Submitted URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Effective URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Submission: On April 23 via api from BR — Scanned from DE

Summary

This website contacted 36 IPs in 6 countries across 30 domains to perform 98 HTTP transactions. The main IP is 13.225.80.94, located in United States and belongs to AMAZON-02, US. The main domain is duo.com. The Cisco Umbrella rank of the primary domain is 54539.
TLS certificate: Issued by Amazon on October 23rd 2021. Valid for: a year.
This is the only time duo.com was scanned on urlscan.io!

urlscan.io Verdict: No classification

Domain & IP information

IP Address AS Autonomous System
11 13.225.80.94 16509 (AMAZON-02)
1 2a00:1450:401... 15169 (GOOGLE)
1 2a02:26f0:350... 20940 (AKAMAI-ASN1)
3 2a00:1450:400... 15169 (GOOGLE)
7 2a00:1450:400... 15169 (GOOGLE)
6 152.195.15.58 15133 (EDGECAST)
1 2a02:26f0:ef:... 20940 (AKAMAI-ASN1)
1 18.66.112.26 16509 (AMAZON-02)
3 2a03:2880:f01... 32934 (FACEBOOK)
2 104.92.72.193 16625 (AKAMAI-AS)
1 4 2620:1ec:c11:... 8068 (MICROSOFT...)
2 2620:116:800d... 16509 (AMAZON-02)
14 104.92.74.202 16625 (AKAMAI-AS)
1 205.185.216.42 20446 (STACKPATH...)
2 2606:4700:20:... 13335 (CLOUDFLAR...)
5 95.100.208.216 16625 (AKAMAI-AS)
1 2600:9000:215... 16509 (AMAZON-02)
3 3 2620:1ec:22::14 8068 (MICROSOFT...)
1 13.107.42.14 8068 (MICROSOFT...)
1 185.33.220.240 29990 (ASN-APPNEX)
1 2600:9000:205... 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
3 2a00:1450:400... 15169 (GOOGLE)
1 4 99.81.5.109 16509 (AMAZON-02)
2 2a00:1450:400... 15169 (GOOGLE)
2 54.72.196.102 16509 (AMAZON-02)
1 192.28.147.68 15224 (OMNITURE)
1 72.163.10.10 109 (CISCOSYSTEMS)
4 2a03:2880:f11... 32934 (FACEBOOK)
3 20.120.65.166 8075 (MICROSOFT...)
1 52.49.218.107 16509 (AMAZON-02)
2 13.36.218.177 16509 (AMAZON-02)
2 2 142.250.186.34 15169 (GOOGLE)
1 104.244.42.195 13414 (TWITTER)
1 1 212.82.100.182 34010 (YAHOO-IRD)
1 1 34.227.211.111 14618 (AMAZON-AES)
1 52.18.28.177 16509 (AMAZON-02)
1 2 52.142.114.2 8075 (MICROSOFT...)
98 36
Apex Domain
Subdomains
Transfer
14 6sc.co
j.6sc.co — Cisco Umbrella Rank: 6651
c.6sc.co — Cisco Umbrella Rank: 10113
b.6sc.co — Cisco Umbrella Rank: 4627
19 KB
11 duo.com
duo.com — Cisco Umbrella Rank: 54539
623 KB
7 google-analytics.com
www.google-analytics.com — Cisco Umbrella Rank: 35
56 KB
5 clarity.ms
l.clarity.ms — Cisco Umbrella Rank: 1917
c.clarity.ms — Cisco Umbrella Rank: 626
24 KB
5 demdex.net
dpm.demdex.net — Cisco Umbrella Rank: 199
cisco.demdex.net — Cisco Umbrella Rank: 15526
7 KB
5 doubleclick.net
stats.g.doubleclick.net — Cisco Umbrella Rank: 80
cm.g.doubleclick.net — Cisco Umbrella Rank: 195
1 KB
5 tiqcdn.com
tags.tiqcdn.com — Cisco Umbrella Rank: 934
91 KB
5 bizible.com
cdn.bizible.com — Cisco Umbrella Rank: 7547
64 KB
4 facebook.com
www.facebook.com — Cisco Umbrella Rank: 102
418 B
4 google.com
analytics.google.com — Cisco Umbrella Rank: 637
www.google.com — Cisco Umbrella Rank: 2
966 B
4 linkedin.com
px.ads.linkedin.com — Cisco Umbrella Rank: 397
www.linkedin.com — Cisco Umbrella Rank: 577
px4.ads.linkedin.com — Cisco Umbrella Rank: 4570
3 KB
4 bing.com
bat.bing.com — Cisco Umbrella Rank: 346
c.bing.com — Cisco Umbrella Rank: 209
13 KB
4 contentsquare.net
t.contentsquare.net — Cisco Umbrella Rank: 3579
csxd.contentsquare.net — Cisco Umbrella Rank: 13170
c.contentsquare.net — Cisco Umbrella Rank: 3506
69 KB
4 cisco.com
www.cisco.com — Cisco Umbrella Rank: 1397
cisco-tags.cisco.com — Cisco Umbrella Rank: 22518
smetrics.cisco.com — Cisco Umbrella Rank: 28480
33 KB
3 google.de
www.google.de — Cisco Umbrella Rank: 6544
671 B
3 facebook.net
connect.facebook.net — Cisco Umbrella Rank: 137
200 KB
3 googletagmanager.com
www.googletagmanager.com — Cisco Umbrella Rank: 58
235 KB
2 krxd.net
usermatch.krxd.net — Cisco Umbrella Rank: 1194
beacon.krxd.net — Cisco Umbrella Rank: 424
529 B
2 jscloud.net
jscloud.net — Cisco Umbrella Rank: 51548
2 KB
2 quantserve.com
secure.quantserve.com — Cisco Umbrella Rank: 892
pixel.quantserve.com — Cisco Umbrella Rank: 398
10 KB
2 marketo.net
munchkin.marketo.net — Cisco Umbrella Rank: 3120
6 KB
1 yahoo.com
cms.analytics.yahoo.com — Cisco Umbrella Rank: 873
680 B
1 twitter.com
analytics.twitter.com — Cisco Umbrella Rank: 498
356 B
1 mktoresp.com
074-uqx-410.mktoresp.com — Cisco Umbrella Rank: 177600
311 B
1 adnxs.com
secure.adnxs.com — Cisco Umbrella Rank: 394
697 B
1 bizibly.com
cdn.bizibly.com — Cisco Umbrella Rank: 7367
203 B
1 quantcount.com
rules.quantcount.com — Cisco Umbrella Rank: 833
1 KB
1 digitaloceanspaces.com
metadata-static-files.sfo2.cdn.digitaloceanspaces.com — Cisco Umbrella Rank: 26915
6 KB
1 licdn.com
snap.licdn.com — Cisco Umbrella Rank: 780
3 KB
1 googleapis.com
ajax.googleapis.com — Cisco Umbrella Rank: 271
30 KB
98 30
Domain Requested by
12 b.6sc.co duo.com
11 duo.com duo.com
7 www.google-analytics.com www.googletagmanager.com
cdn.bizible.com
duo.com
5 tags.tiqcdn.com www.cisco.com
tags.tiqcdn.com
5 cdn.bizible.com www.googletagmanager.com
duo.com
cdn.bizible.com
4 www.facebook.com duo.com
4 dpm.demdex.net 1 redirects duo.com
3 l.clarity.ms bat.bing.com
cdn.bizible.com
3 www.google.de duo.com
3 stats.g.doubleclick.net www.googletagmanager.com
cdn.bizible.com
3 bat.bing.com duo.com
bat.bing.com
3 connect.facebook.net duo.com
connect.facebook.net
3 www.googletagmanager.com duo.com
www.googletagmanager.com
tags.tiqcdn.com
2 c.clarity.ms 1 redirects
2 cm.g.doubleclick.net 2 redirects
2 smetrics.cisco.com cdn.bizible.com
tags.tiqcdn.com
2 c.contentsquare.net duo.com
2 www.google.com duo.com
2 analytics.google.com www.googletagmanager.com
2 px.ads.linkedin.com 2 redirects
2 jscloud.net www.googletagmanager.com
cdn.bizible.com
2 munchkin.marketo.net duo.com
munchkin.marketo.net
1 c.bing.com 1 redirects
1 beacon.krxd.net duo.com
1 usermatch.krxd.net 1 redirects
1 cms.analytics.yahoo.com 1 redirects
1 analytics.twitter.com duo.com
1 cisco.demdex.net tags.tiqcdn.com
1 cisco-tags.cisco.com duo.com
1 074-uqx-410.mktoresp.com munchkin.marketo.net
1 pixel.quantserve.com duo.com
1 csxd.contentsquare.net t.contentsquare.net
1 c.6sc.co cdn.bizible.com
1 secure.adnxs.com cdn.bizible.com
1 px4.ads.linkedin.com duo.com
1 www.linkedin.com 1 redirects
1 cdn.bizibly.com duo.com
1 rules.quantcount.com secure.quantserve.com
1 metadata-static-files.sfo2.cdn.digitaloceanspaces.com duo.com
1 j.6sc.co duo.com
1 secure.quantserve.com duo.com
1 t.contentsquare.net www.googletagmanager.com
1 snap.licdn.com www.googletagmanager.com
1 www.cisco.com duo.com
1 ajax.googleapis.com duo.com
98 45

This site contains links to these domains. Also see Links.

Domain
twitter.com
www.facebook.com
www.youtube.com
Subject Issuer Validity Valid
www.duosecurity.com
Amazon
2021-10-23 -
2022-11-20
a year crt.sh
upload.video.google.com
GTS CA 1C3
2022-04-11 -
2022-07-04
3 months crt.sh
www.cisco.com
HydrantID Server CA O1
2021-11-16 -
2022-11-16
a year crt.sh
*.google-analytics.com
GTS CA 1C3
2022-04-11 -
2022-07-04
3 months crt.sh
io.bizible.com
DigiCert TLS RSA SHA256 2020 CA1
2021-06-30 -
2022-07-05
a year crt.sh
snap.licdn.com
DigiCert SHA2 Secure Server CA
2022-03-01 -
2023-03-01
a year crt.sh
t.contentsquare.net
Amazon
2021-11-13 -
2022-12-11
a year crt.sh
*.facebook.com
DigiCert SHA2 High Assurance Server CA
2022-01-29 -
2022-04-29
3 months crt.sh
*.marketo.net
DigiCert SHA2 Secure Server CA
2022-02-06 -
2023-02-07
a year crt.sh
www.bing.com
Microsoft RSA TLS CA 01
2022-03-16 -
2022-09-16
6 months crt.sh
*.quantserve.com
DigiCert TLS RSA SHA256 2020 CA1
2021-09-22 -
2022-09-21
a year crt.sh
*.6sc.co
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2022-03-08 -
2023-03-11
a year crt.sh
*.sfo2.cdn.digitaloceanspaces.com
DigiCert TLS RSA SHA256 2020 CA1
2022-04-18 -
2023-05-03
a year crt.sh
*.jscloud.net
E1
2022-03-21 -
2022-06-19
3 months crt.sh
*.tiqcdn.com
DigiCert SHA2 Secure Server CA
2022-02-27 -
2023-02-28
a year crt.sh
*.adnxs.com
GeoTrust ECC CA 2018
2022-02-11 -
2023-03-14
a year crt.sh
csxd-02.contentsquare.net
Amazon
2021-09-01 -
2022-09-30
a year crt.sh
*.google.com
GTS CA 1C3
2022-04-11 -
2022-07-04
3 months crt.sh
*.g.doubleclick.net
GTS CA 1C3
2022-04-11 -
2022-07-04
3 months crt.sh
www.google.de
GTS CA 1C3
2022-04-11 -
2022-07-04
3 months crt.sh
www.google.com
GTS CA 1C3
2022-04-11 -
2022-07-04
3 months crt.sh
c.contentsquare.net
Amazon
2021-09-14 -
2022-10-13
a year crt.sh
*.mktoresp.com
DigiCert TLS RSA SHA256 2020 CA1
2021-11-30 -
2022-11-30
a year crt.sh
tagapp-prd-01.cisco.com
HydrantID Server CA O1
2021-08-04 -
2022-08-04
a year crt.sh
a.clarity.ms
Microsoft RSA TLS CA 01
2021-07-27 -
2022-07-27
a year crt.sh
*.google.de
GTS CA 1C3
2022-04-11 -
2022-07-04
3 months crt.sh
*.demdex.net
DigiCert TLS RSA SHA256 2020 CA1
2021-10-19 -
2022-11-19
a year crt.sh
smetrics.cisco.com
DigiCert TLS RSA SHA256 2020 CA1
2022-03-09 -
2023-04-09
a year crt.sh
*.twitter.com
DigiCert TLS Hybrid ECC SHA384 2020 CA1
2022-03-07 -
2023-03-06
a year crt.sh

This page contains 5 frames:

Primary Page: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Frame ID: 9EA3A2E4F4867DBAB3D33E28C6985F9D
Requests: 90 HTTP requests in this frame

Frame: https://csxd.contentsquare.net/uxa/xdframe-single-domain-1.1.1.html?pid=5637
Frame ID: 9DE42FD9143B76712425271AC985D12F
Requests: 1 HTTP requests in this frame

Frame: https://cisco.demdex.net/dest5.html?d_nsid=0
Frame ID: 77E70833ADF59B192ED96822E0255441
Requests: 5 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 54A1C9F38A781B4D9D8E1B56EB8B18F3
Requests: 1 HTTP requests in this frame

Frame: https://www.facebook.com/tr/
Frame ID: 3A087C76BA009AE4AF6EF2D4921EEB95
Requests: 1 HTTP requests in this frame

Screenshot

Page Title

| Decipher

Detected technologies

Overall confidence: 100%
Detected patterns
  • adnxs\.(?:net|com)

Overall confidence: 100%
Detected patterns
  • //connect\.facebook\.([a-z]+)/[^/]*/[a-z]*\.js

Overall confidence: 100%
Detected patterns
  • google-analytics\.com/(?:ga|urchin|analytics)\.js

Overall confidence: 100%
Detected patterns
  • googleapis\.com/.+webfont

Overall confidence: 100%
Detected patterns
  • googletagmanager\.com/gtm\.js
  • googletagmanager\.com/gtag/js

Overall confidence: 100%
Detected patterns
  • snap\.licdn\.com/li\.lms-analytics/insight\.min\.js

Overall confidence: 100%
Detected patterns
  • munchkin\.marketo\.\w+/(?:([\d.]+)/)?munchkin\.js

Overall confidence: 100%
Detected patterns
  • /([\d.]+)/jquery(?:\.min)?\.js
  • jquery.*\.js(?:\?ver(?:sion)?=([\d.]+))?

Page Statistics

98
Requests

93 %
HTTPS

44 %
IPv6

30
Domains

45
Subdomains

36
IPs

6
Countries

1496 kB
Transfer

4504 kB
Size

59
Cookies

Redirected requests

There were HTTP redirect chains for the following requests:

Request Chain 31
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7540&time=1650745551690&url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS HTTP 302
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D7540%26time%3D1650745551690%26url%3Dhttps%253A%252F%252Fduo.com%252Fdecipher%252Ftrailblazer-hunts-compromised-credentials-in-aws%252FnAWS%26liSync%3Dtrue HTTP 302
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7540&time=1650745551690&url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&liSync=true HTTP 302
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7540&time=1650745551690&url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&liSync=true&e_ipv6=AQLYxfHmy0GqjQAAAYBYGi68THEUbKI-zyJpfOpJYlYs5Gk8XWwWDq-PXUhlELD59B6t4dne
Request Chain 46
  • https://dpm.demdex.net/id?d_visid_ver=4.1.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=B8D07FF4520E94C10A490D4C%40AdobeOrg&d_nsid=0&ts=1650745551814 HTTP 302
  • https://dpm.demdex.net/id/rd?d_visid_ver=4.1.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=B8D07FF4520E94C10A490D4C%40AdobeOrg&d_nsid=0&ts=1650745551814
Request Chain 70
  • https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=MjkyMzYzOTMwMjQ0NDk1ODg4MTI3NzkyOTY2MDM1MzU4NjE2MjU= HTTP 302
  • https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm=&gdpr=0&gdpr_consent=&google_hm=MjkyMzYzOTMwMjQ0NDk1ODg4MTI3NzkyOTY2MDM1MzU4NjE2MjU=&google_tc= HTTP 302
  • https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEDu7izUiJCvTvCEQjylTGtc&google_cver=1?gdpr=0&gdpr_consent=
Request Chain 74
  • https://cms.analytics.yahoo.com/cms?partner_id=ADOBE&_hosted_id=29236393024449588812779296603535861625&gdpr=0&gdpr_consent= HTTP 302
  • https://dpm.demdex.net/ibs:dpid=30646?dpuuid=y-DZakXuRE2pHtMzdYbnmcViJpPIuWSqpaVwk-~A
Request Chain 77
  • https://usermatch.krxd.net/um/v2?partner=adobe&id=29236393024449588812779296603535861625 HTTP 302
  • https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=adobe&id=29236393024449588812779296603535861625
Request Chain 81
  • https://c.clarity.ms/c.gif HTTP 302
  • https://c.bing.com/c.gif?CtsSyncId=53E986B609BB443A824C3A445A4D49D1&RedC=c.clarity.ms&MXFR=23383A7EF96D6EE829742BF1FD6D603F HTTP 302
  • https://c.clarity.ms/c.gif?CtsSyncId=53E986B609BB443A824C3A445A4D49D1&MUID=2FAFE1B5AC4169400BC9F03AAD936848

98 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request nAWS
duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/
14 KB
5 KB
Document
General
Full URL
https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.80.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-80-94.fra2.r.cloudfront.net
Software
Duo/1.0 /
Resource Hash
27d6fba6ad31a91fa31d69869c76b901f4eab1b2d3daede85479097c04c605c0

