG8mQ==
date
Wed, 10 Dec 2025 10:55:41 GMT
content-type
image/webp
content-disposition
inline; filename="open-sourcing-quicdraw-h3.webp"
last-modified
Wed, 10 Dec 2025 10:55:31 GMT
mediaproxy
content.cdntwrk.com/ 		19 KB
19 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2025%2F09%2Fcover-image.jpg&size=1&version=1763475591&sig=c4bbeafebae9f996d8460379e71cf880&default=
Requested by
Host: content.cdntwrk.com
URL: https://content.cdntwrk.com/js/hubs/hubs_app.bc805b535b8c6058120d.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
18.66.102.30 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-66-102-30.fra56.r.cloudfront.net
Software
/
Resource Hash
ff94b249e69933eaa84b1bb3533fb51a3c1184f84afbe5584ccc88b5e387c891

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

x-amz-cf-pop
FRA56-P2
cache-control
max-age=1234567890
age
9993322
via
1.1 c2e56cd54e2593df95ccca8a6d98c958.cloudfront.net (CloudFront)
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
content-length
19342
x-amz-cf-id
Czn5YvG7tqJH98Br4dS5NiJibc4841ZYVoNPXv--mxoHeyERzDlkNQ==
date
Tue, 18 Nov 2025 14:25:18 GMT
content-type
image/webp
content-disposition
inline; filename="cover-image.webp"
last-modified
Tue, 18 Nov 2025 14:25:08 GMT
mediaproxy
content.cdntwrk.com/ 		118 KB
118 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2025%2F09%2Ftale-of-a-lpe-vulnerability.png&size=1&version=1761076752&sig=1fbb0e9ec4c3d89de96c9549dce5e3e8&default=
Requested by
Host: content.cdntwrk.com
URL: https://content.cdntwrk.com/js/hubs/hubs_app.bc805b535b8c6058120d.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
18.66.102.30 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-66-102-30.fra56.r.cloudfront.net
Software
/
Resource Hash
965409c36122cec474b4d2062248da8f63b3cb5d9ba1085a586c92f5a48777db

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

x-amz-cf-pop
FRA56-P2
cache-control
max-age=1234567890
age
12392269
via
1.1 c2e56cd54e2593df95ccca8a6d98c958.cloudfront.net (CloudFront)
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
content-length
120576
x-amz-cf-id
2iUGKUEmveVVlLCZr43vshUeWHG0wxZVSZ5CKGRmhsATDQIgmjqNPQ==
date
Tue, 21 Oct 2025 20:02:51 GMT
content-type
image/webp
content-disposition
inline; filename="tale-of-a-lpe-vulnerability.webp"
last-modified
Tue, 21 Oct 2025 20:02:41 GMT
mediaproxy
content.cdntwrk.com/ 		179 KB
179 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2025%2F06%2Fc4-bomb-blog-hero.png&size=1&version=1756990787&sig=9af24e62e49693584b654549aee927e8&default=
Requested by
Host: content.cdntwrk.com
URL: https://content.cdntwrk.com/js/hubs/hubs_app.bc805b535b8c6058120d.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
18.66.102.30 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-66-102-30.fra56.r.cloudfront.net
Software
/
Resource Hash
9341933ddcf666d7d1fdaacba01c75613b26c5530194a2722e61edaf364b2ff6

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

x-amz-cf-pop
FRA56-P2
cache-control
max-age=1234567890
age
15186015
via
1.1 c2e56cd54e2593df95ccca8a6d98c958.cloudfront.net (CloudFront)
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
content-length
183200
x-amz-cf-id
MaXbMinyzOWl0csRNyFTJnewNdB4_2fE9DZ6WmGd6_RJ4WkPNXjdDQ==
date
Fri, 19 Sep 2025 12:00:25 GMT
content-type
image/webp
content-disposition
inline; filename="c4-bomb-blog-hero.webp"
last-modified
Fri, 19 Sep 2025 12:00:15 GMT
mediaproxy
content.cdntwrk.com/ 		179 KB
179 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2025%2F06%2FMCP-Threat-analysis.png&size=1&version=1754341152&sig=aea6fd3ad8fb6e2c91a706d9c14faecb&default=
Requested by
Host: content.cdntwrk.com
URL: https://content.cdntwrk.com/js/hubs/hubs_app.bc805b535b8c6058120d.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
18.66.102.30 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-66-102-30.fra56.r.cloudfront.net
Software
/
Resource Hash
b3fa60d72c41260a9b45f6af7d1acb01ab223cad33e0105766d67df1f1d9d683

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

x-amz-cf-pop
FRA56-P2
cache-control
max-age=1234567890
age
15186016
via
1.1 c2e56cd54e2593df95ccca8a6d98c958.cloudfront.net (CloudFront)
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
content-length
182790
x-amz-cf-id
cVNemfiiee5g8DBSY8hY4u947HRCg0gwIy0DannHNExSNgqP2oyvqg==
date
Fri, 19 Sep 2025 12:00:24 GMT
content-type
image/webp
content-disposition
inline; filename="MCP-Threat-analysis.webp"
last-modified
Fri, 19 Sep 2025 12:00:14 GMT
mediaproxy
content.cdntwrk.com/ 		184 KB
184 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2025%2F05%2Fpoison-everywhere-blog.png&size=1&version=1765318223&sig=2d56346addee89a06bbacd84802c5146&default=
Requested by
Host: content.cdntwrk.com
URL: https://content.cdntwrk.com/js/hubs/hubs_app.bc805b535b8c6058120d.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
18.66.102.30 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-66-102-30.fra56.r.cloudfront.net
Software
/
Resource Hash
eb546cf86b3dcdf1f966899c091cc14b86ad79eae26a156423cd7b9b26faf92b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

x-amz-cf-pop
FRA56-P2
cache-control
max-age=1234567890
age
8150631
via
1.1 c2e56cd54e2593df95ccca8a6d98c958.cloudfront.net (CloudFront)
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
content-length
188208
x-amz-cf-id
KvMTomDLErsvqpxL1wxdFbAT6YTZmhO-qVDJRX9ce5niS4R3H8OuWA==
date
Tue, 09 Dec 2025 22:16:49 GMT
content-type
image/webp
content-disposition
inline; filename="poison-everywhere-blog.webp"
last-modified
Tue, 09 Dec 2025 22:16:39 GMT
mediaproxy
content.cdntwrk.com/ 		10 KB
10 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2025%2F04%2Funlocking-new-jailbreaks-ai.jpg&size=1&version=1754341152&sig=945c8c564c44ade40663fafa3f3913f1&default=
Requested by
Host: content.cdntwrk.com
URL: https://content.cdntwrk.com/js/hubs/hubs_app.bc805b535b8c6058120d.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
18.66.102.30 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-66-102-30.fra56.r.cloudfront.net
Software
/
Resource Hash
ea619a152c6d3c91e8bfb6b36df4904dc6b7beae418d784103ee70154bc102b3

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

x-amz-cf-pop
FRA56-P2
cache-control
max-age=1234567890
age
10154505
via
1.1 c2e56cd54e2593df95ccca8a6d98c958.cloudfront.net (CloudFront)
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
content-length
9776
x-amz-cf-id
BTgnLI1ydykWRRtrr3wo0tbosF0fEW31zKT6wN3GLE8GDCu5Gv-hgA==
date
Sun, 16 Nov 2025 17:38:54 GMT
content-type
image/webp
content-disposition
inline; filename="unlocking-new-jailbreaks-ai.webp"
last-modified
Sun, 16 Nov 2025 17:38:44 GMT
mediaproxy
content.cdntwrk.com/ 		12 KB
12 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2025%2F04%2Fagents-under-attack.jpg&size=1&version=1757354502&sig=377482fd12c836a6dc1908a35f9fe3ab&default=
Requested by
Host: content.cdntwrk.com
URL: https://content.cdntwrk.com/js/hubs/hubs_app.bc805b535b8c6058120d.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
18.66.102.30 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-66-102-30.fra56.r.cloudfront.net
Software
/
Resource Hash
f3c0440fa8ca7f2e0aa46a6ff93e0377b868a471a9c215f8c13d775d3d27d37c

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

x-amz-cf-pop
FRA56-P2
cache-control
max-age=1234567890
age
15186016
via
1.1 c2e56cd54e2593df95ccca8a6d98c958.cloudfront.net (CloudFront)
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
content-length
12282
x-amz-cf-id
RgY7IRqHfmPdZIm3v1tkAzyFycoZg9y5zLmLJWX1lrxnlx2T3GvlAQ==
date
Fri, 19 Sep 2025 12:00:24 GMT
content-type
image/webp
content-disposition
inline; filename="agents-under-attack.webp"
last-modified
Fri, 19 Sep 2025 12:00:14 GMT
mediaproxy
content.cdntwrk.com/ 		126 KB
127 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2025%2F04%2Fjailbreak-hero-rectangle.png&size=1&version=1744236481&sig=532c6dfde4538ffb1c8a981915d83ae8&default=
Requested by
Host: content.cdntwrk.com
URL: https://content.cdntwrk.com/js/hubs/hubs_app.bc805b535b8c6058120d.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
18.66.102.30 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-66-102-30.fra56.r.cloudfront.net
Software
/
Resource Hash
c065380f7bd8d381eaf25e89eb432311f62d6bdb2033959afa80ea07422f0806

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

x-amz-cf-pop
FRA56-P2
cache-control
max-age=1234567890
age
15186015
via
1.1 c2e56cd54e2593df95ccca8a6d98c958.cloudfront.net (CloudFront)
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
content-length
129394
x-amz-cf-id
TWz91A1OpwDy9omGFqy65Vhuic7rMD9NfiecIYoDb-4C1nF4vOYIvQ==
date
Fri, 19 Sep 2025 12:00:25 GMT
content-type
image/webp
content-disposition
inline; filename="jailbreak-hero-rectangle.webp"
last-modified
Fri, 19 Sep 2025 12:00:15 GMT
mediaproxy
content.cdntwrk.com/ 		179 KB
179 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2025%2F03%2Fcaptain-massJacker-sparrow.png&size=1&version=1743523369&sig=23e1d72c2bc29728f10b4eaa276a9fd7&default=
Requested by
Host: content.cdntwrk.com
URL: https://content.cdntwrk.com/js/hubs/hubs_app.bc805b535b8c6058120d.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
18.66.102.30 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-66-102-30.fra56.r.cloudfront.net
Software
/
Resource Hash
578f8ca4c810676744873f67b9401bb5e253626722d9d5faef7ea9f6b4205ec6

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

x-amz-cf-pop
FRA56-P2
cache-control
max-age=1234567890
age
8762249
via
1.1 c2e56cd54e2593df95ccca8a6d98c958.cloudfront.net (CloudFront)
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
content-length
182896
x-amz-cf-id
seBUR9cbck82Mz8ZrzQv7SNC5T61wQFD-pHljh81X097zHl81Grewg==
date
Tue, 02 Dec 2025 20:23:11 GMT
content-type
image/webp
content-disposition
inline; filename="captain-massJacker-sparrow.webp"
last-modified
Tue, 02 Dec 2025 20:23:01 GMT
mediaproxy
content.cdntwrk.com/ 		182 KB
182 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2025%2F02%2Fauthentik-blog.png&size=1&version=1762944449&sig=4f6f5120467d378cb11da34d53f0c218&default=
Requested by
Host: content.cdntwrk.com
URL: https://content.cdntwrk.com/js/hubs/hubs_app.bc805b535b8c6058120d.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
18.66.102.30 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-66-102-30.fra56.r.cloudfront.net
Software
/
Resource Hash
3879e8c7c2b8936f28215aa1eaadff29eb1f5121b53932517f6857b58a5106b9

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

x-amz-cf-pop
FRA56-P2
cache-control
max-age=1234567890
age
9753045
via
1.1 c2e56cd54e2593df95ccca8a6d98c958.cloudfront.net (CloudFront)
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
content-length
186110
x-amz-cf-id
SjHHIdzhWl4a53Y5bligRdGOXVi38K7Tm4AaWJWmz7ZNrNvmmWLMBA==
date
Fri, 21 Nov 2025 09:09:55 GMT
content-type
image/webp
content-disposition
inline; filename="authentik-blog.webp"
last-modified
Fri, 21 Nov 2025 09:09:45 GMT
mediaproxy
content.cdntwrk.com/ 		176 KB
176 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2025%2F02%2Foauth-cover.png&size=1&version=1765318223&sig=174f1e1b8ab62cb8473ac4dddac4e14e&default=
Requested by
Host: content.cdntwrk.com
URL: https://content.cdntwrk.com/js/hubs/hubs_app.bc805b535b8c6058120d.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
18.66.102.30 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-66-102-30.fra56.r.cloudfront.net
Software
/
Resource Hash
d11e80126174cd01dcdcaa8689aba5727d42c79945420610bf2e56a26208e552

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

x-amz-cf-pop
FRA56-P2
cache-control
max-age=1234567890
age
8150631
via
1.1 c2e56cd54e2593df95ccca8a6d98c958.cloudfront.net (CloudFront)
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
content-length
180040
x-amz-cf-id
J_s_wRkL-psTzwPzsFoa-UNsOXZXUK8BdJSL9Xo581BOnEWLWlKhnw==
date
Tue, 09 Dec 2025 22:16:49 GMT
content-type
image/webp
content-disposition
inline; filename="oauth-cover.webp"
last-modified
Tue, 09 Dec 2025 22:16:39 GMT
mediaproxy
content.cdntwrk.com/ 		173 KB
173 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2024%2F11%2Fyourself-kubiscan.png&size=1&version=1739896187&sig=ebe1d3d6432878f7d245564d7874e767&default=
Requested by
Host: content.cdntwrk.com
URL: https://content.cdntwrk.com/js/hubs/hubs_app.bc805b535b8c6058120d.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
18.66.102.30 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-66-102-30.fra56.r.cloudfront.net
Software
/
Resource Hash
dba62db80f107a0fcaae968403a8c771e9222f1b3a3f0f281dcc3fc079572315

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

x-amz-cf-pop
FRA56-P2
cache-control
max-age=1234567890
age
15186015
via
1.1 c2e56cd54e2593df95ccca8a6d98c958.cloudfront.net (CloudFront)
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
content-length
176902
x-amz-cf-id
00eRLPpjNh2wgYTyvPmNdsvtUsudzNUL01mEU_ZJSJ6eynoDmm-yeQ==
date
Fri, 19 Sep 2025 12:00:25 GMT
content-type
image/webp
content-disposition
inline; filename="yourself-kubiscan.webp"
last-modified
Fri, 19 Sep 2025 12:00:15 GMT
mediaproxy
content.cdntwrk.com/ 		184 KB
185 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2024%2F12%2Fbytecodellm-header.png&size=1&version=1738652774&sig=cdc0e78ce6b3cca73b73817f9bbfac06&default=
Requested by
Host: content.cdntwrk.com
URL: https://content.cdntwrk.com/js/hubs/hubs_app.bc805b535b8c6058120d.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
18.66.102.30 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-66-102-30.fra56.r.cloudfront.net
Software
/
Resource Hash
3df0aabfd9233cf1030b0a717149764422f7399d2c0c531efbb858be8efe82ae

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

x-amz-cf-pop
FRA56-P2
cache-control
max-age=1234567890
age
10250621
via
1.1 c2e56cd54e2593df95ccca8a6d98c958.cloudfront.net (CloudFront)
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
content-length
188682
x-amz-cf-id
EQGJus4ftMSNPB3FJ8gVT915D_jrf2645NXg5-rObsJM6_4yQmq5cQ==
date
Sat, 15 Nov 2025 14:56:59 GMT
content-type
image/webp
content-disposition
inline; filename="bytecodellm-header.webp"
last-modified
Sat, 15 Nov 2025 14:56:49 GMT
mediaproxy
content.cdntwrk.com/ 		198 KB
198 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2024%2F11%2Fdevouring-your-personal-data-1.png&size=1&version=1765318223&sig=3b18fdf0427b4e04120535f125425803&default=
Requested by
Host: content.cdntwrk.com
URL: https://content.cdntwrk.com/js/hubs/hubs_app.bc805b535b8c6058120d.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
18.66.102.30 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-66-102-30.fra56.r.cloudfront.net
Software
/
Resource Hash
8da752cc30ea40e8e6bef1e3659f41a96a38182e258823e84bbf6f526bfa1067

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

x-amz-cf-pop
FRA56-P2
cache-control
max-age=1234567890
age
8150631
via
1.1 c2e56cd54e2593df95ccca8a6d98c958.cloudfront.net (CloudFront)
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
content-length
202302
x-amz-cf-id
REmYGeBnqPL_eF_y4i54KwLv7lCnq4IgB5cgRoN8tl8Z1lDRilNMqA==
date
Tue, 09 Dec 2025 22:16:49 GMT
content-type
image/webp
content-disposition
inline; filename="devouring-your-personal-data-1.webp"
last-modified
Tue, 09 Dec 2025 22:16:39 GMT
mediaproxy
content.cdntwrk.com/ 		149 KB
149 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://content.cdntwrk.com/mediaproxy?url=https%3A%2F%2Fwww.cyberark.com%2Fwp-content%2Fuploads%2F2024%2F10%2Fhidden-vulnerabilities-codeql.png&size=1&version=1765318223&sig=af4e3d4b84a73783e71a726b54b99d95&default=
Requested by
Host: content.cdntwrk.com
URL: https://content.cdntwrk.com/js/hubs/hubs_app.bc805b535b8c6058120d.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
18.66.102.30 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-66-102-30.fra56.r.cloudfront.net
Software
/
Resource Hash
c501d5cb69e743beedfa9d81ba09a334426dfef874c9b81e65ef02d56a37f293

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

x-amz-cf-pop
FRA56-P2
cache-control
max-age=1234567890
age
8150631
via
1.1 c2e56cd54e2593df95ccca8a6d98c958.cloudfront.net (CloudFront)
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
content-length
152674
x-amz-cf-id
OM47gF8G19Jwf3nfFFyBT9M9R2J-drnxEoequyx6Wuzwq_AUlqlTVQ==
date
Tue, 09 Dec 2025 22:16:49 GMT
content-type
image/webp
content-disposition
inline; filename="hidden-vulnerabilities-codeql.webp"
last-modified
Tue, 09 Dec 2025 22:16:39 GMT
9dc12c728fa7c222
www.cyberark.com/cdn-cgi/challenge-platform/h/g/jsd/oneshot/ea2d291c0fdc/0.6500296734455963:1773466268:JxC53QujWwcFYTfFPYffLEUrnjc4eTaLsO_oOuGUJmQ/ Frame 473C 		0
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.cyberark.com/cdn-cgi/challenge-platform/h/g/jsd/oneshot/ea2d291c0fdc/0.6500296734455963:1773466268:JxC53QujWwcFYTfFPYffLEUrnjc4eTaLsO_oOuGUJmQ/9dc12c728fa7c222
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/cdn-cgi/challenge-platform/scripts/jsd/main.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.69.86 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8
Referer

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
timing-allow-origin
https://www.cyberark.com
x-content-type-options
nosniff
cf-ray
9dc12c7ffea3c222-TLV
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
content-length
0
cf-chl-out-s
LHhkzoeHOfbBAG6CXx3LIfLRz8EQNgCYTK6Tr/FtB+/ysykvnLz5SIL8P4Hy5P9AO2I/fIcB7vffVg/uDTqTMJhpVUmJYnzlqbg6HZa602zfGlN+pC7YPtuI00cbEHy6I0Cj20giZVu7u/a8jZLa1nIeYWa/MA1ko2faRzaBRSSmrluDLSTHmR/dRTBZLVaQ7olMbIopFKWLGfDOHZEQ/6BtSMTy8WKpMlgu1cxcmpa52mR12up+kVrrlgm77XhCdzLld4NO4S4O+j9anMyRrRaY9FxUTUORNTkOnZ0bSBRtUDzRM3HnQV2uFrS+a2yPXypKbvMQ7uJ8GfCydPjIrf9u8k/bdOgXaqI7YgGfAwUzIaxAqt9KThLFcBMET3PCZq0TzgNm85FfJh3udnZHp0+pkIVdGgmdm4FqyvgPx3psgm43/M2LJ8X1ZgtNjlcm9gacNRkPPQbOiMaa6Vu5CzuOXE6dIrOJa6PVIUKWLZX6Ga6ttQpDldzUy4AZB2HPsdZZksQN+v1+rNrzrx9+n9UYfKAgGMz3UL9Mm8LFXYX4c3DOieY6Kts3FBjdmJWzwJ40DZ23PTz9NUcspMVp903tTVhUSw7Ag9purPXyj+owLOQUh8NUorczIqHliQJcRexyLjTEhGfLqQJq0nDEXyPmnuMCaWSYsMUGikg3rTWK0zHgDaugxeb5hA5EoAPJ9TiezS7/oEd2KdGt+z7FeQ==$xZA2Jd5gHcc1UE3e1Ir1TQ==
date
Sat, 14 Mar 2026 06:20:40 GMT
content-type
text/plain; charset=UTF-8
server
cloudflare
priority
u=1,i
utsync.ashx
ml314.com/ 		62 B
237 B 		Script
General
Check archive.org
Download Go to
Full URL
https://ml314.com/utsync.ashx?pub=&adv=&et=0&eid=52079&ct=js&pi=&fp=&clid=&if=0&ps=&cl=&mlt=&data=&&cp=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fgolden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps&pv=1773469240296_pxxma8e7q&bl=he-il&cb=5982587&return=&ht=&d=&dc=&si=1773469240296_pxxma8e7q&cid=production%7C%7C108540%7C%7C6824673%7C%7C609327918&s=1600x1200&rp=&v=2.8.2.257
Requested by
Host: ml314.com
URL: https://ml314.com/tag.aspx?142
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
79.77.117.34.bc.googleusercontent.com
Software
Google Frontend /
Resource Hash
5a1ba6ff6db12f791bbbfc4da3cb389e06f0cd53eede09ef3eb3ceb074089ef1

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
via
1.1 google
expires
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
date
Sat, 14 Mar 2026 06:20:40 GMT
content-type
application/javascript
server
Google Frontend
ud.ashx
in.ml314.com/ 		20 B
482 B 		Script
General
Check archive.org
Download Go to
Full URL
https://in.ml314.com/ud.ashx?topiclimit=&cb=1422026&v=2.8.2.257
Requested by
Host: ml314.com
URL: https://ml314.com/tag.aspx?142
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.146.227.19 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-146-227-19.compute-1.amazonaws.com
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

Cache-Control
public
X-AspNet-Version
4.0.30319
Content-Encoding
gzip
Connection
keep-alive
Expires
Sun, 15 Mar 2026 06:20:41 GMT
Content-Length
138
Date
Sat, 14 Mar 2026 06:20:40 GMT
Content-Type
application/javascript; charset=utf-8
Vary
Accept-Encoding
Server
Microsoft-IIS/10.0
X-Powered-By
ASP.NET
id
dpm.demdex.net/ 		367 B
918 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://dpm.demdex.net/id?d_visid_ver=5.5.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_orgid=9AB97041603F3EDB0A495C66%40AdobeOrg&d_nsid=0&ts=1773469240322
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/launch-e8e6adf0fe30.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
176.34.239.19 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-176-34-239-19.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
0827bf9532c172c85a6a845ae3c4efadef98a68703a79cd24e0fce9f693aba41
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Content-Type
application/x-www-form-urlencoded
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
cache-control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs
dcs-prod-irl1-1-v085-01b2d7808.edge-irl1.demdex.com 1 ms
content-encoding
gzip
pragma
no-cache
access-control-allow-credentials
true
x-tid
94N+P8ZXQc8=
expires
Thu, 01 Jan 1970 00:00:00 UTC
access-control-allow-origin
https://www.cyberark.com
content-length
311
p3p
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date
Sat, 14 Mar 2026 06:20:40 GMT
content-type
application/json;charset=utf-8
vary
Origin
AppMeasurement.min.js
assets.adobedtm.com/extensions/EP31dbb9c60e404ba1aa6e746d49be6f29/ 		35 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/extensions/EP31dbb9c60e404ba1aa6e746d49be6f29/AppMeasurement.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/launch-e8e6adf0fe30.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.181.12 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-52-181-12.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
7db8d077fc21c20f1449a2603d524e423cfa25d7df6d5fd845a8e5e883aa227e
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cache-control
no-cache
timing-allow-origin
*
content-encoding
gzip
etag
"66aabcd8a7ba429711eebdad8acc3dd6:1729811534.672229"
x-content-type-options
nosniff
expires
Sat, 14 Mar 2026 07:20:40 GMT
accept-ranges
bytes
access-control-allow-origin
https://www.cyberark.com
content-length
13011
date
Sat, 14 Mar 2026 06:20:40 GMT
content-type
application/x-javascript
last-modified
Thu, 24 Oct 2024 23:12:14 GMT
server
AkamaiNetStorage
vary
Accept-Encoding
AppMeasurement_Module_ActivityMap.min.js
assets.adobedtm.com/extensions/EP31dbb9c60e404ba1aa6e746d49be6f29/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/extensions/EP31dbb9c60e404ba1aa6e746d49be6f29/AppMeasurement_Module_ActivityMap.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/launch-e8e6adf0fe30.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.181.12 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-52-181-12.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
2a250e2f225e48cf583d54a0a42d623c700847de17323bf23ea372e5d9e89cb2
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cache-control
no-cache
timing-allow-origin
*
content-encoding
gzip
etag
"ddda3fb3f27121fcba6a33a82f32d57c:1729811534.987187"
x-content-type-options
nosniff
expires
Sat, 14 Mar 2026 07:20:40 GMT
accept-ranges
bytes
access-control-allow-origin
https://www.cyberark.com
content-length
1598
date
Sat, 14 Mar 2026 06:20:40 GMT
content-type
application/x-javascript
last-modified
Thu, 24 Oct 2024 23:12:14 GMT
server
AkamaiNetStorage
vary
Accept-Encoding
RCd27c1b1db9384c37a9a1f03e164d460d-source.min.js
assets.adobedtm.com/789d877fe9a8/09207f0a9c44/eb0d9e0e24f2/ 		2 KB
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/eb0d9e0e24f2/RCd27c1b1db9384c37a9a1f03e164d460d-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/launch-e8e6adf0fe30.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.181.12 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-52-181-12.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
4db026a5454bc4033508ec538f0d13a6aa7f5b0f7ce2f37526e3d4f251d09307
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cache-control
max-age=3600
timing-allow-origin
*
content-encoding
gzip
etag
"79072e67e3bfc87a7e6a64634a830954:1762975007.123862"
x-content-type-options
nosniff
expires
Sat, 14 Mar 2026 07:20:40 GMT
accept-ranges
bytes
access-control-allow-origin
https://www.cyberark.com
content-length
766
date
Sat, 14 Mar 2026 06:20:40 GMT
content-type
application/x-javascript
last-modified
Wed, 12 Nov 2025 19:16:47 GMT
server
AkamaiNetStorage
vary
Accept-Encoding
munchkin.js
munchkin.marketo.net/164/ 		11 KB
5 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://munchkin.marketo.net/164/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
23.67.142.205 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-67-142-205.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
dea9df0145848ffeb3c6931228d41e833341b4837c0e713d321c5bfcf6dcd4e6

