duo.com Open in urlscan Pro
13.225.80.94  Public Scan

3 Outgoing links

These are links going to different origins than the main page.

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Search URL Search Domain Scan URL

---

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 31

• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7540&time=1650745551690&url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS HTTP 302
• https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D7540%26time%3D1650745551690%26url%3Dhttps%253A%252F%252Fduo.com%252Fdecipher%252Ftrailblazer-hunts-compromised-credentials-in-aws%252FnAWS%26liSync%3Dtrue HTTP 302
• https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7540&time=1650745551690&url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&liSync=true HTTP 302
• https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7540&time=1650745551690&url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&liSync=true&e_ipv6=AQLYxfHmy0GqjQAAAYBYGi68THEUbKI-zyJpfOpJYlYs5Gk8XWwWDq-PXUhlELD59B6t4dne

Request Chain 46

• https://dpm.demdex.net/id?d_visid_ver=4.1.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=B8D07FF4520E94C10A490D4C%40AdobeOrg&d_nsid=0&ts=1650745551814 HTTP 302
• https://dpm.demdex.net/id/rd?d_visid_ver=4.1.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=B8D07FF4520E94C10A490D4C%40AdobeOrg&d_nsid=0&ts=1650745551814

Request Chain 70

• https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=MjkyMzYzOTMwMjQ0NDk1ODg4MTI3NzkyOTY2MDM1MzU4NjE2MjU= HTTP 302
• https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm=&gdpr=0&gdpr_consent=&google_hm=MjkyMzYzOTMwMjQ0NDk1ODg4MTI3NzkyOTY2MDM1MzU4NjE2MjU=&google_tc= HTTP 302
• https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEDu7izUiJCvTvCEQjylTGtc&google_cver=1?gdpr=0&gdpr_consent=

Request Chain 74

• https://cms.analytics.yahoo.com/cms?partner_id=ADOBE&_hosted_id=29236393024449588812779296603535861625&gdpr=0&gdpr_consent= HTTP 302
• https://dpm.demdex.net/ibs:dpid=30646?dpuuid=y-DZakXuRE2pHtMzdYbnmcViJpPIuWSqpaVwk-~A

Request Chain 77

• https://usermatch.krxd.net/um/v2?partner=adobe&id=29236393024449588812779296603535861625 HTTP 302
• https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=adobe&id=29236393024449588812779296603535861625

Request Chain 81

• https://c.clarity.ms/c.gif HTTP 302
• https://c.bing.com/c.gif?CtsSyncId=53E986B609BB443A824C3A445A4D49D1&RedC=c.clarity.ms&MXFR=23383A7EF96D6EE829742BF1FD6D603F HTTP 302
• https://c.clarity.ms/c.gif?CtsSyncId=53E986B609BB443A824C3A445A4D49D1&MUID=2FAFE1B5AC4169400BC9F03AAD936848