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

content-encoding
gzip
content-length
5185
content-type
text/html; charset=utf-8
date
Sat, 23 Apr 2022 20:25:51 GMT
etag
W/"6255da84-391f"
server
Duo/1.0
vary
Accept-Encoding
via
1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
x-amz-cf-id
f-QliEUhTJ0tO7xuxQuKbnBUTVEvgs5CY19dSvdN5HVV8-ExmAbYDQ==
x-amz-cf-pop
FRA2-C2
x-cache
Error from cloudfront
production-2021.css
duo.com/css/
515 KB
99 KB
Stylesheet
General
Full URL
https://duo.com/css/production-2021.css?v=1647976353
Requested by
Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.80.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-80-94.fra2.r.cloudfront.net
Software
Duo/1.0 /
Resource Hash
b2021fe9b1f8b7e7bb44e57c5aed88f45cab8b7a0e84f39b7e472277361f1da5

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Sat, 23 Apr 2022 05:23:42 GMT
content-encoding
gzip
last-modified
Thu, 14 Apr 2022 16:20:39 GMT
server
Duo/1.0
age
54129
etag
W/"625849d7-80a86"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
text/css
via
1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
cache-control
max-age=31536000, public, must-revalidate, proxy-revalidate, max-age=31536000
x-amz-cf-pop
FRA2-C2
x-amz-cf-id
joLMSGp5PwfwQc2c45XQpkBotwVtzZKsmSqlVaLh2geRhsoLisr-eg==
expires
Sun, 23 Apr 2023 05:23:42 GMT
d-logo--light.svg
duo.com/assets/img/decipher/logos/
4 KB
2 KB
Image
General
Full URL
https://duo.com/assets/img/decipher/logos/d-logo--light.svg
Requested by
Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.80.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-80-94.fra2.r.cloudfront.net
Software
Duo/1.0 /
Resource Hash
694b5d6220eb8a349b60ce749052c3b923c8449bbfb4ebfb68f4fc27f1b7e92b

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Fri, 15 Apr 2022 08:51:20 GMT
content-encoding
gzip
last-modified
Tue, 12 Apr 2022 20:00:42 GMT
server
Duo/1.0
age
732871
etag
W/"6255da6a-ff2"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
image/svg+xml
via
1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
cache-control
max-age=31536000, public, must-revalidate, proxy-revalidate, max-age=31536000
x-amz-cf-pop
FRA2-C2
x-amz-cf-id
BI4BaI_GaLtIJr2liAJoYalNXgKerfw24lCM2MclUB1nghdU2uRaDQ==
expires
Sat, 15 Apr 2023 08:51:20 GMT
aW1nL2RlY2lwaGVyLzQwNC5qcGc=
duo.com/img/asset/
110 KB
111 KB
Image
General
Full URL
https://duo.com/img/asset/aW1nL2RlY2lwaGVyLzQwNC5qcGc=?s=12378a2282d82a8f9f860cc85a068fe2
Requested by
Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.80.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-80-94.fra2.r.cloudfront.net
Software
Duo/1.0 /
Resource Hash
849b2ac11460487810a7132803d8680307e25126ba000a30b4775ed3e78201be
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Sat, 23 Apr 2022 20:25:51 GMT
via
1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
x-content-type-options
nosniff
x-amz-cf-pop
FRA2-C2
x-cache
Miss from cloudfront
content-length
112627
x-xss-protection
1; mode=block
x-ua-compatible
IE=Edge,chrome=1
referrer-policy
no-referrer-when-downgrade
last-modified
Sat, 23 Apr 2022 20:25:51 GMT
server
Duo/1.0
x-frame-options
SAMEORIGIN
strict-transport-security
max-age=63072000; includeSubDomains; preload
content-type
image/jpeg
cache-control
max-age=300
permissions-policy
interest-cohort=()
x-amz-cf-id
cP9ov1eLZH2INi_ogxxdzkOYSaqtYazqPv6aEjV4QCbL7Di8xVbhIQ==
expires
Sat, 23 Apr 2022 20:30:51 GMT
d-logo--footer.svg
duo.com/assets/img/decipher/logos/
3 KB
2 KB
Image
General
Full URL
https://duo.com/assets/img/decipher/logos/d-logo--footer.svg
Requested by
Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.80.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-80-94.fra2.r.cloudfront.net
Software
Duo/1.0 /
Resource Hash
c33592c7a249c98164b3d533c58fae62ced2b403deab8f2d0cce4c4f1cbb285d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Fri, 15 Apr 2022 08:15:00 GMT
content-encoding
gzip
last-modified
Tue, 12 Apr 2022 20:00:42 GMT
server
Duo/1.0
age
735051
etag
W/"6255da6a-b5f"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
image/svg+xml
via
1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
cache-control
max-age=31536000, public, must-revalidate, proxy-revalidate, max-age=31536000
x-amz-cf-pop
FRA2-C2
x-amz-cf-id
Po9BV8gaujDjbqSlvajQPE-wkhskjlczPnrtwc5KUk2Scz7LWrAo2A==
expires
Sat, 15 Apr 2023 08:15:00 GMT
jquery.min.js
ajax.googleapis.com/ajax/libs/jquery/2.1.4/
82 KB
30 KB
Script
General
Full URL
https://ajax.googleapis.com/ajax/libs/jquery/2.1.4/jquery.min.js
Requested by
Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4014:80b::200a , Ireland, ASN15169 (GOOGLE, US),
Reverse DNS
Software
sffe /
Resource Hash
22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Wed, 20 Apr 2022 15:20:25 GMT
content-encoding
gzip
x-content-type-options
nosniff
age
277526
content-security-policy-report-only
require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/hosted-libraries-pushers
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
29725
x-xss-protection
0
last-modified
Tue, 03 Mar 2020 19:15:00 GMT
server
sffe
cross-origin-opener-policy
same-origin; report-to="hosted-libraries-pushers"
vary
Accept-Encoding
report-to
{"group":"hosted-libraries-pushers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/hosted-libraries-pushers"}]}
content-type
text/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
public, max-age=31536000, stale-while-revalidate=2592000
accept-ranges
bytes
timing-allow-origin
*
expires
Thu, 20 Apr 2023 15:20:25 GMT
production-2021.min.js
duo.com/js/build/
760 KB
270 KB
Script
General
Full URL
https://duo.com/js/build/production-2021.min.js?v=1647976353
Requested by
Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.80.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-80-94.fra2.r.cloudfront.net
Software
Duo/1.0 /
Resource Hash
e8e74813d3382d7453da81f7037183bb926aa06ce68021ba6b55f01d20d0f205

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Sat, 23 Apr 2022 05:23:45 GMT
content-encoding
gzip
last-modified
Thu, 14 Apr 2022 16:20:39 GMT
server
Duo/1.0
age
54126
etag
W/"625849d7-be0c2"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
application/javascript; charset=utf-8
via
1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
cache-control
max-age=31536000, public, must-revalidate, proxy-revalidate, max-age=31536000
x-amz-cf-pop
FRA2-C2
x-amz-cf-id
QfNFSrnF0IHup6bQ6aEghQ261iZR957pgdbHZRiY2UmpUWN_oysQjA==
expires
Sun, 23 Apr 2023 05:23:45 GMT
ctm.js
www.cisco.com/c/dam/cdc/t/
131 KB
31 KB
Script
General
Full URL
https://www.cisco.com/c/dam/cdc/t/ctm.js
Requested by
Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol
H2
Security
TLS 1.3, , CHACHA20_POLY1305
Server
2a02:26f0:3500:88d::b33 Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
Apache /
Resource Hash
ebb4d3109b96ab757bdf0be76f9b0a583086cc032d48b128d8f636da082ca048
Security Headers
Name Value
Content-Security-Policy upgrade-insecure-requests; frame-ancestors *.cisco.com *.jasper.com *.ciscospark.com *.ciscolive.com http://cisco.lookbookhq.com https://cisco.lookbookhq.com testcisco.marketing.adobe.com cisco.marketing.adobe.com ciscosales.my.salesforce.com test.salesforce.com zedo.com hindustantimes.com economictimes.indiatimes.com *.webex.com *.cdw.com *.cdwg.com *.cdw.ca *.meraki-go.com http://ciscopartners.lookbookhq.com https://ciscopartners.lookbookhq.com ciscolearningsystem.com ciscocustomer.lookbookhq.com cisco.lookbookhq.com ccsmedia.com *.itquotes.ie dteonline.com ampito-cisco.com arkphire.com *.insight.com *.ccsmedia.com *.ebuyer.com *.lambda-tek.com *.storm-technologies.com *.vohkus.com *.bechtle.com *.rainfocus.com *.broadbandbuyer.com *.hardware.com shop.redpontem.com cisco.techdatavendors.be;
Strict-Transport-Security max-age=31536000
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Sat, 23 Apr 2022 20:25:51 GMT
content-encoding
gzip
x-content-type-options
nosniff
vary
Accept-Encoding
content-length
30476
x-xss-protection
1; mode=block
pragma
no-cache
cdchost
wemxweb-publish-prod1-01
x-test-debug
nURL=www.cisco.com,realm=0,isRealm=0,realmDomain=0,shortrealm=0,upgradeTest=1
server
Apache
x-frame-options
SAMEORIGIN
etag
"20ccb-5dc9e39f17a0e-gzip"
strict-transport-security
max-age=31536000
content-type
application/x-javascript
cache-control
max-age=0, no-cache, no-store
content-security-policy
upgrade-insecure-requests; frame-ancestors *.cisco.com *.jasper.com *.ciscospark.com *.ciscolive.com http://cisco.lookbookhq.com https://cisco.lookbookhq.com testcisco.marketing.adobe.com cisco.marketing.adobe.com ciscosales.my.salesforce.com test.salesforce.com zedo.com hindustantimes.com economictimes.indiatimes.com *.webex.com *.cdw.com *.cdwg.com *.cdw.ca *.meraki-go.com http://ciscopartners.lookbookhq.com https://ciscopartners.lookbookhq.com ciscolearningsystem.com ciscocustomer.lookbookhq.com cisco.lookbookhq.com ccsmedia.com *.itquotes.ie dteonline.com ampito-cisco.com arkphire.com *.insight.com *.ccsmedia.com *.ebuyer.com *.lambda-tek.com *.storm-technologies.com *.vohkus.com *.bechtle.com *.rainfocus.com *.broadbandbuyer.com *.hardware.com shop.redpontem.com cisco.techdatavendors.be;
accept-ranges
bytes
expires
Sat, 23 Apr 2022 20:25:51 GMT
gtm.js
www.googletagmanager.com/
287 KB
85 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-MFPB9D
Requested by
Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
7b0ecec68b62045e0ed6b268e1548263ab7f315f414873da05632849ae287968
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Sat, 23 Apr 2022 20:25:51 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
86910
x-xss-protection
0
last-modified
Sat, 23 Apr 2022 18:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sat, 23 Apr 2022 20:25:51 GMT
din1451alt-webfont.woff2
duo.com/fonts/din1451alt/
17 KB
18 KB
Font
General
Full URL
https://duo.com/fonts/din1451alt/din1451alt-webfont.woff2
Requested by
Host: duo.com
URL: https://duo.com/css/production-2021.css?v=1647976353
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.80.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-80-94.fra2.r.cloudfront.net
Software
Duo/1.0 /
Resource Hash
e9f76eabead93f85fc4dc190dca4b1419dcd76b57b1c22649856b01d3ac2536e
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://duo.com/css/production-2021.css?v=1647976353
Origin
https://duo.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
via
1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
x-content-type-options
nosniff
x-amz-cf-pop
FRA2-C2
x-cache
RefreshHit from cloudfront
date
Sat, 23 Apr 2022 20:25:51 GMT
content-length
17424
x-xss-protection
1; mode=block
x-ua-compatible
IE=Edge,chrome=1
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 12 Apr 2022 20:01:08 GMT
server
Duo/1.0
etag
"6255da84-4410"
x-frame-options
SAMEORIGIN
content-type
application/octet-stream
cache-control
max-age=300
accept-ranges
bytes
x-amz-cf-id
SFRUH4Ru6rOtGUwbMVyPsBaGmMFt1bkSc3-uvrHiIoaJuQxkEYx2TA==
expires
Sat, 23 Apr 2022 20:30:51 GMT
din1451alt_g-webfont.woff2
duo.com/fonts/din1451alt/
22 KB
23 KB
Font
General
Full URL
https://duo.com/fonts/din1451alt/din1451alt_g-webfont.woff2
Requested by
Host: duo.com
URL: https://duo.com/css/production-2021.css?v=1647976353
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.80.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-80-94.fra2.r.cloudfront.net
Software
Duo/1.0 /
Resource Hash
ede067783c02098828dfe0bda385a9913ff79006eb2cd1a406bcc18e66cd7bad
Security Headers
Name Value
Strict-Transport-Security max-age=63072000; includeSubDomains; preload
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

Referer
https://duo.com/css/production-2021.css?v=1647976353
Origin
https://duo.com
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

strict-transport-security
max-age=63072000; includeSubDomains; preload
via
1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
x-content-type-options
nosniff
x-amz-cf-pop
FRA2-C2
x-cache
RefreshHit from cloudfront
date
Sat, 23 Apr 2022 20:25:51 GMT
content-length
22668
x-xss-protection
1; mode=block
x-ua-compatible
IE=Edge,chrome=1
referrer-policy
no-referrer-when-downgrade
last-modified
Tue, 12 Apr 2022 20:01:08 GMT
server
Duo/1.0
etag
"6255da84-588c"
x-frame-options
SAMEORIGIN
content-type
application/octet-stream
cache-control
max-age=300
accept-ranges
bytes
x-amz-cf-id
KtAJHMg-W94wikNkhUgbwSHqhLmQDpS9u7OCL7BZNnbWmoOmuaaJ5w==
expires
Sat, 23 Apr 2022 20:30:51 GMT
multi-squares-2.svg
duo.com/assets/img/decipher/svg/
1 KB
973 B
Image
General
Full URL
https://duo.com/assets/img/decipher/svg/multi-squares-2.svg
Requested by
Host: duo.com
URL: https://duo.com/css/production-2021.css?v=1647976353
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.80.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-80-94.fra2.r.cloudfront.net
Software
Duo/1.0 /
Resource Hash
4adefd63c0816744b24f5f7c63c2ab245eb000b310fe05fb998cfccb98bad0cb

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/css/production-2021.css?v=1647976353
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Tue, 19 Apr 2022 03:40:59 GMT
content-encoding
gzip
last-modified
Tue, 12 Apr 2022 20:00:42 GMT
server
Duo/1.0
age
405892
etag
W/"6255da6a-5d4"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
image/svg+xml
via
1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
cache-control
max-age=31536000, public, must-revalidate, proxy-revalidate, max-age=31536000
x-amz-cf-pop
FRA2-C2
x-amz-cf-id
LY89_jAnRt_B_ys0suibzGrkmm8be8U8TqH0jM9kDXyk_AAgV-TNZg==
expires
Wed, 19 Apr 2023 03:40:59 GMT
icon-sprite.20210112.svg
duo.com/fonts/
240 KB
81 KB
XHR
General
Full URL
https://duo.com/fonts/icon-sprite.20210112.svg
Requested by
Host: duo.com
URL: https://duo.com/js/build/production-2021.min.js?v=1647976353
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.80.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-80-94.fra2.r.cloudfront.net
Software
Duo/1.0 /
Resource Hash
d9218d98cd999ad151e3b5ff5e2d7021b93f1c806c49ffc1f60a3f476d64747e

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
public
date
Fri, 15 Apr 2022 05:37:56 GMT
content-encoding
gzip
last-modified
Tue, 12 Apr 2022 20:01:08 GMT
server
Duo/1.0
age
744475
etag
W/"6255da84-3c031"
vary
Accept-Encoding
x-cache
Hit from cloudfront
content-type
image/svg+xml
via
1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
cache-control
max-age=31536000, public, must-revalidate, proxy-revalidate, max-age=31536000
x-amz-cf-pop
FRA2-C2
x-amz-cf-id
WP8S6W4OjK9r0vsFdWnB5swQWaK5eIvLY4oK0tsqpob03rIMVao3dw==
expires
Sat, 15 Apr 2023 05:37:56 GMT
optimize.js
www.google-analytics.com/gtm/
92 KB
36 KB
Script
General
Full URL
https://www.google-analytics.com/gtm/optimize.js?id=GTM-WV3KTWL
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MFPB9D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
12cefaf738029b6d8ff15cf04eb1db85f52a11492bf2a83df9717de21ce40ff7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Sat, 23 Apr 2022 20:25:51 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
36732
x-xss-protection
0
last-modified
Sat, 23 Apr 2022 18:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sat, 23 Apr 2022 20:25:51 GMT
js
www.googletagmanager.com/gtag/
175 KB
65 KB
Script
General
Full URL
https://www.googletagmanager.com/gtag/js?id=G-95Z7P6PE75&l=dataLayer&cx=c
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MFPB9D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
956db35bd22bc613b96a763ae81a3d52ec66fd471d0ffac2bb3f324d9e27a0a8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Sat, 23 Apr 2022 20:25:51 GMT
content-encoding
br
server
Google Tag Manager
access-control-allow-headers
Cache-Control
vary
Accept-Encoding
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
strict-transport-security
max-age=31536000; includeSubDomains
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
66188
x-xss-protection
0
expires
Sat, 23 Apr 2022 20:25:51 GMT
bizible.js
cdn.bizible.com/scripts/
83 KB
32 KB
Script
General
Full URL
https://cdn.bizible.com/scripts/bizible.js?account=duo.com
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MFPB9D
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/67D4) /
Resource Hash
cbda94666db24554bf77638fc059848d381c3c98f7f24641fa830abcd5793de7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Sat, 23 Apr 2022 20:25:51 GMT
content-encoding
gzip
last-modified
Fri, 22 Apr 2022 09:50:47 GMT
server
ECS (frb/67D4)
age
73212
etag
"1d65a712e56d81:0"
vary
Accept-Encoding
x-cache
HIT
content-type
application/x-javascript
cache-control
max-age=86400
accept-ranges
bytes
content-length
32300
analytics.js
www.google-analytics.com/
49 KB
20 KB
Script
General
Full URL
https://www.google-analytics.com/analytics.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MFPB9D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

strict-transport-security
max-age=10886400; includeSubDomains; preload
content-encoding
gzip
x-content-type-options
nosniff
last-modified
Wed, 13 Apr 2022 21:02:38 GMT
server
Golfe2
age
3061
date
Sat, 23 Apr 2022 19:34:50 GMT
vary
Accept-Encoding
content-type
text/javascript
cache-control
public, max-age=7200
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
20006
expires
Sat, 23 Apr 2022 21:34:50 GMT
insight.min.js
snap.licdn.com/li.lms-analytics/
8 KB
3 KB
Script
General
Full URL
https://snap.licdn.com/li.lms-analytics/insight.min.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MFPB9D
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
2a02:26f0:ef::5c7b:c25a Frankfurt am Main, Germany, ASN20940 (AKAMAI-ASN1, NL),
Reverse DNS
Software
/
Resource Hash
14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Sat, 23 Apr 2022 20:25:51 GMT
Content-Encoding
gzip
Last-Modified
Wed, 13 Apr 2022 23:25:22 GMT
X-CDN
AKAM
X-EdgeConnect-Cache-Status
1
Vary
Accept-Encoding
Content-Type
application/x-javascript;charset=utf-8
Cache-Control
max-age=78538
Connection
keep-alive
Accept-Ranges
bytes
Content-Length
3085
ebdaa317731b0.js
t.contentsquare.net/uxa/
294 KB
67 KB
Script
General
Full URL
https://t.contentsquare.net/uxa/ebdaa317731b0.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MFPB9D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
18.66.112.26 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-18-66-112-26.fra56.r.cloudfront.net
Software
AmazonS3 /
Resource Hash
0cd5cf7846bd2a36245c0dbb389b7ce1c76a09e251b624a466700887ca0cd317