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

Cache-Control
max-age=8640000
Content-Encoding
gzip
ETag
"756f9116836f579d12be8fe786b69d98:1726632111.60799"
Connection
keep-alive
Expires
Mon, 22 Jun 2026 06:20:40 GMT
Accept-Ranges
bytes
Content-Length
4843
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Date
Sat, 14 Mar 2026 06:20:40 GMT
Content-Type
application/x-javascript
Last-Modified
Wed, 18 Sep 2024 04:01:51 GMT
Server
AkamaiNetStorage
Vary
Accept-Encoding
ct
obs.segreencolumn.com/ 		4 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://obs.segreencolumn.com/ct?id=45375&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fgolden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps&sf=0&tpi=&ch=cheq4ppc&uvid=&tsf=0&tsfmi=&tsfu=&cb=1773469240439&hl=2&op=0&ag=4162048920&rand=54276620556890278571665988695078158127411278022412292029207224612151212588141951785126620712&fs=1600x1200&fst=1600x1200&np=linux%20x86_64&nv=google%20inc.&ref=&ss=1600x1200&nc=0&at=&di=W1siZWYiLDQxMjVdLFsiYWJuY2giLDEyXSxbLTE5LCJbODAsODAsODAsODAsMCwwLDEsMjQsMjQsXCItXCIsMTYwMCwxMjAwLDE2MDAsMTIwMCwxNjAwLDEyODUsMTYwMCwxMjAwLDAsMCwwLDAsXCItXCIsXCItXCIsMTYwMCwxMjAwLDBdIl0sWy0yMiwiW1wiblwiLFwiblwiXSJdLFstMzYsIltcIjQvM1wiLFwiNC8zXCJdIl0sWy00MywiMDAwMDAwMDEwMTAwMDAwMTAwMTExMDExMDExMDExMDEwMDAwMDEwMTEwMSJdLFstNTAsIi0iXSxbLTU3LCJXRTBaVjF4T2NWaFhYVlZjU3hjRldsWlVTVXhOWEYwSEdXSllTaGxZU1VsVlFHUVpFVnhQV0ZVWldFMFpCVmhYVmxkQVZGWk1TZ2NaRVFNT0F3Z01DUW9KQVJBVkdRVllWMVpYUUZSV1RFb0hBd2dCQXdvSkVCVllUUmw0UzB0WVFCZDhYQmtSVVUxTlNVb0RGaFpXV3hkS1hGNUxYRnhYV2xaVlRGUlhGMXBXVkJaUUZnRU5XbDhLQ1E4TFh3QUJXbHRZV3dBQURWMFBDZ0JZQUE0TVd3c09BQUZjRjFOS0F3Z0REd2dLRGdzUUZWaE5HVXNaRVZGTlRVbEtBeFlXVmxzWFNseGVTMXhjVjFwV1ZVeFVWeGRhVmxRV1VCWUJEVnBmQ2drUEMxOEFBVnBiV0ZzQUFBMWREd29BV0FBT0RGc0xEZ0FCWEJkVFNnTUlBdzhQRGc9PSJdLFstNzEsImEwMTAwMTAxMTAwMTAwMTAxMDAwMTAxMDAxMTExMTAxMDAwMDEwIl0sWy0yLCIzLE5JU0FJSmhBNEpIUlVFUWNHQ0JRczJiRnl4ZTBWVUVDelk4SXFpWENzaUZ4VkZ4UUtpVjBHUW9paWlLTDBtb1JNZ1FNcVQ1R21uek14dS85K2FjODZUa3hCQS9OejM4OTczUDUiXSxbLTUsIi0iXSxbLTIwLCItIl0sWy01MSwiLSJdLFsxMiwie1wiY3R4XCI6XCJ3ZWJnbFwiLFwidlwiOlwiaW50ZWwgaW5jLlwiLFwiclwiOlwiaW50ZWwgaXJpcyBvcGVuZ2wgZW5naW5lXCIsXCJzbHZcIjpcIndlYmdsIGdsc2wgZXMgMS4wIChvcGVuZ2wgZXMgZ2xzbCBlcyAxLjAgY2hyb21pdW0pXCIsXCJndmVyXCI6XCJ3ZWJnbCAxLjAgKG9wZW5nbCBlcyAyLjAgY2hyb21pdW0pXCIsXCJndmVuXCI6XCJ3ZWJraXRcIixcImJlblwiOjMsXCJ3Z2xcIjoxLFwiZ3JlblwiOlwid2Via2l0IHdlYmdsXCIsXCJzZWZcIjoxOTMwODIwMjc5LFwic2VjXCI6XCJcIn0iXSxbMzcsIlszMzE2MjI0MDQ5LGZ1bmN0aW9uKG5ld1ZhbHVlKSB7XG4gICAgICAgICAgICAgIGFkZENvbnRlbnRXaW5kb3dQcm94eSh0aGlzKVxuICAgICAgICAgICAgICAvLyBSZXNldCBwcm9wZXJ0eSwgdGhlIGhvb2sgaXMgb25seSBuZWVkZWQgb25jZVxuICAgICAgICAgICAgICBPYmplY3QuZGVmaW5lUHJvcGVydHkoaWZyYW1lLCAnc3JjZG9jJywge1xuICAgICAgICAgICAgICAgIGNvbmZpZ3VyYWJsZTogZmFsc2UsXG4gICAgICAgICAgICAgICAgd3JpdGFibGU6IGZhbHNlLFxuICAgICAgICAgICAgICAgIHZhbHVlOiBfc3JjZG9jXG4gICAgICAgICAgICAgIH0pXG4gICAgICAgICAgICAgIF9pZnJhbWUuc3JjZG9jID0gbmV3VmFsdWVcbiAgICAgICAgICAgIH1dIl0sWy0yNSwiLSJdLFstMzEsImZhbHNlIl0sWy0zNywiLTE0NC02Ni0xODAtIl0sWy00MCwiMzMiXSxbLTQ3LCJBc2lhL0plcnVzYWxlbSxoZSxsYXRuLGdyZWdvcnkiXSxbLTU4LCItIl0sWy02MSwie1wid2dzbFwiOlwiNztwYWNrZWRfNHg4X2ludGVnZXJfZG90X3Byb2R1Y3Q7dW5yZXN0cmljdGVkX3BvaW50ZXJfcGFyYW1ldGVycztzdWJncm91cF91bmlmb3JtaXR5O3N1Ymdyb3VwX2lkO3BvaW50ZXJfY29tcG9zaXRlX2FjY2VzcztyZWFkb25seV9hbmRfcmVhZHdyaXRlX3N0b3JhZ2VfdGV4dHVyZXM7dW5pZm9ybV9idWZmZXJfc3RhbmRhcmRfbGF5b3V0O1wiLFwicGNmXCI6XCJyZ2JhOHVub3JtXCJ9Il0sWy02NywiLSJdLFstNjgsIi0iXSxbLTEsIi0iXSxbLTYsIi0iXSxbLTMwLCJbXCJ2XCIsMF0iXSxbLTMyLCItIl0sWy0zOSwiW1wiMjAwMzAxMDdcIiwyLFwiR2Vja29cIixcIk5ldHNjYXBlXCIsXCJNb3ppbGxhXCIsbnVsbCxudWxsLHRydWUsOCxmYWxzZSxudWxsLDUsdHJ1ZSx0cnVlLG51bGwsMCx0cnVlLHRydWUsZmFsc2UsdHJ1ZV0iXSxbLTQ2LCIwIl0sWy00OCwiW1wiLVwiLFwiLVwiLFwiLVwiLFwiLVwiLFwiLVwiXSJdLFstNTIsIi0iXSxbLTU1LCIyIl0sWy01NiwibGFuZHNjYXBlLXByaW1hcnkiXSxbLTczLCJFaFE9Il0sWy04LCItIl0sWy0yNCwiW1wibGFuZ3VhZ2VzXCIsXCIyNTQ4MzYwMTcwXCIsXCItXCIsMSwwXSJdLFstMzgsImksLTEsLTEsMCwwLDAsMCw2LDgxLDkwNCwtMSwwLDIwMDgsMjAwOCwyMzYwLDIzNjEiXSxbLTcyLCJFeFU9Il0sWy00LCItIl0sWy03LCItIl0sWy0yMSwiLSJdLFstNDIsIjg4MzM5OTAxNiJdLFstNjQsIlswLFwiXCIsW11dIl0sWy02NSwiLSJdLFstNjYsImdlb2xvY2F0aW9uLGNodWFmdWxsdmVyc2lvbmxpc3QsY3Jvc3NvcmlnaW5pc29sYXRlZCxzY3JlZW53YWtlbG9jayxvbmRldmljZXNwZWVjaHJlY29nbml0aW9uLHRyYW5zbGF0b3IscHVibGlja2V5Y3JlZGVudGlhbHNnZXQsc2hhcmVkc3RvcmFnZXNlbGVjdHVybCxjaHVhYXJjaCxjb21wdXRlcHJlc3N1cmUsY2hwcmVmZXJzcmVkdWNlZHRyYW5zcGFyZW5jeSxkZWZlcnJlZGZldGNoLHVzYixjaHNhdmVkYXRhLHB1YmxpY2tleWNyZWRlbnRpYWxzY3JlYXRlLHNoYXJlZHN0b3JhZ2UsZGVmZXJyZWRmZXRjaG1pbmltYWwscnVuYWRhdWN0aW9uLGNoZG93bmxpbmssY2h1YWZvcm1mYWN0b3JzLG90cGNyZWRlbnRpYWxzLHBheW1lbnQsY2h1YSxjaHVhbW9kZWwsY2hlY3QsYXV0b3BsYXksY2FtZXJhLGxhbmd1YWdlZGV0ZWN0b3IscHJpdmF0ZXN0YXRldG9rZW5pc3N1YW5jZSxkaWdpdGFsY3JlZGVudGlhbHNnZXQsYWNjZWxlcm9tZXRlcixjaHVhcGxhdGZvcm12ZXJzaW9uLGlkbGVkZXRlY3Rpb24scHJpdmF0ZWFnZ3JlZ2F0aW9uLGludGVyZXN0Y29ob3J0LGNodmlld3BvcnRoZWlnaHQsY2FwdHVyZWRzdXJmYWNlY29udHJvbCxsb2NhbGZvbnRzLGNodWFwbGF0Zm9ybSxtaWRpLGNodWFmdWxsdmVyc2lvbix4cnNwYXRpYWx0cmFja2luZyxjbGlwYm9hcmRyZWFkLGdhbWVwYWQsZGlzcGxheWNhcHR1cmUsa2V5Ym9hcmRtYXAsam9pbmFkaW50ZXJlc3Rncm91cCxhcmlhbm90aWZ5LGxvY2FsbmV0d29yayxjaHVhaGlnaGVudHJvcHl2YWx1ZXMsY2h3aWR0aCxjaHByZWZlcnNyZWR1Y2VkbW90aW9uLGJyb3dzaW5ndG9waWNzLGVuY3J5cHRlZG1lZGlhLGxvY2FsbmV0d29ya2FjY2VzcyxneXJvc2NvcGUsc2VyaWFsLGNocnR0LGNodWFtb2JpbGUsd2luZG93bWFuYWdlbWVudCx1bmxvYWQsY2hkcHIsY2hwcmVmZXJzY29sb3JzY2hlbWUsY2h1YXdvdzY0LGF0dHJpYnV0aW9ucmVwb3J0aW5nLGZ1bGxzY3JlZW4saWRlbnRpdHljcmVkZW50aWFsc2dldCxwcml2YXRlc3RhdGV0b2tlbnJlZGVtcHRpb24saGlkLHN1bW1hcml6ZXIsY2h1YWJpdG5lc3Msc3RvcmFnZWFjY2VzcyxzeW5jeGhyLGNoZGV2aWNlbWVtb3J5LGNodmlld3BvcnR3aWR0aCxwaWN0dXJlaW5waWN0dXJlLG1hZ25ldG9tZXRlcixsb29wYmFja25ldHdvcmssY2xpcGJvYXJkd3JpdGUsbWljcm9waG9uZSJdLFstNjksIkxpbnV4IHg4Nl82NHxHb29nbGUgSW5jLnw4fDMyfHwwIl0sWy03NCwiMCwwIl0sWy03NSwie30uc29tZUZ1bmMgaXMgbm90IGEgZnVuY3Rpb24iXSxbLTEyLCJudWxsIl0sWy0xNywiMzIiXSxbLTI2LCJ7XCJ0amhzXCI6MTkzMDAwMDAsXCJ1amhzXCI6MTM0MDAwMDAsXCJqaHNsXCI6Mzc2MDAwMDAwMH0iXSxbLTQxLCItIl0sWy02MCwxOTJdLFstMywiW1wiaW50ZXJuYWwtcGRmLXZpZXdlclwiLFwiaW50ZXJuYWwtcGRmLXZpZXdlclwiLFwiaW50ZXJuYWwtcGRmLXZpZXdlclwiLFwiaW50ZXJuYWwtcGRmLXZpZXdlclwiLFwiaW50ZXJuYWwtcGRmLXZpZXdlclwiXSJdLFstMTUsIi0iXSxbLTI5LCItIl0sWy0zNSwiWzE3NzM0NjkyNDA0MDksLTJdIl0sWy00NCwiMCwwLDAsNSJdLFstNDUsIjYyMCw2NzcsMCwwLDAsNTYyLDAsMCw2NDgsMCwwLDAsMCwwLDAsMCwwLDAsMCw2ODQsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAiXSxbLTksIisiXSxbLTM0LCItIl0sWy01MywiMDAxIl0sWy01NCwie1wiaFwiOltcIjM1NzQ0MDcwMDdcIixcIjI3ODg1NDA0NTVcIixcIl8zXCIsXCIyODcyODk5MzIwXCJdLFwiZFwiOltdLFwiYlwiOltcIl8yXCIsXCI0MTk4OTM4MDkxXCJdLFwic1wiOjF9Il0sWy01OSwiZGVmYXVsdCJdLFstNjMsIi0iXSxbLTEwLCItIl0sWy0xMywiLSJdLFstMTYsIjAiXSxbLTI3LCJbMjAwLDEwLDAsXCI0Z1wiLG51bGxdIl0sWy0yOCwiaGUtSUwiXSxbImJuY2giLDc1XSxbLTExLCJ7XCJ0XCI6XCJcIixcIm1cIjpbXCJ0aXRsZVwiLFwiZGVzY3JpcHRpb25cIixcIm9nOnRpdGxlXCIsXCJvZzpkZXNjcmlwdGlvblwiLFwidHdpdHRlcjp0aXRsZVwiLFwidHdpdHRlcjpkZXNjcmlwdGlvblwiLFwiYXBwbGUtbW9iaWxlLXdlYi1hcHAtdGl0bGVcIl19Il0sWy0xNCwiLSJdLFstMTgsIlswLDAsMCwxXSJdLFstMjMsIisiXSxbLTMzLCItIl0sWy00OSwiLSJdLFstNjIsIjgwIl0sWy03MCwiLSJdLFsiZGRiIiwiMCwzLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDEsMCwwLDAsMCwxLDAsMCwwLDAsMSwwLDAsMCwwLDAsMCwwLDAsMCwwLDEsMCwwLDAsMCwwLDAsMCwyLDExLDAsMSwwLDAsMCwwLDEsMCwxLDAsMCwwLDEsMCwyLDEsMCwwLDAsMCwwLDAsMCwwLDAsMCwxLDAsMCwwIl0sWyJjYiIsIjAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDQsMSwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDEsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsOSwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwxLDAsMCwwLDAsMCwwLDAsMCwzLDAsMCwwLDAsMCwwLDAsMCwwLDAsMCwwLDAsMSwwLDAsMCJdXQ%3D%3D&dep=0&pre=0&sdd=&cri=NldDzJV5MW&pto=2408&ver=65&gac=-&mei=&ap=&fe=1&duid=1.1773469240.fO97Q6EPqr5ByTFp&suid=1.1773469240.6Gway8iNmoQkXQxj&tuid=1.1773469240.nCRl0Kh5EZzYezuY&fbc=-&gtm=W10%3D&it=50%2C759%2C1551&fbcl=-&gacl=-&gacsd=-&rtic=-&rtict=-&bgc=-&spa=1&urid=0&ab=jx.2.0%3B&sck=-&io=aGA2Og%3D%3D
Requested by
Host: ob.segreencolumn.com
URL: https://ob.segreencolumn.com/i/84cf3062f98cbab994d639a975b2798e.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
50.16.211.97 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-50-16-211-97.compute-1.amazonaws.com
Software
/
Resource Hash
c526e4bbe921e8a63361f3fe917032ccea863e323e635f06c173bedf5f2a4812

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
https://www.cyberark.com
content-encoding
gzip
pragma
no-cache
expires
Fri, 01 Jan 1990 00:00:00 GMT
content-length
1438
date
Sat, 14 Mar 2026 06:20:41 GMT
content-type
text/javascript
RCaadfaa88901e4f0e8cbb8050b0941051-source.min.js
assets.adobedtm.com/789d877fe9a8/09207f0a9c44/eb0d9e0e24f2/ 		538 B
607 B 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/eb0d9e0e24f2/RCaadfaa88901e4f0e8cbb8050b0941051-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/launch-e8e6adf0fe30.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.181.12 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-52-181-12.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
b6ea1d8746cd439217869050e68386b5a054777c1944398ef3df2543a88fb32a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cache-control
max-age=3600
timing-allow-origin
*
content-encoding
gzip
etag
"79072e67e3bfc87a7e6a64634a830954:1762975007.123862"
x-content-type-options
nosniff
expires
Sat, 14 Mar 2026 07:20:40 GMT
accept-ranges
bytes
access-control-allow-origin
https://www.cyberark.com
content-length
326
date
Sat, 14 Mar 2026 06:20:40 GMT
content-type
application/x-javascript
last-modified
Wed, 12 Nov 2025 19:16:47 GMT
server
AkamaiNetStorage
vary
Accept-Encoding
notice
consent.trustarc.com/ 		40 KB
13 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://consent.trustarc.com/notice?domain=cyberark.com&c=teconsent&js=nj&noticeType=bb&gtm=1&pcookie=1&text=true&language=en
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.122.78 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-66-122-78.fra60.r.cloudfront.net
Software
/
Resource Hash
5d8be609dbcf6813a088078c91e0cffd81eb70a2bc868d5b552525dcc2bca1cc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
cache-control
max-age=3600
content-encoding
gzip
via
1.1 508d9aac3b0097e502b117c1e7390bb0.cloudfront.net (CloudFront)
x-cache
Miss from cloudfront
x-amz-cf-id
6txV9oVEkRQ3mqqGZiKmH_pSXusdvSwNlS2Kulh270RmSHQu7ug1cA==
date
Sat, 14 Mar 2026 06:20:40 GMT
content-type
text/javascript;charset=UTF-8
vary
Accept-Encoding, Origin
x-amz-cf-pop
FRA60-P2
rtp.js
sjrtp6-cdn.marketo.com/rtp-api/v1/ 		152 KB
42 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://sjrtp6-cdn.marketo.com/rtp-api/v1/rtp.js?aid=cyberarksoftware
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.102.33.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-102-33-245.deploy.static.akamaitechnologies.com
Software
nginx /
Resource Hash
4beb123e00f4bef8edecb3c7ddda6eb703d9fac9a91c24ddde2aef8a1cd49bc2

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

Cache-Control
public, max-age=211
Content-Encoding
gzip
Connection
keep-alive
Content-Length
42512
Date
Sat, 14 Mar 2026 06:20:41 GMT
Content-Type
application/x-javascript; charset=UTF-8
Last-Modified
Fri, 13 Mar 2026 16:37:16 GMT
Server
nginx
Vary
Accept-Encoding
destination
www.googletagmanager.com/gtag/ 		391 KB
137 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/destination?id=AW-1071691665&cx=c&gtm=4e63b1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SFWTH
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.141.104 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
tzfraa-ai-in-f8.1e100.net
Software
Google Tag Manager /
Resource Hash
ccf3671ee89abefc15878cca66a85a2839b1e215ece70665767b688f67ddecb2
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

content-encoding
zstd
report-to
{"group":"ascgsrsghrgc:72:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascgsrsghrgc:72:0"}],}
expires
Sat, 14 Mar 2026 06:20:40 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 14 Mar 2026 06:20:40 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
last-modified
Sat, 14 Mar 2026 06:00:00 GMT
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascgsrsghrgc:72:0
access-control-allow-origin
*
cross-origin-opener-policy-report-only
same-origin; report-to=ascgsrsghrgc:72:0
content-length
140023
x-xss-protection
0
server
Google Tag Manager
pixel.js
www.redditstatic.com/ads/ 		65 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.redditstatic.com/ads/pixel.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SFWTH
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.1.140 , United States, ASN54113 (FASTLY - Fastly, Inc., US),
Reverse DNS
Software
snooserv /
Resource Hash
4bb376070ab35cac64c46d43a47b26b6d52bfa8d9b3ccec98c58b7d9d856b1a8

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cache-control
public, max-age=60
nel
{"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.02, "failure_fraction": 0.02}
content-encoding
gzip
etag
"13d81b97a6b0f6f5095a43473dfbab70"
report-to
{"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
via
1.1 varnish, 1.1 varnish
accept-ranges
bytes
alt-svc
h3=":443";ma=2592000;persist=1,h3-29=":443";ma=2592000;persist=1,h3-27=":443";ma=2592000;persist=1
content-length
18505
date
Sat, 14 Mar 2026 06:20:40 GMT
last-modified
Tue, 10 Mar 2026 17:18:07 GMT
content-type
application/javascript
vary
Accept-Encoding,Origin
server
snooserv
x-amz-server-side-encryption
AES256
insight.min.js
snap.licdn.com/li.lms-analytics/ 		52 KB
19 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SFWTH
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.55.161.151 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1 Akamai International B.V., NL),
Reverse DNS
a23-55-161-151.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
7e09fc2637f99d9770b0ee76309ac4c3c08e5583adf6cb5d0bbcc827bba2adc6
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cache-control
max-age=86400
content-encoding
gzip
x-cdn-proto
HTTP2
x-cdn
AKAM
x-content-type-options
nosniff
accept-ranges
bytes
alt-svc
h3=":443"; ma=93600,h3-29=":443"; ma=93600
access-control-allow-origin
*
content-length
18883
date
Sat, 14 Mar 2026 06:20:40 GMT
last-modified
Wed, 03 Dec 2025 08:26:36 GMT
content-type
application/javascript;charset=utf-8
vary
Accept-Encoding
x-amz-server-side-encryption
AES256
fbevents.js
connect.facebook.net/en_US/ 		356 KB
94 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
57.144.244.128 Frankfurt am Main, Germany, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
xx-fbcdn-shv-01-fra5.fbcdn.net
Software
/
Resource Hash
9042f1e34a93c7f8b4f6c71701eb19b553ebf0590081e805fe5a926483de7d1d
Security Headers
Name Value
Content-Security-Policy default-src 'self' blob: *;script-src 'nonce-ZPgXZInU' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: 'self';style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com;font-src 'self' data: blob: *;img-src 'self' data: blob: *;media-src 'self' data: blob: *;child-src 'self' data: blob: *;frame-src 'self' data: blob: *;manifest-src 'self' data: blob: *;object-src 'self' data: blob: *;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

content-encoding
gzip
report-to
{"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options
nosniff
expires
Sat, 01 Jan 2000 00:00:00 GMT
alt-svc
h3=":443"; ma=86400
date
Sat, 14 Mar 2026 06:20:40 GMT
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
priority
u=3,i
x-frame-options
DENY
strict-transport-security
max-age=31536000; preload; includeSubDomains
reporting-endpoints
coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy
default-src 'self' blob: *;script-src 'nonce-ZPgXZInU' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: 'self';style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com;font-src 'self' data: blob: *;img-src 'self' data: blob: *;media-src 'self' data: blob: *;child-src 'self' data: blob: *;frame-src 'self' data: blob: *;manifest-src 'self' data: blob: *;object-src 'self' data: blob: *;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;require-trusted-types-for 'script';
cache-control
public, max-age=1200
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
x-fb-connection-quality
GOOD; q=0.7, rtt=126, rtx=0, c=24, mss=1232, tbw=8723, tp=13, tpl=0, uplat=1, ullat=-1
pragma
public
x-fb-debug
l3AMVy8fwkO1WQrzBIE1Qt1879QwKnwxm6SD5e9Uiwe0nJzAbFQMdBBdqb5op/w1bm6sXOm20dAc/Ysal7cd6A==
cross-origin-resource-policy
cross-origin
permissions-policy
accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy
force-load-at-top, include-js-call-stacks-in-crash-reports
content-length
96497
x-xss-protection
0
origin-agent-cluster
?1
Bootstrap.js
nexus.ensighten.com/choozle/14963/ 		28 KB
9 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/choozle/14963/Bootstrap.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SFWTH
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.26.44 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-108-138-26-44.fra56.r.cloudfront.net
Software
CloudFront /
Resource Hash
8078cebf9ab8ba5c0802536ed68317072ca51f1cb5293db16d63f923aad2e011

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

content-encoding
br
x-amz-version-id
x04iqw22f74TR7YV8WcAUNCuLsQOa2Ho
etag
W/"ae9736f2c4e7558eebdb8be79cbd6a8d"
age
18720565
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
x-amz-cf-id
ny31OaMHXqGOKttKCbpinKRf5yi0D3zWpcWB1t07hBoOt6_v9zSGEA==
date
Sat, 09 Aug 2025 14:11:16 GMT
content-type
application/javascript; charset=utf-8
vary
accept-encoding, Origin
last-modified
Sat, 28 Oct 2023 14:30:41 GMT
x-amz-replication-status
COMPLETED
cache-control
max-age=300
via
1.1 0e358bffbd534852f8496b34da6ad3e4.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P7
server
CloudFront
x-amz-server-side-encryption
AES256
events.js
tags.srv.stackadapt.com/ 		22 KB
8 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tags.srv.stackadapt.com/events.js
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.229.217.25 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-229-217-25.compute-1.amazonaws.com
Software
/
Resource Hash
fd815d8b6eb764467a035fa9301a1c119382be2dca3c7a2f8bfcf5a7349623da

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

access-control-allow-origin
*
cache-control
max-age=5
content-encoding
gzip
date
Sat, 14 Mar 2026 06:20:41 GMT
content-type
text/javascript
dc000d50-4dbc-4d9a-ba52-c3015680f76c
tag.simpli.fi/sifitag/ 		3 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tag.simpli.fi/sifitag/dc000d50-4dbc-4d9a-ba52-c3015680f76c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SFWTH
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.204.89.238 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
238.89.204.35.bc.googleusercontent.com
Software
openresty /
Resource Hash
329eba5224a490e972374a62dd94c61794c440471cc2d40a13a73d6586d7394d

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

x-request-id
GJyg4Nsj_Cev2cHNeKKB
cache-control
max-age=0, private, must-revalidate, max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-encoding
gzip
pragma
no-cache
expires
Thu, 01 Jan 1970 00:00:00 GMT
date
Sat, 14 Mar 2026 06:20:40 GMT
content-type
application/javascript; charset=utf-8
vary
Accept-Encoding
server
openresty
dpm_443233bf934850484d12f21d9603a36ee83d1dfb.min.js
s.dpmsrv.com/ 		33 KB
12 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://s.dpmsrv.com/dpm_443233bf934850484d12f21d9603a36ee83d1dfb.min.js
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.245.60.124 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-245-60-124.fra60.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
8cd83d3dad2994402f9074e9de3ca226d9ce96040c9724cb2ce06c593b39373e

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

Content-Encoding
gzip
ETag
"33cb10f46644c41cdb3c0c0c307a5696"
Age
20895
Connection
keep-alive
Via
1.1 c2bfbd57ba266fad66928f7d9fe2f1c6.cloudfront.net (CloudFront)
Accept-Ranges
bytes
X-Cache
Hit from cloudfront
Content-Length
11644
X-Amz-Cf-Id
OiRa7xmZud8It6YL6e3iGmuJ3nVwZvHta1gNJtpCKDBUr6j9EsEcQQ==
Date
Sat, 14 Mar 2026 00:32:27 GMT
Content-Type
application/x-javascript
Last-Modified
Fri, 27 Feb 2026 02:05:36 GMT
Server
AmazonS3
X-Amz-Cf-Pop
FRA60-P5
x-amz-server-side-encryption
AES256
up_loader.1.1.0.js
js.adsrvr.org/ 		34 KB
11 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://js.adsrvr.org/up_loader.1.1.0.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SFWTH
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.172.114.101 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-172-114-101.fra60.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
62f5a9e298862e32f868dc614fa303d9b732f0dc9bd75ce48f65293c850aec2f

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

Transfer-Encoding
chunked
Vary
accept-encoding
Content-Encoding
gzip
ETag
W/"4f0ee2dd2ded846639b9a28a5cb2bd70"
Age
5435
Connection
keep-alive
Via
1.1 0e49b385c2bbe9db0820bc1551bde98a.cloudfront.net (CloudFront)
X-Cache
Hit from cloudfront
X-Amz-Cf-Id
gPALFCA7tpwG5ydIb6z8eyaw_WqFcUiaxGtY_Y1ZgCK6eTXMm9MhAg==
Date
Sat, 14 Mar 2026 04:50:07 GMT
Content-Type
application/javascript
Last-Modified
Sun, 08 Mar 2026 12:04:55 GMT
Server
AmazonS3
X-Amz-Cf-Pop
FRA60-P8
x-amz-server-side-encryption
AES256
collect
www.google.com/ccm/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://www.google.com/ccm/collect?frm=0&ae=g&en=page_view&dl=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fgolden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps&scrsrc=www.googletagmanager.com&rnd=1205668919.1773469241&dt=Golden%20SAML%3A%20Newly%20Discovered%20Attack%20Technique%20Forges%20Authentication%20to%20Cloud%20Apps&auid=314487143.1773469241&navt=n&npa=0&ep.ads_data_redaction=0&gtm=45He63b1v72025662za200zd72025662xea&gcd=13l3l3l3l1l1&dma=0&tag_exp=103116026~103200004~115938465~115938468~116024733~117484252&apve=1&apvf=f&apvc=1&tft=1773469240530&tfd=2499
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SFWTH
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.151.119 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
/
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers
cnv
cnv.event.prod.bidr.io/log/
Redirect Chain
  • https://cnv.event.prod.bidr.io/log/cnv?tag_id=188&buzz_key=intentsify&value=&segment_key=intentsify-1098&account_id=2&order=[ORDER]&ord=[CACHEBUSTER]
  • https://cnv.event.prod.bidr.io/log/cnv?tag_id=188&buzz_key=intentsify&value=&segment_key=intentsify-1098&account_id=2&order=%5BORDER%5D&ord=%5BCACHEBUSTER%5D&_bee_ppp=1
43 B
575 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://cnv.event.prod.bidr.io/log/cnv?tag_id=188&buzz_key=intentsify&value=&segment_key=intentsify-1098&account_id=2&order=%5BORDER%5D&ord=%5BCACHEBUSTER%5D&_bee_ppp=1
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H2
Server
54.78.54.11 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-78-54-11.eu-west-1.compute.amazonaws.com
Software
gunicorn /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
Strict-Transport-Security max-age=2592000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

strict-transport-security
max-age=2592000; includeSubDomains
cache-control
no-cache, must-revalidate
pragma
no-cache
expires
Fri, 01 Jan 1990 00:00:00 GMT
content-length
43
p3p
CP="This is not a P3P policy! See https://beeswax.com/privacy for more info."
date
Sat, 14 Mar 2026 06:20:41 GMT
content-type
image/gif
server
gunicorn

Redirect headers

strict-transport-security
max-age=2592000; includeSubDomains
location
https://cnv.event.prod.bidr.io/log/cnv?tag_id=188&buzz_key=intentsify&value=&segment_key=intentsify-1098&account_id=2&order=%5BORDER%5D&ord=%5BCACHEBUSTER%5D&_bee_ppp=1
content-length
0
date
Sat, 14 Mar 2026 06:20:41 GMT
server
gunicorn
5bf349c2ca21d6be.min.js
tag.demandbase.com/ 		106 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://tag.demandbase.com/5bf349c2ca21d6be.min.js
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.245.46.25 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-245-46-25.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
96a062daf8450892706b68347abc0c54d4d6d7f363d90f9e110c679d9e6d4ac1
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

content-encoding
gzip
x-amz-version-id
0XF9JL9t26hb4hfa4l.8ceP_QfecQ3YC
etag
W/"63704e66a8a6877cdc1678c0d89a1891"
age
2085
x-cache
Hit from cloudfront
x-amz-cf-id
moOLMIpeJKlLVJMamorW_ST23xpkwUSN71pS35LcWvSN2sZ3TDPooA==
date
Sat, 14 Mar 2026 05:50:28 GMT
content-type
application/javascript; charset=utf-8
vary
accept-encoding
last-modified
Fri, 16 Jan 2026 14:34:36 GMT
strict-transport-security
max-age=63072000; includeSubDomains; preload
cache-control
public, max-age=3600
via
1.1 43b9d5592d1dc6a44adc7ebaaf183280.cloudfront.net (CloudFront)
permissions-policy
accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
x-amz-cf-pop
FRA56-P9
server
AmazonS3
x-amz-server-side-encryption
AES256
analytics.js
www.google-analytics.com/ 		51 KB
21 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SFWTH
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.168.78 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lcfraa-bk-in-f14.1e100.net
Software
Golfe2 /
Resource Hash
f1a61277e3f902f50ab42015d8b07218db9b7601bb0967e54a52bfdcb4fa7e81
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

content-encoding
gzip
age
3771
report-to
{"group":"ascnsrsgac:225:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:225:0"}],}
x-content-type-options
nosniff
expires
Sat, 14 Mar 2026 07:17:50 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 14 Mar 2026 05:17:50 GMT
last-modified
Tue, 15 Jul 2025 00:44:26 GMT
content-type
text/javascript
vary
Accept-Encoding
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:225:0
cross-origin-opener-policy-report-only
same-origin; report-to=ascnsrsgac:225:0
content-length
20737
server
Golfe2
js
www.googletagmanager.com/gtag/ 		335 KB
121 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=DC-9920016
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-5SFWTH
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.141.104 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
tzfraa-ai-in-f8.1e100.net
Software
Google Tag Manager /
Resource Hash
ec5d781fdf2ddbb04ed4491269a0d031464d946c4f1d0d230d7c5cb2fd7a3ad3
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

content-encoding
zstd
expires
Sat, 14 Mar 2026 06:20:40 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 14 Mar 2026 06:20:40 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
last-modified
Sat, 14 Mar 2026 06:00:00 GMT
access-control-allow-headers
Cache-Control
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
*
content-length
123813
x-xss-protection
0
server
Google Tag Manager
visitWebPage
316-czp-275.mktoresp.com/webevents/ 		2 B
318 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://316-czp-275.mktoresp.com/webevents/visitWebPage?_mchNc=1773469240556&_mchCn=&_mchId=316-CZP-275&_mchTk=_mch-cyberark.com-54f3d736a7be1eb78939b03286739e4d&_mchHo=www.cyberark.com&_mchPo=&_mchRu=%2Fresources%2Fthreat-research-blog%2Fgolden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps&_mchPc=https%3A&_mchVr=164&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/164/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.28.164.179 , United States, ASN15224 (OMNITURE - Adobe Inc., US),
Reverse DNS
Software
nginx/1.20.1 /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

Transfer-Encoding
chunked
X-Request-Id
3c4f2df4-c60b-49ed-90a3-61a96f191ce1
Content-Encoding
gzip
Connection
keep-alive
Access-Control-Allow-Origin
*
Date
Sat, 14 Mar 2026 06:20:42 GMT
Content-Type
text/plain; charset=UTF-8
Server
nginx/1.20.1
RCafea4cb80efa419b806e7af4fcada193-source.min.js
assets.adobedtm.com/789d877fe9a8/09207f0a9c44/eb0d9e0e24f2/ 		429 B
555 B 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/eb0d9e0e24f2/RCafea4cb80efa419b806e7af4fcada193-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/launch-e8e6adf0fe30.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.181.12 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-52-181-12.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
609bbf13dec680962cbaec7d7143a6a4a01af4d4907ea07d673bf8aef8fc4771
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cache-control
max-age=3600
timing-allow-origin
*
content-encoding
gzip
etag
"79072e67e3bfc87a7e6a64634a830954:1762975007.123862"
x-content-type-options
nosniff
expires
Sat, 14 Mar 2026 07:20:40 GMT
accept-ranges
bytes
access-control-allow-origin
https://www.cyberark.com
content-length
274
date
Sat, 14 Mar 2026 06:20:40 GMT
content-type
application/x-javascript
last-modified
Wed, 12 Nov 2025 19:16:47 GMT
server
AkamaiNetStorage
vary
Accept-Encoding
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/1071691665/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1071691665/?random=1773469240725&cv=11&fst=1773469240725&bg=ffffff&guid=ON&async=1&gtm=45be63b1v898648185z872025662za20gzb72025662zd72025662xea&gcd=13l3l3l3l1l1&dma=0&tag_exp=103116026~103200004~115616986~115938465~115938469~116024733~117484252&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fgolden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps&frm=0&tiba=Golden%20SAML%3A%20Newly%20Discovered%20Attack%20Technique%20Forges%20Authentication%20to%20Cloud%20Apps&hn=www.googleadservices.com&npa=0&pscdl=noapi&auid=314487143.1773469241&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_tu=CA&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=AW-1071691665&cx=c&gtm=4e63b1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.127.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lcfrai-in-f157.1e100.net
Software
cafe /
Resource Hash
d1f006edc87b21a5167e1dcdd0fce66e6f0a495b8c6da053db08860fa4df0ea9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
content-encoding
br
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
2214
date
Sat, 14 Mar 2026 06:20:41 GMT
x-xss-protection
0
content-type
text/javascript; charset=UTF-8
content-disposition
attachment; filename="f.txt"
server
cafe
collect
www.google.com/ccm/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://www.google.com/ccm/collect?frm=0&ae=g&dl=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fgolden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps&scrsrc=www.googletagmanager.com&rnd=1205668919.1773469241&dt=Golden%20SAML%3A%20Newly%20Discovered%20Attack%20Technique%20Forges%20Authentication%20to%20Cloud%20Apps&auid=314487143.1773469241&navt=n&npa=0&_tu=CA&gtm=45be63b1v898648185z872025662za20gzb72025662zd72025662xea&gcd=13l3l3l3l1l1&dma=0&tag_exp=103116026~103200004~115616986~115938465~115938469~116024733~117484252&apve=1&apvf=f&apvc=0&tids=AW-1071691665&tid=AW-1071691665&tft=1773469240748&tfd=2717
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=AW-1071691665&cx=c&gtm=4e63b1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.151.119 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
/
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers
collect
www.google.com/ccm/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://www.google.com/ccm/collect?frm=0&en=page_view&dl=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fgolden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps&scrsrc=www.googletagmanager.com&rnd=1205668919.1773469241&dt=Golden%20SAML%3A%20Newly%20Discovered%20Attack%20Technique%20Forges%20Authentication%20to%20Cloud%20Apps&auid=314487143.1773469241&navt=n&npa=0&_tu=CA&gtm=45fe63b1za200xec&gcd=13l3l3l3l1l1&dma=0&tag_exp=103116026~103200004~115616986~115938465~115938469~116024733~117484252&apve=1&apvf=f&apvc=0&tids=DC-9920016&tid=DC-9920016&tft=1773469240786&tfd=2756
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=DC-9920016
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.151.119 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
/
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers
dest5.html
cyberark.demdex.net/ Frame 7364 		7 KB
3 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://cyberark.demdex.net/dest5.html?d_nsid=0
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/launch-e8e6adf0fe30.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
52.18.115.33 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-52-18-115-33.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36

Response headers

accept-ranges
bytes
cache-control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
content-encoding
gzip
content-type
text/html;charset=UTF-8
date
Sat, 14 Mar 2026 06:20:41 GMT
dcs
dcs-prod-irl1-1-v085-010688c3b.edge-irl1.demdex.com 0 ms
expires
Thu, 01 Jan 1970 00:00:00 UTC
last-modified
Mon, 9 Mar 2026 11:51:58 GMT
p3p
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
pragma
no-cache
strict-transport-security
max-age=31536000; includeSubDomains
vary
accept-encoding
x-tid
hCQ5GIWsRh4=
ibs:dpid=411&dpuuid=abT_OQAAAE0b6QO-
dpm.demdex.net/
Redirect Chain
  • https://cm.everesttech.net/cm/dd?d_uuid=40063168363633222981499930872278632852
  • https://dpm.demdex.net/ibs:dpid=411&dpuuid=abT_OQAAAE0b6QO-
42 B
717 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dpm.demdex.net/ibs:dpid=411&dpuuid=abT_OQAAAE0b6QO-
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H2
Server
176.34.239.19 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-176-34-239-19.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
cache-control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
dcs
dcs-prod-irl1-1-v085-0005a30a1.edge-irl1.demdex.com 2 ms
content-encoding
gzip
pragma
no-cache
x-content-type-options
nosniff
x-tid
HjXTGjfmTLs=
expires
Thu, 01 Jan 1970 00:00:00 UTC
content-length
59
p3p
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
date
Sat, 14 Mar 2026 06:20:41 GMT
content-type
image/gif