98 HTTP transactions Everything HTML Script AJAX CSS Image Expand all
0 data transactions

Method Protocol	Status	Resource Path	Size x-fer	Time Latency	Type MIME-Type	IP Location
GET H2	404	Primary Request nAWS Show response duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/	14 KB 5 KB	2020ms 1956ms	Document text/html	13.225.80.94 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.225.80.94 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-80-94.fra2.r.cloudfront.net Software Duo/1.0 / Resource Hash 27d6fba6ad31a91fa31d69869c76b901f4eab1b2d3daede85479097c04c605c0 Request headers Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers content-encoding gzip content-length 5185 content-type text/html; charset=utf-8 date Sat, 23 Apr 2022 20:25:51 GMT etag W/"6255da84-391f" server Duo/1.0 vary Accept-Encoding via 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront) x-amz-cf-id f-QliEUhTJ0tO7xuxQuKbnBUTVEvgs5CY19dSvdN5HVV8-ExmAbYDQ== x-amz-cf-pop FRA2-C2 x-cache Error from cloudfront
GET H2	200	production-2021.css duo.com/css/	515 KB 99 KB	15ms 15ms	Stylesheet text/css	13.225.80.94 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://duo.com/css/production-2021.css?v=1647976353 Requested by Host: duo.com URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.225.80.94 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-80-94.fra2.r.cloudfront.net Software Duo/1.0 / Resource Hash b2021fe9b1f8b7e7bb44e57c5aed88f45cab8b7a0e84f39b7e472277361f1da5 Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers pragma public date Sat, 23 Apr 2022 05:23:42 GMT content-encoding gzip last-modified Thu, 14 Apr 2022 16:20:39 GMT server Duo/1.0 age 54129 etag W/"625849d7-80a86" vary Accept-Encoding x-cache Hit from cloudfront content-type text/css via 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront) cache-control max-age=31536000, public, must-revalidate, proxy-revalidate, max-age=31536000 x-amz-cf-pop FRA2-C2 x-amz-cf-id joLMSGp5PwfwQc2c45XQpkBotwVtzZKsmSqlVaLh2geRhsoLisr-eg== expires Sun, 23 Apr 2023 05:23:42 GMT
GET H2	200	d-logo--light.svg duo.com/assets/img/decipher/logos/	4 KB 2 KB	12ms 12ms	Image image/svg+xml	13.225.80.94 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://duo.com/assets/img/decipher/logos/d-logo--light.svg Requested by Host: duo.com URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.225.80.94 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-80-94.fra2.r.cloudfront.net Software Duo/1.0 / Resource Hash 694b5d6220eb8a349b60ce749052c3b923c8449bbfb4ebfb68f4fc27f1b7e92b Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers pragma public date Fri, 15 Apr 2022 08:51:20 GMT content-encoding gzip last-modified Tue, 12 Apr 2022 20:00:42 GMT server Duo/1.0 age 732871 etag W/"6255da6a-ff2" vary Accept-Encoding x-cache Hit from cloudfront content-type image/svg+xml via 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront) cache-control max-age=31536000, public, must-revalidate, proxy-revalidate, max-age=31536000 x-amz-cf-pop FRA2-C2 x-amz-cf-id BI4BaI_GaLtIJr2liAJoYalNXgKerfw24lCM2MclUB1nghdU2uRaDQ== expires Sat, 15 Apr 2023 08:51:20 GMT
GET H2	200	aW1nL2RlY2lwaGVyLzQwNC5qcGc= duo.com/img/asset/	110 KB 111 KB	752ms 750ms	Image image/jpeg	13.225.80.94 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://duo.com/img/asset/aW1nL2RlY2lwaGVyLzQwNC5qcGc=?s=12378a2282d82a8f9f860cc85a068fe2 Requested by Host: duo.com URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.225.80.94 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-80-94.fra2.r.cloudfront.net Software Duo/1.0 / Resource Hash 849b2ac11460487810a7132803d8680307e25126ba000a30b4775ed3e78201be Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers date Sat, 23 Apr 2022 20:25:51 GMT via 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront) x-content-type-options nosniff x-amz-cf-pop FRA2-C2 x-cache Miss from cloudfront content-length 112627 x-xss-protection 1; mode=block x-ua-compatible IE=Edge,chrome=1 referrer-policy no-referrer-when-downgrade last-modified Sat, 23 Apr 2022 20:25:51 GMT server Duo/1.0 x-frame-options SAMEORIGIN strict-transport-security max-age=63072000; includeSubDomains; preload content-type image/jpeg cache-control max-age=300 permissions-policy interest-cohort=() x-amz-cf-id cP9ov1eLZH2INi_ogxxdzkOYSaqtYazqPv6aEjV4QCbL7Di8xVbhIQ== expires Sat, 23 Apr 2022 20:30:51 GMT
GET H2	200	d-logo--footer.svg duo.com/assets/img/decipher/logos/	3 KB 2 KB	22ms 21ms	Image image/svg+xml	13.225.80.94 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://duo.com/assets/img/decipher/logos/d-logo--footer.svg Requested by Host: duo.com URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.225.80.94 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-80-94.fra2.r.cloudfront.net Software Duo/1.0 / Resource Hash c33592c7a249c98164b3d533c58fae62ced2b403deab8f2d0cce4c4f1cbb285d Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers pragma public date Fri, 15 Apr 2022 08:15:00 GMT content-encoding gzip last-modified Tue, 12 Apr 2022 20:00:42 GMT server Duo/1.0 age 735051 etag W/"6255da6a-b5f" vary Accept-Encoding x-cache Hit from cloudfront content-type image/svg+xml via 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront) cache-control max-age=31536000, public, must-revalidate, proxy-revalidate, max-age=31536000 x-amz-cf-pop FRA2-C2 x-amz-cf-id Po9BV8gaujDjbqSlvajQPE-wkhskjlczPnrtwc5KUk2Scz7LWrAo2A== expires Sat, 15 Apr 2023 08:15:00 GMT
GET H2	200	jquery.min.js Show response ajax.googleapis.com/ajax/libs/jquery/2.1.4/	82 KB 30 KB	90ms 21ms	Script text/javascript	2a00:1450:4014:80b::200a GOOGLE
General Check archive.org Show headers Download Go to Full URL https://ajax.googleapis.com/ajax/libs/jquery/2.1.4/jquery.min.js Requested by Host: duo.com URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4014:80b::200a , Ireland, ASN15169 (GOOGLE, US), Reverse DNS Software sffe / Resource Hash 22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers date Wed, 20 Apr 2022 15:20:25 GMT content-encoding gzip x-content-type-options nosniff age 277526 content-security-policy-report-only require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 29725 x-xss-protection 0 last-modified Tue, 03 Mar 2020 19:15:00 GMT server sffe cross-origin-opener-policy same-origin; report-to="hosted-libraries-pushers" vary Accept-Encoding report-to {"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]} content-type text/javascript; charset=UTF-8 access-control-allow-origin * cache-control public, max-age=31536000, stale-while-revalidate=2592000 accept-ranges bytes timing-allow-origin * expires Thu, 20 Apr 2023 15:20:25 GMT
GET H2	200	production-2021.min.js Show response duo.com/js/build/	760 KB 270 KB	25ms 24ms	Script application/javascript	13.225.80.94 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://duo.com/js/build/production-2021.min.js?v=1647976353 Requested by Host: duo.com URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.225.80.94 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-80-94.fra2.r.cloudfront.net Software Duo/1.0 / Resource Hash e8e74813d3382d7453da81f7037183bb926aa06ce68021ba6b55f01d20d0f205 Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers pragma public date Sat, 23 Apr 2022 05:23:45 GMT content-encoding gzip last-modified Thu, 14 Apr 2022 16:20:39 GMT server Duo/1.0 age 54126 etag W/"625849d7-be0c2" vary Accept-Encoding x-cache Hit from cloudfront content-type application/javascript; charset=utf-8 via 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront) cache-control max-age=31536000, public, must-revalidate, proxy-revalidate, max-age=31536000 x-amz-cf-pop FRA2-C2 x-amz-cf-id QfNFSrnF0IHup6bQ6aEghQ261iZR957pgdbHZRiY2UmpUWN_oysQjA== expires Sun, 23 Apr 2023 05:23:45 GMT
GET H2	200	ctm.js Show response www.cisco.com/c/dam/cdc/t/	131 KB 31 KB	280ms 11ms	Script application/x-javascript	2a02:26f0:3500:88d::b33 AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://www.cisco.com/c/dam/cdc/t/ctm.js Requested by Host: duo.com URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS Protocol H2 Security TLS 1.3, , CHACHA20_POLY1305 Server 2a02:26f0:3500:88d::b33 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software Apache / Resource Hash ebb4d3109b96ab757bdf0be76f9b0a583086cc032d48b128d8f636da082ca048 Security Headers Name Value Content-Security-Policy upgrade-insecure-requests; frame-ancestors *.cisco.com *.jasper.com *.ciscospark.com *.ciscolive.com http://cisco.lookbookhq.com https://cisco.lookbookhq.com testcisco.marketing.adobe.com cisco.marketing.adobe.com ciscosales.my.salesforce.com test.salesforce.com zedo.com hindustantimes.com economictimes.indiatimes.com *.webex.com *.cdw.com *.cdwg.com *.cdw.ca *.meraki-go.com http://ciscopartners.lookbookhq.com https://ciscopartners.lookbookhq.com ciscolearningsystem.com ciscocustomer.lookbookhq.com cisco.lookbookhq.com ccsmedia.com *.itquotes.ie dteonline.com ampito-cisco.com arkphire.com *.insight.com *.ccsmedia.com *.ebuyer.com *.lambda-tek.com *.storm-technologies.com *.vohkus.com *.bechtle.com *.rainfocus.com *.broadbandbuyer.com *.hardware.com shop.redpontem.com cisco.techdatavendors.be; Strict-Transport-Security max-age=31536000 X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers date Sat, 23 Apr 2022 20:25:51 GMT content-encoding gzip x-content-type-options nosniff vary Accept-Encoding content-length 30476 x-xss-protection 1; mode=block pragma no-cache cdchost wemxweb-publish-prod1-01 x-test-debug nURL=www.cisco.com,realm=0,isRealm=0,realmDomain=0,shortrealm=0,upgradeTest=1 server Apache x-frame-options SAMEORIGIN etag "20ccb-5dc9e39f17a0e-gzip" strict-transport-security max-age=31536000 content-type application/x-javascript cache-control max-age=0, no-cache, no-store content-security-policy upgrade-insecure-requests; frame-ancestors *.cisco.com *.jasper.com *.ciscospark.com *.ciscolive.com http://cisco.lookbookhq.com https://cisco.lookbookhq.com testcisco.marketing.adobe.com cisco.marketing.adobe.com ciscosales.my.salesforce.com test.salesforce.com zedo.com hindustantimes.com economictimes.indiatimes.com *.webex.com *.cdw.com *.cdwg.com *.cdw.ca *.meraki-go.com http://ciscopartners.lookbookhq.com https://ciscopartners.lookbookhq.com ciscolearningsystem.com ciscocustomer.lookbookhq.com cisco.lookbookhq.com ccsmedia.com *.itquotes.ie dteonline.com ampito-cisco.com arkphire.com *.insight.com *.ccsmedia.com *.ebuyer.com *.lambda-tek.com *.storm-technologies.com *.vohkus.com *.bechtle.com *.rainfocus.com *.broadbandbuyer.com *.hardware.com shop.redpontem.com cisco.techdatavendors.be; accept-ranges bytes expires Sat, 23 Apr 2022 20:25:51 GMT
GET H2	200	gtm.js Show response www.googletagmanager.com/	287 KB 85 KB	154ms 67ms	Script application/javascript	2a00:1450:4001:811::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-MFPB9D Requested by Host: duo.com URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 7b0ecec68b62045e0ed6b268e1548263ab7f315f414873da05632849ae287968 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers date Sat, 23 Apr 2022 20:25:51 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 86910 x-xss-protection 0 last-modified Sat, 23 Apr 2022 18:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Sat, 23 Apr 2022 20:25:51 GMT
GET H2	200	din1451alt-webfont.woff2 duo.com/fonts/din1451alt/	17 KB 18 KB	171ms 171ms	Font application/octet-stream	13.225.80.94 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://duo.com/fonts/din1451alt/din1451alt-webfont.woff2 Requested by Host: duo.com URL: https://duo.com/css/production-2021.css?v=1647976353 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.225.80.94 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-80-94.fra2.r.cloudfront.net Software Duo/1.0 / Resource Hash e9f76eabead93f85fc4dc190dca4b1419dcd76b57b1c22649856b01d3ac2536e Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://duo.com/css/production-2021.css?v=1647976353 Origin https://duo.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers strict-transport-security max-age=63072000; includeSubDomains; preload via 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront) x-content-type-options nosniff x-amz-cf-pop FRA2-C2 x-cache RefreshHit from cloudfront date Sat, 23 Apr 2022 20:25:51 GMT content-length 17424 x-xss-protection 1; mode=block x-ua-compatible IE=Edge,chrome=1 referrer-policy no-referrer-when-downgrade last-modified Tue, 12 Apr 2022 20:01:08 GMT server Duo/1.0 etag "6255da84-4410" x-frame-options SAMEORIGIN content-type application/octet-stream cache-control max-age=300 accept-ranges bytes x-amz-cf-id SFRUH4Ru6rOtGUwbMVyPsBaGmMFt1bkSc3-uvrHiIoaJuQxkEYx2TA== expires Sat, 23 Apr 2022 20:30:51 GMT
GET H2	200	din1451alt_g-webfont.woff2 duo.com/fonts/din1451alt/	22 KB 23 KB	173ms 173ms	Font application/octet-stream	13.225.80.94 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://duo.com/fonts/din1451alt/din1451alt_g-webfont.woff2 Requested by Host: duo.com URL: https://duo.com/css/production-2021.css?v=1647976353 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.225.80.94 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-80-94.fra2.r.cloudfront.net Software Duo/1.0 / Resource Hash ede067783c02098828dfe0bda385a9913ff79006eb2cd1a406bcc18e66cd7bad Security Headers Name Value Strict-Transport-Security max-age=63072000; includeSubDomains; preload X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers Referer https://duo.com/css/production-2021.css?v=1647976353 Origin https://duo.com accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers strict-transport-security max-age=63072000; includeSubDomains; preload via 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront) x-content-type-options nosniff x-amz-cf-pop FRA2-C2 x-cache RefreshHit from cloudfront date Sat, 23 Apr 2022 20:25:51 GMT content-length 22668 x-xss-protection 1; mode=block x-ua-compatible IE=Edge,chrome=1 referrer-policy no-referrer-when-downgrade last-modified Tue, 12 Apr 2022 20:01:08 GMT server Duo/1.0 etag "6255da84-588c" x-frame-options SAMEORIGIN content-type application/octet-stream cache-control max-age=300 accept-ranges bytes x-amz-cf-id KtAJHMg-W94wikNkhUgbwSHqhLmQDpS9u7OCL7BZNnbWmoOmuaaJ5w== expires Sat, 23 Apr 2022 20:30:51 GMT
GET H2	200	multi-squares-2.svg duo.com/assets/img/decipher/svg/	1 KB 973 B	10ms 9ms	Image image/svg+xml	13.225.80.94 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://duo.com/assets/img/decipher/svg/multi-squares-2.svg Requested by Host: duo.com URL: https://duo.com/css/production-2021.css?v=1647976353 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.225.80.94 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-80-94.fra2.r.cloudfront.net Software Duo/1.0 / Resource Hash 4adefd63c0816744b24f5f7c63c2ab245eb000b310fe05fb998cfccb98bad0cb Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/css/production-2021.css?v=1647976353 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers pragma public date Tue, 19 Apr 2022 03:40:59 GMT content-encoding gzip last-modified Tue, 12 Apr 2022 20:00:42 GMT server Duo/1.0 age 405892 etag W/"6255da6a-5d4" vary Accept-Encoding x-cache Hit from cloudfront content-type image/svg+xml via 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront) cache-control max-age=31536000, public, must-revalidate, proxy-revalidate, max-age=31536000 x-amz-cf-pop FRA2-C2 x-amz-cf-id LY89_jAnRt_B_ys0suibzGrkmm8be8U8TqH0jM9kDXyk_AAgV-TNZg== expires Wed, 19 Apr 2023 03:40:59 GMT