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

x-amz-server-side-encryption
AES256
date
Sat, 23 Apr 2022 13:12:32 GMT
content-encoding
gzip
last-modified
Wed, 20 Apr 2022 12:49:15 GMT
server
AmazonS3
age
27353
etag
"2c3255eceb2253d04f1b5591d22d6daf"
x-cache
Hit from cloudfront
content-type
application/javascript;charset=utf-8
via
1.1 d4744f6f4cb683596fb4a26e59b2aba8.cloudfront.net (CloudFront)
cache-control
max-age=900
x-amz-cf-pop
FRA56-P5
accept-ranges
bytes
content-length
67741
x-amz-cf-id
KT8erDqlmJTgeBlQ9NHBLyAP5mjCTJdtj2LplZLm0J2rcVok6yEBbg==
fbevents.js
connect.facebook.net/en_US/
99 KB
27 KB
Script
General
Full URL
https://connect.facebook.net/en_US/fbevents.js
Requested by
Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
086f1c868f8f769ef0039b238b415fc3c46d97e342309dc8c61cefb40868212e
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
document-policy
force-load-at-top
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400,h3-29=":443"; ma=86400
content-length
26311
x-xss-protection
0
pragma
public
x-fb-debug
3BOemuCiN+/ntXc27XH4PJMNTmRkw9DW34DMqWK45sWJyu3NNYWBloVkw3GEHUgAEzgukb8wOf0ZkHm9E6IsWg==
x-fb-trip-id
686109401
x-frame-options
DENY
cross-origin-opener-policy
same-origin-allow-popups
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
date
Sat, 23 Apr 2022 20:25:51 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
expires
Sat, 01 Jan 2000 00:00:00 GMT
munchkin-beta.js
munchkin.marketo.net/
1 KB
1 KB
Script
General
Full URL
https://munchkin.marketo.net/munchkin-beta.js
Requested by
Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.92.72.193 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-92-72-193.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
aaddb9b9a1d45c5de508e64c3dace01f450e4a7521229e99f03838f5067cc8f9

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Sat, 23 Apr 2022 20:25:51 GMT
Content-Encoding
gzip
Last-Modified
Fri, 01 Oct 2021 01:04:09 GMT
Server
AkamaiNetStorage
ETag
"d2b1913e6438b06d03258094a8c365f8:1633050249.484514"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
752
bat.js
bat.bing.com/
38 KB
12 KB
Script
General
Full URL
https://bat.bing.com/bat.js
Requested by
Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
8540c5e2d2e85cc6c5d46b1b06b7f6642dce39e0314299a08976cfe6053c7c52
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
last-modified
Wed, 09 Feb 2022 23:54:49 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: A15A22F87AC2401788520866BC9B17CE Ref B: FRAEDGE1209 Ref C: 2022-04-23T20:25:51Z
etag
"806a236c101ed81:0"
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript
access-control-allow-origin
*
cache-control
private,max-age=1800
date
Sat, 23 Apr 2022 20:25:51 GMT
accept-ranges
bytes
content-length
11333
aquant.js
secure.quantserve.com/
24 KB
10 KB
Script
General
Full URL
https://secure.quantserve.com/aquant.js?a=p-4CduNLZtPCAtp
Requested by
Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800d:21:fcb8:22d2:d390:5f1b , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
8d6580af877387b05d9ffac3ebeacfe25a7728c77adef6d9b32fd72ccbe21468

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Sat, 23 Apr 2022 20:25:51 GMT
content-encoding
gzip
etag
"u2JtyZzqnTXwzBUswy2r+w=="
vary
Accept-Encoding
content-type
application/javascript
cache-control
private, max-age=604800
cross-origin-resource-policy
cross-origin
accept-ranges
bytes
expires
Sat, 30 Apr 2022 20:25:51 GMT
6si.min.js
j.6sc.co/
27 KB
9 KB
Script
General
Full URL
https://j.6sc.co/6si.min.js
Requested by
Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-92-74-202.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
2707e48726a3f7ec48a1d1aec9738f20b36bac1535cfa9de2e4d92310c4e7e7a
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Sat, 23 Apr 2022 20:25:51 GMT
Content-Encoding
gzip
X-Content-Type-Options
nosniff
Connection
keep-alive
Vary
Accept-Encoding
Content-Length
8575
Pragma
no-cache
Last-Modified
Thu, 07 Oct 2021 17:17:43 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"615f2bb7-6a5f"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
application/javascript
Access-Control-Allow-Origin
Cache-Control
private, no-cache, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Sat, 23 Apr 2022 20:25:51 GMT
lp.js
metadata-static-files.sfo2.cdn.digitaloceanspaces.com/pixel/
6 KB
6 KB
Script
General
Full URL
https://metadata-static-files.sfo2.cdn.digitaloceanspaces.com/pixel/lp.js
Requested by
Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
205.185.216.42 , United States, ASN20446 (STACKPATH-CDN, US),
Reverse DNS
map2.hwcdn.net
Software
/
Resource Hash
da5d487f1fe8c4f5bba93bab0b071aed1249cf770ffdbc0144a86a4c2bae3c2c
Security Headers
Name Value
Strict-Transport-Security max-age=15552000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Sat, 23 Apr 2022 20:25:51 GMT
Connection
Keep-Alive
Last-Modified
Fri, 10 Dec 2021 19:19:18 GMT
x-amz-request-id
tx00000000000000bdc7dee-0062633427-26d7450b-sfo2a
etag
"b407e44b8c40c183ae2c50df3bbcf151"
Vary
Access-Control-Request-Headers,Access-Control-Request-Method,Origin
X-HW
1650745551.dop015.am5.t,1650745551.cds119.am5.shn,1650745551.cds119.am5.c
Content-Type
application/x-javascript
Cache-Control
max-age=527832
x-rgw-object-type
Normal
strict-transport-security
max-age=15552000; includeSubDomains; preload
Accept-Ranges
bytes
Content-Length
5673
bizible.js
cdn.bizible.com/scripts/
83 KB
32 KB
Script
General
Full URL
https://cdn.bizible.com/scripts/bizible.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MFPB9D
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/67D4) /
Resource Hash
cbda94666db24554bf77638fc059848d381c3c98f7f24641fa830abcd5793de7

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Sat, 23 Apr 2022 20:25:51 GMT
content-encoding
gzip
last-modified
Fri, 22 Apr 2022 09:50:47 GMT
server
ECS (frb/67D4)
age
73212
etag
"1d65a712e56d81:0"
vary
Accept-Encoding
x-cache
HIT
content-type
application/x-javascript
cache-control
max-age=86400
accept-ranges
bytes
content-length
32300
inlinks.js
jscloud.net/x/12296/
943 B
1017 B
Script
General
Full URL
https://jscloud.net/x/12296/inlinks.js
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtm.js?id=GTM-MFPB9D
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:48ae , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
96c5bfab045aceeb52ae2daa17605f436dd4ab9be43bbc87ac3debdbc9768ffb

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Sat, 23 Apr 2022 20:25:51 GMT
content-encoding
br
cf-cache-status
HIT
last-modified
Thu, 15 Jul 2021 06:33:19 GMT
server
cloudflare
age
392
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding,User-Agent
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=r%2F9SgxZ%2BsBQgVbSmxJKW4HL2Pj3WkKK5Lp3YE3XfuZiRbQBFXiJp2zWZJ1IA7MdoEoDGh%2BcXtS3G3Sws6kSYDV0XD%2BtxLdSxQLCtmyleprU27Ve%2Fcidkzbxgw8j1CMO1zs6ZC8B8t0Jp"}],"group":"cf-nel","max_age":604800}
content-type
application/javascript
access-control-allow-origin
*
cache-control
max-age=14400
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
cf-ray
700954b1af6d690a-FRA
data.json
duo.com/public/json-bodymovin/d-logo-light/
50 KB
12 KB
XHR
General
Full URL
https://duo.com/public/json-bodymovin/d-logo-light/data.json
Requested by
Host: duo.com
URL: https://duo.com/js/build/production-2021.min.js?v=1647976353
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.225.80.94 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
server-13-225-80-94.fra2.r.cloudfront.net
Software
Duo/1.0 /
Resource Hash
6a6d2038fc6ca01db16d2c528375510be154e1214cc694a6332d85a798fb4711

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Sat, 23 Apr 2022 20:25:51 GMT
content-encoding
gzip
server
Duo/1.0
x-amz-cf-pop
FRA2-C2
etag
W/"6255da84-c905"
vary
Accept-Encoding
x-cache
Error from cloudfront
content-type
text/html; charset=utf-8
via
1.1 217b7bc19321a4945b685521fa4f11ac.cloudfront.net (CloudFront)
content-length
11795
x-amz-cf-id
iJcqZsYZGo9yzl_zvy50T8HNWBf-sZOIy2CmEX7bGe8sipPOUByQrg==
utag.js
tags.tiqcdn.com/utag/cisco/duo/prod/
209 KB
57 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.js
Requested by
Host: www.cisco.com
URL: https://www.cisco.com/c/dam/cdc/t/ctm.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.100.208.216 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a95-100-208-216.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
8c685072fb706b91373f00500a93bfe2ba8f1130468d8851ab0d4314340fed0d

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Sat, 23 Apr 2022 20:25:51 GMT
content-encoding
gzip
last-modified
Thu, 14 Apr 2022 14:32:38 GMT
server
AkamaiNetStorage
etag
"c29fef9eea24ca36fd5dcff9b6c82ea9:1649946758.396091"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=300
accept-ranges
bytes
expires
Sat, 23 Apr 2022 20:30:51 GMT
rules-p-4CduNLZtPCAtp.js
rules.quantcount.com/
2 KB
1 KB
Script
General
Full URL
https://rules.quantcount.com/rules-p-4CduNLZtPCAtp.js
Requested by
Host: secure.quantserve.com
URL: https://secure.quantserve.com/aquant.js?a=p-4CduNLZtPCAtp
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2156:4200:6:44e3:f8c0:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
1d48d4cabc9c195baa08e42be70679688d706970ddd862bd91b857109d2a8874

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Sat, 23 Apr 2022 20:22:55 GMT
content-encoding
gzip
age
176
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
cross-origin-resource-policy
cross-origin
access-control-allow-origin
*
last-modified
Wed, 03 Feb 2021 00:36:24 GMT
server
AmazonS3
etag
W/"7d60bb0c5a7bdaca5a9466f9ef246056"
vary
Accept-Encoding
access-control-allow-methods
GET
content-type
application/javascript
via
1.1 632ee301c4920b52f2463aa9e978c57e.cloudfront.net (CloudFront)
cache-control
max-age=3600
x-amz-cf-pop
FRA50-C1
x-amz-cf-id
2Yxwi_WbvHPV030E4VeNytzeugyzS2RxV0jEYElhqxiAJolcbb1-ag==
ipv
cdn.bizible.com/m/
43 B
304 B
Image
General
Full URL
https://cdn.bizible.com/m/ipv?_biz_r=&_biz_h=-1906410348&_biz_u=3784c6066ff24c18962cf4619cd4dd50&_biz_s=51c712&_biz_l=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&_biz_t=1650745551683&_biz_i=%20%7C%20Decipher&_biz_n=0&a=duo.com&rnd=233028&cdn_o=a&_biz_z=1650745551684
Requested by
Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/6739) /
Resource Hash
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 23 Apr 2022 20:25:51 GMT
last-modified
Thu, 21 Apr 2022 01:07:01 GMT
server
ECS (frb/6739)
age
242330
x-cache
HIT
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control
no-cache, no-store
accept-ranges
bytes
content-type
Image/GIF
content-length
43
expires
-1
u
cdn.bizibly.com/
43 B
203 B
Image
General
Full URL
https://cdn.bizibly.com/u?_biz_u=3784c6066ff24c18962cf4619cd4dd50&_biz_s=51c712&_biz_l=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&_biz_t=1650745551686&_biz_i=%20%7C%20Decipher&a=duo.com&rnd=925517&cdn_o=a&_biz_z=1650745551686
Requested by
Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/67C2) /
Resource Hash
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 23 Apr 2022 20:25:51 GMT
last-modified
Thu, 21 Apr 2022 23:57:42 GMT
server
ECS (frb/67C2)
age
160089
x-cache
HIT
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control
no-cache, no-store
accept-ranges
bytes
content-type
Image/GIF
content-length
43
expires
-1
collect
px4.ads.linkedin.com/
Redirect Chain
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7540&time=1650745551690&url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS
  • https://www.linkedin.com/px/li_sync?redirect=https%3A%2F%2Fpx.ads.linkedin.com%2Fcollect%3Fv%3D2%26fmt%3Djs%26pid%3D7540%26time%3D1650745551690%26url%3Dhttps%253A%252F%252Fduo.com%252Fdecipher%252F...
  • https://px.ads.linkedin.com/collect?v=2&fmt=js&pid=7540&time=1650745551690&url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&liSync=true
  • https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7540&time=1650745551690&url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&liSync=true&e_ipv6=AQLYxfH...
0
265 B
Image
General
Full URL
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7540&time=1650745551690&url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&liSync=true&e_ipv6=AQLYxfHmy0GqjQAAAYBYGi68THEUbKI-zyJpfOpJYlYs5Gk8XWwWDq-PXUhlELD59B6t4dne
Requested by
Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol
H2
Server
13.107.42.14 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Sat, 23 Apr 2022 20:25:52 GMT
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: FB6EAEA4B1DF465C9E1DCA8D33005EA0 Ref B: FRAEDGE1219 Ref C: 2022-04-23T20:25:53Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
content-type
application/javascript
x-li-proto
http/2
content-length
0
x-li-uuid
AAXdWCZPDEyOS/7DdbbTuw==
x-li-fabric
prod-ltx1

Redirect headers

date
Sat, 23 Apr 2022 20:25:51 GMT
x-li-pop
afd-prod-ltx1-x
x-msedge-ref
Ref A: ACE068EEB6A3453B835959F6142B8E11 Ref B: VIEEDGE1717 Ref C: 2022-04-23T20:25:52Z
linkedin-action
1
x-cache
CONFIG_NOCACHE
x-li-fabric
prod-ltx1
location
https://px4.ads.linkedin.com/collect?v=2&fmt=js&pid=7540&time=1650745551690&url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&liSync=true&e_ipv6=AQLYxfHmy0GqjQAAAYBYGi68THEUbKI-zyJpfOpJYlYs5Gk8XWwWDq-PXUhlELD59B6t4dne
x-li-proto
http/2
content-length
0
x-li-uuid
AAXdWCZGX5O56RDm/evyOA==
getuidj
secure.adnxs.com/
11 B
697 B
XHR
General
Full URL
https://secure.adnxs.com/getuidj
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=duo.com
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_ECDSA, AES_128_GCM
Server
185.33.220.240 Amsterdam, Netherlands, ASN29990 (ASN-APPNEX, US),
Reverse DNS
717.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net
Software
nginx/1.21.3 /
Resource Hash
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
Security Headers
Name Value
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Pragma
no-cache
Date
Sat, 23 Apr 2022 20:25:51 GMT
X-Proxy-Origin
185.213.155.163; 185.213.155.163; 717.bm-nginx-loadbalancer.mgmt.ams1.adnexus.net; adnxs.com
AN-X-Request-Uuid
3a8a5472-eae1-447d-92fa-e5e6570c642c
Server
nginx/1.21.3
P3P
policyref="http://cdn.adnxs-simple.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE"
Access-Control-Allow-Origin
https://duo.com
Cache-Control
no-store, no-cache, private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json; charset=utf-8
Content-Length
11
X-XSS-Protection
0
Expires
Sat, 15 Nov 2008 16:00:00 GMT
/
c.6sc.co/
47 B
363 B
XHR
General
Full URL
https://c.6sc.co/
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=duo.com
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-92-74-202.deploy.static.akamaitechnologies.com
Software
/
Resource Hash
b1abd3b01e2c2b7089605b10d8c565730201eb2cb6e800188b2c6b68fe657289