Redirect headers

Cache-Control
no-cache
Location
https://dpm.demdex.net/ibs:dpid=411&dpuuid=abT_OQAAAE0b6QO-
P3P
CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Content-Length
0
Date
Sat, 14 Mar 2026 06:20:41 GMT
Connection
keep-alive
Server
AMO-cookiemap/1.1
delivery
cyberark.tt.omtrdc.net/rest/v1/ 		351 B
836 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://cyberark.tt.omtrdc.net/rest/v1/delivery?client=cyberark&sessionId=cd7bef2899e0480b98e2ae9f5e553dc9&version=2.11.7
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/launch-e8e6adf0fe30.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
63.140.62.200 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ip-63-140-62-200.data.adobedc.net
Software
jag /
Resource Hash
c00f98310d0e62fb4ff71952f4bcf87780adc76f479a73b076068c4715b82200
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Content-Type
text/plain
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-request-id
ca411603-7732-4c02-9812-cdf2de8461f8
cache-control
no-cache, no-store, max-age=0, no-transform, private
timing-allow-origin
*
content-encoding
gzip
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List
access-control-allow-credentials
true
referrer-policy
strict-origin-when-cross-origin
x-content-type-options
nosniff
access-control-allow-origin
https://www.cyberark.com
date
Sat, 14 Mar 2026 06:20:41 GMT
x-xss-protection
1; mode=block
content-type
application/json;charset=UTF-8
vary
origin,access-control-request-method,access-control-request-headers,accept-encoding
server
jag
ajax_ping
www.cyberark.com/resources/hubsFront/ 		49 B
413 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.cyberark.com/resources/hubsFront/ajax_ping
Requested by
Host: content.cdntwrk.com
URL: https://content.cdntwrk.com/js/hubs/hubs_app.bc805b535b8c6058120d.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
104.16.69.86 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
74935268619be1f087ce67765abd72f80107125f23b346f7615cc9e6a19d4595
Security Headers
Name Value
Content-Security-Policy frame-ancestors 'self' https://www.cyberark.com/
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Request headers

Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
X-Requested-With
XMLHttpRequest
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Accept
*/*

Response headers

content-encoding
gzip
cf-cache-status
DYNAMIC
x-content-type-options
nosniff
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
p3p
CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
date
Sat, 14 Mar 2026 06:20:41 GMT
content-type
application/json
priority
u=1,i
x-frame-options
DENY
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-security-policy
frame-ancestors 'self' https://www.cyberark.com/
speculation-rules
"/cdn-cgi/speculation"
referrer-policy
unsafe-url
cf-ray
9dc12c8428d1c222-TLV
x-xss-protection
1; mode=block
content-language
en
server
cloudflare
serverComponent.php
nexus.ensighten.com/choozle/14963/ 		386 B
732 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/choozle/14963/serverComponent.php?namespace=Bootstrapper&staticJsPath=nexus.ensighten.com/choozle/14963/code/&publishedOn=Sat%20Oct%2028%2014:30:32%20GMT%202023&ClientID=923&PageID=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fgolden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/choozle/14963/Bootstrap.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
108.138.26.44 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-108-138-26-44.fra56.r.cloudfront.net
Software
CloudFront /
Resource Hash
bea943d92ffaf3641efe765092233d69baf17d5222b41ac60685433b4c5f9a9a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cache-control
no-cache, no-store
via
1.1 0e358bffbd534852f8496b34da6ad3e4.cloudfront.net (CloudFront)
expires
Sat, 14 Mar 2026 06:20:40 GMT
alt-svc
h3=":443"; ma=86400
x-cache
Miss from cloudfront
content-length
386
x-amz-cf-id
GpfYgqjnhDHuIY19dIEWH_XudllnQFnY7j7RQRrD6vnVzT7ruwD2tw==
date
Sat, 14 Mar 2026 06:20:41 GMT
content-type
text/javascript
x-amz-cf-pop
FRA56-P7
server
CloudFront
vary
Origin
analytics
consent.trustarc.com/ 		43 B
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://consent.trustarc.com/analytics?action=0&domain=cyberark.com&implied=1&session=87aa5fbc318c44f58a05afc58d3311a8&new=1&referer=https://www.cyberark.com
Requested by
Host: consent.trustarc.com
URL: https://consent.trustarc.com/notice?domain=cyberark.com&c=teconsent&js=nj&noticeType=bb&gtm=1&pcookie=1&text=true&language=en
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.122.78 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-66-122-78.fra60.r.cloudfront.net
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
access-control-expose-headers
*
pragma
no-cache
via
1.1 935770605c74a80712059ba5b24d4162.cloudfront.net (CloudFront)
expires
Mon, 26 Jul 1997 05:00:00 GMT
access-control-allow-origin
*
x-cache
Miss from cloudfront
content-length
43
x-amz-cf-id
Dw_lR3fDM0JFAICnx3WDP0_-51fBVO7qHlPQ9rbdYW_OY_6FV_rqdw==
date
Sat, 14 Mar 2026 06:20:41 GMT
content-type
image/gif
x-amz-cf-pop
FRA60-P2
get
consent.trustarc.com/ Frame 584C 		2 KB
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://consent.trustarc.com/get?name=crossdomain.html&domain=cyberark.com
Requested by
Host: consent.trustarc.com
URL: https://consent.trustarc.com/notice?domain=cyberark.com&c=teconsent&js=nj&noticeType=bb&gtm=1&pcookie=1&text=true&language=en
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.122.49 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-66-122-49.fra60.r.cloudfront.net
Software
/
Resource Hash
4e02fda4bdfbdf9df0e3523b8b2b385afbd007a3f8318e0e640f8d0a0da100be
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36

Response headers

age
3465
cache-control
max-age=2592000
content-encoding
gzip
content-length
1084
content-type
text/html
date
Sat, 14 Mar 2026 05:22:56 GMT
pragma
public
strict-transport-security
max-age=31536000; includeSubDomains
vary
Accept-Encoding Origin
via
1.1 615f944336054ae07b8e7c415ddbad44.cloudfront.net (CloudFront)
x-amz-cf-id
RFGw_1MoJfxg-I6UIhL3CwbYofoVMJYDIvCyr6fl0RUCN6cIR9qVbA==
x-amz-cf-pop
FRA60-P2
x-cache
Hit from cloudfront
v1.7-8297
consent.trustarc.com/asset/notice.js/v/ 		122 KB
36 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://consent.trustarc.com/asset/notice.js/v/v1.7-8297
Requested by
Host: consent.trustarc.com
URL: https://consent.trustarc.com/notice?domain=cyberark.com&c=teconsent&js=nj&noticeType=bb&gtm=1&pcookie=1&text=true&language=en
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.122.78 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-66-122-78.fra60.r.cloudfront.net
Software
/
Resource Hash
5ea06e65cbabd32730119cff1bb1426c4ab45b8ccba62935c0caebfa50f135b0
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Origin
https://www.cyberark.com
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

access-control-expose-headers
*
content-encoding
gzip
age
442
x-cache
Hit from cloudfront
x-amz-cf-id
YY5sRJAKjpXhOaUd5ohPzM2aovh-sptoOtJOFm5YYmIY5IIljweyIg==
date
Sat, 14 Mar 2026 06:13:19 GMT
content-type
application/javascript
last-modified
Thu, 12 Mar 2026 12:42:53 GMT
vary
accept-encoding
strict-transport-security
max-age=31536000; includeSubDomains
cache-control
max-age=2592000
pragma
public
via
1.1 935770605c74a80712059ba5b24d4162.cloudfront.net (CloudFront)
access-control-allow-origin
*
content-length
36789
x-amz-cf-pop
FRA60-P2
config
pixel-config.reddit.com/pixels/a2_f2ipfpm2zmyf/ 		618 B
327 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://pixel-config.reddit.com/pixels/a2_f2ipfpm2zmyf/config
Requested by
Host: www.redditstatic.com
URL: https://www.redditstatic.com/ads/pixel.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.65.140 , United States, ASN54113 (FASTLY - Fastly, Inc., US),
Reverse DNS
Software
snooserv /
Resource Hash
a3e210a2a85e04c7857200b23bb1696f69953857a9b35745fddd0c446c8918a1

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cache-control
max-age=14400
content-encoding
gzip
via
1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
content-length
221
date
Sat, 14 Mar 2026 06:20:41 GMT
content-type
application/json
server
snooserv
rp.gif
alb.reddit.com/ 		42 B
637 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://alb.reddit.com/rp.gif?ts=1773469241016&id=a2_f2ipfpm2zmyf&event=PageVisit&m.value=&m.transactionId=&m.customEventName=&m.products=&m.conversionId=&uuid=37c60f73-514c-4dc9-8d2a-15c646911490&aaid=&em=&pn=&external_id=&idfa=&integration=gtm&partner=&partner_version=&opt_out=0&sh=1600&sw=1200&v=rdt_79aa2193&dpm=&dpcc=&dprc=
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
151.101.129.140 , United States, ASN54113 (FASTLY - Fastly, Inc., US),
Reverse DNS
Software
Varnish /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

nel
{"report_to": "w3-reporting-nel", "max_age": 14400, "include_subdomains": false, "success_fraction": 0.3, "failure_fraction": 0.3}
retry-after
0
cross-origin-resource-policy
cross-origin
report-to
{"group": "w3-reporting-nel", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-nel.reddit.com/reports" }]}, {"group": "w3-reporting", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting.reddit.com/reports" }]}, {"group": "w3-reporting-csp", "max_age": 14400, "include_subdomains": true, "endpoints": [{ "url": "https://w3-reporting-csp.reddit.com/reports" }]}
via
1.1 varnish
accept-ranges
bytes
content-length
42
date
Sat, 14 Mar 2026 06:20:41 GMT
content-type
image/gif
server
Varnish
/
px.ads.linkedin.com/wa/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://px.ads.linkedin.com/wa/?medium=fetch&fmt=g
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
150.171.22.12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash

Request headers

Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Accept
*
Content-Type
text/plain;charset=UTF-8

Response headers

linkedin-action
1
x-li-pop
afd-prod-lor1-x
x-msedge-ref
Ref A: D7FB0CA532A64B1F8F37568FED904461 Ref B: TLV30EDGE0517 Ref C: 2026-03-14T06:20:41Z
x-li-fabric
prod-lor1
access-control-allow-credentials
true
x-li-uuid
AAZM9fwnvt7S19bKSSyqiQ==
x-li-proto
http/2
access-control-allow-origin
https://www.cyberark.com
x-cache
CONFIG_NOCACHE
alt-svc
h3=":443"; ma=86400
date
Sat, 14 Mar 2026 06:20:41 GMT
vary
Origin
attribution_trigger
px.ads.linkedin.com/ 		2 B
789 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://px.ads.linkedin.com/attribution_trigger?pid=17906&time=1773469241030&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fgolden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps&tm=gtmv2
Requested by
Host: snap.licdn.com
URL: https://snap.licdn.com/li.lms-analytics/insight.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
150.171.22.12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Accept
*
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

x-li-pop
afd-prod-lor1-x
content-encoding
gzip
x-fs-uuid
00064cf5fc27b676babb35928d66efe0
x-msedge-ref
Ref A: 765A9D4FF02A4B9F82FB5C9967F3C26D Ref B: TLV30EDGE0109 Ref C: 2026-03-14T06:20:41Z
x-li-fabric
prod-lor1
x-restli-protocol-version
1.0.0
access-control-allow-methods
GET, OPTIONS
x-li-uuid
AAZM9fwntna6uzWSjWbv4A==
x-li-proto
http/2
access-control-allow-origin
*
x-cache
CONFIG_NOCACHE
alt-svc
h3=":443"; ma=86400
date
Sat, 14 Mar 2026 06:20:40 GMT
content-type
application/json
access-control-allow-headers
*
collect
px.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=17906&time=1773469241030&li_adsId=d179f441-3a79-4559-ac15-e97dc06580a4&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fgol...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=17906&time=1773469241030&li_adsId=d179f441-3a79-4559-ac15-e97dc06580a4&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fgol...
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D17906%26time%3D1773469241030%26li_adsId%3Dd179f441-3a79-4559-ac15-e97dc06580a4%26...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=17906&time=1773469241030&li_adsId=d179f441-3a79-4559-ac15-e97dc06580a4&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fgol...
0
41 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=17906&time=1773469241030&li_adsId=d179f441-3a79-4559-ac15-e97dc06580a4&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fgolden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps&tm=gtmv2&cookiesTest=true&liSync=true
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H3
Server
150.171.22.12 , United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK - Microsoft Corporation, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

linkedin-action
1
x-li-pop
afd-prod-lor1-x
x-msedge-ref
Ref A: F2E096AF7FFE48D98E4492F2FB0ED0A3 Ref B: TLV30EDGE0111 Ref C: 2026-03-14T06:20:42Z
x-li-fabric
prod-lor1
x-li-uuid
AAZM9fw4SYFp74Jdhfwsug==
x-li-proto
http/1.1
alt-svc
h3=":443"; ma=86400
x-cache
CONFIG_NOCACHE
content-length
0
date
Sat, 14 Mar 2026 06:20:42 GMT
content-type
application/javascript

Redirect headers

linkedin-action
1
cf-cache-status
DYNAMIC
x-li-fabric
prod-lor1
x-content-type-options
nosniff
expires
Thu, 01 Jan 1970 00:00:00 GMT
x-li-proto
http/2
alt-svc
h3=":443"; ma=86400
date
Sat, 14 Mar 2026 06:20:42 GMT
x-frame-options
sameorigin
strict-transport-security
max-age=31536000
x-li-pop
cf-prod-lor1-x
content-security-policy
frame-ancestors 'self'
cache-control
no-cache, no-store, no-transform
location
https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=17906&time=1773469241030&li_adsId=d179f441-3a79-4559-ac15-e97dc06580a4&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fgolden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps&tm=gtmv2&cookiesTest=true&liSync=true
pragma
no-cache
cf-ray
9dc12c8b2f31c233-TLV
x-li-uuid
AAZM9fwzyEGQhmv8XHxfkw==
content-length
0
server
cloudflare
286320195733404
connect.facebook.net/signals/config/ 		159 KB
38 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://connect.facebook.net/signals/config/286320195733404?v=2.9.277&r=stable&domain=www.cyberark.com&hme=b0ad3da822578fe2b808f13c29c26424c1eec6df21f897230a1f8d7975c03c8e&ex_m=101%2C194%2C143%2C22%2C69%2C70%2C136%2C65%2C64%2C11%2C151%2C87%2C16%2C130%2C123%2C72%2C75%2C129%2C148%2C153%2C8%2C4%2C5%2C7%2C6%2C3%2C88%2C98%2C154%2C159%2C208%2C59%2C175%2C176%2C52%2C262%2C30%2C71%2C220%2C219%2C218%2C23%2C32%2C100%2C58%2C10%2C60%2C94%2C95%2C96%2C102%2C126%2C31%2C29%2C128%2C125%2C124%2C144%2C73%2C147%2C145%2C146%2C47%2C57%2C119%2C15%2C150%2C42%2C249%2C250%2C248%2C26%2C27%2C28%2C45%2C137%2C74%2C109%2C18%2C20%2C41%2C37%2C39%2C38%2C80%2C89%2C93%2C107%2C135%2C138%2C43%2C108%2C24%2C21%2C115%2C66%2C35%2C140%2C139%2C141%2C132%2C131%2C25%2C34%2C56%2C106%2C149%2C67%2C17%2C142%2C111%2C78%2C63%2C19%2C82%2C83%2C112%2C81%2C33%2C277%2C201%2C190%2C191%2C189%2C280%2C272%2C49%2C202%2C104%2C127%2C77%2C117%2C51%2C44%2C46%2C110%2C116%2C122%2C55%2C61%2C50%2C53%2C97%2C152%2C1%2C120%2C14%2C118%2C12%2C2%2C54%2C90%2C62%2C114%2C86%2C85%2C155%2C156%2C91%2C92%2C9%2C121%2C99%2C48%2C133%2C84%2C76%2C68%2C113%2C103%2C40%2C134%2C0%2C79%2C36%2C105%2C13%2C157
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
57.144.244.128 Frankfurt am Main, Germany, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
xx-fbcdn-shv-01-fra5.fbcdn.net
Software
/
Resource Hash
303b1758be065475105b7095b5f054126654beb7e52fb056af8037b0d8148fb7
Security Headers
Name Value
Content-Security-Policy default-src 'self' blob: *;script-src 'nonce-vY6z5Qjt' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: 'self';style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com;font-src 'self' data: blob: *;img-src 'self' data: blob: *;media-src 'self' data: blob: *;child-src 'self' data: blob: *;frame-src 'self' data: blob: *;manifest-src 'self' data: blob: *;object-src 'self' data: blob: *;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?minimize=0;require-trusted-types-for 'script';
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

content-encoding
gzip
report-to
{"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coep\/?minimize=0"}],"group":"coep_report"}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options
nosniff
expires
Sat, 01 Jan 2000 00:00:00 GMT
alt-svc
h3=":443"; ma=86400
date
Sat, 14 Mar 2026 06:20:41 GMT
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
priority
u=3,i
x-frame-options
DENY
strict-transport-security
max-age=31536000; preload; includeSubDomains
reporting-endpoints
coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", coep_report="https://www.facebook.com/browser_reporting/coep/?minimize=0", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy
default-src 'self' blob: *;script-src 'nonce-vY6z5Qjt' *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* blob: 'self';style-src 'self' data: blob: 'unsafe-inline';connect-src 'self' data: blob: https://edge-chat.facebook.net https://edge-chat-latest.facebook.net wss://edge-chat-latest.facebook.net wss://edge-chat.facebook.net wss://edge-chat.socialplugin.facebook.net wss://edge-chat-latest.socialplugin.facebook.net https://edge-chat.socialplugin.facebook.net https://edge-chat-latest.socialplugin.facebook.net *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* *.cdninstagram.com;font-src 'self' data: blob: *;img-src 'self' data: blob: *;media-src 'self' data: blob: *;child-src 'self' data: blob: *;frame-src 'self' data: blob: *;manifest-src 'self' data: blob: *;object-src 'self' data: blob: *;worker-src 'self' data: blob: *;block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?minimize=0;require-trusted-types-for 'script';
cache-control
public, max-age=1200
timing-allow-origin
*
cross-origin-opener-policy
same-origin-allow-popups
x-fb-connection-quality
GOOD; q=0.7, rtt=126, rtx=0, c=107, mss=1232, tbw=110119, tp=101, tpl=0, uplat=168, ullat=0
pragma
public
x-fb-debug
hj8r+GEWqRAff2smm7WiBG4agct3imW4YqBWVXbftyV8SRP1dyeoaBuBh7XcOaJO3k/iItvfurkWPA0hNZWSkQ==
cross-origin-resource-policy
cross-origin
permissions-policy
accelerometer=(), attribution-reporting=(), autoplay=(), bluetooth=(), camera=(), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(), clipboard-write=(), compute-pressure=(), display-capture=(), encrypted-media=(), fullscreen=(self), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), midi=(), otp-credentials=(), payment=(), picture-in-picture=(), private-state-token-issuance=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=();report-to="permissions_policy"
document-policy
force-load-at-top, include-js-call-stacks-in-crash-reports
x-xss-protection
0
origin-agent-cluster
?1
/
googleads.g.doubleclick.net/pagead/viewthroughconversion/1071691665/ 		5 KB
2 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1071691665/?random=1773469241112&cv=11&fst=1773469241112&bg=ffffff&guid=ON&async=1&en=gtag.config&gtm=45be63b1v898648185za20gzb72025662zd72025662xec&gcd=13l3l3l3l1l1&dma=0&tag_exp=103116026~103200004~115616986~115938465~115938469~116024733~117484252&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fgolden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps&frm=0&tiba=Golden%20SAML%3A%20Newly%20Discovered%20Attack%20Technique%20Forges%20Authentication%20to%20Cloud%20Apps&hn=www.googleadservices.com&npa=0&pscdl=noapi&auid=314487143.1773469241&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=4
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=AW-1071691665&cx=c&gtm=4e63b1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.127.157 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lcfrai-in-f157.1e100.net
Software
cafe /
Resource Hash
1b494e366f0947c7b54904d8cbb4c79efde8ddc54161b9493d5b32216a342a83
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cache-control
no-cache, must-revalidate
timing-allow-origin
*
content-encoding
br
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
2241
date
Sat, 14 Mar 2026 06:20:41 GMT
x-xss-protection
0
content-type
text/javascript; charset=UTF-8
content-disposition
attachment; filename="f.txt"
server
cafe
/
www.googleadservices.com/pagead/conversion/1071691665/ 		3 KB
1 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://www.googleadservices.com/pagead/conversion/1071691665/?random=1773469241120&cv=11&fst=1773469241120&bg=ffffff&guid=ON&async=1&en=conversion&gtm=45be63b1v898648185za20gzb72025662zd72025662xec&gcd=13l3l3l3l1l1&dma=0&tag_exp=103116026~103200004~115616986~115938465~115938469~116024733~117484252&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fgolden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps&label=H8zfCNSYxvwYEJHvgv8D&capi=1&gtm_ee=1&frm=0&tiba=Golden%20SAML%3A%20Newly%20Discovered%20Attack%20Technique%20Forges%20Authentication%20to%20Cloud%20Apps&hn=www.googleadservices.com&npa=0&pscdl=noapi&auid=314487143.1773469241&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&gcl_ctr=1~0~0&data=event%3Dconversion&category=acrcp_v1_512&fmt=7
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=AW-1071691665&cx=c&gtm=4e63b1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
216.58.206.66 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
mil07s08-in-f2.1e100.net
Software
cafe /
Resource Hash
ccbf55c63cf823f257fd0e0f4e213a6782e6eb004f1f2012ae0ddf20748ce1c9
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

content-encoding
br
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
date
Sat, 14 Mar 2026 06:20:41 GMT
content-type
application/json; charset=UTF-8
content-disposition
attachment; filename="f.txt"
cache-control
no-cache, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
https://www.cyberark.com
content-length
1201
x-xss-protection
0
server
cafe
/
www.google.co.il/pagead/1p-conversion/1071691665/
Redirect Chain
  • https://www.googleadservices.com/pagead/conversion/1071691665/?label=H8zfCNSYxvwYEJHvgv8D&guid=ON&script=0
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1071691665/?label=H8zfCNSYxvwYEJHvgv8D&guid=ON&script=0&ct_cookie_present=false&random=523391497&crd=CLTesQIIobixAgixwbECCLDBsQIIscO...
  • https://www.google.com/pagead/1p-conversion/1071691665/?label=H8zfCNSYxvwYEJHvgv8D&guid=ON&script=0&ct_cookie_present=false&random=523391497&crd=CLTesQIIobixAgixwbECCLDBsQIIscOxAgiKxbECCMLJsQIItMax...
  • https://www.google.co.il/pagead/1p-conversion/1071691665/?label=H8zfCNSYxvwYEJHvgv8D&guid=ON&script=0&ct_cookie_present=false&random=523391497&crd=CLTesQIIobixAgixwbECCLDBsQIIscOxAgiKxbECCMLJsQIItM...
42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.co.il/pagead/1p-conversion/1071691665/?label=H8zfCNSYxvwYEJHvgv8D&guid=ON&script=0&ct_cookie_present=false&random=523391497&crd=CLTesQIIobixAgixwbECCLDBsQIIscOxAgiKxbECCMLJsQIItMaxAgiT2rECCNvcsQIIh9uxAgjTxbECCOvMsQII7c6xAgjVz7ECCPTasQIIl9SxAgjJ27ECCLHhsQIIs-GxAgim3bECCLDesQI&cerd=CgSI3b0t&fsk=ChEI8OvOzQYQtqmjsqjx5qviARIsAF5ryED5BClOyAuqURCNuj9tjVgKcJZ_20MpIvEH6IDlk-D3oFGTo6HcJ8oaAnXZ&is_vtc=1&cid=CAQSvwEA56J1eS7cTbfx5w9wOJQgRG8mgYGPnkCrHQyGOgxmpktTG_i7ML8sA3UMPyClfbD8JvigquZGoHpW7k6k7EzfExniKTBG_dcJnlr8rPk8y0o5FPu6fnMtEpC3Uzw586R1qOWMt4kLuYFbc1CT0FOQHRRsn4iLy6H4CKxhcNpxHeeL5EZo5IUoTgSXAiU7ai1JSLBA08fCUEKdJzBexVTpSOtiXOEtY88O93YZWUKX4vAY5e9CoBvu0Y9_EPJoFw&random=68090297&ipr=y&pscrd=IhMI1OGc4d-ekwMV-kQdCR19mxoYMgwIA2IICAAQABgAIAAyDAgEYggIABAAGAAgADIMCAdiCAgAEAAYACAAMgwICGIICAAQABgAIAAyDAgJYggIABAAGAAgADIMCApiCAgAEAAYACAAMgwIAmIICAAQABgAIAAyDAgLYggIABAAGAAgADIMCBViCAgAEAAYACAAMgwIH2IICAAQABgAIAAyDAgTYggIABAAGAAgADIMCBJiCAgAEAAYACAAOokBaHR0cHM6Ly93d3cuY3liZXJhcmsuY29tL3Jlc291cmNlcy90aHJlYXQtcmVzZWFyY2gtYmxvZy9nb2xkZW4tc2FtbC1uZXdseS1kaXNjb3ZlcmVkLWF0dGFjay10ZWNobmlxdWUtZm9yZ2VzLWF1dGhlbnRpY2F0aW9uLXRvLWNsb3VkLWFwcHN6DAgJYggIABAAGAAgAIIBAnAB
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H2
Server
172.217.16.195 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
tzfraa-at-in-f3.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

content-security-policy
script-src 'none'; object-src 'none'
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
42
date
Sat, 14 Mar 2026 06:20:41 GMT
x-xss-protection
0
content-type
image/gif
server
cafe

Redirect headers

content-security-policy
script-src 'none'; object-src 'none'
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
location
https://www.google.co.il/pagead/1p-conversion/1071691665/?label=H8zfCNSYxvwYEJHvgv8D&guid=ON&script=0&ct_cookie_present=false&random=523391497&crd=CLTesQIIobixAgixwbECCLDBsQIIscOxAgiKxbECCMLJsQIItMaxAgiT2rECCNvcsQIIh9uxAgjTxbECCOvMsQII7c6xAgjVz7ECCPTasQIIl9SxAgjJ27ECCLHhsQIIs-GxAgim3bECCLDesQI&cerd=CgSI3b0t&fsk=ChEI8OvOzQYQtqmjsqjx5qviARIsAF5ryED5BClOyAuqURCNuj9tjVgKcJZ_20MpIvEH6IDlk-D3oFGTo6HcJ8oaAnXZ&is_vtc=1&cid=CAQSvwEA56J1eS7cTbfx5w9wOJQgRG8mgYGPnkCrHQyGOgxmpktTG_i7ML8sA3UMPyClfbD8JvigquZGoHpW7k6k7EzfExniKTBG_dcJnlr8rPk8y0o5FPu6fnMtEpC3Uzw586R1qOWMt4kLuYFbc1CT0FOQHRRsn4iLy6H4CKxhcNpxHeeL5EZo5IUoTgSXAiU7ai1JSLBA08fCUEKdJzBexVTpSOtiXOEtY88O93YZWUKX4vAY5e9CoBvu0Y9_EPJoFw&random=68090297&ipr=y&pscrd=IhMI1OGc4d-ekwMV-kQdCR19mxoYMgwIA2IICAAQABgAIAAyDAgEYggIABAAGAAgADIMCAdiCAgAEAAYACAAMgwICGIICAAQABgAIAAyDAgJYggIABAAGAAgADIMCApiCAgAEAAYACAAMgwIAmIICAAQABgAIAAyDAgLYggIABAAGAAgADIMCBViCAgAEAAYACAAMgwIH2IICAAQABgAIAAyDAgTYggIABAAGAAgADIMCBJiCAgAEAAYACAAOokBaHR0cHM6Ly93d3cuY3liZXJhcmsuY29tL3Jlc291cmNlcy90aHJlYXQtcmVzZWFyY2gtYmxvZy9nb2xkZW4tc2FtbC1uZXdseS1kaXNjb3ZlcmVkLWF0dGFjay10ZWNobmlxdWUtZm9yZ2VzLWF1dGhlbnRpY2F0aW9uLXRvLWNsb3VkLWFwcHN6DAgJYggIABAAGAAgAIIBAnAB
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
42
date
Sat, 14 Mar 2026 06:20:41 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
collect
www.google.com/ccm/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://www.google.com/ccm/collect?frm=0&en=page_view&dl=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fgolden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps&scrsrc=www.googletagmanager.com&rnd=1205668919.1773469241&dt=Golden%20SAML%3A%20Newly%20Discovered%20Attack%20Technique%20Forges%20Authentication%20to%20Cloud%20Apps&auid=314487143.1773469241&navt=n&npa=0&gtm=45be63b1v898648185za20gzb72025662zd72025662xec&gcd=13l3l3l3l1l1&dma=0&tag_exp=103116026~103200004~115616986~115938465~115938469~116024733~117484252&apve=1&apvf=f&apvc=0&tids=AW-1071691665&tid=AW-1071691665&tft=1773469241130&tfd=3100
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/destination?id=AW-1071691665&cx=c&gtm=4e63b1
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.151.119 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
/
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers
tc_imp.gif
obs.segreencolumn.com/tracker/ 		43 B
79 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://obs.segreencolumn.com/tracker/tc_imp.gif?e=37dfbd8ee84e00126dedc333e3458e9c9225c24f567d43d6da1908be6245cad7bd70a976750ef80ed89373bfe70e9c20c1e53e8d5a148e6a2217071a10acf9f29f671fd485da007d6a4df87f7f51866adb30ce0c330071c504525a3c5656ceba6c1d77be26bb25cb43e2903aee5367ab132a720fdb5ae854e285929c68f37950aa2084ba5f7ff35b7b1a2d18c8c9077af562b78ed7e2465fc110d1f271f869d26dab56811c30df6d45a54121517eb0106ab9dabff379ec7bfd1ea76b97330d6fa98b6e226e6a2ed036d2c200e0776dbaccec77527b26d3982e3e8b9e5c0e4915275649fe9129637a19a7fc5b659ee9a06f82ea4975152fa3f2f1c09d25bd8c8b5bba02ce5d3766c8be93b0a434c68aeb68973506c3e5db724d04fd686aab930876ab9aa7668514a702f6c45bc850d48838832666dfcb729a34d289f6a0d0b2fc5b7fb570f3f9a97c122bf88b21c5e506ae071342820c18d688ccc8cff1807dcd27de98b28437ff7f743acb742c819a8a0121dbf972a615e0834a9038ac6b544855c579a90addcda274ab903f8818ea9fd9dc76c15a537bf759184575487dd1a76eb80ac2c1c825ab9372fbdf2fc890f8be33cfb6e01f3e2dc6a94e43d8a6045642acbdb36fb828c9f856fd9952a060b2638759d508c5ed6dd51026f8bcd033696a22417f494e1db8f3907e815aa54f5c1071adf54b9fd84b1ee2aa81ebfa3595bca0a5d9a6bdfb59112ee755d1e72a32da163b5fae374f7b7eeb69b3644f90989d3adf3e935cdfb926dfa51f85694d7d320817109fc9f8da3c7b559a044495d3d9b8accb53059eb4a17c96cf737cc4d3123c6bf18dd85621b426995e9f1ae0388713c7d510ffbd2eff988fdb845a63ece2277e8476a7e0acb942d93560040f86695d51b6a45c8bea1dc89d9bd602b28e8052084227ff7fae77e331c4c17b8a200064186e6f75f35b90803452ba6bc6aef731d9d14bfb3322e6192552c2b7b051328f39af9c0cc84374591eae313e83b1d66fcc543a9c8c11a5dfc3a1f320865d2e7a10871d6f3bc9da4935a820f5bc817b9dd98763416ee02e791a0ecf0b42b2c8aa496dcf312097ced81fab81ed96067ca83aba1b7802990c3175d6d30d5d9996be87f0b812fd28e6338067d38501c7e4e43977b2c452c89ea2a09bb0859c26488dfa370ad86cc7488f54e2e722b4dd929622f094dff8e75422c2b4f4f442dd46d9110468136bcc973131c077a8198ccc24a7496dbe3142dc68e09c7566a665620d57c5b7a16df7870171221e7287cdd7ecc374d540f6&cri=NldDzJV5MW&ts=691&cb=1773469241130
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
50.16.211.97 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-50-16-211-97.compute-1.amazonaws.com
Software
/
Resource Hash
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

expires
Fri, 01 Jan 1990 00:00:00 GMT
cache-control
no-cache, no-store, must-revalidate
content-length
43
date
Sat, 14 Mar 2026 06:20:41 GMT
pragma
no-cache
content-type
image/gif
ebc2147d-27c2-46b5-85f6-1c56ce39c897
https://www.cyberark.com/ 		0
0
08773fb052a2034353e4744495485b88.js
nexus.ensighten.com/choozle/14963/code/ 		673 B
1 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/choozle/14963/code/08773fb052a2034353e4744495485b88.js?conditionId0=4910939
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/choozle/14963/Bootstrap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
108.138.26.44 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-108-138-26-44.fra56.r.cloudfront.net
Software
CloudFront /
Resource Hash
60f515991307abd345708ae3d50ff9a7751c68c208e2586d992c3c6ff729d6b0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

etag
"314ad2369d67fe2807f627dbfdcbf52d"
age
10438888
x-amz-version-id
kpkF4PXL.K8vMpkqxwzwd03dNtjBok8N
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
x-amz-cf-id
P0V_Z2GdzL0htBnLgZgf2eA28mygoPn5qdS8nHmQZgCkjKSRKmVEow==
date
Thu, 13 Nov 2025 10:39:14 GMT
content-type
application/javascript; charset=utf-8
last-modified
Sat, 28 Oct 2023 14:30:41 GMT
vary
Origin
x-amz-replication-status
COMPLETED
cache-control
max-age=315360000
via
1.1 8109fadbc132b410ecc2c3df250d6144.cloudfront.net (CloudFront)
accept-ranges
bytes
content-length
673
x-amz-cf-pop
FRA56-P7
server
CloudFront
x-amz-server-side-encryption
AES256
d3d14424fac71699bdbff068d9b1184b.js
nexus.ensighten.com/choozle/14963/code/ 		2 KB
796 B 		Script
General
Check archive.org
Download Go to
Full URL
https://nexus.ensighten.com/choozle/14963/code/d3d14424fac71699bdbff068d9b1184b.js?conditionId0=421905
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/choozle/14963/Bootstrap.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
108.138.26.44 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-108-138-26-44.fra56.r.cloudfront.net
Software
CloudFront /
Resource Hash
e80cfc6df2f882813f88dcf1175bc0c47e13c0cd8517bc240a65ee6cc758b0f2