GET H2	200	icon-sprite.20210112.svg Show response duo.com/fonts/	240 KB 81 KB	10ms 10ms	XHR image/svg+xml	13.225.80.94 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://duo.com/fonts/icon-sprite.20210112.svg Requested by Host: duo.com URL: https://duo.com/js/build/production-2021.min.js?v=1647976353 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.225.80.94 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-80-94.fra2.r.cloudfront.net Software Duo/1.0 / Resource Hash d9218d98cd999ad151e3b5ff5e2d7021b93f1c806c49ffc1f60a3f476d64747e Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers pragma public date Fri, 15 Apr 2022 05:37:56 GMT content-encoding gzip last-modified Tue, 12 Apr 2022 20:01:08 GMT server Duo/1.0 age 744475 etag W/"6255da84-3c031" vary Accept-Encoding x-cache Hit from cloudfront content-type image/svg+xml via 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront) cache-control max-age=31536000, public, must-revalidate, proxy-revalidate, max-age=31536000 x-amz-cf-pop FRA2-C2 x-amz-cf-id WP8S6W4OjK9r0vsFdWnB5swQWaK5eIvLY4oK0tsqpob03rIMVao3dw== expires Sat, 15 Apr 2023 05:37:56 GMT
GET H2	200	optimize.js Show response www.google-analytics.com/gtm/	92 KB 36 KB	152ms 71ms	Script application/javascript	2a00:1450:4001:812::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/gtm/optimize.js?id=GTM-WV3KTWL Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MFPB9D Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 12cefaf738029b6d8ff15cf04eb1db85f52a11492bf2a83df9717de21ce40ff7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers date Sat, 23 Apr 2022 20:25:51 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 36732 x-xss-protection 0 last-modified Sat, 23 Apr 2022 18:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Sat, 23 Apr 2022 20:25:51 GMT
GET H2	200	js Show response www.googletagmanager.com/gtag/	175 KB 65 KB	54ms 54ms	Script application/javascript	2a00:1450:4001:811::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtag/js?id=G-95Z7P6PE75&l=dataLayer&cx=c Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MFPB9D Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 956db35bd22bc613b96a763ae81a3d52ec66fd471d0ffac2bb3f324d9e27a0a8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers date Sat, 23 Apr 2022 20:25:51 GMT content-encoding br server Google Tag Manager access-control-allow-headers Cache-Control vary Accept-Encoding content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true cross-origin-resource-policy cross-origin strict-transport-security max-age=31536000; includeSubDomains alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 66188 x-xss-protection 0 expires Sat, 23 Apr 2022 20:25:51 GMT
GET H2	200	bizible.js Show response cdn.bizible.com/scripts/	83 KB 32 KB	55ms 7ms	Script application/x-javascript	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://cdn.bizible.com/scripts/bizible.js?account=duo.com Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MFPB9D Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/67D4) / Resource Hash cbda94666db24554bf77638fc059848d381c3c98f7f24641fa830abcd5793de7 Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers date Sat, 23 Apr 2022 20:25:51 GMT content-encoding gzip last-modified Fri, 22 Apr 2022 09:50:47 GMT server ECS (frb/67D4) age 73212 etag "1d65a712e56d81:0" vary Accept-Encoding x-cache HIT content-type application/x-javascript cache-control max-age=86400 accept-ranges bytes content-length 32300
GET H2	200	analytics.js Show response www.google-analytics.com/	49 KB 20 KB	115ms 37ms	Script text/javascript	2a00:1450:4001:812::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/analytics.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MFPB9D Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers strict-transport-security max-age=10886400; includeSubDomains; preload content-encoding gzip x-content-type-options nosniff last-modified Wed, 13 Apr 2022 21:02:38 GMT server Golfe2 age 3061 date Sat, 23 Apr 2022 19:34:50 GMT vary Accept-Encoding content-type text/javascript cache-control public, max-age=7200 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 20006 expires Sat, 23 Apr 2022 21:34:50 GMT
GET H/1.1	200 OK	insight.min.js Show response snap.licdn.com/li.lms-analytics/	8 KB 3 KB	57ms 9ms	Script application/x-javascript	2a02:26f0:ef::5c7b:c25a AKAMAI-ASN1
General Check archive.org Show headers Download Go to Full URL https://snap.licdn.com/li.lms-analytics/insight.min.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MFPB9D Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 2a02:26f0:ef::5c7b:c25a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL), Reverse DNS Software / Resource Hash 14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers Date Sat, 23 Apr 2022 20:25:51 GMT Content-Encoding gzip Last-Modified Wed, 13 Apr 2022 23:25:22 GMT X-CDN AKAM X-EdgeConnect-Cache-Status 1 Vary Accept-Encoding Content-Type application/x-javascript;charset=utf-8 Cache-Control max-age=78538 Connection keep-alive Accept-Ranges bytes Content-Length 3085
GET H2	200	ebdaa317731b0.js Show response t.contentsquare.net/uxa/	294 KB 67 KB	38ms 7ms	Script application/javascript	18.66.112.26 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://t.contentsquare.net/uxa/ebdaa317731b0.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MFPB9D Protocol H2 Security TLS 1.3, , AES_128_GCM Server 18.66.112.26 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-18-66-112-26.fra56.r.cloudfront.net Software AmazonS3 / Resource Hash 0cd5cf7846bd2a36245c0dbb389b7ce1c76a09e251b624a466700887ca0cd317 Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers x-amz-server-side-encryption AES256 date Sat, 23 Apr 2022 13:12:32 GMT content-encoding gzip last-modified Wed, 20 Apr 2022 12:49:15 GMT server AmazonS3 age 27353 etag "2c3255eceb2253d04f1b5591d22d6daf" x-cache Hit from cloudfront content-type application/javascript;charset=utf-8 via 1.1 d4744f6f4cb683596fb4a26e59b2aba8.cloudfront.net (CloudFront) cache-control max-age=900 x-amz-cf-pop FRA56-P5 accept-ranges bytes content-length 67741 x-amz-cf-id KT8erDqlmJTgeBlQ9NHBLyAP5mjCTJdtj2LplZLm0J2rcVok6yEBbg==
GET H2	200	fbevents.js Show response connect.facebook.net/en_US/	99 KB 27 KB	49ms 7ms	Script application/x-javascript	2a03:2880:f01c:216:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/en_US/fbevents.js Requested by Host: duo.com URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 086f1c868f8f769ef0039b238b415fc3c46d97e342309dc8c61cefb40868212e Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; content-encoding gzip x-content-type-options nosniff document-policy force-load-at-top cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400,h3-29=":443"; ma=86400 content-length 26311 x-xss-protection 0 pragma public x-fb-debug 3BOemuCiN+/ntXc27XH4PJMNTmRkw9DW34DMqWK45sWJyu3NNYWBloVkw3GEHUgAEzgukb8wOf0ZkHm9E6IsWg== x-fb-trip-id 686109401 x-frame-options DENY cross-origin-opener-policy same-origin-allow-popups cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" date Sat, 23 Apr 2022 20:25:51 GMT strict-transport-security max-age=31536000; preload; includeSubDomains report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cache-control public, max-age=1200 x-fb-rlafr 0 expires Sat, 01 Jan 2000 00:00:00 GMT
GET H/1.1	200 OK	munchkin-beta.js Show response munchkin.marketo.net/	1 KB 1 KB	205ms 28ms	Script application/x-javascript	104.92.72.193 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/munchkin-beta.js Requested by Host: duo.com URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.92.72.193 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-92-72-193.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash aaddb9b9a1d45c5de508e64c3dace01f450e4a7521229e99f03838f5067cc8f9 Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers Date Sat, 23 Apr 2022 20:25:51 GMT Content-Encoding gzip Last-Modified Fri, 01 Oct 2021 01:04:09 GMT Server AkamaiNetStorage ETag "d2b1913e6438b06d03258094a8c365f8:1633050249.484514" Vary Accept-Encoding P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Connection keep-alive Accept-Ranges bytes Content-Type application/x-javascript Content-Length 752
GET H2	200	bat.js Show response bat.bing.com/	38 KB 12 KB	66ms 31ms	Script application/javascript	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/bat.js Requested by Host: duo.com URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 8540c5e2d2e85cc6c5d46b1b06b7f6642dce39e0314299a08976cfe6053c7c52 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip last-modified Wed, 09 Feb 2022 23:54:49 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: A15A22F87AC2401788520866BC9B17CE Ref B: FRAEDGE1209 Ref C: 2022-04-23T20:25:51Z etag "806a236c101ed81:0" vary Accept-Encoding x-cache CONFIG_NOCACHE content-type application/javascript access-control-allow-origin * cache-control private,max-age=1800 date Sat, 23 Apr 2022 20:25:51 GMT accept-ranges bytes content-length 11333
GET H2	200	aquant.js Show response secure.quantserve.com/	24 KB 10 KB	32ms 8ms	Script application/javascript	2620:116:800d:21:fcb8:22d2:d390:5f1b AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://secure.quantserve.com/aquant.js?a=p-4CduNLZtPCAtp Requested by Host: duo.com URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:116:800d:21:fcb8:22d2:d390:5f1b , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash 8d6580af877387b05d9ffac3ebeacfe25a7728c77adef6d9b32fd72ccbe21468 Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers date Sat, 23 Apr 2022 20:25:51 GMT content-encoding gzip etag "u2JtyZzqnTXwzBUswy2r+w==" vary Accept-Encoding content-type application/javascript cache-control private, max-age=604800 cross-origin-resource-policy cross-origin accept-ranges bytes expires Sat, 30 Apr 2022 20:25:51 GMT
GET H/1.1	200 OK	6si.min.js Show response j.6sc.co/	27 KB 9 KB	52ms 7ms	Script application/javascript	104.92.74.202 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://j.6sc.co/6si.min.js Requested by Host: duo.com URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-92-74-202.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash 2707e48726a3f7ec48a1d1aec9738f20b36bac1535cfa9de2e4d92310c4e7e7a Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers Date Sat, 23 Apr 2022 20:25:51 GMT Content-Encoding gzip X-Content-Type-Options nosniff Connection keep-alive Vary Accept-Encoding Content-Length 8575 Pragma no-cache Last-Modified Thu, 07 Oct 2021 17:17:43 GMT Server nginx/1.14.0 (Ubuntu) ETag "615f2bb7-6a5f" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type application/javascript Access-Control-Allow-Origin Cache-Control private, no-cache, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Sat, 23 Apr 2022 20:25:51 GMT
GET H/1.1	200 OK	lp.js Show response metadata-static-files.sfo2.cdn.digitaloceanspaces.com/pixel/	6 KB 6 KB	96ms 15ms	Script application/x-javascript	205.185.216.42 STACKPATH-CDN
General Check archive.org Show headers Download Go to Full URL https://metadata-static-files.sfo2.cdn.digitaloceanspaces.com/pixel/lp.js Requested by Host: duo.com URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 205.185.216.42 , United States, ASN20446 (STACKPATH-CDN, US), Reverse DNS map2.hwcdn.net Software / Resource Hash da5d487f1fe8c4f5bba93bab0b071aed1249cf770ffdbc0144a86a4c2bae3c2c Security Headers Name Value Strict-Transport-Security max-age=15552000; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers Date Sat, 23 Apr 2022 20:25:51 GMT Connection Keep-Alive Last-Modified Fri, 10 Dec 2021 19:19:18 GMT x-amz-request-id tx00000000000000bdc7dee-0062633427-26d7450b-sfo2a etag "b407e44b8c40c183ae2c50df3bbcf151" Vary Access-Control-Request-Headers,Access-Control-Request-Method,Origin X-HW 1650745551.dop015.am5.t,1650745551.cds119.am5.shn,1650745551.cds119.am5.c Content-Type application/x-javascript Cache-Control max-age=527832 x-rgw-object-type Normal strict-transport-security max-age=15552000; includeSubDomains; preload Accept-Ranges bytes Content-Length 5673
GET H2	200	bizible.js Show response cdn.bizible.com/scripts/	83 KB 32 KB	8ms 7ms	Script application/x-javascript	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://cdn.bizible.com/scripts/bizible.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MFPB9D Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/67D4) / Resource Hash cbda94666db24554bf77638fc059848d381c3c98f7f24641fa830abcd5793de7 Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers date Sat, 23 Apr 2022 20:25:51 GMT content-encoding gzip last-modified Fri, 22 Apr 2022 09:50:47 GMT server ECS (frb/67D4) age 73212 etag "1d65a712e56d81:0" vary Accept-Encoding x-cache HIT content-type application/x-javascript cache-control max-age=86400 accept-ranges bytes content-length 32300
GET H2	200	inlinks.js Show response jscloud.net/x/12296/	943 B 1017 B	123ms 21ms	Script application/javascript	2606:4700:20::ac43:48ae CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://jscloud.net/x/12296/inlinks.js Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtm.js?id=GTM-MFPB9D Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::ac43:48ae , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 96c5bfab045aceeb52ae2daa17605f436dd4ab9be43bbc87ac3debdbc9768ffb Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers date Sat, 23 Apr 2022 20:25:51 GMT content-encoding br cf-cache-status HIT last-modified Thu, 15 Jul 2021 06:33:19 GMT server cloudflare age 392 expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding,User-Agent report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=r%2F9SgxZ%2BsBQgVbSmxJKW4HL2Pj3WkKK5Lp3YE3XfuZiRbQBFXiJp2zWZJ1IA7MdoEoDGh%2BcXtS3G3Sws6kSYDV0XD%2BtxLdSxQLCtmyleprU27Ve%2Fcidkzbxgw8j1CMO1zs6ZC8B8t0Jp"}],"group":"cf-nel","max_age":604800} content-type application/javascript access-control-allow-origin * cache-control max-age=14400 nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} cf-ray 700954b1af6d690a-FRA
GET H2	404	data.json Show response duo.com/public/json-bodymovin/d-logo-light/	50 KB 12 KB	170ms 169ms	XHR text/html	13.225.80.94 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://duo.com/public/json-bodymovin/d-logo-light/data.json Requested by Host: duo.com URL: https://duo.com/js/build/production-2021.min.js?v=1647976353 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.225.80.94 , United States, ASN16509 (AMAZON-02, US), Reverse DNS server-13-225-80-94.fra2.r.cloudfront.net Software Duo/1.0 / Resource Hash 6a6d2038fc6ca01db16d2c528375510be154e1214cc694a6332d85a798fb4711 Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers date Sat, 23 Apr 2022 20:25:51 GMT content-encoding gzip server Duo/1.0 x-amz-cf-pop FRA2-C2 etag W/"6255da84-c905" vary Accept-Encoding x-cache Error from cloudfront content-type text/html; charset=utf-8 via 1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront) content-length 11795 x-amz-cf-id iJcqZsYZGo9yzl_zvy50T8HNWBf-sZOIy2CmEX7bGe8sipPOUByQrg==
GET H2	200	utag.js Show response tags.tiqcdn.com/utag/cisco/duo/prod/	209 KB 57 KB	65ms 22ms	Script application/x-javascript	95.100.208.216 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.js Requested by Host: www.cisco.com URL: https://www.cisco.com/c/dam/cdc/t/ctm.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 95.100.208.216 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a95-100-208-216.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash 8c685072fb706b91373f00500a93bfe2ba8f1130468d8851ab0d4314340fed0d Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers date Sat, 23 Apr 2022 20:25:51 GMT content-encoding gzip last-modified Thu, 14 Apr 2022 14:32:38 GMT server AkamaiNetStorage etag "c29fef9eea24ca36fd5dcff9b6c82ea9:1649946758.396091" vary Accept-Encoding content-type application/x-javascript cache-control max-age=300 accept-ranges bytes expires Sat, 23 Apr 2022 20:30:51 GMT
GET H2	200	rules-p-4CduNLZtPCAtp.js Show response rules.quantcount.com/	2 KB 1 KB	51ms 16ms	Script application/javascript	2600:9000:2156:4200:6:44e3:f8c0:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://rules.quantcount.com/rules-p-4CduNLZtPCAtp.js Requested by Host: secure.quantserve.com URL: https://secure.quantserve.com/aquant.js?a=p-4CduNLZtPCAtp Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2156:4200:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash 1d48d4cabc9c195baa08e42be70679688d706970ddd862bd91b857109d2a8874 Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers date Sat, 23 Apr 2022 20:22:55 GMT content-encoding gzip age 176 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront cross-origin-resource-policy cross-origin access-control-allow-origin * last-modified Wed, 03 Feb 2021 00:36:24 GMT server AmazonS3 etag W/"7d60bb0c5a7bdaca5a9466f9ef246056" vary Accept-Encoding access-control-allow-methods GET content-type application/javascript via 1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront) cache-control max-age=3600 x-amz-cf-pop FRA50-C1 x-amz-cf-id 2Yxwi_WbvHPV030E4VeNytzeugyzS2RxV0jEYElhqxiAJolcbb1-ag==