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Sat, 23 Apr 2022 20:25:51 GMT
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
text/plain
Access-Control-Allow-Origin
https://duo.com
Access-Control-Allow-Credentials
true
Connection
keep-alive
Access-Control-Allow-Headers
*
Content-Length
47
216127175396154
connect.facebook.net/signals/config/
305 KB
87 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/216127175396154?v=2.9.57&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
c5028b9a532fb2423ea0b8cd61837102ba21bf6e3e749b90232fd4f0258cc707
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
document-policy
force-load-at-top
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400,h3-29=":443"; ma=86400
x-xss-protection
0
pragma
public
x-fb-debug
sfwouCYKZ45upT1asnC24dovOwlYeJo/ZZbZ7j1/R6T5PG67biwoz5VKqkHR5jAOXAaTDbkPi+V2DYKea4XExw==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
DENY
date
Sat, 23 Apr 2022 20:25:51 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
x-content-cdn-origin-ts
1650745551863
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
xdframe-single-domain-1.1.1.html
csxd.contentsquare.net/uxa/ Frame 9DE4
2 KB
1 KB
Document
General
Full URL
https://csxd.contentsquare.net/uxa/xdframe-single-domain-1.1.1.html?pid=5637
Requested by
Host: t.contentsquare.net
URL: https://t.contentsquare.net/uxa/ebdaa317731b0.js
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2600:9000:2057:4800:1b:ed91:4680:93a1 , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
AmazonS3 /
Resource Hash
d1a9abb0dc96d5a0fcc121a6de3a2c29c193a91d2f68939080e111b54d01d9e8

Request headers

Referer
https://duo.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

age
2784476
cache-control
max-age=31536000
content-encoding
gzip
content-type
text/html
date
Tue, 22 Mar 2022 14:57:56 GMT
etag
W/"fbd0a9f9a63a143cf028aca21682b386"
last-modified
Mon, 07 Mar 2022 15:32:43 GMT
server
AmazonS3
vary
Accept-Encoding
via
1.1 49140b838a62cd29e30f20e39a82dad0.cloudfront.net (CloudFront)
x-amz-cf-id
E5-ga-hn0eFJ1-nGqG41Ca3CU6_QdE6UEaUiyFTB6aWQqYJzpqz1aA==
x-amz-cf-pop
FRA6-C1
x-amz-server-side-encryption
AES256
x-cache
Hit from cloudfront
collect
analytics.google.com/g/
0
341 B
Ping
General
Full URL
https://analytics.google.com/g/collect?v=2&tid=G-95Z7P6PE75&gtm=2oe4k0&_p=2142235294&_z=ccd.NbB&_gaz=1&cid=1970540642.1650745552&ul=en-us&sr=1600x1200&_s=1&sid=1650745551&sct=1&seg=0&dl=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&dt=%7C%20Decipher&en=page_view&_fv=1&_nsi=1&_ss=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-95Z7P6PE75&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 23 Apr 2022 20:25:51 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://duo.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/g/
0
47 B
Ping
General
Full URL
https://stats.g.doubleclick.net/g/collect?v=2&tid=G-95Z7P6PE75&cid=1970540642.1650745552&gtm=2oe4k0&aip=1
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-95Z7P6PE75&l=dataLayer&cx=c
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c06::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 23 Apr 2022 20:25:51 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://duo.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
501 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?v=1&t=sr&slf_rd=1&_r=4&tid=G-95Z7P6PE75&cid=1970540642.1650745552&gtm=2oe4k0&aip=1&z=1544276172
Requested by
Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 23 Apr 2022 20:25:51 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
3f4ff81a-0faf-47bd-b4be-2852c0186612
https://duo.com/
6 KB
0
Other
General
Full URL
blob:https://duo.com/3f4ff81a-0faf-47bd-b4be-2852c0186612
Requested by
Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol
BLOB
Server
-, , ASN (),
Reverse DNS
Software
/
Resource Hash
10dfb21244c78df328ae9cff5429f822f5244e8d90c1efe5c26cc851d7a12f24

Request headers

accept-language
de-DE,de;q=0.9
Referer
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Content-Length
6483
Content-Type
application/javascript
4006052.js
bat.bing.com/p/action/
843 B
841 B
Script
General
Full URL
https://bat.bing.com/p/action/4006052.js
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/bat.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
1403c3e4df327d10852ab8a27fdc49f911d3a55bf0c8892c0fd6f5ed6de2d1d7
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000; includeSubDomains; preload
content-encoding
gzip
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: AF15ACB8A9584F9688B204DBD4420090 Ref B: FRAEDGE1209 Ref C: 2022-04-23T20:25:51Z
date
Sat, 23 Apr 2022 20:25:51 GMT
vary
Accept-Encoding
x-cache
CONFIG_NOCACHE
content-type
application/javascript; charset=utf-8
access-control-allow-origin
*
cache-control
no-store,no-cache
content-length
666
0
bat.bing.com/action/
0
174 B
Image
General
Full URL
https://bat.bing.com/action/0?ti=4006052&Ver=2&mid=0dd41013-9acb-425c-9998-61e2ca9547b7&sid=91c8f950c34311ec85d84fdc6f60f7db&vid=91c93040c34311ec97e4093ff0b1c453&vids=1&pi=1200101525&lg=en-US&sw=1600&sh=1200&sc=24&tl=%7C%20Decipher&p=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&r=&lt=2393&evt=pageLoad&msclkid=N&sv=1&rn=864388
Requested by
Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
2620:1ec:c11::200 , United States, ASN8068 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains; preload

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
strict-transport-security
max-age=31536000; includeSubDomains; preload
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: F224F5F95E6A4A46A809EEEAA1138B02 Ref B: FRAEDGE1209 Ref C: 2022-04-23T20:25:51Z
date
Sat, 23 Apr 2022 20:25:51 GMT
x-cache
CONFIG_NOCACHE
access-control-allow-origin
*
cache-control
no-cache, must-revalidate
expires
Fri, 01 Jan 1990 00:00:00 GMT
httpsduocomdeciphertrailblazerhuntscompromisedcredentialsinawsnAWS.json
jscloud.net/x/13009/
26 B
556 B
XHR
General
Full URL
https://jscloud.net/x/13009/httpsduocomdeciphertrailblazerhuntscompromisedcredentialsinawsnAWS.json
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=duo.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2606:4700:20::ac43:48ae , United States, ASN13335 (CLOUDFLARENET, US),
Reverse DNS
Software
cloudflare /
Resource Hash
0a998ab5472475c3418c7977b6214c566aad928094dceb86d2e9f53bdbdd26c0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Sat, 23 Apr 2022 20:25:52 GMT
cf-cache-status
DYNAMIC
last-modified
Thu, 16 Jan 2020 10:42:21 GMT
server
cloudflare
expect-ct
max-age=604800, report-uri="https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct"
vary
Accept-Encoding,User-Agent
report-to
{"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=u6GsYrn2eOXcD8Dw%2FrfqVq85uvrQwQCaPPSR4b12i%2BdPcDEm5VkbWhAqdWiT01qJ58x3THSXiClTNtzRV71YFpeYbumDqpzgp%2BWfVVk9t7vXRzbYIR9sytaI6mA%2BD5csRF%2FphbIysLCK"}],"group":"cf-nel","max_age":604800}
content-type
application/json
access-control-allow-origin
*
nel
{"success_fraction":0,"report_to":"cf-nel","max_age":604800}
accept-ranges
bytes
cf-ray
700954b2bd3d925c-FRA
content-length
26
collect
www.google-analytics.com/j/
2 B
22 B
XHR
General
Full URL
https://www.google-analytics.com/j/collect?v=1&_v=j96&a=2142235294&t=pageview&_s=1&dl=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&ul=en-us&de=UTF-8&dt=%7C%20Decipher&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aADAAAABQAAAAC~&jid=672138589&gjid=1035995929&cid=1970540642.1650745552&tid=UA-20141016-1&_gid=395505349.1650745552&_r=1&gtm=2wg4k0MFPB9D&z=1651038086
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=duo.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

Referer
https://duo.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
date
Sat, 23 Apr 2022 20:25:51 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://duo.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
2
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
stats.g.doubleclick.net/j/
4 B
436 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-20141016-1&cid=1970540642.1650745552&jid=2130065277&gjid=2088971072&_gid=395505349.1650745552&_u=aCDAgAABQAAAAG~&z=1316543895
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=duo.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:400c:c06::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://duo.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Sat, 23 Apr 2022 20:25:51 GMT
content-type
text/plain
access-control-allow-origin
https://duo.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
55 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j96&a=2142235294&t=pageview&_s=1&dl=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&ul=en-us&de=UTF-8&dt=%7C%20Decipher&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&_u=aCDAgAABQAAAAC~&jid=2130065277&gjid=2088971072&cid=1970540642.1650745552&tid=UA-20141016-1&_gid=395505349.1650745552&gtm=2wg4k0MFPB9D&cg3=Decipher%20Traffic%20Only&z=449829468
Requested by
Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 23 Apr 2022 13:53:59 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
23512
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
rd
dpm.demdex.net/id/
Redirect Chain
  • https://dpm.demdex.net/id?d_visid_ver=4.1.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=B8D07FF4520E94C10A490D4C%40AdobeOrg&d_nsid=0&ts=1650745551814
  • https://dpm.demdex.net/id/rd?d_visid_ver=4.1.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=B8D07FF4520E94C10A490D4C%40AdobeOrg&d_nsid=0&ts=1650745551814
973 B
1 KB
XHR
General
Full URL
https://dpm.demdex.net/id/rd?d_visid_ver=4.1.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=B8D07FF4520E94C10A490D4C%40AdobeOrg&d_nsid=0&ts=1650745551814
Requested by
Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol
HTTP/1.1
Server
99.81.5.109 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-99-81-5-109.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ccd5ccffdeefbc9a639364df7ce84211878f3a7413fe908939dd6df65bc25eb6
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

DCS
dcs-prod-irl1-2-v031-0cf28f2d1.edge-irl1.demdex.com UNKNOWN
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-TID
6woWcy4HTyw=
Vary
Origin
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Access-Control-Allow-Origin
https://duo.com
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Type
application/json;charset=utf-8
Content-Length
532
Expires
Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

DCS
dcs-prod-irl1-2-v031-0f46fb2c8.edge-irl1.demdex.com UNKNOWN
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
Access-Control-Allow-Origin
https://duo.com
X-TID
Oj4PRcJARZo=
Vary
Origin
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Location
https://dpm.demdex.net/id/rd?d_visid_ver=4.1.0&d_fieldgroup=MC&d_rtbd=json&d_ver=2&d_verify=1&d_orgid=B8D07FF4520E94C10A490D4C%40AdobeOrg&d_nsid=0&ts=1650745551814
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Access-Control-Allow-Credentials
true
Connection
keep-alive
Content-Length
0
Expires
Thu, 01 Jan 1970 00:00:00 UTC
xdc.js
cdn.bizible.com/
116 B
525 B
Script
General
Full URL
https://cdn.bizible.com/xdc.js?_biz_u=3784c6066ff24c18962cf4619cd4dd50&_biz_h=-1906410348&cdn_o=a&jsVer=4.22.02.16&a=duo.com
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=duo.com
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/6711) /
Resource Hash
82987c0cc9955a62a0f39457179cc41438567909f2ea0b3d18d05f26e3842c9c

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Sat, 23 Apr 2022 20:25:51 GMT
content-encoding
gzip
server
ECS (frb/6711)
etag
5F75AD94
vary
Accept-Encoding
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control
private, must-revalidate, max-age=21600
content-type
text/javascript; charset=utf-8
content-length
219
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=361da14e9cc9e3c3150a35780c1bec6b&svisitor=null&session=1fd848ae-fdd7-4b53-8a84-aff8e67cc364&event=a_pageload&q=%7B%22pageLoadTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A25%3A51%20GMT%22%7D&isIframe=false&m=%7B%22description%22%3A%22Security%20without%20fear.%20The%20web%20doesn%E2%80%99t%20have%20to%20be%20dark.%20Decipher%E2%80%99s%20goal%20is%20to%20bring%20order%20to%20this%20unpredictable%20and%20often%20confusing%20landscape%20by%20providing%20fresh%20perspectives%20from%20trusted%20voices.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%20%7C%20Decipher%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&pageViewId=f721e288-fc54-430a-8566-c2615b5598d4&an_uid=0
Requested by
Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-92-74-202.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Sat, 23 Apr 2022 20:25:52 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Fri, 21 Feb 2020 18:57:20 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"5e502810-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
munchkin.js
munchkin.marketo.net/161/
11 KB
5 KB
Script
General
Full URL
https://munchkin.marketo.net/161/munchkin.js
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/munchkin-beta.js
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.92.72.193 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-92-72-193.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
c2aee78040b4ed46c2377e6825db12a9691a2eb584adf338e77312c8978d8537

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Sat, 23 Apr 2022 20:25:51 GMT
Content-Encoding
gzip
Last-Modified
Wed, 08 Sep 2021 00:38:21 GMT
Server
AkamaiNetStorage
ETag
"0e0eefac8daf874e8b1aa34aeb160c52:1631061501.737429"
Vary
Accept-Encoding
P3P
policyref="http://www.marketo.com/w3c/p3p.xml", CP="NOI DSP COR NID CURi OUR NOR"
Cache-Control
max-age=8640000
Connection
keep-alive
Accept-Ranges
bytes
Content-Type
application/x-javascript
Content-Length
4681
Expires
Mon, 01 Aug 2022 20:25:51 GMT
utag.5.js
tags.tiqcdn.com/utag/cisco/duo/prod/
72 KB
26 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.5.js?utv=ut4.46.202204141432
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.100.208.216 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a95-100-208-216.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
b9a30fc3aae53b1ec17fd01ab60fd6fd09dfc4ad82967fd11e0c024bad354587

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Sat, 23 Apr 2022 20:25:51 GMT
content-encoding
gzip
last-modified
Thu, 14 Apr 2022 14:32:38 GMT
server
AkamaiNetStorage
etag
"b2aa28110d124d4c147a653bf129ffb4:1649946758.099569"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
25935
expires
Sun, 08 May 2022 20:25:51 GMT
utag.3.js
tags.tiqcdn.com/utag/cisco/duo/prod/
22 KB
7 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.3.js?utv=ut4.46.202204141432
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.100.208.216 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a95-100-208-216.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
d8b2f6ab3701d3ae42d7519c2798c137b53f31c835a6c16df02a6274beac83d0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Sat, 23 Apr 2022 20:25:51 GMT
content-encoding
gzip
last-modified
Thu, 14 Apr 2022 14:32:38 GMT
server
AkamaiNetStorage
etag
"cb3d4ed207da7be05643ceb0c33b9ac5:1649946758.758679"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
7283
expires
Sun, 08 May 2022 20:25:51 GMT
utag.28.js
tags.tiqcdn.com/utag/cisco/duo/prod/
2 KB
1 KB
Script
General
Full URL
https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.28.js?utv=ut4.46.202106171628
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.100.208.216 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a95-100-208-216.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
c72062a60866c674a25f2a5b5d8344e9509c7381a6472f2a484325ac14597ee8

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Sat, 23 Apr 2022 20:25:51 GMT
content-encoding
gzip
last-modified
Thu, 17 Jun 2021 16:28:49 GMT
server
AkamaiNetStorage
etag
"097dc543fb3caec1bac670f2bd520652:1623947329.572906"
vary
Accept-Encoding
content-type
application/x-javascript
cache-control
max-age=1296000
accept-ranges
bytes
content-length
999
expires
Sun, 08 May 2022 20:25:51 GMT
pixel;r=1194282661;labels=_fp.event.Default;rf=0;a=p-4CduNLZtPCAtp;url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS;uht=2;fpan=1;fpa=P0-569987462-16507...
pixel.quantserve.com/
35 B
372 B
Image
General
Full URL
https://pixel.quantserve.com/pixel;r=1194282661;labels=_fp.event.Default;rf=0;a=p-4CduNLZtPCAtp;url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS;uht=2;fpan=1;fpa=P0-569987462-1650745551833;pbc=;ns=0;ce=1;qjs=1;qv=a98acd33-20220316110313;cm=;gdpr=0;ref=;d=duo.com;je=0;sr=1600x1200x24;dst=0;et=1650745551833;tzo=0;ogl=site_name.Decipher%2Ctype.website%2Curl.%2Cdescription.Security%20without%20fear%252E%20The%20web%20doesn%E2%80%99t%20have%20to%20be%20dark%252E%20Decipher%E2%80%99s%20goal%20is%20to%20br%2Cimage.http%3A%2F%2Fduo-www-v3-clean%252Etest%2Fassets%2Fimg%2Fseo-images%2Fmeta-decipher-default%252Ejpg%2Cimage%3Awidth.1200%2Cimage%3Aheight.630
Requested by
Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
2620:116:800d:21:fcb8:22d2:d390:5f1b , United States, ASN16509 (AMAZON-02, US),
Reverse DNS
Software
/
Resource Hash
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
Security Headers
Name Value
Strict-Transport-Security max-age=86400