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

content-encoding
br
x-amz-version-id
ffPQ1iXE0NqYZgujQn.J5knMjbGtNIPl
age
30036982
etag
W/"e8e93310d35a9462151b8fdab5b436ce"
alt-svc
h3=":443"; ma=86400
x-cache
Hit from cloudfront
x-amz-cf-id
e7gKQsik5dndeITHcjW_OnHfH1PKg_rZ-9KXCvspuJ20q7rPjzUZgg==
date
Mon, 31 Mar 2025 14:44:20 GMT
content-type
application/javascript; charset=utf-8
vary
accept-encoding, Origin
last-modified
Sat, 28 Oct 2023 14:30:45 GMT
x-amz-replication-status
COMPLETED
cache-control
max-age=315360000
via
1.1 8109fadbc132b410ecc2c3df250d6144.cloudfront.net (CloudFront)
x-amz-cf-pop
FRA56-P7
server
CloudFront
x-amz-server-side-encryption
AES256
sa.css
tags.srv.stackadapt.com/ 		65 B
203 B 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://tags.srv.stackadapt.com/sa.css
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.229.217.25 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-229-217-25.compute-1.amazonaws.com
Software
/
Resource Hash
c538c77bed3f827d27f063946bef7de87ec446e9731a654687cb553d7b954cb7

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

access-control-allow-origin
*
cache-control
only-if-cached, no-transform, private, max-age=7776000
content-length
65
date
Sat, 14 Mar 2026 06:20:41 GMT
content-type
text/css
sa.jpeg
tags.srv.stackadapt.com/ 		0
2 KB 		Fetch
General
Check archive.org
Download Go to
Full URL
https://tags.srv.stackadapt.com/sa.jpeg
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.229.217.25 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-229-217-25.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

access-control-allow-origin
https://www.cyberark.com
cache-control
only-if-cached, no-transform, private, max-age=7776000
content-length
651
date
Sat, 14 Mar 2026 06:20:41 GMT
content-type
image/jpeg
/
www.google.com/pagead/1p-user-list/1071691665/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/1071691665/?random=1773469240725&cv=11&fst=1773468000000&bg=ffffff&guid=ON&async=1&gtm=45be63b1v898648185z872025662za20gzb72025662zd72025662xea&gcd=13l3l3l3l1l1&dma=0&tag_exp=103116026~103200004~115616986~115938465~115938469~116024733~117484252&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fgolden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps&frm=0&tiba=Golden%20SAML%3A%20Newly%20Discovered%20Attack%20Technique%20Forges%20Authentication%20to%20Cloud%20Apps&hn=www.googleadservices.com&npa=0&pscdl=noapi&auid=314487143.1773469241&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_tu=CA&rfmt=3&fmt=3&is_vtc=1&cid=CAQSsQEA56J1eWD71LBMYnjfRao4AngY7ymeolPpIRClLcDB2d1Oucahfm33COfN_tdq6zMeVXDKAiBk2eglmT_uPj95J0rBqG4GiI3LtVzTRAiAfFGbRfJZaF1pcchDSA2AeggYgHZxm9yhI9_7zwl0LhM6UEFwG-cGbCSVoSYj6MgArw1vB-j2GGxWBk-frMznXBNLrZNHD0EgY875LY5TRrqF-R4YbHnRxyPeg5cDUksNaxg&random=2265512493&rmt_tld=0&ipr=y
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.151.119 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

content-security-policy
script-src 'none'; object-src 'none'
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
42
date
Sat, 14 Mar 2026 06:20:41 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
/
www.google.co.il/pagead/1p-user-list/1071691665/ 		42 B
455 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.co.il/pagead/1p-user-list/1071691665/?random=1773469240725&cv=11&fst=1773468000000&bg=ffffff&guid=ON&async=1&gtm=45be63b1v898648185z872025662za20gzb72025662zd72025662xea&gcd=13l3l3l3l1l1&dma=0&tag_exp=103116026~103200004~115616986~115938465~115938469~116024733~117484252&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fgolden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps&frm=0&tiba=Golden%20SAML%3A%20Newly%20Discovered%20Attack%20Technique%20Forges%20Authentication%20to%20Cloud%20Apps&hn=www.googleadservices.com&npa=0&pscdl=noapi&auid=314487143.1773469241&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&_tu=CA&rfmt=3&fmt=3&is_vtc=1&cid=CAQSsQEA56J1eWD71LBMYnjfRao4AngY7ymeolPpIRClLcDB2d1Oucahfm33COfN_tdq6zMeVXDKAiBk2eglmT_uPj95J0rBqG4GiI3LtVzTRAiAfFGbRfJZaF1pcchDSA2AeggYgHZxm9yhI9_7zwl0LhM6UEFwG-cGbCSVoSYj6MgArw1vB-j2GGxWBk-frMznXBNLrZNHD0EgY875LY5TRrqF-R4YbHnRxyPeg5cDUksNaxg&random=2265512493&rmt_tld=1&ipr=y
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.195 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
tzfraa-at-in-f3.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

content-security-policy
script-src 'none'; object-src 'none'
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
42
date
Sat, 14 Mar 2026 06:20:41 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
/
www.facebook.com/tr/ 		0
19 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/tr/?id=286320195733404&ev=PageView&dl=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fgolden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps&rl=&if=false&ts=1773469241379&sw=1600&sh=1200&v=2.9.277&r=stable&ec=0&o=4126&fbp=fb.1.1773469241375.498538576211186309&cs_est=true&ler=empty&cdl=API_unavailable&pmd[title]=Golden%20SAML%3A%20Newly%20Discovered%20Attack%20Technique%20Forges%20Authentication%20to%20Cloud%20Apps&pmd[locale]=en&pmd[description]=In%20this%20blog%20post%2C%20we%20introduce%20a%20new%20attack%20vector%20discovered%20by%20CyberArk%20Labs%20and%20dubbed%20%E2%80%9Cgolden%20SAML.%E2%80%9D%20The%20vector%20enables%20an%20attacker%20to%20create%20a%20golden%20SAML%2C%20which%20is%20basically%20a%20forged%20SAML...&plt=2013.9000000953674&it=1773469241054&coo=false&expv2[0]=pl1&expv2[1]=el2&expv2[2]=bc1&expv2[3]=ra2&expv2[4]=rp2&expv2[5]=ct3&expv2[6]=hf0&rqm=GET
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
57.144.244.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
edge-star-mini-shv-01-fra5.facebook.com
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
x-fb-connection-quality
GOOD; q=0.7, rtt=141, rtx=0, c=24, mss=1232, tbw=8495, tp=13, tpl=0, uplat=0, ullat=0
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
access-control-allow-origin
alt-svc
h3=":443"; ma=86400
content-length
0
date
Sat, 14 Mar 2026 06:20:41 GMT
content-type
text/plain
server
proxygen-bolt
priority
u=1,i
/
www.facebook.com/privacy_sandbox/pixel/register/trigger/ 		67 B
199 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.facebook.com/privacy_sandbox/pixel/register/trigger/?id=286320195733404&ev=PageView&dl=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fgolden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps&rl=&if=false&ts=1773469241379&sw=1600&sh=1200&v=2.9.277&r=stable&ec=0&o=4126&fbp=fb.1.1773469241375.498538576211186309&cs_est=true&ler=empty&cdl=API_unavailable&pmd[title]=Golden%20SAML%3A%20Newly%20Discovered%20Attack%20Technique%20Forges%20Authentication%20to%20Cloud%20Apps&pmd[locale]=en&pmd[description]=In%20this%20blog%20post%2C%20we%20introduce%20a%20new%20attack%20vector%20discovered%20by%20CyberArk%20Labs%20and%20dubbed%20%E2%80%9Cgolden%20SAML.%E2%80%9D%20The%20vector%20enables%20an%20attacker%20to%20create%20a%20golden%20SAML%2C%20which%20is%20basically%20a%20forged%20SAML...&plt=2013.9000000953674&it=1773469241054&coo=false&expv2[0]=pl1&expv2[1]=el2&expv2[2]=bc1&expv2[3]=ra2&expv2[4]=rp2&expv2[5]=ct3&expv2[6]=hf0&rqm=FGET
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
57.144.244.1 Frankfurt am Main, Germany, ASN32934 (FACEBOOK - Facebook, Inc., US),
Reverse DNS
edge-star-mini-shv-01-fra5.facebook.com
Software
/
Resource Hash
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
Security Headers
Name Value
Content-Security-Policy default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'nonce-2VEWMnXY' blob: 'self' connect.facebook.net 'wasm-unsafe-eval' https://accounts.google.com https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://accounts.google.com https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com *.instagram.com https://accounts.google.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net accounts.meta.com *.accounts.meta.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
Strict-Transport-Security max-age=15552000; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

content-encoding
zstd
report-to
{"max_age":2592000,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/coop\/?minimize=0"}],"group":"coop_report","include_subdomains":true}, {"max_age":259200,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/?device_level=unknown&brsid=7616992391320149394&cpp=C3&cv=1035176028&st=1773469241657"}]}, {"max_age":21600,"endpoints":[{"url":"https:\/\/www.facebook.com\/ajax\/browser_error_reports\/"}],"group":"permissions_policy"}
x-content-type-options
nosniff
expires
Sat, 01 Jan 2000 00:00:00 GMT
alt-svc
h3=":443"; ma=86400
attribution-reporting-register-trigger
{"event_trigger_data":[{"trigger_data":"0"}],"aggregatable_trigger_data":[],"aggregatable_values":{},"aggregatable_source_registration_time":"exclude","filters":{"3":["9642035825907957"]},"debug_reporting":true,"debug_key":"642717178019926713"}
date
Sat, 14 Mar 2026 06:20:41 GMT
content-type
image/png
vary
Accept-Encoding
x-fb-debug
irA0Ct1vr4hhTz2+mxzOX0kMldPMs426EJx/jB9l+NlGeKyzU5e8khtukeGOH6SHVW5MMRgZjqkmEjzMbk5DdA==
priority
u=3,i
x-frame-options
DENY
strict-transport-security
max-age=15552000; preload
reporting-endpoints
coop_report="https://www.facebook.com/browser_reporting/coop/?minimize=0", default="https://www.facebook.com/ajax/browser_error_reports/?device_level=unknown&brsid=7616992391320149394&cpp=C3&cv=1035176028&st=1773469241657", permissions_policy="https://www.facebook.com/ajax/browser_error_reports/"
content-security-policy
default-src blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;script-src *.facebook.com *.fbcdn.net *.facebook.net 127.0.0.1:* 'nonce-2VEWMnXY' blob: 'self' connect.facebook.net 'wasm-unsafe-eval' https://accounts.google.com https://*.google-analytics.com *.google.com;style-src *.fbcdn.net data: *.facebook.com 'unsafe-inline' https://accounts.google.com https://fonts.googleapis.com;connect-src *.facebook.com facebook.com *.fbcdn.net *.facebook.net wss://*.facebook.com:* wss://*.whatsapp.com:* wss://*.fbcdn.net attachment.fbsbx.com ws://localhost:* blob: *.cdninstagram.com 'self' http://localhost:3103 wss://gateway.facebook.com wss://edge-chat.facebook.com wss://snaptu-d.facebook.com wss://kaios-d.facebook.com/ v.whatsapp.net *.fbsbx.com *.fb.com *.instagram.com https://accounts.google.com https://*.google-analytics.com;font-src data: *.facebook.com *.fbcdn.net *.fbsbx.com https://fonts.gstatic.com;img-src *.fbcdn.net *.facebook.com data: https://*.fbsbx.com facebook.com *.cdninstagram.com fbsbx.com fbcdn.net connect.facebook.net blob: android-webview-video-poster: *.whatsapp.net *.fb.com *.oculuscdn.com *.tenor.co *.tenor.com *.giphy.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://*.google-analytics.com;media-src *.cdninstagram.com blob: *.fbcdn.net *.fbsbx.com www.facebook.com *.facebook.com data: *.tenor.co *.tenor.com https://*.giphy.com;child-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;frame-src *.facebook.com *.fbsbx.com fbsbx.com data: www.instagram.com *.fbcdn.net accounts.meta.com *.accounts.meta.com https://trustly.one/ https://*.trustly.one/ https://paywithmybank.com/ https://*.paywithmybank.com/ https://www.googleadservices.com https://googleads.g.doubleclick.net https://www.google.com https://td.doubleclick.net *.google.com *.doubleclick.net;manifest-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;object-src data: blob: 'self' https://*.fbsbx.com *.facebook.com *.fbcdn.net;worker-src blob: *.facebook.com data:;block-all-mixed-content;upgrade-insecure-requests;
cache-control
private, no-store, no-cache, must-revalidate
x-fb-connection-quality
GOOD; q=0.7, rtt=141, rtx=0, c=27, mss=1232, tbw=9315, tp=21, tpl=0, uplat=224, ullat=0
cross-origin-opener-policy
same-origin-allow-popups
pragma
no-cache
cross-origin-resource-policy
cross-origin
permissions-policy
accelerometer=(), attribution-reporting=(self), autoplay=(), bluetooth=(), browsing-topics=(self), camera=(self "https://www.fbsbx.com"), ch-device-memory=(), ch-downlink=(), ch-dpr=(), ch-ect=(), ch-rtt=(), ch-save-data=(), ch-ua-arch=(), ch-ua-bitness=(), ch-viewport-height=(), ch-viewport-width=(), ch-width=(), clipboard-read=(self), clipboard-write=(self), compute-pressure=(), display-capture=(self), encrypted-media=(self), fullscreen=(self), gamepad=*, geolocation=(self), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(self), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(self), midi=(), otp-credentials=(), payment=(), picture-in-picture=(self), private-state-token-issuance=(), publickey-credentials-get=(self), screen-wake-lock=(), serial=(), shared-storage=(), shared-storage-select-url=(), private-state-token-redemption=(), usb=(), unload=(self), window-management=(), xr-spatial-tracking=(self);report-to="permissions_policy"
document-policy
force-load-at-top, include-js-call-stacks-in-crash-reports
x-xss-protection
0
origin-agent-cluster
?1
jquery-ui-insightera-custom-1.9.6.css
rtp-static.marketo.com/rtp/libs/ 		23 KB
4 KB 		Stylesheet
General
Check archive.org
Download Go to
Full URL
https://rtp-static.marketo.com/rtp/libs/jquery-ui-insightera-custom-1.9.6.css
Requested by
Host: sjrtp6-cdn.marketo.com
URL: https://sjrtp6-cdn.marketo.com/rtp-api/v1/rtp.js?aid=cyberarksoftware
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.102.33.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-102-33-245.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
143a1ee63c9fe87791cde6209d3716bf432ede02fc23ecbd064edfe1cc02bca9

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

Access-Control-Allow-Headers
*
Access-Control-Max-Age
86400
Content-Encoding
gzip
ETag
"c89c0f4cc3c0f0f2bd846508a3cd504c:1715749730.923559"
Connection
keep-alive
Access-Control-Allow-Credentials
false
Access-Control-Allow-Methods
GET
Accept-Ranges
bytes
Access-Control-Allow-Origin
*
Content-Length
3762
Date
Sat, 14 Mar 2026 06:20:41 GMT
Content-Type
text/css
Last-Modified
Wed, 15 May 2024 05:08:51 GMT
Server
AkamaiNetStorage
Vary
Accept-Encoding
trw
sjrtp6.marketo.com/gw1/ 		208 B
652 B 		Script
General
Check archive.org
Download Go to
Full URL
https://sjrtp6.marketo.com/gw1/trw?aid=cyberarksoftware&trwv.uid=cyberarksoftware-1773469241389-99881024&trwv.vc=1&trwsa.sid=cyberarksoftware-1773469241390-0aa249d6&trwsb.cpv=1&ctzo=+02:00&uri=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fgolden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps&ma=id%3A316-CZP-275%26token%3A_mch-cyberark.com-54f3d736a7be1eb78939b03286739e4d&pm=&viewedTypes=&rts=1773469241391
Requested by
Host: sjrtp6-cdn.marketo.com
URL: https://sjrtp6-cdn.marketo.com/rtp-api/v1/rtp.js?aid=cyberarksoftware
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.28.164.244 , United States, ASN15224 (OMNITURE - Adobe Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
f3b44481b288f30a9b8c98cad80b00e0c01930bf8ad573c8e71990ed42076bfb

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

Cache-Control
no-cache
Content-Length
208
Keep-Alive
timeout=2
Date
Sat, 14 Mar 2026 06:20:42 GMT
Content-Type
application/x-javascript;charset=utf-8
Server
nginx
Connection
keep-alive
ga-integration-2.0.5.js
rtp-static.marketo.com/rtp/libs/ 		18 KB
6 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rtp-static.marketo.com/rtp/libs/ga-integration-2.0.5.js
Requested by
Host: sjrtp6-cdn.marketo.com
URL: https://sjrtp6-cdn.marketo.com/rtp-api/v1/rtp.js?aid=cyberarksoftware
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.102.33.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-102-33-245.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
bf6806d8c92e228249230195772afe2e68791d52763b782be9aa2855fab3b641

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

Access-Control-Allow-Headers
*
Access-Control-Max-Age
86400
Content-Encoding
gzip
ETag
"18a7b0f60655900c0010a35d07b9da0f:1686816053.163727"
Connection
keep-alive
Access-Control-Allow-Credentials
false
Access-Control-Allow-Methods
GET
Accept-Ranges
bytes
Access-Control-Allow-Origin
*
Content-Length
5654
Date
Sat, 14 Mar 2026 06:20:41 GMT
Content-Type
application/x-javascript
Last-Modified
Thu, 15 Jun 2023 08:00:53 GMT
Server
AkamaiNetStorage
Vary
Accept-Encoding
msg
sjrtp6.marketo.com/gw1/ 		0
433 B 		Script
General
Check archive.org
Download Go to
Full URL
https://sjrtp6.marketo.com/gw1/msg?a=2&sid=cyberarksoftware-1773469241390-0aa249d6&aid=cyberarksoftware&ma=id%3A316-CZP-275%26token%3A_mch-cyberark.com-54f3d736a7be1eb78939b03286739e4d&viewedTypes=&0.7039138244436657&rts=1773469241612
Requested by
Host: sjrtp6-cdn.marketo.com
URL: https://sjrtp6-cdn.marketo.com/rtp-api/v1/rtp.js?aid=cyberarksoftware
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.28.164.244 , United States, ASN15224 (OMNITURE - Adobe Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

Cache-Control
no-cache
Content-Length
0
Keep-Alive
timeout=2
Date
Sat, 14 Mar 2026 06:20:42 GMT
Content-Type
text/javascript;charset=utf-8
Server
nginx
Connection
keep-alive
iframe
d1eoo1tco6rr5e.cloudfront.net/0v1kpom/u9beit9/ Frame 8274
Redirect Chain
  • https://insight.adsrvr.org/tags/0v1kpom/u9beit9/iframe
  • https://d1eoo1tco6rr5e.cloudfront.net/0v1kpom/u9beit9/iframe
138 B
669 B 		Document
General
Check archive.org
Download Go to
Full URL
https://d1eoo1tco6rr5e.cloudfront.net/0v1kpom/u9beit9/iframe
Requested by
Host: nexus.ensighten.com
URL: https://nexus.ensighten.com/choozle/14963/code/08773fb052a2034353e4744495485b88.js?conditionId0=4910939
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
65.8.101.109 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-65-8-101-109.fra60.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
93e2856e540b7faf4767d1291492324c43994be69562b8d1d9be07de8e2e40e4

Request headers

Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36

Response headers

Accept-Ranges
bytes
Age
14994
Cache-Control
max-age=86400
Connection
keep-alive
Content-Length
138
Content-Type
text/html
Date
Sat, 14 Mar 2026 02:18:19 GMT
ETag
"d45046dc61fcd53aaf217c2c9496ec77"
Last-Modified
Fri, 01 Oct 2021 23:43:18 GMT
Server
AmazonS3
Via
1.1 4d4680d03dbc233f4f8d4e3d75985c84.cloudfront.net (CloudFront)
X-Amz-Cf-Id
5-Xbp0EUeTWpqV8LnqZRI9ysxEemBD32A66cYRBrZjb-Vaxpa5D-QQ==
X-Amz-Cf-Pop
FRA60-P13
X-Cache
Hit from cloudfront
x-amz-server-side-encryption
AES256

Redirect headers

content-length
0
date
Sat, 14 Mar 2026 06:20:41 GMT
location
https://d1eoo1tco6rr5e.cloudfront.net/0v1kpom/u9beit9/iframe
/
www.google.co.il/pagead/1p-conversion/1071691665/
Redirect Chain
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1071691665/?random=319567778&cv=11&fst=1773469241120&bg=ffffff&guid=ON&async=1&en=conversion&gtm=45be63b1v898648185za20gzb72025662zd...
  • https://www.google.com/pagead/1p-conversion/1071691665/?random=319567778&cv=11&fst=1773469241120&bg=ffffff&guid=ON&async=1&en=conversion&gtm=45be63b1v898648185za20gzb72025662zd72025662xec&gcd=13l3l...
  • https://www.google.co.il/pagead/1p-conversion/1071691665/?random=319567778&cv=11&fst=1773469241120&bg=ffffff&guid=ON&async=1&en=conversion&gtm=45be63b1v898648185za20gzb72025662zd72025662xec&gcd=13l...
0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://www.google.co.il/pagead/1p-conversion/1071691665/?random=319567778&cv=11&fst=1773469241120&bg=ffffff&guid=ON&async=1&en=conversion&gtm=45be63b1v898648185za20gzb72025662zd72025662xec&gcd=13l3l3l3l1l1&dma=0&tag_exp=103116026~103200004~115616986~115938465~115938469~116024733~117484252&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fgolden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps&label=H8zfCNSYxvwYEJHvgv8D&capi=1&gtm_ee=1&frm=0&tiba=Golden%20SAML%3A%20Newly%20Discovered%20Attack%20Technique%20Forges%20Authentication%20to%20Cloud%20Apps&hn=www.googleadservices.com&npa=0&pscdl=noapi&auid=314487143.1773469241&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&gcl_ctr=1~0~0&data=event%3Dconversion&category=acrcp_v1_512&fmt=8&ct_cookie_present=false&crd=CLTesQII8t-xAgihuLECCLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgi0xrECCJPasQII29yxAgiH27ECCNPFsQII68yxAgjtzrECCNXPsQII9NqxAgiX1LECCMnbsQIIseGxAgiz4bECCKbdsQIIsN6xAkoZdHJpZ2dlcj1uYXZpZ2F0aW9uLXNvdXJjZVoDCgEBYgMKAQM&cerd=CgSI3b0t&fsk=ChEI8OvOzQYQtqmjsqjx5qviARIsAF5ryEAiLqfbv0uZlTg44ufaUjvD4y3znC_yPv_ujLOzTpkpLiM86HBkozEaAsLZ&is_vtc=1&cid=CAQSvwEA56J1edkvIYUOw8djb3q22BrOule_0msAvcJbmDAd540dk1acYIdsz0U5PNQYE5zZQfM9Dc_K8hnVhwm9U6NRu2GHBXe4OHjaniD8TUTVesyKREAPVO8u15o6UM9RsH1ZAtDYG7z4ny4O2z77tVGq6wxgl70fRE8k7XriJRkQ-daGiI6q9F98R9ixk4yf9G3BV2h6vVbekNiqScAEp2vJakeU4DLP7kVzACDiFeQN9fc7p0jbN_ceAyuv6CPRkw&random=941399293&ipr=y&pscrd=IhMIjreZ4d-ekwMVrUYdCR3jbye-MgwIA2IICAAQABgAIAAyDAgEYggIABAAGAAgADIMCAdiCAgAEAAYACAAMgwICGIICAAQABgAIAAyDAgJYggIABAAGAAgADIMCApiCAgAEAAYACAAMgwIAmIICAAQABgAIAAyDAgLYggIABAAGAAgADIMCBViCAgAEAAYACAAMgwIH2IICAAQABgAIAAyDAgTYggIABAAGAAgADIMCBJiCAgAEAAYACAAOokBaHR0cHM6Ly93d3cuY3liZXJhcmsuY29tL3Jlc291cmNlcy90aHJlYXQtcmVzZWFyY2gtYmxvZy9nb2xkZW4tc2FtbC1uZXdseS1kaXNjb3ZlcmVkLWF0dGFjay10ZWNobmlxdWUtZm9yZ2VzLWF1dGhlbnRpY2F0aW9uLXRvLWNsb3VkLWFwcHNCVkNoQUk4T3ZPelFZUWg2Ymd4WWVSbkxnUkVpd0FRV3Z6a1RiUkRBTWVCZnBJQnZia1lqb3FoS3Nsdi1FeTlHNzBOYVlHVkhNZ3JLZFhxOU1OV2NlVjd3egwICWIICAAQABgAIACCAQVwAYgBAQ
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H2
Server
172.217.16.195 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
tzfraa-at-in-f3.1e100.net
Software
/
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

Redirect headers

content-security-policy
script-src 'none'; object-src 'none'
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
location
https://www.google.co.il/pagead/1p-conversion/1071691665/?random=319567778&cv=11&fst=1773469241120&bg=ffffff&guid=ON&async=1&en=conversion&gtm=45be63b1v898648185za20gzb72025662zd72025662xec&gcd=13l3l3l3l1l1&dma=0&tag_exp=103116026~103200004~115616986~115938465~115938469~116024733~117484252&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fgolden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps&label=H8zfCNSYxvwYEJHvgv8D&capi=1&gtm_ee=1&frm=0&tiba=Golden%20SAML%3A%20Newly%20Discovered%20Attack%20Technique%20Forges%20Authentication%20to%20Cloud%20Apps&hn=www.googleadservices.com&npa=0&pscdl=noapi&auid=314487143.1773469241&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&gcl_ctr=1~0~0&data=event%3Dconversion&category=acrcp_v1_512&fmt=8&ct_cookie_present=false&crd=CLTesQII8t-xAgihuLECCLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgi0xrECCJPasQII29yxAgiH27ECCNPFsQII68yxAgjtzrECCNXPsQII9NqxAgiX1LECCMnbsQIIseGxAgiz4bECCKbdsQIIsN6xAkoZdHJpZ2dlcj1uYXZpZ2F0aW9uLXNvdXJjZVoDCgEBYgMKAQM&cerd=CgSI3b0t&fsk=ChEI8OvOzQYQtqmjsqjx5qviARIsAF5ryEAiLqfbv0uZlTg44ufaUjvD4y3znC_yPv_ujLOzTpkpLiM86HBkozEaAsLZ&is_vtc=1&cid=CAQSvwEA56J1edkvIYUOw8djb3q22BrOule_0msAvcJbmDAd540dk1acYIdsz0U5PNQYE5zZQfM9Dc_K8hnVhwm9U6NRu2GHBXe4OHjaniD8TUTVesyKREAPVO8u15o6UM9RsH1ZAtDYG7z4ny4O2z77tVGq6wxgl70fRE8k7XriJRkQ-daGiI6q9F98R9ixk4yf9G3BV2h6vVbekNiqScAEp2vJakeU4DLP7kVzACDiFeQN9fc7p0jbN_ceAyuv6CPRkw&random=941399293&ipr=y&pscrd=IhMIjreZ4d-ekwMVrUYdCR3jbye-MgwIA2IICAAQABgAIAAyDAgEYggIABAAGAAgADIMCAdiCAgAEAAYACAAMgwICGIICAAQABgAIAAyDAgJYggIABAAGAAgADIMCApiCAgAEAAYACAAMgwIAmIICAAQABgAIAAyDAgLYggIABAAGAAgADIMCBViCAgAEAAYACAAMgwIH2IICAAQABgAIAAyDAgTYggIABAAGAAgADIMCBJiCAgAEAAYACAAOokBaHR0cHM6Ly93d3cuY3liZXJhcmsuY29tL3Jlc291cmNlcy90aHJlYXQtcmVzZWFyY2gtYmxvZy9nb2xkZW4tc2FtbC1uZXdseS1kaXNjb3ZlcmVkLWF0dGFjay10ZWNobmlxdWUtZm9yZ2VzLWF1dGhlbnRpY2F0aW9uLXRvLWNsb3VkLWFwcHNCVkNoQUk4T3ZPelFZUWg2Ymd4WWVSbkxnUkVpd0FRV3Z6a1RiUkRBTWVCZnBJQnZia1lqb3FoS3Nsdi1FeTlHNzBOYVlHVkhNZ3JLZFhxOU1OV2NlVjd3egwICWIICAAQABgAIACCAQVwAYgBAQ
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
0
date
Sat, 14 Mar 2026 06:20:41 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
cafe
index.php
a.dpmsrv.com/dpmpxl/ 		334 B
882 B 		Script
General
Check archive.org
Download Go to
Full URL
https://a.dpmsrv.com/dpmpxl/index.php?zn=&sn=&sessionId=&q=xImp&v=1.x&ep%5BaUid%5D=&ep%5BaSid%5D=&ep%5BaSidCustom%5D=1&ep%5BcCid%5D=&cl=1512&pixelIndex=0&r=293303&tzOffset=-120&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fgolden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps&pageTitle=Golden%20SAML%3A%20Newly%20Discovered%20Attack%20Technique%20Forges%20Authentication%20to%20Cloud%20Apps
Requested by
Host: s.dpmsrv.com
URL: https://s.dpmsrv.com/dpm_443233bf934850484d12f21d9603a36ee83d1dfb.min.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.211.70.183 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-211-70-183.compute-1.amazonaws.com
Software
/
Resource Hash
3a0f91dd9c097e0720223eeddb1ff16cfa5206274e5531010f8ee0385314a54d

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

Access-Control-Max-Age
10
Cache-Control
no-cache, no-store, must-revalidate
content-encoding
gzip
Pragma
no-cache
Connection
keep-alive
Access-Control-Allow-Methods
GET, POST, PUT, DELETE, OPTIONS
Expires
0
Access-Control-Allow-Origin
*
P3P
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
Content-Length
259
Content-Type
text/javascript
Access-Control-Allow-Headers
content-type, accept
/
www.google.com/pagead/1p-user-list/1071691665/ 		42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.com/pagead/1p-user-list/1071691665/?random=1773469241112&cv=11&fst=1773468000000&bg=ffffff&guid=ON&async=1&en=gtag.config&gtm=45be63b1v898648185za20gzb72025662zd72025662xec&gcd=13l3l3l3l1l1&dma=0&tag_exp=103116026~103200004~115616986~115938465~115938469~116024733~117484252&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fgolden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps&frm=0&tiba=Golden%20SAML%3A%20Newly%20Discovered%20Attack%20Technique%20Forges%20Authentication%20to%20Cloud%20Apps&hn=www.googleadservices.com&npa=0&pscdl=noapi&auid=314487143.1773469241&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSvwEA56J1eYVMb2kT9qSuILNYVRRQu5kQSWZ5XlRsTRSGYpNrtWtVxtHprzSy2auz2kKMyaQwZunN71y12gcgbmKJw5eilWs09Zy5Rte25lI3zRBUxdpJFxeK6vCKXGRFj_ptnh5SeepSd-AlLJgg4jcbOz4nMy3ih2Nbqp9ruiolZElfMS7xg4IbK-LQnSvP7esdtVNBV88VbuEjfwbdqlf3jHSUkj2BRdnN-ZLQkYYYxrt3IGmiYxjTM8-wG65hZQ&random=1331853395&rmt_tld=0&ipr=y
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.151.119 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

content-security-policy
script-src 'none'; object-src 'none'
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
42
date
Sat, 14 Mar 2026 06:20:41 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
/
www.google.co.il/pagead/1p-user-list/1071691665/ 		42 B
108 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.co.il/pagead/1p-user-list/1071691665/?random=1773469241112&cv=11&fst=1773468000000&bg=ffffff&guid=ON&async=1&en=gtag.config&gtm=45be63b1v898648185za20gzb72025662zd72025662xec&gcd=13l3l3l3l1l1&dma=0&tag_exp=103116026~103200004~115616986~115938465~115938469~116024733~117484252&u_w=1600&u_h=1200&url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fgolden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps&frm=0&tiba=Golden%20SAML%3A%20Newly%20Discovered%20Attack%20Technique%20Forges%20Authentication%20to%20Cloud%20Apps&hn=www.googleadservices.com&npa=0&pscdl=noapi&auid=314487143.1773469241&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&data=event%3Dgtag.config&rfmt=3&fmt=3&is_vtc=1&cid=CAQSvwEA56J1eYVMb2kT9qSuILNYVRRQu5kQSWZ5XlRsTRSGYpNrtWtVxtHprzSy2auz2kKMyaQwZunN71y12gcgbmKJw5eilWs09Zy5Rte25lI3zRBUxdpJFxeK6vCKXGRFj_ptnh5SeepSd-AlLJgg4jcbOz4nMy3ih2Nbqp9ruiolZElfMS7xg4IbK-LQnSvP7esdtVNBV88VbuEjfwbdqlf3jHSUkj2BRdnN-ZLQkYYYxrt3IGmiYxjTM8-wG65hZQ&random=1331853395&rmt_tld=1&ipr=y
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.16.195 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
tzfraa-at-in-f3.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

content-security-policy
script-src 'none'; object-src 'none'
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
42
date
Sat, 14 Mar 2026 06:20:41 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
sync
s.company-target.com/s/ Frame C876 		634 B
1018 B 		Document
General
Check archive.org
Download Go to
Full URL
https://s.company-target.com/s/sync?exc=lr
Requested by
Host: tag.demandbase.com
URL: https://tag.demandbase.com/5bf349c2ca21d6be.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.96.71.22 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
22.71.96.34.bc.googleusercontent.com
Software
/
Resource Hash
5fe1275aa22d6ef48e4b611897febe201800c7ee3e97f54d46c689345b2b2ef6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36