GET H2	200	ipv cdn.bizible.com/m/	43 B 304 B	7ms 7ms	Image image/gif	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.bizible.com/m/ipv?_biz_r=&_biz_h=-1906410348&_biz_u=3784c6066ff24c18962cf4619cd4dd50&_biz_s=51c712&_biz_l=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&_biz_t=1650745551683&_biz_i=%20%7C%20Decipher&_biz_n=0&a=duo.com&rnd=233028&cdn_o=a&_biz_z=1650745551684 Requested by Host: duo.com URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/6739) / Resource Hash afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277 Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers pragma no-cache date Sat, 23 Apr 2022 20:25:51 GMT last-modified Thu, 21 Apr 2022 01:07:01 GMT server ECS (frb/6739) age 242330 x-cache HIT p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" cache-control no-cache, no-store accept-ranges bytes content-type Image/GIF content-length 43 expires -1
GET H2	200	u cdn.bizibly.com/	43 B 203 B	18ms 7ms	Image image/gif	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.bizibly.com/u?_biz_u=3784c6066ff24c18962cf4619cd4dd50&_biz_s=51c712&_biz_l=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&_biz_t=1650745551686&_biz_i=%20%7C%20Decipher&a=duo.com&rnd=925517&cdn_o=a&_biz_z=1650745551686 Requested by Host: duo.com URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/67C2) / Resource Hash afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277 Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers pragma no-cache date Sat, 23 Apr 2022 20:25:51 GMT last-modified Thu, 21 Apr 2022 23:57:42 GMT server ECS (frb/67C2) age 160089 x-cache HIT p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" cache-control no-cache, no-store accept-ranges bytes content-type Image/GIF content-length 43 expires -1
GET H2	200	collect px4.ads.linkedin.com/ Redirect Chain https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7540&time=1650745551690&url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D7540%26time%3D1650745551690%26url%3Dhttps%253A%252F%252Fduo.com%252Fdecipher%252F... https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7540&time=1650745551690&url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&liSync=true https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7540&time=1650745551690&url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&liSync=true&e_ipv6=AQLYxfH...	0 265 B	566ms 168ms	Image application/javascript	13.107.42.14 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7540&time=1650745551690&url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&liSync=true&e_ipv6=AQLYxfHmy0GqjQAAAYBYGi68THEUbKI-zyJpfOpJYlYs5Gk8XWwWDq-PXUhlELD59B6t4dne Requested by Host: duo.com URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS Protocol H2 Server 13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers date Sat, 23 Apr 2022 20:25:52 GMT x-li-pop afd-prod-ltx1-x x-msedge-ref Ref A: FB6EAEA4B1DF465C9E1DCA8D33005EA0 Ref B: FRAEDGE1219 Ref C: 2022-04-23T20:25:53Z linkedin-action 1 x-cache CONFIG_NOCACHE content-type application/javascript x-li-proto http/2 content-length 0 x-li-uuid AAXdWCZPDEyOS/7DdbbTuw== x-li-fabric prod-ltx1 Redirect headers date Sat, 23 Apr 2022 20:25:51 GMT x-li-pop afd-prod-ltx1-x x-msedge-ref Ref A: ACE068EEB6A3453B835959F6142B8E11 Ref B: VIEEDGE1717 Ref C: 2022-04-23T20:25:52Z linkedin-action 1 x-cache CONFIG_NOCACHE x-li-fabric prod-ltx1 location https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7540&time=1650745551690&url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&liSync=true&e_ipv6=AQLYxfHmy0GqjQAAAYBYGi68THEUbKI-zyJpfOpJYlYs5Gk8XWwWDq-PXUhlELD59B6t4dne x-li-proto http/2 content-length 0 x-li-uuid AAXdWCZGX5O56RDm/evyOA==
GET H/1.1	200 OK	getuidj Show response secure.adnxs.com/	11 B 697 B	54ms 14ms	XHR application/json	185.33.220.240 ASN-APPNEX
General Check archive.org Show headers Download Go to Full URL https://secure.adnxs.com/getuidj Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=duo.com Protocol HTTP/1.1 Security TLS 1.2, ECDHE_ECDSA, AES_128_GCM Server 185.33.220.240 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US), Reverse DNS 717.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net Software nginx/1.21.3 / Resource Hash 31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d Security Headers Name Value X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers Pragma no-cache Date Sat, 23 Apr 2022 20:25:51 GMT X-Proxy-Origin 185.213.155.163; 185.213.155.163; 717.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com AN-X-Request-Uuid 3a8a5472-eae1-447d-92fa-e5e6570c642c Server nginx/1.21.3 P3P policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Access-Control-Allow-Origin https://duo.com Cache-Control no-store, no-cache, private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json; charset=utf-8 Content-Length 11 X-XSS-Protection 0 Expires Sat, 15 Nov 2008 16:00:00 GMT
GET H/1.1	200 OK	/ Show response c.6sc.co/	47 B 363 B	44ms 7ms	XHR text/plain	104.92.74.202 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://c.6sc.co/ Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=duo.com Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-92-74-202.deploy.static.akamaitechnologies.com Software / Resource Hash b1abd3b01e2c2b7089605b10d8c565730201eb2cb6e800188b2c6b68fe657289 Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers Date Sat, 23 Apr 2022 20:25:51 GMT Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type text/plain Access-Control-Allow-Origin https://duo.com Access-Control-Allow-Credentials true Connection keep-alive Access-Control-Allow-Headers * Content-Length 47
GET H3	200	216127175396154 Show response connect.facebook.net/signals/config/	305 KB 87 KB	167ms 157ms	Script application/x-javascript	2a03:2880:f01c:216:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/216127175396154?v=2.9.57&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash c5028b9a532fb2423ea0b8cd61837102ba21bf6e3e749b90232fd4f0258cc707 Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; content-encoding gzip x-content-type-options nosniff document-policy force-load-at-top report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400,h3-29=":443"; ma=86400 x-xss-protection 0 pragma public x-fb-debug sfwouCYKZ45upT1asnC24dovOwlYeJo/ZZbZ7j1/R6T5PG67biwoz5VKqkHR5jAOXAaTDbkPi+V2DYKea4XExw== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" cross-origin-opener-policy same-origin-allow-popups x-frame-options DENY date Sat, 23 Apr 2022 20:25:51 GMT strict-transport-security max-age=31536000; preload; includeSubDomains x-content-cdn-origin-ts 1650745551863 content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cache-control public, max-age=1200 x-fb-rlafr 0 priority u=3,i expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	xdframe-single-domain-1.1.1.html Show response csxd.contentsquare.net/uxa/ Frame 9DE4	2 KB 1 KB	78ms 7ms	Document text/html	2600:9000:2057:4800:1b:ed91:4680:93a1 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://csxd.contentsquare.net/uxa/xdframe-single-domain-1.1.1.html?pid=5637 Requested by Host: t.contentsquare.net URL: https://t.contentsquare.net/uxa/ebdaa317731b0.js Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2600:9000:2057:4800:1b:ed91:4680:93a1 , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software AmazonS3 / Resource Hash d1a9abb0dc96d5a0fcc121a6de3a2c29c193a91d2f68939080e111b54d01d9e8 Request headers Referer https://duo.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers age 2784476 cache-control max-age=31536000 content-encoding gzip content-type text/html date Tue, 22 Mar 2022 14:57:56 GMT etag W/"fbd0a9f9a63a143cf028aca21682b386" last-modified Mon, 07 Mar 2022 15:32:43 GMT server AmazonS3 vary Accept-Encoding via 1.1 49140b838a62cd29e30f20e39a82dad0.cloudfront.net (CloudFront) x-amz-cf-id E5-ga-hn0eFJ1-nGqG41Ca3CU6_QdE6UEaUiyFTB6aWQqYJzpqz1aA== x-amz-cf-pop FRA6-C1 x-amz-server-side-encryption AES256 x-cache Hit from cloudfront
POST H2	204	collect analytics.google.com/g/	0 341 B	140ms 44ms	Ping text/plain	2a00:1450:4001:80f::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://analytics.google.com/g/collect?v=2&tid=G-95Z7P6PE75&gtm=2oe4k0&_p=2142235294&_z=ccd.NbB&_gaz=1&cid=1970540642.1650745552&ul=en-us&sr=1600x1200&_s=1&sid=1650745551&sct=1&seg=0&dl=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&dt=%7C%20Decipher&en=page_view&_fv=1&_nsi=1&_ss=1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-95Z7P6PE75&l=dataLayer&cx=c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers pragma no-cache date Sat, 23 Apr 2022 20:25:51 GMT server Golfe2 content-type text/plain access-control-allow-origin https://duo.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	204	collect stats.g.doubleclick.net/g/	0 47 B	63ms 19ms	Ping text/plain	2a00:1450:400c:c06::9c GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/g/collect?v=2&tid=G-95Z7P6PE75&cid=1970540642.1650745552&gtm=2oe4k0&aip=1 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-95Z7P6PE75&l=dataLayer&cx=c Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c06::9c Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers pragma no-cache date Sat, 23 Apr 2022 20:25:51 GMT server Golfe2 content-type text/plain access-control-allow-origin https://duo.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.de/ads/	42 B 501 B	199ms 107ms	Image image/gif	2a00:1450:4001:80f::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-95Z7P6PE75&cid=1970540642.1650745552&gtm=2oe4k0&aip=1&z=1544276172 Requested by Host: duo.com URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers pragma no-cache date Sat, 23 Apr 2022 20:25:51 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET BLOB	200 OK	3f4ff81a-0faf-47bd-b4be-2852c0186612 https://duo.com/	6 KB 0		Other application/javascript
General Check archive.org Show headers Download Go to Full URL blob:https://duo.com/3f4ff81a-0faf-47bd-b4be-2852c0186612 Requested by Host: duo.com URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS Protocol BLOB Server -, , ASN (), Reverse DNS Software / Resource Hash 10dfb21244c78df328ae9cff5429f822f5244e8d90c1efe5c26cc851d7a12f24 Request headers accept-language de-DE,de;q=0.9 Referer User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers Content-Length 6483 Content-Type application/javascript
GET H2	200	4006052.js Show response bat.bing.com/p/action/	843 B 841 B	199ms 198ms	Script application/javascript	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://bat.bing.com/p/action/4006052.js Requested by Host: bat.bing.com URL: https://bat.bing.com/bat.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash 1403c3e4df327d10852ab8a27fdc49f911d3a55bf0c8892c0fd6f5ed6de2d1d7 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers pragma no-cache strict-transport-security max-age=31536000; includeSubDomains; preload content-encoding gzip accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: AF15ACB8A9584F9688B204DBD4420090 Ref B: FRAEDGE1209 Ref C: 2022-04-23T20:25:51Z date Sat, 23 Apr 2022 20:25:51 GMT vary Accept-Encoding x-cache CONFIG_NOCACHE content-type application/javascript; charset=utf-8 access-control-allow-origin * cache-control no-store,no-cache content-length 666
GET H2	204	0 bat.bing.com/action/	0 174 B	31ms 31ms	Image text/plain	2620:1ec:c11::200 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://bat.bing.com/action/0?ti=4006052&Ver=2&mid=0dd41013-9acb-425c-9998-61e2ca9547b7&sid=91c8f950c34311ec85d84fdc6f60f7db&vid=91c93040c34311ec97e4093ff0b1c453&vids=1&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=%7C%20Decipher&p=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&r=&lt=2393&evt=pageLoad&msclkid=N&sv=1&rn=864388 Requested by Host: duo.com URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains; preload Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers pragma no-cache strict-transport-security max-age=31536000; includeSubDomains; preload accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: F224F5F95E6A4A46A809EEEAA1138B02 Ref B: FRAEDGE1209 Ref C: 2022-04-23T20:25:51Z date Sat, 23 Apr 2022 20:25:51 GMT x-cache CONFIG_NOCACHE access-control-allow-origin * cache-control no-cache, must-revalidate expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	httpsduocomdeciphertrailblazerhuntscompromisedcredentialsinawsnAWS.json Show response jscloud.net/x/13009/	26 B 556 B	319ms 304ms	XHR application/json	2606:4700:20::ac43:48ae CLOUDFLARENET
General Check archive.org Show headers Download Go to Full URL https://jscloud.net/x/13009/httpsduocomdeciphertrailblazerhuntscompromisedcredentialsinawsnAWS.json Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=duo.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2606:4700:20::ac43:48ae , United States, ASN13335 (CLOUDFLARENET, US), Reverse DNS Software cloudflare / Resource Hash 0a998ab5472475c3418c7977b6214c566aad928094dceb86d2e9f53bdbdd26c0 Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers date Sat, 23 Apr 2022 20:25:52 GMT cf-cache-status DYNAMIC last-modified Thu, 16 Jan 2020 10:42:21 GMT server cloudflare expect-ct max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" vary Accept-Encoding,User-Agent report-to {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=u6GsYrn2eOXcD8Dw%2FrfqVq85uvrQwQCaPPSR4b12i%2BdPcDEm5VkbWhAqdWiT01qJ58x3THSXiClTNtzRV71YFpeYbumDqpzgp%2BWfVVk9t7vXRzbYIR9sytaI6mA%2BD5csRF%2FphbIysLCK"}],"group":"cf-nel","max_age":604800} content-type application/json access-control-allow-origin * nel {"success_fraction":0,"report_to":"cf-nel","max_age":604800} accept-ranges bytes cf-ray 700954b2bd3d925c-FRA content-length 26
POST H3	200	collect Show response www.google-analytics.com/j/	2 B 22 B	126ms 46ms	XHR text/plain	2a00:1450:4001:812::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.google-analytics.com/j/collect?v=1&_v=j96&a=2142235294&t=pageview&_s=1&dl=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&ul=en-us&de=UTF-8&dt=%7C%20Decipher&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aADAAAABQAAAAC~&jid=672138589&gjid=1035995929&cid=1970540642.1650745552&tid=UA-20141016-1&_gid=395505349.1650745552&_r=1&gtm=2wg4k0MFPB9D&z=1651038086 Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=duo.com Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af Security Headers Name Value X-Content-Type-Options nosniff Request headers Referer https://duo.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Content-Type text/plain Response headers pragma no-cache date Sat, 23 Apr 2022 20:25:51 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 content-type text/plain access-control-allow-origin https://duo.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 2 expires Fri, 01 Jan 1990 00:00:00 GMT