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 23 Apr 2022 20:25:51 GMT
strict-transport-security
max-age=86400
p3p
CP="NOI DSP COR NID CURa ADMa DEVa PSAo PSDo OUR SAMa IND COM NAV"
cache-control
private, no-cache, no-store, proxy-revalidate
content-type
image/gif
content-length
35
expires
Fri, 04 Aug 1978 12:00:00 GMT
ga-audiences
www.google.com/ads/
42 B
501 B
Image
General
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-20141016-1&cid=1970540642.1650745552&jid=2130065277&_u=aCDAgAABQAAAAG~&z=1933731971
Requested by
Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 23 Apr 2022 20:25:52 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
107 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-20141016-1&cid=1970540642.1650745552&jid=2130065277&_u=aCDAgAABQAAAAG~&z=1933731971
Requested by
Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 23 Apr 2022 20:25:52 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
pageview
c.contentsquare.net/
0
320 B
Image
General
Full URL
https://c.contentsquare.net/pageview?pid=5637&uu=2102bbfc-9992-aab2-e650-4ec6c651b846&sn=1&lv=1650745551&lhd=1650745551&hd=1650745551&pn=1&dw=1600&dh=1373&ww=1600&wh=1200&sw=1600&sh=1200&dr=&url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&uc=1&la=en-US&v=11.20.0&r=245523
Requested by
Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.72.196.102 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-72-196-102.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 23 Apr 2022 20:25:51 GMT
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
content-disposition
inline
timing-allow-origin
*
access-control-allow-headers
Access-Control-Expose-Headers, Content-Type, Content-Compression, X-Requested-With
expires
Sun, 24 Oct 1982 23:00:00 GMT
gtm.js
www.googletagmanager.com/
287 KB
85 KB
Script
General
Full URL
https://www.googletagmanager.com/gtm.js?id=GTM-MFPB9D&l=dataLayer
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:811::2008 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Google Tag Manager /
Resource Hash
34c727e51a6df37234ce8086a0b56b8c62ce12b2a765a198f4c0f9dd8791d6c9
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Sat, 23 Apr 2022 20:25:51 GMT
content-encoding
br
vary
Accept-Encoding
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
86997
x-xss-protection
0
last-modified
Sat, 23 Apr 2022 18:00:00 GMT
server
Google Tag Manager
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/javascript; charset=UTF-8
access-control-allow-origin
*
cache-control
private, max-age=900
access-control-allow-credentials
true
access-control-allow-headers
Cache-Control
expires
Sat, 23 Apr 2022 20:25:51 GMT
visitWebPage
074-uqx-410.mktoresp.com/webevents/
2 B
311 B
Ping
General
Full URL
https://074-uqx-410.mktoresp.com/webevents/visitWebPage?_mchNc=1650745551867&_mchCn=&_mchId=074-UQX-410&_mchTk=_mch-duo.com-1650745551866-32900&_mchHo=duo.com&_mchPo=&_mchRu=%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&_mchPc=https%3A&_mchVr=161&_mchEcid=&_mchHa=&_mchRe=&_mchQp=
Requested by
Host: munchkin.marketo.net
URL: https://munchkin.marketo.net/161/munchkin.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
192.28.147.68 , United States, ASN15224 (OMNITURE, US),
Reverse DNS
Software
nginx /
Resource Hash
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Sat, 23 Apr 2022 20:25:52 GMT
Content-Encoding
gzip
Server
nginx
Transfer-Encoding
chunked
Content-Type
text/plain; charset=UTF-8
Access-Control-Allow-Origin
*
Connection
keep-alive
X-Request-Id
ee5131db-d569-426c-b97e-7c96bb2b9ee0
ntpagetag.gif
cisco-tags.cisco.com/tag/
85 B
598 B
Image
General
Full URL
https://cisco-tags.cisco.com/tag/ntpagetag.gif?js=1&ts=1650745551871.978&lc=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&rs=1600x1200&cd=24&ln=en&tz=GMT&jv=0&utag_main_v_id=0180581a2bb600232beab95db30003074004e06c00b08&meta.viewport=width%3Ddevice-width%2C%20initial-scale%3D1.0%2C%20user-scalable%3Dyes&title=%7C%20decipher&url=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&tag=ut4.46.202204141432&entitlement=undefined&locale=en-us&meta.country=us&meta.locale=us&breakpoint=unavailable&content_type=no%20contenttype&linktrack=linkpage&loc=http%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&cookie_length=1000&meta.iapath=no%20iapath&hier1=no%20iapath&meta.wm_reporting_category=no%20iapath&sa_source=meta.iapath&t_profile=cisco.duo&t_load=ctm&suite=cisco-complete&returnVisit=false&cookies=true&localstorage=true&dnt=false&_ga=GA1.2.1970540642.1650745552&conversion=event1&adobeVersions=AppMeasurement%3Dna%2CVisitorJS%3Dna%2CMbox%3Dna&meta.msapplication-tilecolor=%23000000&meta.msapplication-config=%2Fassets%2Fimg%2Fdecipher%2Ffavicons%2Fbrowserconfig.xml&meta.theme-color=%23ffffff&meta.robots=index%2Cfollow%2Carchive&meta.fb:app_id=2090208394329663&meta.og:site_name=decipher&meta.og:type=website&meta.twitter:card=summary_large_image&meta.twitter:site=%40deciphersec&meta.twitter:creator=%40deciphersec&meta.description=security%20without%20fear.%20the%20web%20doesn%E2%80%99t%20have%20to%20be%20dark.%20decipher%E2%80%99s%20goal%20is%20to%20bring%20order%20to%20this%20unpredictable%20and%20often%20confusing%20landscape%20by%20providing%20fresh%20perspectives%20from%20trusted%20voices.&meta.og:description=security%20without%20fear.%20the%20web%20doesn%E2%80%99t%20have%20to%20be%20dark.%20decipher%E2%80%99s%20goal%20is%20to%20bring%20order%20to%20this%20unpredictable%20and%20often%20confusing%20landscape%20by%20providing%20fresh%20perspectives%20from%20trusted%20voices.&meta.twitter:description=security%20without%20fear.%20the%20web%20doesn%E2%80%99t%20have%20to%20be%20dark.%20decipher%E2%80%99s%20goal%20is%20to%20bring%20order%20to%20this%20unpredictable%20and%20often%20confusing%20landscape%20by%20providing%20fresh%20perspectives%20from%20trusted%20voices.&meta.twitter:image=http%3A%2F%2Fduo-www-v3-clean.test%2Fassets%2Fimg%2Fseo-images%2Fmeta-decipher-default.jpg&meta.og:image=http%3A%2F%2Fduo-www-v3-clean.test%2Fassets%2Fimg%2Fseo-images%2Fmeta-decipher-default.jpg&meta.og:image:width=1200&meta.og:image:height=630&meta.bitly-verification=040b99f315c6&meta.google-site-verification=svd8ahbyylsc2wljqdzwij1d2tnu8-u3fbldciehxdu&meta.twitter:widgets:csp=on&meta.msvalidate.01=27fb624dbd3f07315a4bf69f5d649c68&ets=1650745551873.905
Requested by
Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol
HTTP/1.1
Security
TLS 1.2, RSA, AES_128_GCM
Server
72.163.10.10 , United States, ASN109 (CISCOSYSTEMS, US),
Reverse DNS
cisco-tags.cisco.com
Software
Apache/2.2 /
Resource Hash
b96b64444f7d52c39b5716fe4d3e8d0433c67fb79731a4400188835d97b74bce
Security Headers
Name Value
Content-Security-Policy script-src 'self'; object-src 'self'
Strict-Transport-Security max-age=31536000; includeSubdomains;
X-Content-Type-Options nosniff
X-Frame-Options SAMEORIGIN
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Sat, 23 Apr 2022 20:25:52 GMT
X-Content-Type-Options
nosniff
Last-Modified
Fri, 12 Jun 2009 13:18:26 GMT
Server
Apache/2.2
ETag
"55"
X-Frame-Options
SAMEORIGIN
Content-Type
image/gif
Access-Control-Allow-Origin
*
Connection
Keep-Alive
Content-Security-Policy
script-src 'self'; object-src 'self'
Strict-Transport-Security
max-age=31536000; includeSubdomains;
Accept-Ranges
bytes
Keep-Alive
timeout=2, max=1000
Content-Length
85
X-XSS-Protection
1; mode=block
utag.v.js
tags.tiqcdn.com/utag/tiqapp/
2 B
202 B
Script
General
Full URL
https://tags.tiqcdn.com/utag/tiqapp/utag.v.js?a=cisco/duo/202204141432&cb=1650745551876
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
95.100.208.216 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a95-100-208-216.deploy.static.akamaitechnologies.com
Software
AkamaiNetStorage /
Resource Hash
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Sat, 23 Apr 2022 20:25:51 GMT
last-modified
Thu, 14 Apr 2016 16:57:51 GMT
server
AkamaiNetStorage
etag
"7bc0ee636b3b83484fc3b9348863bd22:1460653071"
content-type
application/x-javascript
cache-control
max-age=600
accept-ranges
bytes
content-length
2
expires
Sat, 23 Apr 2022 20:35:51 GMT
collect
stats.g.doubleclick.net/j/
4 B
25 B
XHR
General
Full URL
https://stats.g.doubleclick.net/j/collect?t=dc&aip=1&_r=3&v=1&_v=j96&tid=UA-20141016-1&cid=1970540642.1650745552&jid=672138589&gjid=1035995929&_gid=395505349.1650745552&_u=aADAAAAAQAAAAC~&z=1664567021
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=duo.com
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:400c:c06::9c Brussels, Belgium, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
Security Headers
Name Value
Strict-Transport-Security max-age=10886400; includeSubDomains; preload
X-Content-Type-Options nosniff

Request headers

Referer
https://duo.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type
text/plain

Response headers

pragma
no-cache
strict-transport-security
max-age=10886400; includeSubDomains; preload
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
date
Sat, 23 Apr 2022 20:25:51 GMT
content-type
text/plain
access-control-allow-origin
https://duo.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
4
expires
Fri, 01 Jan 1990 00:00:00 GMT
120108061684670
connect.facebook.net/signals/config/
305 KB
87 KB
Script
General
Full URL
https://connect.facebook.net/signals/config/120108061684670?v=2.9.57&r=stable
Requested by
Host: connect.facebook.net
URL: https://connect.facebook.net/en_US/fbevents.js
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f01c:216:face:b00c:0:3 Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
/
Resource Hash
22b6980432a6921ed17c090fcce9c581a6bbca8eeba48476f9e2b4b948beb520
Security Headers
Name Value
Content-Security-Policy default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
Strict-Transport-Security max-age=31536000; preload; includeSubDomains
X-Content-Type-Options nosniff
X-Frame-Options DENY
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

content-security-policy
default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
content-encoding
gzip
x-content-type-options
nosniff
document-policy
force-load-at-top
report-to
{"max_age":86400,"endpoints":[{"url":"https:\/\/www.facebook.com\/browser_reporting\/?minimize=0"}],"group":"coep_report"}
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400,h3-29=":443"; ma=86400
x-xss-protection
0
pragma
public
x-fb-debug
SiPuYr9EK/u79cVD+rBtKcyNJtZYXV2vHvUd1NubNki46/hcmjKFmxD8ITzOTXuLvJsqJkBQV1K3SGe30tDx6A==
cross-origin-embedder-policy-report-only
require-corp;report-to="coep_report"
cross-origin-opener-policy
same-origin-allow-popups
x-frame-options
DENY
date
Sat, 23 Apr 2022 20:25:52 GMT
strict-transport-security
max-age=31536000; preload; includeSubDomains
x-content-cdn-origin-ts
1650745552213
content-type
application/x-javascript; charset=utf-8
vary
Accept-Encoding
cache-control
public, max-age=1200
x-fb-rlafr
0
priority
u=3,i
expires
Sat, 01 Jan 2000 00:00:00 GMT
/
www.facebook.com/tr/
44 B
297 B
Image
General
Full URL
https://www.facebook.com/tr/?id=216127175396154&ev=PageView&dl=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&rl=&if=false&ts=1650745551934&sw=1600&sh=1200&v=2.9.57&r=stable&ec=0&o=30&fbp=fb.1.1650745551932.1591478257&it=1650745551700&coo=false&exp=p1&rqm=GET
Requested by
Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Sat, 23 Apr 2022 20:25:51 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
44
expires
Sat, 23 Apr 2022 20:25:51 GMT
clarity.js
l.clarity.ms/s/0.6.34/
53 KB
23 KB
Script
General
Full URL
https://l.clarity.ms/s/0.6.34/clarity.js
Requested by
Host: bat.bing.com
URL: https://bat.bing.com/p/action/4006052.js
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.120.65.166 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
ca63193ce799e4e00c9106349365981dc6e26cb77632ebf5df23dffba2aaccfa

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Sat, 23 Apr 2022 20:25:52 GMT
content-encoding
br
etag
"1d8530fabd6bb54"
last-modified
Mon, 18 Apr 2022 10:32:58 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
vary
Accept-Encoding
content-type
application/javascript;charset=utf-8
cache-control
public,max-age=86400
accept-ranges
bytes
request-context
appId=cid-v1:e55edbbe-e22b-46b4-8313-9ee2a4e71d12
ga-audiences
www.google.com/ads/
42 B
107 B
Image
General
Full URL
https://www.google.com/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-20141016-1&cid=1970540642.1650745552&jid=672138589&_u=aADAAAAAQAAAAC~&z=585327608
Requested by
Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
2a00:1450:4001:831::2004 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 23 Apr 2022 20:25:53 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
ga-audiences
www.google.de/ads/
42 B
63 B
Image
General
Full URL
https://www.google.de/ads/ga-audiences?t=sr&aip=1&_r=4&slf_rd=1&v=1&_v=j96&tid=UA-20141016-1&cid=1970540642.1650745552&jid=672138589&_u=aADAAAAAQAAAAC~&z=585327608
Requested by
Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::2003 Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
cafe /
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
X-Content-Type-Options nosniff
X-Xss-Protection 0

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 23 Apr 2022 20:25:52 GMT
x-content-type-options
nosniff
server
cafe
timing-allow-origin
*
p3p
policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
image/gif
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
42
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
dest5.html
cisco.demdex.net/ Frame 77E7
7 KB
3 KB
Document
General
Full URL
https://cisco.demdex.net/dest5.html?d_nsid=0
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.js
Protocol
HTTP/1.1
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
52.49.218.107 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-49-218-107.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Referer
https://duo.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Accept-Ranges
bytes
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Length
2791
Content-Type
text/html;charset=UTF-8
DCS
dcscanary-prod-irl1-1-v036-065406f3e.edge-irl1.demdex.com UNKNOWN
Expires
Thu, 01 Jan 1970 00:00:00 UTC
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
X-TID
yGKAjmvbSro=
content-encoding
gzip
date
Sat, 23 Apr 2022 20:25:52 GMT
last-modified
Wed, 13 Apr 2022 14:39:52 GMT
vary
accept-encoding
id
smetrics.cisco.com/
48 B
500 B
XHR
General
Full URL
https://smetrics.cisco.com/id?d_visid_ver=4.1.0&d_fieldgroup=A&mcorgid=B8D07FF4520E94C10A490D4C%40AdobeOrg&mid=23833216641308009283392217193619685112&ts=1650745552037
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=duo.com
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.36.218.177 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-13-36-218-177.eu-west-3.compute.amazonaws.com
Software
jag /
Resource Hash
0d66ef0aee9b4719486242281cd0add74dbec97893bc8e61c27b6e84d28f9391
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

Referer
https://duo.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type
application/x-www-form-urlencoded

Response headers

date
Sat, 23 Apr 2022 20:25:52 GMT
x-content-type-options
nosniff
server
jag
xserver
anedge-7b6f4bb9f7-fdl82
vary
Origin
x-c
main-1637.I660130.M0-562
p3p
CP="This is not a P3P policy"
access-control-allow-origin
https://duo.com
cache-control
no-cache, no-store, max-age=0, no-transform, private
access-control-allow-credentials
true
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/x-javascript;charset=utf-8
content-length
48
x-xss-protection
1; mode=block
dvar
c.contentsquare.net/
0
319 B
Image
General
Full URL
https://c.contentsquare.net/dvar?v=11.20.0&pid=5637&uu=2102bbfc-9992-aab2-e650-4ec6c651b846&sn=1&pn=1&dv=N4IgxgzgsghgLmAFgSwHYHMDSBTAniALhAAYA6ANgEYBWATgGZqAWY8pygdmI4A4eB9SuWrcm1cQCZiTeiAC%2BQAA&r=877066
Requested by
Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_128_GCM
Server
54.72.196.102 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-54-72-196-102.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 23 Apr 2022 20:25:52 GMT
access-control-allow-methods
GET, POST, OPTIONS
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate, pre-check=0, post-check=0
content-disposition
inline
timing-allow-origin
*
access-control-allow-headers
Access-Control-Expose-Headers, Content-Type, Content-Compression, X-Requested-With
expires
Sun, 24 Oct 1982 23:00:00 GMT
ibs:dpid=771&dpuuid=CAESEDu7izUiJCvTvCEQjylTGtc&google_cver=1
dpm.demdex.net/ Frame 77E7
Redirect Chain
  • https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm&gdpr=0&gdpr_consent=&google_hm=MjkyMzYzOTMwMjQ0NDk1ODg4MTI3NzkyOTY2MDM1MzU4NjE2MjU=
  • https://cm.g.doubleclick.net/pixel?google_nid=adobe_dmp&google_cm=&gdpr=0&gdpr_consent=&google_hm=MjkyMzYzOTMwMjQ0NDk1ODg4MTI3NzkyOTY2MDM1MzU4NjE2MjU=&google_tc=
  • https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEDu7izUiJCvTvCEQjylTGtc&google_cver=1?gdpr=0&gdpr_consent=
42 B
945 B
Image
General
Full URL
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEDu7izUiJCvTvCEQjylTGtc&google_cver=1?gdpr=0&gdpr_consent=
Requested by
Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol
HTTP/1.1
Server
99.81.5.109 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-99-81-5-109.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cisco.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

DCS
dcs-prod-irl1-1-v031-0b4a9e24c.edge-irl1.demdex.com UNKNOWN
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-Content-Type-Options
nosniff
X-TID
CvN/HCOfQx8=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
59
Expires
Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

pragma
no-cache
date
Sat, 23 Apr 2022 20:25:52 GMT
server
HTTP server (unknown)
p3p
policyref="https://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR"
location
https://dpm.demdex.net/ibs:dpid=771&dpuuid=CAESEDu7izUiJCvTvCEQjylTGtc&google_cver=1?gdpr=0&gdpr_consent=
cache-control
no-cache, must-revalidate
cross-origin-resource-policy
cross-origin
content-type
text/html; charset=UTF-8
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
314
x-xss-protection
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
adsct
analytics.twitter.com/i/ Frame 77E7
43 B
356 B
Image
General
Full URL
https://analytics.twitter.com/i/adsct?p_user_id=29236393024449588812779296603535861625&p_id=38594
Requested by
Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
104.244.42.195 , United States, ASN13414 (TWITTER, US),
Reverse DNS
Software
tsa_o /
Resource Hash
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
Security Headers
Name Value
Strict-Transport-Security max-age=631138519