Response headers

access-control-allow-methods
GET,OPTIONS
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
634
content-type
text/html; charset=UTF-8
date
Sat, 14 Mar 2026 06:20:41 GMT
strict-transport-security
max-age=31536000; includeSubDomains; preload
via
1.1 google
464526.gif
id.rlcdn.com/ 		0
0
ip.json
api.company-target.com/api/v3/ 		454 B
944 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.company-target.com/api/v3/ip.json?referrer=&page=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fgolden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps&page_title=Golden%20SAML%3A%20Newly%20Discovered%20Attack%20Technique%20Forges%20Authentication%20to%20Cloud%20Apps
Requested by
Host: tag.demandbase.com
URL: https://tag.demandbase.com/5bf349c2ca21d6be.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.102.85 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-66-102-85.fra56.r.cloudfront.net
Software
/
Resource Hash
85e5fdd9b37a2574d8c76a46faecb5504b2d528026d4be3d4ff58ad773995f5b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
access-control-expose-headers
x-amz-cf-id
access-control-allow-credentials
true
via
1.1 e9101023ffbe04130b9d4cac0cf9eebc.cloudfront.net (CloudFront)
access-control-allow-origin
https://www.cyberark.com
x-cache
Miss from cloudfront
content-length
454
x-amz-cf-id
VfBhDOt_JXU5dmBqI39x7xogARF9-A687ehRPlQzkgZ0dfvDTrCWHQ==
date
Sat, 14 Mar 2026 06:20:42 GMT
content-type
application/json; charset=utf-8
x-amz-cf-pop
FRA56-P2
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
ip.json
api.company-target.com/api/v3/ 		12 B
489 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://api.company-target.com/api/v3/ip.json?referrer=&page=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fgolden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps&page_title=Golden%20SAML%3A%20Newly%20Discovered%20Attack%20Technique%20Forges%20Authentication%20to%20Cloud%20Apps
Requested by
Host: tag.demandbase.com
URL: https://tag.demandbase.com/5bf349c2ca21d6be.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.102.85 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-66-102-85.fra56.r.cloudfront.net
Software
/
Resource Hash
d089c8a9fc28e4e50223eb38c9409e362521be9380a37341304fbac7a4cd9e5f
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
access-control-expose-headers
x-amz-cf-id
access-control-allow-credentials
true
via
1.1 e9101023ffbe04130b9d4cac0cf9eebc.cloudfront.net (CloudFront)
access-control-allow-origin
https://www.cyberark.com
x-cache
Error from cloudfront
content-length
12
x-amz-cf-id
fc8Si5G8_kNJnq3z29eD6Sn_9qESoIwxNnYCw8yx8fHgmtMIKHeiKQ==
date
Sat, 14 Mar 2026 06:20:42 GMT
content-type
text/plain
x-amz-cf-pop
FRA56-P2
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
get
consent.trustarc.com/ 		242 KB
106 KB 		Font
General
Check archive.org
Download Go to
Full URL
https://consent.trustarc.com/get?name=SourceSansPro-Regular.ttf
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.122.78 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-66-122-78.fra60.r.cloudfront.net
Software
/
Resource Hash
e0acaced3f5686390c4c2ed8d3b447c725660252d1a20a71fdab5110a435c463
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Origin
https://www.cyberark.com
Referer
https://www.cyberark.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
cache-control
max-age=2592000
access-control-expose-headers
*
content-encoding
gzip
pragma
public
age
3162
via
1.1 935770605c74a80712059ba5b24d4162.cloudfront.net (CloudFront)
access-control-allow-origin
*
x-cache
Hit from cloudfront
content-length
108305
x-amz-cf-id
7tQASX8p4czieo14xZNUkTbUvMiYI6Mp0Zz4F20GrMupEHldBiDUKg==
date
Sat, 14 Mar 2026 05:27:59 GMT
content-type
font/ttf
vary
Accept-Encoding
x-amz-cf-pop
FRA60-P2
analytics
consent.trustarc.com/ 		43 B
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://consent.trustarc.com/analytics?action=1&domain=cyberark.com&implied=1&session=87aa5fbc318c44f58a05afc58d3311a8&new=1&referer=https://www.cyberark.com
Requested by
Host: consent.trustarc.com
URL: https://consent.trustarc.com/asset/notice.js/v/v1.7-8297
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.122.78 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-66-122-78.fra60.r.cloudfront.net
Software
/
Resource Hash
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
access-control-expose-headers
*
pragma
no-cache
via
1.1 935770605c74a80712059ba5b24d4162.cloudfront.net (CloudFront)
expires
Mon, 26 Jul 1997 05:00:00 GMT
access-control-allow-origin
*
x-cache
Miss from cloudfront
content-length
43
x-amz-cf-id
NgxwU1EG3Wf4Iw2ja9JJ-LC9XI5kTyKpfTZYo4DtgMbF-prFHUGaAQ==
date
Sat, 14 Mar 2026 06:20:41 GMT
content-type
image/gif
x-amz-cf-pop
FRA60-P2
collect
www.google-analytics.com/j/ 		15 B
466 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j102&a=969219483&t=pageview&_s=1&dl=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fgolden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps&ul=he-il&dt=Golden%20SAML%3A%20Newly%20Discovered%20Attack%20Technique%20Forges%20Authentication%20to%20Cloud%20Apps&sr=1600x1200&vp=1600x1200&_u=YGBAgEABAAAAACAEK~&jid=1790804101&gjid=1952413412&cid=806338685.1773469242&tid=UA-44168172-9&_gid=666271079.1773469242&_slc=1&gtm=45He63b1n715SFWTHv72025662za200zd72025662&cd6=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fgolden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps&cd7=&gcd=13l3l3l3l1l1&dma=0&tag_exp=103116026~103200004~115938465~115938468~116024733~117484252&z=1477226091
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
172.217.168.78 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lcfraa-bk-in-f14.1e100.net
Software
Golfe2 /
Resource Hash
5cbd2c4ce1325baae0fa325bdd95a25a925b094d7e88fc6fcebb834a6906c5b4
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Content-Type
text/plain
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

report-to
{"group":"ascnsrsgac:207:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgac:207:0"}],}
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 14 Mar 2026 06:20:41 GMT
last-modified
Sun, 17 May 1998 03:00:00 GMT
content-type
text/plain
cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgac:207:0
access-control-allow-origin
https://www.cyberark.com
cross-origin-opener-policy-report-only
same-origin; report-to=ascnsrsgac:207:0
content-length
15
server
Golfe2
collect
stats.g.doubleclick.net/j/ 		1 B
651 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j102&tid=UA-44168172-9&cid=806338685.1773469242&jid=1790804101&gjid=1952413412&_gid=666271079.1773469242&_u=YGBAgEABAAAAAGAEK~&z=722910668
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.127.154 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lcfrai-in-f154.1e100.net
Software
Golfe2 /
Resource Hash
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Content-Type
text/plain
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

report-to
{"group":"ascnsrsgdc:143:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsgdc:143:0"}],}
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 14 Mar 2026 06:20:42 GMT
last-modified
Sun, 17 May 1998 03:00:00 GMT
content-type
text/plain
strict-transport-security
max-age=31536000; includeSubDomains; preload
cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsgdc:143:0
access-control-allow-origin
https://www.cyberark.com
cross-origin-opener-policy-report-only
same-origin; report-to=ascnsrsgdc:143:0
content-length
1
server
Golfe2
saq_pxl
tags.srv.stackadapt.com/ 		116 B
311 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tags.srv.stackadapt.com/saq_pxl?uid=jVuggUzL4Z1pNoK2f21A_Q&is_js=true&landing_url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fgolden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps&t=Golden%20SAML%3A%20Newly%20Discovered%20Attack%20Technique%20Forges%20Authentication%20to%20Cloud%20Apps&tip=xTNYc64YNfkMh9mmM7Py9363wqntZZhQA94ftO79mnM&host=https%3A%2F%2Fwww.cyberark.com&l_src=&l_src_d=&u_src=&u_src_d=&shop=false&sa-user-id-v3=s%253AAQAKINAbTgZlB4vQaXQZotPspsvy7wMqFcWwV2HT4l6RErkwENYBGAQgufzTzQYwAToEvry6bkIEnpTIkA.cmmdGVjVpIll%252BH0nnI70pwOnLmW5r%252F0Pu81HlJh%252B3xw&sa-user-id-v2=s%253A8JoJ2z9UX5NWFgQa_qoOLx-7TsI.US7EsDUNQid8fexZaE53AtPv1%252Fv%252BU%252FT36yFmsN0USLI&sa-user-id=s%253A0-f09a09db-3f54-5f93-5616-041afeaa0e2f.X4vsyPrwDlmrNSUWxLmvzY3r7PuDZcmx59XGDazHh5Q
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.229.217.25 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-229-217-25.compute-1.amazonaws.com
Software
/
Resource Hash
c7295f0f8c9fbfaeb021c7f80e61b2ebc9c3312995a17fb8ba238ce9068c9734

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

access-control-allow-methods
GET
access-control-allow-origin
https://www.cyberark.com
content-length
116
date
Sat, 14 Mar 2026 06:20:41 GMT
content-type
text/plain; charset=utf-8
access-control-allow-credentials
true
access-control-allow-headers
*
js
www.googletagmanager.com/gtag/ 		499 KB
162 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://www.googletagmanager.com/gtag/js?id=G-XTLTD7RKN5&cx=c&_slc=1
Requested by
Host: www.google-analytics.com
URL: https://www.google-analytics.com/analytics.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
142.251.141.104 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
tzfraa-ai-in-f8.1e100.net
Software
Google Tag Manager /
Resource Hash
ee294a3b30eca6f8d0ff28214cedcbb143beebc4cc038302afbdd799206b34fc
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

strict-transport-security
max-age=31536000; includeSubDomains
cache-control
private, max-age=900
content-encoding
zstd
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
expires
Sat, 14 Mar 2026 06:20:41 GMT
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
165839
date
Sat, 14 Mar 2026 06:20:41 GMT
x-xss-protection
0
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
server
Google Tag Manager
access-control-allow-headers
Cache-Control
rum
dsum-sec.casalemedia.com/ Frame C876
Redirect Chain
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=18&expiry=1789366841&external_user_id=e650fb5c-3b88-46ca-a587-b6bf604d5b33
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=18&expiry=1789366841&external_user_id=e650fb5c-3b88-46ca-a587-b6bf604d5b33&C=1
43 B
713 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=18&expiry=1789366841&external_user_id=e650fb5c-3b88-46ca-a587-b6bf604d5b33&C=1
Requested by
Host: s.company-target.com
URL: https://s.company-target.com/s/sync?exc=lr
Protocol
H3
Server
104.18.26.193 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer

Response headers

cache-control
no-cache
nel
{"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
cf-cache-status
DYNAMIC
pragma
no-cache
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=hfri9kylsaL%2FCIRIqW7Vld1ReP%2FbRUxcoMLymVQKAsFOiZsgXdePpZsA4VHOYs6WHAbMx0RdmXjFImpw7BmEutV5Y0%2BC4RZUEcfopvtznsk2laQNn33e"}]}
cf-ray
9dc12c8d395a7d9b-TLV
expires
0
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
content-length
43
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date
Sat, 14 Mar 2026 06:20:42 GMT
content-type
image/gif
server
cloudflare
priority
u=3,i

Redirect headers

cache-control
no-cache
location
/rum?cm_dsp_id=18&expiry=1789366841&external_user_id=e650fb5c-3b88-46ca-a587-b6bf604d5b33&C=1
cf-cache-status
DYNAMIC
pragma
no-cache
nel
{"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Uqs4JldKso1K%2Bwxkavn25cZ%2BSBlKyQetG5%2FHAh2IEKa8ZcYmdKh543D2jdhpE4Y5PM74HcLsYTGgWEh7V0Sjr5C91nGE0ngSNDvmmj8bGMRDpM%2B6qDKp"}]}
cf-ray
9dc12c8b88627d9b-TLV
expires
0
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
content-length
0
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date
Sat, 14 Mar 2026 06:20:42 GMT
server
cloudflare
priority
u=3,i
sync
partners.tremorhub.com/ Frame C876 		43 B
393 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://partners.tremorhub.com/sync?UIDM=e650fb5c-3b88-46ca-a587-b6bf604d5b33
Requested by
Host: s.company-target.com
URL: https://s.company-target.com/s/sync?exc=lr
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
34.225.5.229 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-34-225-5-229.compute-1.amazonaws.com
Software
nginx /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer

Response headers

p3p
CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date
Sat, 14 Mar 2026 06:20:42 GMT
content-type
image/gif
server
nginx
tap.php
pixel.rubiconproject.com/ Frame C876 		42 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?nid=5578&put=e650fb5c-3b88-46ca-a587-b6bf604d5b33&v=1181926
Requested by
Host: s.company-target.com
URL: https://s.company-target.com/s/sync?exc=lr
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_256_GCM
Server
69.173.144.165 , Germany, ASN26667 (RUBICONPROJECT - Magnite, Inc., US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer

Response headers

Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
169b98e0ba071daa3c67db5615efec3d
Pragma
no-cache
content-length
42
Content-Type
image/gif
bg9s
tag-logger.demandbase.com/ 		0
425 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tag-logger.demandbase.com/bg9s?x-amz-cf-id=VfBhDOt_JXU5dmBqI39x7xogARF9-A687ehRPlQzkgZ0dfvDTrCWHQ==&api-version=v3
Requested by
Host: tag.demandbase.com
URL: https://tag.demandbase.com/5bf349c2ca21d6be.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.173.205.94 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-173-205-94.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

x-amz-version-id
8SdDCdpJvGjkSiMFPv08XcVSgwOMVVmH
etag
"d41d8cd98f00b204e9800998ecf8427e"
age
71166
alt-svc
h3=":443"; ma=86400
x-cache
Error from cloudfront
x-amz-cf-id
yiylNp_P3d1E7Pat0ft3KK_1bSMS2D2CI85ZUz-g8iJdGATRzFuxwQ==
date
Fri, 13 Mar 2026 10:34:37 GMT
content-type
text/html
last-modified
Tue, 07 Mar 2023 20:47:02 GMT
via
1.1 4966f878e5166e8661305465727dd124.cloudfront.net (CloudFront)
accept-ranges
bytes
access-control-allow-origin
*
content-length
0
x-amz-cf-pop
FRA56-P12
server
AmazonS3
x-amz-server-side-encryption
AES256
mon
obs.segreencolumn.com/ 		0
148 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://obs.segreencolumn.com/mon
Requested by
Host: ob.segreencolumn.com
URL: https://ob.segreencolumn.com/i/84cf3062f98cbab994d639a975b2798e.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
50.16.211.97 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-50-16-211-97.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Content-Type
application/x-www-form-urlencoded
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

access-control-allow-origin
https://www.cyberark.com
content-length
0
date
Sat, 14 Mar 2026 06:20:42 GMT
content-type
application/json
access-control-allow-credentials
true
access-control-allow-methods
GET,HEAD,PUT,PATCH,POST,DELETE
mon
obs.segreencolumn.com/ 		0
16 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://obs.segreencolumn.com/mon
Requested by
Host: ob.segreencolumn.com
URL: https://ob.segreencolumn.com/i/84cf3062f98cbab994d639a975b2798e.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
50.16.211.97 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-50-16-211-97.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Content-Type
application/x-www-form-urlencoded
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

access-control-allow-origin
https://www.cyberark.com
content-length
0
date
Sat, 14 Mar 2026 06:20:42 GMT
content-type
application/json
access-control-allow-credentials
true
access-control-allow-methods
GET,HEAD,PUT,PATCH,POST,DELETE
collect
analytics.google.com/g/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://analytics.google.com/g/collect?v=2&tid=G-XTLTD7RKN5&gtm=45je63b1v9135218693za20g&_p=1773469238798&_gaz=1&gcd=13l3l3l3l2l1&npa=0&dma=0&ul=he-il&sr=1600x1200&cid=806338685.1773469242&_ng=1&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=EBAIAGA&_s=1&tag_exp=103116026~103200004~115938465~115938469~116024733~117484252&dl=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fgolden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps&dt=Golden%20SAML%3A%20Newly%20Discovered%20Attack%20Technique%20Forges%20Authentication%20to%20Cloud%20Apps&sid=1773469242&sct=1&seg=0&_tu=yAQ&en=page_view&_fv=1&_ss=1&_ee=1&ep.ua_dimension_6=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fgolden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps&tfd=4290
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-XTLTD7RKN5&cx=c&_slc=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.239.36.181 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:171:0
report-to
{"group":"ascnsrsggc:171:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:171:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://www.cyberark.com
cross-origin-opener-policy-report-only
same-origin; report-to=ascnsrsggc:171:0
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 14 Mar 2026 06:20:42 GMT
content-type
text/plain
server
Golfe2
collect
stats.g.doubleclick.net/g/ 		0
292 B 		Ping
General
Check archive.org
Download Go to
Full URL
https://stats.g.doubleclick.net/g/collect?v=2&_ng=1&tid=G-XTLTD7RKN5&cid=806338685.1773469242&gtm=45je63b1v9135218693za20g&aip=1&dma=0&gcd=13l3l3l3l2l1&npa=0&frm=0&tag_exp=103116026~103200004~115938465~115938469~116024733~117484252
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-XTLTD7RKN5&cx=c&_slc=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
142.251.127.154 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
lcfrai-in-f154.1e100.net
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:139:0
report-to
{"group":"ascnsrsggc:139:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:139:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://www.cyberark.com
cross-origin-opener-policy-report-only
same-origin; report-to=ascnsrsggc:139:0
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 14 Mar 2026 06:20:42 GMT
content-type
text/plain
server
Golfe2
ga-audiences
www.google.co.il/ads/ 		42 B
63 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.co.il/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&_ng=1&tid=G-XTLTD7RKN5&cid=806338685.1773469242&gtm=45je63b1v9135218693za20g&aip=1&dma=0&gcd=13l3l3l3l2l1&npa=0&frm=0&tag_exp=103116026~103200004~115938465~115938469~116024733~117484252&z=333727861
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
172.217.16.195 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
tzfraa-at-in-f3.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
42
date
Sat, 14 Mar 2026 06:20:42 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
rum
dsum-sec.casalemedia.com/ Frame 8274
Redirect Chain
  • https://insight.adsrvr.org/track/pxl/?adv=0v1kpom&ct=0:u9beit9&fmt=3
  • https://dpm.demdex.net/ibs:dpid=903&dpuuid=84287645-639f-44a7-be57-32558b730d7e&gdpr=0&gdpr_consent=&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Daam
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=aam
  • https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=84287645-639f-44a7-be57-32558b730d7e
  • https://ib.adnxs.com/bounce?%2Fgetuid%3Fhttps%253a%252f%252fmatch.adsrvr.org%252ftrack%252fcmf%252fappnexus%253fttd%253d1%2526anid%253d%2524UID%26ttd_tdid%3D84287645-639f-44a7-be57-32558b730d7e
  • https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=6262219618946998537&ttd_tdid=84287645-639f-44a7-be57-32558b730d7e
  • https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=ODQyODc2NDUtNjM5Zi00NGE3LWJlNTctMzI1NThiNzMwZDdl&gdpr=0&gdpr_consent=&ttd_tdid=84287645-639f-44a7-be57-32558...
  • https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=84287645-639f-44a7-be57-32558b730d7e&google_gid=CAESELAbeGUHTKQO0b7fY9JewEo&google_cver=1
  • https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=84287645-639f-44a7-be57-32558b730d7e&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon
  • https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=84287645-639f-44a7-be57-32558b730d7e&expiration=1776061244&gdpr=0&gdpr_consent=
43 B
716 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=84287645-639f-44a7-be57-32558b730d7e&expiration=1776061244&gdpr=0&gdpr_consent=
Requested by
Host: d1eoo1tco6rr5e.cloudfront.net
URL: https://d1eoo1tco6rr5e.cloudfront.net/0v1kpom/u9beit9/iframe
Protocol
H3
Server
104.18.26.193 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://d1eoo1tco6rr5e.cloudfront.net/

Response headers

cache-control
no-cache
nel
{"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
cf-cache-status
DYNAMIC
pragma
no-cache
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=0c369urDmM21df9o%2FGf7OHJh0lEdC4S6Kh6T6mIhRClCP1EWq%2FaHA7b0PDHNydwuSNE95vkXrc1nTWtH%2BlaWYYG6gVi%2BSX%2FaBPZWUCBkvKwoSqkl1JSu"}]}
cf-ray
9dc12c99a9087d9b-TLV
expires
0
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
content-length
43
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date
Sat, 14 Mar 2026 06:20:44 GMT
content-type
image/gif
server
cloudflare
priority
u=3,i

Redirect headers

location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=84287645-639f-44a7-be57-32558b730d7e&expiration=1776061244&gdpr=0&gdpr_consent=
content-length
323
date
Sat, 14 Mar 2026 06:20:44 GMT
server
Kestrel
bounce
ib.adnxs.com/
Redirect Chain
  • https://ib.adnxs.com/seg?member=827&consent=1&add=37503624,37503625
  • https://ib.adnxs.com/bounce?%2Fseg%3Fmember%3D827%26consent%3D1%26add%3D37503624%2C37503625
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ib.adnxs.com/bounce?%2Fseg%3Fmember%3D827%26consent%3D1%26add%3D37503624%2C37503625
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H2
Server
37.252.171.21 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEXUS - Xandr Inc., US),
Reverse DNS
1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.25.5 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cache-control
no-store, no-cache, private
pragma
no-cache
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials
true
x-proxy-origin
31.187.78.194; 31.187.78.194; 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; *.adnxs.com
expires
Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin
*
an-x-request-uuid
5042b286-6f8b-4238-b038-2f9e926604b3
content-length
43
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date
Sat, 14 Mar 2026 06:20:43 GMT
x-xss-protection
0
content-type
image/gif
server
nginx/1.25.5

Redirect headers

cache-control
no-store, no-cache, private
location
https://ib.adnxs.com/bounce?%2Fseg%3Fmember%3D827%26consent%3D1%26add%3D37503624%2C37503625
pragma
no-cache
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
access-control-allow-credentials
true
x-proxy-origin
31.187.78.194; 31.187.78.194; 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; *.adnxs.com
expires
Sat, 15 Nov 2008 16:00:00 GMT
access-control-allow-origin
*
an-x-request-uuid
891f3d9d-4561-4f16-a5d2-a4f71de16611
content-length
0
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date
Sat, 14 Mar 2026 06:20:42 GMT
x-xss-protection
0
content-type
text/html; charset=utf-8
server
nginx/1.25.5
img
pixel.mathtag.com/event/
Redirect Chain
  • https://pixel.mathtag.com/event/img?mt_id=2373692&mt_adid=431650
  • https://pixel.mathtag.com/event/img?primary-x-request-id=344fbf1d1d832934861424a55aae6a87&mt_id=2373692&mt_adid=431650
43 B
609 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.mathtag.com/event/img?primary-x-request-id=344fbf1d1d832934861424a55aae6a87&mt_id=2373692&mt_adid=431650
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
HTTP/1.1
Server
74.121.140.211 Reston, United States, ASN30419 (PAEDAE-INC - PaeDae, Inc., US),
Reverse DNS
Software
MT3 2314 5039ac4 master iad iad-pixel-x15 config_version:"562" /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
Security Headers
Name Value
Strict-Transport-Security 31536000
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/

Response headers

Strict-Transport-Security
31536000
Cache-Control
no-cache
Connection
keep-alive
Cross-Origin-Resource-Policy
cross-origin
Referrer-Policy
strict-origin
X-Content-Type-Options
nosniff
X-Permitted-Cross-Domain-Policies
all
Access-Control-Allow-Origin
*
Content-Length
43
Keep-Alive
timeout=360
Date
Sat, 14 Mar 2026 06:26:32 GMT
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Content-Type
image/gif
X-XSS-Protection
0
Server
MT3 2314 5039ac4 master iad iad-pixel-x15 config_version:"562"

Redirect headers

X-Permitted-Cross-Domain-Policies
all
X-Content-Type-Options
nosniff
Keep-Alive
timeout=360
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Date
Sat, 14 Mar 2026 06:26:32 GMT
Content-Type
image/gif
Strict-Transport-Security
31536000
Cache-Control
no-cache
Location
https://pixel.mathtag.com/event/img?primary-x-request-id=344fbf1d1d832934861424a55aae6a87&mt_id=2373692&mt_adid=431650
Connection
keep-alive
Cross-Origin-Resource-Policy
cross-origin
Referrer-Policy
strict-origin
Access-Control-Allow-Origin
*
Content-Length
0
X-XSS-Protection
0
Server
MT3 2314 5039ac4 master iad iad-pixel-x18 config_version:"562"
img
pixel.mathtag.com/event/
Redirect Chain
  • https://pixel.mathtag.com/event/img?mt_id=2373694&mt_adid=431650
  • https://pixel.mathtag.com/event/img?primary-x-request-id=dd88174debab3ae42b3dd4ef589d5fd0&mt_id=2373694&mt_adid=431650
43 B
609 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.mathtag.com/event/img?primary-x-request-id=dd88174debab3ae42b3dd4ef589d5fd0&mt_id=2373694&mt_adid=431650
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
HTTP/1.1
Server
74.121.140.211 Reston, United States, ASN30419 (PAEDAE-INC - PaeDae, Inc., US),
Reverse DNS
Software
MT3 2314 5039ac4 master iad iad-pixel-x17 config_version:"562" /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
Security Headers
Name Value
Strict-Transport-Security 31536000
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/

Response headers

Strict-Transport-Security
31536000
Cache-Control
no-cache
Connection
keep-alive
Cross-Origin-Resource-Policy
cross-origin
Referrer-Policy
strict-origin
X-Content-Type-Options
nosniff
X-Permitted-Cross-Domain-Policies
all
Access-Control-Allow-Origin
*
Content-Length
43
Keep-Alive
timeout=360
Date
Sat, 14 Mar 2026 06:20:43 GMT
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Content-Type
image/gif
X-XSS-Protection
0
Server
MT3 2314 5039ac4 master iad iad-pixel-x17 config_version:"562"

Redirect headers

X-Permitted-Cross-Domain-Policies
all
X-Content-Type-Options
nosniff
Keep-Alive
timeout=360
P3P
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
Date
Sat, 14 Mar 2026 06:20:43 GMT
Content-Type
image/gif
Strict-Transport-Security
31536000
Cache-Control
no-cache
Location
https://pixel.mathtag.com/event/img?primary-x-request-id=dd88174debab3ae42b3dd4ef589d5fd0&mt_id=2373694&mt_adid=431650
Connection
keep-alive
Cross-Origin-Resource-Policy
cross-origin
Referrer-Policy
strict-origin
Access-Control-Allow-Origin
*
Content-Length
0
X-XSS-Protection
0
Server
MT3 2314 5039ac4 master iad iad-pixel-x14 config_version:"562"
rum
dsum-sec.casalemedia.com/
Redirect Chain
  • https://insight.adsrvr.org/track/pxl/?adv=f6ba480&ct=0:zorfgoq&fmt=3
  • https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=84287645-639f-44a7-be57-32558b730d7e
  • https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=149472567156098708&ttd_tdid=84287645-639f-44a7-be57-32558b730d7e
  • https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=84287645-639f-44a7-be57-32558b730d7e&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon
  • https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
  • https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=84287645-639f-44a7-be57-32558b730d7e&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon
  • https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
  • https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=84287645-639f-44a7-be57-32558b730d7e&expiration=1776061244&gdpr=0&gdpr_consent=
43 B
752 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=84287645-639f-44a7-be57-32558b730d7e&expiration=1776061244&gdpr=0&gdpr_consent=
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H3
Server
104.18.27.193 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cache-control
no-cache
nel
{"report_to":"cf-nel","success_fraction":0.01,"max_age":604800}
cf-cache-status
DYNAMIC
pragma
no-cache
report-to
{"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=GEsv%2B6CX1BCwzAgUIamdZerMxfyKzqnnIVK%2FNMTL5%2BX09HPgPAMtLCkCkWXFGmJjrgRAlndiWiUnGAFrR2kL2EI4vG19hGHEfftPW%2ByblL7gOiasm8LF"}]}
cf-ray
9dc12c9a3bfffc6b-TLV
expires
0
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
content-length
43
p3p
policyref="/w3c/p3p.xml", CP="NOI DSP COR DEVa TAIa OUR BUS UNI"
date
Sat, 14 Mar 2026 06:20:44 GMT
content-type
image/gif
server
cloudflare
priority
u=3,i

Redirect headers

location
https://dsum-sec.casalemedia.com/rum?cm_dsp_id=39&external_user_id=84287645-639f-44a7-be57-32558b730d7e&expiration=1776061244&gdpr=0&gdpr_consent=
content-length
323
date
Sat, 14 Mar 2026 06:20:44 GMT
server
Kestrel
generic
match.adsrvr.org/track/cmf/
Redirect Chain
  • https://insight.adsrvr.org/track/pxl/?adv=f6ba480&ct=0:wvpxlx5&fmt=3
  • https://ib.adnxs.com/getuid?https%3a%2f%2fmatch.adsrvr.org%2ftrack%2fcmf%2fappnexus%3fttd%3d1%26anid%3d%24UID&ttd_tdid=84287645-639f-44a7-be57-32558b730d7e
  • https://match.adsrvr.org/track/cmf/appnexus?ttd=1&anid=149472567156098708&ttd_tdid=84287645-639f-44a7-be57-32558b730d7e
  • https://cm.g.doubleclick.net/pixel?google_nid=TheTradeDesk&google_cm&google_sc&google_hm=ODQyODc2NDUtNjM5Zi00NGE3LWJlNTctMzI1NThiNzMwZDdl&gdpr=0&gdpr_consent=&ttd_tdid=84287645-639f-44a7-be57-32558...
  • https://match.adsrvr.org/track/cmf/google?g_uuid=&gdpr=0&gdpr_consent=&ttd_tdid=84287645-639f-44a7-be57-32558b730d7e&google_gid=CAESELAbeGUHTKQO0b7fY9JewEo&google_cver=1
  • https://pixel.rubiconproject.com/tap.php?v=8981&nid=2307&put=84287645-639f-44a7-be57-32558b730d7e&gdpr=0&gdpr_consent=&expires=30&next=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Frubicon
  • https://match.adsrvr.org/track/cmf/rubicon?gdpr=0
  • https://x.bidswitch.net/syncd?dsp_id=93&user_group=1&user_id=84287645-639f-44a7-be57-32558b730d7e&expires=30&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dbidswitch
  • https://x.bidswitch.net/ul_cb/syncd?dsp_id=93&user_group=1&user_id=84287645-639f-44a7-be57-32558b730d7e&expires=30&redir=https%3A%2F%2Fmatch.adsrvr.org%2Ftrack%2Fcmf%2Fgeneric%3Fttd_pid%3Dbidswitch
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=bidswitch
70 B
503 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://match.adsrvr.org/track/cmf/generic?ttd_pid=bidswitch
Requested by
Host: www.cyberark.com
URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H2
Server
52.223.40.198 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
Kestrel /
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

content-length
70
date
Sat, 14 Mar 2026 06:20:45 GMT
content-type
image/gif
server
Kestrel

Redirect headers

via
1.1 google
cache-control
no-cache, no-store, must-revalidate
location
https://match.adsrvr.org/track/cmf/generic?ttd_pid=bidswitch
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 14 Mar 2026 06:20:45 GMT
msg
sjrtp6.marketo.com/gw1/ 		0
433 B 		Script
General
Check archive.org
Download Go to
Full URL
https://sjrtp6.marketo.com/gw1/msg?a=2&sid=cyberarksoftware-1773469241390-0aa249d6&aid=cyberarksoftware&ma=id%3A316-CZP-275%26token%3A_mch-cyberark.com-54f3d736a7be1eb78939b03286739e4d&viewedTypes=&0.7569333248007992&rts=1773469242669
Requested by
Host: sjrtp6-cdn.marketo.com
URL: https://sjrtp6-cdn.marketo.com/rtp-api/v1/rtp.js?aid=cyberarksoftware
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.28.164.244 , United States, ASN15224 (OMNITURE - Adobe Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

Cache-Control
no-cache
Content-Length
0
Keep-Alive
timeout=2
Date
Sat, 14 Mar 2026 06:20:42 GMT
Content-Type
text/javascript;charset=utf-8
Server
nginx
Connection
keep-alive
mon
obs.segreencolumn.com/ 		0
39 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://obs.segreencolumn.com/mon
Requested by
Host: ob.segreencolumn.com
URL: https://ob.segreencolumn.com/i/84cf3062f98cbab994d639a975b2798e.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
50.16.211.97 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-50-16-211-97.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Content-Type
application/x-www-form-urlencoded
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

access-control-allow-origin
https://www.cyberark.com
content-length
0
date
Sat, 14 Mar 2026 06:20:43 GMT
content-type
application/json
access-control-allow-credentials
true
access-control-allow-methods
GET,HEAD,PUT,PATCH,POST,DELETE
mon
obs.segreencolumn.com/ 		0
39 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://obs.segreencolumn.com/mon
Requested by
Host: ob.segreencolumn.com
URL: https://ob.segreencolumn.com/i/84cf3062f98cbab994d639a975b2798e.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
50.16.211.97 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-50-16-211-97.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Content-Type
application/x-www-form-urlencoded
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

access-control-allow-origin
https://www.cyberark.com
content-length
0
date
Sat, 14 Mar 2026 06:20:44 GMT
content-type
application/json
access-control-allow-credentials
true
access-control-allow-methods
GET,HEAD,PUT,PATCH,POST,DELETE
RC3719b75d704c41bf84889d486a456143-source.min.js
assets.adobedtm.com/789d877fe9a8/09207f0a9c44/eb0d9e0e24f2/ 		451 B
572 B 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/eb0d9e0e24f2/RC3719b75d704c41bf84889d486a456143-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/launch-e8e6adf0fe30.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.181.12 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-52-181-12.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
02b3d7b0b8740148469d839cb81fddb4ca8330c202242f4f393d928c89fee486
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cache-control
max-age=3600
timing-allow-origin
*
content-encoding
gzip
etag
"79072e67e3bfc87a7e6a64634a830954:1762975007.123862"
x-content-type-options
nosniff
expires
Sat, 14 Mar 2026 07:20:45 GMT
accept-ranges
bytes
access-control-allow-origin
https://www.cyberark.com
content-length
292
date
Sat, 14 Mar 2026 06:20:45 GMT
content-type
application/x-javascript
last-modified
Wed, 12 Nov 2025 19:16:47 GMT
server
AkamaiNetStorage
vary
Accept-Encoding
p
i.simpli.fi/ 		874 B
781 B 		Script
General
Check archive.org
Download Go to
Full URL
https://i.simpli.fi/p?cid=440562&cb=sifi_att_42656._hp
Requested by
Host: tag.simpli.fi
URL: https://tag.simpli.fi/sifitag/dc000d50-4dbc-4d9a-ba52-c3015680f76c
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
35.204.89.238 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
238.89.204.35.bc.googleusercontent.com
Software
openresty /
Resource Hash
eb57752bfa803d15370c556f6c037906d408f5b2edad5631f36a9bdc38a67371

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cache-control
max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0
content-encoding
gzip
pragma
no-cache
expires
Thu, 01 Jan 1970 00:00:00 GMT
date
Sat, 14 Mar 2026 06:20:45 GMT
content-type
application/javascript; charset=UTF-8
vary
Accept-Encoding
server
openresty
jquery-custom-ui.min.js
rtp-static.marketo.com/rtp/libs/jqueryui/1.13.2/ 		522 KB
126 KB 		Script
General
Check archive.org
Download Go to
Full URL
https://rtp-static.marketo.com/rtp/libs/jqueryui/1.13.2/jquery-custom-ui.min.js
Requested by
Host: sjrtp6-cdn.marketo.com
URL: https://sjrtp6-cdn.marketo.com/rtp-api/v1/rtp.js?aid=cyberarksoftware
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.102.33.245 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a104-102-33-245.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
b122e173fb310c409d02c56e57eea40f1ea470fed839599c902b085d8fdb0129