POST H2	200	collect Show response stats.g.doubleclick.net/j/	4 B 436 B	27ms 19ms	XHR text/plain	2a00:1450:400c:c06::9c GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-20141016-1&cid=1970540642.1650745552&jid=2130065277&gjid=2088971072&_gid=395505349.1650745552&_u=aCDAgAABQAAAAG~&z=1316543895 Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=duo.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:400c:c06::9c Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://duo.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 date Sat, 23 Apr 2022 20:25:51 GMT content-type text/plain access-control-allow-origin https://duo.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	collect www.google-analytics.com/	35 B 55 B	113ms 39ms	Image image/gif	2a00:1450:4001:812::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google-analytics.com/collect?v=1&_v=j96&a=2142235294&t=pageview&_s=1&dl=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&ul=en-us&de=UTF-8&dt=%7C%20Decipher&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aCDAgAABQAAAAC~&jid=2130065277&gjid=2088971072&cid=1970540642.1650745552&tid=UA-20141016-1&_gid=395505349.1650745552&gtm=2wg4k0MFPB9D&cg3=Decipher%20Traffic%20Only&z=449829468 Requested by Host: duo.com URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers pragma no-cache date Sat, 23 Apr 2022 13:53:59 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 age 23512 content-type image/gif access-control-allow-origin * cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 35 expires Mon, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	rd Show response dpm.demdex.net/id/ Redirect Chain https://dpm.demdex.net/id?d_visid_ver=4.1.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=B8D07FF4520E94C10A490D4C%40AdobeOrg&d_nsid=0&ts=1650745551814 https://dpm.demdex.net/id/rd?d_visid_ver=4.1.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=B8D07FF4520E94C10A490D4C%40AdobeOrg&d_nsid=0&ts=1650745551814	973 B 1 KB	30ms 30ms	XHR application/json	99.81.5.109 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://dpm.demdex.net/id/rd?d_visid_ver=4.1.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=B8D07FF4520E94C10A490D4C%40AdobeOrg&d_nsid=0&ts=1650745551814 Requested by Host: duo.com URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS Protocol HTTP/1.1 Server 99.81.5.109 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-99-81-5-109.eu-west-1.compute.amazonaws.com Software / Resource Hash ccd5ccffdeefbc9a639364df7ce84211878f3a7413fe908939dd6df65bc25eb6 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers DCS dcs-prod-irl1-2-v031-0cf28f2d1.edge-irl1.demdex.com UNKNOWN Pragma no-cache Strict-Transport-Security max-age=31536000; includeSubDomains content-encoding gzip X-TID 6woWcy4HTyw= Vary Origin P3P policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Access-Control-Allow-Origin https://duo.com Cache-Control no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Access-Control-Allow-Credentials true Connection keep-alive Content-Type application/json;charset=utf-8 Content-Length 532 Expires Thu, 01 Jan 1970 00:00:00 UTC Redirect headers DCS dcs-prod-irl1-2-v031-0f46fb2c8.edge-irl1.demdex.com UNKNOWN Pragma no-cache Strict-Transport-Security max-age=31536000; includeSubDomains Access-Control-Allow-Origin https://duo.com X-TID Oj4PRcJARZo= Vary Origin P3P policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Location https://dpm.demdex.net/id/rd?d_visid_ver=4.1.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=B8D07FF4520E94C10A490D4C%40AdobeOrg&d_nsid=0&ts=1650745551814 Cache-Control no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Access-Control-Allow-Credentials true Connection keep-alive Content-Length 0 Expires Thu, 01 Jan 1970 00:00:00 UTC
GET H2	200	xdc.js Show response cdn.bizible.com/	116 B 525 B	118ms 118ms	Script text/javascript	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Full URL https://cdn.bizible.com/xdc.js?_biz_u=3784c6066ff24c18962cf4619cd4dd50&_biz_h=-1906410348&cdn_o=a&jsVer=4.22.02.16&a=duo.com Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=duo.com Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/6711) / Resource Hash 82987c0cc9955a62a0f39457179cc41438567909f2ea0b3d18d05f26e3842c9c Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers date Sat, 23 Apr 2022 20:25:51 GMT content-encoding gzip server ECS (frb/6711) etag 5F75AD94 vary Accept-Encoding p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" cache-control private, must-revalidate, max-age=21600 content-type text/javascript; charset=utf-8 content-length 219
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	228ms 205ms	Image image/gif	104.92.74.202 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=361da14e9cc9e3c3150a35780c1bec6b&svisitor=null&session=1fd848ae-fdd7-4b53-8a84-aff8e67cc364&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A25%3A51%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Security%20without%20fear.%20The%20web%20doesn%E2%80%99t%20have%20to%20be%20dark.%20Decipher%E2%80%99s%20goal%20is%20to%20bring%20order%20to%20this%20unpredictable%20and%20often%20confusing%20landscape%20by%20providing%20fresh%20perspectives%20from%20trusted%20voices.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%20%7C%20Decipher%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&pageViewId=f721e288-fc54-430a-8566-c2615b5598d4&an_uid=0 Requested by Host: duo.com URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-92-74-202.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers Date Sat, 23 Apr 2022 20:25:52 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Fri, 21 Feb 2020 18:57:20 GMT Server nginx/1.14.0 (Ubuntu) ETag "5e502810-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H/1.1	200 OK	munchkin.js Show response munchkin.marketo.net/161/	11 KB 5 KB	8ms 8ms	Script application/x-javascript	104.92.72.193 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://munchkin.marketo.net/161/munchkin.js Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/munchkin-beta.js Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.92.72.193 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-92-72-193.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash c2aee78040b4ed46c2377e6825db12a9691a2eb584adf338e77312c8978d8537 Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers Date Sat, 23 Apr 2022 20:25:51 GMT Content-Encoding gzip Last-Modified Wed, 08 Sep 2021 00:38:21 GMT Server AkamaiNetStorage ETag "0e0eefac8daf874e8b1aa34aeb160c52:1631061501.737429" Vary Accept-Encoding P3P policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR" Cache-Control max-age=8640000 Connection keep-alive Accept-Ranges bytes Content-Type application/x-javascript Content-Length 4681 Expires Mon, 01 Aug 2022 20:25:51 GMT
GET H2	200	utag.5.js Show response tags.tiqcdn.com/utag/cisco/duo/prod/	72 KB 26 KB	16ms 15ms	Script application/x-javascript	95.100.208.216 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.5.js?utv=ut4.46.202204141432 Requested by Host: tags.tiqcdn.com URL: https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 95.100.208.216 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a95-100-208-216.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash b9a30fc3aae53b1ec17fd01ab60fd6fd09dfc4ad82967fd11e0c024bad354587 Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers date Sat, 23 Apr 2022 20:25:51 GMT content-encoding gzip last-modified Thu, 14 Apr 2022 14:32:38 GMT server AkamaiNetStorage etag "b2aa28110d124d4c147a653bf129ffb4:1649946758.099569" vary Accept-Encoding content-type application/x-javascript cache-control max-age=1296000 accept-ranges bytes content-length 25935 expires Sun, 08 May 2022 20:25:51 GMT
GET H2	200	utag.3.js Show response tags.tiqcdn.com/utag/cisco/duo/prod/	22 KB 7 KB	15ms 14ms	Script application/x-javascript	95.100.208.216 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.3.js?utv=ut4.46.202204141432 Requested by Host: tags.tiqcdn.com URL: https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 95.100.208.216 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a95-100-208-216.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash d8b2f6ab3701d3ae42d7519c2798c137b53f31c835a6c16df02a6274beac83d0 Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers date Sat, 23 Apr 2022 20:25:51 GMT content-encoding gzip last-modified Thu, 14 Apr 2022 14:32:38 GMT server AkamaiNetStorage etag "cb3d4ed207da7be05643ceb0c33b9ac5:1649946758.758679" vary Accept-Encoding content-type application/x-javascript cache-control max-age=1296000 accept-ranges bytes content-length 7283 expires Sun, 08 May 2022 20:25:51 GMT
GET H2	200	utag.28.js Show response tags.tiqcdn.com/utag/cisco/duo/prod/	2 KB 1 KB	14ms 14ms	Script application/x-javascript	95.100.208.216 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.28.js?utv=ut4.46.202106171628 Requested by Host: tags.tiqcdn.com URL: https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 95.100.208.216 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a95-100-208-216.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash c72062a60866c674a25f2a5b5d8344e9509c7381a6472f2a484325ac14597ee8 Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers date Sat, 23 Apr 2022 20:25:51 GMT content-encoding gzip last-modified Thu, 17 Jun 2021 16:28:49 GMT server AkamaiNetStorage etag "097dc543fb3caec1bac670f2bd520652:1623947329.572906" vary Accept-Encoding content-type application/x-javascript cache-control max-age=1296000 accept-ranges bytes content-length 999 expires Sun, 08 May 2022 20:25:51 GMT
GET H2	200	pixel;r=1194282661;labels=_fp.event.Default;rf=0;a=p-4CduNLZtPCAtp;url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS;uht=2;fpan=1;fpa=P0-569987462-16507... pixel.quantserve.com/	35 B 372 B	13ms 12ms	Image image/gif	2620:116:800d:21:fcb8:22d2:d390:5f1b AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://pixel.quantserve.com/pixel;r=1194282661;labels=_fp.event.Default;rf=0;a=p-4CduNLZtPCAtp;url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS;uht=2;fpan=1;fpa=P0-569987462-1650745551833;pbc=;ns=0;ce=1;qjs=1;qv=a98acd33-20220316110313;cm=;gdpr=0;ref=;d=duo.com;je=0;sr=1600x1200x24;dst=0;et=1650745551833;tzo=0;ogl=site_name.Decipher%2Ctype.website%2Curl.%2Cdescription.Security%20without%20fear%252E%20The%20web%20doesn%E2%80%99t%20have%20to%20be%20dark%252E%20Decipher%E2%80%99s%20goal%20is%20to%20br%2Cimage.http%3A%2F%2Fduo-www-v3-clean%252Etest%2Fassets%2Fimg%2Fseo-images%2Fmeta-decipher-default%252Ejpg%2Cimage%3Awidth.1200%2Cimage%3Aheight.630 Requested by Host: duo.com URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 2620:116:800d:21:fcb8:22d2:d390:5f1b , United States, ASN16509 (AMAZON-02, US), Reverse DNS Software / Resource Hash a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8 Security Headers Name Value Strict-Transport-Security max-age=86400 Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers pragma no-cache date Sat, 23 Apr 2022 20:25:51 GMT strict-transport-security max-age=86400 p3p CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV" cache-control private, no-cache, no-store, proxy-revalidate content-type image/gif content-length 35 expires Fri, 04 Aug 1978 12:00:00 GMT
GET H2	200	ga-audiences www.google.com/ads/	42 B 501 B	382ms 298ms	Image image/gif	2a00:1450:4001:831::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-20141016-1&cid=1970540642.1650745552&jid=2130065277&_u=aCDAgAABQAAAAG~&z=1933731971 Requested by Host: duo.com URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers pragma no-cache date Sat, 23 Apr 2022 20:25:52 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	ga-audiences www.google.de/ads/	42 B 107 B	239ms 232ms	Image image/gif	2a00:1450:4001:80f::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-20141016-1&cid=1970540642.1650745552&jid=2130065277&_u=aCDAgAABQAAAAG~&z=1933731971 Requested by Host: duo.com URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers pragma no-cache date Sat, 23 Apr 2022 20:25:52 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	204	pageview c.contentsquare.net/	0 320 B	103ms 28ms	Image text/plain	54.72.196.102 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://c.contentsquare.net/pageview?pid=5637&uu=2102bbfc-9992-aab2-e650-4ec6c651b846&sn=1&lv=1650745551&lhd=1650745551&hd=1650745551&pn=1&dw=1600&dh=1373&ww=1600&wh=1200&sw=1600&sh=1200&dr=&url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&uc=1&la=en-US&v=11.20.0&r=245523 Requested by Host: duo.com URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.72.196.102 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-72-196-102.eu-west-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers pragma no-cache date Sat, 23 Apr 2022 20:25:51 GMT access-control-allow-methods GET, POST, OPTIONS access-control-allow-origin * cache-control no-cache, no-store, must-revalidate, pre-check=0, post-check=0 content-disposition inline timing-allow-origin * access-control-allow-headers Access-Control-Expose-Headers, Content-Type, Content-Compression, X-Requested-With expires Sun, 24 Oct 1982 23:00:00 GMT
GET H3	200	gtm.js Show response www.googletagmanager.com/	287 KB 85 KB	58ms 58ms	Script application/javascript	2a00:1450:4001:811::2008 GOOGLE
General Check archive.org Show headers Download Go to Full URL https://www.googletagmanager.com/gtm.js?id=GTM-MFPB9D&l=dataLayer Requested by Host: tags.tiqcdn.com URL: https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Google Tag Manager / Resource Hash 34c727e51a6df37234ce8086a0b56b8c62ce12b2a765a198f4c0f9dd8791d6c9 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers date Sat, 23 Apr 2022 20:25:51 GMT content-encoding br vary Accept-Encoding cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 86997 x-xss-protection 0 last-modified Sat, 23 Apr 2022 18:00:00 GMT server Google Tag Manager strict-transport-security max-age=31536000; includeSubDomains content-type application/javascript; charset=UTF-8 access-control-allow-origin * cache-control private, max-age=900 access-control-allow-credentials true access-control-allow-headers Cache-Control expires Sat, 23 Apr 2022 20:25:51 GMT
POST H/1.1	200 OK	visitWebPage 074-uqx-410.mktoresp.com/webevents/	2 B 311 B	1047ms 159ms	Ping text/plain	192.28.147.68 OMNITURE
General Check archive.org Show headers Download Go to Full URL https://074-uqx-410.mktoresp.com/webevents/visitWebPage?_mchNc=1650745551867&_mchCn=&_mchId=074-UQX-410&_mchTk=_mch-duo.com-1650745551866-32900&_mchHo=duo.com&_mchPo=&_mchRu=%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&_mchPc=https%3A&_mchVr=161&_mchEcid=&_mchHa=&_mchRe=&_mchQp= Requested by Host: munchkin.marketo.net URL: https://munchkin.marketo.net/161/munchkin.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 192.28.147.68 , United States, ASN15224 (OMNITURE, US), Reverse DNS Software nginx / Resource Hash 565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3 Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers Date Sat, 23 Apr 2022 20:25:52 GMT Content-Encoding gzip Server nginx Transfer-Encoding chunked Content-Type text/plain; charset=UTF-8 Access-Control-Allow-Origin * Connection keep-alive X-Request-Id ee5131db-d569-426c-b97e-7c96bb2b9ee0
GET H/1.1	200 OK	ntpagetag.gif cisco-tags.cisco.com/tag/	85 B 598 B	734ms 126ms	Image image/gif	72.163.10.10 CISCOSYSTEMS