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cisco.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

x-response-time
106
date
Sat, 23 Apr 2022 20:25:51 GMT
server
tsa_o
strict-transport-security
max-age=631138519
content-type
image/gif;charset=utf-8
cache-control
no-cache, no-store, max-age=0
x-connection-hash
7d32d9358959404d79d147ad38c00b18f69be11282387169b3c3a427513e1134
content-length
43
s63415170312740
smetrics.cisco.com/b/ss/cisco-complete/10/JS-2.12.0/
927 B
1 KB
Script
General
Full URL
https://smetrics.cisco.com/b/ss/cisco-complete/10/JS-2.12.0/s63415170312740?AQB=1&ndh=1&pf=1&callback=s_c_il[1].doPostbacks&et=1&t=23%2F3%2F2022%2020%3A25%3A52%206%200&d.&nsid=0&jsonv=1&.d&sdid=4038FDBC4EF51AF6-1077CC681E0102A0&mid=23833216641308009283392217193619685112&aamlh=6&ce=UTF-8&ns=cisco&pageName=duo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2Fnaws&g=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&cc=USD&events=event1&aamb=RKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y&c1=%7C%20decipher&h1=duo.com%3Adecipher%3Atrailblazer-hunts-compromised-credentials-in-aws%3Anaws&c2=undefined%3Ano%20iapath%3Anaws&c3=duo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2Fnaws&h3=no%20iapath&c10=12%3A25%20PM%7CSaturday&v10=12%3A25%20PM%7CSaturday&v25=duo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2Fnaws&v26=no%20contenttype&c28=no%20iapath&v28=no%20iapath&c33=en-us&v33=en-us&c41=duo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2Fnaws&c46=ut4.46.202204141432&v48=undefined&c50=cisco-complete&c51=unavailable&c53=no%20contenttype&c59=0180581a2bb600232beab95db30003074004e06c00b08&v63=unavailable&v77=AppMeasurement%3D2.12.0%2CVisitorJS%3D4.1.0%2CMbox%3Dna&v78=dnt%3Dfalse%2Ccookies%3Dtrue%2Clocalstorage%3Dtrue&v92=0.6159354064170788_1650745552043&v98=cisco.duo&v106=23833216641308009283392217193619685112&s=1600x1200&c=24&j=1.6&v=N&k=Y&bw=1600&bh=1200&mcorgid=B8D07FF4520E94C10A490D4C%40AdobeOrg&AQE=1
Requested by
Host: tags.tiqcdn.com
URL: https://tags.tiqcdn.com/utag/cisco/duo/prod/utag.5.js?utv=ut4.46.202204141432
Protocol
H2
Security
TLS 1.3, , AES_128_GCM
Server
13.36.218.177 Paris, France, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-13-36-218-177.eu-west-3.compute.amazonaws.com
Software
jag /
Resource Hash
72e10a966c7b28c6111598c445b3fa5b1f7d11fbf71815f8cc29ad6c996059d4
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff
X-Xss-Protection 1; mode=block

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

x-aam-tid
czVkPK+ITog=
date
Sat, 23 Apr 2022 20:25:52 GMT
x-content-type-options
nosniff
x-c
main-1637.I660130.M0-562
p3p
CP="This is not a P3P policy"
vary
*
content-length
927
x-xss-protection
1; mode=block
dcs
dcs-prod-irl1-2-v031-0267e2bef.edge-irl1.demdex.com UNKNOWN
pragma
no-cache
last-modified
Sun, 24 Apr 2022 20:25:52 GMT
server
jag
xserver
anedge-7b6f4bb9f7-wq2lx
etag
3544949079944036352-4619888269648017549
strict-transport-security
max-age=31536000; includeSubDomains
content-type
application/x-javascript;charset=utf-8
access-control-allow-origin
*
cache-control
no-cache, no-store, max-age=0, no-transform, private
expires
Fri, 22 Apr 2022 20:25:52 GMT
/
www.facebook.com/tr/
44 B
91 B
Image
General
Full URL
https://www.facebook.com/tr/?id=120108061684670&ev=PageView&dl=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&rl=&if=false&ts=1650745552329&sw=1600&sh=1200&v=2.9.57&r=stable&ec=0&o=30&fbp=fb.1.1650745551932.1591478257&it=1650745551700&coo=false&exp=p1&rqm=GET
Requested by
Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Sat, 23 Apr 2022 20:25:52 GMT
last-modified
Fri, 21 Dec 2012 00:00:01 GMT
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
content-type
image/gif
cache-control
no-cache, must-revalidate, max-age=0
cross-origin-resource-policy
cross-origin
content-length
44
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
priority
u=3,i
expires
Sat, 23 Apr 2022 20:25:52 GMT
ibs:dpid=30646
dpm.demdex.net/ Frame 77E7
Redirect Chain
  • https://cms.analytics.yahoo.com/cms?partner_id=ADOBE&_hosted_id=29236393024449588812779296603535861625&gdpr=0&gdpr_consent=
  • https://dpm.demdex.net/ibs:dpid=30646?dpuuid=y-DZakXuRE2pHtMzdYbnmcViJpPIuWSqpaVwk-~A
42 B
945 B
Image
General
Full URL
https://dpm.demdex.net/ibs:dpid=30646?dpuuid=y-DZakXuRE2pHtMzdYbnmcViJpPIuWSqpaVwk-~A
Requested by
Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol
HTTP/1.1
Server
99.81.5.109 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-99-81-5-109.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cisco.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

DCS
dcs-prod-irl1-2-v031-08c1b627a.edge-irl1.demdex.com UNKNOWN
Pragma
no-cache
Strict-Transport-Security
max-age=31536000; includeSubDomains
content-encoding
gzip
X-Content-Type-Options
nosniff
X-TID
vDEHOAKZQlM=
P3P
policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa PSAa PSDa OUR SAMa BUS PUR COM NAV INT"
Cache-Control
no-cache,no-store,must-revalidate,max-age=0,proxy-revalidate,no-transform,private
Connection
keep-alive
Content-Type
image/gif
Content-Length
59
Expires
Thu, 01 Jan 1970 00:00:00 UTC

Redirect headers

date
Sat, 23 Apr 2022 20:25:52 GMT
via
http/1.1 spdc0106.pbp.ir2.yahoo.com (ApacheTrafficServer)
server
ATS
age
0
strict-transport-security
max-age=31536000
content-type
text/html;charset=utf-8
location
https://dpm.demdex.net/ibs:dpid=30646?dpuuid=y-DZakXuRE2pHtMzdYbnmcViJpPIuWSqpaVwk-~A
content-length
0
/
www.facebook.com/tr/ Frame 54A1
0
15 B
Document
General
Full URL
https://www.facebook.com/tr/
Requested by
Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://duo.com
Referer
https://duo.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-origin
https://duo.com
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
0
content-type
text/plain
cross-origin-resource-policy
cross-origin
date
Sat, 23 Apr 2022 20:25:52 GMT
priority
u=0
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
collect
l.clarity.ms/
0
64 B
XHR
General
Full URL
https://l.clarity.ms/collect
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=duo.com
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.120.65.166 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
application/x-clarity-gzip
Referer
https://duo.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

access-control-allow-origin
https://duo.com
date
Sat, 23 Apr 2022 20:25:52 GMT
access-control-allow-credentials
true
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
request-context
appId=cid-v1:e55edbbe-e22b-46b4-8313-9ee2a4e71d12
usermatch.gif
beacon.krxd.net/ Frame 77E7
Redirect Chain
  • https://usermatch.krxd.net/um/v2?partner=adobe&id=29236393024449588812779296603535861625
  • https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=adobe&id=29236393024449588812779296603535861625
0
338 B
Image
General
Full URL
https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=adobe&id=29236393024449588812779296603535861625
Requested by
Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol
H2
Server
52.18.28.177 Dublin, Ireland, ASN16509 (AMAZON-02, US),
Reverse DNS
ec2-52-18-28-177.eu-west-1.compute.amazonaws.com
Software
/
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://cisco.demdex.net/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

date
Sat, 23 Apr 2022 20:25:52 GMT
cache-control
private, no-cache, no-store
x-request-time
D=32 t=1650745552
x-served-by
beacon-n017-dub-prod.krxd.net
p3p
policyref="https://cdn.krxd.net/kruxcontent/p3p.xml", CP="NON DSP COR NID OUR DEL SAM OTR UNR COM NAV INT DEM CNT STA PRE LOC OTC"

Redirect headers

location
https://beacon.krxd.net/usermatch.gif?kuid_status=new&partner=adobe&id=29236393024449588812779296603535861625
date
Sat, 23 Apr 2022 20:25:52 GMT
x-cache-hits
0
x-age
0
content-length
0
x-cache
MISS
x-served-by
usermatch-a004-ash-prod.krxd.net
u
cdn.bizible.com/m/
43 B
144 B
Image
General
Full URL
https://cdn.bizible.com/m/u?mapType=ecid&mapValue=B8D07FF4520E94C10A490D4C%40AdobeOrg_23833216641308009283392217193619685112&_biz_u=3784c6066ff24c18962cf4619cd4dd50&_biz_s=51c712&_biz_l=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&_biz_t=1650745552687&_biz_i=%20%7C%20Decipher&_biz_n=1&a=duo.com&rnd=215845&cdn_o=a&_biz_z=1650745552688
Requested by
Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol
H2
Security
TLS 1.3, , AES_256_GCM
Server
152.195.15.58 , United States, ASN15133 (EDGECAST, US),
Reverse DNS
Software
ECS (frb/6776) /
Resource Hash
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 23 Apr 2022 20:25:52 GMT
last-modified
Thu, 21 Apr 2022 23:59:33 GMT
server
ECS (frb/6776)
age
159979
x-cache
HIT
p3p
CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
cache-control
no-cache, no-store
accept-ranges
bytes
content-type
Image/GIF
content-length
43
expires
-1
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=361da14e9cc9e3c3150a35780c1bec6b&svisitor=2d58655fce170000cf60646208020000576f0200&session=1fd848ae-fdd7-4b53-8a84-aff8e67cc364&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A25%3A52%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A25%3A51%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%221001%22%7D&isIframe=false&m=%7B%22description%22%3A%22Security%20without%20fear.%20The%20web%20doesn%E2%80%99t%20have%20to%20be%20dark.%20Decipher%E2%80%99s%20goal%20is%20to%20bring%20order%20to%20this%20unpredictable%20and%20often%20confusing%20landscape%20by%20providing%20fresh%20perspectives%20from%20trusted%20voices.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%20%7C%20Decipher%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&pageViewId=f721e288-fc54-430a-8566-c2615b5598d4&an_uid=0
Requested by
Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-92-74-202.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Sat, 23 Apr 2022 20:25:52 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Tue, 05 Oct 2021 22:17:52 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"615ccf10-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
/
www.facebook.com/tr/ Frame 3A08
0
15 B
Document
General
Full URL
https://www.facebook.com/tr/
Requested by
Host: duo.com
URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a03:2880:f11c:8183:face:b00c:0:25de Frankfurt am Main, Germany, ASN32934 (FACEBOOK, US),
Reverse DNS
Software
proxygen-bolt /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Security Headers
Name Value
Strict-Transport-Security max-age=31536000; includeSubDomains

Request headers

Content-Type
application/x-www-form-urlencoded
Origin
https://duo.com
Referer
https://duo.com/
Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

access-control-allow-credentials
true
access-control-allow-origin
https://duo.com
alt-svc
h3=":443"; ma=86400, h3-29=":443"; ma=86400
content-length
0
content-type
text/plain
cross-origin-resource-policy
cross-origin
date
Sat, 23 Apr 2022 20:25:52 GMT
priority
u=0
server
proxygen-bolt
strict-transport-security
max-age=31536000; includeSubDomains
c.gif
c.clarity.ms/
Redirect Chain
  • https://c.clarity.ms/c.gif
  • https://c.bing.com/c.gif?CtsSyncId=53E986B609BB443A824C3A445A4D49D1&RedC=c.clarity.ms&MXFR=23383A7EF96D6EE829742BF1FD6D603F
  • https://c.clarity.ms/c.gif?CtsSyncId=53E986B609BB443A824C3A445A4D49D1&MUID=2FAFE1B5AC4169400BC9F03AAD936848
42 B
369 B
Image
General
Full URL
https://c.clarity.ms/c.gif?CtsSyncId=53E986B609BB443A824C3A445A4D49D1&MUID=2FAFE1B5AC4169400BC9F03AAD936848
Protocol
H2
Server
52.142.114.2 Dublin, Ireland, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 23 Apr 2022 20:25:52 GMT
last-modified
Fri, 18 Mar 2022 19:39:54 GMT
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
etag
"8120eaf0ff3ad81:0"
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
cache-control
private, no-cache, proxy-revalidate, no-store
accept-ranges
bytes
content-type
image/gif
content-length
42

Redirect headers

pragma
no-cache
date
Sat, 23 Apr 2022 20:25:53 GMT
accept-ch
Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref
Ref A: 55A04028005E48EABE78A1E2A3052156 Ref B: FRAEDGE1209 Ref C: 2022-04-23T20:25:53Z
x-powered-by
ASP.NET
x-cache
CONFIG_NOCACHE
p3p
CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo"
location
https://c.clarity.ms/c.gif?CtsSyncId=53E986B609BB443A824C3A445A4D49D1&MUID=2FAFE1B5AC4169400BC9F03AAD936848
cache-control
private, no-cache, proxy-revalidate, no-store
content-length
0
collect
www.google-analytics.com/
35 B
55 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j96&a=2142235294&t=event&ni=1&_s=1&dl=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&ul=en-us&de=UTF-8&dt=%7C%20Decipher&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=undefined&ea=undefined&_u=aDDAAAABQAAAAG~&jid=&gjid=&cid=1970540642.1650745552&tid=UA-20141016-1&_gid=395505349.1650745552&gtm=2wg4k0MFPB9D&cd2=1970540642.1650745552&z=298313273
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 23 Apr 2022 13:53:59 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
23514
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
55 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j96&a=2142235294&t=event&ni=1&_s=1&dl=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&ul=en-us&de=UTF-8&dt=%7C%20Decipher&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=CRI%20-%20Scroll%20Tracking&ea=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&el=50%25&_u=aDDAAEABQAAAAG~&jid=&gjid=&cid=1970540642.1650745552&tid=UA-20141016-1&_gid=395505349.1650745552&gtm=2wg4k0MFPB9D&z=1496707971
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 23 Apr 2022 13:53:59 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
23514
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
www.google-analytics.com/
35 B
55 B
Image
General
Full URL
https://www.google-analytics.com/collect?v=1&_v=j96&a=2142235294&t=event&ni=1&_s=1&dl=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&ul=en-us&de=UTF-8&dt=%7C%20Decipher&sd=24-bit&sr=1600x1200&vp=1600x1200&je=0&ec=CRI%20-%20Scroll%20Tracking&ea=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&el=75%25&_u=aDDAAEABQAAAAG~&jid=&gjid=&cid=1970540642.1650745552&tid=UA-20141016-1&_gid=395505349.1650745552&gtm=2wg4k0MFPB9D&z=968605772
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:812::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 23 Apr 2022 13:53:59 GMT
x-content-type-options
nosniff
last-modified
Sun, 17 May 1998 03:00:00 GMT
server
Golfe2
age
23514
content-type
image/gif
access-control-allow-origin
*
cache-control
no-cache, no-store, must-revalidate
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
35
expires
Mon, 01 Jan 1990 00:00:00 GMT
collect
l.clarity.ms/
0
48 B
XHR
General
Full URL
https://l.clarity.ms/collect
Requested by
Host: cdn.bizible.com
URL: https://cdn.bizible.com/scripts/bizible.js?account=duo.com
Protocol
H2
Security
TLS 1.2, ECDHE_RSA, AES_256_GCM
Server
20.120.65.166 Tappahannock, United States, ASN8075 (MICROSOFT-CORP-MSN-AS-BLOCK, US),
Reverse DNS
Software
Microsoft-IIS/10.0 / ASP.NET
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Accept
application/x-clarity-gzip
Referer
https://duo.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