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

Transfer-Encoding
chunked
Access-Control-Allow-Headers
*
Access-Control-Max-Age
86400
Content-Encoding
gzip
ETag
"85c4e68263c6de164e4bad3fb60222a5:1685620750.615377"
Connection
keep-alive, Transfer-Encoding
Access-Control-Allow-Credentials
false
Access-Control-Allow-Methods
GET
Accept-Ranges
bytes
Access-Control-Allow-Origin
*
Date
Sat, 14 Mar 2026 06:20:45 GMT
Content-Type
application/x-javascript
Last-Modified
Thu, 01 Jun 2023 11:54:52 GMT
Server
AkamaiNetStorage
Vary
Accept-Encoding
cei
insight.adsrvr.org/track/ Frame 92F6 		736 B
1 KB 		Document
General
Check archive.org
Download Go to
Full URL
https://insight.adsrvr.org/track/cei?advertiser_id=db8v4fb&cookie_sync=1&upv=3.0.0&upid=2kfe2lm&ref=https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Requested by
Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.223.40.198 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
Kestrel /
Resource Hash
c89ad4459c7c0a83f898fcf6f69eb4b95acd87c39e05eebac69906d36ed47804

Request headers

Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36

Response headers

content-encoding
gzip
content-type
text/html
date
Sat, 14 Mar 2026 06:20:45 GMT
server
Kestrel
vary
Accept-Encoding
favicon.ico
cihost.uberflip.com/cyberArk/favicon-update/assets/favicons/ 		15 KB
15 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://cihost.uberflip.com/cyberArk/favicon-update/assets/favicons/favicon.ico
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.173.205.109 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-173-205-109.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3394af2edb462a3dcb742b0b26ef640f0ee9701638d06d3dca4a9528d15ce01a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

vary
accept-encoding
x-amz-meta-s3cmd-attrs
atime:1733772036/ctime:1733772036/gid:127/gname:docker/md5:f3c3697de3fa24ba9b2cdeebaa48d071/mode:33188/mtime:1733772036/uid:1001/uname:runner
etag
"f3c3697de3fa24ba9b2cdeebaa48d071"
via
1.1 0140ca34c2d577c2578595f0c9e0050e.cloudfront.net (CloudFront)
accept-ranges
bytes
x-cache
RefreshHit from cloudfront
content-length
15086
x-amz-cf-id
sLpxIeFMhr5XYksr7Wk-fIyUU8FJHhU6OGCCENJPYIWJ9mFhi5QSqQ==
date
Sat, 14 Mar 2026 06:20:46 GMT
content-type
image/vnd.microsoft.icon
last-modified
Mon, 09 Dec 2024 19:22:12 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P12
x-amz-server-side-encryption
AES256
RC5266e3ee597a459fbc388f1132b7e943-source.min.js
assets.adobedtm.com/789d877fe9a8/09207f0a9c44/eb0d9e0e24f2/ 		521 B
609 B 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/eb0d9e0e24f2/RC5266e3ee597a459fbc388f1132b7e943-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/launch-e8e6adf0fe30.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.181.12 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-52-181-12.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
9047f7304169514f176ad69b031dc68732f1bc7af1543c224188e81d7946633e
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cache-control
max-age=3600
timing-allow-origin
*
content-encoding
gzip
etag
"79072e67e3bfc87a7e6a64634a830954:1762975007.123862"
x-content-type-options
nosniff
expires
Sat, 14 Mar 2026 07:20:45 GMT
accept-ranges
bytes
access-control-allow-origin
https://www.cyberark.com
content-length
328
date
Sat, 14 Mar 2026 06:20:45 GMT
content-type
application/x-javascript
last-modified
Wed, 12 Nov 2025 19:16:47 GMT
server
AkamaiNetStorage
vary
Accept-Encoding
utsync.ashx
ml314.com/
Redirect Chain
  • https://um.simpli.fi/bombora
  • https://ml314.com/utsync.ashx?et=0&eid=93940&fp=7BCE36D896B24D3E9FFB9A9004C0C77F
43 B
60 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ml314.com/utsync.ashx?et=0&eid=93940&fp=7BCE36D896B24D3E9FFB9A9004C0C77F
Protocol
H3
Server
34.117.77.79 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
79.77.117.34.bc.googleusercontent.com
Software
Google Frontend /
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
via
1.1 google
expires
0, Sun, 15 Mar 2026 06:20:45 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
CP="NON DSP COR ADMo PSAo DEVo BUS COM UNI NAV DEM STA"
date
Sat, 14 Mar 2026 06:20:45 GMT
content-type
image/gif
server
Google Frontend

Redirect headers

strict-transport-security
max-age=63072000; includeSubdomains; preload
cache-control
no-cache
location
https://ml314.com/utsync.ashx?et=0&eid=93940&fp=7BCE36D896B24D3E9FFB9A9004C0C77F
x-content-type-options
nosniff
access-control-allow-methods
GET, POST, OPTIONS
expires
Fri, 13 Mar 2026 06:20:45 GMT
access-control-allow-origin
*
content-length
142
date
Sat, 14 Mar 2026 06:20:45 GMT
content-type
text/html
server
openresty
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
/
onetag-sys.com/match/
Redirect Chain
  • https://um.simpli.fi/bidswitch
  • https://x.bidswitch.net/sync?dsp_id=518&user_id=7BCE36D896B24D3E9FFB9A9004C0C77F
  • https://onetag-sys.com/match/?int_id=30&uid=a17a1391-522b-47c1-b3f7-7910d09cb5de&gdpr=&gdpr_consent=&us_privacy=
0
232 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://onetag-sys.com/match/?int_id=30&uid=a17a1391-522b-47c1-b3f7-7910d09cb5de&gdpr=&gdpr_consent=&us_privacy=
Protocol
H2
Server
51.38.120.206 Hessen, Germany, ASN16276 (OVH OVH SAS, FR),
Reverse DNS
ip206.ip-51-38-120.eu
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=15552000

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

strict-transport-security
max-age=15552000
cache-control
no-transform, no-cache
alt-svc
h3=":443"; ma=900, h3-29=":443"; ma=900
content-length
0
p3p
CP='CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR'
date
Sat, 14 Mar 2026 06:20:46 GMT

Redirect headers

via
1.1 google
cache-control
no-cache, no-store, must-revalidate
location
//onetag-sys.com/match/?int_id=30&uid=a17a1391-522b-47c1-b3f7-7910d09cb5de&gdpr=&gdpr_consent=&us_privacy=
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 14 Mar 2026 06:20:45 GMT
syncMe
synchroscript.deliveryengine.adswizz.com/
Redirect Chain
  • https://um.simpli.fi/adswizz
  • https://synchroscript.deliveryengine.adswizz.com/syncMe?partnerDomain=simpli.fi&idType=cookie&partnerUserId=7BCE36D896B24D3E9FFB9A9004C0C77F
0
387 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://synchroscript.deliveryengine.adswizz.com/syncMe?partnerDomain=simpli.fi&idType=cookie&partnerUserId=7BCE36D896B24D3E9FFB9A9004C0C77F
Protocol
H2
Server
18.245.46.60 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-245-46-60.fra56.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

x-adswizz-request-id
09e7a1dc-b94a-4a72-84b1-bc6b7a07945a
x-clacks-overhead
GNU Terry Pratchett
via
1.1 e5482755d4e937d4018ce72cd23b55c4.cloudfront.net (CloudFront)
access-control-allow-origin
*
x-cache
Miss from cloudfront
x-amz-cf-id
NjWwxZbSZ4PqW9gkPUa0Q_NoGRB8OvSWrPQMpgornNY_GGjzSl0VhQ==
date
Sat, 14 Mar 2026 06:20:46 GMT
x-amz-cf-pop
FRA56-P9

Redirect headers

strict-transport-security
max-age=63072000; includeSubdomains; preload
cache-control
no-cache
location
https://synchroscript.deliveryengine.adswizz.com/syncMe?partnerDomain=simpli.fi&idType=cookie&partnerUserId=7BCE36D896B24D3E9FFB9A9004C0C77F
x-content-type-options
nosniff
access-control-allow-methods
GET, POST, OPTIONS
expires
Fri, 13 Mar 2026 06:20:45 GMT
access-control-allow-origin
*
content-length
142
date
Sat, 14 Mar 2026 06:20:45 GMT
content-type
text/html
server
openresty
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
lons7jax
sync-tm.everesttech.net/ct/upi/pid/
Redirect Chain
  • https://um.simpli.fi/eyeota
  • https://ps.eyeota.net/match?bid=irm51m1&uid=7BCE36D896B24D3E9FFB9A9004C0C77F
  • https://ps.eyeota.net/match/bounce/?bid=irm51m1&uid=7BCE36D896B24D3E9FFB9A9004C0C77F
  • https://cm.g.doubleclick.net/pixel?google_nid=eye&google_cm&google_sc&google_hm=MnZZRVMwYm4wQlVoOE4xYjBPTmdHTXZUQ0xDMVIyRG5aaEx4NnBxRVQyWjA&gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&dc_rc=1&...
  • https://ps.eyeota.net/match?gdpr=0&gdpr_consent=&uid=1&bid=gdo9o51&newuser=1&dc_rc=1&dc_mr=5&dc_orig=irm51m1&google_gid=CAESEOIzutn5rD-X6R4WVZebaXc&google_cver=1
  • https://d.turn.com/r/dd/id/L2NzaWQvMS9jaWQvMjg0NTA1NDYvdC8w/url/https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=$!{TURN_UUID}&newuser=1&dc_rc=2&dc_mr=5&dc_orig=irm51m1&
  • https://ps.eyeota.net/match?bid=1mpjpn0&turn_id=4457383036734668487&newuser=1&dc_rc=2&dc_mr=5&dc_orig=irm51m1&
  • https://sync-tm.everesttech.net/upi/pid/lons7jax?redir=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fuid%3D%24%7BTM_USER_ID%7D%26bid%3D0rijhbu%26dc_rc%3D3%26dc_mr%3D5%26dc_orig%3Dirm51m1%26
  • https://sync-tm.everesttech.net/ct/upi/pid/lons7jax?redir=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fuid%3D%24%7BTM_USER_ID%7D%26bid%3D0rijhbu%26dc_rc%3D3%26dc_mr%3D5%26dc_orig%3Dirm51m1%26&_test=abT_Pw...
85 B
194 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync-tm.everesttech.net/ct/upi/pid/lons7jax?redir=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fuid%3D%24%7BTM_USER_ID%7D%26bid%3D0rijhbu%26dc_rc%3D3%26dc_mr%3D5%26dc_orig%3Dirm51m1%26&_test=abT_PwAAe3y8TwAz
Protocol
H2
Server
151.101.66.49 , United States, ASN54113 (FASTLY - Fastly, Inc., US),
Reverse DNS
Software
Jetty(9.4.35.v20201120) /
Resource Hash
acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

x-robots-tag
noindex
cache-control
no-cache
x-timer
S1773469248.117776,VS0,VE0
age
2875
pragma
no-cache
via
1.1 varnish
accept-ranges
bytes
x-cache
HIT
content-length
85
date
Sat, 14 Mar 2026 06:20:48 GMT
content-type
image/png
x-served-by
cache-lon4250-LON
server
Jetty(9.4.35.v20201120)
x-cache-hits
1282

Redirect headers

x-robots-tag
noindex
cache-control
no-cache
location
https://sync-tm.everesttech.net/ct/upi/pid/lons7jax?redir=https%3A%2F%2Fps.eyeota.net%2Fmatch%3Fuid%3D%24%7BTM_USER_ID%7D%26bid%3D0rijhbu%26dc_rc%3D3%26dc_mr%3D5%26dc_orig%3Dirm51m1%26&_test=abT_PwAAe3y8TwAz
x-timer
S1773469248.900244,VS0,VE77
pragma
no-cache
via
1.1 varnish
accept-ranges
bytes
access-control-allow-origin
*
x-cache
MISS
p3p
CP="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
content-length
0
date
Sat, 14 Mar 2026 06:20:47 GMT
x-served-by
cache-lon4250-LON
server
Jetty(9.4.35.v20201120)
x-cache-hits
0
pixel
capi.connatix.com/us/
Redirect Chain
  • https://um.simpli.fi/smaato
  • https://s.ad.smaato.net/c/?dspInit=675&dspCookie=7BCE36D896B24D3E9FFB9A9004C0C77F
  • https://capi.connatix.com/us/pixel?puid=b8a8954356&pId=48&gdpr=0&gdpr_consent=&us_privacy={usPrivacyString}
  • https://capi.connatix.com/us/pixel?puid=b8a8954356&pId=48&gdpr=0&gdpr_consent=&us_privacy={usPrivacyString}&final=true
82 B
82 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://capi.connatix.com/us/pixel?puid=b8a8954356&pId=48&gdpr=0&gdpr_consent=&us_privacy={usPrivacyString}&final=true
Protocol
H3
Server
172.64.146.152 , Ascension Island, ASN13335 (CLOUDFLARENET - Cloudflare, Inc., US),
Reverse DNS
Software
cloudflare /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

surrogate-control
no-cache, no-store, must-revalidate, max-age=0
access-control-max-age
86400
cache-control
no-cache, no-store, must-revalidate, max-age=0
content-encoding
gzip
cf-cache-status
DYNAMIC
cf-ray
9dc12ca8da507d94-TLV
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
content-length
95
date
Sat, 14 Mar 2026 06:20:46 GMT
content-type
image/gif
vary
Accept-Encoding
server
cloudflare
priority
u=3,i
access-control-allow-headers
x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model

Redirect headers

access-control-max-age
86400
cache-control
no-cache, no-store, must-revalidate, max-age=0
location
https://capi.connatix.com/us/pixel?puid=b8a8954356&pId=48&gdpr=0&gdpr_consent=&us_privacy={usPrivacyString}&final=true
cf-cache-status
DYNAMIC
cf-ray
9dc12ca7999b7d94-TLV
alt-svc
h3=":443"; ma=86400
server-timing
cfExtPri
content-length
0
date
Sat, 14 Mar 2026 06:20:46 GMT
server
cloudflare
priority
u=3,i
access-control-allow-headers
x-sec-ch-ua-platform-version, x-sec-ch-ua-full-version-list, x-sec-ch-ua-arch, x-sec-ch-ua-bitness, x-sec-ch-ua-model
7BCE36D896B24D3E9FFB9A9004C0C77F
sync.1rx.io/usersync/simplifi/
Redirect Chain
  • https://um.simpli.fi/nexxen
  • https://sync.1rx.io/usersync/simplifi/7BCE36D896B24D3E9FFB9A9004C0C77F
0
44 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.1rx.io/usersync/simplifi/7BCE36D896B24D3E9FFB9A9004C0C77F
Protocol
H2
Server
54.146.30.88 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-54-146-30-88.compute-1.amazonaws.com
Software
awselb/2.0 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

date
Sat, 14 Mar 2026 06:20:46 GMT
server
awselb/2.0

Redirect headers

strict-transport-security
max-age=63072000; includeSubdomains; preload
cache-control
no-cache
location
https://sync.1rx.io/usersync/simplifi/7BCE36D896B24D3E9FFB9A9004C0C77F
x-content-type-options
nosniff
access-control-allow-methods
GET, POST, OPTIONS
expires
Fri, 13 Mar 2026 06:20:45 GMT
access-control-allow-origin
*
content-length
142
date
Sat, 14 Mar 2026 06:20:45 GMT
content-type
text/html
server
openresty
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
xuid
eb2.3lift.com/
Redirect Chain
  • https://um.simpli.fi/triplelift
  • https://eb2.3lift.com/xuid?mid=7969&xuid=7BCE36D896B24D3E9FFB9A9004C0C77F&dongle=yf3
  • https://eb2.3lift.com/xuid?ld=1&mid=7969&xuid=7BCE36D896B24D3E9FFB9A9004C0C77F&dongle=yf3&gdpr=0&cmp_cs=&us_privacy=
37 B
473 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://eb2.3lift.com/xuid?ld=1&mid=7969&xuid=7BCE36D896B24D3E9FFB9A9004C0C77F&dongle=yf3&gdpr=0&cmp_cs=&us_privacy=
Protocol
H2
Server
44.211.20.238 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-44-211-20-238.compute-1.amazonaws.com
Software
/
Resource Hash
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cache-control
no-cache, no-store, must-revalidate
content-length
37
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date
Sat, 14 Mar 2026 06:20:46 GMT
content-type
image/gif

Redirect headers

cache-control
no-cache, no-store, must-revalidate
location
/xuid?ld=1&mid=7969&xuid=7BCE36D896B24D3E9FFB9A9004C0C77F&dongle=yf3&gdpr=0&cmp_cs=&us_privacy=
content-length
0
p3p
policyref="http://cdn.3lift.com/w3c/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"
date
Sat, 14 Mar 2026 06:20:46 GMT
sync
simplifi.partners.tremorhub.com/
Redirect Chain
  • https://um.simpli.fi/telaria_p
  • https://simplifi.partners.tremorhub.com/sync?UISF=7BCE36D896B24D3E9FFB9A9004C0C77F
43 B
286 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://simplifi.partners.tremorhub.com/sync?UISF=7BCE36D896B24D3E9FFB9A9004C0C77F
Protocol
H2
Server
100.55.244.171 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-100-55-244-171.compute-1.amazonaws.com
Software
nginx /
Resource Hash
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

p3p
CP='This is not a P3P policy. See https://telaria.com/privacy-policy/'
date
Sat, 14 Mar 2026 06:20:46 GMT
content-type
image/gif
server
nginx

Redirect headers

strict-transport-security
max-age=63072000; includeSubdomains; preload
cache-control
no-cache
location
https://simplifi.partners.tremorhub.com/sync?UISF=7BCE36D896B24D3E9FFB9A9004C0C77F
x-content-type-options
nosniff
access-control-allow-methods
GET, POST, OPTIONS
expires
Fri, 13 Mar 2026 06:20:45 GMT
access-control-allow-origin
*
content-length
142
date
Sat, 14 Mar 2026 06:20:45 GMT
content-type
text/html
server
openresty
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
check
pixel.tapad.com/idsync/ex/receive/
Redirect Chain
  • https://um.simpli.fi/tapad
  • https://pixel.tapad.com/idsync/ex/receive?partner_id=2305&partner_device_id=7BCE36D896B24D3E9FFB9A9004C0C77F
  • https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=7BCE36D896B24D3E9FFB9A9004C0C77F
95 B
427 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=7BCE36D896B24D3E9FFB9A9004C0C77F
Protocol
H2
Server
34.111.113.62 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
62.113.111.34.bc.googleusercontent.com
Software
/
Resource Hash
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
Security Headers
Name Value
Strict-Transport-Security max-age=31536000

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

strict-transport-security
max-age=31536000
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via
1.1 google
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length
95
date
Sat, 14 Mar 2026 06:20:46 GMT
content-type
image/png

Redirect headers

strict-transport-security
max-age=31536000
location
https://pixel.tapad.com/idsync/ex/receive/check?partner_id=2305&partner_device_id=7BCE36D896B24D3E9FFB9A9004C0C77F
accept-ch
Sec-CH-UA, Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version, Sec-CH-UA-WoW64
via
1.1 google
access-control-allow-origin
*
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="http://tapad-taptags.s3.amazonaws.com/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
content-length
0
date
Sat, 14 Mar 2026 06:20:46 GMT
g.pixel
aa.agkn.com/adscores/
Redirect Chain
  • https://um.simpli.fi/ad_advisor
  • https://aa.agkn.com/adscores/g.pixel?sid=9201915418&sifi_uid=7BCE36D896B24D3E9FFB9A9004C0C77F
0
307 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://aa.agkn.com/adscores/g.pixel?sid=9201915418&sifi_uid=7BCE36D896B24D3E9FFB9A9004C0C77F
Protocol
H2
Server
35.168.61.84 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-35-168-61-84.compute-1.amazonaws.com
Software
AAWebServer /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
access-control-allow-methods
GET, OPTIONS
expires
0
access-control-allow-origin
*
p3p
policyref="https://www.agkn.com/p3p/p3p.xml",CP="NOI NID"
date
Sat, 14 Mar 2026 06:20:46 GMT
server
AAWebServer
access-control-allow-headers
accept, cache-control, origin, x-requested-with, x-file-name, content-type

Redirect headers

strict-transport-security
max-age=63072000; includeSubdomains; preload
cache-control
no-cache
location
https://aa.agkn.com/adscores/g.pixel?sid=9201915418&sifi_uid=7BCE36D896B24D3E9FFB9A9004C0C77F
x-content-type-options
nosniff
access-control-allow-methods
GET, POST, OPTIONS
expires
Fri, 13 Mar 2026 06:20:45 GMT
access-control-allow-origin
*
content-length
142
date
Sat, 14 Mar 2026 06:20:45 GMT
content-type
text/html
server
openresty
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
ProfilesEngineServlet
sync.intentiq.com/profiles_engine/
Redirect Chain
  • https://um.simpli.fi/intentiq
  • https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=7BCE36D896B24D3E9FFB9A9004C0C77F
0
218 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=7BCE36D896B24D3E9FFB9A9004C0C77F
Protocol
H2
Server
13.226.244.23 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-13-226-244-23.fra56.r.cloudfront.net
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

via
1.1 2366f276ada852c1e79bf73ce885394a.cloudfront.net (CloudFront)
alt-svc
h3=":443"; ma=86400
x-cache
Miss from cloudfront
content-length
0
x-amz-cf-id
yEesIwMlLr1b3eVicEECvkSmcMz-8woCpYL4VNvjkALtXrV4R96Ntg==
date
Sat, 14 Mar 2026 06:20:46 GMT
x-amz-cf-pop
FRA56-P14

Redirect headers

strict-transport-security
max-age=63072000; includeSubdomains; preload
cache-control
no-cache
location
https://sync.intentiq.com/profiles_engine/ProfilesEngineServlet?at=20&dpi=2124307461&pcid=7BCE36D896B24D3E9FFB9A9004C0C77F
x-content-type-options
nosniff
access-control-allow-methods
GET, POST, OPTIONS
expires
Fri, 13 Mar 2026 06:20:45 GMT
access-control-allow-origin
*
content-length
142
date
Sat, 14 Mar 2026 06:20:45 GMT
content-type
text/html
server
openresty
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
pubmatic
um.simpli.fi/ 		43 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://um.simpli.fi/pubmatic
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
34.7.37.3 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
3.37.7.34.bc.googleusercontent.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

strict-transport-security
max-age=63072000; includeSubdomains; preload
cache-control
no-cache
x-content-type-options
nosniff
access-control-allow-methods
GET, POST, OPTIONS
expires
Fri, 13 Mar 2026 06:20:45 GMT
access-control-allow-origin
*
content-length
43
date
Sat, 14 Mar 2026 06:20:45 GMT
content-type
image/gif
last-modified
Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
freewheel
um.simpli.fi/ 		43 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://um.simpli.fi/freewheel
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
34.7.37.3 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
3.37.7.34.bc.googleusercontent.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

strict-transport-security
max-age=63072000; includeSubdomains; preload
cache-control
no-cache
x-content-type-options
nosniff
access-control-allow-methods
GET, POST, OPTIONS
expires
Fri, 13 Mar 2026 06:20:45 GMT
access-control-allow-origin
*
content-length
43
date
Sat, 14 Mar 2026 06:20:45 GMT
content-type
image/gif
last-modified
Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
getuid
sync.smartadserver.com/
Redirect Chain
  • https://um.simpli.fi/dtnx
  • https://fei.pro-market.net/engine?du=24;csync=7BCE36D896B24D3E9FFB9A9004C0C77F;mimetype=img;
  • https://fei.pro-market.net/engine?du=24;csync=7BCE36D896B24D3E9FFB9A9004C0C77F;mimetype=img;sr
  • https://sync.smartadserver.com/getuid?url=https%3A%2F%2Ffei.pro-market.net%2Fengine%3Fsite%3D161185%26size%3D1x1%26du%3D36%26csync%3D[sas_uid]
  • https://sync.smartadserver.com/getuid?url=https://fei.pro-market.net/engine?site=161185&size=1x1&du=36&csync=[sas_uid]&cklb=1
0
256 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.smartadserver.com/getuid?url=https://fei.pro-market.net/engine?site=161185&size=1x1&du=36&csync=[sas_uid]&cklb=1
Protocol
H2
Server
81.17.55.116 , Netherlands, ASN60781 (LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V., NL),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cache-control
no-cache,no-store
content-length
0
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date
Sat, 14 Mar 2026 06:20:45 GMT
pragma
no-cache

Redirect headers

cache-control
no-cache,no-store
location
https://sync.smartadserver.com:443/getuid?url=https://fei.pro-market.net/engine?site=161185&size=1x1&du=36&csync=[sas_uid]&cklb=1
content-length
0
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
date
Sat, 14 Mar 2026 06:20:46 GMT
pragma
no-cache
/
loadm.exelator.com/load/
Redirect Chain
  • https://um.simpli.fi/exelatem
  • https://loadm.exelator.com/load/?p=204&g=2191&simid=7BCE36D896B24D3E9FFB9A9004C0C77F&j=0
0
324 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://loadm.exelator.com/load/?p=204&g=2191&simid=7BCE36D896B24D3E9FFB9A9004C0C77F&j=0
Protocol
H2
Server
54.78.254.47 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-78-254-47.eu-west-1.compute.amazonaws.com
Software
nginx / Undertow/1
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cache-control
no-cache
p3p
policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA, policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA
date
Sat, 14 Mar 2026 06:20:46 GMT
x-powered-by
Undertow/1
server
nginx
access-control-allow-credentials
true

Redirect headers

strict-transport-security
max-age=63072000; includeSubdomains; preload
cache-control
no-cache
location
https://loadm.exelator.com/load/?p=204&g=2191&simid=7BCE36D896B24D3E9FFB9A9004C0C77F&j=0
x-content-type-options
nosniff
access-control-allow-methods
GET, POST, OPTIONS
expires
Fri, 13 Mar 2026 06:20:45 GMT
access-control-allow-origin
*
content-length
142
date
Sat, 14 Mar 2026 06:20:45 GMT
content-type
text/html
server
openresty
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
yahoo
um.simpli.fi/ 		43 B
409 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://um.simpli.fi/yahoo
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
34.7.37.3 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
3.37.7.34.bc.googleusercontent.com
Software
/
Resource Hash
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

strict-transport-security
max-age=63072000; includeSubdomains; preload
cache-control
no-cache
x-content-type-options
nosniff
access-control-allow-methods
GET, POST, OPTIONS
expires
Fri, 13 Mar 2026 06:20:45 GMT
access-control-allow-origin
*
content-length
43
date
Sat, 14 Mar 2026 06:20:45 GMT
content-type
image/gif
last-modified
Mon, 28 Sep 1970 06:00:00 GMT
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
sync
sync.bfmio.com/
Redirect Chain
  • https://um.simpli.fi/beachfront
  • https://sync.bfmio.com/sync?pid=141&uid=7BCE36D896B24D3E9FFB9A9004C0C77F
0
379 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://sync.bfmio.com/sync?pid=141&uid=7BCE36D896B24D3E9FFB9A9004C0C77F
Protocol
H2
Server
35.212.17.176 Washington, United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
176.17.212.35.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

via
1.1 google
date
Sat, 14 Mar 2026 06:20:46 GMT

Redirect headers

strict-transport-security
max-age=63072000; includeSubdomains; preload
cache-control
no-cache
location
https://sync.bfmio.com/sync?pid=141&uid=7BCE36D896B24D3E9FFB9A9004C0C77F
x-content-type-options
nosniff
access-control-allow-methods
GET, POST, OPTIONS
expires
Fri, 13 Mar 2026 06:20:45 GMT
access-control-allow-origin
*
content-length
142
date
Sat, 14 Mar 2026 06:20:45 GMT
content-type
text/html
server
openresty
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
tpid=7BCE36D896B24D3E9FFB9A9004C0C77F
bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/
Redirect Chain
  • https://um.simpli.fi/crwdcntrl
  • https://bcp.crwdcntrl.net/map/c=7625/tp=SIMP/tpid=7BCE36D896B24D3E9FFB9A9004C0C77F
  • https://bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/tpid=7BCE36D896B24D3E9FFB9A9004C0C77F
49 B
546 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/tpid=7BCE36D896B24D3E9FFB9A9004C0C77F
Protocol
H2
Server
108.128.131.68 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-108-128-131-68.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
Security Headers
Name Value
Strict-Transport-Security max-age=31536000 ; includeSubDomains

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

strict-transport-security
max-age=31536000 ; includeSubDomains
cache-control
no-cache
pragma
no-cache
expires
0
access-control-allow-origin
*
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length
49
date
Sat, 14 Mar 2026 06:20:46 GMT
content-type
image/gif

Redirect headers

strict-transport-security
max-age=31536000 ; includeSubDomains
cache-control
no-cache
location
https://bcp.crwdcntrl.net/map/ct=y/c=7625/tp=SIMP/tpid=7BCE36D896B24D3E9FFB9A9004C0C77F
pragma
no-cache
expires
0
p3p
CP=NOI DSP COR NID PSAa PSDa OUR UNI COM NAV
content-length
0
date
Sat, 14 Mar 2026 06:20:46 GMT
merge
ce.lijit.com/
Redirect Chain
  • https://um.simpli.fi/lj_match
  • https://ce.lijit.com/merge?pid=2&3pid=7BCE36D896B24D3E9FFB9A9004C0C77F
  • https://ce.lijit.com/merge?pid=2&3pid=7BCE36D896B24D3E9FFB9A9004C0C77F&dnr=1
43 B
391 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ce.lijit.com/merge?pid=2&3pid=7BCE36D896B24D3E9FFB9A9004C0C77F&dnr=1
Protocol
H2
Server
54.154.24.113 Dublin, Ireland, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ec2-54-154-24-113.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cache-control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
pragma
no-cache
expires
Fri, 20 Mar 2009 00:00:00 GMT
content-length
43
p3p
CP="CUR ADM OUR NOR STA NID"
date
Sat, 14 Mar 2026 06:20:46 GMT
content-type
image/gif
vary
Accept-Encoding

Redirect headers

cache-control
private, no-cache, no-store, must-revalidate, proxy-revalidate, max-age=0, s-maxage=0
location
https://ce.lijit.com/merge?pid=2&3pid=7BCE36D896B24D3E9FFB9A9004C0C77F&dnr=1
pragma
no-cache
expires
Fri, 20 Mar 2009 00:00:00 GMT
content-length
0
p3p
CP="CUR ADM OUR NOR STA NID"
date
Sat, 14 Mar 2026 06:20:46 GMT
vary
Accept-Encoding
sync
pippio.com/api/
Redirect Chain
  • https://um.simpli.fi/liveramp_match
  • https://idsync.rlcdn.com/419566.gif?partner_uid=7BCE36D896B24D3E9FFB9A9004C0C77F
  • https://idsync.rlcdn.com/1000.gif?memo=CO7NGRIrCicIARDuJBogN0JDRTM2RDg5NkIyNEQzRTlGRkI5QTkwMDRDMEM3N0YQABoNCL78080GEgUI6AcQAEIASgA
  • https://pippio.com/api/sync?pid=5324&it=1&iv=2b42d1c7c77af0b603a3367a60d62e12482a2e185ac7c51d6f0cb5e2286abbe6791426b5417dce21&_=2
42 B
571 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pippio.com/api/sync?pid=5324&it=1&iv=2b42d1c7c77af0b603a3367a60d62e12482a2e185ac7c51d6f0cb5e2286abbe6791426b5417dce21&_=2
Protocol
H2
Server
107.178.254.65 , United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
65.254.178.107.bc.googleusercontent.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cache-control
no-cache, no-store
timing-allow-origin
*
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length
42
date
Sat, 14 Mar 2026 06:20:46 GMT
content-type
image/gif

Redirect headers

cache-control
no-cache, no-store
timing-allow-origin
*
location
https://pippio.com/api/sync?pid=5324&it=1&iv=2b42d1c7c77af0b603a3367a60d62e12482a2e185ac7c51d6f0cb5e2286abbe6791426b5417dce21&_=2
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA"
content-length
0
date
Sat, 14 Mar 2026 06:20:46 GMT
/
www.google.co.il/pagead/1p-conversion/1026675585/
Redirect Chain
  • https://www.googleadservices.com/pagead/conversion/1026675585/?random=1773469245372&cv=7&fst=1773469245372&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON
  • https://googleads.g.doubleclick.net/pagead/viewthroughconversion/1026675585/?random=1752528150&cv=7&fst=1773469245372&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLT...
  • https://www.google.com/pagead/1p-conversion/1026675585/?random=1752528150&cv=7&fst=1773469245372&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLTesQII8d-xAgihuLECCLHB...
  • https://www.google.co.il/pagead/1p-conversion/1026675585/?random=1752528150&cv=7&fst=1773469245372&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLTesQII8d-xAgihuLECCL...
42 B
64 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://www.google.co.il/pagead/1p-conversion/1026675585/?random=1752528150&cv=7&fst=1773469245372&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLTesQII8d-xAgihuLECCLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgi0xrECCJPasQII29yxAgiH27ECCNPFsQII68yxAgjtzrECCNXPsQII9NqxAgiX1LECCMnbsQIIseGxAgiz4bECCKbdsQIIsN6xAg&cerd=CgSI3b0t&fsk=ChEI8OvOzQYQtqmjsqjx5qviARIsAF5ryEC4ZQ4YfUQJ9En4NFQUJVRnlck7E4peGUBwFwjYB_ArpkwR8zFRpowaAuoL&is_vtc=1&cid=CAQSvwEA56J1eXvf99l3irOkOkHqLtueQWC4fdMwGpnvpJwTWpuUdTKQ0qah5KvK9Ec3e_INqjABO7ODXvifvX4LR4dRwzjrgh8kfAPeLrtZ5TV2OBWRPML3GTGntJBD4JfLub2fECNz5Qiy5mVYehmMJ1-TySPsOxNWFm7EmLdVgQ9DHr9vHHcz831tJmGORvYB4xDIPlhnGUD-8kw_XitYjorxUavEO99KIoQYQic8CBAUSQkepi8LYXV9nshNjC09Eg&random=3162843267&ipr=y&pscrd=IhMI9ciY49-ekwMVOUUdCR2g_hu8MgwIA2IICAAQABgAIAAyDAgEYggIABAAGAAgADIMCAdiCAgAEAAYACAAMgwICGIICAAQABgAIAAyDAgJYggIABAAGAAgADIMCApiCAgAEAAYACAAMgwIAmIICAAQABgAIAAyDAgLYggIABAAGAAgADIMCBViCAgAEAAYACAAMgwIH2IICAAQABgAIAAyDAgTYggIABAAGAAgADIMCBJiCAgAEAAYACAAOokBaHR0cHM6Ly93d3cuY3liZXJhcmsuY29tL3Jlc291cmNlcy90aHJlYXQtcmVzZWFyY2gtYmxvZy9nb2xkZW4tc2FtbC1uZXdseS1kaXNjb3ZlcmVkLWF0dGFjay10ZWNobmlxdWUtZm9yZ2VzLWF1dGhlbnRpY2F0aW9uLXRvLWNsb3VkLWFwcHN6DAgJYggIABAAGAAgAIIBAnAB
Protocol
H3
Server
172.217.16.195 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
tzfraa-at-in-f3.1e100.net
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Content-Security-Policy script-src 'none'; object-src 'none'
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

content-security-policy
script-src 'none'; object-src 'none'
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
42
date
Sat, 14 Mar 2026 06:20:45 GMT
x-xss-protection
0
content-type
image/gif
server
cafe