General Check archive.org Show headers Download Go to Show image Full URL https://cisco-tags.cisco.com/tag/ntpagetag.gif?js=1&ts=1650745551871.978&lc=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&rs=1600x1200&cd=24&ln=en&tz=GMT&jv=0&utag_main_v_id=0180581a2bb600232beab95db30003074004e06c00b08&meta.viewport=width%3Ddevice-width%2C%20initial-scale%3D1.0%2C%20user-scalable%3Dyes&title=%7C%20decipher&url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&tag=ut4.46.202204141432&entitlement=undefined&locale=en-us&meta.country=us&meta.locale=us&breakpoint=unavailable&content_type=no%20contenttype&linktrack=linkpage&loc=http%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&cookie_length=1000&meta.iapath=no%20iapath&hier1=no%20iapath&meta.wm_reporting_category=no%20iapath&sa_source=meta.iapath&t_profile=cisco.duo&t_load=ctm&suite=cisco-complete&returnVisit=false&cookies=true&localstorage=true&dnt=false&_ga=GA1.2.1970540642.1650745552&conversion=event1&adobeVersions=AppMeasurement%3Dna%2CVisitorJS%3Dna%2CMbox%3Dna&meta.msapplication-tilecolor=%23000000&meta.msapplication-config=%2Fassets%2Fimg%2Fdecipher%2Ffavicons%2Fbrowserconfig.xml&meta.theme-color=%23ffffff&meta.robots=index%2Cfollow%2Carchive&meta.fb:app_id=2090208394329663&meta.og:site_name=decipher&meta.og:type=website&meta.twitter:card=summary_large_image&meta.twitter:site=%40deciphersec&meta.twitter:creator=%40deciphersec&meta.description=security%20without%20fear.%20the%20web%20doesn%E2%80%99t%20have%20to%20be%20dark.%20decipher%E2%80%99s%20goal%20is%20to%20bring%20order%20to%20this%20unpredictable%20and%20often%20confusing%20landscape%20by%20providing%20fresh%20perspectives%20from%20trusted%20voices.&meta.og:description=security%20without%20fear.%20the%20web%20doesn%E2%80%99t%20have%20to%20be%20dark.%20decipher%E2%80%99s%20goal%20is%20to%20bring%20order%20to%20this%20unpredictable%20and%20often%20confusing%20landscape%20by%20providing%20fresh%20perspectives%20from%20trusted%20voices.&meta.twitter:description=security%20without%20fear.%20the%20web%20doesn%E2%80%99t%20have%20to%20be%20dark.%20decipher%E2%80%99s%20goal%20is%20to%20bring%20order%20to%20this%20unpredictable%20and%20often%20confusing%20landscape%20by%20providing%20fresh%20perspectives%20from%20trusted%20voices.&meta.twitter:image=http%3A%2F%2Fduo-www-v3-clean.test%2Fassets%2Fimg%2Fseo-images%2Fmeta-decipher-default.jpg&meta.og:image=http%3A%2F%2Fduo-www-v3-clean.test%2Fassets%2Fimg%2Fseo-images%2Fmeta-decipher-default.jpg&meta.og:image:width=1200&meta.og:image:height=630&meta.bitly-verification=040b99f315c6&meta.google-site-verification=svd8ahbyylsc2wljqdzwij1d2tnu8-u3fbldciehxdu&meta.twitter:widgets:csp=on&meta.msvalidate.01=27fb624dbd3f07315a4bf69f5d649c68&ets=1650745551873.905 Requested by Host: duo.com URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS Protocol HTTP/1.1 Security TLS 1.2, RSA, AES_128_GCM Server 72.163.10.10 , United States, ASN109 (CISCOSYSTEMS, US), Reverse DNS cisco-tags.cisco.com Software Apache/2.2 / Resource Hash b96b64444f7d52c39b5716fe4d3e8d0433c67fb79731a4400188835d97b74bce Security Headers Name Value Content-Security-Policy script-src 'self'; object-src 'self' Strict-Transport-Security max-age=31536000; includeSubdomains; X-Content-Type-Options nosniff X-Frame-Options SAMEORIGIN X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers Date Sat, 23 Apr 2022 20:25:52 GMT X-Content-Type-Options nosniff Last-Modified Fri, 12 Jun 2009 13:18:26 GMT Server Apache/2.2 ETag "55" X-Frame-Options SAMEORIGIN Content-Type image/gif Access-Control-Allow-Origin * Connection Keep-Alive Content-Security-Policy script-src 'self'; object-src 'self' Strict-Transport-Security max-age=31536000; includeSubdomains; Accept-Ranges bytes Keep-Alive timeout=2, max=1000 Content-Length 85 X-XSS-Protection 1; mode=block
GET H2	200	utag.v.js Show response tags.tiqcdn.com/utag/tiqapp/	2 B 202 B	7ms 7ms	Script application/x-javascript	95.100.208.216 AKAMAI-AS
General Check archive.org Show headers Download Go to Full URL https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=cisco/duo/202204141432&cb=1650745551876 Requested by Host: tags.tiqcdn.com URL: https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 95.100.208.216 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a95-100-208-216.deploy.static.akamaitechnologies.com Software AkamaiNetStorage / Resource Hash a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers date Sat, 23 Apr 2022 20:25:51 GMT last-modified Thu, 14 Apr 2016 16:57:51 GMT server AkamaiNetStorage etag "7bc0ee636b3b83484fc3b9348863bd22:1460653071" content-type application/x-javascript cache-control max-age=600 accept-ranges bytes content-length 2 expires Sat, 23 Apr 2022 20:35:51 GMT
POST H3	200	collect Show response stats.g.doubleclick.net/j/	4 B 25 B	56ms 19ms	XHR text/plain	2a00:1450:400c:c06::9c GOOGLE
General Check archive.org Show headers Download Go to Full URL https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-20141016-1&cid=1970540642.1650745552&jid=672138589&gjid=1035995929&_gid=395505349.1650745552&_u=aADAAAAAQAAAAC~&z=1664567021 Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=duo.com Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:400c:c06::9c Brussels, Belgium, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80 Security Headers Name Value Strict-Transport-Security max-age=10886400; includeSubDomains; preload X-Content-Type-Options nosniff Request headers Referer https://duo.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Content-Type text/plain Response headers pragma no-cache strict-transport-security max-age=10886400; includeSubDomains; preload x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 date Sat, 23 Apr 2022 20:25:51 GMT content-type text/plain access-control-allow-origin https://duo.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 4 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	120108061684670 Show response connect.facebook.net/signals/config/	305 KB 87 KB	283ms 282ms	Script application/x-javascript	2a03:2880:f01c:216:face:b00c:0:3 FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://connect.facebook.net/signals/config/120108061684670?v=2.9.57&r=stable Requested by Host: connect.facebook.net URL: https://connect.facebook.net/en_US/fbevents.js Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software / Resource Hash 22b6980432a6921ed17c090fcce9c581a6bbca8eeba48476f9e2b4b948beb520 Security Headers Name Value Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; Strict-Transport-Security max-age=31536000; preload; includeSubDomains X-Content-Type-Options nosniff X-Frame-Options DENY X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers content-security-policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0; content-encoding gzip x-content-type-options nosniff document-policy force-load-at-top report-to {"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"} cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400,h3-29=":443"; ma=86400 x-xss-protection 0 pragma public x-fb-debug SiPuYr9EK/u79cVD+rBtKcyNJtZYXV2vHvUd1NubNki46/hcmjKFmxD8ITzOTXuLvJsqJkBQV1K3SGe30tDx6A== cross-origin-embedder-policy-report-only require-corp;report-to="coep_report" cross-origin-opener-policy same-origin-allow-popups x-frame-options DENY date Sat, 23 Apr 2022 20:25:52 GMT strict-transport-security max-age=31536000; preload; includeSubDomains x-content-cdn-origin-ts 1650745552213 content-type application/x-javascript; charset=utf-8 vary Accept-Encoding cache-control public, max-age=1200 x-fb-rlafr 0 priority u=3,i expires Sat, 01 Jan 2000 00:00:00 GMT
GET H2	200	/ www.facebook.com/tr/	44 B 297 B	30ms 7ms	Image image/gif	2a03:2880:f11c:8183:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=216127175396154&ev=PageView&dl=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&rl=&if=false&ts=1650745551934&sw=1600&sh=1200&v=2.9.57&r=stable&ec=0&o=30&fbp=fb.1.1650745551932.1591478257&it=1650745551700&coo=false&exp=p1&rqm=GET Requested by Host: duo.com URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers date Sat, 23 Apr 2022 20:25:51 GMT last-modified Fri, 21 Dec 2012 00:00:01 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains content-type image/gif cache-control no-cache, must-revalidate, max-age=0 cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 44 expires Sat, 23 Apr 2022 20:25:51 GMT
GET H2	200	clarity.js Show response l.clarity.ms/s/0.6.34/	53 KB 23 KB	324ms 93ms	Script application/javascript	20.120.65.166 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://l.clarity.ms/s/0.6.34/clarity.js Requested by Host: bat.bing.com URL: https://bat.bing.com/p/action/4006052.js Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 20.120.65.166 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash ca63193ce799e4e00c9106349365981dc6e26cb77632ebf5df23dffba2aaccfa Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers date Sat, 23 Apr 2022 20:25:52 GMT content-encoding br etag "1d8530fabd6bb54" last-modified Mon, 18 Apr 2022 10:32:58 GMT server Microsoft-IIS/10.0 x-powered-by ASP.NET vary Accept-Encoding content-type application/javascript;charset=utf-8 cache-control public,max-age=86400 accept-ranges bytes request-context appId=cid-v1:e55edbbe-e22b-46b4-8313-9ee2a4e71d12
GET H2	200	ga-audiences www.google.com/ads/	42 B 107 B	1582ms 1581ms	Image image/gif	2a00:1450:4001:831::2004 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-20141016-1&cid=1970540642.1650745552&jid=672138589&_u=aADAAAAAQAAAAC~&z=585327608 Requested by Host: duo.com URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS Protocol H2 Security TLS 1.3, , AES_128_GCM Server 2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers pragma no-cache date Sat, 23 Apr 2022 20:25:53 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H3	200	ga-audiences www.google.de/ads/	42 B 63 B	148ms 72ms	Image image/gif	2a00:1450:4001:80f::2003 GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-20141016-1&cid=1970540642.1650745552&jid=672138589&_u=aADAAAAAQAAAAC~&z=585327608 Requested by Host: duo.com URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software cafe / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value X-Content-Type-Options nosniff X-Xss-Protection 0 Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers pragma no-cache date Sat, 23 Apr 2022 20:25:52 GMT x-content-type-options nosniff server cafe timing-allow-origin * p3p policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC" cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin content-type image/gif alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 42 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	dest5.html Show response cisco.demdex.net/ Frame 77E7	7 KB 3 KB	149ms 34ms	Document text/html	52.49.218.107 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://cisco.demdex.net/dest5.html?d_nsid=0 Requested by Host: tags.tiqcdn.com URL: https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.js Protocol HTTP/1.1 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 52.49.218.107 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-49-218-107.eu-west-1.compute.amazonaws.com Software / Resource Hash 7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Referer https://duo.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers Accept-Ranges bytes Cache-Control no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Connection keep-alive Content-Length 2791 Content-Type text/html;charset=UTF-8 DCS dcscanary-prod-irl1-1-v036-065406f3e.edge-irl1.demdex.com UNKNOWN Expires Thu, 01 Jan 1970 00:00:00 UTC P3P policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Pragma no-cache Strict-Transport-Security max-age=31536000; includeSubDomains X-TID yGKAjmvbSro= content-encoding gzip date Sat, 23 Apr 2022 20:25:52 GMT last-modified Wed, 13 Apr 2022 14:39:52 GMT vary accept-encoding
GET H2	200	id Show response smetrics.cisco.com/	48 B 500 B	274ms 16ms	XHR application/x-javascript	13.36.218.177 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://smetrics.cisco.com/id?d_visid_ver=4.1.0&d_fieldgroup=A&mcorgid=B8D07FF4520E94C10A490D4C%40AdobeOrg&mid=23833216641308009283392217193619685112&ts=1650745552037 Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=duo.com Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.36.218.177 Paris, France, ASN16509 (AMAZON-02, US), Reverse DNS ec2-13-36-218-177.eu-west-3.compute.amazonaws.com Software jag / Resource Hash 0d66ef0aee9b4719486242281cd0add74dbec97893bc8e61c27b6e84d28f9391 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers Referer https://duo.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Content-Type application/x-www-form-urlencoded Response headers date Sat, 23 Apr 2022 20:25:52 GMT x-content-type-options nosniff server jag xserver anedge-7b6f4bb9f7-fdl82 vary Origin x-c main-1637.I660130.M0-562 p3p CP="This is not a P3P policy" access-control-allow-origin https://duo.com cache-control no-cache, no-store, max-age=0, no-transform, private access-control-allow-credentials true strict-transport-security max-age=31536000; includeSubDomains content-type application/x-javascript;charset=utf-8 content-length 48 x-xss-protection 1; mode=block
GET H2	204	dvar c.contentsquare.net/	0 319 B	29ms 28ms	Image text/plain	54.72.196.102 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://c.contentsquare.net/dvar?v=11.20.0&pid=5637&uu=2102bbfc-9992-aab2-e650-4ec6c651b846&sn=1&pn=1&dv=N4IgxgzgsghgLmAFgSwHYHMDSBTAniALhAAYA6ANgEYBWATgGZqAWY8pygdmI4A4eB9SuWrcm1cQCZiTeiAC%2BQAA&r=877066 Requested by Host: duo.com URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_128_GCM Server 54.72.196.102 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-54-72-196-102.eu-west-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers pragma no-cache date Sat, 23 Apr 2022 20:25:52 GMT access-control-allow-methods GET, POST, OPTIONS access-control-allow-origin * cache-control no-cache, no-store, must-revalidate, pre-check=0, post-check=0 content-disposition inline timing-allow-origin * access-control-allow-headers Access-Control-Expose-Headers, Content-Type, Content-Compression, X-Requested-With expires Sun, 24 Oct 1982 23:00:00 GMT
GET H/1.1	200 OK	ibs:dpid=771&dpuuid=CAESEDu7izUiJCvTvCEQjylTGtc&google_cver=1 dpm.demdex.net/ Frame 77E7 Redirect Chain https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=MjkyMzYzOTMwMjQ0NDk1ODg4MTI3NzkyOTY2MDM1MzU4NjE2MjU= https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm=&gdpr=0&gdpr_consent=&google_hm=MjkyMzYzOTMwMjQ0NDk1ODg4MTI3NzkyOTY2MDM1MzU4NjE2MjU=&google_tc= https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEDu7izUiJCvTvCEQjylTGtc&google_cver=1?gdpr=0&gdpr_consent=	42 B 945 B	31ms 31ms	Image image/gif	99.81.5.109 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEDu7izUiJCvTvCEQjylTGtc&google_cver=1?gdpr=0&gdpr_consent= Requested by Host: duo.com URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS Protocol HTTP/1.1 Server 99.81.5.109 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-99-81-5-109.eu-west-1.compute.amazonaws.com Software / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://cisco.demdex.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers DCS dcs-prod-irl1-1-v031-0b4a9e24c.edge-irl1.demdex.com UNKNOWN Pragma no-cache Strict-Transport-Security max-age=31536000; includeSubDomains content-encoding gzip X-Content-Type-Options nosniff X-TID CvN/HCOfQx8= P3P policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Cache-Control no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Connection keep-alive Content-Type image/gif Content-Length 59 Expires Thu, 01 Jan 1970 00:00:00 UTC Redirect headers pragma no-cache date Sat, 23 Apr 2022 20:25:52 GMT server HTTP server (unknown) p3p policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" location https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEDu7izUiJCvTvCEQjylTGtc&google_cver=1?gdpr=0&gdpr_consent= cache-control no-cache, must-revalidate cross-origin-resource-policy cross-origin content-type text/html; charset=UTF-8 alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 314 x-xss-protection 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H2	200	adsct analytics.twitter.com/i/ Frame 77E7	43 B 356 B	381ms 112ms	Image image/gif	104.244.42.195 TWITTER
General Check archive.org Show headers Download Go to Show image Full URL https://analytics.twitter.com/i/adsct?p_user_id=29236393024449588812779296603535861625&p_id=38594 Requested by Host: duo.com URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS Protocol H2 Security TLS 1.3, , AES_128_GCM Server 104.244.42.195 , United States, ASN13414 (TWITTER, US), Reverse DNS Software tsa_o / Resource Hash ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957 Security Headers Name Value Strict-Transport-Security max-age=631138519 Request headers accept-language de-DE,de;q=0.9 Referer https://cisco.demdex.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers x-response-time 106 date Sat, 23 Apr 2022 20:25:51 GMT server tsa_o strict-transport-security max-age=631138519 content-type image/gif;charset=utf-8 cache-control no-cache, no-store, max-age=0 x-connection-hash 7d32d9358959404d79d147ad38c00b18f69be11282387169b3c3a427513e1134 content-length 43