access-control-allow-origin
https://duo.com
date
Sat, 23 Apr 2022 20:25:53 GMT
access-control-allow-credentials
true
server
Microsoft-IIS/10.0
x-powered-by
ASP.NET
request-context
appId=cid-v1:e55edbbe-e22b-46b4-8313-9ee2a4e71d12
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=361da14e9cc9e3c3150a35780c1bec6b&svisitor=2d58655fce170000cf60646208020000576f0200&session=1fd848ae-fdd7-4b53-8a84-aff8e67cc364&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A25%3A53%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A25%3A52%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%222003%22%7D&isIframe=false&m=%7B%22description%22%3A%22Security%20without%20fear.%20The%20web%20doesn%E2%80%99t%20have%20to%20be%20dark.%20Decipher%E2%80%99s%20goal%20is%20to%20bring%20order%20to%20this%20unpredictable%20and%20often%20confusing%20landscape%20by%20providing%20fresh%20perspectives%20from%20trusted%20voices.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%20%7C%20Decipher%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&pageViewId=f721e288-fc54-430a-8566-c2615b5598d4&an_uid=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-92-74-202.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Sat, 23 Apr 2022 20:25:53 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Sat, 05 Jun 2021 07:56:05 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"60bb2e15-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=361da14e9cc9e3c3150a35780c1bec6b&svisitor=2d58655fce170000cf60646208020000576f0200&session=1fd848ae-fdd7-4b53-8a84-aff8e67cc364&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A25%3A54%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A25%3A53%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%223005%22%7D&isIframe=false&m=%7B%22description%22%3A%22Security%20without%20fear.%20The%20web%20doesn%E2%80%99t%20have%20to%20be%20dark.%20Decipher%E2%80%99s%20goal%20is%20to%20bring%20order%20to%20this%20unpredictable%20and%20often%20confusing%20landscape%20by%20providing%20fresh%20perspectives%20from%20trusted%20voices.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%20%7C%20Decipher%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&pageViewId=f721e288-fc54-430a-8566-c2615b5598d4&an_uid=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-92-74-202.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Sat, 23 Apr 2022 20:25:54 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Sat, 05 Jun 2021 07:56:05 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"60bb2e15-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=361da14e9cc9e3c3150a35780c1bec6b&svisitor=2d58655fce170000cf60646208020000576f0200&session=1fd848ae-fdd7-4b53-8a84-aff8e67cc364&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A25%3A55%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A25%3A54%20GMT%22%2C%22timeSpent%22%3A%221004%22%2C%22totalTimeSpent%22%3A%224009%22%7D&isIframe=false&m=%7B%22description%22%3A%22Security%20without%20fear.%20The%20web%20doesn%E2%80%99t%20have%20to%20be%20dark.%20Decipher%E2%80%99s%20goal%20is%20to%20bring%20order%20to%20this%20unpredictable%20and%20often%20confusing%20landscape%20by%20providing%20fresh%20perspectives%20from%20trusted%20voices.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%20%7C%20Decipher%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&pageViewId=f721e288-fc54-430a-8566-c2615b5598d4&an_uid=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-92-74-202.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Sat, 23 Apr 2022 20:25:55 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Sat, 05 Jun 2021 07:56:05 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"60bb2e15-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=361da14e9cc9e3c3150a35780c1bec6b&svisitor=2d58655fce170000cf60646208020000576f0200&session=1fd848ae-fdd7-4b53-8a84-aff8e67cc364&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A25%3A56%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A25%3A55%20GMT%22%2C%22timeSpent%22%3A%221005%22%2C%22totalTimeSpent%22%3A%225014%22%7D&isIframe=false&m=%7B%22description%22%3A%22Security%20without%20fear.%20The%20web%20doesn%E2%80%99t%20have%20to%20be%20dark.%20Decipher%E2%80%99s%20goal%20is%20to%20bring%20order%20to%20this%20unpredictable%20and%20often%20confusing%20landscape%20by%20providing%20fresh%20perspectives%20from%20trusted%20voices.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%20%7C%20Decipher%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&pageViewId=f721e288-fc54-430a-8566-c2615b5598d4&an_uid=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-92-74-202.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Sat, 23 Apr 2022 20:25:56 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Tue, 05 Oct 2021 22:17:52 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"615ccf10-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=361da14e9cc9e3c3150a35780c1bec6b&svisitor=2d58655fce170000cf60646208020000576f0200&session=1fd848ae-fdd7-4b53-8a84-aff8e67cc364&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A25%3A57%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A25%3A56%20GMT%22%2C%22timeSpent%22%3A%221001%22%2C%22totalTimeSpent%22%3A%226015%22%7D&isIframe=false&m=%7B%22description%22%3A%22Security%20without%20fear.%20The%20web%20doesn%E2%80%99t%20have%20to%20be%20dark.%20Decipher%E2%80%99s%20goal%20is%20to%20bring%20order%20to%20this%20unpredictable%20and%20often%20confusing%20landscape%20by%20providing%20fresh%20perspectives%20from%20trusted%20voices.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%20%7C%20Decipher%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&pageViewId=f721e288-fc54-430a-8566-c2615b5598d4&an_uid=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-92-74-202.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Sat, 23 Apr 2022 20:25:57 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Tue, 05 Oct 2021 22:17:52 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"615ccf10-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
collect
analytics.google.com/g/
0
17 B
Ping
General
Full URL
https://analytics.google.com/g/collect?v=2&tid=G-95Z7P6PE75&gtm=2oe4k0&_p=2142235294&_z=ccd.NbB&cid=1970540642.1650745552&ul=en-us&sr=1600x1200&sid=1650745551&sct=1&seg=0&dl=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&dt=%7C%20Decipher&_s=2
Requested by
Host: www.googletagmanager.com
URL: https://www.googletagmanager.com/gtag/js?id=G-95Z7P6PE75&l=dataLayer&cx=c
Protocol
H3
Security
QUIC, , AES_128_GCM
Server
2a00:1450:4001:80f::200e Frankfurt am Main, Germany, ASN15169 (GOOGLE, US),
Reverse DNS
Software
Golfe2 /
Resource Hash
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Request headers

Referer
https://duo.com/
accept-language
de-DE,de;q=0.9
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36
Content-Type
text/plain;charset=UTF-8

Response headers

pragma
no-cache
date
Sat, 23 Apr 2022 20:25:58 GMT
server
Golfe2
content-type
text/plain
access-control-allow-origin
https://duo.com
cache-control
no-cache, no-store, must-revalidate
access-control-allow-credentials
true
cross-origin-resource-policy
cross-origin
alt-svc
h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
content-length
0
expires
Fri, 01 Jan 1990 00:00:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=361da14e9cc9e3c3150a35780c1bec6b&svisitor=2d58655fce170000cf60646208020000576f0200&session=1fd848ae-fdd7-4b53-8a84-aff8e67cc364&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A25%3A58%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A25%3A57%20GMT%22%2C%22timeSpent%22%3A%221005%22%2C%22totalTimeSpent%22%3A%227020%22%7D&isIframe=false&m=%7B%22description%22%3A%22Security%20without%20fear.%20The%20web%20doesn%E2%80%99t%20have%20to%20be%20dark.%20Decipher%E2%80%99s%20goal%20is%20to%20bring%20order%20to%20this%20unpredictable%20and%20often%20confusing%20landscape%20by%20providing%20fresh%20perspectives%20from%20trusted%20voices.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%20%7C%20Decipher%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&pageViewId=f721e288-fc54-430a-8566-c2615b5598d4&an_uid=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-92-74-202.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Sat, 23 Apr 2022 20:25:58 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Sat, 05 Jun 2021 07:56:05 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"60bb2e15-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=361da14e9cc9e3c3150a35780c1bec6b&svisitor=2d58655fce170000cf60646208020000576f0200&session=1fd848ae-fdd7-4b53-8a84-aff8e67cc364&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A25%3A59%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A25%3A58%20GMT%22%2C%22timeSpent%22%3A%221005%22%2C%22totalTimeSpent%22%3A%228025%22%7D&isIframe=false&m=%7B%22description%22%3A%22Security%20without%20fear.%20The%20web%20doesn%E2%80%99t%20have%20to%20be%20dark.%20Decipher%E2%80%99s%20goal%20is%20to%20bring%20order%20to%20this%20unpredictable%20and%20often%20confusing%20landscape%20by%20providing%20fresh%20perspectives%20from%20trusted%20voices.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%20%7C%20Decipher%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&pageViewId=f721e288-fc54-430a-8566-c2615b5598d4&an_uid=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-92-74-202.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Sat, 23 Apr 2022 20:25:59 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Tue, 05 Oct 2021 22:17:52 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"615ccf10-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=361da14e9cc9e3c3150a35780c1bec6b&svisitor=2d58655fce170000cf60646208020000576f0200&session=1fd848ae-fdd7-4b53-8a84-aff8e67cc364&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A26%3A00%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A25%3A59%20GMT%22%2C%22timeSpent%22%3A%221005%22%2C%22totalTimeSpent%22%3A%229030%22%7D&isIframe=false&m=%7B%22description%22%3A%22Security%20without%20fear.%20The%20web%20doesn%E2%80%99t%20have%20to%20be%20dark.%20Decipher%E2%80%99s%20goal%20is%20to%20bring%20order%20to%20this%20unpredictable%20and%20often%20confusing%20landscape%20by%20providing%20fresh%20perspectives%20from%20trusted%20voices.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%20%7C%20Decipher%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&pageViewId=f721e288-fc54-430a-8566-c2615b5598d4&an_uid=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-92-74-202.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Sat, 23 Apr 2022 20:26:00 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Tue, 05 Oct 2021 22:17:52 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"615ccf10-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=361da14e9cc9e3c3150a35780c1bec6b&svisitor=2d58655fce170000cf60646208020000576f0200&session=1fd848ae-fdd7-4b53-8a84-aff8e67cc364&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A26%3A01%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A26%3A00%20GMT%22%2C%22timeSpent%22%3A%221002%22%2C%22totalTimeSpent%22%3A%2210032%22%7D&isIframe=false&m=%7B%22description%22%3A%22Security%20without%20fear.%20The%20web%20doesn%E2%80%99t%20have%20to%20be%20dark.%20Decipher%E2%80%99s%20goal%20is%20to%20bring%20order%20to%20this%20unpredictable%20and%20often%20confusing%20landscape%20by%20providing%20fresh%20perspectives%20from%20trusted%20voices.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%20%7C%20Decipher%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&pageViewId=f721e288-fc54-430a-8566-c2615b5598d4&an_uid=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-92-74-202.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Sat, 23 Apr 2022 20:26:01 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Fri, 21 Feb 2020 18:57:20 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"5e502810-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT
img.gif
b.6sc.co/v1/beacon/
43 B
774 B
Image
General
Full URL
https://b.6sc.co/v1/beacon/img.gif?token=361da14e9cc9e3c3150a35780c1bec6b&svisitor=2d58655fce170000cf60646208020000576f0200&session=1fd848ae-fdd7-4b53-8a84-aff8e67cc364&event=active_time_track&q=%7B%22currentTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A26%3A04%20GMT%22%2C%22lastTrackTime%22%3A%22Sat%2C%2023%20Apr%202022%2020%3A26%3A01%20GMT%22%2C%22timeSpent%22%3A%223004%22%2C%22totalTimeSpent%22%3A%2213036%22%7D&isIframe=false&m=%7B%22description%22%3A%22Security%20without%20fear.%20The%20web%20doesn%E2%80%99t%20have%20to%20be%20dark.%20Decipher%E2%80%99s%20goal%20is%20to%20bring%20order%20to%20this%20unpredictable%20and%20often%20confusing%20landscape%20by%20providing%20fresh%20perspectives%20from%20trusted%20voices.%22%2C%22keywords%22%3A%22%22%2C%22title%22%3A%22%20%7C%20Decipher%22%7D&cb=&r=&thirdParty=%7B%7D&v2=1&pageURL=https%3A%2F%2Fduo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2FnAWS&pageViewId=f721e288-fc54-430a-8566-c2615b5598d4&an_uid=0
Protocol
HTTP/1.1
Security
TLS 1.3, , AES_256_GCM
Server
104.92.74.202 Frankfurt am Main, Germany, ASN16625 (AKAMAI-AS, US),
Reverse DNS
a104-92-74-202.deploy.static.akamaitechnologies.com
Software
nginx/1.14.0 (Ubuntu) /
Resource Hash
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
Security Headers
Name Value
X-Content-Type-Options nosniff

Request headers

accept-language
de-DE,de;q=0.9
Referer
https://duo.com/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/100.0.4896.127 Safari/537.36

Response headers

Date
Sat, 23 Apr 2022 20:26:05 GMT
X-Content-Type-Options
nosniff
Connection
keep-alive
Content-Length
43
Pragma
no-cache
Last-Modified
Sat, 05 Jun 2021 07:56:05 GMT
Server
nginx/1.14.0 (Ubuntu)
ETag
"60bb2e15-2b"
Access-Control-Max-Age
86400
Access-Control-Allow-Methods
GET,POST
Content-Type
image/gif
Access-Control-Allow-Origin
Cache-Control
private, no-cache, no-cache=Set-Cookie, proxy-revalidate
Access-Control-Allow-Credentials
true
Accept-Ranges
bytes
Access-Control-Allow-Headers
*
Expires
Wed, 19 Apr 2000 11:43:00 GMT

Verdicts & Comments Add Verdict or Comment

363 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

object| 0 object| 1 function| structuredClone object| oncontextlost object| oncontextrestored function| getScreenDetails object| dataLayer function| submitForm function| $ function| jQuery function| getUrlVar function| isInputEmpty function| getUrlParam function| lottieAnimate function| handleGDPRsetup function| getipinfo function| handleGDPRfields function| MktoValidateEmail function| scrollToHelper function| setUpEbookFilter function| setUpCaseStudiesFilter function| setUpSearch function| handleSearch function| clearSearch function| setUpSelectedOptionsList function| handleSelectedOptionsList function| clearAllSelectedOptions function| unsetValue function| setUpFilterGroups function| handleFilter function| clearAllFilters function| filterItemsByTag function| getLabel function| getValues function| showHideClearAll function| showHideNoResultsMessage function| simpleToggle function| vis_isInViewport function| vis_startScrollEvt_isElemVisible function| renderD3_barChartHoriz function| renderD3_barChartVert function| renderD3_groupedBarChartVert function| renderD3_lineChart function| renderD3_choropleth function| renderD3 function| nav__desktopHoverintent function| nav__mobileDropdowns function| nav__desktopKeyboard function| nav__closeDropdowns function| nav__openDropdown function| nav__drawer function| nav__openDrawer function| nav__closeDrawer function| nav__hashChange function| getScrollByOffset function| List object| _self object| Prism object| typescript string| fingerprint object| pressOptions object| pressList object| nav object| drawer function| Cookies function| Fingerprint2 function| hoverintent object| lottie object| bodymovin function| jQueryBridget function| EvEmitter function| getSize function| matchesSelector object| fizzyUIUtils function| Outlayer function| Masonry object| html5 object| Modernizr function| FontFaceObserver object| google_tag_manager function| postscribe object| google_tag_manager_external object| google_tag_data string| GoogleAnalyticsObject function| ga string| _linkedin_data_partner_id object| _uxa function| fbq function| _fbq object| uetq object| ezt object| _6si object| ctmsRequire object| rulesLib object| XdUtils object| xdLocalStorage object| ctm object| cdc object| trackEvent object| search_reveal object| search_input string| search_label_class string| search_btn_class string| search_active_class object| katexElems function| isCookieEnabled function| isSSEnabled function| isLSEnabled function| isDNTEnabled function| getFirstPaintIE function| getFirstPaintCh function| getFirstPaintOther function| getFirstPaint function| sendPerformancePost function| getPerformance function| writePerformanceData function| retrievePerformanceData function| sendPerformanceOnExit function| savePerformanceData function| processPerfData function| performanceInit object| cdcPerformance object| visitConfig string| ctm_disbable_auto_track string| appKey string| s_wgw string| attendeeId object| utag_data object| omsStorage object| videoMetrics boolean| cdtmLoaded function| quantserve function| __qc object| _qevents object| _qoptions function| qtrack object| Bizible object| BizTrackingA object| BizA object| _vis_opt_queue object| LC_API function| lintrk boolean| _already_called_lintrk object| CS_CONF object| CS_INTEGRATIONS_CONF object| CSPureWindow function| csDate object| csJSON function| csArray function| csString function| csURL function| csMutationObserver object| csScreen function| csNodechildNodes function| csNodeparentNode function| csNodenextSibling function| csNodefirstChild function| csElementshadowRoot function| csEventtarget object| CSPathComputation object| UXAnalytics object| gaGlobal function| onYouTubeIframeAPIReady object| Metadata function| UET function| UET_init function| UET_push object| ueto_fd5866ed0d function| getJSON number| pid string| jsonPath object| gaplugins object| google_optimize object| gaData boolean| utag_condload boolean| isCtmsRequireLoaded boolean| isCdtmLoaded boolean| isCtmsLoaded object| sensorConfigObj function| aMap_region_bkp undefined| btnNodes string| isPerformanceActive object| utag string| e function| AppMeasurement_Module_AudienceManagement function| s_getLoadTime function| addTealiumMetricsRules object| utag_cfg_ovrd boolean| sc_fire boolean| isHomePage boolean| runOnce_activityMap boolean| elqpzn_runOnce string| srcInfoData number| s_loadT object| ctms function| isSpecialLinkClick object| vpsService function| getKeycodePath function| getCmpPath string| categoryLevel1 string| categoryLevel2 string| categoryLevel3 string| categoryLevel4 string| channel function| getLanguageCountry function| getTheater function| getPageName function| getPrevpage function| getCampaign function| getCampaignPosition function| getScreenWidth function| getKeyword function| getAccessLevel function| getLoc function| getContentType function| getAgencyFull function| getKeyCode function| getCookieLength function| flattenObject function| getConversionForUnica function| getNewRepeatForUnica function| getHinav function| getSiteArea function| searchCharCount function| getLid function| getLpos function| getLtext function| getButtonText function| getLinkValue function| mapDataToDatalayer function| isOmsConversion function| setLinkOmsData function| isDownloadable function| getLtype function| isGrsForm function| isCampaign function| isKeycode function| isCampaignClickThro function| isCampaignClickPast function| isKeycodeClickThro function| isKeycodeClickPast function| isPageLoad function| setPageLoadFalse function| grsComplete function| isClickToChat function| isExitByDomain function| isExit function| isJsAtZeroIndex function| isOnDemand function| isFgeLinkClick function| isLetUsHelpLinkClick function| updateBWithLinkData function| normalizeMetricsObj function| updateBWithMetrics function| makeUnicaCallOnly function| makeSCnUnicaCalls function| getImageLinkText function| lookForAttributes function| isJumplink string| eachLevel number| f function| buttonHandler object| prodDomains boolean| isProdDomain function| isLandingPage function| isThankyouPage string| c object| adobe function| Visitor object| s_c_il number| s_c_in function| DIL function| mktoMunchkinFunction object| Munchkin function| mktoMunchkin string| O0000OO string| NTPT_IMGSRC_CUSTOM object| MunchkinTracker undefined| MktoForms2 string| NTPT_IMGSRC boolean| NTPT_NOINITIALTAG object| NTPT_FLDS number| NTPT_MAXTAGWAIT string| NTPT_HTTPSIMGSRC boolean| NTPT_GLBLREFTOP boolean| NTPT_SET_IDCOOKIE string| NTPT_IDCOOKIE_NAME string| NTPT_GLBLEXTRA string| NTPT_IDCOOKIE_DOMAIN object| NTPT_GLBLCOOKIES object| q_temp object| q function| OOOO000 function| OOOO00 function| O00000O object| O00OOO function| OOOOOO0 function| O0O000O function| OO0OO function| OO0O000 function| O000O00 function| O00OO function| O0OO0O0 function| OOO0000 function| O000000 function| OOO00OO function| OO0O0OO function| O0O00O0 function| OOOOO0O function| OO00OO function| O0O0OO function| O00OO0O function| O000OO0 object| OO000 object| O00OO0 object| OOOO0O boolean| OOO00O0 string| OO0OO0 string| OO00O00 number| OO0OOOO string| O00O00O boolean| O0OO000 boolean| OO00000 function| ntptAddPair function| ntptDropPair function| ntptEventTag function| ntptLinkTag function| ntptSubmitTag object| OOO00 object| OOOOO0 object| OOOO0 number| O0000 object| LnkLck object| FrmLck string| OOO0OO string| OOO0O string| OO0O0 object| O0O00O number| O0O00 undefined| O0OO00 string| O0000O object| O0OO0 boolean| O00O0OO number| O0O0O0 object| O00O0 string| O0OOO0 string| OO00O object| activityConfig object| activityMonitor string| mbv string| vjs object| s function| AppMeasurement function| s_gi function| s_pgicq function| AppMeasurement_Module_Integrate function| AppMeasurement_Module_ActivityMap number| s_objectID number| s_giq function| clarity object| visitor function| doPluginsAddOn object| s_i_cisco-complete