Redirect headers

content-security-policy
script-src 'none'; object-src 'none'
cache-control
no-cache, no-store, must-revalidate
timing-allow-origin
*
location
https://www.google.co.il/pagead/1p-conversion/1026675585/?random=1752528150&cv=7&fst=1773469245372&fmt=3&value=0&label=eGG0CO2U2AIQgafH6QM&guid=ON&ct_cookie_present=false&crd=CLTesQII8d-xAgihuLECCLHBsQIIsMGxAgixw7ECCIrFsQIIwsmxAgi0xrECCJPasQII29yxAgiH27ECCNPFsQII68yxAgjtzrECCNXPsQII9NqxAgiX1LECCMnbsQIIseGxAgiz4bECCKbdsQIIsN6xAg&cerd=CgSI3b0t&fsk=ChEI8OvOzQYQtqmjsqjx5qviARIsAF5ryEC4ZQ4YfUQJ9En4NFQUJVRnlck7E4peGUBwFwjYB_ArpkwR8zFRpowaAuoL&is_vtc=1&cid=CAQSvwEA56J1eXvf99l3irOkOkHqLtueQWC4fdMwGpnvpJwTWpuUdTKQ0qah5KvK9Ec3e_INqjABO7ODXvifvX4LR4dRwzjrgh8kfAPeLrtZ5TV2OBWRPML3GTGntJBD4JfLub2fECNz5Qiy5mVYehmMJ1-TySPsOxNWFm7EmLdVgQ9DHr9vHHcz831tJmGORvYB4xDIPlhnGUD-8kw_XitYjorxUavEO99KIoQYQic8CBAUSQkepi8LYXV9nshNjC09Eg&random=3162843267&ipr=y&pscrd=IhMI9ciY49-ekwMVOUUdCR2g_hu8MgwIA2IICAAQABgAIAAyDAgEYggIABAAGAAgADIMCAdiCAgAEAAYACAAMgwICGIICAAQABgAIAAyDAgJYggIABAAGAAgADIMCApiCAgAEAAYACAAMgwIAmIICAAQABgAIAAyDAgLYggIABAAGAAgADIMCBViCAgAEAAYACAAMgwIH2IICAAQABgAIAAyDAgTYggIABAAGAAgADIMCBJiCAgAEAAYACAAOokBaHR0cHM6Ly93d3cuY3liZXJhcmsuY29tL3Jlc291cmNlcy90aHJlYXQtcmVzZWFyY2gtYmxvZy9nb2xkZW4tc2FtbC1uZXdseS1kaXNjb3ZlcmVkLWF0dGFjay10ZWNobmlxdWUtZm9yZ2VzLWF1dGhlbnRpY2F0aW9uLXRvLWNsb3VkLWFwcHN6DAgJYggIABAAGAAgAIIBAnAB
pragma
no-cache
cross-origin-resource-policy
cross-origin
x-content-type-options
nosniff
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
content-length
42
date
Sat, 14 Mar 2026 06:20:45 GMT
x-xss-protection
0
content-type
image/gif
server
cafe
spotx_match
um.simpli.fi/ 		0
272 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://um.simpli.fi/spotx_match
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
34.7.37.3 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
3.37.7.34.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

access-control-allow-methods
GET, POST, OPTIONS
strict-transport-security
max-age=63072000; includeSubdomains; preload
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
access-control-allow-origin
*
date
Sat, 14 Mar 2026 06:20:45 GMT
x-content-type-options
nosniff
setuid
ib.adnxs.com/
Redirect Chain
  • https://um.simpli.fi/an
  • https://ib.adnxs.com/setuid?entity=66&code=7BCE36D896B24D3E9FFB9A9004C0C77F
43 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://ib.adnxs.com/setuid?entity=66&code=7BCE36D896B24D3E9FFB9A9004C0C77F
Protocol
H2
Server
37.252.171.21 Frankfurt am Main, Germany, ASN29990 (ASN-APPNEXUS - Xandr Inc., US),
Reverse DNS
1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net
Software
nginx/1.25.5 /
Resource Hash
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
Security Headers
Name Value
X-Xss-Protection 0

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cache-control
no-store, no-cache, private
pragma
no-cache
accept-ch
Sec-CH-UA-Full-Version-List,Sec-CH-UA-Arch,Sec-CH-UA-Model,Sec-CH-UA-Platform-Version,Sec-CH-UA-Bitness
x-proxy-origin
31.187.78.194; 31.187.78.194; 1004.bm-nginx-loadbalancer.mgmt.fra1.adnexus.net; *.adnxs.com
expires
Sat, 15 Nov 2008 16:00:00 GMT
an-x-request-uuid
4bf49460-43dc-4c18-a1cb-60e2e7a6aa97
content-length
43
p3p
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
date
Sat, 14 Mar 2026 06:20:46 GMT
x-xss-protection
0
content-type
image/gif
server
nginx/1.25.5

Redirect headers

strict-transport-security
max-age=63072000; includeSubdomains; preload
cache-control
no-cache
location
https://ib.adnxs.com/setuid?entity=66&code=7BCE36D896B24D3E9FFB9A9004C0C77F
x-content-type-options
nosniff
access-control-allow-methods
GET, POST, OPTIONS
expires
Fri, 13 Mar 2026 06:20:45 GMT
access-control-allow-origin
*
content-length
142
date
Sat, 14 Mar 2026 06:20:45 GMT
content-type
text/html
server
openresty
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
tap.php
pixel.rubiconproject.com/
Redirect Chain
  • https://um.simpli.fi/rb_match
  • https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=7BCE36D896B24D3E9FFB9A9004C0C77F&expires=365
42 B
1 KB 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=7BCE36D896B24D3E9FFB9A9004C0C77F&expires=365
Protocol
HTTP/1.1
Server
69.173.144.138 , Germany, ASN26667 (RUBICONPROJECT - Magnite, Inc., US),
Reverse DNS
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

Expires
0
Cache-Control
no-cache,no-store,must-revalidate
P3P
CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-RPHost
08d2322ff6a2719f13397777e30d0962
Pragma
no-cache
content-length
42
Content-Type
image/gif

Redirect headers

strict-transport-security
max-age=63072000; includeSubdomains; preload
cache-control
no-cache
location
https://pixel.rubiconproject.com/tap.php?v=6286&nid=2132&put=7BCE36D896B24D3E9FFB9A9004C0C77F&expires=365
x-content-type-options
nosniff
access-control-allow-methods
GET, POST, OPTIONS
expires
Fri, 13 Mar 2026 06:20:45 GMT
access-control-allow-origin
*
content-length
142
date
Sat, 14 Mar 2026 06:20:45 GMT
content-type
text/html
server
openresty
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type
sd
us-u.openx.net/w/1.0/
Redirect Chain
  • https://um.simpli.fi/ox_match
  • https://us-u.openx.net/w/1.0/sd?id=537072966&val=7BCE36D896B24D3E9FFB9A9004C0C77F
  • https://us-u.openx.net/w/1.0/sd?cc=1&id=537072966&val=7BCE36D896B24D3E9FFB9A9004C0C77F
43 B
171 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://us-u.openx.net/w/1.0/sd?cc=1&id=537072966&val=7BCE36D896B24D3E9FFB9A9004C0C77F
Protocol
H2
Server
35.244.159.8 Kansas City, United States, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
8.159.244.35.bc.googleusercontent.com
Software
/
Resource Hash
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cache-control
private, max-age=0, no-cache
pragma
no-cache
x-forwarded-for
31.187.78.194
via
1.1 google
expires
Mon, 26 Jul 1997 05:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
43
p3p
CP="CUR ADM OUR NOR STA NID"
date
Sat, 14 Mar 2026 06:20:45 GMT
content-type
image/gif
vary
Accept

Redirect headers

location
https://us-u.openx.net/w/1.0/sd?cc=1&id=537072966&val=7BCE36D896B24D3E9FFB9A9004C0C77F
x-forwarded-for
31.187.78.194
via
1.1 google
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
content-length
0
p3p
CP="CUR ADM OUR NOR STA NID"
date
Sat, 14 Mar 2026 06:20:45 GMT
content-type
text/plain; charset=utf-8
vary
Origin
g_match
um.simpli.fi/
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_cm&google_sc
  • https://um.simpli.fi/g_match?id=&google_gid=CAESEG0GUjdLWDKrZlv-_dcA2K8&google_cver=1
  • https://cm.g.doubleclick.net/pixel?google_nid=simplifi&google_hm=7BCE36D896B24D3E9FFB9A9004C0C77F
  • https://um.simpli.fi/g_match?id=
0
320 B 		Image
General
Check archive.org
Download Go to Show image
Full URL
https://um.simpli.fi/g_match?id=
Protocol
H2
Server
34.7.37.3 Groningen, Netherlands, ASN396982 (GOOGLE-CLOUD-PLATFORM - Google LLC, US),
Reverse DNS
3.37.7.34.bc.googleusercontent.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubdomains; preload
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

strict-transport-security
max-age=63072000; includeSubdomains; preload
cache-control
no-cache
access-control-allow-methods
GET, POST, OPTIONS
x-content-type-options
nosniff
expires
Fri, 13 Mar 2026 06:20:46 GMT
access-control-allow-origin
*
date
Sat, 14 Mar 2026 06:20:46 GMT
access-control-allow-headers
DNT,X-Mx-ReqToken,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type

Redirect headers

cache-control
no-cache, must-revalidate
location
https://um.simpli.fi/g_match?id=
pragma
no-cache
cross-origin-resource-policy
cross-origin
expires
Fri, 01 Jan 1990 00:00:00 GMT
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
content-length
229
date
Sat, 14 Mar 2026 06:20:45 GMT
x-xss-protection
0
content-type
text/html; charset=UTF-8
server
HTTP server (unknown)
universal_pixel.js
js.adsrvr.org/ Frame 92F6 		422 B
958 B 		Script
General
Check archive.org
Download Go to
Full URL
https://js.adsrvr.org/universal_pixel.js
Requested by
Host: insight.adsrvr.org
URL: https://insight.adsrvr.org/track/cei?advertiser_id=db8v4fb&cookie_sync=1&upv=3.0.0&upid=2kfe2lm&ref=https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_128_GCM
Server
18.172.114.101 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-172-114-101.fra60.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
2538590b87a5eb44bb27a7a5039451a5606d80c587cb361de40ed4193c9a552f

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://insight.adsrvr.org/

Response headers

Vary
accept-encoding
ETag
"4e7de5ca0248ffa6216174e643f3112d"
Age
13341
Connection
keep-alive
Via
1.1 e2239bbca97bdb08942ca2cd020caca8.cloudfront.net (CloudFront)
Accept-Ranges
bytes
X-Cache
Hit from cloudfront
Content-Length
422
X-Amz-Cf-Id
SFxqHboroPPfG84icddGXxtFuA9kbuUWgeFtYzCtf6A1aijy1W56FA==
Date
Sat, 14 Mar 2026 02:38:25 GMT
Content-Type
application/javascript
Last-Modified
Sun, 08 Mar 2026 12:04:56 GMT
Server
AmazonS3
X-Amz-Cf-Pop
FRA60-P8
x-amz-server-side-encryption
AES256
generic
match.adsrvr.org/track/cmf/ Frame 67BF
Redirect Chain
  • https://simage2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTI4NDkmdGw9MTI5NjAw&gdpr=0&gdpr_consent=&piggybackCookie=84287645-639f-44a7-be57-32558b730d7e&r=https%3A%2F%2Fmatch.adsrvr.org%2...
  • https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic
70 B
571 B 		Document
General
Check archive.org
Download Go to
Full URL
https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic
Requested by
Host: insight.adsrvr.org
URL: https://insight.adsrvr.org/track/cei?advertiser_id=db8v4fb&cookie_sync=1&upv=3.0.0&upid=2kfe2lm&ref=https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.223.40.198 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
Kestrel /
Resource Hash
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0

Request headers

Referer
https://insight.adsrvr.org/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36

Response headers

content-length
70
content-type
image/gif
date
Sat, 14 Mar 2026 06:20:45 GMT
server
Kestrel

Redirect headers

cache-control
no-store, no-cache, private
date
Sat, 14 Mar 2026 06:20:45 GMT
location
https://match.adsrvr.org/track/cmf/generic?ttd_pid=pubmatic
p3p
CP="NOI DSP COR LAW CUR ADMo DEVo TAIo PSAo PSDo IVAo IVDo HISo OTPo OUR SAMo BUS UNI COM NAV INT DEM CNT STA PRE LOC"
server
nginx
strict-transport-security
max-age=16070400; includeSubDomains
RCa5164e12c82447adb2cd80d0c9b8bb38-source.min.js
assets.adobedtm.com/789d877fe9a8/09207f0a9c44/eb0d9e0e24f2/ 		504 B
605 B 		Script
General
Check archive.org
Download Go to
Full URL
https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/eb0d9e0e24f2/RCa5164e12c82447adb2cd80d0c9b8bb38-source.min.js
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/789d877fe9a8/09207f0a9c44/launch-e8e6adf0fe30.min.js
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
23.52.181.12 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS - Akamai Technologies, Inc., US),
Reverse DNS
a23-52-181-12.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
330952ab82d0d42fdf24e29f35b5b1565d2e5458713a3783300ddece550e68ae
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cache-control
max-age=3600
timing-allow-origin
*
content-encoding
gzip
etag
"79072e67e3bfc87a7e6a64634a830954:1762975007.123862"
x-content-type-options
nosniff
expires
Sat, 14 Mar 2026 07:20:45 GMT
accept-ranges
bytes
access-control-allow-origin
https://www.cyberark.com
content-length
324
date
Sat, 14 Mar 2026 06:20:45 GMT
content-type
application/x-javascript
last-modified
Wed, 12 Nov 2025 19:16:47 GMT
server
AkamaiNetStorage
vary
Accept-Encoding
visitor
sjrtp6.marketo.com/gw1/rtp/api/v1_1/ 		831 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://sjrtp6.marketo.com/gw1/rtp/api/v1_1/visitor?sid=cyberarksoftware-1773469241390-0aa249d6&aid=cyberarksoftware&1773469245643
Requested by
Host: rtp-static.marketo.com
URL: https://rtp-static.marketo.com/rtp/libs/ga-integration-2.0.5.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.28.164.244 , United States, ASN15224 (OMNITURE - Adobe Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
159782eec3137c4cb3daf25fda51de32b3f3d47de97374c46309e005503ca099

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

Transfer-Encoding
chunked
Cache-Control
no-store, no-cache, must-revalidate, max-age=0, post-check=0, pre-check=0
Content-Encoding
gzip
Pragma
No-cache
Connection
keep-alive
Access-Control-Allow-Credentials
true
Expires
Thu, 01 Jan 1970 00:00:00 GMT
Access-Control-Allow-Origin
https://www.cyberark.com
Keep-Alive
timeout=2
Date
Sat, 14 Mar 2026 06:20:46 GMT
Content-Type
application/json
Last-Modified
Sat Mar 14 01:20:46 CDT 2026
Server
nginx
Vary
Origin
sgm
sjrtp6.marketo.com/gw1/ga/ 		982 B
1 KB 		XHR
General
Check archive.org
Download Go to
Full URL
https://sjrtp6.marketo.com/gw1/ga/sgm?sid=cyberarksoftware-1773469241390-0aa249d6&1773469245644
Requested by
Host: rtp-static.marketo.com
URL: https://rtp-static.marketo.com/rtp/libs/ga-integration-2.0.5.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
192.28.164.244 , United States, ASN15224 (OMNITURE - Adobe Inc., US),
Reverse DNS
Software
nginx /
Resource Hash
46e9c53019a1d7eba71e11a7490a952f41e6ee3bb718d8abdb3ead7c6d87df7a

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

Cache-Control
no-cache
Connection
keep-alive
Access-Control-Allow-Origin
*
Content-Length
982
Keep-Alive
timeout=2
Date
Sat, 14 Mar 2026 06:20:46 GMT
Content-Type
text/json;charset=utf-8
Server
nginx
favicon.svg
cihost.uberflip.com/cyberArk/favicon-update/assets/favicons/ 		1 KB
1 KB 		Other
General
Check archive.org
Download Go to
Full URL
https://cihost.uberflip.com/cyberArk/favicon-update/assets/favicons/favicon.svg
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.173.205.109 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
server-18-173-205-109.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
3c94e227340e9e5b88730462cc4d35f5c5e0061b788a3dde696588f40b5cc864

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

vary
accept-encoding
content-encoding
gzip
x-amz-meta-s3cmd-attrs
atime:1733772036/ctime:1733772036/gid:127/gname:docker/md5:d888d7e0544aef4a91b8468ecf55911e/mode:33188/mtime:1733772036/uid:1001/uname:runner
etag
W/"d888d7e0544aef4a91b8468ecf55911e"
via
1.1 0140ca34c2d577c2578595f0c9e0050e.cloudfront.net (CloudFront)
x-cache
RefreshHit from cloudfront
x-amz-cf-id
WNUnMYZ14u2swvHPlHvX23pS1rO1VKFrRp2Yh33IYolTzqui2R3CoA==
date
Sat, 14 Mar 2026 06:20:47 GMT
content-type
image/svg+xml
last-modified
Mon, 09 Dec 2024 19:22:12 GMT
server
AmazonS3
x-amz-cf-pop
FRA56-P12
x-amz-server-side-encryption
AES256
s04191424633876
cyberark.sc.omtrdc.net/b/ss/cyberarkproduction/1/JS-2.27.0-LEWM/ 		43 B
387 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://cyberark.sc.omtrdc.net/b/ss/cyberarkproduction/1/JS-2.27.0-LEWM/s04191424633876
Requested by
Host: assets.adobedtm.com
URL: https://assets.adobedtm.com/extensions/EP31dbb9c60e404ba1aa6e746d49be6f29/AppMeasurement.min.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
63.140.62.210 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
ip-63-140-62-210.data.adobedc.net
Software
jag /
Resource Hash
55c9d2f019f9d7ddfd69b2ad0351c5617338a222362aebb02b3b98a4dbc18486
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Content-Type
application/x-www-form-urlencoded
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cache-control
no-cache, no-store, max-age=0, no-transform, private
pragma
no-cache
etag
3808496208091250688-4613846145932897758
access-control-allow-credentials
true
x-content-type-options
nosniff
expires
Fri, 13 Mar 2026 06:20:46 GMT
access-control-allow-origin
https://www.cyberark.com
p3p
CP="This is not a P3P policy"
content-length
43
date
Sat, 14 Mar 2026 06:20:46 GMT
x-xss-protection
1; mode=block
last-modified
Sun, 15 Mar 2026 06:20:46 GMT
vary
*
server
jag
content-type
image/gif;charset=utf-8
mon
obs.segreencolumn.com/ 		0
39 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://obs.segreencolumn.com/mon
Requested by
Host: ob.segreencolumn.com
URL: https://ob.segreencolumn.com/i/84cf3062f98cbab994d639a975b2798e.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
50.16.211.97 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-50-16-211-97.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Content-Type
application/x-www-form-urlencoded
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

access-control-allow-origin
https://www.cyberark.com
content-length
0
date
Sat, 14 Mar 2026 06:20:46 GMT
content-type
application/json
access-control-allow-credentials
true
access-control-allow-methods
GET,HEAD,PUT,PATCH,POST,DELETE
realtimeconversion
insight.adsrvr.org/track/ 		36 B
350 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://insight.adsrvr.org/track/realtimeconversion
Requested by
Host: js.adsrvr.org
URL: https://js.adsrvr.org/up_loader.1.1.0.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.223.40.198 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
Kestrel /
Resource Hash
15a3dc247a9802298e21568c4d7d501a6236c246e9a2257177799a5400844740

Request headers

Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
eventDataSourceVersion
3.0.0
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Content-type
application/json
eventDataSource
JsSdk

Response headers

content-encoding
gzip
access-control-allow-credentials
true
access-control-allow-origin
https://www.cyberark.com
date
Sat, 14 Mar 2026 06:20:46 GMT
content-type
application/json
vary
Accept-Encoding
server
Kestrel
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept, x-integration-type
realtimeconversion
insight.adsrvr.org/track/ Frame 		0
0 		Preflight
General
Check archive.org
Download Go to
Full URL
https://insight.adsrvr.org/track/realtimeconversion
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.223.40.198 , United States, ASN16509 (AMAZON-02 - Amazon.com, Inc., US),
Reverse DNS
a6370ebea231e0c9a.awsglobalaccelerator.com
Software
Kestrel /
Resource Hash

Request headers

Accept
*/*
Access-Control-Request-Headers
content-type,eventdatasource,eventdatasourceversion
Access-Control-Request-Method
POST
Origin
https://www.cyberark.com
Sec-Fetch-Mode
cors
User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36

Response headers

access-control-allow-credentials
true
access-control-allow-headers
Origin, X-Requested-With, Content-Type, Content-Length, Content-Encoding, Vary, Cache-Control, Accept, ttdSignature, eventDataSource, eventDataSourceVersion
access-control-allow-origin
https://www.cyberark.com
content-encoding
gzip
content-type
application/json
date
Sat, 14 Mar 2026 06:20:46 GMT
server
Kestrel
vary
Accept-Encoding
mon
obs.segreencolumn.com/ 		0
39 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://obs.segreencolumn.com/mon
Requested by
Host: ob.segreencolumn.com
URL: https://ob.segreencolumn.com/i/84cf3062f98cbab994d639a975b2798e.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
50.16.211.97 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-50-16-211-97.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Content-Type
application/x-www-form-urlencoded
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

access-control-allow-origin
https://www.cyberark.com
content-length
0
date
Sat, 14 Mar 2026 06:20:47 GMT
content-type
application/json
access-control-allow-credentials
true
access-control-allow-methods
GET,HEAD,PUT,PATCH,POST,DELETE
mon
obs.segreencolumn.com/ 		0
39 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://obs.segreencolumn.com/mon
Requested by
Host: ob.segreencolumn.com
URL: https://ob.segreencolumn.com/i/84cf3062f98cbab994d639a975b2798e.js
Protocol
H2
Security
TLS 1.2, ECDHE_ECDSA, AES_256_GCM
Server
50.16.211.97 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-50-16-211-97.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Content-Type
application/x-www-form-urlencoded
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

access-control-allow-origin
https://www.cyberark.com
content-length
0
date
Sat, 14 Mar 2026 06:20:51 GMT
content-type
application/json
access-control-allow-credentials
true
access-control-allow-methods
GET,HEAD,PUT,PATCH,POST,DELETE
js_tracking
tags.srv.stackadapt.com/ 		0
152 B 		XHR
General
Check archive.org
Download Go to
Full URL
https://tags.srv.stackadapt.com/js_tracking?url=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fgolden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps&uid=jVuggUzL4Z1pNoK2f21A_Q&v=1&host=https%3A%2F%2Fwww.cyberark.com&l_src=&l_src_d=&u_src=&u_src_d=&shop=false
Requested by
Host: tags.srv.stackadapt.com
URL: https://tags.srv.stackadapt.com/events.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
3.229.217.25 Ashburn, United States, ASN14618 (AMAZON-AES - Amazon.com, Inc., US),
Reverse DNS
ec2-3-229-217-25.compute-1.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

access-control-allow-headers
*
access-control-allow-origin
https://www.cyberark.com
date
Sat, 14 Mar 2026 06:20:51 GMT
access-control-allow-credentials
true
access-control-allow-methods
GET
collect
analytics.google.com/g/ 		0
0 		Fetch
General
Check archive.org
Download Go to
Full URL
https://analytics.google.com/g/collect?v=2&tid=G-XTLTD7RKN5&gtm=45je63b1v9135218693za20g&_p=1773469238798&gcd=13l3l3l3l2l1&npa=0&dma=0&ul=he-il&sr=1600x1200&cid=806338685.1773469242&_ng=1&ir=1&uaa=&uab=&uafvl=&uamb=0&uam=&uap=&uapv=&uaw=0&are=1&frm=0&pscdl=noapi&_eu=EBAIAGQ&tag_exp=103116026~103200004~115938465~115938469~116024733~117484252&dl=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fgolden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps&dt=Golden%20SAML%3A%20Newly%20Discovered%20Attack%20Technique%20Forges%20Authentication%20to%20Cloud%20Apps&sid=1773469242&sct=1&seg=0&_tu=wAQ&_s=2&tfd=13878
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-XTLTD7RKN5&cx=c&_slc=1
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
216.239.36.181 , United States, ASN15169 (GOOGLE - Google LLC, US),
Reverse DNS
Software
Golfe2 /
Resource Hash

Request headers

User-Agent
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Content-Type
text/plain;charset=UTF-8
Referer
https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps

Response headers

cache-control
no-cache, no-store, must-revalidate
pragma
no-cache
cross-origin-resource-policy
cross-origin
access-control-allow-credentials
true
content-security-policy-report-only
script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/ascnsrsggc:171:0
report-to
{"group":"ascnsrsggc:171:0","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/ascnsrsggc:171:0"}],}
expires
Fri, 01 Jan 1990 00:00:00 GMT
access-control-allow-origin
https://www.cyberark.com
cross-origin-opener-policy-report-only
same-origin; report-to=ascnsrsggc:171:0
content-length
0
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
date
Sat, 14 Mar 2026 06:20:51 GMT
content-type
text/plain
server
Golfe2

Failed requests

These URLs were requested, but there was no response received. You will also see them in the list above.

Domain
www.cyberark.com
URL
blob:https://www.cyberark.com/ebc2147d-27c2-46b5-85f6-1c56ce39c897
Domain
id.rlcdn.com
URL
https://id.rlcdn.com/464526.gif

Verdicts & Comments Add Verdict or Comment

181 JavaScript Window variables

These are the non-standard variables defined on the window object. These include var declarations and global functions and can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 object| 2 object| 3 object| 4 object| 5 object| 6 object| dataLayer object| ubermenu_data object| EnlighterJS object| Hubs function| g_iFrameLoadDataCallback function| g_iFrameScrollCallback object| frontEndPage object| __core-js_shared__ object| core function| setImmediate function| clearImmediate object| regeneratorRuntime boolean| _babelPolyfill object| Shared object| MBP object| html5 function| _ function| ufa object| Modernizr function| jQuery function| $ function| imagesLoaded function| getBomboraUuid function| getBomboraUrlId object| _ml function| loadMarketoTracking object| Munchkin object| obData function| getMatchingTileTag boolean| onbrandLoaded string| ufPageTitle string| prefix object| tagArray function| firstSubmission function| secondarySubmission function| persistParams function| getQueryString object| queryString function| submitQueryStrings object| urlArray function| stateControl function| previewField function| thirdPartyCTA function| thirdPartyCtaLink function| uber_supports function| uber_op function| uberMenu_openMega function| uberMenu_openFlyout function| uberMenu_close function| uberMenu_redrawSubmenus function| flexTable function| sha256 function| sha224 object| psArray object| topicArray object| industryArray object| typeArray object| stageArray object| personaArray string| tagPrefix object| ufTagArray object| digital_data number| imageCount object| _satellite boolean| __satelliteLoaded object| adobe function| Visitor object| s_c_il number| s_c_in object| __target_telemetry object| ___target_traces function| mboxCreate function| mboxDefine function| mboxUpdate function| mktoMunchkinFunction function| mktoMunchkin function| __ctcg_ct_45375_exec function| AppMeasurement function| s_gi function| s_pgicq function| AppMeasurement_Module_ActivityMap object| s boolean| __formStartBound object| google_tag_manager function| postscribe object| google_tag_manager_external object| google_tag_data function| rtp function| rdt object| _linkedin_data_partner_ids boolean| _already_called_lintrk object| _wq object| __dispatched__ function| fbq function| _fbq function| saq function| _saq function| onYouTubeIframeAPIReady string| GoogleAnalyticsObject function| ga object| MunchkinTracker object| input object| GooglebQhCsO function| gtag object| ensBootstraps object| Bootstrapper object| sifi_att_42656 object| LanguageSelector object| truste function| shouldRepop function| shouldResolveConsent object| $temp_box_overlay_border object| $temp_closebtn_style string| $temp_externalcss string| userType function| redditNormalizeEmail function| lintrk object| ORIBILI object| _cq function| getInternetExplorerVersion function| consoleMessage function| makeGetRequest function| createCORSRequest object| ITLocalStorageAPI object| InsighteraUtil object| iiq object| ibq object| trackObj function| isCurrentSession function| addDynamicScript function| rtpRCMD object| AITag object| aiq object| AIConfig function| setButtonWidthHeight function| getDirectionForWidgetSide function| updateWidget function| initialize function| showWidgetCampaign function| hideWidgetCampaign function| injectContent function| execute function| destroy object| InsighteraWidget function| setTimeoutFunction object| exp_2_year function| loadRichMediaImage object| TTDConversionEvents object| ttdConversionEventsLayer object| ttdConversionEvents function| ttd_dom_ready function| TTDUniversalPixelApi object| ttd_up_api object| dpmPixels object| Demandbase function| _truste_eu object| PREF_MGR_API_DEBUG object| PrivacyManagerAPI object| TRUSTE_CMAPI_DEBUG object| gaplugins object| gaGlobal object| gaData object| res object| saCookies string| current_window_url_param function| extUrl function| alignElementPosition function| applyAttributeHeightToPics function| revertAttributeHeightToPics function| cookieWrite function| cookieRead string| g number| s_loadT object| s_i_cyberarkproduction