GET H2	200	s63415170312740 Show response smetrics.cisco.com/b/ss/cisco-complete/10/JS-2.12.0/	927 B 1 KB	37ms 37ms	Script application/x-javascript	13.36.218.177 AMAZON-02
General Check archive.org Show headers Download Go to Full URL https://smetrics.cisco.com/b/ss/cisco-complete/10/JS-2.12.0/s63415170312740?AQB=1&ndh=1&pf=1&callback=s_c_il[1].doPostbacks&et=1&t=23%2F3%2F2022%2020%3A25%3A52%206%200&d.&nsid=0&jsonv=1&.d&sdid=4038FDBC4EF51AF6-1077CC681E0102A0&mid=23833216641308009283392217193619685112&aamlh=6&ce=UTF-8&ns=cisco&pageName=duo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2Fnaws&g=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&cc=USD&events=event1&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&c1=%7C%20decipher&h1=duo.com%3Adecipher%3Atrailblazer-hunts-compromised-credentials-in-aws%3Anaws&c2=undefined%3Ano%20iapath%3Anaws&c3=duo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2Fnaws&h3=no%20iapath&c10=12%3A25%20PM%7CSaturday&v10=12%3A25%20PM%7CSaturday&v25=duo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2Fnaws&v26=no%20contenttype&c28=no%20iapath&v28=no%20iapath&c33=en-us&v33=en-us&c41=duo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2Fnaws&c46=ut4.46.202204141432&v48=undefined&c50=cisco-complete&c51=unavailable&c53=no%20contenttype&c59=0180581a2bb600232beab95db30003074004e06c00b08&v63=unavailable&v77=AppMeasurement%3D2.12.0%2CVisitorJS%3D4.1.0%2CMbox%3Dna&v78=dnt%3Dfalse%2Ccookies%3Dtrue%2Clocalstorage%3Dtrue&v92=0.6159354064170788_1650745552043&v98=cisco.duo&v106=23833216641308009283392217193619685112&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=B8D07FF4520E94C10A490D4C%40AdobeOrg&AQE=1 Requested by Host: tags.tiqcdn.com URL: https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.5.js?utv=ut4.46.202204141432 Protocol H2 Security TLS 1.3, , AES_128_GCM Server 13.36.218.177 Paris, France, ASN16509 (AMAZON-02, US), Reverse DNS ec2-13-36-218-177.eu-west-3.compute.amazonaws.com Software jag / Resource Hash 72e10a966c7b28c6111598c445b3fa5b1f7d11fbf71815f8cc29ad6c996059d4 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff X-Xss-Protection 1; mode=block Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers x-aam-tid czVkPK+ITog= date Sat, 23 Apr 2022 20:25:52 GMT x-content-type-options nosniff x-c main-1637.I660130.M0-562 p3p CP="This is not a P3P policy" vary * content-length 927 x-xss-protection 1; mode=block dcs dcs-prod-irl1-2-v031-0267e2bef.edge-irl1.demdex.com UNKNOWN pragma no-cache last-modified Sun, 24 Apr 2022 20:25:52 GMT server jag xserver anedge-7b6f4bb9f7-wq2lx etag 3544949079944036352-4619888269648017549 strict-transport-security max-age=31536000; includeSubDomains content-type application/x-javascript;charset=utf-8 access-control-allow-origin * cache-control no-cache, no-store, max-age=0, no-transform, private expires Fri, 22 Apr 2022 20:25:52 GMT
GET H3	200	/ www.facebook.com/tr/	44 B 91 B	16ms 7ms	Image image/gif	2a03:2880:f11c:8183:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Show image Full URL https://www.facebook.com/tr/?id=120108061684670&ev=PageView&dl=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&rl=&if=false&ts=1650745552329&sw=1600&sh=1200&v=2.9.57&r=stable&ec=0&o=30&fbp=fb.1.1650745551932.1591478257&it=1650745551700&coo=false&exp=p1&rqm=GET Requested by Host: duo.com URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash 10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers date Sat, 23 Apr 2022 20:25:52 GMT last-modified Fri, 21 Dec 2012 00:00:01 GMT server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains content-type image/gif cache-control no-cache, must-revalidate, max-age=0 cross-origin-resource-policy cross-origin content-length 44 alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 priority u=3,i expires Sat, 23 Apr 2022 20:25:52 GMT
GET H/1.1	200 OK	ibs:dpid=30646 dpm.demdex.net/ Frame 77E7 Redirect Chain https://cms.analytics.yahoo.com/cms?partner_id=ADOBE&_hosted_id=29236393024449588812779296603535861625&gdpr=0&gdpr_consent= https://dpm.demdex.net/ibs:dpid=30646?dpuuid=y-DZakXuRE2pHtMzdYbnmcViJpPIuWSqpaVwk-~A	42 B 945 B	37ms 36ms	Image image/gif	99.81.5.109 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://dpm.demdex.net/ibs:dpid=30646?dpuuid=y-DZakXuRE2pHtMzdYbnmcViJpPIuWSqpaVwk-~A Requested by Host: duo.com URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS Protocol HTTP/1.1 Server 99.81.5.109 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-99-81-5-109.eu-west-1.compute.amazonaws.com Software / Resource Hash ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://cisco.demdex.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers DCS dcs-prod-irl1-2-v031-08c1b627a.edge-irl1.demdex.com UNKNOWN Pragma no-cache Strict-Transport-Security max-age=31536000; includeSubDomains content-encoding gzip X-Content-Type-Options nosniff X-TID vDEHOAKZQlM= P3P policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT" Cache-Control no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private Connection keep-alive Content-Type image/gif Content-Length 59 Expires Thu, 01 Jan 1970 00:00:00 UTC Redirect headers date Sat, 23 Apr 2022 20:25:52 GMT via http/1.1 spdc0106.pbp.ir2.yahoo.com (ApacheTrafficServer) server ATS age 0 strict-transport-security max-age=31536000 content-type text/html;charset=utf-8 location https://dpm.demdex.net/ibs:dpid=30646?dpuuid=y-DZakXuRE2pHtMzdYbnmcViJpPIuWSqpaVwk-~A content-length 0
POST H3	200	/ Show response www.facebook.com/tr/ Frame 54A1	0 15 B	7ms 7ms	Document text/plain	2a03:2880:f11c:8183:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/tr/ Requested by Host: duo.com URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Content-Type application/x-www-form-urlencoded Origin https://duo.com Referer https://duo.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-credentials true access-control-allow-origin https://duo.com alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 0 content-type text/plain cross-origin-resource-policy cross-origin date Sat, 23 Apr 2022 20:25:52 GMT priority u=0 server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains
POST H2	204	collect Show response l.clarity.ms/	0 64 B	93ms 92ms	XHR text/plain	20.120.65.166 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://l.clarity.ms/collect Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=duo.com Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 20.120.65.166 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept application/x-clarity-gzip Referer https://duo.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers access-control-allow-origin https://duo.com date Sat, 23 Apr 2022 20:25:52 GMT access-control-allow-credentials true server Microsoft-IIS/10.0 x-powered-by ASP.NET request-context appId=cid-v1:e55edbbe-e22b-46b4-8313-9ee2a4e71d12
GET H2	204	usermatch.gif beacon.krxd.net/ Frame 77E7 Redirect Chain https://usermatch.krxd.net/um/v2?partner=adobe&id=29236393024449588812779296603535861625 https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=adobe&id=29236393024449588812779296603535861625	0 338 B	141ms 29ms	Image text/plain	52.18.28.177 AMAZON-02
General Check archive.org Show headers Download Go to Show image Full URL https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=adobe&id=29236393024449588812779296603535861625 Requested by Host: duo.com URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS Protocol H2 Server 52.18.28.177 Dublin, Ireland, ASN16509 (AMAZON-02, US), Reverse DNS ec2-52-18-28-177.eu-west-1.compute.amazonaws.com Software / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers accept-language de-DE,de;q=0.9 Referer https://cisco.demdex.net/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers date Sat, 23 Apr 2022 20:25:52 GMT cache-control private, no-cache, no-store x-request-time D=32 t=1650745552 x-served-by beacon-n017-dub-prod.krxd.net p3p policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC" Redirect headers location https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=adobe&id=29236393024449588812779296603535861625 date Sat, 23 Apr 2022 20:25:52 GMT x-cache-hits 0 x-age 0 content-length 0 x-cache MISS x-served-by usermatch-a004-ash-prod.krxd.net
GET H2	200	u cdn.bizible.com/m/	43 B 144 B	7ms 7ms	Image image/gif	152.195.15.58 EDGECAST
General Check archive.org Show headers Download Go to Show image Full URL https://cdn.bizible.com/m/u?mapType=ecid&mapValue=B8D07FF4520E94C10A490D4C%40AdobeOrg_23833216641308009283392217193619685112&_biz_u=3784c6066ff24c18962cf4619cd4dd50&_biz_s=51c712&_biz_l=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&_biz_t=1650745552687&_biz_i=%20%7C%20Decipher&_biz_n=1&a=duo.com&rnd=215845&cdn_o=a&_biz_z=1650745552688 Requested by Host: duo.com URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS Protocol H2 Security TLS 1.3, , AES_256_GCM Server 152.195.15.58 , United States, ASN15133 (EDGECAST, US), Reverse DNS Software ECS (frb/6776) / Resource Hash afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277 Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers pragma no-cache date Sat, 23 Apr 2022 20:25:52 GMT last-modified Thu, 21 Apr 2022 23:59:33 GMT server ECS (frb/6776) age 159979 x-cache HIT p3p CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT" cache-control no-cache, no-store accept-ranges bytes content-type Image/GIF content-length 43 expires -1
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	214ms 214ms	Image image/gif	104.92.74.202 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=361da14e9cc9e3c3150a35780c1bec6b&svisitor=2d58655fce170000cf60646208020000576f0200&session=1fd848ae-fdd7-4b53-8a84-aff8e67cc364&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A25%3A52%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A25%3A51%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%221001%22%7D&isIframe=false&m=%7B%22description%22%3A%22Security%20without%20fear.%20The%20web%20doesn%E2%80%99t%20have%20to%20be%20dark.%20Decipher%E2%80%99s%20goal%20is%20to%20bring%20order%20to%20this%20unpredictable%20and%20often%20confusing%20landscape%20by%20providing%20fresh%20perspectives%20from%20trusted%20voices.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%20%7C%20Decipher%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&pageViewId=f721e288-fc54-430a-8566-c2615b5598d4&an_uid=0 Requested by Host: duo.com URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-92-74-202.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers Date Sat, 23 Apr 2022 20:25:52 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Tue, 05 Oct 2021 22:17:52 GMT Server nginx/1.14.0 (Ubuntu) ETag "615ccf10-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
POST H3	200	/ Show response www.facebook.com/tr/ Frame 3A08	0 15 B	8ms 7ms	Document text/plain	2a03:2880:f11c:8183:face:b00c:0:25de FACEBOOK
General Check archive.org Show headers Download Go to Full URL https://www.facebook.com/tr/ Requested by Host: duo.com URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS Protocol H3 Security QUIC, , AES_128_GCM Server 2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US), Reverse DNS Software proxygen-bolt / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Security Headers Name Value Strict-Transport-Security max-age=31536000; includeSubDomains Request headers Content-Type application/x-www-form-urlencoded Origin https://duo.com Referer https://duo.com/ Upgrade-Insecure-Requests 1 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 accept-language de-DE,de;q=0.9 Response headers access-control-allow-credentials true access-control-allow-origin https://duo.com alt-svc h3=":443"; ma=86400, h3-29=":443"; ma=86400 content-length 0 content-type text/plain cross-origin-resource-policy cross-origin date Sat, 23 Apr 2022 20:25:52 GMT priority u=0 server proxygen-bolt strict-transport-security max-age=31536000; includeSubDomains
GET H2	200	c.gif c.clarity.ms/ Redirect Chain https://c.clarity.ms/c.gif https://c.bing.com/c.gif?CtsSyncId=53E986B609BB443A824C3A445A4D49D1&RedC=c.clarity.ms&MXFR=23383A7EF96D6EE829742BF1FD6D603F https://c.clarity.ms/c.gif?CtsSyncId=53E986B609BB443A824C3A445A4D49D1&MUID=2FAFE1B5AC4169400BC9F03AAD936848	42 B 369 B	27ms 26ms	Image image/gif	52.142.114.2 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Show image Full URL https://c.clarity.ms/c.gif?CtsSyncId=53E986B609BB443A824C3A445A4D49D1&MUID=2FAFE1B5AC4169400BC9F03AAD936848 Protocol H2 Server 52.142.114.2 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash 99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12 Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers pragma no-cache date Sat, 23 Apr 2022 20:25:52 GMT last-modified Fri, 18 Mar 2022 19:39:54 GMT server Microsoft-IIS/10.0 x-powered-by ASP.NET etag "8120eaf0ff3ad81:0" p3p CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" cache-control private, no-cache, proxy-revalidate, no-store accept-ranges bytes content-type image/gif content-length 42 Redirect headers pragma no-cache date Sat, 23 Apr 2022 20:25:53 GMT accept-ch Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version x-msedge-ref Ref A: 55A04028005E48EABE78A1E2A3052156 Ref B: FRAEDGE1209 Ref C: 2022-04-23T20:25:53Z x-powered-by ASP.NET x-cache CONFIG_NOCACHE p3p CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" location https://c.clarity.ms/c.gif?CtsSyncId=53E986B609BB443A824C3A445A4D49D1&MUID=2FAFE1B5AC4169400BC9F03AAD936848 cache-control private, no-cache, proxy-revalidate, no-store content-length 0
GET H3	200	collect www.google-analytics.com/	35 B 55 B	40ms 39ms	Image image/gif	2a00:1450:4001:812::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google-analytics.com/collect?v=1&_v=j96&a=2142235294&t=event&ni=1&_s=1&dl=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&ul=en-us&de=UTF-8&dt=%7C%20Decipher&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=undefined&ea=undefined&_u=aDDAAAABQAAAAG~&jid=&gjid=&cid=1970540642.1650745552&tid=UA-20141016-1&_gid=395505349.1650745552&gtm=2wg4k0MFPB9D&cd2=1970540642.1650745552&z=298313273 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers pragma no-cache date Sat, 23 Apr 2022 13:53:59 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 age 23514 content-type image/gif access-control-allow-origin * cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 35 expires Mon, 01 Jan 1990 00:00:00 GMT
GET H3	200	collect www.google-analytics.com/	35 B 55 B	39ms 39ms	Image image/gif	2a00:1450:4001:812::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google-analytics.com/collect?v=1&_v=j96&a=2142235294&t=event&ni=1&_s=1&dl=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&ul=en-us&de=UTF-8&dt=%7C%20Decipher&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=CRI%20-%20Scroll%20Tracking&ea=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&el=50%25&_u=aDDAAEABQAAAAG~&jid=&gjid=&cid=1970540642.1650745552&tid=UA-20141016-1&_gid=395505349.1650745552&gtm=2wg4k0MFPB9D&z=1496707971 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers pragma no-cache date Sat, 23 Apr 2022 13:53:59 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 age 23514 content-type image/gif access-control-allow-origin * cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 35 expires Mon, 01 Jan 1990 00:00:00 GMT
GET H3	200	collect www.google-analytics.com/	35 B 55 B	40ms 39ms	Image image/gif	2a00:1450:4001:812::200e GOOGLE
General Check archive.org Show headers Download Go to Show image Full URL https://www.google-analytics.com/collect?v=1&_v=j96&a=2142235294&t=event&ni=1&_s=1&dl=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&ul=en-us&de=UTF-8&dt=%7C%20Decipher&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=CRI%20-%20Scroll%20Tracking&ea=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&el=75%25&_u=aDDAAEABQAAAAG~&jid=&gjid=&cid=1970540642.1650745552&tid=UA-20141016-1&_gid=395505349.1650745552&gtm=2wg4k0MFPB9D&z=968605772 Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015 Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers pragma no-cache date Sat, 23 Apr 2022 13:53:59 GMT x-content-type-options nosniff last-modified Sun, 17 May 1998 03:00:00 GMT server Golfe2 age 23514 content-type image/gif access-control-allow-origin * cache-control no-cache, no-store, must-revalidate cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 35 expires Mon, 01 Jan 1990 00:00:00 GMT