59 Cookies

Domain/Path Name / Value
.duo.com/ Name: _gcl_au
Value: 1.1.71469800.1650745551
.6sc.co/ Name: 6suuid
Value: 2d58655fce170000cf60646208020000576f0200
.bing.com/ Name: MUID
Value: 2FAFE1B5AC4169400BC9F03AAD936848
.duo.com/ Name: _biz_uid
Value: 3784c6066ff24c18962cf4619cd4dd50
.duo.com/ Name: _biz_sid
Value: 51c712
.bizible.com/ Name: _BUID
Value: 3784c6066ff24c18962cf4619cd4dd50
.bizibly.com/ Name: _BUID
Value: ef19f92b6a92b6c5ebdf588f22909aac
.duo.com/ Name: _uetsid
Value: 91c8f950c34311ec85d84fdc6f60f7db
.duo.com/ Name: _uetvid
Value: 91c93040c34311ec97e4093ff0b1c453
.duo.com/ Name: _ga
Value: GA1.2.1970540642.1650745552
.duo.com/ Name: _gid
Value: GA1.2.395505349.1650745552
.duo.com/ Name: _gat_UA-20141016-1
Value: 1
.duo.com/ Name: _dc_gtm_UA-20141016-1
Value: 1
duo.com/ Name: _an_uid
Value: 0
duo.com/ Name: _gd_visitor
Value: 5be5805d-c90e-45cb-8a54-4c6805572a3f
duo.com/ Name: _gd_session
Value: 1fd848ae-fdd7-4b53-8a84-aff8e67cc364
duo.com/ Name: _gd_svisitor
Value: 2d58655fce170000cf60646208020000576f0200
.quantserve.com/ Name: mc
Value: 626460cf-cdc47-df073-24844
.duo.com/ Name: _cs_c
Value: 1
.duo.com/ Name: _cs_id
Value: 2102bbfc-9992-aab2-e650-4ec6c651b846.1650745551.1.1650745551.1650745551.1627413105.1684909551858
.duo.com/ Name: _cs_s
Value: 1.0.0.1650747351860
.duo.com/ Name: _mkto_trk
Value: id:074-UQX-410&token:_mch-duo.com-1650745551866-32900
.duo.com/ Name: __qca
Value: P0-569987462-1650745551833
.duo.com/ Name: utag_main
Value: v_id:0180581a2bb600232beab95db30003074004e06c00b08$_sn:1$_se:1$_ss:1$_st:1650747351799$ses_id:1650745551799%3Bexp-session$_pn:1%3Bexp-session$vapi_domain:duo.com$ctm_ss:true%3Bexp-session
.csxd.contentsquare.net/ Name: _cs_id___5637
Value: 2102bbfc-9992-aab2-e650-4ec6c651b846.1650745551.1.1650745551.1650745551.1627413105.1684909551858
.csxd.contentsquare.net/ Name: _cs_s___5637
Value: 1.0.0.1650747351860
.duo.com/ Name: _fbp
Value: fb.1.1650745551932.1591478257
.demdex.net/ Name: demdex
Value: 29236393024449588812779296603535861625
.duo.com/ Name: AMCVS_B8D07FF4520E94C10A490D4C%40AdobeOrg
Value: 1
.duo.com/ Name: _cs_mk
Value: 0.6159354064170788_1650745552043
.linkedin.com/ Name: UserMatchHistory
Value: AQJdqFvfPZhEfQAAAYBYGi1KRe-tyScpLgBYi18tbzBAlOxJjPb3o7xzvojJvQSv1g4t5hc0p0be0A
.linkedin.com/ Name: AnalyticsSyncHistory
Value: AQL3voDYlQKTTgAAAYBYGi1KDbfBL4Wrp5zgtPLfdiTFtLeTDG6v5UVBEYdgxg6mw_zyR-YErsXvh2Nk2vnsAQ
.ads.linkedin.com/ Name: lang
Value: v=2&lang=en-us
.linkedin.com/ Name: bcookie
Value: "v=2&c0be038e-9d39-4409-85a6-11877dd571d9"
.linkedin.com/ Name: lidc
Value: "b=TGST04:s=T:r=T:a=T:p=T:g=2701:u=1:x=1:i=1650745552:t=1650831952:v=2:sig=AQEohMqXAqTwtQ3MnshqiEs5YmgRIDK4"
.duo.com/ Name: AMCV_B8D07FF4520E94C10A490D4C%40AdobeOrg
Value: 281789898%7CMCIDTS%7C19106%7CMCMID%7C23833216641308009283392217193619685112%7CMCAAMLH-1651350352%7C6%7CMCAAMB-1651350352%7CRKhpRz8krg2tLO6pguXWp5olkAcUniQYPHaMWWgdJ3xzPWQmdj0y%7CMCOPTOUT-1650752752s%7CNONE%7CMCAID%7CNONE%7CvVersion%7C4.1.0
.duo.com/ Name: gpv_v9
Value: duo.com%2Fdecipher%2Ftrailblazer-hunts-compromised-credentials-in-aws%2Fnaws
.duo.com/ Name: s_cc
Value: true
.duo.com/ Name: aam_uuid
Value: 29236393024449588812779296603535861625
.duo.com/ Name: _clck
Value: 14g7h8|1|f0v|0
.doubleclick.net/ Name: IDE
Value: AHWqTUmEcRt5ldrW0Y6MZwVogowUcN9OH3h8hyZStNm-2DiXC2jTzZ211rNWifVoU30
.linkedin.com/ Name: lang
Value: v=2&lang=de-de
.www.linkedin.com/ Name: bscookie
Value: "v=1&2022042320255211a999d2-d4bf-43b9-8608-85ea18c64bf5AQHvsmxJTwdTaubS7LlY1Jf9lZvyYoHK"
.linkedin.com/ Name: li_gc
Value: MTswOzE2NTA3NDU1NTI7MjswMjHBUhdx1F1+o03cIGnqe9KTaLNZ5zKEIHKX/PgSku2ZMg==
.dpm.demdex.net/ Name: dpm
Value: 29236393024449588812779296603535861625
.demdex.net/ Name: dextp
Value: 771-1-1650745552200|1123-1-1650745552301|30646-1-1650745552408|66757-1-1650745552509
.duo.com/ Name: _clsk
Value: 1jeoeye|1650745552590|1|1|l.clarity.ms/collect
.yahoo.com/ Name: A3
Value: d=AQABBNBgZGICEHEpiHCkEjVSrRfWyEbgbII&S=AQAAAm5BsiLLIMtSS7DGNXY4RpA
.twitter.com/ Name: personalization_id
Value: "v1_tH9Nlnu+lZLOkN6eUkXIGA=="
.duo.com/ Name: _biz_nA
Value: 2
.duo.com/ Name: _biz_flagsA
Value: %7B%22Version%22%3A1%2C%22ViewThrough%22%3A%221%22%2C%22XDomain%22%3A%221%22%2C%22Ecid%22%3A%22-2045636937%22%7D
.duo.com/ Name: _biz_pendingA
Value: %5B%5D
.krxd.net/ Name: _kuid_
Value: Oy9ZwJ8w
.duo.com/ Name: s_ptc
Value: 0%5E%5E1%5E%5E37%5E%5E26%5E%5E1956%5E%5E1%5E%5E2402%5E%5E3%5E%5E4429
.duo.com/ Name: _ga_95Z7P6PE75
Value: GS1.1.1650745551.1.0.1650745553.58
.c.bing.com/ Name: SRM_B
Value: 2FAFE1B5AC4169400BC9F03AAD936848
.c.clarity.ms/ Name: SM
Value: C
.clarity.ms/ Name: MUID
Value: 2FAFE1B5AC4169400BC9F03AAD936848
.c.clarity.ms/ Name: ANONCHK
Value: 0

2 Console Messages

Source Level URL
Text
network error URL: https://duo.com/decipher/trailblazer-hunts-compromised-credentials-in-aws/nAWS
Message:
Failed to load resource: the server responded with a status of 404 ()
network error URL: https://duo.com/public/json-bodymovin/d-logo-light/data.json
Message:
Failed to load resource: the server responded with a status of 404 ()

Indicators

This is a term in the security industry to describe indicators such as IPs, Domains, Hashes, etc. This does not imply that any of these indicate malicious activity.

074-uqx-410.mktoresp.com
ajax.googleapis.com
analytics.google.com
analytics.twitter.com
b.6sc.co
bat.bing.com
beacon.krxd.net
c.6sc.co
c.bing.com
c.clarity.ms
c.contentsquare.net
cdn.bizible.com
cdn.bizibly.com
cisco-tags.cisco.com
cisco.demdex.net
cm.g.doubleclick.net
cms.analytics.yahoo.com
connect.facebook.net
csxd.contentsquare.net
dpm.demdex.net
duo.com
j.6sc.co
jscloud.net
l.clarity.ms
metadata-static-files.sfo2.cdn.digitaloceanspaces.com
munchkin.marketo.net
pixel.quantserve.com
px.ads.linkedin.com
px4.ads.linkedin.com
rules.quantcount.com
secure.adnxs.com
secure.quantserve.com
smetrics.cisco.com
snap.licdn.com
stats.g.doubleclick.net
t.contentsquare.net
tags.tiqcdn.com
usermatch.krxd.net
www.cisco.com
www.facebook.com
www.google-analytics.com
www.google.com
www.google.de
www.googletagmanager.com
www.linkedin.com
104.244.42.195
104.92.72.193
104.92.74.202
13.107.42.14
13.225.80.94
13.36.218.177
142.250.186.34
152.195.15.58
18.66.112.26
185.33.220.240
192.28.147.68
20.120.65.166
205.185.216.42
212.82.100.182
2600:9000:2057:4800:1b:ed91:4680:93a1
2600:9000:2156:4200:6:44e3:f8c0:93a1
2606:4700:20::ac43:48ae
2620:116:800d:21:fcb8:22d2:d390:5f1b
2620:1ec:22::14
2620:1ec:c11::200
2a00:1450:4001:80f::2003
2a00:1450:4001:80f::200e
2a00:1450:4001:811::2008
2a00:1450:4001:812::200e
2a00:1450:4001:831::2004
2a00:1450:400c:c06::9c
2a00:1450:4014:80b::200a
2a02:26f0:3500:88d::b33
2a02:26f0:ef::5c7b:c25a
2a03:2880:f01c:216:face:b00c:0:3
2a03:2880:f11c:8183:face:b00c:0:25de
34.227.211.111
52.142.114.2
52.18.28.177
52.49.218.107
54.72.196.102
72.163.10.10
95.100.208.216
99.81.5.109
086f1c868f8f769ef0039b238b415fc3c46d97e342309dc8c61cefb40868212e
0a998ab5472475c3418c7977b6214c566aad928094dceb86d2e9f53bdbdd26c0
0cd5cf7846bd2a36245c0dbb389b7ce1c76a09e251b624a466700887ca0cd317
0d66ef0aee9b4719486242281cd0add74dbec97893bc8e61c27b6e84d28f9391
10d8d42d73a02ddb877101e72fbfa15a0ec820224d97cedee4cf92d571be5caa
10dfb21244c78df328ae9cff5429f822f5244e8d90c1efe5c26cc851d7a12f24
12cefaf738029b6d8ff15cf04eb1db85f52a11492bf2a83df9717de21ce40ff7
1403c3e4df327d10852ab8a27fdc49f911d3a55bf0c8892c0fd6f5ed6de2d1d7
14f2ec002b176e0dee403cb7dd4ef2274a1353080e1e3e4084678770f4c15b9c
1d48d4cabc9c195baa08e42be70679688d706970ddd862bd91b857109d2a8874
22642f202577f0ba2f22cbe56b6cf291a09374487567cd3563e0d2a29f75c0c5
22b6980432a6921ed17c090fcce9c581a6bbca8eeba48476f9e2b4b948beb520
2707e48726a3f7ec48a1d1aec9738f20b36bac1535cfa9de2e4d92310c4e7e7a
27d6fba6ad31a91fa31d69869c76b901f4eab1b2d3daede85479097c04c605c0
31b45c462302ac175bfa43f9e5591491db780ca094f6ecdd2907f25ad578448d
34c727e51a6df37234ce8086a0b56b8c62ce12b2a765a198f4c0f9dd8791d6c9
4adefd63c0816744b24f5f7c63c2ab245eb000b310fe05fb998cfccb98bad0cb
565339bc4d33d72817b583024112eb7f5cdf3e5eef0252d6ec1b9c9a94e12bb3
694b5d6220eb8a349b60ce749052c3b923c8449bbfb4ebfb68f4fc27f1b7e92b
6a6d2038fc6ca01db16d2c528375510be154e1214cc694a6332d85a798fb4711
72e10a966c7b28c6111598c445b3fa5b1f7d11fbf71815f8cc29ad6c996059d4
7b0ecec68b62045e0ed6b268e1548263ab7f315f414873da05632849ae287968
7bea17a80a61ed0f54248b4ffc4c718f7c8ff2619742577a73591d62ce074da8
82987c0cc9955a62a0f39457179cc41438567909f2ea0b3d18d05f26e3842c9c
8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
849b2ac11460487810a7132803d8680307e25126ba000a30b4775ed3e78201be
84e01419bd81f32ac6df0f75f49c604fda9172000a3ae432b3c47b2a6a712d80
8540c5e2d2e85cc6c5d46b1b06b7f6642dce39e0314299a08976cfe6053c7c52
8c685072fb706b91373f00500a93bfe2ba8f1130468d8851ab0d4314340fed0d
8d6580af877387b05d9ffac3ebeacfe25a7728c77adef6d9b32fd72ccbe21468
956db35bd22bc613b96a763ae81a3d52ec66fd471d0ffac2bb3f324d9e27a0a8
96c5bfab045aceeb52ae2daa17605f436dd4ab9be43bbc87ac3debdbc9768ffb
99c2917ee5b2a01459a923bdd1c676f15ee73b62b87f696e6735312d26f51e12
a0d3a0aff7dc3bf32d2176fc3dcda6e7aba2867c4f4d1f7af6355d2cfc6c44f8
a1925038db769477ab74b4df34350c35688a795bb718727b0f4292a4a78a6210
a2c2339691fc48fbd14fb307292dff3e21222712d9240810742d7df0c6d74dfb
aaddb9b9a1d45c5de508e64c3dace01f450e4a7521229e99f03838f5067cc8f9
ac8778041fdb7f2e08ceb574c9a766247ea26f1a7d90fa854c4efcf4b361a957
afe0dcfca292a0fae8bce08a48c14d3e59c9d82c6052ab6d48a22ecc6c48f277
b1abd3b01e2c2b7089605b10d8c565730201eb2cb6e800188b2c6b68fe657289
b2021fe9b1f8b7e7bb44e57c5aed88f45cab8b7a0e84f39b7e472277361f1da5
b96b64444f7d52c39b5716fe4d3e8d0433c67fb79731a4400188835d97b74bce
b9a30fc3aae53b1ec17fd01ab60fd6fd09dfc4ad82967fd11e0c024bad354587
c2aee78040b4ed46c2377e6825db12a9691a2eb584adf338e77312c8978d8537
c33592c7a249c98164b3d533c58fae62ced2b403deab8f2d0cce4c4f1cbb285d
c5028b9a532fb2423ea0b8cd61837102ba21bf6e3e749b90232fd4f0258cc707
c72062a60866c674a25f2a5b5d8344e9509c7381a6472f2a484325ac14597ee8
ca63193ce799e4e00c9106349365981dc6e26cb77632ebf5df23dffba2aaccfa
cbda94666db24554bf77638fc059848d381c3c98f7f24641fa830abcd5793de7
ccd5ccffdeefbc9a639364df7ce84211878f3a7413fe908939dd6df65bc25eb6
d1a9abb0dc96d5a0fcc121a6de3a2c29c193a91d2f68939080e111b54d01d9e8
d8b2f6ab3701d3ae42d7519c2798c137b53f31c835a6c16df02a6274beac83d0
d9218d98cd999ad151e3b5ff5e2d7021b93f1c806c49ffc1f60a3f476d64747e
da5d487f1fe8c4f5bba93bab0b071aed1249cf770ffdbc0144a86a4c2bae3c2c
dcecab1355b5c2b9ecef281322bf265ac5840b4688748586e9632b473a5fe56b
de3246094525b21a870fc7d2a67490d0132535c6fa5993755c549f1a9d1bd8af
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
e8e74813d3382d7453da81f7037183bb926aa06ce68021ba6b55f01d20d0f205
e9f76eabead93f85fc4dc190dca4b1419dcd76b57b1c22649856b01d3ac2536e
ebb4d3109b96ab757bdf0be76f9b0a583086cc032d48b128d8f636da082ca048
ede067783c02098828dfe0bda385a9913ff79006eb2cd1a406bcc18e66cd7bad
ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629