110 Cookies

Domain/Path Name / Value
www.cyberark.com/ Name: _MGZ_
Value: 9c1t6dibb0s0m7be3i9q98ja2g
.cyberark.com/ Name: __cf_bm
Value: 5_GckNCt_wAiyLiVLuU3q.IRSxeevs7n5WVoWOwzqqw-1773469238-1.0.1.1-mBr12WzRw3IuJBAqj.8EvpZnzssEgiyuqVCax724ywfDDiloju0uBxwoj6UFHkfcBBGaqoxcOn2OtDW6o.AbzlmlMR2B0JnRvq07hwatGOM
.www.cyberark.com/ Name: _ufav
Value: 75e6c1608fd24789b5c76b254a9a9c4f
.www.cyberark.com/ Name: _ufas
Value: 35161811fc4b4fc8a974f0445f6242c2
www.cyberark.com/ Name: ufentry
Value: 20260314.025040
.cyberark.com/ Name: at_check
Value: true
.cyberark.com/ Name: cf_clearance
Value: oS61xRiMncqVTr2knu.rZ94QReSeL5uyqjiIUGzpXKY-1773469240-1.2.1.1-brRiUgqwixFyKOWXQzCX7xXibcS97CHsy0hNaFbBOnxkopt2MOBTnwasRVijoyBJ3fclnzPTHxp7k8NTtIxqSoQk4afHrkC9tmHQxVaFmH7tQ21ohCqdmBrwAdYwW5SeUUljo6RQQhyzCfByvW1M9RkHrAL_rs9P3l_lrH9abl0LL8C93WHU_nlSSnauueBBYiuYWxIC5eap4Pp2NKriA9RA9VnsPo4f01OzMS_vGI8
.cyberark.com/ Name: _cq_duid
Value: 1.1773469240.fO97Q6EPqr5ByTFp
.cyberark.com/ Name: _cq_suid
Value: 1.1773469240.6Gway8iNmoQkXQxj
.cyberark.com/ Name: _gcl_au
Value: 1.1.314487143.1773469241
.cyberark.com/ Name: _mkto_trk
Value: id:316-CZP-275&token:_mch-cyberark.com-54f3d736a7be1eb78939b03286739e4d
.demdex.net/ Name: demdex
Value: 40063168363633222981499930872278632852
.cyberark.com/ Name: AMCVS_9AB97041603F3EDB0A495C66%40AdobeOrg
Value: 1
.simpli.fi/ Name: suid
Value: 7BCE36D896B24D3E9FFB9A9004C0C77F
.cyberark.com/ Name: TAsessionID
Value: 87aa5fbc-318c-44f5-8a05-afc58d3311a8|NEW
.cyberark.com/ Name: notice_behavior
Value: implied,us
.cyberark.com/ Name: _rdt_uuid
Value: 1773469241012.37c60f73-514c-4dc9-8d2a-15c646911490
obs.segreencolumn.com/ Name: cg_uuid
Value: ff6c7aef678e1a4b9835bffb59b9847b
tags.srv.stackadapt.com/ Name: sa-user-id
Value: s%3A0-f09a09db-3f54-5f93-5616-041afeaa0e2f.X4vsyPrwDlmrNSUWxLmvzY3r7PuDZcmx59XGDazHh5Q
.srv.stackadapt.com/ Name: sa-user-id
Value: s%3A0-f09a09db-3f54-5f93-5616-041afeaa0e2f.X4vsyPrwDlmrNSUWxLmvzY3r7PuDZcmx59XGDazHh5Q
tags.srv.stackadapt.com/ Name: sa-user-id-v2
Value: s%3A8JoJ2z9UX5NWFgQa_qoOLx-7TsI.US7EsDUNQid8fexZaE53AtPv1%2Fv%2BU%2FT36yFmsN0USLI
.srv.stackadapt.com/ Name: sa-user-id-v2
Value: s%3A8JoJ2z9UX5NWFgQa_qoOLx-7TsI.US7EsDUNQid8fexZaE53AtPv1%2Fv%2BU%2FT36yFmsN0USLI
tags.srv.stackadapt.com/ Name: sa-user-id-v3
Value: s%3AAQAKINAbTgZlB4vQaXQZotPspsvy7wMqFcWwV2HT4l6RErkwENYBGAQgufzTzQYwAToEvry6bkIEnpTIkA.cmmdGVjVpIll%2BH0nnI70pwOnLmW5r%2F0Pu81HlJh%2B3xw
.srv.stackadapt.com/ Name: sa-user-id-v3
Value: s%3AAQAKINAbTgZlB4vQaXQZotPspsvy7wMqFcWwV2HT4l6RErkwENYBGAQgufzTzQYwAToEvry6bkIEnpTIkA.cmmdGVjVpIll%2BH0nnI70pwOnLmW5r%2F0Pu81HlJh%2B3xw
www.cyberark.com/ Name: sa-user-id
Value: s%253A0-f09a09db-3f54-5f93-5616-041afeaa0e2f.X4vsyPrwDlmrNSUWxLmvzY3r7PuDZcmx59XGDazHh5Q
www.cyberark.com/ Name: sa-user-id-v2
Value: s%253A8JoJ2z9UX5NWFgQa_qoOLx-7TsI.US7EsDUNQid8fexZaE53AtPv1%252Fv%252BU%252FT36yFmsN0USLI
www.cyberark.com/ Name: sa-user-id-v3
Value: s%253AAQAKINAbTgZlB4vQaXQZotPspsvy7wMqFcWwV2HT4l6RErkwENYBGAQgufzTzQYwAToEvry6bkIEnpTIkA.cmmdGVjVpIll%252BH0nnI70pwOnLmW5r%252F0Pu81HlJh%252B3xw
.cyberark.com/ Name: mbox
Value: session#cd7bef2899e0480b98e2ae9f5e553dc9#1773471102|PC#cd7bef2899e0480b98e2ae9f5e553dc9.37_0#1836714042
.cyberark.com/ Name: _fbp
Value: fb.1.1773469241375.498538576211186309
.cyberark.com/ Name: trwv.uid
Value: cyberarksoftware-1773469241389-99881024%3A1
.cyberark.com/ Name: trwsa.sid
Value: cyberarksoftware-1773469241390-0aa249d6%3A1
.doubleclick.net/ Name: IDE
Value: AHWqTUmsz70jY0axMl0Y8XzD1dPdDr9oJxhfVp32dMmockvf2QwrrzUi-rt_R_0W
.linkedin.com/ Name: li_sugr
Value: ab721895-edbf-4fd9-a01b-89085af2ca2a
.linkedin.com/ Name: lidc
Value: "b=OGST06:s=O:r=O:a=O:p=O:g=3490:u=1:x=1:i=1773469241:t=1773555641:v=2:sig=AQGUwMdLB3juubvu3VcSwGRECMMgd8d5"
.linkedin.com/ Name: bcookie
Value: "v=2&4e4b0e77-7038-4db5-8cbf-c4c8f4e7b71c"
www.cyberark.com/ Name: dpm_url_count
Value: 1
.cyberark.com/ Name: _ga
Value: GA1.2.806338685.1773469242
.cyberark.com/ Name: _gid
Value: GA1.2.666271079.1773469242
.cyberark.com/ Name: _dc_gtm_UA-44168172-9
Value: 1
.bidr.io/ Name: bito
Value: AADHZ07TafwAAABiIg1fyg
.bidr.io/ Name: bitoIsSecure
Value: ok
.dpm.demdex.net/ Name: dpm
Value: 40063168363633222981499930872278632852
.cyberark.com/ Name: AMCV_9AB97041603F3EDB0A495C66%40AdobeOrg
Value: 179643557%7CMCIDTS%7C20527%7CMCMID%7C44261918306025195752172255391673065017%7CMCAAMLH-1774074040%7C6%7CMCAAMB-1774074040%7C6G1ynYcLPuiQxYZrsz_pkqfLG9yMXBpb2zX5dvJdYQJzPXImdj0y%7CMCOPTOUT-1773476440s%7CNONE%7CMCSYNCSOP%7C411-20534%7CvVersion%7C5.5.0
.linkedin.com/ Name: UserMatchHistory
Value: AQJEdraGwJ9LIAAAAZzrARGXUo_CdDX9I7RYjDKdPTuY8tx_0SaVYWOuOwuNSOPYzjgoBzoIgN1qbQ
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQKO_1U9-br2CAAAAZzrARGXgDJxOuBLLKPzl0YoPlzVZ7ZI1DPLZG0rczzEYuqkBeIwyqzvc0VJO8pLrHQsIA
.company-target.com/ Name: tuuid
Value: e650fb5c-3b88-46ca-a587-b6bf604d5b33
.company-target.com/ Name: tuuid_lu
Value: 1773469241|ix:0|mctv:0|rp:0
.www.linkedin.com/ Name: bscookie
Value: "v=1&2026031406204268690fed-cff5-43b4-848b-c12995b047bbAQG6x6BjYbpmOtuh9gq_Wb-nWOlDEPeU"
.linkedin.com/ Name: __cf_bm
Value: RXJY4NgQwNA2eDVWkGKyu84A4HF0KekHwvDLQbitGFA-1773469242-1.0.1.1-wLIUtjpaEEJx3onSy3NVvk1Cb2FafZqOF9NAbCGpBcK3jzoUNGYz2sHYBGChy96cBKmqk379lrgreXhdaEVLEoMwz2OZIx3YfVbq7jgZm5Y
.casalemedia.com/ Name: CMID
Value: abT.OosFVqUAEl40AAgKJAAA
.casalemedia.com/ Name: CMPS
Value: 4695
.casalemedia.com/ Name: CMPRO
Value: 4695
.adsrvr.org/ Name: TDID
Value: 84287645-639f-44a7-be57-32558b730d7e
.dpmsrv.com/ Name: dpm_pxl
Value: b863076be7e77cf344533ad11362ead94cd89ddb
www.cyberark.com/ Name: dpm_sid
Value: 019ceb01-1495-7b21-9047-25ddbb4b3632
www.cyberark.com/ Name: dpm_uid
Value: 019ceb01-1495-749d-8184-8287c6bd224e
.rubiconproject.com/ Name: khaos
Value: MMPXSPFK-1C-HB7P
.rubiconproject.com/ Name: khaos_p
Value: MMPXSPFK-1C-HB7P
.rubiconproject.com/ Name: receive-cookie-deprecation
Value: 1
.tremorhub.com/ Name: tvid
Value: 88cd156e8e24475c911da4550a5bfd5d
.tremorhub.com/ Name: tv_UIDM
Value: e650fb5c-3b88-46ca-a587-b6bf604d5b33
.mathtag.com/ Name: uuid
Value: d43a69b4-fe3b-4c00-a1aa-acae844db4b1
.adnxs.com/ Name: XANDR_PANID
Value: xY5wn3qh6f7fpVjMw37K9gbVSTEs4T8A1V1jvwFu6gHeTb2XnFh3jBnfswOKs-RlDxyUl1hBQt_IuzogWS9DNDf2XWZ-x4ogKWXMKDBJzPA.
.adnxs.com/ Name: uuid2
Value: 6262219618946998537
.bidswitch.net/ Name: tuuid
Value: a17a1391-522b-47c1-b3f7-7910d09cb5de
.bidswitch.net/ Name: c
Value: 1773469244
.bidswitch.net/ Name: tuuid_lu
Value: 1773469245
.simpli.fi/ Name: uid_syncd_secure
Value: true
.cyberark.com/ Name: gpv_c51
Value: https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fgolden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
.cyberark.com/ Name: s_nr30
Value: 1773469245795-New
.cyberark.com/ Name: s_cc
Value: true
.pubmatic.com/ Name: KRTBCOOKIE_377
Value: 6810-84287645-639f-44a7-be57-32558b730d7e&KRTB&22918-84287645-639f-44a7-be57-32558b730d7e&KRTB&22926-84287645-639f-44a7-be57-32558b730d7e&KRTB&23031-84287645-639f-44a7-be57-32558b730d7e
.pubmatic.com/ Name: PugT
Value: 1773469245
.adsrvr.org/ Name: TDCPM
Value: CAESEgoDYWFtEgsIjq3Rw8G09T4QBRIXCghhcHBuZXh1cxILCNqRvaz75oA_EAUSFQoGZ29vZ2xlEgsIzOHpsfvmgD8QBRIWCgdydWJpY29uEgsI7pXqsfvmgD8QBRIVCgZjYXNhbGUSCwi2k7C0--aAPxAFEhgKCWJpZHN3aXRjaBILCOa--rX75oA_EAUSFwoIcHVibWF0aWMSCwiKk7y---aAPxAFGAUgASgGMgsIhsC-65HngD8QBUIPIg0IARIJCgV0aWVyMhABWgdkYjh2NGZiYAE.
.adnxs.com/ Name: anj
Value: dTM7k!M4.FE:2jUF']wIg2In?f:Dtw!]tbp8i_jC:lq+Z*:3[eTM'@uVB_hvVCRgnQr=A_W#$Z@YW[RrQ9mhBa`j6Jc0Dy4_>UdU3PVX23nXm/!1)ZBc(W08
.rlcdn.com/ Name: rlas3
Value: HAy/dgtmZft4+LCtChAuxsCbt3AGg1djLtzQW10sUe8=
.rubiconproject.com/ Name: audit_p
Value: 1|OH/xENRmnnVWLG8EwKCITk4e3pswhKHVRBrNQlK6nc1+4SNCS7h+YxA3eQujKfzdzmD7MUlYJvqM1KxoLazIt5mwZQnb46mp0ToDYenRcx0hXz+kYgEb8bL/xjFMB3qudieHWuT+5jMudzjYpzCXuI11zJIy6PbrcmESKmf2cwrTmoFL5pKQsaZr5ZVxLWDe
.rubiconproject.com/ Name: audit
Value: 1|OH/xENRmnnVWLG8EwKCITk4e3pswhKHVRBrNQlK6nc1+4SNCS7h+YxA3eQujKfzdzmD7MUlYJvqM1KxoLazIt5mwZQnb46mp0ToDYenRcx0hXz+kYgEb8bL/xjFMB3qudieHWuT+5jMudzjYpzCXuI11zJIy6PbrcmESKmf2cwrTmoFL5pKQsaZr5ZVxLWDe
.rlcdn.com/ Name: pxrc
Value: CL78080GEgUI6AcQABIFCOhHEAA=
.tapad.com/ Name: TapAd_TS
Value: 1773469246168
.tapad.com/ Name: TapAd_DID
Value: 238599ae-a1bf-48a0-b5ed-2207c60abb18
.openx.net/ Name: i
Value: ac7e083c-0ca9-435d-a368-acbd21186f50|1773469246
.smaato.net/ Name: SCM
Value: b8a8954356
.smaato.net/ Name: SCM675
Value: b8a8954356
.smaato.net/ Name: SCMco
Value: b8a8954356
.tapad.com/ Name: TapAd_3WAY_SYNCS
Value:
.pro-market.net/ Name: anProfile
Value: "-rge3ntfay19i+1+4=14d+1f=1+1g=1+1j=2+rs=s+rt=1FBB4EC2+s0=(20)+s2=(tbvlmm)+vm=24-7BCE36D896B24D3E9FFB9A9004C0C77F"
.pro-market.net/ Name: anHistory
Value: "-rge3ntfay19i+2+!#6wM!m!0A("
.lijit.com/ Name: ljt_reader
Value: MU_84QZHM6BpQhgcRFKkSKns
.eyeota.net/ Name: mako_uid
Value: 19ceb012391-35210000010f43d3
.eyeota.net/ Name: SERVERID
Value: 17363~DM
.crwdcntrl.net/ Name: _cc_dc
Value: 1
.crwdcntrl.net/ Name: _cc_id
Value: 60232442d8a8cceb0ccad35d112cdb04
.3lift.com/ Name: tluidp
Value: 2289667862880711286644
.3lift.com/ Name: tluid
Value: 2289667862880711286644
.connatix.com/ Name: cnx_userId
Value: 3-af28ce7422764ce883250fb0e587d500
.smartadserver.com/ Name: TestIfCookieP
Value: ok
.smartadserver.com/ Name: pbw
Value: %24b%3d16999%3b%24o%3d99999
.tremorhub.com/ Name: tv_UISF
Value: 7BCE36D896B24D3E9FFB9A9004C0C77F
.bfmio.com/ Name: __141_cid
Value: 7BCE36D896B24D3E9FFB9A9004C0C77F
.bfmio.com/ Name: __141_exp
Value: 1
.bfmio.com/ Name: __io_cid
Value: 84e8be0e507dedb7a5fbe8302a5881827e6572f9
.pippio.com/ Name: did
Value: HEpk-maxs5fr5y4r
.pippio.com/ Name: didts
Value: 1773469246
.pippio.com/ Name: nnls
Value:
.pippio.com/ Name: pxrc
Value: CAA=
.cyberark.com/ Name: _ga_XTLTD7RKN5
Value: GS2.2.s1773469242$o1$g0$t1773469246$j56$l0$h0
.smartadserver.com/ Name: pid
Value: 5796898548289141777
.turn.com/ Name: uid
Value: 4457383036734668487
www.cyberark.com/ Name: dpm_time_site
Value: 11.002

4 Console Messages

Source Level URL
Text
rendering warning URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Message:
[GroupMarkerNotSet(crbug.com/242999)!:A0405019DC0A0000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader (about:flags#enable-unsafe-swiftshader) flag to opt in to lower security guarantees for trusted content.
worker warning URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Message:
[GroupMarkerNotSet(crbug.com/242999)!:A0405019DC0A0000]Automatic fallback to software WebGL has been deprecated. Please use the --enable-unsafe-swiftshader (about:flags#enable-unsafe-swiftshader) flag to opt in to lower security guarantees for trusted content.
other error URL: https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
Message:
Attestation check for Attribution Reporting on https://www.facebook.com failed.
network error URL: https://api.company-target.com/api/v3/ip.json?referrer=&page=https%3A%2F%2Fwww.cyberark.com%2Fresources%2Fthreat-research-blog%2Fgolden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps&page_title=Golden%20SAML%3A%20Newly%20Discovered%20Attack%20Technique%20Forges%20Authentication%20to%20Cloud%20Apps
Message:
Failed to load resource: the server responded with a status of 401 ()

Security Headers

This page lists any security headers set by the main page. If you want to understand what these mean and how to use them, head on over to this page

Header Value
Content-Security-Policy frame-ancestors 'self' https://www.cyberark.com/
Strict-Transport-Security max-age=31536000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 1; mode=block

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

316-czp-275.mktoresp.com
a.dpmsrv.com
aa.agkn.com
alb.reddit.com
analytics.google.com
api.company-target.com
assets.adobedtm.com
bcp.crwdcntrl.net
capi.connatix.com
cdnjs.cloudflare.com
ce.lijit.com
cihost.uberflip.com
cm.everesttech.net
cm.g.doubleclick.net
cnv.event.prod.bidr.io
connect.facebook.net
consent.trustarc.com
content.cdntwrk.com
cyberark.demdex.net
cyberark.sc.omtrdc.net
cyberark.tt.omtrdc.net
d.turn.com
d1eoo1tco6rr5e.cloudfront.net
dpm.demdex.net
dsum-sec.casalemedia.com
eb2.3lift.com
fei.pro-market.net
fonts.googleapis.com
fonts.gstatic.com
googleads.g.doubleclick.net
i.simpli.fi
ib.adnxs.com
id.rlcdn.com
idsync.rlcdn.com
in.ml314.com
insight.adsrvr.org
js.adsrvr.org
loadm.exelator.com
match.adsrvr.org
ml314.com
munchkin.marketo.net
nexus.ensighten.com
ob.segreencolumn.com
obs.segreencolumn.com
onetag-sys.com
partners.tremorhub.com
pippio.com
pixel-config.reddit.com
pixel.mathtag.com
pixel.rubiconproject.com
pixel.tapad.com
ps.eyeota.net
px.ads.linkedin.com
rtp-static.marketo.com
s.ad.smaato.net
s.company-target.com
s.dpmsrv.com
simage2.pubmatic.com
simplifi.partners.tremorhub.com
sjrtp6-cdn.marketo.com
sjrtp6.marketo.com
snap.licdn.com
stats.g.doubleclick.net
sync-tm.everesttech.net
sync.1rx.io
sync.bfmio.com
sync.intentiq.com
sync.smartadserver.com
synchroscript.deliveryengine.adswizz.com
tag-logger.demandbase.com
tag.demandbase.com
tag.simpli.fi
tags.srv.stackadapt.com
um.simpli.fi
us-u.openx.net
www.cyberark.com
www.facebook.com
www.google-analytics.com
www.google.co.il
www.google.com
www.googleadservices.com
www.googletagmanager.com
www.linkedin.com
www.redditstatic.com
x.bidswitch.net
id.rlcdn.com
www.cyberark.com
100.55.244.171
103.231.98.109
104.102.33.245
104.16.69.86
104.17.25.14
104.18.26.193
104.18.27.193
104.18.41.41
107.178.254.65
108.128.131.68
108.138.26.44
108.138.7.50
13.226.244.23
142.250.201.163
142.250.201.74
142.251.127.154
142.251.127.157
142.251.141.104
142.251.141.66
142.251.151.119
142.251.37.2
150.171.22.12
151.101.1.140
151.101.129.140
151.101.65.140
151.101.66.49
172.217.16.195
172.217.168.78
172.64.146.152
172.67.75.205
176.34.239.19
18.172.114.101
18.173.205.109
18.173.205.94
18.245.46.25
18.245.46.60
18.245.60.124
18.66.102.30
18.66.102.85
18.66.122.49
18.66.122.78
192.28.164.179
192.28.164.244
216.239.36.181
216.58.206.66
23.52.181.12
23.55.161.151
23.67.142.205
3.125.70.222
3.211.70.183
3.229.217.25
34.111.113.62
34.117.77.79
34.225.5.229
34.240.240.83
34.7.37.3
34.96.71.22
35.168.61.84
35.204.89.238
35.212.17.176
35.214.136.108
35.214.194.245
35.244.159.8
35.244.174.68
37.252.171.21
37.252.171.53
44.211.20.238
46.228.164.30
50.16.211.97
51.38.120.206
52.18.115.33
52.223.40.198
54.146.227.19
54.146.30.88
54.154.24.113
54.78.254.47
54.78.54.11
57.144.244.1
57.144.244.128
63.140.62.200
63.140.62.210
65.8.101.109
69.173.144.138
69.173.144.165
74.121.140.211
81.17.55.116
02b3d7b0b8740148469d839cb81fddb4ca8330c202242f4f393d928c89fee486
0827bf9532c172c85a6a845ae3c4efadef98a68703a79cd24e0fce9f693aba41
0ae1d8ff559d265d54750e40737826960c9948d43edfb72b2d33c7fb2dcd3ebb
0b0ac7c68db346fa3204bc6a91bc0520a99a9a624909cac18fa4cecd14336c55
0db210edd69ae50d9bdf5982ba9e3490972296be80a76a5dbec6159080da2b5d
11a2142988720cd49ff000e5d488493947b3d34821301c5a706b3495b8381f7d
143a1ee63c9fe87791cde6209d3716bf432ede02fc23ecbd064edfe1cc02bca9
159782eec3137c4cb3daf25fda51de32b3f3d47de97374c46309e005503ca099
15a3dc247a9802298e21568c4d7d501a6236c246e9a2257177799a5400844740
17ec719c8fc3d2f11d574963335660fd461c642743f6ca54d9cfd4ead26b3f61
19bb468ba17ea560dc3b738083bfdfbe55dea24abc35be5d6889d1bc2fd31182
1b494e366f0947c7b54904d8cbb4c79efde8ddc54161b9493d5b32216a342a83
1f150486021d4182821249f13273a7a87862756e2b021e3d19121aaae6a2e09d
1fb7ee27fdfb34869f89aa51d9af1cf86ecc6800ab591ec3ca78f155742200b2
219d7416ab96d326fcb9fd3d639821032442f97a256236f4fa6c6063e947013d
22480d7ad71f14068913f91d946e7a5cd5a33a6ddd60494fa090ce6c02aca15d
232c6f6a7678304f9efaa26f30b1610debc2ba9f4cd636b5e6751c8d73761b92
2538590b87a5eb44bb27a7a5039451a5606d80c587cb361de40ed4193c9a552f
2595496fe48df6fcf9b1bc57c29a744c121eb4dd11566466bc13d2e52e6bbcc8
2a250e2f225e48cf583d54a0a42d623c700847de17323bf23ea372e5d9e89cb2
2adefcbc041e7d18fcf2d417879dc5a09997aa64d675b7a3c4b6ce33da13f3fe
2cae1e0f64116783be1860b6b3a275157057d0f24f028e28c6e98ee6aa82a1a8
2f561b02a49376e3679acd5975e3790abdff09ecbadfa1e1858c7ba26e3ffcef
2f5f9d511700318e988d3ef843afc49224162c8bb2435db7b9dc3590f525306f
303b1758be065475105b7095b5f054126654beb7e52fb056af8037b0d8148fb7
329eba5224a490e972374a62dd94c61794c440471cc2d40a13a73d6586d7394d
330952ab82d0d42fdf24e29f35b5b1565d2e5458713a3783300ddece550e68ae
3394af2edb462a3dcb742b0b26ef640f0ee9701638d06d3dca4a9528d15ce01a
33bfff284b4455e2dd459c4bf0e6076a5fe5f8632b42b8ccd2dd5a0d55dbcfbb
3879e8c7c2b8936f28215aa1eaadff29eb1f5121b53932517f6857b58a5106b9
3a0f91dd9c097e0720223eeddb1ff16cfa5206274e5531010f8ee0385314a54d
3c94e227340e9e5b88730462cc4d35f5c5e0061b788a3dde696588f40b5cc864
3df0aabfd9233cf1030b0a717149764422f7399d2c0c531efbb858be8efe82ae
3eb10792d1f0c7e07e7248273540f1952d9a5a2996f4b5df70ab026cd9f05517
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
4669b2dfe555b8033e408c1fc12ab79badbda018bb544508e231cf74a926afbd
46e9c53019a1d7eba71e11a7490a952f41e6ee3bb718d8abdb3ead7c6d87df7a
4b5b6b15c6255109e06720cce42a06d3aead8b7874423d9c52cb0303212c25ef
4bb376070ab35cac64c46d43a47b26b6d52bfa8d9b3ccec98c58b7d9d856b1a8
4beb123e00f4bef8edecb3c7ddda6eb703d9fac9a91c24ddde2aef8a1cd49bc2
4d0130d314f1669c9ea5a911d401d6250f96386a52b0c38f7b3fb43cdcd10589
4db026a5454bc4033508ec538f0d13a6aa7f5b0f7ce2f37526e3d4f251d09307
4e02fda4bdfbdf9df0e3523b8b2b385afbd007a3f8318e0e640f8d0a0da100be
4e0705327480ad2323cb03d9c450ffcae4a98bf3a5382fa0c7882145ed620e49
4f677c72abaf624f80c8f5a21f46e71d63f82876fb80a185cbe1377de6a79ea6
55c9d2f019f9d7ddfd69b2ad0351c5617338a222362aebb02b3b98a4dbc18486
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
578f8ca4c810676744873f67b9401bb5e253626722d9d5faef7ea9f6b4205ec6
58e87012ca6026107d7528768b7de0adad95fadec78500ce274775e993c30a95
59a7a179044a073f8724448ebb09aef58d8874ffcbb4138c3f89482c3ea5db63
5a1ba6ff6db12f791bbbfc4da3cb389e06f0cd53eede09ef3eb3ceb074089ef1
5c7df99df232586111917083a85aa31b82ee29e48ca2990e13fae0c0663a923f
5cbd2c4ce1325baae0fa325bdd95a25a925b094d7e88fc6fcebb834a6906c5b4
5ceaaba22d75b58e04150311f596306562a3e595e27ed4b1dfa451b82dda9e50
5d8be609dbcf6813a088078c91e0cffd81eb70a2bc868d5b552525dcc2bca1cc
5e240679c3215c840cf754104fe7291c77f2f52ad551c95e8c8364d0124938ec
5ea06e65cbabd32730119cff1bb1426c4ab45b8ccba62935c0caebfa50f135b0
5f7b5928808a1fab833a81628932ce41e85f33ccdd41664b557a5d8002ddbbb7
5fe1275aa22d6ef48e4b611897febe201800c7ee3e97f54d46c689345b2b2ef6
608a2d05568fcb6af26e068d71652de00d4a205768fdc784ed1e859260b26a5c
609bbf13dec680962cbaec7d7143a6a4a01af4d4907ea07d673bf8aef8fc4771
60f515991307abd345708ae3d50ff9a7751c68c208e2586d992c3c6ff729d6b0
623315489f08928990290cd0de14e35c11baea8a50149acc6d27cbef6757dab0
62f5a9e298862e32f868dc614fa303d9b732f0dc9bd75ce48f65293c850aec2f
66c708b80cab108a2fde84cac9677c07435537bc9d06085ccd1ac80cb93513b4
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
7157511697db744d384a5a2a8646af23f3c90560abf93bb240fdd690b29a898a
74935268619be1f087ce67765abd72f80107125f23b346f7615cc9e6a19d4595
752bae4ad65c49d137fd4a2b82b7229e01a61a769baf0a8d61fb94f2fa663359
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
7da00d50d49129b8cd6db682a403151b757c09599645060c91db8d379fc9c1e5
7db8d077fc21c20f1449a2603d524e423cfa25d7df6d5fd845a8e5e883aa227e
7e09fc2637f99d9770b0ee76309ac4c3c08e5583adf6cb5d0bbcc827bba2adc6
7ef8a267de455c3a72237bf7db0c97c97e35e52452ff9ece15876d0d60f9c0e9
8078cebf9ab8ba5c0802536ed68317072ca51f1cb5293db16d63f923aad2e011
85e5fdd9b37a2574d8c76a46faecb5504b2d528026d4be3d4ff58ad773995f5b
861b80b49d2a634d8746e2e45c672309d9ba69a2fdd95da2af034d7a1d09b3f9
8891a160f8a2afb81de5259f9f68e5af3782348ea2927ad9e969bc88c7d39984
88b4bd1c3c8e9af6516b562e9679955ff48479ee6a5771e97ef425d1c5425e1f
892a22c46a1f9b3175ca9505e0b3fe54514b3b1e270be879ffb2393aa652328a
892a637e286877d9688ab92a770cdefb05f0e0b5600c7063adc2cd6f2fecbf8f
8cd83d3dad2994402f9074e9de3ca226d9ce96040c9724cb2ce06c593b39373e
8d70b3e6badb6973663b398d297bb32eaedd08826a1af98d0a1cfce5324ffce0
8da752cc30ea40e8e6bef1e3659f41a96a38182e258823e84bbf6f526bfa1067
8f80f993e523f2e6c2d097552740fd26331658da23ffad31d26edcdd3aeec370
9042f1e34a93c7f8b4f6c71701eb19b553ebf0590081e805fe5a926483de7d1d
9047f7304169514f176ad69b031dc68732f1bc7af1543c224188e81d7946633e
91eb45e152428a3e9f37db0fc1a012a944907dc7c4a26ad0266ac00ea6c67ff1
9341933ddcf666d7d1fdaacba01c75613b26c5530194a2722e61edaf364b2ff6
93e2856e540b7faf4767d1291492324c43994be69562b8d1d9be07de8e2e40e4
965409c36122cec474b4d2062248da8f63b3cb5d9ba1085a586c92f5a48777db
96a062daf8450892706b68347abc0c54d4d6d7f363d90f9e110c679d9e6d4ac1
98b3d9d20e032f90aca49e9b116225d539ff6fbdb7e42c3c363f63896ac03d2a
9d95d1586b80e36867fcc02a259a124fea267f62c2960cad88520cece45ea767
9e3162d81ed6681322ab34791660f1b45c79945197e7a7dbb217005b2926caf4
a065920df8cc4016d67c3a464be90099c9d28ffe7c9e6ee3a18f257efc58cbd7
a117f36dba1eb2100f340bb68f3cc4d4c04d50d8a1d61c36a5d0a682aed9d362
a249bcffb2d8e92a3bdff919def43b14841803ad93b80ffa864db1090e007594
a36681fe4fd06eb0856952cddb2047065db39f00e819dbf0e9715540083f8198
a3e210a2a85e04c7857200b23bb1696f69953857a9b35745fddd0c446c8918a1
a593e91ed4b2d26f56bb1f92f8d0fc1d2741b97823b154404d955a77380d06ec
aa7b6c81e85551eeb5c4809f1e683efa0b780c33d12ddfc2067a1b136803e45a
aafea011e884eb0b14840d9a8db02927da95aa02909d31bf856a72cd20246a35
acccc501aa6afa3cfac15e8ddccf1561deed2ed08c2f7d652abbdbe9aa71609a
acefee5919ad26b14b672618d4db53e269288c6067b374f15383b81767e6322a
ae17c16afbea216707b2203ea1cf9bdb45b9bfe47d0f4ae3258ddbc6294dd02f
ae39109580d502f2f8728e062d65bee0d92a4b3f45a02b59deb27a904e056d3a
b122e173fb310c409d02c56e57eea40f1ea470fed839599c902b085d8fdb0129
b1442e85b03bdcaf66dc58c7abb98745dd2687d86350be9a298a1d9382ac849b
b3fa60d72c41260a9b45f6af7d1acb01ab223cad33e0105766d67df1f1d9d683
b563a1c24a769b1996e5b3bcf3bb56bd558d14e813d553784d368f306dd83936
b6ea1d8746cd439217869050e68386b5a054777c1944398ef3df2543a88fb32a
b9a43d9c1267add6dc178add460022752a200e1f2974e9cb0322fe0a025275b0
bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
bc765a035f517ac4cbabc8b790609aa1710b89c05f517273d9465cf702dab8c1
bea943d92ffaf3641efe765092233d69baf17d5222b41ac60685433b4c5f9a9a
bf6806d8c92e228249230195772afe2e68791d52763b782be9aa2855fab3b641
c00f98310d0e62fb4ff71952f4bcf87780adc76f479a73b076068c4715b82200
c065380f7bd8d381eaf25e89eb432311f62d6bdb2033959afa80ea07422f0806
c1cd0852f3077f1b059e16529d8de16acb490990d6cb796dd74873de0bfd8a91
c501d5cb69e743beedfa9d81ba09a334426dfef874c9b81e65ef02d56a37f293
c526e4bbe921e8a63361f3fe917032ccea863e323e635f06c173bedf5f2a4812
c538c77bed3f827d27f063946bef7de87ec446e9731a654687cb553d7b954cb7
c7295f0f8c9fbfaeb021c7f80e61b2ebc9c3312995a17fb8ba238ce9068c9734
c89ad4459c7c0a83f898fcf6f69eb4b95acd87c39e05eebac69906d36ed47804
ca72d2bcea8f4daa783dbdfa2d9b46068c3ce38168e05918fb867aa453b4f890
ccbf55c63cf823f257fd0e0f4e213a6782e6eb004f1f2012ae0ddf20748ce1c9
ccf3671ee89abefc15878cca66a85a2839b1e215ece70665767b688f67ddecb2
cf4724b2f736ed1a0ae6bc28f1ead963d9cd2c1fd87b6ef32e7799fc1c5c8bda
d089c8a9fc28e4e50223eb38c9409e362521be9380a37341304fbac7a4cd9e5f
d0e4a6372d6fb5ffe9505dbe9e94aee8f1b9b96ec8e5e20684cce8b4c5a88fa7
d11e80126174cd01dcdcaa8689aba5727d42c79945420610bf2e56a26208e552
d1f006edc87b21a5167e1dcdd0fce66e6f0a495b8c6da053db08860fa4df0ea9
d4761d421bbf2f059126b9ce4f5e0a9f7bc83b046a58162780a2b9c3ab8c9a56
d8e4fe0452aa2076429a9bb5d8757d00a994dd95986cf950e9a1a371b9a072a0
da70aaab22df021fab995b92d471f3e92495729f3c219f5d676c6cae8239b417
dba62db80f107a0fcaae968403a8c771e9222f1b3a3f0f281dcc3fc079572315
dc0e20bf83a2fa90b0138f93f14ba2a0fabf13bda151ea2b07da9e7c8bceb8d8
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de51e430d25badc6910e9d30c8d9ddc8f15cd282a8a5096328d4a8328b8ad833
dea9df0145848ffeb3c6931228d41e833341b4837c0e713d321c5bfcf6dcd4e6
dfcf469c7a66c6b348b50f9cd98a103da4c6ba969f80fb88ee7fed530315b302
e0acaced3f5686390c4c2ed8d3b447c725660252d1a20a71fdab5110a435c463
e236ccec492424188f1f5d91e08023e26ca3203db3842cf3e54f891514a0fc41
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e5c7208df8112b91fb43a21c4b54b1b6e1d66cf70382a90485dd8e0e6c243d07
e80cfc6df2f882813f88dcf1175bc0c47e13c0cd8517bc240a65ee6cc758b0f2
ea619a152c6d3c91e8bfb6b36df4904dc6b7beae418d784103ee70154bc102b3
eae2ae55dd936065b7ad5f5f36db2c99e8525482915139a3b6421d554193ffb1
eb546cf86b3dcdf1f966899c091cc14b86ad79eae26a156423cd7b9b26faf92b
eb57752bfa803d15370c556f6c037906d408f5b2edad5631f36a9bdc38a67371
ec5d781fdf2ddbb04ed4491269a0d031464d946c4f1d0d230d7c5cb2fd7a3ad3
ee294a3b30eca6f8d0ff28214cedcbb143beebc4cc038302afbdd799206b34fc
eee6eaf59f3744b188505112ab4f349b8a7bdb5a460a253042a55ce40373bf2f
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
f1a61277e3f902f50ab42015d8b07218db9b7601bb0967e54a52bfdcb4fa7e81
f3b44481b288f30a9b8c98cad80b00e0c01930bf8ad573c8e71990ed42076bfb
f3c0440fa8ca7f2e0aa46a6ff93e0377b868a471a9c215f8c13d775d3d27d37c
f9c0f62b8a0f09e69dc09f581bf16c8f065ebcb743f1efebb9da584027652566
fb2f383b5253bd2edfb18c734bcbba3bfceb5b9ba20bb2b6f383edcec368df98
fd815d8b6eb764467a035fa9301a1c119382be2dca3c7a2f8bfcf5a7349623da
ff94b249e69933eaa84b1bb3533fb51a3c1184f84afbe5584ccc88b5e387c891