POST H2	204	collect Show response l.clarity.ms/	0 48 B	92ms 91ms	XHR text/plain	20.120.65.166 MICROSOFT-CORP-MS...
General Check archive.org Show headers Download Go to Full URL https://l.clarity.ms/collect Requested by Host: cdn.bizible.com URL: https://cdn.bizible.com/scripts/bizible.js?account=duo.com Protocol H2 Security TLS 1.2, ECDHE_RSA, AES_256_GCM Server 20.120.65.166 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US), Reverse DNS Software Microsoft-IIS/10.0 / ASP.NET Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Accept application/x-clarity-gzip Referer https://duo.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers access-control-allow-origin https://duo.com date Sat, 23 Apr 2022 20:25:53 GMT access-control-allow-credentials true server Microsoft-IIS/10.0 x-powered-by ASP.NET request-context appId=cid-v1:e55edbbe-e22b-46b4-8313-9ee2a4e71d12
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	212ms 212ms	Image image/gif	104.92.74.202 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=361da14e9cc9e3c3150a35780c1bec6b&svisitor=2d58655fce170000cf60646208020000576f0200&session=1fd848ae-fdd7-4b53-8a84-aff8e67cc364&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A25%3A53%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A25%3A52%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%222003%22%7D&isIframe=false&m=%7B%22description%22%3A%22Security%20without%20fear.%20The%20web%20doesn%E2%80%99t%20have%20to%20be%20dark.%20Decipher%E2%80%99s%20goal%20is%20to%20bring%20order%20to%20this%20unpredictable%20and%20often%20confusing%20landscape%20by%20providing%20fresh%20perspectives%20from%20trusted%20voices.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%20%7C%20Decipher%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&pageViewId=f721e288-fc54-430a-8566-c2615b5598d4&an_uid=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-92-74-202.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers Date Sat, 23 Apr 2022 20:25:53 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Sat, 05 Jun 2021 07:56:05 GMT Server nginx/1.14.0 (Ubuntu) ETag "60bb2e15-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	197ms 196ms	Image image/gif	104.92.74.202 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=361da14e9cc9e3c3150a35780c1bec6b&svisitor=2d58655fce170000cf60646208020000576f0200&session=1fd848ae-fdd7-4b53-8a84-aff8e67cc364&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A25%3A54%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A25%3A53%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%223005%22%7D&isIframe=false&m=%7B%22description%22%3A%22Security%20without%20fear.%20The%20web%20doesn%E2%80%99t%20have%20to%20be%20dark.%20Decipher%E2%80%99s%20goal%20is%20to%20bring%20order%20to%20this%20unpredictable%20and%20often%20confusing%20landscape%20by%20providing%20fresh%20perspectives%20from%20trusted%20voices.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%20%7C%20Decipher%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&pageViewId=f721e288-fc54-430a-8566-c2615b5598d4&an_uid=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-92-74-202.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers Date Sat, 23 Apr 2022 20:25:54 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Sat, 05 Jun 2021 07:56:05 GMT Server nginx/1.14.0 (Ubuntu) ETag "60bb2e15-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	209ms 208ms	Image image/gif	104.92.74.202 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=361da14e9cc9e3c3150a35780c1bec6b&svisitor=2d58655fce170000cf60646208020000576f0200&session=1fd848ae-fdd7-4b53-8a84-aff8e67cc364&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A25%3A55%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A25%3A54%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%224009%22%7D&isIframe=false&m=%7B%22description%22%3A%22Security%20without%20fear.%20The%20web%20doesn%E2%80%99t%20have%20to%20be%20dark.%20Decipher%E2%80%99s%20goal%20is%20to%20bring%20order%20to%20this%20unpredictable%20and%20often%20confusing%20landscape%20by%20providing%20fresh%20perspectives%20from%20trusted%20voices.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%20%7C%20Decipher%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&pageViewId=f721e288-fc54-430a-8566-c2615b5598d4&an_uid=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-92-74-202.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers Date Sat, 23 Apr 2022 20:25:55 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Sat, 05 Jun 2021 07:56:05 GMT Server nginx/1.14.0 (Ubuntu) ETag "60bb2e15-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	213ms 212ms	Image image/gif	104.92.74.202 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=361da14e9cc9e3c3150a35780c1bec6b&svisitor=2d58655fce170000cf60646208020000576f0200&session=1fd848ae-fdd7-4b53-8a84-aff8e67cc364&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A25%3A56%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A25%3A55%20GMT%22%2C%22timeSpent%22%3A%221005%22%2C%22totalTimeSpent%22%3A%225014%22%7D&isIframe=false&m=%7B%22description%22%3A%22Security%20without%20fear.%20The%20web%20doesn%E2%80%99t%20have%20to%20be%20dark.%20Decipher%E2%80%99s%20goal%20is%20to%20bring%20order%20to%20this%20unpredictable%20and%20often%20confusing%20landscape%20by%20providing%20fresh%20perspectives%20from%20trusted%20voices.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%20%7C%20Decipher%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&pageViewId=f721e288-fc54-430a-8566-c2615b5598d4&an_uid=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-92-74-202.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers Date Sat, 23 Apr 2022 20:25:56 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Tue, 05 Oct 2021 22:17:52 GMT Server nginx/1.14.0 (Ubuntu) ETag "615ccf10-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	205ms 204ms	Image image/gif	104.92.74.202 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=361da14e9cc9e3c3150a35780c1bec6b&svisitor=2d58655fce170000cf60646208020000576f0200&session=1fd848ae-fdd7-4b53-8a84-aff8e67cc364&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A25%3A57%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A25%3A56%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%226015%22%7D&isIframe=false&m=%7B%22description%22%3A%22Security%20without%20fear.%20The%20web%20doesn%E2%80%99t%20have%20to%20be%20dark.%20Decipher%E2%80%99s%20goal%20is%20to%20bring%20order%20to%20this%20unpredictable%20and%20often%20confusing%20landscape%20by%20providing%20fresh%20perspectives%20from%20trusted%20voices.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%20%7C%20Decipher%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&pageViewId=f721e288-fc54-430a-8566-c2615b5598d4&an_uid=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-92-74-202.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers Date Sat, 23 Apr 2022 20:25:57 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Tue, 05 Oct 2021 22:17:52 GMT Server nginx/1.14.0 (Ubuntu) ETag "615ccf10-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
POST H3	204	collect analytics.google.com/g/	0 17 B	131ms 47ms	Ping text/plain	2a00:1450:4001:80f::200e GOOGLE
General Check archive.org Show headers Download Go to Full URL https://analytics.google.com/g/collect?v=2&tid=G-95Z7P6PE75&gtm=2oe4k0&_p=2142235294&_z=ccd.NbB&cid=1970540642.1650745552&ul=en-us&sr=1600x1200&sid=1650745551&sct=1&seg=0&dl=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&dt=%7C%20Decipher&_s=2 Requested by Host: www.googletagmanager.com URL: https://www.googletagmanager.com/gtag/js?id=G-95Z7P6PE75&l=dataLayer&cx=c Protocol H3 Security QUIC, , AES_128_GCM Server 2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US), Reverse DNS Software Golfe2 / Resource Hash e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 Request headers Referer https://duo.com/ accept-language de-DE,de;q=0.9 User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Content-Type text/plain;charset=UTF-8 Response headers pragma no-cache date Sat, 23 Apr 2022 20:25:58 GMT server Golfe2 content-type text/plain access-control-allow-origin https://duo.com cache-control no-cache, no-store, must-revalidate access-control-allow-credentials true cross-origin-resource-policy cross-origin alt-svc h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43" content-length 0 expires Fri, 01 Jan 1990 00:00:00 GMT
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	197ms 196ms	Image image/gif	104.92.74.202 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=361da14e9cc9e3c3150a35780c1bec6b&svisitor=2d58655fce170000cf60646208020000576f0200&session=1fd848ae-fdd7-4b53-8a84-aff8e67cc364&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A25%3A58%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A25%3A57%20GMT%22%2C%22timeSpent%22%3A%221005%22%2C%22totalTimeSpent%22%3A%227020%22%7D&isIframe=false&m=%7B%22description%22%3A%22Security%20without%20fear.%20The%20web%20doesn%E2%80%99t%20have%20to%20be%20dark.%20Decipher%E2%80%99s%20goal%20is%20to%20bring%20order%20to%20this%20unpredictable%20and%20often%20confusing%20landscape%20by%20providing%20fresh%20perspectives%20from%20trusted%20voices.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%20%7C%20Decipher%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&pageViewId=f721e288-fc54-430a-8566-c2615b5598d4&an_uid=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-92-74-202.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers Date Sat, 23 Apr 2022 20:25:58 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Sat, 05 Jun 2021 07:56:05 GMT Server nginx/1.14.0 (Ubuntu) ETag "60bb2e15-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	227ms 225ms	Image image/gif	104.92.74.202 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=361da14e9cc9e3c3150a35780c1bec6b&svisitor=2d58655fce170000cf60646208020000576f0200&session=1fd848ae-fdd7-4b53-8a84-aff8e67cc364&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A25%3A59%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A25%3A58%20GMT%22%2C%22timeSpent%22%3A%221005%22%2C%22totalTimeSpent%22%3A%228025%22%7D&isIframe=false&m=%7B%22description%22%3A%22Security%20without%20fear.%20The%20web%20doesn%E2%80%99t%20have%20to%20be%20dark.%20Decipher%E2%80%99s%20goal%20is%20to%20bring%20order%20to%20this%20unpredictable%20and%20often%20confusing%20landscape%20by%20providing%20fresh%20perspectives%20from%20trusted%20voices.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%20%7C%20Decipher%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&pageViewId=f721e288-fc54-430a-8566-c2615b5598d4&an_uid=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-92-74-202.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers Date Sat, 23 Apr 2022 20:25:59 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Tue, 05 Oct 2021 22:17:52 GMT Server nginx/1.14.0 (Ubuntu) ETag "615ccf10-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	205ms 205ms	Image image/gif	104.92.74.202 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=361da14e9cc9e3c3150a35780c1bec6b&svisitor=2d58655fce170000cf60646208020000576f0200&session=1fd848ae-fdd7-4b53-8a84-aff8e67cc364&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A26%3A00%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A25%3A59%20GMT%22%2C%22timeSpent%22%3A%221005%22%2C%22totalTimeSpent%22%3A%229030%22%7D&isIframe=false&m=%7B%22description%22%3A%22Security%20without%20fear.%20The%20web%20doesn%E2%80%99t%20have%20to%20be%20dark.%20Decipher%E2%80%99s%20goal%20is%20to%20bring%20order%20to%20this%20unpredictable%20and%20often%20confusing%20landscape%20by%20providing%20fresh%20perspectives%20from%20trusted%20voices.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%20%7C%20Decipher%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&pageViewId=f721e288-fc54-430a-8566-c2615b5598d4&an_uid=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-92-74-202.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers Date Sat, 23 Apr 2022 20:26:00 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Tue, 05 Oct 2021 22:17:52 GMT Server nginx/1.14.0 (Ubuntu) ETag "615ccf10-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	197ms 196ms	Image image/gif	104.92.74.202 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=361da14e9cc9e3c3150a35780c1bec6b&svisitor=2d58655fce170000cf60646208020000576f0200&session=1fd848ae-fdd7-4b53-8a84-aff8e67cc364&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A26%3A01%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A26%3A00%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%2210032%22%7D&isIframe=false&m=%7B%22description%22%3A%22Security%20without%20fear.%20The%20web%20doesn%E2%80%99t%20have%20to%20be%20dark.%20Decipher%E2%80%99s%20goal%20is%20to%20bring%20order%20to%20this%20unpredictable%20and%20often%20confusing%20landscape%20by%20providing%20fresh%20perspectives%20from%20trusted%20voices.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%20%7C%20Decipher%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&pageViewId=f721e288-fc54-430a-8566-c2615b5598d4&an_uid=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-92-74-202.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers Date Sat, 23 Apr 2022 20:26:01 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Fri, 21 Feb 2020 18:57:20 GMT Server nginx/1.14.0 (Ubuntu) ETag "5e502810-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT
GET H/1.1	200 OK	img.gif b.6sc.co/v1/beacon/	43 B 774 B	343ms 342ms	Image image/gif	104.92.74.202 AKAMAI-AS
General Check archive.org Show headers Download Go to Show image Full URL https://b.6sc.co/v1/beacon/img.gif?token=361da14e9cc9e3c3150a35780c1bec6b&svisitor=2d58655fce170000cf60646208020000576f0200&session=1fd848ae-fdd7-4b53-8a84-aff8e67cc364&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A26%3A04%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A26%3A01%20GMT%22%2C%22timeSpent%22%3A%223004%22%2C%22totalTimeSpent%22%3A%2213036%22%7D&isIframe=false&m=%7B%22description%22%3A%22Security%20without%20fear.%20The%20web%20doesn%E2%80%99t%20have%20to%20be%20dark.%20Decipher%E2%80%99s%20goal%20is%20to%20bring%20order%20to%20this%20unpredictable%20and%20often%20confusing%20landscape%20by%20providing%20fresh%20perspectives%20from%20trusted%20voices.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%20%7C%20Decipher%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&pageViewId=f721e288-fc54-430a-8566-c2615b5598d4&an_uid=0 Protocol HTTP/1.1 Security TLS 1.3, , AES_256_GCM Server 104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US), Reverse DNS a104-92-74-202.deploy.static.akamaitechnologies.com Software nginx/1.14.0 (Ubuntu) / Resource Hash dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b Security Headers Name Value X-Content-Type-Options nosniff Request headers accept-language de-DE,de;q=0.9 Referer https://duo.com/ User-Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36 Response headers Date Sat, 23 Apr 2022 20:26:05 GMT X-Content-Type-Options nosniff Connection keep-alive Content-Length 43 Pragma no-cache Last-Modified Sat, 05 Jun 2021 07:56:05 GMT Server nginx/1.14.0 (Ubuntu) ETag "60bb2e15-2b" Access-Control-Max-Age 86400 Access-Control-Allow-Methods GET,POST Content-Type image/gif Access-Control-Allow-Origin Cache-Control private, no-cache, no-cache=Set-Cookie, proxy-revalidate Access-Control-Allow-Credentials true Accept-Ranges bytes Access-Control-Allow-Headers * Expires Wed, 19 Apr 2000 11:43:00 GMT